chore(deps): upgrade @objectstack/* to 17.6.0

[hotlong]

Description

Upgrade HotCRM from @objectstack/* 17.5.0 to 17.6.0, done the way an end user would do it. The upgrade was exercised in place on a database created by HotCRM on 17.5.0, then walked in a browser. This PR is one of the verification lanes for the 17.6.0 release. The tables below record what was run against each line of the 17.6.0 Upgrade checklist (content/docs/releases/v17/17-6.mdx in objectstack) and what was observed.

Method.

1. On main (17.5.0), I built HotCRM and booted it on a fresh SQLite file, which ran the seed load. I then signed up the first admin and wrote probe records through REST: an account, which started a pending approval; a contact; an opportunity; a case; an event with datetime values; a campaign with date values; and an anonymous Web-to-Lead submission. I also saved one list view through PUT /api/v1/meta/view, with an 「is empty」 filter on a text field. A copy of that DB was kept as the 17.5.0 baseline.
2. On this branch I moved the pins and regenerated the lockfile. I ran every os command on the checklist, booted 17.6.0 on a copy of the 17.5.0 DB, and walked the console with Playwright (Chromium). For each difference I found, I booted 17.5.0 on the same DB to tell regressions from older behaviour.

Type of Change

• Breaking change (platform upgrade, dependency pins)
• Documentation update

Related Issues

Related to hotcrm#1970 (the 17.5.0 upgrade). This PR closes its "Known issue": grouped lists with object columns load rows again on the 17.6.0 console.

Changes Made

• package.json: all 21 @objectstack/* pins move 17.5.0 → 17.6.0, exact. pnpm-lock.yaml was regenerated by pnpm install: 725 → 727 packages: entries, 54 @objectstack/* keys moved 1:1, and hono@4.13.3 left the tree.
• objectstack.manifest.json / objectstack.config.ts: specVersion and engines.protocol move to ^17.6.0. That is still protocol major 17, so it meets the checklist's "leave on 17" line and follows the repo's own convention (docs/MAINTENANCE.md §3).
• Six page:header blocks drop breadcrumb. The key was retired in 17.6.0 (page-header-breadcrumb-removed). The six pages are App Launcher, Sales Home, Account Detail, Lead Detail, Opportunity Detail and Case Detail. No visible change: the app shell still draws its breadcrumb trail.
• Audit-log docs (FAQ + Security & Compliance, en / zh-Hans / zh-Hant): Setup → Audit Logs no longer shows delete rows, logout rows or login rows whose session has ended to any non-system reader, admins included. I verified this in the browser: I deleted a record, and its delete row is stored but appears in neither audit-log screen.
• Re-scoped pin claims: the What's new platform line (three locales), docs/STATUS.md, and three comments that called 17.5.0 the current pin. Claims that say "not re-run on 17.5.0" are dated truth and are unchanged. The sweep was a grep for 17.5. A stale claim written without a version number would not show up in it.
• .changeset/objectstack-17-6-0.md.

Upgrade checklist → 17.6.0, line by line

"Applies?" means whether HotCRM has anything the line describes.

Before you upgrade

Line	Applies?	What I ran	Observed
Find app-declared anonymous endpoints (authRequired: false)	No	grep authRequired over src/ and the config. Anonymous submit of both public forms, over REST and in the browser at /_console/f/contact-us, on 17.5.0 and 17.6.0	HotCRM declares no authRequired: false endpoint. Its two public forms (web_to_lead → /forms/contact-us, web_to_case → /forms/support, sharing.allowAnonymous) still create their records on 17.6.0: 201, and the browser shows "Thank you!". GET /api/v1/forms/:slug serves the form. The case form has no lookup field, so the publicPicker retirement does not reach it.
Grant a permission set where fallbackPermissionSet: null	No	grep fallbackPermissionSet	HotCRM does not embed the runtime. The six hits are test harnesses that pass the app's default set, and all six tests pass.
Grant manage_platform_settings for datasource / external_catalog reads on /meta	No	grep for datasource metadata and for authoring capabilities in permission sets	HotCRM ships no datasource or external_catalog metadata, and no permission set holds only manage_metadata / studio.access / setup.access.
List stored flows that share a packaged flow's name	No	Startup log on the 17.5.0 DB. GET /api/v1/automation/_status	No shadow warnings. The 17.5.0 DB stores no flow rows (sys_metadata has one row, a view). _status lists 31 flows. Every flow that is not bound says why: scheduled work is off by deployment policy, the same as on 17.5.0. No subflow refusals.
Find stored datetime values before year 1000	Yes (data) — none found	$lt '1000-01-01T00:00:00.000Z' over REST on five fields, and SQL over all 18 datetime columns of the 17.5.0 DB	0 rows.
Fix Turso datasource configs (mode: 'local' + syncUrl)	No	—	HotCRM declares no datasource.

