objectstack-ai · github-actions · Jul 11, 2026
diff --git a/.changeset/adr-0057-lifecycle-p1-p4.md b/.changeset/adr-0057-lifecycle-p1-p4.md
diff --git a/.changeset/adr-0091-l1-grant-validity.md b/.changeset/adr-0091-l1-grant-validity.md
diff --git a/.changeset/agent-docs-open-edition-honesty.md b/.changeset/agent-docs-open-edition-honesty.md
diff --git a/.changeset/docs-sms-phone-otp.md b/.changeset/docs-sms-phone-otp.md
diff --git a/.changeset/fix-resend-verification-email.md b/.changeset/fix-resend-verification-email.md
diff --git a/.changeset/fls-keys-release-sync-d11.md b/.changeset/fls-keys-release-sync-d11.md
diff --git a/.changeset/rename-plugin-sms-to-service-sms.md b/.changeset/rename-plugin-sms-to-service-sms.md
diff --git a/examples/app-crm/CHANGELOG.md b/examples/app-crm/CHANGELOG.md
@@ -1,5 +1,16 @@
 # @objectstack/example-crm
 
+## 4.0.82
+
+### Patch Changes
+
+- Updated dependencies [7953832]
+- Updated dependencies [82e745e]
+- Updated dependencies [82c0d94]
+- Updated dependencies [7449476]
+  - @objectstack/spec@14.4.0
+  - @objectstack/runtime@14.4.0
+
 ## 4.0.81
 
 ### Patch Changes

diff --git a/examples/app-crm/package.json b/examples/app-crm/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/example-crm",
-  "version": "4.0.81",
+  "version": "4.0.82",
   "description": "Minimal CRM example — a smoke-test workspace that exercises the metadata loading pipeline (objects → views → app → dashboard → hook → flow → seed). For a full-featured enterprise CRM see https://github.com/objectstack-ai/hotcrm.",
   "license": "Apache-2.0",
   "private": true,

diff --git a/examples/app-showcase/CHANGELOG.md b/examples/app-showcase/CHANGELOG.md
@@ -1,5 +1,49 @@
 # @objectstack/example-showcase
 
+## 0.3.4
+
+### Patch Changes
+
+- 7449476: Permission-zoo audit follow-ups:
+
+  **FLS keys must be object-qualified (`security-fls-unqualified-key`, error).**
+  The runtime evaluator matches field-permission keys by `<object>.<field>`
+  prefix — a bare `budget` key matches NOTHING and the declared masking
+  silently never enforces. The showcase itself shipped exactly that bug: its
+  contributor FLS block (bare `budget`/`spent`/`budget_remaining`) was a
+  runtime no-op, and the "FLS proof" in earlier verification was actually a
+  validation-rule rejection. Fixed: keys qualified
+  (`showcase_project.budget` …), a new D7 lint rule rejects bare keys at
+  compile time with a fix-it, and the permission-zoo dogfood now proves the
+  served pipeline denies a contributor's budget write while allowing ordinary
+  field edits.
+
+  **Release pipeline: PROTOCOL_VERSION auto-sync.** `changeset version` now
+  runs `scripts/sync-protocol-version.mjs`, regenerating the handshake
+  constant from the spec package major. Release PRs opened by
+  changesets/action with the default GITHUB_TOKEN never trigger CI (GitHub's
+  anti-recursion rule), so the lockstep guard could only fire AFTER a release
+  merged — the drift class that broke main at 14.0.0 (#2769) is now fixed at
+  version time, the one spot that cannot be skipped.
+
+  **D11 `externalSharingModel` honestly marked.** The dial has no runtime
+  consumer yet (authoring lint + Studio badges only); its liveness entry
+  moves from a bespoke `authorable` status to the documented `planned` +
+  `authorWarn`, and the sharing docs / design doc / showcase comments now say
+  explicitly that evaluation of external principals lands with the
+  principal-taxonomy phase (#2696).
+
+- Updated dependencies [7953832]
+- Updated dependencies [82e745e]
+- Updated dependencies [82c0d94]
+- Updated dependencies [7449476]
+  - @objectstack/spec@14.4.0
+  - @objectstack/driver-sql@14.4.0
+  - @objectstack/cloud-connection@14.4.0
+  - @objectstack/connector-rest@14.4.0
+  - @objectstack/connector-slack@14.4.0
+  - @objectstack/runtime@14.4.0
+
 ## 0.3.3
 
 ### Patch Changes

diff --git a/examples/app-showcase/package.json b/examples/app-showcase/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/example-showcase",
-  "version": "0.3.3",
+  "version": "0.3.4",
   "description": "Kitchen-sink showcase workspace — exercises every metadata type, every view type, every chart type, and the major end-to-end capability chains (security, automation, analytics). Built for demonstration, debugging, and coverage-driven verification.",
   "license": "Apache-2.0",
   "private": true,

diff --git a/examples/app-todo/CHANGELOG.md b/examples/app-todo/CHANGELOG.md
@@ -1,5 +1,23 @@
 # @objectstack/example-todo
 
