chore(deps): upgrade ObjectStack 9.11 → 10.0 (1.3.0) (#411)

Bump all @objectstack/* deps ^9.11.0 → ^10.0.0; app version 1.2.0 → 1.3.0
(package.json, objectstack.config.ts, manifest specVersion).

The 10.0 metadata surface is additive for HotCRM (new tree view type +
TreeConfig, optional readScope/writeScope on permissions [ADR-0057],
optional currency on datasets, actor/currency on execution context,
defaulted `surface` on AI agents/skills) — no metadata edits required.

The one real break: 10.0's build-time expression validator (ADR-0032)
now also checks sharing-rule CEL conditions against the object schema,
surfacing a latent dangling reference. crm_account has no
`billing_country` field — country lives inside the structured
`billing_address` (Field.address). Repoint the north_america_territory
and europe_territory rules to `record.billing_address.country`. No
behavioral change (the dangling field matched nothing before; seed does
not populate billing_address).

Verified: pnpm verify green (validate, typecheck, build, 17/17 tests).
Browser-verified login → Executive Dashboard (live seeded data, lazy
charts) → Accounts list → record detail; no console errors.

Co-authored-by: Jack Zhuang <277994282+os-zhuang@users.noreply.github.com>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Author: 3 people

CHANGELOG.md

@@ -2,6 +2,18 @@
 
 All notable changes to HotCRM are documented in this file. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); HotCRM follows [Semantic Versioning](https://semver.org/).
 
+## [1.3.0] — 2026-06-22
+
+Platform upgrade to ObjectStack **10.0** — the first major line bump. Manifest `specVersion` now declares `^10.0.0` (was `^9.11.0`); app version `1.3.0`. The 10.0 metadata surface is **additive** for HotCRM except for one newly-enforced validation (below). Built, validated, type-checked, unit-tested (17/17), and browser-verified against `@objectstack/* ^10.0.0` (login → home → Executive Dashboard with live seeded data and lazy charts → Accounts list → record detail; no console errors, no failed requests).
+
+### Changed
+
+- **ObjectStack platform → 10.0** across all `@objectstack/*` packages (from `9.11`). Schema-level changes are additive and required no metadata edits: new `tree` view type + `TreeConfig` (ui); optional `readScope`/`writeScope` access-depth on object permissions and a new `ObjectAccessScope` enum (security, ADR-0057); optional `currency` on `Dataset`/`DatasetMeasure`; `actor`/`currency` fields on the execution context; AI `Agent`/`Skill` gained a `surface` field (defaulted, so existing agents/skills validate unchanged). No use of these is required by HotCRM today.
+
+### Fixed
+
+- **Territory sharing rules referenced a non-existent `billing_country` field.** 10.0's build-time expression validator (ADR-0032) now also checks **sharing-rule** CEL conditions against the object schema, which surfaced this latent dangling reference — `crm_account` has no `billing_country`; the country lives inside the structured `billing_address` field. The `north_america_territory` and `europe_territory` rules in [`src/sharing/account.sharing.ts`](src/sharing/account.sharing.ts) now read `record.billing_address.country`. No behavioral change (the dangling field matched nothing before; the seed does not populate `billing_address`), but the metadata is now valid and the rule expresses its stated "by billing country" intent against a real field.
+
 ## [1.2.0] — 2026-06-20
 
 Platform upgrade to ObjectStack **9.11** — the release cut that promotes the in-tree 9.9.1 work to the latest line. Manifest `specVersion` now declares `^9.11.0` (was `^9.4.0`); app version `1.2.0`. Built, validated, type-checked, unit-tested (17/17), and browser-verified against `@objectstack/* ^9.11.0`.

