Uh oh!
There was an error while loading. Please reload this page.
chore: release packages - #2390
Closed
github-actions[bot] wants to merge 1 commit into
Closed
Conversation
github-actionsBotforce-pushed
the
changeset-release/main
branch
from
July 11, 2026 01:43
9e0a598 to
620da2fCompareThe latest updates on your projects. Learn more about Vercel for GitHub. |
github-actionsBotforce-pushed
the
changeset-release/main
branch
6 times, most recently
from
July 11, 2026 16:11
6ed8450 to
06fad32Comparegithub-actionsBotforce-pushed
the
changeset-release/main
branch
from
July 13, 2026 00:36
06fad32 to
b86b3f9Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated.
Releases
@object-ui/app-shell@13.2.0
Minor Changes
53c40c2: feat: identity import — the stock ImportWizard now drives sys_user bulk import (framework#2782)
The Users list gets an Import entry for platform admins (gated on
features.adminfrom/api/v1/auth/configplus workspace-admin), wired tothe dedicated
POST /api/v1/auth/admin/import-userspipeline instead of thegeneric data import (which would bypass better-auth hashing and produce
accounts that can never sign in).
extraOptionsContent(host-injected options on the preview step) andrenderResultExtra(host-rendered content on the result step).endpoint's ≤500-row batches (idempotent upsert makes re-runs safe), injects
the selected password policy, renumbers per-batch results onto the whole
file, and enriches rows with their sign-in identity. Password policy panel
(
nonedefault /invite/temporary) and a one-shot temporary-passwordreveal with CSV download (client memory only — nothing is persisted).
Async-job/undo surfaces are hidden for identity import by design.
AuthPublicConfig.features.admintyping.Patch Changes
672f18e: Access pillar: the 已分配用户 section now lists EFFECTIVE holders — direct
grants ∪ holders of every position bound to the set — with per-row
attribution badges (直授 / 经岗位 X). Position-held rows are not removable
here (remove on the position's assignments); an
everyone-anchor bindingrenders as a note ("every signed-in member holds this set") instead of
enumerating the tenant (objectui#2382 — the direct-grants-only list told
admins "0 users" for any normally-administered set). The explain panel's
user field gains a chevron so "pick another user" is discoverable
(objectui#2381 — the picker existed but read as static text).
603d406: Fix "Create User" (and set_user_password / enable_two_factor /
create_oauth_application) result dialogs rendering an empty email + temporary
password: the console
apiHandlernow unwraps the{ success, data }responseenvelope so
resultDialogfield paths resolve against the innerdata,matching
flowHandler/serverActionHandlerand the documented "path intodata" contract. Paired with framework#2842 (objectui#2396).e492b9d: Permission sets — pure separation of design (Studio) and assignment
(Setup), per ADR-0056 / epic Epic: Permission sets — Studio designs every facet, Setup assigns users (ADR-0056) #2398. A
sys_permission_setused to render its sixauthorization facets in Setup as raw
[Object]/ JSON textareas, and onlyobjects+fields were editable in Studio; this reworks both surfaces.
Setup (assign + read-only):
object_permissions,field_permissions,system_permissions,row_level_security,tab_permissions,admin_scope) now render read-only onthe
sys_permission_setrecord page as a compact summary (counts, or capabilitychips) plus a “Design in Studio →” deep-link into the structured editor
(
/apps/:appName/metadata/permission/:setName, env scope). No[Object], noJSON — in the record view, inline edit, and the create/edit form. Implemented as
a
permission-facet-linkfield widget stamped onto the six fields via the singleObjectStackAdapter.getObjectSchemachoke point and honored by DetailSection +the record form.
sys_user_permission_set) is surfaced directlyon the Setup record page.
Studio (design every facet): the permission matrix editor gains structured
editors for the facets that were JSON-only —
sys_capabilityregistry(scope-grouped, labelled chips).
USING/CHECK.
visible | hidden | default_on | default_off.-bindings / author-env-sets toggles, and an assignable-permission-sets allowlist.
