chore: version packages (rc)

Author: github-actions[bot]

.changeset/pre.json

@@ -1,5 +1,172 @@
 # @objectstack/example-crm
 
+## 4.0.92-rc.6
+
+### Patch Changes
+
+- 7e06f51: fix(example-crm): bind the three declared positions to `crm_sales_user` (#8060)
+
+  `examples/app-crm/src/security/sales-positions.ts` declared three positions
+  (`sales_rep`, `sales_manager`, `finance_approver`) and a `crm_sales_user`
+  permission set, but nothing ever joined them — the app seeded no
+  `sys_position_permission_set` rows, and `crm_sales_user` was not marked
+  `isDefault` (which would have granted every user, not just the three
+  positions). A user assigned any of the three positions therefore resolved
+  only the platform `everyone` baseline and was 403'd on every CRM object.
+
+  Mirrors `examples/app-showcase/src/security/bind-position-sets.ts`: a new
+  `examples/app-crm/src/security/bind-position-sets.ts` binds the three
+  positions to `crm_sales_user` imperatively on `kernel:bootstrapped` (a
+  declarative seed can't do this — the seed loader runs before the security
+  bootstrap creates the `sys_position`/`sys_permission_set` rows), wired via a
+  new `onEnable` export in `objectstack.config.ts`.
+
+  Measured with `objectstack verify --app examples/app-crm/objectstack.config.ts
+--rls`: the three per-position probe personas went from 18-of-18
+  `probe-blocked` (no object grant at all — the by-id-write class was never
+  exercised) to 3 `probe-blocked` (one per persona: `crm_opportunity_line_item`,
+  which `crm_sales_user` does not grant — a separate, pre-existing gap, not
+  addressed here). Zero RLS holes introduced or found.
+
+- c4624f0: fix(example-crm): grant `crm_opportunity_line_item` in `crm_sales_user`, matching its master `crm_opportunity` (#8164)
+
+  `crm_opportunity_line_item` is a master-detail CHILD of `crm_opportunity`
+  (`sharingModel: 'controlled_by_parent'`, `inlineEdit: 'grid'` on the
+  Opportunity form), but `crm_sales_user` — the app's only non-guest
+  permission set — granted object-level CRUD on 5 CRM objects and never the
+  line item. Record-level access always follows the master (ADR-0055), but
+  object-level CRUD is a SEPARATE gate the platform never derives: every
+  role-bound (non-admin) user, including the three positions this app ships
+  to demonstrate selling, got a silent 403 the moment they tried to add or
+  edit a product line on an Opportunity they otherwise fully own. The
+  platform's own build-time lint (`security-master-detail-ungranted`) already
+  flagged this independently.
+
+  Added `crm_opportunity_line_item` to `crm_sales_user`'s `objects` map with
+  the exact same grant shape as its master `crm_opportunity`
+  (`{ allowRead: true, allowCreate: true, allowEdit: true, allowDelete: false }`)
+  — the line item's own access is meant to follow its master, not invent an
+  independent policy.
+
+  Measured with `objectstack verify --app examples/app-crm/objectstack.config.ts
+--rls`: every position persona's `probeBlocked` count dropped from 1 (the
+  line item, the sole remaining gap left open by #8060) to 0, with zero RLS
+  holes introduced or found. The build's `security-master-detail-ungranted`
+  warning for this object is gone.
+
+- Updated dependencies [690ccf2]
+- Updated dependencies [333a374]
+- Updated dependencies [30536e3]
+- Updated dependencies [5823d59]
+- Updated dependencies [3140f9c]
+- Updated dependencies [9500ba4]
+- Updated dependencies [a8940e4]
+- Updated dependencies [76d74ec]
+- Updated dependencies [0e79785]
+- Updated dependencies [344a22a]
+- Updated dependencies [86f7a20]
+- Updated dependencies [c546c89]
+- Updated dependencies [627e65a]
+- Updated dependencies [b16dcb4]
+- Updated dependencies [22df871]
