chore(deps): refresh the lockfile to @objectstack/* 17.2.0 — fs stops reaching the browser bundle

Lockfile-only refresh, the residual action the objectui#5668 ruling named
(Decision 1, option A — wait for upstream, then "an objectui lockfile
refresh"): every manifest already declared ^17.0.0, which admits 17.2.0, so
no dependency range changed. All six @objectstack packages move in lockstep
(spec, client, core, formula, lint, sdui-parser) — a split resolution is what
produced the dual-version spec graph that reddened check:spec-symbols in this
repo's history — and no 17.1.0 resolution remains in pnpm-lock.yaml. Two
incidental in-range transitive patch floats rode the non-frozen install:
seroval 1.6.2 -> 1.6.3 (under @tanstack/router-core) and fast-uri
3.1.5 -> 3.1.6 (under ajv).

The fix consumed: @objectstack/spec@17.1.0 imported pg-connection-string at
the top level of dist/index.mjs with no browser export condition, so the
apps/site production build failed with "Module not found: Can't resolve 'fs'"
— red on main since 2026-08-22. 17.2.0 ships the objectstack#11072 browser
conditions (., ./data, ./system, ./kernel, ./cloud -> dist/browser/**).
Measured locally on this branch, same instrument as the 2026-08-22 bisect:
before (17.1.0) Tasks: 28 successful, 29 total / turbo exit 1; after
(17.2.0) Tasks: 29 successful, 29 total / turbo exit 0, uncached.

Green-keeping, forced by the new build and nothing else — both halves the
objectui#5716 localization planted deliberately as the refresh's tripwire
("both turn stale/red on the pin refresh, which is how that refresh
announces itself here"):

- check-spec-symbol-derivation: delete the Theme / ThemeMode / ColorPalette
  ALLOW entries, stale now that 17.2.0 ships the spec's theme-module
  retirement (objectstack#10485) and the names no longer collide — exactly
  the deletion their own comment prescribed ("The refresh PR deletes these
  three entries").
- page-nav-misc-spec-parity.test: retire the two spec-side theme legs
  (mutual assignability with the spec Theme, ThemeParsed.mode required) —
  nothing is left upstream to pin against — and pin the vacancy instead:
  Theme, ThemeMode and ColorPalette asserted ABSENT from the spec export
  set, the GestureType/GestureConfig road, so an upstream re-publish is a
  loud collision. The local authoring pin (mode optional) stays executable.

The declared-BREAKING 17.2.0 entry (http_request_errors_total retired,
objectstack#9834) is inert here: the name and its four spelling/registry
variants match zero files.

Fixes #5668

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EuPCi56cnGyykygi3z9w4m

Author: claude

.changeset/spec-refresh-17-2-0-5668.md

@@ -0,0 +1,9 @@
+---
+'@object-ui/console': patch
+---
+
+Refreshes the lockfile so every `@objectstack/*` package resolves at `17.2.0` — `spec`, `client`, `core`, `formula`, `lint` and `sdui-parser` move in lockstep (a split resolution is what produced the dual-version spec graph that reddened `check:spec-symbols` in this repo's history), and no `17.1.0` resolution remains.
+
+**The docs-site and console builds stop pulling a Postgres connection-string parser toward the browser bundle.** `@objectstack/spec@17.1.0` imported `pg-connection-string` at the top level of `dist/index.mjs` with no `browser` export condition, so `apps/site`'s production build failed with `Module not found: Can't resolve 'fs'` on every route that reaches `@object-ui/components` from a client component — red on `main` since 2026-08-22 (objectui#5668). `17.2.0` ships the objectstack#11072 fix: `.`, `./data`, `./system`, `./kernel` and `./cloud` now carry `browser` conditions pointing at schema-free `dist/browser/**` bundles, and the site build is back to `Tasks: 29 successful, 29 total`.
+
+The refresh is lockfile-only — every manifest already declared `^17.0.0`, which admits `17.2.0`, so no dependency range changed. No shipped source moves: the two in-repo adaptations are a drift-guard test and a CI gate, both forced by `17.2.0` retiring the spec's theme module (objectstack#10485) exactly as the objectui#5716 localization predicted — its `Theme`/`ThemeMode`/`ColorPalette` ALLOW entries in `check:spec-symbols` went stale and were deleted, and the parity test now pins the vacancy (the spec re-publishing a theme name is a loud collision) instead of a spec leg that no longer exists.