Assignment was moved out of the editor (it is now a Setup act) — the editor is
purely a design surface.
Storage/types are unchanged; editors read/write the draft’s existing parsed
fields and tolerate legacy JSON strings on load. Note: env-scope metadata saves of
these facets do not yet project onto the queryable
sys_permission_setdatarecord the Setup summary reads, so a fresh Studio edit isn’t reflected in Setup’s
read-only view until the projection refreshes — tracked as a framework follow-up
(enforcement reads the authoritative metadata).
787b0e7: Setup-app UX fixes from a system-settings review:
sys_teamnow shows an accurate empty state ("No teams yet" — create one with Create Team, or they arrive via org/SSO provisioning) instead of the generic better-auth "these records … are not added by hand here" copy, which flatly contradicted the visible Create Team button.objectName/onDirtyChange(and other FormSchema-only props) onto its<form>DOM element, removing theReact does not recognize the objectName prop/Unknown event handler property onDirtyChangewarnings logged on every object list view.Updated dependencies [80901aa]
Updated dependencies [53c40c2]
Updated dependencies [e492b9d]
@object-ui/plugin-grid@13.2.0
Minor Changes
53c40c2: feat: identity import — the stock ImportWizard now drives sys_user bulk import (framework#2782)
The Users list gets an Import entry for platform admins (gated on
features.adminfrom/api/v1/auth/configplus workspace-admin), wired tothe dedicated
POST /api/v1/auth/admin/import-userspipeline instead of thegeneric data import (which would bypass better-auth hashing and produce
accounts that can never sign in).
extraOptionsContent(host-injected options on the preview step) andrenderResultExtra(host-rendered content on the result step).endpoint's ≤500-row batches (idempotent upsert makes re-runs safe), injects
the selected password policy, renumbers per-batch results onto the whole
file, and enriches rows with their sign-in identity. Password policy panel
(
nonedefault /invite/temporary) and a one-shot temporary-passwordreveal with CSV download (client memory only — nothing is persisted).
Async-job/undo surfaces are hidden for identity import by design.
AuthPublicConfig.features.admintyping.Patch Changes
80901aa: Honor action
visible(andenabled) predicates in three more action renderers.Following the data-table row-action fix, three sibling renderers still rendered schema-defined actions without evaluating their
visibleCEL predicate:action:groupdropdown mode (@object-ui/components) — dropdown items ignoredvisible/enabled, while the group's inline mode already honored them.list_toolbarheader actions (@object-ui/plugin-detail) — e.g. an organization's "Invite User" button ignoredvisible, even though the sibling row actions (fed by the samederiveActionsbridge) already honored it via the data-table'sDataTableRowActionItem.@object-ui/plugin-grid) —bulkActionDefs.visiblewas ignored entirely; the button is now hidden when the predicate is false (theBulkActionDef.visibledoc comment is corrected from "disables" to "hides" to match).Each now evaluates
visible(and, where applicable,enabled) via a hook-safe per-item component that mirrorsRowActionMenuItem/DataTableRowActionItem, resolvingfeatures/userfrom the ambientExpressionProviderscope. Rendering-layer only — no action definitions changed.Updated dependencies [80901aa]
Updated dependencies [53c40c2]
Updated dependencies [e492b9d]
@object-ui/console@13.2.0
Patch Changes
@object-ui/auth@13.2.0
Patch Changes
53c40c2: feat: identity import — the stock ImportWizard now drives sys_user bulk import (framework#2782)
The Users list gets an Import entry for platform admins (gated on
features.adminfrom/api/v1/auth/configplus workspace-admin), wired tothe dedicated
POST /api/v1/auth/admin/import-userspipeline instead of thegeneric data import (which would bypass better-auth hashing and produce
accounts that can never sign in).
extraOptionsContent(host-injected options on the preview step) andrenderResultExtra(host-rendered content on the result step).endpoint's ≤500-row batches (idempotent upsert makes re-runs safe), injects
the selected password policy, renumbers per-batch results onto the whole
file, and enriches rows with their sign-in identity. Password policy panel
(
nonedefault /invite/temporary) and a one-shot temporary-passwordreveal with CSV download (client memory only — nothing is persisted).
