@objectstack/lint 17.0.0-rc.5 → 17.0.0

package/dist/index.d.ts

@@ -1,7 +1,7 @@
 import { Manifest } from '@objectstack/sdui-parser';
 import { Options } from 'ajv';
-import { AccessMatrix } from '@objectstack/spec/security';
-export { A as AUTHORING_COMMANDS, a as AUTHORING_RULES, b as AUTHORING_SURFACES, c as AuthoringCommand, d as AuthoringFinding, e as AuthoringRule, f as AuthoringRuleContext, g as AuthoringRuleInputTier, h as AuthoringRuleRun, i as AuthoringRuleTier, j as AuthoringSeverity, k as AuthoringSurface, E as EXPRESSION_INVALID, R as RuntimeGateResult, l as RuntimeStackContext, m as authoringRulesFor, r as runAuthoringRules, n as runRuntimeAuthoringRules, o as runtimeAuthoringRulesFor, p as runtimeGatedTypes, s as splitBySeverity, q as stackKeyForType } from './runtime-Cs64ShwN.js';
+import { AccessMatrixParsed } from '@objectstack/spec/security';
+export { A as AUTHORING_COMMANDS, a as AUTHORING_RULES, b as AUTHORING_SURFACES, c as AuthoringCommand, d as AuthoringFinding, e as AuthoringRule, f as AuthoringRuleContext, g as AuthoringRuleInputTier, h as AuthoringRuleRun, i as AuthoringRuleTier, j as AuthoringSeverity, k as AuthoringSurface, E as EXPRESSION_INVALID, R as RuntimeGateResult, l as RuntimeStackContext, m as authoringRulesFor, n as buildRuntimeWriteSnapshots, r as runAuthoringRules, o as runRuntimeAuthoringRules, p as runtimeAuthoringRulesFor, q as runtimeGatedTypes, s as splitBySeverity, t as stackKeyForType } from './runtime-H-nDodRy.js';
 
 /**
  * Build-time dashboard widget binding diagnostics (issues #1719, #1721).
@@ -68,6 +68,14 @@ export { A as AUTHORING_COMMANDS, a as AUTHORING_RULES, b as AUTHORING_SURFACES,
  *   single-form cutover removed. The dashboard renderer routes dataset-bound
  *   widgets through `DatasetWidget` and never reads these, so they are a
  *   silent no-op. Steers the author onto `dataset`+`dimensions`+`values`.
+ * - `dashboard-filter-field-unprovisioned` (#8340) — the filter's effective
+ *   field RESOLVES (it is a registry-injected system column, so
+ *   `dashboard-filter-field-unknown` above rightly stays silent) but the bound
+ *   object is ADR-0015 `external`, where the platform registers the anchor and
+ *   provisions no storage for it. The filter is still ANDed into the query, so
+ *   the widget renders empty instead of crashing — the silent-degradation half
+ *   of the same invariant, warned rather than errored because this pass cannot
+ *   see the remote schema (#8116's severity reasoning).
  *
  * Warnings can be deliberately suppressed per widget via
  * `suppressWarnings: ['<rule-id>']`; errors cannot — they describe a
@@ -83,6 +91,7 @@ declare const MEASURE_AGGREGATE_INCOHERENT = "measure-aggregate-incoherent";
 declare const WIDGET_LEGACY_ANALYTICS_SHAPE = "widget-legacy-analytics-shape";
 declare const WIDGET_LEGACY_ANALYTICS_UNRENDERABLE = "widget-legacy-analytics-unrenderable";
 declare const DASHBOARD_FILTER_FIELD_UNKNOWN = "dashboard-filter-field-unknown";
+declare const DASHBOARD_FILTER_FIELD_UNPROVISIONED = "dashboard-filter-field-unprovisioned";
 type WidgetBindingSeverity = 'error' | 'warning';
 interface WidgetBindingFinding {
     /** `error` = unresolvable binding (broken page); `warning` = advisory. */
@@ -98,7 +107,7 @@ interface WidgetBindingFinding {
     /** How to fix (or deliberately suppress) it. */
     hint: string;
 }
-type AnyRec$E = Record<string, unknown>;
+type AnyRec$F = Record<string, unknown>;
 /**
  * Validate every dashboard widget's dataset binding. Returns the list of
  * findings (empty = clean). Caller decides how to surface them: `error`
@@ -106,7 +115,7 @@ type AnyRec$E = Record<string, unknown>;
  * should fail validate/build; `warning` findings are advisory and must
  * never fail the build on their own.
  */
-declare function validateWidgetBindings(stack: AnyRec$E): WidgetBindingFinding[];
+declare function validateWidgetBindings(stack: AnyRec$F): WidgetBindingFinding[];
 
 interface ExprIssue {
     where: string;
@@ -119,12 +128,12 @@ interface ExprIssue {
      */
     severity?: 'error' | 'warning';
 }
-type AnyRec$D = Record<string, unknown>;
+type AnyRec$E = Record<string, unknown>;
 /**
  * Validate every predicate in the stack. Returns the list of issues (empty =
  * clean). Caller decides how to surface / whether to fail the build.
  */
-declare function validateStackExpressions(stack: AnyRec$D): ExprIssue[];
+declare function validateStackExpressions(stack: AnyRec$E): ExprIssue[];
 
 /**
  * The corrective sentence, lifted **verbatim** from `unevaluableRuleError` in
@@ -204,6 +213,95 @@ type NullGuardOutcome =
  */
 declare function nullGuardMessage(subject: string, objectName: string | undefined, finding: NullGuardFinding, outcome?: NullGuardOutcome): string;
 
+/**
+ * A verdict about an open capability vocabulary, recorded during a phase in
+ * which a plugin can still contribute to it.
+ */
+declare const STARTUP_OPEN_VOCABULARY_VERDICT = "startup-open-vocabulary-verdict";
+/**
+ * The diagnostic at such a site asserts a terminal outcome about a world that
+ * has not finished forming. Emitted only where
+ * {@link STARTUP_OPEN_VOCABULARY_VERDICT} already fired.
+ */
+declare const STARTUP_VERDICT_ASSERTIVE_WORDING = "startup-verdict-assertive-wording";
+/**
+ * Accessors that read a capability vocabulary a plugin can still extend.
+ *
+ * Each entry names WHY the answer is not final; the note travels into the
+ * finding so the author reads the consequence rather than a rule id.
+ *
+ * Matched on the accessor NAME rather than on a `this.<registry>` property,
+ * which is what lets a consumer in another package be seen at all — the CI
+ * gate's Rule B is keyed on the two property names the owning class uses, so a
+ * caller that reaches the same vocabulary through its public accessor is
+ * invisible to it. Keyed lookups that ask about ONE item and dispatch on the
+ * answer (`registry.get(type)`, `registry.has(type)`) are deliberately absent:
+ * that is how the runtime legitimately resolves work, and reading it as a
+ * startup verdict is exactly the false-positive class that gets a rule switched
+ * off.
+ */
+declare const OPEN_VOCABULARY_PROBES: ReadonlyMap<string, string>;
+/**
+ * Lifecycle phases that run BEFORE the vocabulary can be considered closed, with
+ * the reason each one is still open.
+ *
+ * `start` is the phase this rule exists for. The CI gate stops at `init`, on the
+ * sound reasoning that every plugin's `init()` has completed by then — true of
+ * the SERVICE registry, and false of an open capability vocabulary: ADR-0018
+ * executors are registered from `start()` too, and sibling plugins' `start()`
+ * have not all run. That is literally where #4771 sat.
+ */
+declare const PRE_SEAL_PHASES: ReadonlyMap<string, string>;
+/**
+ * Identifier fragments whose presence in the scope means the code ASKED whether
+ * the vocabulary is closed before judging it — the third sanctioned cure.
+ * Matched as a case-insensitive substring of an identifier so
+ * `nodeTypeVocabularySealed`, `sealNodeTypeVocabulary` and a host's own
+ * `vocabularySeal` all count.
+ */
+declare const SEAL_MARKERS: readonly string[];
+type StartupRegistryVerdictSeverity = 'warning';
+interface StartupRegistryVerdictFinding {
+    /** Always `warning` — this rule advises, it never gates (see module note). */
+    severity: StartupRegistryVerdictSeverity;
+    /** Diagnostic rule id. */
+    rule: string;
+    /** Human-readable location, e.g. `AutomationServicePlugin.start()`. */
+    where: string;
+    /** Source path, e.g. `plugin.ts:412`. */
+    path: string;
+    /** What is wrong. */
+    message: string;
+    /** How to fix it. */
+    hint: string;
+}
+/**
+ * The prescription every finding carries. It names the three cures in the order
+ * AGENTS.md ranks them, and each by the change that actually shipped, so the
+ * reader can go and read one.
+ *
+ * It states no verdict of its own about whether the site is broken at runtime —
+ * asserting a terminal outcome about a world that has not finished forming is
+ * the mistake this rule exists to remove, and a hint that did it would be the
+ * defect wearing the rule's own badge.
+ */
+declare const STARTUP_VERDICT_HINT: string;
+interface StartupRegistryVerdictOptions {
+    /**
+     * Label for the source under check — a path, a package name, whatever the
+     * caller can point at. Prefixes every finding's `path`.
+     */
+    file?: string;
+}
+/**
+ * Find startup open-vocabulary verdicts in one TypeScript/JavaScript source.
+ *
+ * Pure: parses, never executes, never type-checks, touches no filesystem. An
+ * unparseable source yields no findings rather than throwing — this advises on
+ * source someone else owns, and refusing to parse is not a verdict about them.
+ */
+declare function findStartupRegistryVerdicts(source: string, options?: StartupRegistryVerdictOptions): StartupRegistryVerdictFinding[];
+
 type ListViewModeSeverity = 'error' | 'warning';
 interface ListViewModeFinding {
     severity: ListViewModeSeverity;
@@ -216,7 +314,7 @@ interface ListViewModeFinding {
     hint: string;
 }
 declare const LIST_VIEW_FILTERS_IN_VIEWS_MODE = "list-view-filters-in-views-mode";
-type AnyRec$C = Record<string, unknown>;
+type AnyRec$D = Record<string, unknown>;
 /**
  * Flag ADR-0047 "views" mode violations on an object's built-in named views or a
  * `defineView` default `list` / named `listViews`: `quickFilters`, or a `tabs`
@@ -226,7 +324,7 @@ type AnyRec$C = Record<string, unknown>;
  *
  * Feed the PRE-parse stack (normalizeStackInput output) — see file header.
  */
-declare function validateListViewMode(stack: AnyRec$C): ListViewModeFinding[];
+declare function validateListViewMode(stack: AnyRec$D): ListViewModeFinding[];
 
 type FunctionalCompletenessSeverity = 'error' | 'warning';
 interface FunctionalCompletenessFinding {
@@ -246,6 +344,37 @@ interface FunctionalCompletenessFinding {
  */
 declare function validateFunctionalCompleteness(stack: unknown): FunctionalCompletenessFinding[];
 
