chore(deps): raise the @objectstack/* pin from ^17.0.0-rc.6 to 17.0.0 GA

[yinlianghui]

Part of #4636

Raises the @objectstack/* dependency floor from ^17.0.0-rc.6 to ^17.0.0 so the
lockfile resolves the GA spec across the workspace.

This PR is deliberately incomplete and must not be merged on its own. It carries the
bump and nothing else. The rc.6 to GA delta turned out to be large, and the adaptations it
forces exceed this card's stated scope ceiling ("the bump + the minimal adaptations required
to keep the full farm green"). Per the card's own instruction to stop and report if that
happened, no adaptations are folded in here. The full adaptation surface is enumerated on
issue #4636 for sequencing.

Lockfile resolution evidence

All 30 workspace importers resolve GA:

### importer resolutions (@objectstack/spec)
     30         specifier: ^17.0.0
     30         version: 17.0.0(ai@7.0.56(zod@4.4.3))

A single copy of every @objectstack/* package in the tree:

'@objectstack/client@17.0.0':
'@objectstack/core@17.0.0':
'@objectstack/formula@17.0.0':
'@objectstack/lint@17.0.0':
'@objectstack/sdui-parser@17.0.0':
'@objectstack/spec@17.0.0':

Installed check: require('@objectstack/spec/package.json').version is 17.0.0.

Why client / formula / lint are in the same commit

Each of them exact-pins its own @objectstack/spec — measured from npm:

package	rc.6 pins	GA pins
@objectstack/client	"@objectstack/spec": "17.0.0-rc.6"	"@objectstack/spec": "17.0.0"
@objectstack/formula	"@objectstack/spec": "17.0.0-rc.6"	"@objectstack/spec": "17.0.0"
@objectstack/lint	"@objectstack/spec": "17.0.0-rc.6"	"@objectstack/spec": "17.0.0"

A spec-only bump was tried first and measured: it produced two copies of the schema
package — @objectstack/spec@17.0.0 for the workspace importers plus a nested
@objectstack/spec@17.0.0-rc.6 dragged in by those exact pins. Raising all four is what
yields the single GA resolution this card asks for, so it is part of the bump rather than a
separate change.

global_nav ACTION_LOCATIONS retirement (objectstack#6888) — answer for the downstream card

Yes, 17.0.0 contains the retirement. ACTION_LOCATIONS in the installed GA package is
six values with global_nav absent:

export const ACTION_LOCATIONS = [
  'list_toolbar', 'list_item', 'record_header',
  'record_more', 'record_related', 'record_section',
] as const;

Authoring it now fails with a dedicated error (GLOBAL_NAV_RETIRED).

Worth flagging for whoever is waiting on this: the retirement was already present in
17.0.0-rc.6 — it is not part of the rc.6 to GA delta. Any card gated purely on "the
installed spec has the global_nav retirement" was therefore already unblocked before this
bump, and did not need to wait on it.

The rc.6 to GA delta is not small

Measured by unpacking @objectstack/spec@17.0.0-rc.6 and diffing it against the installed
GA package, normalising the $id / x-spec-version version strings that otherwise make
every one of the 1571 JSON-schema files differ:

• 165 json-schema files differ for reasons beyond the version string
• 9 schemas removed, 8 added
• two source modules deleted outright: src/data/external-lookup.zod.ts,
  src/system/message-queue.zod.ts

The removals are clear of this repo — ExternalLookup, ExternalDataSource,
ExternalFieldMapping, MessageQueueConfig, MessageQueueProvider, TopicConfig,
ConsumerConfig and DeadLetterQueue have zero references in objectui. The additions
and the retirements are what cost.

Verification of this branch

Run at 48b0fde (the pushed HEAD; working tree clean):

gate	result
check-changeset-presence	PASS
check-changeset-fixed	PASS
check-changeset-no-major	PASS
check-phantom-dependencies	PASS
check-control-bytes	PASS
check-spec-symbol-derivation	FAIL (exit 1) — see below
turbo run build	PASS, 43/43 tasks
turbo run type-check	FAIL — 1 error, see below
full farm (vitest run)	9 files / 17 tests failed, 1452 files / 18340 tests passed

What is still red, and why none of it is fixed here

Everything below is caused by this bump. None of it is folded in, for two stated reasons:
it exceeds the scope ceiling, and part of it lands inside file regions declared by
in-flight sibling cards.