Async-job/undo surfaces are hidden for identity import by design.
AuthPublicConfig.features.admintyping.@object-ui/cli@13.2.0
Patch Changes
@object-ui/collaboration@13.2.0
Patch Changes
@object-ui/components@13.2.0
Patch Changes
80901aa: Honor action
visible(andenabled) predicates in three more action renderers.Following the data-table row-action fix, three sibling renderers still rendered schema-defined actions without evaluating their
visibleCEL predicate:action:groupdropdown mode (@object-ui/components) — dropdown items ignoredvisible/enabled, while the group's inline mode already honored them.list_toolbarheader actions (@object-ui/plugin-detail) — e.g. an organization's "Invite User" button ignoredvisible, even though the sibling row actions (fed by the samederiveActionsbridge) already honored it via the data-table'sDataTableRowActionItem.@object-ui/plugin-grid) —bulkActionDefs.visiblewas ignored entirely; the button is now hidden when the predicate is false (theBulkActionDef.visibledoc comment is corrected from "disables" to "hides" to match).Each now evaluates
visible(and, where applicable,enabled) via a hook-safe per-item component that mirrorsRowActionMenuItem/DataTableRowActionItem, resolvingfeatures/userfrom the ambientExpressionProviderscope. Rendering-layer only — no action definitions changed.e492b9d: Permission sets — pure separation of design (Studio) and assignment
(Setup), per ADR-0056 / epic Epic: Permission sets — Studio designs every facet, Setup assigns users (ADR-0056) #2398. A
sys_permission_setused to render its sixauthorization facets in Setup as raw
[Object]/ JSON textareas, and onlyobjects+fields were editable in Studio; this reworks both surfaces.
Setup (assign + read-only):
object_permissions,field_permissions,system_permissions,row_level_security,tab_permissions,admin_scope) now render read-only onthe
sys_permission_setrecord page as a compact summary (counts, or capabilitychips) plus a “Design in Studio →” deep-link into the structured editor
(
/apps/:appName/metadata/permission/:setName, env scope). No[Object], noJSON — in the record view, inline edit, and the create/edit form. Implemented as
a
permission-facet-linkfield widget stamped onto the six fields via the singleObjectStackAdapter.getObjectSchemachoke point and honored by DetailSection +the record form.
sys_user_permission_set) is surfaced directlyon the Setup record page.
Studio (design every facet): the permission matrix editor gains structured
editors for the facets that were JSON-only —
sys_capabilityregistry(scope-grouped, labelled chips).
USING/CHECK.
visible | hidden | default_on | default_off.-bindings / author-env-sets toggles, and an assignable-permission-sets allowlist.
Assignment was moved out of the editor (it is now a Setup act) — the editor is
purely a design surface.
Storage/types are unchanged; editors read/write the draft’s existing parsed
fields and tolerate legacy JSON strings on load. Note: env-scope metadata saves of
these facets do not yet project onto the queryable
sys_permission_setdatarecord the Setup summary reads, so a fresh Studio edit isn’t reflected in Setup’s
read-only view until the projection refreshes — tracked as a framework follow-up
(enforcement reads the authoritative metadata).
Updated dependencies [53c40c2]
@object-ui/core@13.2.0
Patch Changes
@object-ui/data-objectstack@13.2.0
Patch Changes
e492b9d: Permission sets — pure separation of design (Studio) and assignment
(Setup), per ADR-0056 / epic Epic: Permission sets — Studio designs every facet, Setup assigns users (ADR-0056) #2398. A
sys_permission_setused to render its sixauthorization facets in Setup as raw
[Object]/ JSON textareas, and onlyobjects+fields were editable in Studio; this reworks both surfaces.
