chore(deps): upgrade the ObjectStack platform to 18.0.0-next.0

.changeset/2031-objectstack-18-next-0.md

@@ -0,0 +1,56 @@
+---
+'hotcrm': minor
+---
+
+Upgrade the ObjectStack platform to 18.0.0-next.0 (prerelease)
+
+All 24 `@objectstack/*` dependencies move from 17.7.0 to 18.0.0-next.0 together, pinned exact:
+20 in `dependencies` and 4 in `devDependencies`. `specVersion` and `engines.protocol` follow to
+`^18.0.0-next.0` in `objectstack.manifest.json` and in both package manifests (`src/sales`,
+`src/service`). `pnpm install` regenerated `pnpm-lock.yaml` against the public registry: 790
+`packages:` entries before, 791 after. The 54 `@objectstack/*` and `create-objectstack` keys moved
+one for one, `@objectstack/service-mailbox@18.0.0-next.0` was added, and no third-party package
+changed version.
+
+**This release needs an ObjectStack 18 runtime.** 18.0.0-next.0 is a prerelease. The protocol
+handshake compares majors, so a 17.x host refuses to load this artifact before it reads a single
+object, and reports why. Upgrade the host first.
+
+The platform changes that reached this app:
+
+- **Every flow is rewritten in the two 18.0.0-next.0 dialects.** The platform no longer accepts
+  `{…}` templates in a flow's value fields. A value is now a CEL expression, and a text field
+  (screen titles and descriptions, end messages, action links, HTTP URLs and headers) takes
+  `{{ … }}` holes. All 32 flows and the shared billing payload were rewritten, and `os validate`
+  goes from 340 refusals to none. Each site keeps what it did on 17.7.0, with one exception. On
+  **Close Case**, an agent who leaves *Resolved by Article* unanswered now clears a link that was
+  set earlier on the record form. On 17.7.0 that link stayed.
+- **Flow dialogs translate more of their text.** 18.0.0-next.0 makes screen descriptions, select
+  options and refusal messages translatable, and `os lint` reports the missing keys. All 32 new
+  keys are translated in zh-CN, es-ES and ja-JP, using the words the packs already use for the
+  same objects.
+- **Tenant administrators no longer hold `manage_org_presentation`.** 18.0.0-next.0 retires the
+  capability together with per-organization overlays (ADR-0131 D6). The platform has no
+  organization-bounded authoring capability now, so a tenant administrator authors no metadata.
+- **Email templates no longer declare `category`.** The platform retires the key and refuses it.
+
+**What operators should know:**
+
+- **Scheduled flows still need `OS_AUTOMATION_SCHEDULED_WORK_ENABLED=true`.** Without it, none of
+  the eight scheduled flows runs: no contract or quote expiry, no SLA monitor, no reminders, no
+  forecast snapshots.
+- **Every install now has an organization.** Under the `single` posture, the platform creates the
+  Default Organization at boot and loads the seed data into it.
+- **A position assigned through Setup carries that organization.** A position row written without
+  one, such as a 17.x row an upgrade carries over, does not staff the case-escalation pool, which
+  stays inside each case's organization. A sales manager or service manager whose 17.x assignment
+  carries no organization should be assigned again.
+- **Deleting an account removes its draft, expired and terminated contracts with it.** An activated
+  contract still blocks the delete, as the account documentation says.
+- **An elevated scheduled or sub-flow can no longer be started by name**, not even by an
+  administrator. It starts from its own trigger, or as a sub-flow of a parent flow.
+
+The test suite moved with the platform. Every suite runs on the SQL datasource, by maintainer
+ruling. The legs whose only subject was the absent-column shape of the in-memory driver are retired,
+because that driver no longer serves an app with organizations. The token ceilings are raised 50%
+by maintainer ruling and recorded as a grant.

content/docs/whats-new.mdx

@@ -65,11 +65,12 @@ http://localhost:4001 and create the first admin account.
 