1. New GA authoring surfaces (the large one)

GA adds authorable props schemas the repo-wide parity test auto-discovers, so four new
blocks entered the judged set and objectui publishes none of their keys:

+   "object-form",
+   "object-grid",
+   "object-master-detail-form",
+   "object-metric",

object-grid alone reports 34 unpublished top-level keys (label, title, fields,
defaultFilters, sort, defaultSort, pagination, pageSize, showPagination,
searchableFields, showSearch, …). page:header, page:tabs and record:details gained
keys too. Building those registry inputs surfaces is new-feature work consuming GA
surfaces, which the card lists as explicitly out.

2. striped / bordered / virtualScroll retirement (objectstack#7176)

GA converts these three to retiredKey() tombstones that actively reject. objectui imports
them into ListViewSchema from the spec shape, so parsing now fails and one type error
falls out:

packages/types/src/__tests__/p1-spec-alignment.test.ts(67,7):
  error TS2322: Type 'true' is not assignable to type 'undefined'.

The spec's own note names the reader chain this has to be unwound along — react
spec-bridge, then plugin-list, then plugin-view and app-shell. That chain terminates at
packages/app-shell/src/views/ObjectView.tsx:1766-1838, which is inside a region declared
by in-flight card #8500, so it is not mine to edit in this batch.

3. Six spec-named symbol collisions (check:spec-symbols, exit 1)

The new GA exports collide with local declarations:

symbol	location
SECRET_MASK	packages/app-shell/src/views/metadata-admin/widgets.tsx:1852
ObjectCalendarProps	packages/plugin-calendar/src/ObjectCalendar.tsx:64
ObjectFormProps	packages/plugin-form/src/ObjectForm.tsx:48
ObjectGridProps	packages/plugin-grid/src/ObjectGrid.tsx:351
ObjectKanbanProps	packages/plugin-kanban/src/ObjectKanban.tsx:106

SECRET_MASK is also inside in-flight card #8500's declared region.

4. Remaining failing test files

• packages/plugin-form/src/sectionFields.spec-parity.test.ts — a new spec FormFieldSchema
  key needs a behavioral row or a reasoned exemption
• packages/components/src/__tests__/record-picker-inputs-spec-parity.test.ts — publish filter
• packages/components/src/__tests__/text-input-inputs-spec-parity.test.ts — publish defaultValue
• packages/plugin-detail/src/__tests__/recordHighlightsInputs.spec-parity.test.ts — a top-level
  readonly is now stripped, so it must stop being published
• packages/plugin-detail/src/__tests__/recordDetailsInputs.spec-parity.test.ts — a section
  member key the spec now strips
• packages/fields/src/widgets/__tests__/FilterConditionField.operators.test.ts — GA accepts
  $like and $ilike, which no builder operator can author

Each of these is a contract decision about what objectui publishes as an authoring surface,
not a mechanical rename.

Accounting note, stated plainly: the full farm reported 9 failing files / 17 failing
tests. Re-running the 193 spec-importing test files in isolation reproduces 8 files / 15
tests consistently. One file and two tests are therefore unaccounted for — they are
outside the spec-importing set, and I did not identify them. They may be load-dependent
flakes (this repo documents that failure mode) but I have not shown that, so it is recorded
as unknown rather than dismissed.

Changeset

Included, patch, covering the 20 published packages whose dependencies or
peerDependencies ranges change. No major is declared, per the version-alignment rule.

check-changeset-presence reports none is strictly owed — the gate keys on src/ and no
src/ changed here — but the published dependency range of 20 released packages does change,
which a consumer sees on install, so it is declared rather than skipped. The
skip-changeset convention was not applied because this diff is not tooling-only.

---

Generated by Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
objectui	Ignored		Aug 14, 2026 11:11am

[github-actions]

✅ Console Performance Budget

Metric	Value	Budget
Main entry (gzip)	24.7 KB	350 KB
Entry file	index-DBTm0Zii.js	—
Status	PASS	—