Setup (assign + read-only):
object_permissions,field_permissions,system_permissions,row_level_security,tab_permissions,admin_scope) now render read-only onthe
sys_permission_setrecord page as a compact summary (counts, or capabilitychips) plus a “Design in Studio →” deep-link into the structured editor
(
/apps/:appName/metadata/permission/:setName, env scope). No[Object], noJSON — in the record view, inline edit, and the create/edit form. Implemented as
a
permission-facet-linkfield widget stamped onto the six fields via the singleObjectStackAdapter.getObjectSchemachoke point and honored by DetailSection +the record form.
sys_user_permission_set) is surfaced directlyon the Setup record page.
Studio (design every facet): the permission matrix editor gains structured
editors for the facets that were JSON-only —
sys_capabilityregistry(scope-grouped, labelled chips).
USING/CHECK.
visible | hidden | default_on | default_off.-bindings / author-env-sets toggles, and an assignable-permission-sets allowlist.
Assignment was moved out of the editor (it is now a Setup act) — the editor is
purely a design surface.
Storage/types are unchanged; editors read/write the draft’s existing parsed
fields and tolerate legacy JSON strings on load. Note: env-scope metadata saves of
these facets do not yet project onto the queryable
sys_permission_setdatarecord the Setup summary reads, so a fresh Studio edit isn’t reflected in Setup’s
read-only view until the projection refreshes — tracked as a framework follow-up
(enforcement reads the authoritative metadata).
@object-ui/fields@13.2.0
Patch Changes
e492b9d: Permission sets — pure separation of design (Studio) and assignment
(Setup), per ADR-0056 / epic Epic: Permission sets — Studio designs every facet, Setup assigns users (ADR-0056) #2398. A
sys_permission_setused to render its sixauthorization facets in Setup as raw
[Object]/ JSON textareas, and onlyobjects+fields were editable in Studio; this reworks both surfaces.
Setup (assign + read-only):
object_permissions,field_permissions,system_permissions,row_level_security,tab_permissions,admin_scope) now render read-only onthe
sys_permission_setrecord page as a compact summary (counts, or capabilitychips) plus a “Design in Studio →” deep-link into the structured editor
(
/apps/:appName/metadata/permission/:setName, env scope). No[Object], noJSON — in the record view, inline edit, and the create/edit form. Implemented as
a
permission-facet-linkfield widget stamped onto the six fields via the singleObjectStackAdapter.getObjectSchemachoke point and honored by DetailSection +the record form.
sys_user_permission_set) is surfaced directlyon the Setup record page.
Studio (design every facet): the permission matrix editor gains structured
editors for the facets that were JSON-only —
sys_capabilityregistry(scope-grouped, labelled chips).
USING/CHECK.
visible | hidden | default_on | default_off.-bindings / author-env-sets toggles, and an assignable-permission-sets allowlist.
Assignment was moved out of the editor (it is now a Setup act) — the editor is
purely a design surface.
Storage/types are unchanged; editors read/write the draft’s existing parsed
fields and tolerate legacy JSON strings on load. Note: env-scope metadata saves of
these facets do not yet project onto the queryable
sys_permission_setdatarecord the Setup summary reads, so a fresh Studio edit isn’t reflected in Setup’s
read-only view until the projection refreshes — tracked as a framework follow-up
(enforcement reads the authoritative metadata).
Updated dependencies [80901aa]
Updated dependencies [53c40c2]
Updated dependencies [e492b9d]
@object-ui/i18n@13.2.0
Patch Changes
53c40c2: feat: identity import — the stock ImportWizard now drives sys_user bulk import (framework#2782)
The Users list gets an Import entry for platform admins (gated on
features.adminfrom/api/v1/auth/configplus workspace-admin), wired tothe dedicated
POST /api/v1/auth/admin/import-userspipeline instead of thegeneric data import (which would bypass better-auth hashing and produce
accounts that can never sign in).
extraOptionsContent(host-injected options on the preview step) andrenderResultExtra(host-rendered content on the result step).endpoint's ≤500-row batches (idempotent upsert makes re-runs safe), injects
the selected password policy, renumbers per-batch results onto the whole
file, and enriches rows with their sign-in identity. Password policy panel
(
nonedefault /invite/temporary) and a one-shot temporary-passwordreveal with CSV download (client memory only — nothing is persisted).