 ## v4.0.1 — Latest release
 
-**HotCRM 4.0.1**, running on **ObjectStack 17.7.0** across every
-`@objectstack/*` package. The app manifest declares the matching
-`^17.7.0` protocol range, so a runtime on a different protocol major
-refuses the load up front with a structured diagnostic instead of failing deep
-in a schema parse.
+**HotCRM 4.0.1** shipped on **ObjectStack 17.7.0** across every
+`@objectstack/*` package. The release after it runs on **ObjectStack
+18.0.0-next.0**, a prerelease of the platform's next major, and its manifest
+declares the matching `^18.0.0-next.0` protocol range, so a runtime on a
+different protocol major — a 17.x host included — refuses the load up front
+with a structured diagnostic instead of failing deep in a schema parse.
 
 > **This page does not keep a second release table.** The release-by-release
 > history is `CHANGELOG.md` in the repository, compiled from the `.changeset/`

content/docs/whats-new.zh-Hans.mdx

@@ -47,9 +47,11 @@ HOTCRM_TOKEN=... ./scripts/wow1-live-schema.sh
 
 ## v4.0.1 —— 最新发布
 
-**HotCRM 4.0.1**，全线 `@objectstack/*` 包运行在 **ObjectStack 17.7.0** 上。
-应用清单声明了与之匹配的 `^17.7.0` 协议区间，因此协议大版本不同的运行时会在
-装载之初就带着结构化诊断拒绝加载，而不是在某次 schema 解析的深处才失败。
+**HotCRM 4.0.1** 发布时，全线 `@objectstack/*` 包运行在 **ObjectStack 17.7.0** 上。
+它之后的版本运行在 **ObjectStack 18.0.0-next.0** 上（平台下一个大版本的预发布版），
+应用清单声明了与之匹配的 `^18.0.0-next.0` 协议区间，因此协议大版本不同的运行时
+（包括 17.x 的宿主）会在装载之初就带着结构化诊断拒绝加载，而不是在某次 schema
+解析的深处才失败。
 
 > **这一页不维护第二张发布表。** 逐版本的发布历史在仓库的 `CHANGELOG.md` 里，由每个
 > 拉取请求补充的 `.changeset/` 条目编译而成。v1.0 与 4.0.1 之间的各个版本都记录在那里，

content/docs/whats-new.zh-Hant.mdx

@@ -49,9 +49,11 @@ HOTCRM_TOKEN=... ./scripts/wow1-live-schema.sh
 
 ## v4.0.1 —— 最新發行
 
-**HotCRM 4.0.1**，全線 `@objectstack/*` 套件執行在 **ObjectStack 17.7.0** 上。
-應用清單宣告了與之相符的 `^17.7.0` 協定區間，因此協定大版本不同的執行時會在
-載入之初就帶著結構化診斷拒絕載入，而不是在某次 schema 解析的深處才失敗。
+**HotCRM 4.0.1** 發行時，全線 `@objectstack/*` 套件執行在 **ObjectStack 17.7.0** 上。
+它之後的版本執行在 **ObjectStack 18.0.0-next.0** 上（平台下一個大版本的預發行版），
+應用清單宣告了與之相符的 `^18.0.0-next.0` 協定區間，因此協定大版本不同的執行時
+（包括 17.x 的宿主）會在載入之初就帶著結構化診斷拒絕載入，而不是在某次 schema
+解析的深處才失敗。
 
 > **這一頁不維護第二張發行表。** 逐版本的發行歷史在儲存庫的 `CHANGELOG.md` 裡，由每個
 > 拉取請求補上的 `.changeset/` 條目編譯而成。v1.0 與 4.0.1 之間的各個版本都記錄在那裡，

docs/STATUS.md

@@ -73,7 +73,7 @@ pnpm verify
 | --- | --- |
 | Node.js | `^22.11 \|\| ^24 \|\| >=26` |
 | pnpm | `>=10.0.0` |
-| ObjectStack packages | `17.7.0` |
+| ObjectStack packages | `18.0.0-next.0` |
 | Local dev port | `4001` |
 
