chore: version packages

Author: github-actions[bot]

.changeset/autonumber-authoring-guardrails.md

@@ -1,5 +1,16 @@
 # @objectstack/example-crm
 
+## 4.0.54
+
+### Patch Changes
+
+- Updated dependencies [36138c7]
+- Updated dependencies [a8e4f3b]
+- Updated dependencies [4c213c2]
+- Updated dependencies [2afb612]
+  - @objectstack/spec@9.11.0
+  - @objectstack/runtime@9.11.0
+
 ## 4.0.53
 
 ### Patch Changes

.changeset/autonumber-format-tokens.md

@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/example-crm",
-  "version": "4.0.53",
+  "version": "4.0.54",
   "description": "Minimal CRM example — a smoke-test workspace that exercises the metadata loading pipeline (objects → views → app → dashboard → hook → flow → seed). For a full-featured enterprise CRM see https://github.com/objectstack-ai/hotcrm.",
   "license": "Apache-2.0",
   "private": true,

.changeset/liveness-prove-it-runs.md

@@ -1,5 +1,42 @@
 # @objectstack/example-showcase
 
+## 0.1.24
+
+### Patch Changes
+
+- 2afb612: feat(security): resolve `current_user.email` in RLS owner policies
+
+  RLS `using` predicates can now reference **`current_user.email`** — a unique,
+  human-readable, _seedable_ owner anchor (`owner = current_user.email`). Previously
+  the RLS compiler resolved only `current_user.id` / `organization_id` / `roles` /
+  `org_user_ids`, so any owner-by-name/email predicate silently compiled to the
+  deny sentinel (fail-closed → the user saw nothing). Email is sourced for free
+  from the auth session (with a bounded `sys_user` fallback for the API-key path)
+  and threaded onto the `ExecutionContext` in both identity resolvers — the REST
+  data path (`rest-server`) and the dispatcher path (`resolve-execution-context`).
+
+  Display `name` is deliberately **not** exposed to RLS: names collide, and a
+  collision on an ownership predicate is an access-control leak. Only unique
+  identifiers (`id`, `email`) are resolvable.
+
+  This makes owner-scoped row-level security work with seed data (no per-user ids
+  needed) and, combined with `controlled_by_parent` (ADR-0055), lets a master's
+  owner scoping flow to its detail records. The example-showcase demonstrates it:
+  `showcase_invoice` carries an `owner` email + an owner RLS policy, its lines are
+  controlled-by-parent, and invoices/lines are seeded per owner. It also fixes the
+  showcase's previously inert owner predicates (they used `==` and `current_user.name`,
+  neither of which the compiler accepts) to `= current_user.email`.
+
+- Updated dependencies [36138c7]
+- Updated dependencies [a8e4f3b]
+- Updated dependencies [4c213c2]
+- Updated dependencies [2afb612]
+  - @objectstack/spec@9.11.0
+  - @objectstack/runtime@9.11.0
+  - @objectstack/cloud-connection@9.11.0
+  - @objectstack/connector-rest@9.11.0
+  - @objectstack/connector-slack@9.11.0
+
 ## 0.1.23
 
 ### Patch Changes