Async-job/undo surfaces are hidden for identity import by design.
AuthPublicConfig.features.admintyping.@object-ui/layout@13.2.0
Patch Changes
@object-ui/mobile@13.2.0
Patch Changes
@object-ui/permissions@13.2.0
Patch Changes
@object-ui/plugin-ai@13.2.0
Patch Changes
@object-ui/plugin-calendar@13.2.0
Patch Changes
@object-ui/plugin-charts@13.2.0
Patch Changes
@object-ui/plugin-chatbot@13.2.0
Patch Changes
@object-ui/plugin-dashboard@13.2.0
Patch Changes
@object-ui/plugin-designer@13.2.0
Patch Changes
@object-ui/plugin-detail@13.2.0
Patch Changes
80901aa: Honor action
visible(andenabled) predicates in three more action renderers.Following the data-table row-action fix, three sibling renderers still rendered schema-defined actions without evaluating their
visibleCEL predicate:action:groupdropdown mode (@object-ui/components) — dropdown items ignoredvisible/enabled, while the group's inline mode already honored them.list_toolbarheader actions (@object-ui/plugin-detail) — e.g. an organization's "Invite User" button ignoredvisible, even though the sibling row actions (fed by the samederiveActionsbridge) already honored it via the data-table'sDataTableRowActionItem.@object-ui/plugin-grid) —bulkActionDefs.visiblewas ignored entirely; the button is now hidden when the predicate is false (theBulkActionDef.visibledoc comment is corrected from "disables" to "hides" to match).Each now evaluates
visible(and, where applicable,enabled) via a hook-safe per-item component that mirrorsRowActionMenuItem/DataTableRowActionItem, resolvingfeatures/userfrom the ambientExpressionProviderscope. Rendering-layer only — no action definitions changed.e492b9d: Permission sets — pure separation of design (Studio) and assignment
(Setup), per ADR-0056 / epic Epic: Permission sets — Studio designs every facet, Setup assigns users (ADR-0056) #2398. A
sys_permission_setused to render its sixauthorization facets in Setup as raw
[Object]/ JSON textareas, and onlyobjects+fields were editable in Studio; this reworks both surfaces.
Setup (assign + read-only):
object_permissions,field_permissions,system_permissions,row_level_security,tab_permissions,admin_scope) now render read-only onthe
sys_permission_setrecord page as a compact summary (counts, or capabilitychips) plus a “Design in Studio →” deep-link into the structured editor
(
/apps/:appName/metadata/permission/:setName, env scope). No[Object], noJSON — in the record view, inline edit, and the create/edit form. Implemented as
a
permission-facet-linkfield widget stamped onto the six fields via the singleObjectStackAdapter.getObjectSchemachoke point and honored by DetailSection +the record form.
sys_user_permission_set) is surfaced directlyon the Setup record page.
Studio (design every facet): the permission matrix editor gains structured
editors for the facets that were JSON-only —
sys_capabilityregistry(scope-grouped, labelled chips).
USING/CHECK.
visible | hidden | default_on | default_off.-bindings / author-env-sets toggles, and an assignable-permission-sets allowlist.
Assignment was moved out of the editor (it is now a Setup act) — the editor is
purely a design surface.
Storage/types are unchanged; editors read/write the draft’s existing parsed
fields and tolerate legacy JSON strings on load. Note: env-scope metadata saves of
these facets do not yet project onto the queryable
sys_permission_setdatarecord the Setup summary reads, so a fresh Studio edit isn’t reflected in Setup’s
read-only view until the projection refreshes — tracked as a framework follow-up
(enforcement reads the authoritative metadata).
