chore(deps): upgrade @objectstack/* to 17.7.0

.changeset/objectstack-17-7-0.md

@@ -0,0 +1,100 @@
+---
+'hotcrm': minor
+---
+
+Upgrade the ObjectStack platform to 17.7.0
+
+All 21 `@objectstack/*` dependencies move 17.6.0 → 17.7.0 together — 20 in
+`dependencies`, `@objectstack/formula` in `devDependencies` — pinned exact, no
+caret. `specVersion` and `engines.protocol` follow to `^17.7.0`, in
+`objectstack.manifest.json` and in the stack manifest in `objectstack.config.ts`.
+17.7.0 still implements protocol 17, so both declarations stay on major 17.
+`pnpm-lock.yaml` was regenerated by `pnpm install` against the public registry:
+706 `packages:` entries before, 704 after. The 54 `@objectstack/*` and
+`create-objectstack` keys moved 1:1, `@noble/ciphers` and `jose` left the tree, and
+no third-party package changed version. The install still prints the peer note
+17.6.0 printed (`better-auth` asks for `better-sqlite3@^12`; 13.0.3 is installed).
+
+The platform changes that reached this app:
+
+- **The screen-flow dialogs speak the reader's language.** The 17.7.0 console's
+  flow runner reads the `flows` translation group (the spec's liveness row for it
+  is now `live`), and `os lint` reports a missing key as `i18n/missing-flow`. It
+  reported 108 on this app: the seven screen flows' labels, screen titles and
+  field labels, in zh-CN, es-ES and ja-JP. All 108 are translated, in each
+  locale's `app.ts`, using the words the packs already use for the same objects
+  and actions. A screen with no authored title shows its flow's label, so each
+  `screen_1.title` repeats the flow label. The quote dialog's discount label is
+  interpolated from `QUOTE_DISCOUNT_CEILING`, so the ceiling is still written in
+  one place only (#1711). **What readers will see:** a zh-CN seller opening
+  *Escalate Case*, *Close Case*, *Claim Case*, *Convert Lead*, *Schedule
+  Follow-up*, *Generate Quote* or *Enroll Members* now reads Chinese titles and
+  field labels where they read English. Six of the seven were opened in a zh-CN
+  browser; *Claim Case* is offered only on an unowned case, and the demo data
+  holds none. Select-option labels and screen
+  descriptions on these dialogs stay as authored: a screen field's options are
+  not a translatable key on the platform (`FLOW_SCREEN_FIELD_NO_OPTIONS`). This
+  closes #1210 and #1975.
+- **The lead page's Tasks list drops three action ids that named nothing.**
+  17.7.0 adds an author-time rule (`action-name-undefined`) that refuses a
+  `record:related_list` action id the related object does not define. The lead
+  page's Tasks list named `new_task`, `edit` and `complete`, and `crm_task`
+  defines no action, so none of them ever drew a button. The 17.7.0 console would
+  draw a refusal notice above the list for them instead. The ids are removed.
+  **What readers will see:** no change. The list's own *New* and *View all*
+  affordances are drawn by the platform and stay.
+- **The contact mailing-address conversion (#1836) works on 17.7.0.** 17.7.0
+  serves declared fields only, so no REST read returns a retired field's
+  leftover column any more. The conversion script read the five old `mailing_*`
+  columns that way, and on 17.7.0 it would have found nothing to convert. It now
+  takes `--unmapped FILE`, the JSON that the platform's new operator-only
+  `os migrate unmapped-columns --object crm_contact --json` prints, and still
+  writes through the REST API. Measured on 17.7.0 against a contact whose
+  `mailing_street` column held a value: the REST read carried no `mailing_*`
+  key; the command read it; the script converted it, read the address back, and
+  a second run reported it already converted.
+- **Claims that named 17.6.0 as the current pin are re-scoped.** The *What's
+  new* platform line and `docs/STATUS.md` name 17.7.0. A flow comment, a
+  composition comment, a maintainer-doc line and two test comments that read as
+  "17.6.0 is the pin" now date themselves. Claims written as "measured on
+  17.6.0" are dated truth and stay as they are. None was re-measured on 17.7.0
+  except the REST query door the backfill test models, which is unchanged.
+
+The test suite needed three adjustments, all to its harnesses: the engine now
+refuses an object name its registry does not hold (objectstack#21545), so nine
+files register the platform identity objects `plugin-auth` registers in a real
+boot; a by-id write to a row the caller cannot read now answers
+`RECORD_NOT_FOUND` instead of a permission error (objectstack#21812), so the
+reach tests expect that for unreadable rows, still refused and still unwritten;
+and the share-link test's response stub gains the `header()` the 17.7.0 route
+calls. No assertion was loosened.
+
+The upgrade was exercised in place on a database that HotCRM on 17.6.0 had
+created, seeded and written to, including an opportunity whose amount opened an
+approval request. `os migrate meta --stored` found no stored metadata row, so it
+attests nothing here; `os migrate audit-metadata-bodies` found nothing to
+rewrite; `os migrate plan` reported the schema in sync. The 17.7.0 server
+booted on that database with no errors, the 17.6.0 records opened, and the
+approval request opened on 17.6.0 was decided on 17.7.0 by an administrator's
+override. A fresh boot seeded the demo data, and a browser pass covered sign-in,
+dashboards, lists, record pages, record creation, a screen flow run, reports,
+the approvals inbox, both public forms and the zh-CN dialogs.
+
+**What operators should know:**
+
+- **The public Web-to-Lead and Web-to-Case forms keep working.** 17.7.0 serves
+  a form anonymously only when its `sharing` sets `enabled: true`, and both
+  forms already did. An anonymous Web-to-Lead submission on 17.7.0 created its
+  lead.
+- **Upgrading a deployment from HotCRM 3.1.0 moves contact addresses with the
+  new route.** Before `os migrate apply --allow-destructive`, run
+  `objectstack migrate unmapped-columns --object crm_contact --json > FILE` from
+  the project root, then the conversion script with `--unmapped FILE`.
+- **A write to a record the caller cannot see answers 404 `RECORD_NOT_FOUND`**,
+  where it answered 403 before. An integration that branches on 403 for this
+  case reads a 404 now.
+- **Not exercised here:** the release's rotate-after-first-boot step for flow
+  secrets. HotCRM's two billing-handoff flows carry a `signingSecret` only when
+  the build sets `HOTCRM_BILLING_SIGNING_SECRET`, and no run of this upgrade set
+  it. A deployment that does should rotate that secret after the first 17.7.0
+  boot, as the 17.7.0 upgrade checklist says.