+- Updated dependencies [9c82146]
+- Updated dependencies [744b8f5]
+- Updated dependencies [37785ed]
+- Updated dependencies [7e5af5c]
+- Updated dependencies [9d1d9c7]
+- Updated dependencies [1007379]
+- Updated dependencies [4ff8abf]
+- Updated dependencies [e5bd2f6]
+- Updated dependencies [e38db3d]
+- Updated dependencies [2c1988c]
+- Updated dependencies [211abdb]
+- Updated dependencies [b3de0dd]
+- Updated dependencies [35b36f2]
+- Updated dependencies [19aaf4b]
+- Updated dependencies [0e4a7fb]
+- Updated dependencies [f505689]
+- Updated dependencies [76682cb]
+- Updated dependencies [606d577]
+- Updated dependencies [e906126]
+- Updated dependencies [08363a0]
+- Updated dependencies [444de5b]
+- Updated dependencies [3f7b4ff]
+- Updated dependencies [6a9dec6]
+- Updated dependencies [4dc1c7d]
+- Updated dependencies [baeb4f0]
+- Updated dependencies [29488cc]
+- Updated dependencies [08cd163]
+- Updated dependencies [7dc1067]
+- Updated dependencies [7674859]
+- Updated dependencies [b85cc54]
+- Updated dependencies [7a8476f]
+- Updated dependencies [518ca7a]
+- Updated dependencies [2d8dba3]
+- Updated dependencies [d62f8eb]
+- Updated dependencies [a7586cd]
+- Updated dependencies [4c5e80e]
+- Updated dependencies [4b5702a]
+- Updated dependencies [af05400]
+- Updated dependencies [d063a96]
+- Updated dependencies [fa48973]
+- Updated dependencies [cf7c694]
+- Updated dependencies [ddd0f06]
+- Updated dependencies [603cab8]
+- Updated dependencies [df95346]
+- Updated dependencies [591f675]
+- Updated dependencies [9051802]
+- Updated dependencies [2f8328c]
+- Updated dependencies [f293d45]
+- Updated dependencies [f067930]
+- Updated dependencies [97ace2a]
+- Updated dependencies [ef7b5ef]
+- Updated dependencies [9514767]
+- Updated dependencies [8813b90]
+- Updated dependencies [8f1851e]
+- Updated dependencies [b4b2c7d]
+- Updated dependencies [61ea810]
+- Updated dependencies [66d99ec]
+- Updated dependencies [cb43296]
+- Updated dependencies [91eddca]
+- Updated dependencies [b61afc1]
+- Updated dependencies [9b2d720]
+- Updated dependencies [95ef5c0]
+- Updated dependencies [97b6658]
+- Updated dependencies [0410522]
+- Updated dependencies [814db6d]
+- Updated dependencies [8dd98bf]
+- Updated dependencies [8a9c079]
+- Updated dependencies [cc3555e]
+- Updated dependencies [ea936f3]
+- Updated dependencies [69ac82c]
+- Updated dependencies [833ed84]
+- Updated dependencies [a18abf3]
+- Updated dependencies [86d2e5e]
+- Updated dependencies [c6a4eeb]
+- Updated dependencies [f450ae7]
+- Updated dependencies [5326b36]
+- Updated dependencies [e124711]
+- Updated dependencies [3bb9340]
+- Updated dependencies [9d4dfc4]
+- Updated dependencies [1059965]
+- Updated dependencies [ee264b2]
+- Updated dependencies [60b672e]
+- Updated dependencies [e654bfd]
+- Updated dependencies [6e6c872]
+- Updated dependencies [fa5758e]
+- Updated dependencies [ecf0bef]
+- Updated dependencies [3da3da5]
+- Updated dependencies [a0fdc56]
+- Updated dependencies [0dcbc11]
+- Updated dependencies [d88f3e9]
+- Updated dependencies [b9f930b]
+- Updated dependencies [289d04a]
+- Updated dependencies [c9b809f]
+- Updated dependencies [32386f8]
+- Updated dependencies [a1dd1e4]
+  - @objectstack/runtime@17.0.0-rc.7
+  - @objectstack/spec@17.0.0-rc.7
+
 ## 4.0.92-rc.5
 
 ### Patch Changes

examples/app-crm/CHANGELOG.md

@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/example-crm",
-  "version": "4.0.92-rc.5",
+  "version": "4.0.92-rc.6",
   "description": "Minimal CRM example — a smoke-test workspace that exercises the metadata loading pipeline (objects → views → app → dashboard → hook → flow → seed). For a full-featured enterprise CRM see https://github.com/objectstack-ai/hotcrm.",
   "license": "Apache-2.0",
   "private": true,