@forge/lint

Index: package/out/lint/text/messages.js
===================================================================
--- package/out/lint/text/messages.js
+++ package/out/lint/text/messages.js
@@ -74,8 +74,12 @@
         deprecatedApiStorage: {
             message: () => `The \"storage\" export from \"@forge/api\" is deprecated. Use the \"@forge/kvs\" package instead.`,
             reference: 'deprecated-api-storage'
         },
+        appManagedPermissionsSdk: {
+            message: () => 'App-managed permissions enforcement is set in the manifest. Source files include API usage that requires OAuth scopes (such as requestJira or external fetch), without checks for when those scopes are missing. Use the Permissions SDK (@forge/api, @forge/bridge, or @forge/react), displayConditions.permissions, or a trigger filter that references event.permissions.',
+            reference: 'https://go.atlassian.com/forge-permissions-sdk'
+        },
         functionTimeout: {
             shared: {
                 message: (functionKey, conflictingModuleKey, conflictingModuleType) => `Function "${functionKey}" is used by a consumer and ${conflictingModuleType} "${conflictingModuleKey}". Consumer functions must not be shared with other modules. Use a separate function for each module type.`,
                 reference: 'https://developer.atlassian.com/platform/forge/use-a-long-running-function/'