---

📦 Bundle Size Report

Package	Size	Gzipped
app-shell (index.js)	9.56KB	3.59KB
app-shell (runtime-config.js)	7.42KB	2.32KB
app-shell (types.js)	0.01KB	0.04KB
app-shell (urlParams.js)	8.92KB	3.41KB
auth (AuthContext.js)	0.31KB	0.24KB
auth (AuthGuard.js)	1.17KB	0.53KB
auth (AuthProvider.js)	25.13KB	5.40KB
auth (AuthShell.js)	3.49KB	1.40KB
auth (ForgotPasswordForm.js)	12.21KB	3.45KB
auth (LoginForm.js)	18.13KB	5.39KB
auth (PreviewBanner.js)	0.90KB	0.50KB
auth (RegisterForm.js)	6.64KB	2.21KB
auth (SocialSignInButtons.js)	9.60KB	3.89KB
auth (UserMenu.js)	3.40KB	1.22KB
auth (auth-gate-events.js)	1.29KB	0.66KB
auth (authStyles.js)	5.04KB	1.72KB
auth (createAuthClient.js)	38.46KB	10.17KB
auth (createAuthenticatedFetch.js)	6.34KB	2.43KB
auth (index.js)	2.35KB	1.07KB
auth (org-roles.js)	6.66KB	2.78KB
auth (phone-identifier.js)	1.11KB	0.66KB
auth (types.js)	0.59KB	0.35KB
auth (useAuth.js)	5.02KB	0.88KB
auth (useIsWorkspaceAdmin.js)	1.61KB	0.85KB
collaboration (CommentThread.js)	26.07KB	7.56KB
collaboration (LiveCursors.js)	3.17KB	1.27KB
collaboration (PresenceAvatars.js)	6.49KB	2.64KB
collaboration (PresenceProvider.js)	2.79KB	1.13KB
collaboration (index.js)	1.65KB	0.73KB
collaboration (useCollaborationTranslation.js)	6.05KB	2.52KB
collaboration (useCommentSearch.js)	1.98KB	0.88KB
collaboration (useConflictResolution.js)	7.75KB	1.86KB
collaboration (useMentionNotifications.js)	1.81KB	0.68KB
collaboration (usePresence.js)	6.33KB	1.84KB
collaboration (useRealtimeSubscription.js)	7.91KB	2.01KB
components (index.js)	489.88KB	108.67KB
core (index.js)	3.79KB	1.52KB
create-plugin (index.js)	10.08KB	3.26KB
data-objectstack (index.js)	163.56KB	44.83KB
fields (index.js)	230.37KB	57.17KB
i18n (LocalizationContext.js)	1.76KB	0.96KB
i18n (currency.js)	1.22KB	0.64KB
i18n (i18n.js)	4.32KB	1.77KB
i18n (index.js)	3.35KB	1.38KB
i18n (pickLocalized.js)	3.69KB	1.73KB
i18n (provider.js)	23.12KB	7.62KB
i18n (useDisplayLocale.js)	2.84KB	1.45KB
i18n (useObjectLabel.js)	27.59KB	6.63KB
i18n (useSafeTranslation.js)	7.77KB	3.13KB
layout (index.js)	38.98KB	10.85KB
mobile (MobileProvider.js)	0.92KB	0.49KB
mobile (ResponsiveContainer.js)	0.94KB	0.38KB
mobile (breakpoints.js)	1.51KB	0.70KB
mobile (createOfflineDataSource.js)	5.61KB	1.74KB
mobile (index.js)	1.50KB	0.62KB
mobile (offlineQueue.js)	3.91KB	1.35KB
mobile (pwa.js)	0.97KB	0.49KB
mobile (serviceWorker.js)	1.48KB	0.62KB
mobile (serviceWorkerSource.js)	3.41KB	1.48KB
mobile (useBreakpoint.js)	1.54KB	0.65KB
mobile (useGesture.js)	6.96KB	1.98KB
mobile (useOfflineSync.js)	1.99KB	0.72KB
mobile (usePullToRefresh.js)	2.53KB	0.85KB
mobile (useResponsive.js)	0.71KB	0.42KB
mobile (useResponsiveConfig.js)	1.36KB	0.63KB
mobile (useSpecGesture.js)	4.32KB	1.64KB
mobile (useTouchTarget.js)	1.01KB	0.54KB
permissions (MePermissionsProvider.js)	8.75KB	3.06KB
permissions (PermissionContext.js)	0.31KB	0.25KB
permissions (PermissionGuard.js)	0.89KB	0.45KB
permissions (PermissionProvider.js)	3.67KB	1.12KB
permissions (evaluator.js)	4.41KB	1.44KB
permissions (index.js)	0.91KB	0.41KB