+/**
+ * Stable diagnostic id. Named for the CONTRADICTION rather than for the strip,
+ * because at authoring time nothing has been stripped yet — the declaration is
+ * simply advertising something the object cannot honour.
+ */
+declare const MANAGED_API_METHOD_UNAFFORDABLE = "object/managed-api-method-unaffordable";
+interface ManagedApiMethodFinding {
+    /**
+     * Always `error`. The contradiction is decidable from the object's own
+     * declaration — no call graph, no runtime state — and shipping it means the
+     * metadata claims an API surface the registry will silently take away.
+     */
+    severity: 'error';
+    rule: typeof MANAGED_API_METHOD_UNAFFORDABLE;
+    /** Human-readable location, e.g. `object "sys_environment"`. */
+    where: string;
+    /** Config path, e.g. `objects[2].enable.apiMethods`. */
+    path: string;
+    message: string;
+    hint: string;
+}
+/**
+ * Walk every object declaration in the stack through the shared
+ * managed-affordance predicate.
+ *
+ * One finding per object, not per verb: an object declaring both `create` and
+ * `update` against an all-locked bucket has ONE authoring mistake, and the fix
+ * — open the affordances or drop the verbs — is a single edit.
+ */
+declare function validateManagedApiMethods(stack: unknown): ManagedApiMethodFinding[];
+
 type FlowTriggerReadinessSeverity = 'error' | 'warning';
 interface FlowTriggerReadinessFinding {
     severity: FlowTriggerReadinessSeverity;
@@ -287,7 +416,30 @@ declare const FLOW_TIME_RELATIVE_DESCRIPTOR_INVALID = "flow-time-relative-descri
  *     there is no runtime channel at all for it to be moved earlier from.
  */
 declare const FLOW_TIME_RELATIVE_DESCRIPTOR_UNROUTABLE = "flow-time-relative-descriptor-unroutable";
-type AnyRec$B = Record<string, unknown>;
+/**
+ * #6637 — a `type: 'record_change'` flow whose start-node `triggerType` the
+ * engine routes to NO trigger at all, so the flow is silently demoted to a
+ * manual one. Widened by #7215 to also cover the token being ABSENT
+ * entirely — the omission shape is exactly as dead at runtime as the
+ * contradiction shape this id originally caught, so one id and one severity
+ * cover both (see 1f for the history of why the widening waited).
+ *
+ * A separate id from `flow-trigger-unknown-event`, on the same distinction that
+ * separates the two `timeRelative` ids: whether the engine ROUTES the value.
+ * The two partition the declared-but-dead tokens and can never both fire on one
+ * value, because being `record-`-prefixed is exactly what routes a token:
+ *
+ *   - `record-`-prefixed but off-grammar (`record-after-updated`) — the engine
+ *     ROUTES it to the record-change trigger, which maps it to zero hook events
+ *     and says so in a bind-time warn. That is `…-UNKNOWN-EVENT`, and this rule
+ *     file moves that warn earlier.
+ *   - anything else (`onCreate`, `on_update`, `''`, `['onCreate']`, or the key
+ *     absent entirely) — the engine routes it NOWHERE. That is this id, and
+ *     there is no runtime channel to move earlier from: see 1f for the three
+ *     call sites that each skip it.
+ */
+declare const FLOW_TRIGGER_UNROUTABLE = "flow-trigger-unroutable";
+type AnyRec$C = Record<string, unknown>;
 /**
  * Validate auto-launched flow trigger wiring against the stack definition.
  *
@@ -296,7 +448,7 @@ type AnyRec$B = Record<string, unknown>;
  * owns the `timeRelative` descriptor's contract, which is the point: the rule
  * ASKS that schema rather than restating it.
  */
-declare function validateFlowTriggerReadiness(stack: AnyRec$B): FlowTriggerReadinessFinding[];
+declare function validateFlowTriggerReadiness(stack: AnyRec$C): FlowTriggerReadinessFinding[];
 
 type FlowTemplatePathSeverity = 'error' | 'warning';
 interface FlowTemplatePathFinding {
@@ -311,12 +463,13 @@ interface FlowTemplatePathFinding {
 }
 declare const FLOW_TEMPLATE_UNKNOWN_FIELD = "flow-template-unknown-field";
 declare const FLOW_TEMPLATE_LOOKUP_TRAVERSAL = "flow-template-lookup-traversal";
-type AnyRec$A = Record<string, unknown>;
+declare const FLOW_TEMPLATE_FIELD_UNPROVISIONED = "flow-template-field-unprovisioned";
+type AnyRec$B = Record<string, unknown>;
 /**
  * Validate `{record.<path>}` template references across every record-change
  * flow. Pure and dependency-free; safe on pre- or post-parse stacks.
  */
-declare function validateFlowTemplatePaths(stack: AnyRec$A): FlowTemplatePathFinding[];
+declare function validateFlowTemplatePaths(stack: AnyRec$B): FlowTemplatePathFinding[];
 
 type ReadonlyFlowWriteSeverity = 'error' | 'warning';
 interface ReadonlyFlowWriteFinding {
@@ -331,12 +484,12 @@ interface ReadonlyFlowWriteFinding {
 }
 declare const FLOW_UPDATE_READONLY_FIELD = "flow-update-readonly-field";
 declare const FLOW_UPDATE_READONLY_WHEN_FIELD = "flow-update-readonly-when-field";
-type AnyRec$z = Record<string, unknown>;
+type AnyRec$A = Record<string, unknown>;
 /**
  * Validate flow `update_record` writes against target-object readonly
  * declarations. Pure and dependency-free; safe on pre- or post-parse stacks.
  */
-declare function validateReadonlyFlowWrites(stack: AnyRec$z): ReadonlyFlowWriteFinding[];
+declare function validateReadonlyFlowWrites(stack: AnyRec$A): ReadonlyFlowWriteFinding[];
 
 type ViewContainerSeverity = 'error' | 'warning';
 interface ViewContainerFinding {
@@ -373,14 +526,14 @@ declare const STYLE_CLASSNAME_TAILWIND = "style-classname-tailwind";
 declare const STYLE_RESPONSIVE_NO_BASE = "style-responsive-no-base";
 declare const STYLE_UNKNOWN_CSS_PROPERTY = "style-unknown-css-property";
 declare const STYLE_UNKNOWN_TOKEN = "style-unknown-token";
-type AnyRec$y = Record<string, unknown>;
+type AnyRec$z = Record<string, unknown>;
 /**
  * Validate every page's component tree for SDUI styling correctness (ADR-0065).
  * Returns findings (empty = clean). `error` findings describe styles that are
  * silently dropped and should fail validate/build; `warning` findings are
  * advisory (typos, drift, footguns).
  */
-declare function validateResponsiveStyles(stack: AnyRec$y): StyleFinding[];
+declare function validateResponsiveStyles(stack: AnyRec$z): StyleFinding[];
 
 type JsxPageSeverity = 'error' | 'warning';
 interface JsxPageFinding {
@@ -393,8 +546,8 @@ interface JsxPageFinding {
     message: string;
     hint: string;
 }
-type AnyRec$x = Record<string, unknown>;
-declare function validateJsxPages(stack: AnyRec$x, opts?: {
+type AnyRec$y = Record<string, unknown>;
+declare function validateJsxPages(stack: AnyRec$y, opts?: {
     manifest?: Manifest;
 }): JsxPageFinding[];
 
@@ -407,8 +560,8 @@ interface ReactPageFinding {
     message: string;
     hint: string;
 }
-type AnyRec$w = Record<string, unknown>;
-declare function validateReactPages(stack: AnyRec$w): ReactPageFinding[];
+type AnyRec$x = Record<string, unknown>;
+declare function validateReactPages(stack: AnyRec$x): ReactPageFinding[];
 
 type ReactPropSeverity = 'error' | 'warning';
 interface ReactPropFinding {
@@ -419,13 +572,14 @@ interface ReactPropFinding {
     message: string;
     hint: string;
 }
-type AnyRec$v = Record<string, unknown>;
+type AnyRec$w = Record<string, unknown>;
 declare const REACT_CHART_FIELD_UNKNOWN = "react-chart-field-unknown";
+declare const REACT_CHART_FIELD_UNPROVISIONED = "react-chart-field-unprovisioned";
 declare const REACT_CHART_AGGREGATE_INVALID = "react-chart-aggregate-invalid";
 declare const REACT_CHART_AXIS_UNKNOWN = "react-chart-axis-unknown";
 declare const REACT_CHART_DRILLDOWN_INVALID = "react-chart-drilldown-invalid";
 declare const REACT_BLOCK_NEEDS_RECORD_CONTEXT = "react-block-needs-record-context";
-declare function validateReactPageProps(stack: AnyRec$v): ReactPropFinding[];
+declare function validateReactPageProps(stack: AnyRec$w): ReactPropFinding[];
 
 type SourceStyleSeverity = 'error' | 'warning';
 interface SourceStyleFinding {
@@ -437,8 +591,8 @@ interface SourceStyleFinding {
     hint: string;
 }
 declare const PAGE_SOURCE_CLASSNAME = "page-source-className-tailwind";
-type AnyRec$u = Record<string, unknown>;
-declare function validatePageSourceStyling(stack: AnyRec$u): SourceStyleFinding[];
+type AnyRec$v = Record<string, unknown>;
+declare function validatePageSourceStyling(stack: AnyRec$v): SourceStyleFinding[];
 
