chore: version packages (rc)

Author: github-actions[bot]

.changeset/pre.json

@@ -1,5 +1,231 @@
 # @objectstack/example-crm
 
+## 4.0.92-rc.6
+
+### Patch Changes
+
+- 7e06f51: fix(example-crm): bind the three declared positions to `crm_sales_user` (#8060)
+
+  `examples/app-crm/src/security/sales-positions.ts` declared three positions
+  (`sales_rep`, `sales_manager`, `finance_approver`) and a `crm_sales_user`
+  permission set, but nothing ever joined them — the app seeded no
+  `sys_position_permission_set` rows, and `crm_sales_user` was not marked
+  `isDefault` (which would have granted every user, not just the three
+  positions). A user assigned any of the three positions therefore resolved
+  only the platform `everyone` baseline and was 403'd on every CRM object.
+
+  Mirrors `examples/app-showcase/src/security/bind-position-sets.ts`: a new
+  `examples/app-crm/src/security/bind-position-sets.ts` binds the three
+  positions to `crm_sales_user` imperatively on `kernel:bootstrapped` (a
+  declarative seed can't do this — the seed loader runs before the security
+  bootstrap creates the `sys_position`/`sys_permission_set` rows), wired via a
+  new `onEnable` export in `objectstack.config.ts`.
+
+  Measured with `objectstack verify --app examples/app-crm/objectstack.config.ts
+--rls`: the three per-position probe personas went from 18-of-18
+  `probe-blocked` (no object grant at all — the by-id-write class was never
+  exercised) to 3 `probe-blocked` (one per persona: `crm_opportunity_line_item`,
+  which `crm_sales_user` does not grant — a separate, pre-existing gap, not
+  addressed here). Zero RLS holes introduced or found.
+
+- c4624f0: fix(example-crm): grant `crm_opportunity_line_item` in `crm_sales_user`, matching its master `crm_opportunity` (#8164)
+
+  `crm_opportunity_line_item` is a master-detail CHILD of `crm_opportunity`
+  (`sharingModel: 'controlled_by_parent'`, `inlineEdit: 'grid'` on the
+  Opportunity form), but `crm_sales_user` — the app's only non-guest
+  permission set — granted object-level CRUD on 5 CRM objects and never the
+  line item. Record-level access always follows the master (ADR-0055), but
+  object-level CRUD is a SEPARATE gate the platform never derives: every
+  role-bound (non-admin) user, including the three positions this app ships
+  to demonstrate selling, got a silent 403 the moment they tried to add or
+  edit a product line on an Opportunity they otherwise fully own. The
+  platform's own build-time lint (`security-master-detail-ungranted`) already
+  flagged this independently.
+
+  Added `crm_opportunity_line_item` to `crm_sales_user`'s `objects` map with
+  the exact same grant shape as its master `crm_opportunity`
+  (`{ allowRead: true, allowCreate: true, allowEdit: true, allowDelete: false }`)
+  — the line item's own access is meant to follow its master, not invent an
+  independent policy.
+
+  Measured with `objectstack verify --app examples/app-crm/objectstack.config.ts
+--rls`: every position persona's `probeBlocked` count dropped from 1 (the
+  line item, the sole remaining gap left open by #8060) to 0, with zero RLS
+  holes introduced or found. The build's `security-master-detail-ungranted`
+  warning for this object is gone.
+
+- 450f3e5: fix(examples): name the form/page sections that had a label but no `name`, and translate the headings into zh-CN (#8231)
+
+  `translation-section-name-missing` fired on every build of both example apps: a
+  form or `record:details` section that declares a `label` but no `name` has no
+  key a bundle can carry (`objects.<object>._sections.<name>.label`), so its
