chore: release packages by github-actions[bot] · Pull Request #2445 · objectstack-ai/objectui

github-actions · 2026-07-13T11:37:33Z

This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated.

Releases

@object-ui/app-shell@13.3.0

Minor Changes

7b4fc36: feat(console-ai): ask→build handoff carries conversation context (ADR-0057 P4 / cloud#817)

The P4 "Open in Builder →" handoff previously carried only the build prompt + an
optional package, so the Builder started cold and the user re-explained
themselves. It now also carries the source ask conversation as context —
ADR-0057 P4 / cloud#817 — so the build agent's first turn starts with the thread
the user already had.
- @object-ui/app-shell: both handoff sites (the full-page AiChatPage and the
  console FAB) now append ?parentConversationId=<ask thread id> to the
  /ai/build URL. The build surface reads it and forwards it to useObjectChat;
  the existing URL-mirror drops it once the build conversation id is minted, so a
  reload never re-carries it.
- @object-ui/plugin-chatbot: useObjectChat accepts parentConversationId and
  sends it as context.parentConversationId on the first turn only (held in a
  ref, consumed once) — the backend redeems it into the turn's context and the
  client owns history from there. New pure helper withHandoffContext (unit
  tested) does the non-mutating context merge.
Requires the cloud handoff-context contract (service-ai, cloud#817): the build
agent redeems context.parentConversationId into a single system block on its
first turn — ownership-checked, and carrying only the user/assistant text the
user already saw (ADR-0063 governance boundary). Without it the console degrades
cleanly: the id is sent but ignored, and the handoff is a (working) cold start.
7dea792: feat(console-ai): explicit "Open in Builder →" ask→build handoff (ADR-0057 P4)

When the ask agent declines an app-authoring request it now calls the cloud
suggest_builder tool (structured decline). The console renders that as an
explicit "Open in Builder →" action that opens the full-page build surface
seeded with the handoff prompt — ADR-0063 decline-and-redirect: an explicit,
user-initiated switch, never a silent re-route into authoring.
- @object-ui/plugin-chatbot: detectBuilderHandoff lifts the
  { status:'build_handoff', prompt, packageId? } result onto the tool
  invocation; ChatbotEnhanced renders the "Open in Builder →" card and calls a
  new onOpenBuilder prop (disabled when no host wires it).
- @object-ui/app-shell: the full-page AiChatPage (ask) and the console FAB
  wire onOpenBuilder to navigate to /ai/build?package=…&handoffPrompt=…; the
  build surface seeds that prompt as its first message (auto-sent once the
  conversation is minted), and the URL-mirror strips ?handoffPrompt so a reload
  never re-sends it. Full ask-conversation context transfer is a later upgrade
  (cloud#817); v1 carries the build prompt + optional package.
Requires the cloud suggest_builder signal (service-ai-studio) to light up; the
console degrades cleanly (no card) without it.

Patch Changes

443360a: Action params support a visible CEL predicate — the param dialog omits a param
when it evaluates false, against the same scope as action visible (features /
user / app / data). Fixes the create-user form offering a Phone Number field
the default backend rejects ("Phone numbers require the phoneNumber auth plugin"):
paired with the framework gating that param on features.phoneNumber, the form
now follows the plugin — no phone field unless the opt-in phoneNumber auth plugin
is loaded. filterVisibleParams is exported + unit-tested (feature-off hides,
feature-on shows, malformed predicate fails open).
1273f1e: fix(console-ai): reliable ask→build handoff auto-send + second-handoff context re-carry (ADR-0057 P4)

Two follow-ups to the P4 "Open in Builder →" handoff:
- Auto-send swallow. The handoff's auto-sent first message could be dropped on
  a brand-new build conversation: the seed gated on the async-resolved
  activeAgent, which can settle after the conversation id is minted, so the
  deferred-send replay ran with an empty pending and never re-fired. The seed now
  gates on the route (agentSegment, synchronous) and bumps a pendingSignal
  that useDeferredFirstSend lists in its replay deps, so the seed always fires —
  no more empty build conversation on handoff.
- Second-handoff re-carry. A second "Open in Builder →" into the (singleton)
  build conversation now re-carries the latest ask context. The transport re-arms
  parentConversationId on each falsy→truthy transition of the prop (the ask
  thread is a singleton, so the same id repeats — the fresh-arrival signal is the
  transition the URL-mirror produces, not a changed value), and the seed re-arms
  on each new handoffPrompt.
Unit-tested: deferred-send replays a post-id seed via the signal; the transport
re-carries across a strip→re-supply cycle.
9d0fdb1: feat(console-ai): render agent behavior by declared capability (cloud#816 / ADR-0057 "B+")