 /**
  * Build-time record-title diagnostics (ADR-0079).
@@ -482,19 +636,20 @@ interface RecordTitleFinding {
     /** How to fix it. */
     hint: string;
 }
-type AnyRec$t = Record<string, unknown>;
+type AnyRec$u = Record<string, unknown>;
 /**
  * Validate every object's record-title declaration. Returns the list of
  * findings (empty = clean). Both rules are advisory (`warning`): the caller
  * must never fail the build on them alone — auto-provision + the `Record #<id>`
  * floor guarantee a resolvable title at runtime.
  */
-declare function validateRecordTitle(stack: AnyRec$t): RecordTitleFinding[];
+declare function validateRecordTitle(stack: AnyRec$u): RecordTitleFinding[];
 
 declare const FIELD_GROUP_UNDECLARED = "field-group-undeclared";
 declare const FIELD_GROUP_EMPTY = "field-group-empty";
 declare const FIELD_GROUP_SHADOWED = "field-group-shadowed";
 declare const SEMANTIC_ROLE_FIELD_UNKNOWN = "semantic-role-field-unknown";
+declare const SEMANTIC_ROLE_FIELD_UNPROVISIONED = "semantic-role-field-unprovisioned";
 type SemanticRoleSeverity = 'error' | 'warning';
 interface SemanticRoleFinding {
     /** Always `warning` today — all three rules are advisory (see module note). */
@@ -510,38 +665,14 @@ interface SemanticRoleFinding {
     /** How to fix it. */
     hint: string;
 }
-type AnyRec$s = Record<string, unknown>;
+type AnyRec$t = Record<string, unknown>;
 /**
  * Validate every object's semantic-role pointers. Returns the list of
  * findings (empty = clean). Advisory only — the caller must never fail the
  * build on these alone.
  */
-declare function validateSemanticRoles(stack: AnyRec$s): SemanticRoleFinding[];
+declare function validateSemanticRoles(stack: AnyRec$t): SemanticRoleFinding[];
 
-/**
- * Build-time form-layout diagnostics (#2578).
- *
- * Authored form views carry field references and column-layout hints that are
- * Zod-valid but can be silently wrong at render time — the "parsed, unmarked,
- * silently inert" shape ADR-0078 prohibits. This lint catches the two that
- * matter for multi-column, AI-authored forms, uniformly for `os build` /
- * `os validate`, MCP authoring and hand authors (ADR-0019).
- *
- * Both rules are warnings, not errors — nothing is fully broken (an unknown
- * field name is skipped; an over-wide colSpan is clamped) — but each is almost
- * certainly an authoring mistake worth surfacing at author time:
- *
- * - `form-field-unknown` — a section references a field that is not on the
- *   form's bound object, so the field silently does not render.
- * - `absolute-colspan-discouraged` — a field uses the absolute `colSpan`. Under
- *   a per-surface DERIVED column count (mobile 1 / modal 2 / page 3-4) a fixed
- *   span only lines up at the one width the author imagined; the renderer
- *   clamps it. The robust primitive is the relative `span: 'full'`.
- *
- * Scope: top-level form `views` (a `sections` array). Forms embedded inside
- * page component trees are a follow-up — the walker deliberately stays shallow
- * so it never guesses at an arbitrary component's object binding.
- */
 declare const FORM_FIELD_UNKNOWN = "form-field-unknown";
 declare const FORM_COLSPAN_ABSOLUTE = "absolute-colspan-discouraged";
 type FormLayoutSeverity = 'error' | 'warning';
@@ -550,72 +681,66 @@ interface FormLayoutFinding {
     severity: FormLayoutSeverity;
     /** Diagnostic rule id, e.g. `form-field-unknown`. */
     rule: string;
-    /** Human-readable location, e.g. `view "contract_form"`. */
+    /** Human-readable location, e.g. `view "contract_form" · formViews.create`. */
     where: string;
-    /** Config path, e.g. `views[2].sections[0].fields[3]`. */
+    /** Config path, e.g. `views[2].formViews.create.sections[0].fields[3]`. */
     path: string;
     /** What is wrong. */
     message: string;
     /** How to fix it. */
     hint: string;
 }
-type AnyRec$r = Record<string, unknown>;
+type AnyRec$s = Record<string, unknown>;
 /**
  * Validate authored form-view layout. Returns findings (empty = clean).
  * Advisory only — the caller must never fail the build on these alone.
  */
-declare function validateFormLayout(stack: AnyRec$r): FormLayoutFinding[];
-
-/**
- * Build-time conditional-visibility diagnostics (ADR-0089 D3b).
- *
- * ADR-0089 unifies the conditional-visibility predicate under the single
- * canonical key **`visibleWhen`** across data fields, view form sections/fields,
- * and page components. The deprecated spellings — `visibleOn` (view form) and
- * `visibility` (page component) — stay accepted and are folded into `visibleWhen`
- * at the schema boundary (a zod `.transform()`). Because that fold happens during
- * `parse()`, the aliases are gone from the *parsed* stack — so this rule runs on
- * the **pre-parse** (normalized) stack, exactly like `validate-list-view-mode`,
- * to see what the author actually wrote.
- *
- * Two advisory rules (both `warning` — nothing is broken, the alias still works
- * and a mis-rooted predicate just never matches):
- *
- * - `visibility-alias-deprecated` — a `visibleOn` / `visibility` key in authored
- *   source. Autofix intent: rename the key to `visibleWhen` (same value).
- * - `visibility-root-mislayered` — a visibility predicate whose binding root does
- *   not match its layer (ADR-0089 D3, §Context). The check is **bidirectional**:
- *   - **runtime** view/page surfaces (`*.view.ts` / `*.page.ts`) bind
- *     `record` + `current_user` (pages also expose `page.<var>`), so a `data.`-rooted
- *     predicate here is a wrong-layer paste that silently never matches; and
- *   - **metadata-editing** forms (`*.form.ts` — the row under edit) bind `data`, so
- *     a `record.`-rooted predicate there is the same bug in the other direction.
- *   The layer is supplied by the caller (`opts.layer`, default `'runtime'`): the
- *   app-lint path (`os validate` / `compile`) always lints runtime surfaces, while a
- *   file-aware caller linting a `*.form.ts` passes `layer: 'metadata'`.
- *
- * Scope: `views` (form `sections` / legacy `groups`, and their `fields`) and
- * `pages` (`regions[].components[]`). Data-field `visibleWhen` is already covered
- * by `validate-expressions` and is not re-checked here.
- */
-declare const VISIBILITY_ALIAS_DEPRECATED = "visibility-alias-deprecated";
+declare function validateFormLayout(stack: AnyRec$s): FormLayoutFinding[];
+
 declare const VISIBILITY_ROOT_MISLAYERED = "visibility-root-mislayered";
+declare const VISIBILITY_BARE_IDENTIFIER = "visibility-bare-identifier";
+declare const VISIBILITY_PREDICATE_SYNTAX = "visibility-predicate-syntax";
+/**
+ * Valid CEL that overruns a `DEFAULT_LIMITS` parse bound (`maxAstNodes` 256,
+ * `maxDepth` 32, `maxListElements` 64, …) — #7217. A separate id from
+ * {@link VISIBILITY_PREDICATE_SYNTAX} for the reason `rls-predicate-over-budget`
+ * is a separate id from `rls-predicate-unparseable` (#6778 / PR #6831): the
+ * consequence is identical, the FIX is not, and `--json` consumers key on the id.
+ */
+declare const VISIBILITY_PREDICATE_OVER_BUDGET = "visibility-predicate-over-budget";
 type VisibilitySeverity = 'error' | 'warning';
 /**
  * Which binding environment the linted surface belongs to (ADR-0089 §Context):
  * - `runtime`  — `*.view.ts` / `*.page.ts`; binds `record` + `current_user` (+ `page`).
- * - `metadata` — `*.form.ts` metadata-editing forms; binds `data` (the row under edit).
+ * - `metadata` — metadata-editing forms (a `*.form.ts` module, or a form view
+ *   declaring `data: { provider: 'schema', schemaId }`); binds `data` (the row
+ *   under edit).
  */
 type VisibilityLayer = 'runtime' | 'metadata';
 /** Options for {@link validateVisibilityPredicates}. */
 interface VisibilityOptions {
-    /** Binding layer of the surface being linted. Defaults to `'runtime'`. */
+    /**
+     * Binding layer for the sites whose layer the metadata does not state.
+     * Defaults to `'runtime'`.
+     *
+     * A form view that declares `data: { provider: 'schema', schemaId }` DOES
+     * state it — the metadata-admin evaluator renders that surface and binds the
+     * row under edit as `data` — so such a site is judged at `'metadata'`
+     * regardless of this option (#7815; see the module note §Which layer a site is
+     * on). Pass `'metadata'` to cover the forms that do not carry that data source
+     * either, which is what a file-aware caller linting a `*.form.ts` does.
+     */
     layer?: VisibilityLayer;
 }
 interface VisibilityFinding {
-    /** Always `warning` today — both rules are advisory (see module note). */
+    /**
+     * `warning` for the ADR-0089 D3b advisory (`visibility-root-mislayered`);
+     * `error` for the three rules that gate — `visibility-predicate-syntax`,
+     * `visibility-predicate-over-budget` and `visibility-bare-identifier` (see
+     * module note).
+     */
     severity: VisibilitySeverity;
-    /** Diagnostic rule id, e.g. `visibility-alias-deprecated`. */
+    /** Diagnostic rule id, e.g. `visibility-root-mislayered`. */
     rule: string;
     /** Human-readable location, e.g. `view "contact_form"`. */
     where: string;
@@ -626,22 +751,104 @@ interface VisibilityFinding {
     /** How to fix it. */
     hint: string;
 }
+type AnyRec$r = Record<string, unknown>;
+/**
+ * Validate conditional-visibility predicates across authored views and pages.
+ *
+ * Every rule here judges the predicate's **VALUE**, which survives both the
+ * ADR-0087 D2 alias fold and the Zod parse intact — so the registered
+ * `normalized` tier sees exactly what a `parsed` one would. (It is registered
+ * `normalized` for the tier's surviving reason, not the retired one: a
+ * normalized-tier finding still reaches the author when an unrelated schema
+ * error elsewhere would have stopped the parse. See `AuthoringRuleInputTier`.)
+ *
+ * Returns findings (empty = clean). `visibility-root-mislayered` is advisory
+ * (`warning`); `visibility-predicate-syntax` (#6253),
+ * `visibility-predicate-over-budget` (#7217) and `visibility-bare-identifier`
+ * (#6128) are `error` and the caller is expected to fail the build on them.
+ *
+ * The binding-root check is layer-directional (ADR-0089 D3). A form view that
+ * declares `data: { provider: 'schema', schemaId }` is judged at `metadata` on
+ * its own say-so (#7815); for every other site pass `opts.layer = 'metadata'`
+ * when linting a `*.form.ts` metadata-editing form (so a `record.`-rooted
+ * predicate is flagged), or leave it at the `'runtime'` default for `*.view.ts` /
+ * `*.page.ts` surfaces (so a `data.`-rooted predicate is flagged). The syntax and
+ * bare-identifier checks are layer-agnostic — but the ROOT their hints prescribe
+ * is not, which is the second half of what #7815 fixes.
+ */
+declare function validateVisibilityPredicates(stack: AnyRec$r, opts?: VisibilityOptions): VisibilityFinding[];
+
+declare const PREDICATE_PATH_UNRESOLVED = "predicate-path-unresolved";
+declare const PREDICATE_PATH_UNROOTED = "predicate-path-unrooted";
+/**
+ * A `==` / `!=` RIGHT-hand side that is path-shaped — an unquoted identifier
+ * chain (#7659). See the module note's §The right-hand side for the two
+ * severities this one id carries and why they are not the same defect.
+ */
+declare const PREDICATE_RHS_PATH_SHAPED = "predicate-rhs-path-shaped";
+/**
+ * The two path-RESOLUTION rules always GATE; {@link PREDICATE_RHS_PATH_SHAPED}
+ * gates on a dotted chain and is advisory on a bare word — see the module note
+ * for why the same shape earns two answers.
+ */
+type PredicatePathSeverity = 'error' | 'warning';
+interface PredicatePathFinding {
+    severity: PredicatePathSeverity;
+    /** Diagnostic rule id — `predicate-path-unresolved` / `predicate-path-unrooted`. */
+    rule: string;
+    /** Human-readable location, e.g. `view "object" · schema form "object"`. */
+    where: string;
+    /** Config path, e.g. `views[0].sections[1].fields[0].fields[21].visibleWhen`. */
+    path: string;
+    /** What is wrong — always names the unresolvable path. */
+    message: string;
+    /** How to fix it. */
+    hint: string;
+}
+/** Options for {@link validatePredicatePathRefs}. */
+interface PredicatePathOptions {
+    /**
+     * Schema oracle: `schemaId` → the Zod schema of the row under edit. Defaults
+     * to the canonical `getMetadataTypeSchema` registry
+     * (`packages/spec/src/kernel/metadata-type-schemas.ts`), which is the same
+     * entry `saveMetaItem` validates against — so this rule can never disagree
+     * with the parse that judges the saved row. Injectable so a test can pin the
+     * traversal against a small schema, and so a future caller holding a richer
+     * registry (runtime `/meta/types`, a package-declared type) can supply it
+     * without this file growing a second lookup path.
+     */
+    resolveSchema?: (schemaId: string) => unknown;
+}
 type AnyRec$q = Record<string, unknown>;
 /**
- * Validate conditional-visibility keys across authored views and pages.
+ * Refuse a metadata-form predicate that names a path the target schema does not
+ * declare (#7010).
+ *
+ * Walks `views[]` through the shared {@link formViewSites} ladder — the entry
+ * itself (the bare `defineForm` shape every `*.form.ts` uses), the container's
+ * default `form`, and each `formViews.<key>` — and judges only the sites whose
+ * data source is `{ provider: 'schema', schemaId }`, resolving `schemaId`
+ * through `opts.resolveSchema` (the canonical metadata-type registry by
+ * default). A site bound to an ObjectQL object, or naming a `schemaId` no schema
+ * resolves, is skipped: see the module note for why the `record.*` layer is out
+ * of scope rather than merely unimplemented.
+ *
+ * Both path-resolution rules emit `error` and the caller is expected to fail the
+ * build on them. The corpus measurement behind that severity is on the PR for
+ * #7010: over the shipped `METADATA_FORM_REGISTRY` (17 forms, 46 predicates) the
+ * count is **0** for both, and 16 for `predicate-path-unrooted` once #6254's
+ * pre-fix `object.form.ts` is restored.
+ *
+ * The third rule, `predicate-rhs-path-shaped` (#7659), asks a different question
+ * about the same predicates — whether a `==` / `!=` RIGHT-hand side is
+ * path-shaped, which the renderer parses as a literal — and carries two
+ * severities: `error` on a dotted chain, `warning` on a bare word. Its corpus
+ * count over the same shipped forms is **0** at both severities. See the module
+ * note.
  *
- * Runs on the **pre-parse** (normalized) stack so it can see the deprecated
- * `visibleOn` / `visibility` aliases before the schema folds them into
- * `visibleWhen`. Returns findings (empty = clean); all advisory (`warning`) —
- * the caller must never fail the build on these alone.
- *
- * The binding-root check is layer-directional (ADR-0089 D3): pass
- * `opts.layer = 'metadata'` when linting a `*.form.ts` metadata-editing form (so a
- * `record.`-rooted predicate is flagged), or leave it at the `'runtime'` default for
- * `*.view.ts` / `*.page.ts` surfaces (so a `data.`-rooted predicate is flagged). The
- * alias-deprecated check is layer-agnostic.
+ * Returns findings (empty = clean).
  */
-declare function validateVisibilityPredicates(stack: AnyRec$q, opts?: VisibilityOptions): VisibilityFinding[];
+declare function validatePredicatePathRefs(stack: AnyRec$q, opts?: PredicatePathOptions): PredicatePathFinding[];
 