content/docs/whats-new.mdx

@@ -71,8 +71,8 @@ http://localhost:4001 and create the first admin account.
 refuses the load up front with a structured diagnostic instead of failing deep
 in a schema parse.
 
-Since 3.1.0 was cut, the app has moved to **ObjectStack 17.6.0** (manifest range
-`^17.6.0`). That move ships with the next HotCRM release; until then, 3.1.0 is the
+Since 3.1.0 was cut, the app has moved to **ObjectStack 17.7.0** (manifest range
+`^17.7.0`). That move ships with the next HotCRM release; until then, 3.1.0 is the
 release that runs on 17.4.0.
 
 > **This page does not keep a second release table.** The release-by-release

content/docs/whats-new.zh-Hans.mdx

@@ -51,7 +51,7 @@ HOTCRM_TOKEN=... ./scripts/wow1-live-schema.sh
 应用清单声明了与之匹配的 `^17.4.0` 协议区间，因此协议大版本不同的运行时会在
 装载之初就带着结构化诊断拒绝加载，而不是在某次 schema 解析的深处才失败。
 
-3.1.0 发布之后，应用已迁移到 **ObjectStack 17.6.0**（清单区间 `^17.6.0`）。这次迁移随下一个
+3.1.0 发布之后，应用已迁移到 **ObjectStack 17.7.0**（清单区间 `^17.7.0`）。这次迁移随下一个
 HotCRM 版本发布；在那之前，运行在 17.4.0 上的发布版本仍是 3.1.0。
 
 > **这一页不维护第二张发布表。** 逐版本的发布历史在仓库的 `CHANGELOG.md` 里，由每个

content/docs/whats-new.zh-Hant.mdx

@@ -53,7 +53,7 @@ HOTCRM_TOKEN=... ./scripts/wow1-live-schema.sh
 應用清單宣告了與之相符的 `^17.4.0` 協定區間，因此協定大版本不同的執行時會在
 載入之初就帶著結構化診斷拒絕載入，而不是在某次 schema 解析的深處才失敗。
 
-3.1.0 發行之後，應用已遷移到 **ObjectStack 17.6.0**（清單區間 `^17.6.0`）。這次遷移隨下一個
+3.1.0 發行之後，應用已遷移到 **ObjectStack 17.7.0**（清單區間 `^17.7.0`）。這次遷移隨下一個
 HotCRM 版本發行；在那之前，執行在 17.4.0 上的發行版本仍是 3.1.0。
 
 > **這一頁不維護第二張發行表。** 逐版本的發行歷史在儲存庫的 `CHANGELOG.md` 裡，由每個

docs/STATUS.md

@@ -73,7 +73,7 @@ pnpm verify
 | --- | --- |
 | Node.js | `^22.11 \|\| ^24 \|\| >=26` |
 | pnpm | `>=10.0.0` |
-| ObjectStack packages | `17.6.0` |
+| ObjectStack packages | `17.7.0` |
 | Local dev port | `4001` |
 