GET /api/v1/ai/agents now serves per-agent capabilities; the console
consumes them instead of hard-coding isBuildAgent(name):
- @object-ui/plugin-chatbot: AgentDescriptor.capabilities (normalized from
  the catalog) + new agentHasCapability(agents, name, cap) — declaration wins
  when present; falls back to the legacy isBuildAgent(name) check when absent
  (older server), so shipping order doesn't matter.
- @object-ui/app-shell: the build-doctor drawer + showDebug key off
  'debug', the FAB's resume-vs-fresh keys off 'resume', HomePage's
  "Build with AI" availability keys off 'authoring'. The ADR-0063 product-axis
  sites (surface→agent resolver, conversation scope keying, picker availability)
  intentionally stay name-based — capability describes RENDERED behavior, not
  which product an agent is.
A future skill-driven build variant now needs no console change.
9442310: feat(console-ai): key AI chat conversations on (user, app, product), not on surface (ADR-0057 P1)

The console rendered AI chat through parallel shells that forked the
conversation: the Studio design copilot scoped its thread as
studio:${packageId}:${agent} while the full-page /ai/build focus view scoped
on the agent alone — so opening the same app in both showed an empty "Build
with AI" copilot beside an active full-page build thread (indistinguishable from
data loss).

Per ADR-0057 (surface = view · conversation = model · product = binding
axis), conversations are now keyed on (user, app, product):
- New pure, unit-tested chatConversationScope({ appId, product }) +
  chatProductOfAgent(name) helper (hooks/chatScope.ts) is the single place
  the scope key is formed. product is the ADR-0063 axis (ask | build),
  derived from the resolved agent — never a per-surface choice.
- StudioAiCopilot and the full-page AiChatPage both resolve
  app:${packageId}:${product} for a package-scoped surface (the Studio copilot
  editing package X and the /ai/build?package=X "Edit with AI" focus view now
  resume ONE shared thread). The legacy studio: surface prefix is dropped.
- A generic /ai/:agent visit with no ?package= degrades to the product alone
  (build / ask) — unchanged behaviour for that surface.
Enablement stays on the single access-filtered agent-catalog gate
(useAiSurfaceEnabled, ADR-0068) — a seat-less user's empty catalog hides the
whole AI surface. No layout change.
9442310: feat(console-ai): one declarative surface→agent resolver (ADR-0057 P2)

The console re-implemented the ADR-0063 surface→agent chain in ~5 places, each
spelled slightly differently — and ConsoleLayout carried an AI-Studio-off
downgrade special case that existed nowhere else. This collapses them into one
pure, unit-tested resolver so ADR-0063 (exactly two products ask/build,
bound by surface — no roster, no per-turn classifier) becomes a structural
guarantee.
- New hooks/surfaceAgent.ts: resolveSurfaceAgent(surface, { agents, appDefaultAgent, aiStudioEnabled }) + SURFACE_DEFAULT. app.defaultAgent is
  bounded to ask/build (alias-aware) — a withdrawn tenant custom agent is
  rejected, not passed through, so no roster is representable (ADR-0057 open
  question Add default props to all components to prevent collapse in designer #4). The AI-Studio-off build → ask downgrade is folded in ONCE.
- StudioAiCopilot (studio-build → build) and the console FAB (default → ask)
  resolve through it. The FAB keeps chore(deps): bump lucide-react from 0.574.0 to 0.575.0 #771's "prefer build when the catalog unlocks
  it and nothing pinned a product" by passing that as its default PRODUCT input —
  so the resolver still owns bounding + the downgrade, which now also applies to
  the chore(deps): bump lucide-react from 0.574.0 to 0.575.0 #771 preference (closing the leak where an authoring-disabled deployment
  could still open build).
- ConsoleLayout's bespoke !aiStudioEnabled && isBuildAgent(...) downgrade is
  deleted; it passes the raw app.defaultAgent and the resolver downgrades.
Ships a unit table proving the ADR-0063 rows: Studio→build, other→ask,
AI-Studio-off downgrade, app.defaultAgent bounded (valid override wins, roster
rejected), alias-aware catalog resolution, empty catalog → inert (ADR-0025).
9d0fdb1: fix(console-ai): second handoff's auto-send no longer dies in the stale-scope pane (AI handoff: second handoff's auto-send doesn't fire into an existing (hydrating) build conversation #2450)

Mid ask→build transition, useChatConversation briefly still holds the OLD
scope's conversation id (the same stale window the URL-mirror already guards).
<ChatPane> was fed that raw id, so a DOOMED pane (build chatApi + stale ask id,
about to remount) could mount — and the deferred first-send replay consumed the
handoff stash into it, where the send died with the unmount before reaching the
wire (observed live as "conversation resumes, zero …/chat POST").