 declare const CAPABILITY_REFERENCE_UNKNOWN = "capability-reference-unknown";
 type CapabilityRefSeverity = 'error' | 'warning';
@@ -760,6 +967,7 @@ declare const SECURITY_MASTER_DETAIL_UNGRANTED = "security-master-detail-ungrant
 declare const SECURITY_FLS_UNQUALIFIED_KEY = "security-fls-unqualified-key";
 declare const SECURITY_GRANT_EXPIRED_AT_AUTHORING = "security-grant-expired-at-authoring";
 declare const SECURITY_DELEGATION_MISSING_REASON = "security-delegation-missing-reason";
+declare const SECURITY_CBP_NO_RELATION = "security-controlled-by-parent-no-relation";
 type SecuritySeverity = 'error' | 'warning' | 'info';
 interface SecurityFinding {
     severity: SecuritySeverity;
@@ -785,6 +993,35 @@ type AnyRec$l = Record<string, unknown>;
 declare function validateSecurityPosture(stack: AnyRec$l, opts?: {
     nowMs?: number;
 }): SecurityFinding[];
+/**
+ * [ADR-0090 D3] The `security-role-word` vocabulary freeze, as its own rule.
+ *
+ * Scope: security-relevant identifiers/labels across SIX collections — objects
+ * (names, field names, action names), permission sets, positions, apps, books.
+ * Pages/views/components are NOT scanned — `role` there is HTML/ARIA
+ * semantics, not permission vocabulary. The sole platform exception
+ * (better-auth `sys_member.role`) is a system object, which app stacks never
+ * author. Books entered the security-relevant set when `book.audience` became
+ * a permission-model reference (ADR-0046 §6.7 / ADR-0090).
+ *
+ * ## Why this is a separate function from {@link validateSecurityPosture}
+ *
+ * [#8310] Not taste — a surface boundary. When the rest of the D7 block
+ * crossed onto the runtime publish surface (`runtimeTypes: ['seed',
+ * 'permission', 'book']` — `object` measured dirty and is escalated, see the
+ * registry comment), this rule could not go with it: the per-write snapshot
+ * (`runtime-gate.ts`) neither carries nor maps `positions` / `apps`, both of
+ * which are `allowRuntimeCreate: true` — so wiring it through the shared
+ * entry would have enforced ONE rule id for a strict subset of its six
+ * collections. That is the #7220 failure shape (a door that refuses a
+ * permission set named `role_manager` while a position named `sales_role`
+ * walks through), and
+ * the registry refuses to build it in either direction. The rule therefore
+ * stays behind WHOLE, on its own CLI-only registry entry, until the snapshot
+ * carries `positions`/`apps` and both types are gated — at which point it
+ * crosses whole, in one edit, as its own entry.
+ */
+declare function validateSecurityRoleWord(stack: AnyRec$l): SecurityFinding[];
 
 /**
  * [ADR-0105 D6] The two organization-axis red lines, enforced at authoring time.
@@ -923,6 +1160,8 @@ declare function validateSharingRuleEnforceability(stack: unknown): SharingRuleE
 declare const RLS_PREDICATE_UNENFORCEABLE = "rls-predicate-unenforceable";
 /** A predicate that does not parse as CEL even after the legacy SQL bridge. */
 declare const RLS_PREDICATE_UNPARSEABLE = "rls-predicate-unparseable";
+/** Valid CEL that overruns a platform parse bound (`maxAstNodes`, `maxDepth`, …). */
+declare const RLS_PREDICATE_OVER_BUDGET = "rls-predicate-over-budget";
 type RlsPredicateSeverity = 'error' | 'warning';
 interface RlsPredicateFinding {
     severity: RlsPredicateSeverity;
@@ -1086,13 +1325,16 @@ declare function validateDashboardActionRefs(stack: AnyRec$k): DashboardActionRe
  *
  * ## Scope — filter subtrees only
  *
- * The walk descends into `filter` / `filters` / `runtimeFilter` subtrees and
- * classifies string values inside them. It deliberately does NOT check
- * navigation `recordId` / `params`, which resolve an additional vocabulary —
- * `AppContextSelector` ids such as `{active_package}` — that is meaningless in
- * a filter because filters are not evaluated with the sidebar's selector
- * state. Restricting the walk keeps that legitimate usage out of the rule and
- * holds false positives at zero.
+ * Finding those subtrees is `filter-walk.ts`'s job since #5330 gave the same
+ * traversal a second consumer; this file owns only the judgement on the strings
+ * inside them. The shared walk descends into `filter` / `filters` /
+ * `runtimeFilter` and deliberately does NOT check navigation `recordId` /
+ * `params`, which resolve an additional vocabulary — `AppContextSelector` ids
+ * such as `{active_package}` — that is meaningless in a filter because filters
+ * are not evaluated with the sidebar's selector state. Restricting the walk
+ * keeps that legitimate usage out of the rule and holds false positives at
+ * zero. The seven surfaces below stay THIS rule's declaration, not the walk's:
+ * a shared surface list would let another rule's widening land here silently.
  *
  * Only whole-string placeholders are considered (`'{token}'` / `'${token}'`,
  * anchored). A value that merely contains braces is left alone.
@@ -1122,6 +1364,35 @@ interface FilterTokenFinding {
  */
 declare function validateFilterTokens(stack: Record<string, unknown> | undefined | null): FilterTokenFinding[];
 