packages/types/src/__tests__/page-nav-misc-spec-parity.test.ts

@@ -15,9 +15,14 @@
  *
  *  - **Derived** (`ActionParam`, `CreateExportJobRequest`,
  *    `CreateExportJobResult`, `ImportRowResult`, `NavigationArea`,
- *    `NavigationAreaSchema`, `Theme`): the spec now supplies the keys, so the
+ *    `NavigationAreaSchema`): the spec now supplies the keys, so the
  *    risk is no longer drift but a divergence outliving its reason, or a local
  *    key quietly reclaiming a name the spec owns. Asserted in both directions.
+ *    (`Theme` was in this list until `@objectstack/spec` 17.2.0 retired its
+ *    whole theme module — objectstack#10485 / PR objectstack#10695. Under the
+ *    objectui#5716 ruling, option A, this package now OWNS the vocabulary, so
+ *    `Theme`/`ThemeMode`/`ColorPalette` moved to the vacancy-pinned rows
+ *    below, the same road `GestureType`/`GestureConfig` travelled.)
  *  - **Renamed** (`FileMetadata`, `GestureConfig`, `GestureType`,
  *    `OfflineConfig`, `PageRegion`, `PageRegionSchema`, `ResponsiveConfig`,
  *    `WidgetManifest`, `WidgetSource`): nine genuine coincidences — same word,
@@ -50,15 +55,6 @@ import type {
   ActionParamSchema as SpecActionParamSchema,
   I18nLabel as SpecI18nLabel,
   NavigationArea as SpecNavigationArea,
-  // Re-pointed BY SIDE on the rc.6 bump (objectui#4167), not by name.
-  // Up to rc.5 the spec published `Theme` (= `z.infer`) alongside `ThemeInput`
-  // (= `z.input`); rc.6 retired every `…Input` alias and moved the bare name
-  // onto the INPUT side, so `Theme` is now `z.input` and `ThemeParsed` is the
-  // `z.infer` side. Following the old NAMES here would have swapped both pins
-  // silently — which is why `ThemeInput` became `Theme` and `Theme` became
-  // `ThemeParsed`, rather than either binding staying where it was written.
-  Theme as SpecThemeInput,
-  ThemeParsed as SpecThemeParsed,
 } from '@objectstack/spec/ui';
 import { NavigationAreaSchema } from '../zod/app.zod.js';
 import type { NavigationArea, NavigationItem } from '../app.js';
@@ -280,35 +276,24 @@ describe('NavigationArea derives from the spec', () => {
 });
 
 // ─────────────────────────────────────────────────────────────────────────────
-// Theme — derived (re-export of the spec's AUTHORING shape)
+// Theme — owned locally since the spec's theme retirement (objectui#5716)
 // ─────────────────────────────────────────────────────────────────────────────
 
-describe('Theme is the spec AUTHORING theme, not the parsed one', () => {
+describe('Theme is the AUTHORING theme document, owned by this package (objectui#5716)', () => {
+  // Until `@objectstack/spec` 17.2.0 this block pinned mutual assignability
+  // with the spec's `Theme` (its `z.input` side) and pinned `ThemeParsed.mode`
+  // required — the two spec legs `theme.ts`'s header predicted would retire on
+  // the pin refresh. 17.2.0 shipped the retirement (objectstack#10485 / PR
+  // objectstack#10695): the spec no longer exports any theme name, so there is
+  // nothing upstream to pin against and the shapes are documented, not pinned
+  // (objectui#5716 ruling, option A — localize). The vacancy itself is pinned
+  // in the renamed-dialects block below. What stays executable here is the
+  // AUTHORING reading the engine depends on: `mode` optional, because
+  // `ThemeEngine` receives stored/authored themes, not parsed ones.
   it('accepts a theme with no `mode` (the authoring side)', () => {
     const authored: Theme = { name: 'acme', label: 'Acme', colors: { primary: '#0af' } };
     expect(authored.mode).toBeUndefined();
 
-    // Mutual assignability with the spec's authoring type: this is what makes
-    // the re-export a re-export rather than a coincidence.
-    const asSpecInput: SpecThemeInput = authored;
-    const back: Theme = asSpecInput;
-    expect(back.name).toBe('acme');
-  });
-
-  it('is NOT the spec parsed theme, whose `mode` is required', () => {
-    // `.default('auto')` has already run in `z.infer`, so the parsed type would
-    // make `mode` mandatory and every stored objectui theme unrepresentable.
-    // If the spec ever drops that default the two collapse and this pin fails,
-    // which is the moment to re-read the derivation comment in `theme.ts`.
-    //
-    // rc.6 spells the `z.infer` side `ThemeParsed`. The pin reads the same fact
-    // it always did — following the NAME `Theme` here instead would have made
-    // this assertion compare the authoring side against itself and go green on
-    // nothing, which is exactly the swap the import comment warns about.
-    type ModeOfParsed = undefined extends SpecThemeParsed['mode'] ? 'optional' : 'required';
-    const parsedModeIs: ModeOfParsed = 'required';
-    expect(parsedModeIs).toBe('required');
-
     type ModeOfLocal = undefined extends Theme['mode'] ? 'optional' : 'required';
     const localModeIs: ModeOfLocal = 'optional';
     expect(localModeIs).toBe('optional');
@@ -694,6 +679,32 @@ describe('renamed local dialects do not collide with a spec export (objectui#307
     },
   );
 
+  /**
+   * THE TRIPWIRE'S THIRD FIRING, on the `@objectstack/spec` 17.2.0 refresh
+   * (objectui#5668). 17.2.0 retired the spec's whole theme module
+   * (objectstack#10485 / PR objectstack#10695) while objectui retained the
+   * theme SYSTEM, so under the objectui#5716 ruling (option A — localize)
+   * `@object-ui/types` now OWNS `Theme`, `ThemeMode` and `ColorPalette`,
+   * hand-written in `theme.ts` from the last-published 17.1.0 shapes.
+   *
+   * Unlike the Gesture pair these were never renamed — the local names were
+   * derived from the spec until the retirement — but the pin they need now is
+   * the same one: the names are exported from this package, so the spec
+   * re-publishing any of them is a live collision, not a latent one.
+   */
+  it.each([['Theme'], ['ThemeMode'], ['ColorPalette']])(
+    'the spec no longer owns `%s`, localized under the objectui#5716 ruling',
+    (localized) => {
+      expect(
+        names,
+        `spec owns '${localized}' again — the objectstack#10485 theme retirement has ` +
+          `been undone upstream while @object-ui/types exports that exact name ` +
+          `(theme.ts, objectui#5716). This is a live collision: re-triage against ` +
+          `objectstack#4115 — derive from the spec again, or arbitrate the name.`,
+      ).not.toContain(localized);
+    },
+  );
+
   /**
    * `OfflineConfig` is the one the spec vacated that objectui did NOT reclaim,
    * and the reason is worth pinning rather than remembering: **the spec was