Getting onto the release

Line	Applies?	What I ran	Observed
Move all @objectstack/* pins as one set; regenerate the lockfile; pnpm update hono if flagged	Yes	Edited package.json, then pnpm install	21 pins moved. Lockfile 725 → 727 entries. The older hono under the MCP SDK left the tree, so pnpm update hono is not needed. One peer warning (better-auth wants better-sqlite3@^12, @objectstack/cli has 13.0.3) is unchanged from 17.5.0: same versions in both locks.
Leave protocol declarations on 17	Yes	—	^17.6.0 in both places. Still major 17, and the runtime loads it.
os migrate meta --from 17, then os migrate meta --stored --apply	Yes	os migrate meta --from 17. os migrate meta --stored (preview), then --stored --apply --yes, both on the 17.5.0 DB	--from 17: 19 mechanical edits. 6 page-header-breadcrumb-removed, applied in source by this PR. 13 flow-decision-mode-inclusive-explicit, the same 13 that 17.5.0 offered; deliberately not written, since every one partitions its out-edges (see hotcrm#1970). 263 generic "manual change" notices, none naming HotCRM metadata. --stored: "Examined 1 stored metadata row … already on protocol 17.0.0 — nothing to rewrite"; --apply rewrote 0. ⚠️ See platform issue A: the preview wrote to app tables.
os migrate audit-metadata-bodies, then --apply	Yes	Dry run, --apply --yes, then --apply again for idempotence, on the 17.5.0 DB	sys_audit_log: 2 scanned, 0 to rewrite. sys_activity: 2 scanned, 0. "Nothing to rewrite". The second --apply gives the same result. ⚠️ The dry run also wrote to app tables (platform issue A).

Metadata and build

Line	Applies?	What I ran	Observed
Rewrite cube sql / dataset field that is not a column; delete refreshKey	No	os validate. grep refreshKey	Validate passes, so every dataset member names a column. No refreshKey.
Delete connector triggers / syncConfig / fieldMappings	No	grep	No connectors.
Rewrite page/view shapes (div→box, requires, endpoint→target, subform columns, grouping, publicPicker, breadcrumb)	Yes — breadcrumb only	os migrate meta --from 17. grep	6 breadcrumb deleted. No html pages, endpoint, subforms, line-item or master-detail blocks, or publicPicker. The 4 grouping values already have the { fields: [{ field }] } shape.
Fix new author-time refusals (picklist refs, api flow secret, action translation keys, JSON/multi-value dimensions, dimensionless multi-value pie/…)	No	os validate, os build	Both exit 0. None of these fire.
Write time defaults/values as a bare wall clock	Yes (one action param)	Browser: Schedule a Meeting on an account, Start Time 14:30	POST /api/v1/actions/crm_account/schedule_meeting 200. The event was stored with start_datetime: 2026-11-05T14:30:00.000Z. No time field or time default anywhere.
(os validate --strict)	—	os validate --strict on 17.5.0 and 17.6.0	Red on both. Not a HotCRM gate (pnpm verify does not run it). 17.5.0 fails on 23 warnings. 17.6.0 fails on the same 23 plus 88 from the newly firing rules: 84 unconsumed-widget-option (dashboard options.icon / format / columns / striped / density / pivot keys that no renderer reads) and 4 liveness-dead-property (rowLevelSecurity[].label / description on two permission sets). These are dead keys. Removing them changes nothing at runtime. Not done here, to keep the upgrade PR minimal; proposed as a follow-up.

Data and database

Line	Applies?	What I ran	Observed
Review sharing rules / views using 「is empty」 on text or multi-value fields	Yes (stored data only)	grep over source. A stored list view from 17.5.0 with is_empty on crm_case.resolution. SQL	The source uses none. The stored view still loads (31 rows) and re-saves (rename → PUT 200). The 17.5.0 data holds no '' text value (resolution: 31 NULL, 0 empty string), so the wider meaning changes no result here.
Review saved filters, list views, dashboard widgets, reports for refused filter / aggregate shapes	Yes	Browser walk of 20 list views, 5 dashboards and 7 record pages, recording every non-GET API call and every 4xx/5xx	No refused query anywhere. The 5 dashboards draw the same number of chart elements on 17.5.0 and 17.6.0 (13 / 21 / 12 / 14 / 17), and no /analytics/dataset/query failed.
Send import files with ISO 8601 dates	Yes	POST /api/v1/data/crm_campaign/import and the console Import wizard (CSV)	As documented. 2026-07-15 and 2026-07-16 00:00:00 import. 07/15/2026, 46218 (Excel serial) and 2026-02-30 fail their row with invalid_date, and the rest of the batch imports. The wizard reports "2 created, 1 skipped — Row 2: Start Date: "07/15/2026" is not a valid date".
Remote Turso _objectstack_sequences without key_hash	No	—	SQLite only.