+/** A literal `$and: []` / `$or: []` / `$not: {}` — a combinator with no operands. */
+declare const FILTER_EMPTY_COMBINATOR = "filter-empty-combinator";
+/** A literal `{}` where a filter node is authored — the whole filter, or a branch. */
+declare const FILTER_EMPTY_NODE = "filter-empty-node";
+type EmptyCombinatorSeverity = 'error' | 'warning';
+interface EmptyCombinatorFinding {
+    /** Always `error` — see the severity note in this module's header. */
+    severity: EmptyCombinatorSeverity;
+    /** Diagnostic rule id (`filter-empty-combinator` / `filter-empty-node`). */
+    rule: string;
+    /** Human-readable location, e.g. `dashboard "sales" · widget "my_deals"`. */
+    where: string;
+    /** Config path, e.g. `dashboards[0].widgets[2].filter.$or`. */
+    path: string;
+    /** What is wrong. */
+    message: string;
+    /** How to fix it. */
+    hint: string;
+}
+/**
+ * Reject literal empty combinators across an authored stack.
+ *
+ * Pure `(stack) => Finding[]`; no I/O. Tolerates both authoring tiers — a
+ * filter subtree survives the Zod parse unchanged, and no filter key in the
+ * spec carries a `.default({})`, so a `{}` seen here was authored, never filled
+ * in by a schema.
+ */
+declare function validateEmptyCombinators(stack: Record<string, unknown> | undefined | null): EmptyCombinatorFinding[];
+
 declare const OBJECT_REFERENCE_UNKNOWN = "object-reference-unknown";
 declare const OBJECT_REFERENCE_UNREGISTERED_PLATFORM = "object-reference-unregistered-platform";
 type ObjectRefSeverity = 'error' | 'warning';
@@ -1248,6 +1519,11 @@ type NavTargetRefFinding = ReferenceIntegrityFinding;
 declare const NAV_TARGET_UNRESOLVED = "nav-target-unresolved";
 declare function validateNavTargetRefs(stack: unknown): NavTargetRefFinding[];
 
+type NavObjectServabilityFinding = ReferenceIntegrityFinding;
+/** Emitted when a nav entry targets an object whose `enable` block cannot serve a list. */
+declare const NAV_OBJECT_UNSERVABLE = "nav-object-unservable";
+declare function validateNavObjectServability(stack: unknown): NavObjectServabilityFinding[];
+
 /**
  * [ADR-0061 — searchable set] `searchableFields` entries must name a field the
  * object actually has — and, on a list view, one the runtime will agree to scan.
@@ -1308,12 +1584,25 @@ declare function validateNavTargetRefs(stack: unknown): NavTargetRefFinding[];
  *    linter, gate and engine cannot drift apart (the same one-source move
  *    #4254 made between gate and engine).
  *
- * The OBJECT's own `searchableFields` stays existence-only: the runtime's
- * declared branch filters by existence, never by type, so a json or lookup
- * column declared THERE is a choice the engine executes (a `$contains` over
- * the raw column), not a 400. Flagging it would reject metadata the runtime
- * accepts — the false finding that makes authors stop trusting the linter
- * (ADR-0072 D1).
+ * 3. VIRTUALITY, on EVERY surface — the object's own set included
+ *    (`searchable-field-unsearchable`, #6674): a `formula` entry names a real
+ *    field, so check 1 passes it, and the runtime's declared branch admitted
+ *    it verbatim — but the value is computed on read with no stored column, so
+ *    the scan looks at nothing. Measured 0 rows on driver-memory and 0 rows
+ *    WITH NO ERROR on driver-sql. Since #6674 the spec resolution drops such
+ *    an entry and both enforcement faces refuse it by name.
+ *
+ * The OBJECT's own `searchableFields` stays existence-only OTHERWISE, and the
+ * dividing line is STORAGE, not search quality: the runtime's declared branch
+ * filters by existence and scannability, never by type taste, so a json or
+ * lookup column declared THERE is a choice the engine executes (a `$contains`
+ * over the stored JSON text / the stored foreign key) — narrow, rarely useful,
+ * but a scan that CAN match, so it is neither a 400 nor a finding. Flagging
+ * those would reject metadata the runtime accepts — the false finding that
+ * makes authors stop trusting the linter (ADR-0072 D1). A virtual entry is the
+ * opposite case: no column exists on any driver, so admitting it is the
+ * fail-open #4254 closed one axis over, surviving on the known-but-virtual
+ * axis.
  *
  * Three skips keep false positives near zero (ADR-0072 D1):
  *
@@ -1360,8 +1649,9 @@ interface SearchableFieldFinding {
  * Which runtime judgment applies to the declaration being checked:
  *
  * - `'canonical'` — the object's own `searchableFields`. The runtime honors
- *   any entry that exists (existence-filtered, never type-filtered), so only
- *   existence is checked.
+ *   any entry that exists and has a stored column to scan (existence- and
+ *   scannability-filtered, never type-filtered), so existence and virtuality
+ *   are checked and nothing else (#6674).
  * - `'narrowing'` — a list view's `searchableFields` (metadata or react
  *   surface). Clients echo it as the `$searchFields` override, which the
  *   #4254 ingress gate intersects with the object's allowed set — entries the
@@ -1556,11 +1846,14 @@ declare function walkPageComponents(page: AnyRec$f, pagePath: string): WalkedCom
  * authored in the wild. The table below names the field-bearing props
  * explicitly; an unknown component type is SKIPPED silently, never flagged.
  *
- * The table also covers shapes the props schemas do not yet describe but real
- * pages authored anyway (they pass only because `properties` is unvalidated):
- * `record:details` `sections[].fields[]` and `hideFields[]`, and the record
- * picker's `labelField`. Linting the schema's shape alone would find nothing on
- * the actual corpus.
+ * The table once also covered shapes the props schemas did not describe but
+ * real pages authored anyway (`record:details` `sections[].fields[]` /
+ * `hideFields[]`, the record picker's `labelField`). #5611 and #5775 settled
+ * those the other way — the delivered shape got declared — so today every prop
+ * this table names is a live (non-retired) key on its `ComponentPropsMap`
+ * schema, and `component-field-specs-liveness.test.ts` pins that: a future
+ * retirement that forgets this table turns that test red instead of leaving a
+ * tombstoned key listed here as if it were still-valid spelling (#6629).
  *
  * ── Shared with the react page surface ──────────────────────────────────
  *
@@ -1575,6 +1868,17 @@ declare function walkPageComponents(page: AnyRec$f, pagePath: string): WalkedCom
  * drift #4330 had just finished removing from the system-field lists.
  */
 declare const PAGE_FIELD_UNKNOWN = "page-field-unknown";
+/**
+ * [#8340] The reference RESOLVES to a registry-injected system column — so
+ * {@link PAGE_FIELD_UNKNOWN} is right to stay silent — but the bound object is
+ * ADR-0015 `external`, where the platform registers the anchor and provisions
+ * no storage behind it. Always `warning`, on both consequences and including
+ * the `queried` one that gates for a genuinely missing column: the existence
+ * question has a closed oracle here and the provenance question does not (this
+ * pass cannot see the remote schema, only that the platform stores nothing) —
+ * #8116's severity reasoning, unchanged.
+ */
+declare const PAGE_FIELD_UNPROVISIONED = "page-field-unprovisioned";
 type PageFieldSeverity = 'error' | 'warning';
 interface PageFieldFinding {
     /**
@@ -1945,8 +2249,26 @@ declare function validateAiToolReferences(stack: AnyRec$9): AiToolRefFinding[];
  * that names the runtime consequence is honest for both readers; the runtime
  * is what actually gates. Deliberately NOT a Zod refine — an existing stack
  * must keep parsing (ADR-0078 non-goal #1).
+ *
+ * ## The value half (issue #6041)
+ *
+ * The rule above catches a stack that *declares* a withdrawn agent record.
+ * It never looked at `app.defaultAgent` — a plain
+ * `SnakeCaseIdentifierSchema` string, so any snake_case value parses, builds,
+ * and passes `os:check` even when it names nothing the runtime will ever
+ * resolve. #5985 measured the blind spot directly: replaying the bad example
+ * `defaultAgent: 'sales_copilot'` left `check:skill-examples` at 208 green,
+ * EXIT=0. `app.defaultAgent` silently falls back to the platform default at
+ * runtime (ADR-0063 §1) instead of crashing, which is why this limb is
+ * **warning**, not error, same as the rule above — the maintainer ruling on
+ * #6041 (2026-08-07, reaffirmed 2026-08-09) is option A: add the value check
+ * at warning tier, reusing `PLATFORM_AGENT_NAMES` rather than narrowing the
+ * schema to an enum (a breaking authoring change ADR-0063 already walked
+ * back once).
  */
 declare const AGENT_AUTHORING_WITHDRAWN = "agent-authoring-withdrawn";
+/** `app.defaultAgent` names something outside the platform agent roster. */
+declare const DEFAULT_AGENT_OUTSIDE_ROSTER = "default-agent-outside-roster";
 type AiAgentAuthoringSeverity = 'error' | 'warning';
 interface AiAgentAuthoringFinding {
     /** Always `warning` — the runtime is the gate; this is the authoring-time signal. */
@@ -2176,12 +2498,12 @@ declare function validateFlowNodeWrites(stack: AnyRec$5): FlowNodeWriteFinding[]
 
