chore: version packages

Author: github-actions[bot]

.changeset/adr-0057-lifecycle-p1-p4.md

@@ -1,5 +1,15 @@
 # @objectstack/example-crm
 
+## 4.0.82
+
+### Patch Changes
+
+- Updated dependencies [7953832]
+- Updated dependencies [82e745e]
+- Updated dependencies [7449476]
+  - @objectstack/spec@14.4.0
+  - @objectstack/runtime@14.4.0
+
 ## 4.0.81
 
 ### Patch Changes

.changeset/adr-0091-l1-grant-validity.md

@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/example-crm",
-  "version": "4.0.81",
+  "version": "4.0.82",
   "description": "Minimal CRM example — a smoke-test workspace that exercises the metadata loading pipeline (objects → views → app → dashboard → hook → flow → seed). For a full-featured enterprise CRM see https://github.com/objectstack-ai/hotcrm.",
   "license": "Apache-2.0",
   "private": true,

.changeset/docs-sms-phone-otp.md

@@ -1,5 +1,48 @@
 # @objectstack/example-showcase
 
+## 0.3.4
+
+### Patch Changes
+
+- 7449476: Permission-zoo audit follow-ups:
+
+  **FLS keys must be object-qualified (`security-fls-unqualified-key`, error).**
+  The runtime evaluator matches field-permission keys by `<object>.<field>`
+  prefix — a bare `budget` key matches NOTHING and the declared masking
+  silently never enforces. The showcase itself shipped exactly that bug: its
+  contributor FLS block (bare `budget`/`spent`/`budget_remaining`) was a
+  runtime no-op, and the "FLS proof" in earlier verification was actually a
+  validation-rule rejection. Fixed: keys qualified
+  (`showcase_project.budget` …), a new D7 lint rule rejects bare keys at
+  compile time with a fix-it, and the permission-zoo dogfood now proves the
+  served pipeline denies a contributor's budget write while allowing ordinary
+  field edits.
+
+  **Release pipeline: PROTOCOL_VERSION auto-sync.** `changeset version` now
+  runs `scripts/sync-protocol-version.mjs`, regenerating the handshake
+  constant from the spec package major. Release PRs opened by
+  changesets/action with the default GITHUB_TOKEN never trigger CI (GitHub's
+  anti-recursion rule), so the lockstep guard could only fire AFTER a release
+  merged — the drift class that broke main at 14.0.0 (#2769) is now fixed at
+  version time, the one spot that cannot be skipped.
+
+  **D11 `externalSharingModel` honestly marked.** The dial has no runtime
+  consumer yet (authoring lint + Studio badges only); its liveness entry
+  moves from a bespoke `authorable` status to the documented `planned` +
+  `authorWarn`, and the sharing docs / design doc / showcase comments now say
+  explicitly that evaluation of external principals lands with the
+  principal-taxonomy phase (#2696).
+
+- Updated dependencies [7953832]
+- Updated dependencies [82e745e]
+- Updated dependencies [7449476]
+  - @objectstack/spec@14.4.0
+  - @objectstack/driver-sql@14.4.0
+  - @objectstack/cloud-connection@14.4.0
+  - @objectstack/connector-rest@14.4.0
+  - @objectstack/connector-slack@14.4.0
+  - @objectstack/runtime@14.4.0
+
 ## 0.3.3
 
 ### Patch Changes

.changeset/fix-resend-verification-email.md

@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/example-showcase",
-  "version": "0.3.3",
+  "version": "0.3.4",
   "description": "Kitchen-sink showcase workspace — exercises every metadata type, every view type, every chart type, and the major end-to-end capability chains (security, automation, analytics). Built for demonstration, debugging, and coverage-driven verification.",
   "license": "Apache-2.0",
   "private": true,