Upgrade the @objectstack/* dependencies from 17.7.0 to 18.1.0, walking the official upgrade checklists of 18.0 and 18.1

README.md

@@ -199,7 +199,7 @@ POST /api/v1/data/sys_user_position
 ```
 
 A name-spelled row grants that position's own permission set **and** `clm_requester`, because every
-position binds that set too (`src/security/bind-position-sets.ts`) — a lawyer holds `clm_legal` and
+position names that set too (`permissionSets` in `src/sharing/positions.ts`) — a lawyer holds `clm_legal` and
 `clm_requester` both. To read back what an account actually ended up with:
 
 ```http

objectstack.config.ts

@@ -5,7 +5,6 @@ import * as actions from './src/actions/index.js';
 import { allFlows, flowFunctions } from './src/flows/index.js';
 import * as profiles from './src/profiles/index.js';
 import { ClmPositions, ClmSharingRules } from './src/sharing/index.js';
-import { registerClmPositionBindings, type BindHostContext } from './src/security/index.js';
 import { clmSeeds } from './src/data/index.js';
 import * as apps from './src/apps/index.js';
 import * as datasets from './src/datasets/index.js';
@@ -32,7 +31,7 @@ export default defineStack({
     // Protocol major this app is authored against. The runtime checks the
     // range at load time and refuses a major-incompatible runtime with a
     // structured diagnostic instead of failing deep in a schema parse.
-    engines: { protocol: '^17' },
+    engines: { protocol: '^18' },
   },
 
   // `ui` serves the Console; `auth` mounts the login surface and the platform
@@ -193,8 +192,8 @@ export default defineStack({
   functions: flowFunctions,
 
   // Security (DESIGN.md §04, card 04): seven positions, five permission sets,
-  // the sharing rules. Positions and sets are containers — the join rows that
-  // make a position grant anything are written by `onEnable` below.
+  // the sharing rules. Each position names the sets it distributes in its own
+  // `permissionSets` (src/sharing/positions.ts).
   positions: ClmPositions,
   permissions: Object.values(profiles),
   sharingRules: ClmSharingRules,
@@ -206,16 +205,3 @@ export default defineStack({
   // `OS_SEED_LOCALE` chooses which language the fixture is written in.
   data: clmSeeds,
 });
-
-/**
- * Declaring a position and a permission set grants nobody anything until a
- * `sys_position_permission_set` row joins them, and that row cannot be a seed
- * (the seed loader runs before the security bootstrap creates the rows it
- * would reference). Bind them on `kernel:bootstrapped` instead — the shape
- * ATS ships. A module-level named export, which the CLI preserves beside the
- * default `defineStack()` export on the config-load path and grafts back onto
- * the app bundle on the artifact-boot path.
- */
-export const onEnable = async (ctx: unknown): Promise<void> => {
-  registerClmPositionBindings(ctx as BindHostContext);
-};

objectstack.manifest.json

@@ -2,9 +2,9 @@
   "$schema": "https://schemas.objectstack.dev/template-manifest.json",
   "name": "hotclm",
   "namespace": "clm",
-  "specVersion": "^17.0.0",
+  "specVersion": "^18.0.0",
   "engines": {
-    "protocol": "^17"
+    "protocol": "^18"
   },
   "manifestId": "app.objectstack.hotclm",
   "displayName": "HotCLM",

package.json

@@ -21,12 +21,12 @@
     "verify": "pnpm validate && pnpm lint && pnpm typecheck && pnpm lint:i18n-gate"
   },
   "dependencies": {
-    "@objectstack/spec": "^17.7.0",
-    "@objectstack/runtime": "^17.7.0",
-    "@objectstack/plugin-hono-server": "^17.7.0"
+    "@objectstack/spec": "18.1.0",
+    "@objectstack/runtime": "18.1.0",
+    "@objectstack/plugin-hono-server": "18.1.0"
   },
   "devDependencies": {
-    "@objectstack/cli": "^17.7.0",
+    "@objectstack/cli": "18.1.0",
     "typescript": "^6.0.0"
   }
 }