 type AnyRec$4 = Record<string, unknown>;
 /** Build the sorted access matrix for a normalized stack. */
-declare function buildAccessMatrix(stack: AnyRec$4): AccessMatrix;
+declare function buildAccessMatrix(stack: AnyRec$4): AccessMatrixParsed;
 /**
  * Semantic diff between two matrices — human-review lines, empty = identical.
  * Ordered: removals, additions, then per-entry bit/scope changes.
  */
-declare function diffAccessMatrix(before: AccessMatrix, after: AccessMatrix): string[];
+declare function diffAccessMatrix(before: AccessMatrixParsed, after: AccessMatrixParsed): string[];
 
 interface FlowLintFinding {
     where: string;
@@ -2344,6 +2666,8 @@ declare const UNIQUE_LEGACY_ORGANIZATION_COMPOSITE = "unique/legacy-organization
  * 17.x: warning. Protocol 18 rejects the spelling at validate/publish (#5082).
  * Advisory — never fails a build in 17.x.
  *
+ * Concrete harm: #8323 measured the cross-tenant 409-vs-201 oracle end to end.
+ *
  * Wiring: own AUTHORING_RULES entry (validate/build), and `lintDataModel`
  * calls it for `os lint` — each command reports each finding exactly once.
  */
@@ -2412,4 +2736,4 @@ declare function lintLegacyOrganizationComposites(objects: any[]): LintIssue[];
  */
 declare function lintDataModel(objects: any[]): LintIssue[];
 
