Upgrade ObjectStack to 0.8.0 and resolve Zod v4 type incompatibilities

[Copilot]

Upgrades all @objectstack/* packages from 0.7.2 to 0.8.0. The new spec version requires Zod v4.3.6 (breaking change from v3.25.76), which introduced stricter type inference that breaks plugin lifecycle hook signatures.

Package Updates

• @objectstack/spec: 0.7.2 → 0.8.0
• @objectstack/runtime: 0.7.2 → 0.8.0
• @objectstack/objectql: 0.7.2 → 0.8.0
• @objectstack/cli: 0.7.2 → 0.8.0
• zod: ^3.25.76 → ^4.3.6

Type Compatibility Fix

Zod v4's $InferOuterFunctionType creates complex nested types that TypeScript cannot match against the expected PluginDefinition signature. Applied explicit type casts to plugin lifecycle hooks:

// Before (0.7.2)
export const MyPlugin: PluginDefinition = {
    async onInstall(context: PluginContextData) {
        await context.storage.set('key', 'value');
    }
};

// After (0.8.0)
export const MyPlugin: PluginDefinition = {
    onInstall: (async (context: PluginContextData) => {
        await context.storage.set('key', 'value');
    }) as any,
};

Affected: @objectos/plugin-audit-log, @objectos/plugin-better-auth

Patch Management

Removed (fixed upstream):

• @objectstack__runtime@0.7.2.patch - ES module .js extensions
• @objectstack__objectql@0.7.2.patch - ES module .js extensions

Updated:

• @objectstack__cli@0.8.0.patch - Still requires fixes for incorrect import path (@objectstack/core → @objectstack/runtime) and deprecated API (registerPlugin → use)

Documentation

• Added OBJECTSTACK_0.8.0_UPGRADE.md with migration guide and breaking changes
• Updated README with upgrade guide references

Original prompt

@objectstack 为何升级到最新版并按照最新的内核调整代码

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
objectos	Ready	Preview, Comment	Feb 1, 2026 10:12am

[vercel]

Deployment failed with the following error:

You don't have permission to create a Preview Deployment for this Vercel project: objectos.

View Documentation: https://vercel.com/docs/accounts/team-members-and-roles

[Copilot]

Pull request overview

This PR upgrades the ObjectStack integration in ObjectOS to 0.8.0, aligns the codebase with Zod v4, and updates plugin lifecycle signatures and tooling to match the latest ObjectStack kernel behavior.

Changes:

• Bumped all @objectstack/* dependencies (spec, runtime, objectql, cli, types) to 0.8.0 and aligned Zod to ^4.3.6 where used directly.
• Adjusted plugin lifecycle hooks in the audit-log and better-auth plugins to satisfy the stricter Zod v4 / @objectstack/spec type signatures, and added explicit plugin typings.
• Simplified patch management by removing obsolete runtime/objectql patches, adding a focused CLI patch for @objectstack/cli@0.8.0, and documented the upgrade with new guides and summaries; CI workflows now use the latest pnpm action.

Reviewed changes

Copilot reviewed 17 out of 18 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
pnpm-lock.yaml	Regenerated lockfile to reflect @objectstack/* 0.8.0, new @objectstack/types@0.8.0, and Zod 4.3.6, removing older patched entries for 0.7.2 packages.
patches/@objectstack__runtime@0.7.2.patch	Removed obsolete patch now that upstream runtime includes correct .js ESM extensions.
patches/@objectstack__objectql@0.7.2.patch	Removed obsolete ObjectQL patch since upstream 0.8.0 fixes ESM path and main/types issues.
patches/@objectstack__cli@0.8.0.patch	New patch for CLI 0.8.0 that imports ObjectKernel from @objectstack/runtime and switches from kernel.registerPlugin to kernel.use, matching the current runtime API.
packages/server/package.json	Updated @objectstack/runtime, @objectstack/objectql, and @objectstack/spec dependencies to 0.8.0 so the deprecated server package runs against the new kernel/spec.
packages/runtime/package.json	Bumped @objectstack/spec to 0.8.0 so the runtime is aligned with the new protocol and Zod v4 types.
packages/plugins/server/package.json	Updated server plugin deps (@objectstack/objectql, @objectstack/spec) to 0.8.0 for compatibility with the upgraded runtime.
packages/plugins/better-auth/package.json	Upgraded @objectstack/spec from 0.6.0 to 0.8.0 to use the latest manifest and lifecycle contract.
packages/plugins/better-auth/src/plugin.ts	Wrapped onInstall, onEnable, onDisable, and onUninstall lifecycle handlers in async arrow functions cast as any, and typed BetterAuthPlugin as PluginDefinition, to satisfy the stricter Zod v4 / spec function types without altering runtime behavior.
packages/plugins/audit-log/package.json	Upgraded @objectstack/spec from 0.6.1 to 0.8.0 to match the new spec version.
packages/plugins/audit-log/src/plugin.ts	Applied the same lifecycle-hook wrapping and as any casting as better-auth, and explicitly typed AuditLogPlugin as PluginDefinition, preserving behavior while working around Zod v4 inference constraints.
packages/kernel/package.json	Bumped @objectstack/spec to 0.8.0 and zod to ^4.3.6, so the deprecated kernel builds against the new spec and Zod major version.
packages/runtime/package.json	(Same as above runtime snippet) Ensures runtime depends on @objectstack/spec@0.8.0 (already listed above; kept for clarity).
packages/plugins/server/package.json	(Same as above plugins/server snippet; reinforces plugin-server alignment with 0.8.0; already described above.)
package.json	Updated root pnpm.patchedDependencies to only patch @objectstack/cli@0.8.0, removed old 0.7.2 patches, and bumped dev @objectstack/cli and @objectstack/spec to 0.8.0.
README.md	Added an “Upgrade Guides” section linking to 0.8.0, 0.7.2, and 0.7.1 upgrade docs, helping maintainers understand staged migrations.
OBJECTSTACK_0.8.0_UPGRADE.md	New, detailed migration guide covering package bumps, Zod v4 impact, plugin lifecycle type workarounds, patch updates, and troubleshooting steps.
IMPLEMENTATION_SUMMARY_0.8.0.md	New implementation summary documenting what was changed in this upgrade, verification steps (build, tests, CodeQL), and known limitations such as remaining CLI patch and as any casts.
.github/workflows/test.yml	CI: changed pnpm/action-setup to version: latest (non-deterministic; comment added recommending pinning a major) while keeping the Node 20.x/22.x test matrix.
.github/workflows/lint.yml	CI: likewise switched pnpm/action-setup to version: latest in the lint workflow; comment added suggesting a pinned major version for stability.

Files not reviewed (1)

• pnpm-lock.yaml: Language not supported

[Copilot]

Using version: latest for pnpm/action-setup makes the CI pipeline non-deterministic and can cause unexpected breakages when a new pnpm major is released; please pin this to a specific major (e.g. 9 or another tested version) to keep builds reproducible.

[Copilot]

Here as well, version: latest for pnpm/action-setup introduces avoidable CI fragility; it would be safer to pin this to a known-good major version (e.g. 9) rather than tracking the moving latest tag.