+  heading renders in the source locale in EVERY locale — permanently, and
+  invisibly, because every neighbouring field label on the same object
+  translates fine. `app-crm` ships en + zh-CN; `app-showcase` ships the same.
+
+  21 of the 24 flagged sections now declare a stable snake_case `name` and
+  resolve a real (non-echoed) zh-CN label:
+
+  - **app-crm** (9/9): `crm_activity` (`activity_details`, `related_records`,
+    `notes`), `crm_lead` (`contact_us`, `lead_information`, `qualification`,
+    `conversion`, `notes`), `crm_opportunity` (`opportunity`).
+  - **app-showcase** (12/15): `showcase_project` form (`project`,
+    `budget_schedule`) and its detail page (`overview`, `financials`,
+    `timeline`); `showcase_task`'s detail page (`overview`, `schedule`,
+    `details` — reusing the same names and zh-CN copy its `tabbed` form view
+    already declares, so no new bundle entries were needed there);
+    `showcase_inquiry` (`tell_us_about_yourself`); `showcase_business_unit`
+    (`unit`); `showcase_preference`'s settings page (`appearance`,
+    `notifications`).
+
+  **Not named here — a `packages/**`conflict, out of this PR's scope.** Three`app-showcase` sections (`showcase_task`'s `formViews.edit`/`Task`and`formViews.quick`/`Quick Edit`, `showcase_contact`'s `formViews.create`/`Who is
+  this?`) are pinned NAMELESS as regression fixtures by
+`packages/lint/src/validate-translatable-sections.test.ts`and`validate-translation-references.test.ts`, which import `TaskViews`/`ContactViews`directly from this app and assert on their current unnamed
+shape. Naming them requires a coordinated`packages/lint` test update; #8231
+  remains open for that follow-up.
+
+  Adding a `name` alone would have silenced the warning with zero translation
+  delivered, so both apps also gain a generalized i18n-coverage sweep test
+  (`examples/app-crm/test/i18n-sections.test.ts`,
+  `examples/app-showcase/test/seed.test.ts`) asserting every section this PR
+  touches BOTH has a `name` AND resolves a real, non-ASCII zh-CN
+  `_sections.<name>.label` — not just that the section has a name.
+
+- Updated dependencies [690ccf2]
+- Updated dependencies [333a374]
+- Updated dependencies [30536e3]
+- Updated dependencies [5823d59]
+- Updated dependencies [3140f9c]
+- Updated dependencies [9500ba4]
+- Updated dependencies [a8940e4]
+- Updated dependencies [76d74ec]
+- Updated dependencies [0e79785]
+- Updated dependencies [116c0d9]
+- Updated dependencies [a98085f]
+- Updated dependencies [344a22a]
+- Updated dependencies [4827e91]
+- Updated dependencies [86f7a20]
+- Updated dependencies [c546c89]
+- Updated dependencies [627e65a]
+- Updated dependencies [b16dcb4]
+- Updated dependencies [22df871]
+- Updated dependencies [9c82146]
+- Updated dependencies [744b8f5]
+- Updated dependencies [37785ed]
+- Updated dependencies [7e5af5c]
+- Updated dependencies [9d1d9c7]
+- Updated dependencies [1007379]
+- Updated dependencies [4ff8abf]
+- Updated dependencies [e5bd2f6]
+- Updated dependencies [e38db3d]
+- Updated dependencies [2c1988c]
+- Updated dependencies [211abdb]
+- Updated dependencies [b3de0dd]
+- Updated dependencies [35b36f2]
+- Updated dependencies [19aaf4b]
+- Updated dependencies [0e4a7fb]
+- Updated dependencies [f505689]
+- Updated dependencies [76682cb]
+- Updated dependencies [606d577]
+- Updated dependencies [e906126]
+- Updated dependencies [08363a0]
+- Updated dependencies [444de5b]
+- Updated dependencies [3f7b4ff]
+- Updated dependencies [2bacd1a]
+- Updated dependencies [6a9dec6]
+- Updated dependencies [4dc1c7d]