-export { ACTION_BODY_WRITE_EXCLUSIONS, ACTION_BODY_WRITE_PATTERNS, ACTION_BODY_WRITE_PATTERN_IDS, ACTION_BODY_WRITE_UNKNOWN_FIELD, ACTION_NAME_UNDEFINED, ACTION_NO_PLACEMENT, ACTION_RECORD_WRITE_DISCARDED, ACTION_RECORD_WRITE_PATTERNS, ACTION_RECORD_WRITE_PATTERN_IDS, AGENT_AUTHORING_WITHDRAWN, AI_SKILL_SURFACE_MISMATCH, AI_SKILL_TOOL_UNRESOLVED, APPROVAL_APPROVERS_MAY_RESOLVE_EMPTY, APPROVAL_APPROVER_CROSS_ORG_UNSUPPORTED, APPROVAL_APPROVER_NOT_MEMBERSHIP_TIER, APPROVAL_APPROVER_TYPE_DEPRECATED, APPROVAL_APPROVER_TYPE_UNKNOWN, APPROVAL_APPROVER_TYPE_UNSUPPORTED, APPROVAL_DECISION_OUTPUTS_RESERVED, APPROVAL_ESCALATION_REASSIGN_NO_TARGET, APPROVAL_EXPRESSION_INVALID, APPROVAL_EXPRESSION_NO_EMPTY_POLICY, AUTONUMBER_LITERAL_TOKEN, AUTONUMBER_OPTIONAL_FIELD, AUTONUMBER_SELF_REFERENCE, AUTONUMBER_UNKNOWN_FIELD, type ActionBodyWriteExclusion, type ActionBodyWriteFinding, type ActionBodyWriteSeverity, type ActionLocationsFinding, type ActionLocationsSeverity, type ActionNameRefFinding, type ActionNameRefSeverity, type AiAgentAuthoringFinding, type AiAgentAuthoringSeverity, type AiSurfaceAffinityFinding, type AiSurfaceAffinitySeverity, type AiToolRefFinding, type AiToolRefSeverity, type ApprovalApproverFinding, type ApprovalApproverSeverity, type AutonumberLintFinding, type BodyWritePatternExclusion, CAPABILITY_REFERENCE_UNKNOWN, CHART_AXIS_NOT_SELECTED, CHART_CONFIG_MISSING, CHART_DATASET_UNKNOWN, CHART_DIMENSION_UNKNOWN, CHART_FIELD_UNKNOWN, CHART_MEASURE_UNKNOWN, COMPONENT_PROPS_INVALID, COMPONENT_PROPS_UNKNOWN_KEY, type CapabilityRefFinding, type CapabilityRefSeverity, type ChartBindingFinding, type ChartBindingSeverity, type ComponentPropsFinding, type ComponentPropsSeverity, DASHBOARD_ACTION_ROUTE_UNRESOLVED, DASHBOARD_ACTION_TARGET_UNDEFINED, DASHBOARD_FILTER_FIELD_UNKNOWN, type DashboardActionRefFinding, type DashboardActionRefSeverity, type ExprIssue, type ExtractedHookBodyWrite, type ExtractedHookBodyWriteSet, FIELD_GROUP_EMPTY, FIELD_GROUP_SHADOWED, FIELD_GROUP_UNDECLARED, FILTER_TOKEN_UNKNOWN, FLOW_APPROVAL_REVISE_DEAD_END, FLOW_APPROVAL_REVISE_DISABLED, FLOW_APPROVAL_REVISE_TARGET_NOT_SERVICE_OWNED, FLOW_APPROVAL_REVISE_UNMARKED_BACKEDGE, FLOW_BARE_DOLLAR_REF, FLOW_BRANCH_LABEL_UNMATCHED, FLOW_DATE_EQUALITY_FILTER, FLOW_DECISION_UNCONDITIONAL_BRANCH, FLOW_DEFAULT_EDGE_WITH_CONDITION, FLOW_DOUBLE_BRACE_INTERP, FLOW_DRAFT_STATUS_AMBIGUOUS, FLOW_ERROR_LABEL_NOT_FAULT, FLOW_INERT_NODE_CONDITION, FLOW_MULTIPLE_DEFAULT_EDGES, FLOW_MULTI_WRITE_UNFILTERED, FLOW_NODE_WRITE_UNKNOWN_FIELD, FLOW_PHANTOM_AGGREGATION, FLOW_RUNAS_UNSCOPED, FLOW_TEMPLATE_LOOKUP_TRAVERSAL, FLOW_TEMPLATE_UNKNOWN_FIELD, FLOW_TIME_RELATIVE_ANTIPATTERN, FLOW_TIME_RELATIVE_DESCRIPTOR_INVALID, FLOW_TIME_RELATIVE_DESCRIPTOR_UNROUTABLE, FLOW_TRIGGER_UNKNOWN_EVENT, FLOW_TRIGGER_UNKNOWN_OBJECT, FLOW_UPDATE_READONLY_FIELD, FLOW_UPDATE_READONLY_WHEN_FIELD, FLOW_WRITE_NODE_TYPES, FLOW_WRITE_NODE_TYPES_DEFERRED, FORM_COLSPAN_ABSOLUTE, FORM_FIELD_UNKNOWN, type FilterTokenFinding, type FilterTokenSeverity, type FlowLintFinding, type FlowNodeWriteFinding, type FlowNodeWriteSeverity, type FlowTemplatePathFinding, type FlowTemplatePathSeverity, type FlowTriggerReadinessFinding, type FlowTriggerReadinessSeverity, type FlowWriteNodeDeferral, type FormLayoutFinding, type FormLayoutSeverity, type FunctionalCompletenessFinding, type FunctionalCompletenessSeverity, HOOK_BODY_WRITE_EXCLUSIONS, HOOK_BODY_WRITE_PATTERNS, HOOK_BODY_WRITE_PATTERN_IDS, HOOK_BODY_WRITE_UNKNOWN_FIELD, type HookBodyWriteFinding, type HookBodyWritePattern, type HookBodyWriteSeverity, type JsxPageFinding, type JsxPageSeverity, LIST_VIEW_FILTERS_IN_VIEWS_MODE, LIVENESS_DEAD_PROPERTY, LIVENESS_EXPERIMENTAL_PROPERTY, type LintIssue, type ListViewModeFinding, type ListViewModeSeverity, type LivenessLintFinding, MAX_SCHEMA_WALK_DEPTH, MEASURE_AGGREGATE_INCOHERENT, NAV_OBJECT_UNGRANTED, NAV_TARGET_UNRESOLVED, NULL_GUARD_HINT, type NavAccessFinding, type NavAccessSeverity, type NavTargetRefFinding, type NavTargetRefSeverity, type NullGuardFinding, type NullGuardOptions, OBJECT_REFERENCE_UNKNOWN, OBJECT_REFERENCE_UNREGISTERED_PLATFORM, ORG_AXIS_CROSS_ORG_BU_GRANT, ORG_AXIS_PERMISSION_INHERITANCE, type ObjectRefFinding, type ObjectRefSeverity, type OrgAxisFinding, type OrgAxisSeverity, PAGE_FIELD_UNKNOWN, PAGE_SOURCE_CLASSNAME, type PageFieldFinding, type PageFieldSeverity, REACT_BLOCK_NEEDS_RECORD_CONTEXT, REACT_CHART_AGGREGATE_INVALID, REACT_CHART_AXIS_UNKNOWN, REACT_CHART_DRILLDOWN_INVALID, REACT_CHART_FIELD_UNKNOWN, REFERENCE_INTEGRITY_RULES, RLS_PREDICATE_UNENFORCEABLE, RLS_PREDICATE_UNPARSEABLE, RUNTIME_AJV_OPTIONS, type ReactPageFinding, type ReactPageSeverity, type ReactPropFinding, type ReactPropSeverity, type ReadonlyFlowWriteFinding, type ReadonlyFlowWriteSeverity, type RecordTitleFinding, type RecordTitleSeverity, type ReferenceIntegrityFinding, type ReferenceIntegrityRule, type ReferenceIntegritySeverity, type RlsPredicateFinding, type RlsPredicateSeverity, type RuleCompilabilityFinding, type RuleCompilabilitySeverity, type RuleSchemaFormatFinding, type RuleSchemaFormatSeverity, SEARCHABLE_FIELD_UNKNOWN, SEARCHABLE_FIELD_UNSEARCHABLE, SECURITY_ANCHOR_HIGH_PRIVILEGE, SECURITY_BOOK_AUDIENCE_UNKNOWN_SET, SECURITY_DELEGATION_MISSING_REASON, SECURITY_EXTERNAL_WIDER, SECURITY_FLS_UNQUALIFIED_KEY, SECURITY_GRANT_EXPIRED_AT_AUTHORING, SECURITY_MASTER_DETAIL_UNGRANTED, SECURITY_OWD_ALIAS, SECURITY_OWD_UNSET, SECURITY_PRIVATE_NO_READSCOPE, SECURITY_ROLE_WORD, SECURITY_WILDCARD_VAMA, SEED_INSERT_MODE_DUPLICATES_ON_REPLAY, SEED_VALUE_OUTSIDE_STATE_MACHINE, SEMANTIC_ROLE_FIELD_UNKNOWN, SHARING_RULE_RUNTIME_VARIABLE_CONDITION, SHARING_RULE_UNLOWERABLE_CONDITION, STYLE_CLASSNAME_TAILWIND, STYLE_NODE_MISSING_ID, STYLE_RESPONSIVE_NO_BASE, STYLE_UNKNOWN_CSS_PROPERTY, STYLE_UNKNOWN_TOKEN, type SearchableFieldFinding, type SearchableFieldRole, type SearchableFieldSeverity, type SecurityFinding, type SecuritySeverity, type SeedReplaySafetyFinding, type SeedReplaySafetySeverity, type SeedStateMachineFinding, type SeedStateMachineSeverity, type SemanticRoleFinding, type SemanticRoleSeverity, type Severity, type SharingRuleEnforceabilityFinding, type SharingRuleEnforceabilitySeverity, type SourceStyleFinding, type SourceStyleSeverity, type StyleFinding, type StyleSeverity, TABLE_COUNT_ONLY, TITLE_FORMAT_RETIRED, TITLE_UNRESOLVABLE, TRANSLATION_OPTION_KEY_UNKNOWN, TRANSLATION_SECTION_NAME_MISSING, TRANSLATION_TARGET_UNKNOWN, type TranslatableSectionFinding, type TranslatableSectionSeverity, type TranslationRefFinding, type TranslationRefSeverity, UNIQUE_DOUBLE_DECLARATION, UNIQUE_LEGACY_ORGANIZATION_COMPOSITE, UNIQUE_UNSCOPED_DECLARED_INDEX, VALIDATION_RULE_REGEX_UNCOMPILABLE, VALIDATION_RULE_SCHEMA_UNCOMPILABLE, VALIDATION_RULE_SCHEMA_UNKNOWN_FORMAT, VIEW_CONTAINER_SHAPE, VIEW_KEY_COLLISION, VIEW_REF_FORM_TARGET_KIND, VIEW_REF_FORM_TARGET_MISSING, VISIBILITY_ALIAS_DEPRECATED, VISIBILITY_ROOT_MISLAYERED, type ViewContainerFinding, type ViewContainerSeverity, type ViewRefFinding, type VisibilityFinding, type VisibilityLayer, type VisibilityOptions, type VisibilitySeverity, WIDGET_DATASET_UNKNOWN, WIDGET_DIMENSION_UNKNOWN, WIDGET_LEGACY_ANALYTICS_SHAPE, WIDGET_LEGACY_ANALYTICS_UNRENDERABLE, WIDGET_MEASURE_UNKNOWN, type WalkedComponent, type WalkedValidationRule, type WidgetBindingFinding, type WidgetBindingSeverity, buildAccessMatrix, diffAccessMatrix, extractHookBodyWriteSet, extractHookBodyWrites, findUnguardedNullableOperands, isSourceAuthoredPage, lintAutonumberFormats, lintDataModel, lintFlowPatterns, lintLegacyOrganizationComposites, lintLivenessProperties, lintUniqueDeclarations, lintUnscopedDeclaredIndexes, lintViewRefs, nearestRegisteredFormat, nullGuardMessage, validateActionBodyWrites, validateActionLocations, validateActionNameRefs, validateAiAgentAuthoring, validateAiSurfaceAffinity, validateAiToolReferences, validateApprovalApprovers, validateCapabilityReferences, validateChartBindings, validateComponentProps, validateDashboardActionRefs, validateFilterTokens, validateFlowNodeWrites, validateFlowTemplatePaths, validateFlowTriggerReadiness, validateFormLayout, validateFunctionalCompleteness, validateHookBodyWrites, validateJsxPages, validateListViewMode, validateNavAccess, validateNavTargetRefs, validateObjectReferences, validateOrgAxisRedLines, validatePageFieldBindings, validatePageSourceStyling, validateReactPageProps, validateReactPages, validateReadonlyFlowWrites, validateRecordTitle, validateReferenceIntegrity, validateResponsiveStyles, validateRlsPredicateEnforceability, validateRuleCompilability, validateRuleSchemaFormats, validateSearchableFields, validateSecurityPosture, validateSeedReplaySafety, validateSeedStateMachine, validateSemanticRoles, validateSharingRuleEnforceability, validateStackExpressions, validateTranslatableSections, validateTranslationReferences, validateViewContainers, validateVisibilityPredicates, validateWidgetBindings, walkPageComponents };