 Each row above is asserted against `package.json` (`engines`, the `@objectstack/*`

docs/architecture/module-split-plan.md

@@ -360,7 +360,7 @@ would otherwise slug the heading to `#上游缺口--upstream-gaps` — the exact
   [objectstack#14430](https://github.com/objectstack-ai/objectstack/issues/14430).
 - An objectstack release carrying both, and the version bump in this repository. HotCRM was
   pinned to `@objectstack/*` 17.4.0 when this was written (PR #1814, #1807) and moved to 17.5.0,
-  then 17.6.0, after it (this plan's own measurements were taken at the 17.2.0 pin and are labelled as such).
+  then 17.6.0 and 17.7.0, after it (this plan's own measurements were taken at the 17.2.0 pin and are labelled as such).
   Merged upstream is not the same as available
   in the pin (AGENTS.md, *Platform Upgrades*).
 

objectstack.composition.ts

@@ -349,8 +349,8 @@ export { CrmPositions };
  * The PLATFORM does it, at the only moment it can: when the seed settles,
  * `@objectstack/plugin-security` re-runs its seed-ownership claim on
  * `app:seeded` and hands every ownerless row of every object carrying
- * `owner_id` to the first platform administrator (objectstack#17872, in the
- * 17.6.0 pin). No HotCRM flow is involved. The `demo_bootstrap` sweep that used
+ * `owner_id` to the first platform administrator (objectstack#17872, shipped in
+ * 17.6.0). No HotCRM flow is involved. The `demo_bootstrap` sweep that used
  * to do this every ten minutes was retired once a fresh boot measured that
  * claim leaving all twelve seeded owner-scoped objects at zero ownerless rows
  * with the sweep disabled (#1892).

objectstack.config.ts

@@ -76,7 +76,7 @@ export default defineStack({
     // enforces that pairing against `objectstack.manifest.json` instead of
     // trusting this comment, because two platform upgrades in a row (rc.2, then
     // rc.3) moved the manifest and left this line behind (#728).
-    engines: { protocol: '^17.6.0' },
+    engines: { protocol: '^17.7.0' },
   },
 
   // ─── Platform capabilities this app needs ─────────────────────────

objectstack.manifest.json

@@ -1,9 +1,9 @@
 {
   "$schema": "https://schemas.objectstack.dev/template-manifest.json",
   "name": "hotcrm",
-  "specVersion": "^17.6.0",
+  "specVersion": "^17.7.0",
   "engines": {
-    "protocol": "^17.6.0"
+    "protocol": "^17.7.0"
   },
   "manifestId": "app.objectstack.hotcrm",
   "displayName": "HotCRM",

package.json

@@ -36,33 +36,33 @@
   },
   "packageManager": "pnpm@10.33.0",
   "dependencies": {
-    "@objectstack/account": "17.6.0",
-    "@objectstack/cli": "17.6.0",
-    "@objectstack/core": "17.6.0",
-    "@objectstack/driver-memory": "17.6.0",
-    "@objectstack/driver-sql": "17.6.0",
-    "@objectstack/driver-sqlite-wasm": "17.6.0",
-    "@objectstack/metadata": "17.6.0",
-    "@objectstack/objectql": "17.6.0",
-    "@objectstack/platform-objects": "17.6.0",
-    "@objectstack/plugin-approvals": "17.6.0",
-    "@objectstack/plugin-auth": "17.6.0",
-    "@objectstack/plugin-security": "17.6.0",
-    "@objectstack/plugin-sharing": "17.6.0",
-    "@objectstack/runtime": "17.6.0",
-    "@objectstack/service-analytics": "17.6.0",
-    "@objectstack/service-automation": "17.6.0",
-    "@objectstack/service-messaging": "17.6.0",
-    "@objectstack/service-storage": "17.6.0",
-    "@objectstack/spec": "17.6.0",
-    "@objectstack/trigger-record-change": "17.6.0"
+    "@objectstack/account": "17.7.0",
+    "@objectstack/cli": "17.7.0",
+    "@objectstack/core": "17.7.0",
+    "@objectstack/driver-memory": "17.7.0",
+    "@objectstack/driver-sql": "17.7.0",
+    "@objectstack/driver-sqlite-wasm": "17.7.0",
+    "@objectstack/metadata": "17.7.0",
+    "@objectstack/objectql": "17.7.0",
+    "@objectstack/platform-objects": "17.7.0",
+    "@objectstack/plugin-approvals": "17.7.0",
+    "@objectstack/plugin-auth": "17.7.0",
+    "@objectstack/plugin-security": "17.7.0",
+    "@objectstack/plugin-sharing": "17.7.0",
+    "@objectstack/runtime": "17.7.0",
+    "@objectstack/service-analytics": "17.7.0",
+    "@objectstack/service-automation": "17.7.0",
+    "@objectstack/service-messaging": "17.7.0",
+    "@objectstack/service-storage": "17.7.0",
+    "@objectstack/spec": "17.7.0",
+    "@objectstack/trigger-record-change": "17.7.0"
   },
   "optionalDependencies": {
     "better-sqlite3": "^13.0.3"
   },
   "devDependencies": {
     "@changesets/cli": "^3.0.3",
-    "@objectstack/formula": "17.6.0",
+    "@objectstack/formula": "17.7.0",
     "@playwright/test": "^1.63.0",
     "@vitest/coverage-v8": "^4.1.10",
     "fumadocs-core": "16.15.14",