+## 4.0.82
+
+### Patch Changes
+
+- Updated dependencies [7953832]
+- Updated dependencies [82e745e]
+- Updated dependencies [82c0d94]
+- Updated dependencies [7449476]
+  - @objectstack/spec@14.4.0
+  - @objectstack/objectql@14.4.0
+  - @objectstack/driver-sqlite-wasm@14.4.0
+  - @objectstack/client@14.4.0
+  - @objectstack/mcp@14.4.0
+  - @objectstack/metadata@14.4.0
+  - @objectstack/knowledge-memory@14.4.0
+  - @objectstack/runtime@14.4.0
+  - @objectstack/service-knowledge@14.4.0
+
 ## 4.0.81
 
 ### Patch Changes

diff --git a/examples/app-todo/package.json b/examples/app-todo/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/example-todo",
-  "version": "4.0.81",
+  "version": "4.0.82",
   "description": "Example Todo App using ObjectStack Protocol",
   "license": "Apache-2.0",
   "private": true,

diff --git a/examples/embed-objectql/CHANGELOG.md b/examples/embed-objectql/CHANGELOG.md
@@ -1,5 +1,17 @@
 # @objectstack/example-embed-objectql
 
+## 0.0.22
+
+### Patch Changes
+
+- Updated dependencies [7953832]
+- Updated dependencies [82e745e]
+- Updated dependencies [82c0d94]
+- Updated dependencies [7449476]
+  - @objectstack/spec@14.4.0
+  - @objectstack/objectql@14.4.0
+  - @objectstack/driver-memory@14.4.0
+
 ## 0.0.21
 
 ### Patch Changes

diff --git a/examples/embed-objectql/package.json b/examples/embed-objectql/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/example-embed-objectql",
-  "version": "0.0.21",
+  "version": "0.0.22",
   "private": true,
   "description": "Embed the ObjectQL engine as a plain library via @objectstack/objectql/core — no kernel, no plugins, no metadata protocol (ADR-0076).",
   "type": "module",

diff --git a/packages/adapters/hono/CHANGELOG.md b/packages/adapters/hono/CHANGELOG.md
@@ -1,5 +1,13 @@
 # @objectstack/hono
 
+## 14.4.0
+
+### Patch Changes
+
+- @objectstack/plugin-hono-server@14.4.0
+- @objectstack/runtime@14.4.0
+- @objectstack/types@14.4.0
+
 ## 14.3.0
 
 ### Patch Changes

diff --git a/packages/adapters/hono/package.json b/packages/adapters/hono/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/hono",
-  "version": "14.3.0",
+  "version": "14.4.0",
   "license": "Apache-2.0",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

diff --git a/packages/apps/account/CHANGELOG.md b/packages/apps/account/CHANGELOG.md
@@ -1,5 +1,16 @@
 # @objectstack/account
 
+## 14.4.0
+
+### Patch Changes
+
+- Updated dependencies [7953832]
+- Updated dependencies [82e745e]
+- Updated dependencies [82c0d94]
+- Updated dependencies [7449476]
+  - @objectstack/spec@14.4.0
+  - @objectstack/platform-objects@14.4.0
+
 ## 14.3.0
 
 ### Patch Changes

diff --git a/packages/apps/account/package.json b/packages/apps/account/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/account",
-  "version": "14.3.0",
+  "version": "14.4.0",
   "license": "Apache-2.0",
   "description": "ObjectStack Account — the end-user account/self-service console app, packaged as its own ObjectStack app package (ADR-0048: one app per package).",
   "main": "dist/index.js",

diff --git a/packages/apps/setup/CHANGELOG.md b/packages/apps/setup/CHANGELOG.md
@@ -1,5 +1,16 @@
 # @objectstack/setup
 
+## 14.4.0
+
+### Patch Changes
+
+- Updated dependencies [7953832]
+- Updated dependencies [82e745e]
+- Updated dependencies [82c0d94]
+- Updated dependencies [7449476]
+  - @objectstack/spec@14.4.0
+  - @objectstack/platform-objects@14.4.0
+
 ## 14.3.0
 
 ### Patch Changes

diff --git a/packages/apps/setup/package.json b/packages/apps/setup/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/setup",
-  "version": "14.3.0",
+  "version": "14.4.0",
   "license": "Apache-2.0",
   "description": "ObjectStack Setup — the platform administration app, packaged as its own ObjectStack app package (ADR-0048: one app per package).",
   "main": "dist/index.js",

diff --git a/packages/apps/studio/CHANGELOG.md b/packages/apps/studio/CHANGELOG.md
@@ -1,5 +1,16 @@
 # @objectstack/studio
 
+## 14.4.0
+
+### Patch Changes
+
+- Updated dependencies [7953832]
+- Updated dependencies [82e745e]
+- Updated dependencies [82c0d94]
+- Updated dependencies [7449476]
+  - @objectstack/spec@14.4.0
+  - @objectstack/platform-objects@14.4.0
+
 ## 14.3.0
 
 ### Patch Changes

diff --git a/packages/apps/studio/package.json b/packages/apps/studio/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/studio",
-  "version": "14.3.0",
+  "version": "14.4.0",
   "license": "Apache-2.0",
   "description": "ObjectStack Studio — the metadata builder app, packaged as its own ObjectStack app package (ADR-0048: one app per package).",
   "main": "dist/index.js",