+export { ACTION_BODY_WRITE_EXCLUSIONS, ACTION_BODY_WRITE_PATTERNS, ACTION_BODY_WRITE_PATTERN_IDS, ACTION_BODY_WRITE_UNKNOWN_FIELD, ACTION_NAME_UNDEFINED, ACTION_NO_PLACEMENT, ACTION_RECORD_WRITE_DISCARDED, ACTION_RECORD_WRITE_PATTERNS, ACTION_RECORD_WRITE_PATTERN_IDS, AGENT_AUTHORING_WITHDRAWN, AI_SKILL_SURFACE_MISMATCH, AI_SKILL_TOOL_UNRESOLVED, APPROVAL_APPROVERS_MAY_RESOLVE_EMPTY, APPROVAL_APPROVER_CROSS_ORG_UNSUPPORTED, APPROVAL_APPROVER_NOT_MEMBERSHIP_TIER, APPROVAL_APPROVER_TYPE_DEPRECATED, APPROVAL_APPROVER_TYPE_UNKNOWN, APPROVAL_APPROVER_TYPE_UNSUPPORTED, APPROVAL_DECISION_OUTPUTS_RESERVED, APPROVAL_ESCALATION_REASSIGN_NO_TARGET, APPROVAL_EXPRESSION_INVALID, APPROVAL_EXPRESSION_NO_EMPTY_POLICY, AUTONUMBER_LITERAL_TOKEN, AUTONUMBER_OPTIONAL_FIELD, AUTONUMBER_SELF_REFERENCE, AUTONUMBER_UNKNOWN_FIELD, type ActionBodyWriteExclusion, type ActionBodyWriteFinding, type ActionBodyWriteSeverity, type ActionLocationsFinding, type ActionLocationsSeverity, type ActionNameRefFinding, type ActionNameRefSeverity, type AiAgentAuthoringFinding, type AiAgentAuthoringSeverity, type AiSurfaceAffinityFinding, type AiSurfaceAffinitySeverity, type AiToolRefFinding, type AiToolRefSeverity, type ApprovalApproverFinding, type ApprovalApproverSeverity, type AutonumberLintFinding, type BodyWritePatternExclusion, CAPABILITY_REFERENCE_UNKNOWN, CHART_AXIS_NOT_SELECTED, CHART_CONFIG_MISSING, CHART_DATASET_UNKNOWN, CHART_DIMENSION_UNKNOWN, CHART_FIELD_UNKNOWN, CHART_MEASURE_UNKNOWN, COMPONENT_PROPS_INVALID, COMPONENT_PROPS_UNKNOWN_KEY, type CapabilityRefFinding, type CapabilityRefSeverity, type ChartBindingFinding, type ChartBindingSeverity, type ComponentPropsFinding, type ComponentPropsSeverity, DASHBOARD_ACTION_ROUTE_UNRESOLVED, DASHBOARD_ACTION_TARGET_UNDEFINED, DASHBOARD_FILTER_FIELD_UNKNOWN, DASHBOARD_FILTER_FIELD_UNPROVISIONED, DEFAULT_AGENT_OUTSIDE_ROSTER, type DashboardActionRefFinding, type DashboardActionRefSeverity, type EmptyCombinatorFinding, type EmptyCombinatorSeverity, type ExprIssue, type ExtractedHookBodyWrite, type ExtractedHookBodyWriteSet, FIELD_GROUP_EMPTY, FIELD_GROUP_SHADOWED, FIELD_GROUP_UNDECLARED, FILTER_EMPTY_COMBINATOR, FILTER_EMPTY_NODE, FILTER_TOKEN_UNKNOWN, FLOW_APPROVAL_REVISE_DEAD_END, FLOW_APPROVAL_REVISE_DISABLED, FLOW_APPROVAL_REVISE_TARGET_NOT_SERVICE_OWNED, FLOW_APPROVAL_REVISE_UNMARKED_BACKEDGE, FLOW_BARE_DOLLAR_REF, FLOW_BRANCH_LABEL_UNMATCHED, FLOW_DATE_EQUALITY_FILTER, FLOW_DECISION_UNCONDITIONAL_BRANCH, FLOW_DEFAULT_EDGE_WITH_CONDITION, FLOW_DOUBLE_BRACE_INTERP, FLOW_DRAFT_STATUS_AMBIGUOUS, FLOW_ERROR_LABEL_NOT_FAULT, FLOW_INERT_NODE_CONDITION, FLOW_MULTIPLE_DEFAULT_EDGES, FLOW_MULTI_WRITE_UNFILTERED, FLOW_NODE_WRITE_UNKNOWN_FIELD, FLOW_PHANTOM_AGGREGATION, FLOW_RUNAS_UNSCOPED, FLOW_TEMPLATE_FIELD_UNPROVISIONED, FLOW_TEMPLATE_LOOKUP_TRAVERSAL, FLOW_TEMPLATE_UNKNOWN_FIELD, FLOW_TIME_RELATIVE_ANTIPATTERN, FLOW_TIME_RELATIVE_DESCRIPTOR_INVALID, FLOW_TIME_RELATIVE_DESCRIPTOR_UNROUTABLE, FLOW_TRIGGER_UNKNOWN_EVENT, FLOW_TRIGGER_UNKNOWN_OBJECT, FLOW_TRIGGER_UNROUTABLE, FLOW_UPDATE_READONLY_FIELD, FLOW_UPDATE_READONLY_WHEN_FIELD, FLOW_WRITE_NODE_TYPES, FLOW_WRITE_NODE_TYPES_DEFERRED, FORM_COLSPAN_ABSOLUTE, FORM_FIELD_UNKNOWN, type FilterTokenFinding, type FilterTokenSeverity, type FlowLintFinding, type FlowNodeWriteFinding, type FlowNodeWriteSeverity, type FlowTemplatePathFinding, type FlowTemplatePathSeverity, type FlowTriggerReadinessFinding, type FlowTriggerReadinessSeverity, type FlowWriteNodeDeferral, type FormLayoutFinding, type FormLayoutSeverity, type FunctionalCompletenessFinding, type FunctionalCompletenessSeverity, HOOK_BODY_WRITE_EXCLUSIONS, HOOK_BODY_WRITE_PATTERNS, HOOK_BODY_WRITE_PATTERN_IDS, HOOK_BODY_WRITE_UNKNOWN_FIELD, type HookBodyWriteFinding, type HookBodyWritePattern, type HookBodyWriteSeverity, type JsxPageFinding, type JsxPageSeverity, LIST_VIEW_FILTERS_IN_VIEWS_MODE, LIVENESS_DEAD_PROPERTY, LIVENESS_EXPERIMENTAL_PROPERTY, type LintIssue, type ListViewModeFinding, type ListViewModeSeverity, type LivenessLintFinding, MANAGED_API_METHOD_UNAFFORDABLE, MAX_SCHEMA_WALK_DEPTH, MEASURE_AGGREGATE_INCOHERENT, type ManagedApiMethodFinding, NAV_OBJECT_UNGRANTED, NAV_OBJECT_UNSERVABLE, NAV_TARGET_UNRESOLVED, NULL_GUARD_HINT, type NavAccessFinding, type NavAccessSeverity, type NavObjectServabilityFinding, type NavTargetRefFinding, type NavTargetRefSeverity, type NullGuardFinding, type NullGuardOptions, OBJECT_REFERENCE_UNKNOWN, OBJECT_REFERENCE_UNREGISTERED_PLATFORM, OPEN_VOCABULARY_PROBES, ORG_AXIS_CROSS_ORG_BU_GRANT, ORG_AXIS_PERMISSION_INHERITANCE, type ObjectRefFinding, type ObjectRefSeverity, type OrgAxisFinding, type OrgAxisSeverity, PAGE_FIELD_UNKNOWN, PAGE_FIELD_UNPROVISIONED, PAGE_SOURCE_CLASSNAME, PREDICATE_PATH_UNRESOLVED, PREDICATE_PATH_UNROOTED, PREDICATE_RHS_PATH_SHAPED, PRE_SEAL_PHASES, type PageFieldFinding, type PageFieldSeverity, type PredicatePathFinding, type PredicatePathOptions, type PredicatePathSeverity, REACT_BLOCK_NEEDS_RECORD_CONTEXT, REACT_CHART_AGGREGATE_INVALID, REACT_CHART_AXIS_UNKNOWN, REACT_CHART_DRILLDOWN_INVALID, REACT_CHART_FIELD_UNKNOWN, REACT_CHART_FIELD_UNPROVISIONED, REFERENCE_INTEGRITY_RULES, RLS_PREDICATE_OVER_BUDGET, RLS_PREDICATE_UNENFORCEABLE, RLS_PREDICATE_UNPARSEABLE, RUNTIME_AJV_OPTIONS, type ReactPageFinding, type ReactPageSeverity, type ReactPropFinding, type ReactPropSeverity, type ReadonlyFlowWriteFinding, type ReadonlyFlowWriteSeverity, type RecordTitleFinding, type RecordTitleSeverity, type ReferenceIntegrityFinding, type ReferenceIntegrityRule, type ReferenceIntegritySeverity, type RlsPredicateFinding, type RlsPredicateSeverity, type RuleCompilabilityFinding, type RuleCompilabilitySeverity, type RuleSchemaFormatFinding, type RuleSchemaFormatSeverity, SEAL_MARKERS, SEARCHABLE_FIELD_UNKNOWN, SEARCHABLE_FIELD_UNSEARCHABLE, SECURITY_ANCHOR_HIGH_PRIVILEGE, SECURITY_BOOK_AUDIENCE_UNKNOWN_SET, SECURITY_CBP_NO_RELATION, SECURITY_DELEGATION_MISSING_REASON, SECURITY_EXTERNAL_WIDER, SECURITY_FLS_UNQUALIFIED_KEY, SECURITY_GRANT_EXPIRED_AT_AUTHORING, SECURITY_MASTER_DETAIL_UNGRANTED, SECURITY_OWD_ALIAS, SECURITY_OWD_UNSET, SECURITY_PRIVATE_NO_READSCOPE, SECURITY_ROLE_WORD, SECURITY_WILDCARD_VAMA, SEED_INSERT_MODE_DUPLICATES_ON_REPLAY, SEED_VALUE_OUTSIDE_STATE_MACHINE, SEMANTIC_ROLE_FIELD_UNKNOWN, SEMANTIC_ROLE_FIELD_UNPROVISIONED, SHARING_RULE_RUNTIME_VARIABLE_CONDITION, SHARING_RULE_UNLOWERABLE_CONDITION, STARTUP_OPEN_VOCABULARY_VERDICT, STARTUP_VERDICT_ASSERTIVE_WORDING, STARTUP_VERDICT_HINT, STYLE_CLASSNAME_TAILWIND, STYLE_NODE_MISSING_ID, STYLE_RESPONSIVE_NO_BASE, STYLE_UNKNOWN_CSS_PROPERTY, STYLE_UNKNOWN_TOKEN, type SearchableFieldFinding, type SearchableFieldRole, type SearchableFieldSeverity, type SecurityFinding, type SecuritySeverity, type SeedReplaySafetyFinding, type SeedReplaySafetySeverity, type SeedStateMachineFinding, type SeedStateMachineSeverity, type SemanticRoleFinding, type SemanticRoleSeverity, type Severity, type SharingRuleEnforceabilityFinding, type SharingRuleEnforceabilitySeverity, type SourceStyleFinding, type SourceStyleSeverity, type StartupRegistryVerdictFinding, type StartupRegistryVerdictOptions, type StartupRegistryVerdictSeverity, type StyleFinding, type StyleSeverity, TABLE_COUNT_ONLY, TITLE_FORMAT_RETIRED, TITLE_UNRESOLVABLE, TRANSLATION_OPTION_KEY_UNKNOWN, TRANSLATION_SECTION_NAME_MISSING, TRANSLATION_TARGET_UNKNOWN, type TranslatableSectionFinding, type TranslatableSectionSeverity, type TranslationRefFinding, type TranslationRefSeverity, UNIQUE_DOUBLE_DECLARATION, UNIQUE_LEGACY_ORGANIZATION_COMPOSITE, UNIQUE_UNSCOPED_DECLARED_INDEX, VALIDATION_RULE_REGEX_UNCOMPILABLE, VALIDATION_RULE_SCHEMA_UNCOMPILABLE, VALIDATION_RULE_SCHEMA_UNKNOWN_FORMAT, VIEW_CONTAINER_SHAPE, VIEW_KEY_COLLISION, VIEW_REF_FORM_TARGET_KIND, VIEW_REF_FORM_TARGET_MISSING, VISIBILITY_BARE_IDENTIFIER, VISIBILITY_PREDICATE_OVER_BUDGET, VISIBILITY_PREDICATE_SYNTAX, VISIBILITY_ROOT_MISLAYERED, type ViewContainerFinding, type ViewContainerSeverity, type ViewRefFinding, type VisibilityFinding, type VisibilityLayer, type VisibilityOptions, type VisibilitySeverity, WIDGET_DATASET_UNKNOWN, WIDGET_DIMENSION_UNKNOWN, WIDGET_LEGACY_ANALYTICS_SHAPE, WIDGET_LEGACY_ANALYTICS_UNRENDERABLE, WIDGET_MEASURE_UNKNOWN, type WalkedComponent, type WalkedValidationRule, type WidgetBindingFinding, type WidgetBindingSeverity, buildAccessMatrix, diffAccessMatrix, extractHookBodyWriteSet, extractHookBodyWrites, findStartupRegistryVerdicts, findUnguardedNullableOperands, isSourceAuthoredPage, lintAutonumberFormats, lintDataModel, lintFlowPatterns, lintLegacyOrganizationComposites, lintLivenessProperties, lintUniqueDeclarations, lintUnscopedDeclaredIndexes, lintViewRefs, nearestRegisteredFormat, nullGuardMessage, validateActionBodyWrites, validateActionLocations, validateActionNameRefs, validateAiAgentAuthoring, validateAiSurfaceAffinity, validateAiToolReferences, validateApprovalApprovers, validateCapabilityReferences, validateChartBindings, validateComponentProps, validateDashboardActionRefs, validateEmptyCombinators, validateFilterTokens, validateFlowNodeWrites, validateFlowTemplatePaths, validateFlowTriggerReadiness, validateFormLayout, validateFunctionalCompleteness, validateHookBodyWrites, validateJsxPages, validateListViewMode, validateManagedApiMethods, validateNavAccess, validateNavObjectServability, validateNavTargetRefs, validateObjectReferences, validateOrgAxisRedLines, validatePageFieldBindings, validatePageSourceStyling, validatePredicatePathRefs, validateReactPageProps, validateReactPages, validateReadonlyFlowWrites, validateRecordTitle, validateReferenceIntegrity, validateResponsiveStyles, validateRlsPredicateEnforceability, validateRuleCompilability, validateRuleSchemaFormats, validateSearchableFields, validateSecurityPosture, validateSecurityRoleWord, validateSeedReplaySafety, validateSeedStateMachine, validateSemanticRoles, validateSharingRuleEnforceability, validateStackExpressions, validateTranslatableSections, validateTranslationReferences, validateViewContainers, validateVisibilityPredicates, validateWidgetBindings, walkPageComponents };