Deployment and configuration

Line	Applies?	What I ran	Observed
Grant auditors what they need to read	Yes (docs)	Deleted a campaign as the platform admin, then read sys_audit_log over REST and in both Setup audit-log screens	The create and delete rows are stored (SQL), but the admin is served neither. Both Setup screens omit them. HotCRM's FAQ and Security page claimed otherwise; fixed in this PR.
--visibility private on first os plugin publish	No	grep	HotCRM publishes with scripts/publish-marketplace.mjs, not os plugin publish.
Know the console issues at this pin	Yes (Studio)	Browser. Created a writable package and object in Studio, then a dataset in Setup › Metadata › Dataset and a datasource in Setup › Datasources	All three known issues are confirmed where reachable. Dataset: a new count measure from the designer gets 422 measures.0.field [invalid_format]. Datasource: External with no external block gets 400 … schemaMode='external' requires 'external' settings. Html page: HotCRM has no html page and Studio offered no html-page authoring in the walk, so this one was not exercised. HotCRM's own metadata is read-only in Studio (a code package), so none of the three reaches HotCRM's datasets or pages.
Override of validation.field.invalid_date / invalid_datetime	No	grep	No such override.

Application code, hooks and flows

Line	Applies?	What I ran	Observed
Customer flows: status: 'obsolete', not the toggle; enable subflows first; no _ names	No	grep. _status	No customer-authored flows, no flow name starts with _, no toggle calls.
Every http node's signingSecret renders to a value	Yes (2 nodes)	Read src/sales/flows/_billing-endpoint.ts	The two billing hand-off nodes take signingSecret from HOTCRM_BILLING_SIGNING_SECRET. When the variable is unset the constant is undefined, so the key is absent and the node sends unsigned (allowed). When it is set the value is a non-empty literal. Neither case hits "renders to nothing".
Stop sending formula with strictReadonlyWrites; read ctx.submitted	No	grep	No strictReadonlyWrites, and no hook reads a formula from ctx.input.data.
Migration-chain imports / --clone-from / os dev --no-watch / nextUtcCalendarDay	No	grep	None used. tsc --noEmit is clean.
Custom hosts and drivers (AnalyticsService wiring, findOne stand-ins, ISecurityService)	Tests only	pnpm test	Nine tests build AnalyticsService by hand. All 3725 tests pass on 17.6.0 unchanged.
Publish data.record.*, not bare record.*	No	grep	No plugin publishes events.

Commands

Command	17.6.0 result
os validate	✅ exit 0, 111 warnings (17.5.0 CLI on the 17.5.0 source: 23)
os validate --strict	❌ exit 1, red on 17.5.0 too (see above). Not a repo gate
os build	✅ exit 0
os lint	✅ exit 0, 104 warnings / 16 suggestions (17.5.0: 16 / 16). The +88 are the two newly firing rules
pnpm verify (validate, typecheck, lint, i18n gate, hygiene, token ratchet, build, test)	✅ green. 173 files, 3725 passed, 1 skipped. No test changed
pnpm test:e2e (against the upgraded 17.5.0 DB)	✅ 16 / 16
Boot 17.6.0 on the 17.5.0-created DB	✅ clean. Seed replay inserted 0, updated 196, skipped 158, errored 0, and all probe records are intact

Browser walk (Playwright, Chromium, 17.6.0 on the 17.5.0-created DB)

Area	Result
Sign-in, app home	✅
List views: Accounts, Contacts (grouped by account, collapsed), Leads, Opportunities, Quotes, Contracts, Products (grouped), Cases, Knowledge Articles (grouped), Events, Forecasts (grouped), Campaigns, Campaign Members, My Tasks / Deals / Leads / Cases / Events, Account Workbench	✅ Every one rendered rows, with no API error. The grouped grids now load rows. On 17.5.0, Products still shows Unknown field '[object Object]' (re-checked side by side), so hotcrm#1970's known issue is closed.
Record pages: account, lead, opportunity, case, contact, quote, contract	✅ No API errors. The shell breadcrumb still draws.
Dashboards: Executive, Sales Performance, Sales Activity, Service Overview, CRM Overview	✅ 13 / 21 / 12 / 14 / 17 chart elements, identical to 17.5.0. No failed dataset query.
Approvals	✅ A request started on 17.5.0 was approved on 17.6.0 through POST /api/v1/approvals/requests/:id/approve, with the admin staffed into sales_manager. The account's approval_status became approved. ⚠️ My Pending in the Approvals Inbox does not list position-routed requests (platform issue B). That is unchanged from 17.5.0. Submitted by me and All list them.
Flows	✅ The Close Case screen flow ran: confirm, then the screen, then the knowledge-article picker (4 options), then submit. The case closed with resolved_by_article set. Schedule a Meeting (date and time params) ran too.
Import, including date cells	✅ Matches the documented 17.6.0 rule (see the Data table).
zh-CN locale, full document load per page	✅ Navigation, list views, a dashboard, four record pages and the Approvals Inbox all render in zh-CN, with no API errors. Every page was a full goto, not a client-side route change.
Studio saves	Object ✅: new package (the "New Package" dialog works again at this pin), then a new object as a draft, then publish (publish-drafts 200). App / nav ✅ as a draft. ⚠️ "Add nav item" autosaves the empty item at once, and the console shows 422 navigation.1.objectName until an object is picked. View ✅: renamed a stored 17.5.0 view, PUT /meta/view 200. Dataset ❌ known issue, count measure refused. Datasource ❌ known issue, External refused. Page — not exercised (HotCRM has no html page).
Public form, anonymous	✅ /_console/f/contact-us rendered, submitted, and showed "Thank you!" (201).