Updated dependencies [53c40c2]
@object-ui/plugin-editor@13.2.0
Patch Changes
@object-ui/plugin-form@13.2.0
Patch Changes
e492b9d: Permission sets — pure separation of design (Studio) and assignment
(Setup), per ADR-0056 / epic Epic: Permission sets — Studio designs every facet, Setup assigns users (ADR-0056) #2398. A
sys_permission_setused to render its sixauthorization facets in Setup as raw
[Object]/ JSON textareas, and onlyobjects+fields were editable in Studio; this reworks both surfaces.
Setup (assign + read-only):
object_permissions,field_permissions,system_permissions,row_level_security,tab_permissions,admin_scope) now render read-only onthe
sys_permission_setrecord page as a compact summary (counts, or capabilitychips) plus a “Design in Studio →” deep-link into the structured editor
(
/apps/:appName/metadata/permission/:setName, env scope). No[Object], noJSON — in the record view, inline edit, and the create/edit form. Implemented as
a
permission-facet-linkfield widget stamped onto the six fields via the singleObjectStackAdapter.getObjectSchemachoke point and honored by DetailSection +the record form.
sys_user_permission_set) is surfaced directlyon the Setup record page.
Studio (design every facet): the permission matrix editor gains structured
editors for the facets that were JSON-only —
sys_capabilityregistry(scope-grouped, labelled chips).
USING/CHECK.
visible | hidden | default_on | default_off.-bindings / author-env-sets toggles, and an assignable-permission-sets allowlist.
Assignment was moved out of the editor (it is now a Setup act) — the editor is
purely a design surface.
Storage/types are unchanged; editors read/write the draft’s existing parsed
fields and tolerate legacy JSON strings on load. Note: env-scope metadata saves of
these facets do not yet project onto the queryable
sys_permission_setdatarecord the Setup summary reads, so a fresh Studio edit isn’t reflected in Setup’s
read-only view until the projection refreshes — tracked as a framework follow-up
(enforcement reads the authoritative metadata).
5da9905: fix(plugin-form): honor
userActions.editon managed objects instead of blanket-disabling every field (ADR-0092 D4)ObjectFormdisabled every field on any non-platformlifecycle bucket(config / system / append-only / better-auth) — a defensive default from when
those objects had no generic edit affordance at all. Now that an object can
OPEN per-record editing via
userActions.{edit,create}(framework ADR-0092 D4— e.g.
sys_userexposing itsname/imageprofile fields), the blanketlock lifts for the current mode when its affordance is
true, and eachfield's own
readonlyflag decides. Managed buckets still default theaffordance off, so an object that doesn't opt in is unchanged. The server-side
identity write guard remains the real boundary; this is UX only.
Updated dependencies [80901aa]
Updated dependencies [53c40c2]
Updated dependencies [e492b9d]
@object-ui/plugin-gantt@13.2.0
Patch Changes
@object-ui/plugin-kanban@13.2.0
Patch Changes
@object-ui/plugin-map@13.2.0
Patch Changes
@object-ui/plugin-markdown@13.2.0
Patch Changes
@object-ui/plugin-report@13.2.0
Patch Changes
@object-ui/plugin-timeline@13.2.0
Patch Changes
@object-ui/plugin-tree@13.2.0
Patch Changes
@object-ui/plugin-view@13.2.0
Patch Changes
@object-ui/providers@13.2.0
Patch Changes
@object-ui/react@13.2.0
Patch Changes
@object-ui/runner@13.2.0
Patch Changes
@object-ui/tenant@13.2.0
Patch Changes
@object-ui/create-plugin@13.2.0
@object-ui/plugin-list@13.2.0
@object-ui/react-runtime@13.2.0
@object-ui/sdui-parser@13.2.0
@object-ui/types@13.2.0
object-ui@13.2.0
Patch Changes