docs/MAINTENANCE.md

@@ -49,7 +49,7 @@ can silently invalidate existing metadata or **seed data** (see §4). Treat ever
 1. Bump all `@objectstack/*` deps in [`package.json`](../package.json) together —
    they are released in lockstep, so keep them on one version line.
 2. Update `specVersion` in [`objectstack.manifest.json`](../objectstack.manifest.json)
-   to match the installed `@objectstack/spec` (e.g. `^9.11.0`).
+   to match the installed `@objectstack/spec` (e.g. `^10.0.0`).
 3. `pnpm install`.
 4. `pnpm verify`. Validation failures here are usually metadata that a new
    platform contract just started enforcing — fix the metadata, do not pin back.

docs/STATUS.md

@@ -1,11 +1,11 @@
 # HotCRM Status
 
-> Snapshot date: June 4, 2026
+> Snapshot date: June 22, 2026
 > Source of truth: `pnpm validate`, `pnpm typecheck`, and `pnpm test`
 
 ## Summary
 
-HotCRM is a single ObjectStack marketplace app at version `1.0.5`. The app manifest is defined in [`objectstack.config.ts`](../objectstack.config.ts) with id `app.objectstack.hotcrm` and namespace `crm`.
+HotCRM is a single ObjectStack marketplace app at version `1.3.0`. The app manifest is defined in [`objectstack.config.ts`](../objectstack.config.ts) with id `app.objectstack.hotcrm` and namespace `crm`.
 
 ## ObjectStack Validation
 

objectstack.config.ts

@@ -31,7 +31,7 @@ export default defineStack({
   manifest: {
     id: 'app.objectstack.hotcrm',
     namespace: 'crm',
-    version: '1.2.0',
+    version: '1.3.0',
     type: 'app',
     name: 'HotCRM',
     description: 'AI-Native CRM for the ObjectStack marketplace — Accounts, Contacts, Leads, Opportunities, Cases, Knowledge, Forecasts, Campaigns, Contracts.',

objectstack.manifest.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://schemas.objectstack.dev/template-manifest.json",
   "name": "hotcrm",
-  "specVersion": "^9.11.0",
+  "specVersion": "^10.0.0",
   "manifestId": "app.objectstack.hotcrm",
   "displayName": "HotCRM",
   "description": "AI-Native CRM for the ObjectStack marketplace — Accounts, Contacts, Leads, Opportunities, Cases, Knowledge, Forecasts, Campaigns, and Contracts in one production-grade workspace.",

package.json

@@ -1,6 +1,6 @@
 {
   "name": "hotcrm",
-  "version": "1.2.0",
+  "version": "1.3.0",
   "description": "HotCRM - Production CRM built on ObjectStack",
   "private": true,
   "main": "./objectstack.config.ts",
@@ -26,17 +26,17 @@
   },
   "packageManager": "pnpm@10.33.0",
   "dependencies": {
-    "@objectstack/account": "^9.11.0",
-    "@objectstack/cli": "^9.11.0",
-    "@objectstack/driver-memory": "^9.11.0",
-    "@objectstack/driver-sql": "^9.11.0",
-    "@objectstack/driver-sqlite-wasm": "^9.11.0",
-    "@objectstack/metadata": "^9.11.0",
-    "@objectstack/objectql": "^9.11.0",
-    "@objectstack/runtime": "^9.11.0",
-    "@objectstack/service-analytics": "^9.11.0",
-    "@objectstack/service-automation": "^9.11.0",
-    "@objectstack/spec": "^9.11.0"
+    "@objectstack/account": "^10.0.0",
+    "@objectstack/cli": "^10.0.0",
+    "@objectstack/driver-memory": "^10.0.0",
+    "@objectstack/driver-sql": "^10.0.0",
+    "@objectstack/driver-sqlite-wasm": "^10.0.0",
+    "@objectstack/metadata": "^10.0.0",
+    "@objectstack/objectql": "^10.0.0",
+    "@objectstack/runtime": "^10.0.0",
+    "@objectstack/service-analytics": "^10.0.0",
+    "@objectstack/service-automation": "^10.0.0",
+    "@objectstack/spec": "^10.0.0"
   },
   "optionalDependencies": {
     "better-sqlite3": "^12.11.1"