 Each row above is asserted against `package.json` (`engines`, the `@objectstack/*`

objectstack.manifest.json

@@ -1,9 +1,9 @@
 {
   "$schema": "https://schemas.objectstack.dev/template-manifest.json",
   "name": "hotcrm",
-  "specVersion": "^17.7.0",
+  "specVersion": "^18.0.0-next.0",
   "engines": {
-    "protocol": "^17.7.0"
+    "protocol": "^18.0.0-next.0"
   },
   "manifestId": "app.objectstack.hotcrm",
   "displayName": "HotCRM",

package.json

@@ -36,36 +36,36 @@
   },
   "packageManager": "pnpm@10.33.0",
   "dependencies": {
-    "@objectstack/account": "17.7.0",
-    "@objectstack/cli": "17.7.0",
-    "@objectstack/core": "17.7.0",
-    "@objectstack/driver-memory": "17.7.0",
-    "@objectstack/driver-sql": "17.7.0",
-    "@objectstack/driver-sqlite-wasm": "17.7.0",
-    "@objectstack/metadata": "17.7.0",
-    "@objectstack/objectql": "17.7.0",
-    "@objectstack/platform-objects": "17.7.0",
-    "@objectstack/plugin-approvals": "17.7.0",
-    "@objectstack/plugin-auth": "17.7.0",
-    "@objectstack/plugin-security": "17.7.0",
-    "@objectstack/plugin-sharing": "17.7.0",
-    "@objectstack/runtime": "17.7.0",
-    "@objectstack/service-analytics": "17.7.0",
-    "@objectstack/service-automation": "17.7.0",
-    "@objectstack/service-messaging": "17.7.0",
-    "@objectstack/service-storage": "17.7.0",
-    "@objectstack/spec": "17.7.0",
-    "@objectstack/trigger-record-change": "17.7.0"
+    "@objectstack/account": "18.0.0-next.0",
+    "@objectstack/cli": "18.0.0-next.0",
+    "@objectstack/core": "18.0.0-next.0",
+    "@objectstack/driver-memory": "18.0.0-next.0",
+    "@objectstack/driver-sql": "18.0.0-next.0",
+    "@objectstack/driver-sqlite-wasm": "18.0.0-next.0",
+    "@objectstack/metadata": "18.0.0-next.0",
+    "@objectstack/objectql": "18.0.0-next.0",
+    "@objectstack/platform-objects": "18.0.0-next.0",
+    "@objectstack/plugin-approvals": "18.0.0-next.0",
+    "@objectstack/plugin-auth": "18.0.0-next.0",
+    "@objectstack/plugin-security": "18.0.0-next.0",
+    "@objectstack/plugin-sharing": "18.0.0-next.0",
+    "@objectstack/runtime": "18.0.0-next.0",
+    "@objectstack/service-analytics": "18.0.0-next.0",
+    "@objectstack/service-automation": "18.0.0-next.0",
+    "@objectstack/service-messaging": "18.0.0-next.0",
+    "@objectstack/service-storage": "18.0.0-next.0",
+    "@objectstack/spec": "18.0.0-next.0",
+    "@objectstack/trigger-record-change": "18.0.0-next.0"
   },
   "optionalDependencies": {
     "better-sqlite3": "^13.0.3"
   },
   "devDependencies": {
     "@changesets/cli": "^3.0.3",
-    "@objectstack/formula": "17.7.0",
-    "@objectstack/plugin-audit": "17.7.0",
-    "@objectstack/plugin-email": "17.7.0",
-    "@objectstack/verify": "17.7.0",
+    "@objectstack/formula": "18.0.0-next.0",
+    "@objectstack/plugin-audit": "18.0.0-next.0",
+    "@objectstack/plugin-email": "18.0.0-next.0",
+    "@objectstack/verify": "18.0.0-next.0",
     "@playwright/test": "^1.63.0",
     "@vitest/coverage-v8": "^4.1.10",
     "fumadocs-core": "16.15.14",