+- Updated dependencies [baeb4f0]
+- Updated dependencies [29488cc]
+- Updated dependencies [859cb83]
+- Updated dependencies [08cd163]
+- Updated dependencies [7dc1067]
+- Updated dependencies [7674859]
+- Updated dependencies [427344c]
+- Updated dependencies [b85cc54]
+- Updated dependencies [7a8476f]
+- Updated dependencies [518ca7a]
+- Updated dependencies [2d8dba3]
+- Updated dependencies [d62f8eb]
+- Updated dependencies [a7586cd]
+- Updated dependencies [4c5e80e]
+- Updated dependencies [4b5702a]
+- Updated dependencies [af05400]
+- Updated dependencies [36d90fc]
+- Updated dependencies [d063a96]
+- Updated dependencies [fa48973]
+- Updated dependencies [cf7c694]
+- Updated dependencies [ddd0f06]
+- Updated dependencies [603cab8]
+- Updated dependencies [df95346]
+- Updated dependencies [591f675]
+- Updated dependencies [d56012f]
+- Updated dependencies [9051802]
+- Updated dependencies [2f8328c]
+- Updated dependencies [2a6c279]
+- Updated dependencies [8c8f0df]
+- Updated dependencies [f293d45]
+- Updated dependencies [f067930]
+- Updated dependencies [6b7129a]
+- Updated dependencies [97ace2a]
+- Updated dependencies [ef7b5ef]
+- Updated dependencies [9514767]
+- Updated dependencies [8f20201]
+- Updated dependencies [8813b90]
+- Updated dependencies [8f1851e]
+- Updated dependencies [b4b2c7d]
+- Updated dependencies [61ea810]
+- Updated dependencies [66d99ec]
+- Updated dependencies [cb43296]
+- Updated dependencies [91eddca]
+- Updated dependencies [b61afc1]
+- Updated dependencies [79021fc]
+- Updated dependencies [7dbf4c3]
+- Updated dependencies [9b2d720]
+- Updated dependencies [95ef5c0]
+- Updated dependencies [97b6658]
+- Updated dependencies [27358d5]
+- Updated dependencies [76bcb83]
+- Updated dependencies [0410522]
+- Updated dependencies [814db6d]
+- Updated dependencies [8dd98bf]
+- Updated dependencies [8a9c079]
+- Updated dependencies [cc3555e]
+- Updated dependencies [b30963d]
+- Updated dependencies [ea936f3]
+- Updated dependencies [69ac82c]
+- Updated dependencies [833ed84]
+- Updated dependencies [a18abf3]
+- Updated dependencies [86d2e5e]
+- Updated dependencies [c6a4eeb]
+- Updated dependencies [f450ae7]
+- Updated dependencies [e9cb9ab]
+- Updated dependencies [5326b36]
+- Updated dependencies [e124711]
+- Updated dependencies [3bb9340]
+- Updated dependencies [9d4dfc4]
+- Updated dependencies [1059965]
+- Updated dependencies [ee264b2]
+- Updated dependencies [60b672e]
+- Updated dependencies [6b441a8]
+- Updated dependencies [dd0f681]
+- Updated dependencies [e654bfd]
+- Updated dependencies [6e6c872]
+- Updated dependencies [fa5758e]
+- Updated dependencies [ecf0bef]
+- Updated dependencies [3da3da5]
+- Updated dependencies [a0fdc56]
+- Updated dependencies [0dcbc11]
+- Updated dependencies [d88f3e9]
+- Updated dependencies [b9f930b]
+- Updated dependencies [289d04a]
+- Updated dependencies [c9b809f]
+- Updated dependencies [89be40c]
+- Updated dependencies [32386f8]
+- Updated dependencies [bbe05de]
+- Updated dependencies [a1dd1e4]
+  - @objectstack/runtime@17.0.0-rc.7
+  - @objectstack/spec@17.0.0-rc.7
+
 ## 4.0.92-rc.5
 
 ### Patch Changes

examples/app-crm/CHANGELOG.md

@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/example-crm",
-  "version": "4.0.92-rc.5",
+  "version": "4.0.92-rc.6",
   "description": "Minimal CRM example — a smoke-test workspace that exercises the metadata loading pipeline (objects → views → app → dashboard → hook → flow → seed). For a full-featured enterprise CRM see https://github.com/objectstack-ai/hotcrm.",
   "license": "Apache-2.0",
   "private": true,