Other things seen, all unchanged from 17.5.0 (so not regressions):

• Every console page calls GET /api/v1/usage/storage and gets 404.
• lead_assignment fails its notify_std node on an ownerless Web-to-Lead ("every recipient template resolved to nothing: {record.owner_id}").
• A boot's seed replay claims ownerless non-seed leads for the first admin.

Platform issues

⚠️ Not filed yet. This session could not attach objectstack-ai/objectstack, because the request was denied by the session's permission policy, so I could not search for duplicates or open issues there. The drafts below go to the maintainer to file. Neither is an authorization defect.

• A — os migrate meta --stored (preview) and os migrate audit-metadata-bodies (dry run) write to application tables (17.6.0 regression for --stored).
  • Steps: make a SQLite DB with HotCRM on 17.5.0 (boot, seed, sign up). Copy it. On 17.6.0, run os migrate meta --stored --database-url file:<copy>, with no --apply.
  • Expected: a read-only preview; the file is unchanged.
  • Actual: the command boots the app's seed loader. On crm_contact, crm_lead, crm_opportunity and five more tables it bumps updated_at, stamps organization_id on seeded rows that had none, and rewrites relative-date seed values. It also logs ERROR [SeedLoader] Failed to write sys_activity …: cannot modify sys_activity because it is a view, because sys_activity is a rotation view on that DB.
  • Comparison: the 17.5.0 CLI on the same file changes nothing (row hashes identical) and logs no SeedLoader error. audit-metadata-bodies without --apply (new in 17.6.0) does the same writes.
• B — Approvals Inbox "My Pending" never lists position-routed requests.
  • Steps: HotCRM's approval flows route to positions. sys_approval_request.pending_approvers holds position:sales_manager. Staff a user into sales_manager (a sys_user_position row). Open Approvals Inbox → My Pending as that user.
  • Expected: the request is listed.
  • Actual: "No requests". The console asks GET /api/v1/approvals/requests?status=pending&approverId=<id>,<email>,role:platform_admin,role:org_owner,role:sales_manager,…, which spells positions as role:, so nothing matches.
  • Comparison: the same happens on 17.5.0, so this is not a 17.6.0 regression. It does hide every HotCRM approval from its approvers.
• Release-notes note: 748b240 (#21270, ScheduledWorkPolicy.hostDisabledReason) is in the 17.6.0 code (@objectstack/service-automation dist), but no CHANGELOG.md in the installed 17.6.0 packages mentions #21270 or hostDisabledReason. HotCRM does not use it.

Testing

• pnpm verify green (unit tests, lint, build, validate, typecheck, i18n gate, hygiene)
• pnpm test:e2e 16 / 16 against the upgraded DB
• Manual browser testing (above)
• New tests added (none needed; no test changed)

🤖 Generated with Claude Code

https://claude.ai/code/session_01WXp8E7s1gzSBje9ZwwqVux

---

Generated by Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
hotcrm	Ignored		Oct 2, 2026 5:11am UTC

[hotlong]

The two platform issues drafted under "Platform issues" are now filed in objectstack. I searched for duplicates first and found none.

• A is 17.6.0: os migrate meta --stored (preview) and os migrate audit-metadata-bodies (dry run) boot the app's seed loader and write to application tables objectstack#21349: os migrate meta --stored (preview) and os migrate audit-metadata-bodies (dry run) write to application tables.
• B is approvals: "My Pending" never lists a request routed to a position — the console filters with approverId=role:<p>, the request stores position:<p>, and the list filter matches literally objectstack#21350: "My Pending" never lists position-routed requests. The console filters by role:<p>, the request stores position:<p>, and the list filter matches the string literally.

---

Generated by Claude Code