fix(spec): cross-validate permission/profile object grants against declared objects

`validateCrossReferences` checked hook/view/seed/app-nav/action references against
the declared object set — but NOT permission-set/profile `objects` grants, even
though `validateNamespacePrefix`'s doc already assumed it did. So a profile that
grants on a non-existent object (e.g. a short `lead` instead of the namespaced
`crm_lead`) passed build/validate/test silently. The grant then applies to
nothing: the authenticated path may namespace-resolve the short name, but the
anonymous / explicit-permission-set path does not — so e.g. a public Web-to-Lead
INSERT is denied for "roles []", with no diagnostic anywhere.

Add the missing check: every `permissions[].objects` key must reference a declared
object, or strict validation fails loudly at build time.

- stack.zod.ts: validate permission/profile object grants → object references
- stack.test.ts: +2 cases (short/undefined name fails; full name passes)

82/82 spec stack tests pass.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: os-zhuang

packages/spec/src/stack.test.ts

@@ -485,6 +485,43 @@ describe('defineStack', () => {
     expect(() => defineStack(config, { strict: true })).not.toThrow();
   });
 
+  it('should detect permission/profile granting on an undefined object in strict mode', () => {
+    const config = {
+      manifest: baseManifest,
+      objects: [
+        { name: 'crm_lead', fields: { email: { type: 'email' } } },
+      ],
+      permissions: [
+        {
+          name: 'guest_portal',
+          isProfile: true,
+          // BUG: the object is `crm_lead`, not the short `lead` — the short name
+          // exists nowhere, so this grant silently applies to nothing (and the
+          // anonymous permission path denies the write). Must fail loudly.
+          objects: { lead: { allowCreate: true } },
+        },
+      ],
+    };
+    expect(() => defineStack(config, { strict: true })).toThrow("object 'lead'");
+  });
+
+  it('should pass strict mode when a permission grants on a defined (full-name) object', () => {
+    const config = {
+      manifest: baseManifest,
+      objects: [
+        { name: 'crm_lead', fields: { email: { type: 'email' } } },
+      ],
+      permissions: [
+        {
+          name: 'guest_portal',
+          isProfile: true,
+          objects: { crm_lead: { allowCreate: true } },
+        },
+      ],
+    };
+    expect(() => defineStack(config, { strict: true })).not.toThrow();
+  });
+
   it('should skip cross-reference validation when no objects are defined', () => {
     const config = {
       manifest: baseManifest,

packages/spec/src/stack.zod.ts

@@ -583,6 +583,29 @@ function validateCrossReferences(config: ObjectStackDefinition): string[] {
     }
   }
 
+  // Validate permission-set / profile object grants → object references.
+  // A grant keyed by an object that isn't declared (e.g. a short `lead` instead
+  // of the namespaced `crm_lead`) silently applies to NOTHING: the
+  // authenticated path may namespace-resolve it, but the anonymous /
+  // explicit-permission-set path does not — so the grant is simply lost (e.g. a
+  // public Web-to-Lead INSERT is denied for "roles []"). Fail loudly at build
+  // time. (`validateNamespacePrefix`'s doc already assumes this check lives here.)
+  if (config.permissions) {
+    for (const perm of config.permissions) {
+      const grants = (perm as { objects?: Record<string, unknown> }).objects;
+      if (grants && typeof grants === 'object') {
+        for (const objName of Object.keys(grants)) {
+          if (!objectNames.has(objName)) {
+            errors.push(
+              `Permission '${(perm as { name?: string }).name ?? '(unnamed)'}' grants on object ` +
+                `'${objName}' which is not defined in objects.`,
+            );
+          }
+        }
+      }
+    }
+  }
+
   // Validate app navigation → object/dashboard/page/report references
   if (config.apps) {
     const dashboardNames = new Set<string>();