permissions (store.js)	0.91KB	0.42KB
permissions (useFieldPermissions.js)	1.28KB	0.52KB
permissions (usePermissions.js)	1.55KB	0.71KB
plugin-ai (index.js)	15.75KB	3.80KB
plugin-calendar (index.js)	46.86KB	12.91KB
plugin-charts (index.js)	62.10KB	17.67KB
plugin-chatbot (index.js)	181.21KB	43.14KB
plugin-dashboard (index.js)	121.84KB	31.74KB
plugin-designer (index.js)	212.58KB	42.83KB
plugin-detail (index.js)	239.93KB	60.01KB
plugin-editor (index.js)	2.46KB	1.10KB
plugin-form (index.js)	114.72KB	27.70KB
plugin-gantt (index.js)	164.30KB	40.02KB
plugin-grid (index.js)	190.02KB	50.48KB
plugin-kanban (index.js)	52.74KB	14.53KB
plugin-list (index.js)	112.01KB	27.27KB
plugin-map (index.js)	18.16KB	5.81KB
plugin-markdown (index.js)	13.72KB	4.69KB
plugin-report (index.js)	41.38KB	11.09KB
plugin-timeline (index.js)	26.68KB	7.66KB
plugin-tree (index.js)	8.50KB	2.88KB
plugin-view (index.js)	84.09KB	20.56KB
providers (DataSourceProvider.js)	0.75KB	0.39KB
providers (MetadataProvider.js)	1.37KB	0.59KB
providers (ThemeProvider.js)	1.90KB	0.85KB
providers (UploadProvider.js)	11.71KB	3.53KB
providers (index.js)	0.44KB	0.22KB
providers (types.js)	0.01KB	0.04KB
react-runtime (index.js)	5.67KB	2.37KB
react (LazyPluginLoader.js)	3.77KB	1.33KB
react (SchemaRenderer.js)	27.64KB	9.44KB
react (data-invalidation.js)	5.05KB	2.08KB
react (index.js)	1.26KB	0.67KB
react (schema-input.js)	1.45KB	0.83KB
react (spec-input.js)	0.20KB	0.18KB
sdui-parser (codegen.js)	4.09KB	1.74KB
sdui-parser (index.js)	4.47KB	2.03KB
sdui-parser (parse.js)	10.04KB	2.82KB
sdui-parser (types.js)	0.29KB	0.24KB
sdui-parser (validate.js)	4.69KB	1.48KB
types (ai.js)	0.20KB	0.17KB
types (api-types.js)	0.20KB	0.18KB
types (app.js)	2.87KB	0.99KB
types (base.js)	0.20KB	0.18KB
types (blocks.js)	0.20KB	0.18KB
types (complex.js)	0.20KB	0.18KB
types (crud.js)	0.20KB	0.18KB
types (dashboard-filter-alias.js)	6.23KB	2.74KB
types (data-display.js)	0.20KB	0.18KB
types (data-protocol.js)	0.20KB	0.19KB
types (data.js)	0.20KB	0.18KB
types (designer.js)	1.87KB	0.85KB
types (disclosure.js)	0.20KB	0.18KB
types (error-code.js)	1.54KB	0.88KB
types (feedback.js)	0.20KB	0.18KB
types (field-types.js)	0.20KB	0.18KB
types (form.js)	0.20KB	0.18KB
types (http-retry.js)	4.32KB	2.02KB
types (index.js)	3.05KB	1.52KB
types (layout.js)	0.20KB	0.18KB
types (managed-by.js)	0.19KB	0.18KB
types (mobile.js)	2.59KB	1.31KB
types (navigation.js)	0.20KB	0.18KB
types (objectql.js)	0.20KB	0.18KB
types (overlay.js)	0.20KB	0.18KB
types (permissions.js)	0.20KB	0.18KB
types (plugin-scope.js)	0.20KB	0.18KB
types (record-components.js)	0.20KB	0.19KB
types (record-semantics.js)	1.28KB	0.67KB
types (registry.js)	0.20KB	0.18KB
types (reports.js)	0.20KB	0.18KB
types (spec-report.js)	5.05KB	1.93KB
types (system-fields.js)	3.33KB	1.54KB
types (theme.js)	0.20KB	0.18KB
types (ui-action.js)	3.40KB	1.71KB
types (views.js)	0.20KB	0.18KB
types (widget.js)	0.20KB	0.18KB

Size Limits

• ✅ Core packages should be < 50KB gzipped
• ✅ Component packages should be < 100KB gzipped
• ⚠️ Plugin packages should be < 150KB gzipped