fix(spec): cross-validate permission object grants against declared objects (#1997)

* feat(crm): working Web-to-Lead public form example

The app-crm example showed Web-to-Lead only via `customer.portal` `anonymousEntry`
— a spec property with NO runtime consumer, so it never worked (404). Add the
mechanism that actually does, and make the example coherent:

- lead.view.ts: `web_to_lead` form view with `sharing.allowAnonymous` →
  live `GET/POST /api/v1/forms/contact-us` (+ /submit).
- sales-roles.ts: `GuestPortalProfile` (isProfile, INSERT-only on crm_lead, keyed
  by FULL object name — the anonymous permission path requires it).
- lead.object.ts: `status` gets `defaultValue: 'new'` so a minimal public create
  satisfies `required` (the option-level `default` is only a UI preselect).
- customer.portal.ts: drop the dead `anonymousEntry` routes; point to the working
  form view instead (re-add when the runtime mounts anonymousEntry).
- security/index.ts + objectstack.config.ts: export + register the guest profile.

Doubles as a CI regression test for the public-form path (builds against the
workspace) — the #1989 flattened-metadata resolution bug would have been caught here.

Verified end-to-end (app-crm, no auth): GET /forms/contact-us → 200 form spec;
POST /forms/contact-us/submit → creates a crm_lead (status=new); GET /data/crm_lead
→ 401 (guests can't read).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(spec): cross-validate permission/profile object grants against declared objects

`validateCrossReferences` checked hook/view/seed/app-nav/action references against
the declared object set — but NOT permission-set/profile `objects` grants, even
though `validateNamespacePrefix`'s doc already assumed it did. So a profile that
grants on a non-existent object (e.g. a short `lead` instead of the namespaced
`crm_lead`) passed build/validate/test silently. The grant then applies to
nothing: the authenticated path may namespace-resolve the short name, but the
anonymous / explicit-permission-set path does not — so e.g. a public Web-to-Lead
INSERT is denied for "roles []", with no diagnostic anywhere.

Add the missing check: every `permissions[].objects` key must reference a declared
object, or strict validation fails loudly at build time.

- stack.zod.ts: validate permission/profile object grants → object references
- stack.test.ts: +2 cases (short/undefined name fails; full name passes)

82/82 spec stack tests pass.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: os-zhuang

packages/spec/src/stack.test.ts

@@ -485,6 +485,43 @@ describe('defineStack', () => {
     expect(() => defineStack(config, { strict: true })).not.toThrow();
   });
 
+  it('should detect permission/profile granting on an undefined object in strict mode', () => {
+    const config = {
+      manifest: baseManifest,
+      objects: [
+        { name: 'crm_lead', fields: { email: { type: 'email' } } },
+      ],
+      permissions: [
+        {
+          name: 'guest_portal',
+          isProfile: true,
+          // BUG: the object is `crm_lead`, not the short `lead` — the short name
+          // exists nowhere, so this grant silently applies to nothing (and the
+          // anonymous permission path denies the write). Must fail loudly.
+          objects: { lead: { allowCreate: true } },
+        },
+      ],
+    };
+    expect(() => defineStack(config, { strict: true })).toThrow("object 'lead'");
+  });
+
+  it('should pass strict mode when a permission grants on a defined (full-name) object', () => {
+    const config = {
+      manifest: baseManifest,
+      objects: [
+        { name: 'crm_lead', fields: { email: { type: 'email' } } },
+      ],
+      permissions: [
+        {
+          name: 'guest_portal',
+          isProfile: true,
+          objects: { crm_lead: { allowCreate: true } },
+        },
+      ],
+    };
+    expect(() => defineStack(config, { strict: true })).not.toThrow();
+  });
+
   it('should skip cross-reference validation when no objects are defined', () => {
     const config = {
       manifest: baseManifest,

packages/spec/src/stack.zod.ts

@@ -583,6 +583,29 @@ function validateCrossReferences(config: ObjectStackDefinition): string[] {
     }
   }
 
+  // Validate permission-set / profile object grants → object references.
+  // A grant keyed by an object that isn't declared (e.g. a short `lead` instead
+  // of the namespaced `crm_lead`) silently applies to NOTHING: the
+  // authenticated path may namespace-resolve it, but the anonymous /
+  // explicit-permission-set path does not — so the grant is simply lost (e.g. a
+  // public Web-to-Lead INSERT is denied for "roles []"). Fail loudly at build
+  // time. (`validateNamespacePrefix`'s doc already assumes this check lives here.)
+  if (config.permissions) {
+    for (const perm of config.permissions) {
+      const grants = (perm as { objects?: Record<string, unknown> }).objects;
+      if (grants && typeof grants === 'object') {
+        for (const objName of Object.keys(grants)) {
+          if (!objectNames.has(objName)) {
+            errors.push(
+              `Permission '${(perm as { name?: string }).name ?? '(unnamed)'}' grants on object ` +
+                `'${objName}' which is not defined in objects.`,
+            );
+          }
+        }
+      }
+    }
+  }
+
   // Validate app navigation → object/dashboard/page/report references
   if (config.apps) {
     const dashboardNames = new Set<string>();