Two-layer fix:
- Scope-gated pane feed (structural): the page now hands <ChatPane> a
  conversation id/messages ONLY when conversationScope === chatScope. During
  the stale window the pane mounts as …:pending, holds the stash, and replays
  exactly once in the correctly-scoped pane — extending the existing URL-mirror
  guard to the pane itself.
- Targeted stash (defense-in-depth): the handoff seed is stamped
  targetAgentRoute: 'build'; useDeferredFirstSend refuses to consume a
  targeted stash in a pane bound to another agent (untargeted user-typed sends
  keep the legacy consume-anywhere behavior).
Per product decision, a second handoff landing on a conversation with a
blueprint still Awaiting Approval just auto-sends — the build agent sees the
pending plan in context and decides merge/supersede itself.
9138e68: fix(metadata-admin): authenticate console MetadataClient requests (Bearer token)

Studio / metadata-admin surfaces issued /api/v1/meta/* requests (list types,
?package=… reads, _drafts, the /meta root) that came back 401 unauthenticated in the token-based console, while the runtime data adapter's
reads (/meta/object|view|app) succeeded — so the same page showed some
metadata requests failing and others working.

Root cause: useMetadataClient and MetadataProvider's draft-preview client
constructed MetadataClient without a fetch, so it fell back to the bare
globalThis.fetch and sent no Authorization header. The console
authenticates by a Bearer token in localStorage (auth-session-token) — there
is no session cookie — so those requests were unauthenticated. A same-origin
cookie deployment masks the bug, which is why it went unnoticed and regressed
twice.

Both sites (and every future console surface) now construct through a single
createConsoleMetadataClient factory that bakes in createAuthenticatedFetch
(Bearer token + X-Tenant-ID + Accept-Language), matching the runtime data
adapter. This is additive for cookie deployments — credentials is untouched,
so a same-origin session cookie still flows. A
metadata-client-auth.ratchet.test.ts guard forbids a bare
new MetadataClient( elsewhere in app-shell so authentication can't silently
regress again.
2fb38ed: fix(app-shell): propagate action-param visible predicate through resolveActionParams

The create-user phone fix (feat(core,app-shell): action params honor a 'visible' predicate; hide create-user phone when plugin off #2406) gated the phoneNumber param with
visible: 'features.phoneNumber == true', but resolveActionParam dropped
visible when flattening raw spec params into ActionParamDef — so
ActionParamDialog's filterVisibleParams never saw the predicate and the
phone field kept rendering even with the phoneNumber auth plugin off.

Propagate visible in all three resolve branches (inline / field-backed /
missing-field), unwrapping the spec's { dialect, source } ExpressionInput
envelope to a plain CEL string. Completes the create-user phone fix end to end.
Updated dependencies [443360a]
Updated dependencies [a44e7b6]
Updated dependencies [94d00d4]
Updated dependencies [6a74160]
- @object-ui/core@13.3.0
- @object-ui/components@13.3.0
- @object-ui/auth@13.3.0
- @object-ui/fields@13.3.0
- @object-ui/data-objectstack@13.3.0
- @object-ui/types@13.3.0
- @object-ui/layout@13.3.0
- @object-ui/plugin-editor@13.3.0
- @object-ui/react@13.3.0
- @object-ui/collaboration@13.3.0
- @object-ui/permissions@13.3.0
- @object-ui/providers@13.3.0
- @object-ui/i18n@13.3.0

@object-ui/auth@13.3.0

Minor Changes

94d00d4: feat(auth): phone number + password sign-in on the login page

The login page's password mode now accepts an email OR a phone number as the
identifier and routes by shape — email → /sign-in/email, phone →
/sign-in/phone-number (better-auth phoneNumber plugin, framework#2780). It
coexists with the existing phone-OTP mode.
- Gated on features.phoneNumber (phoneNumber plugin enabled). Unlike phone-OTP
  it needs no SMS service, so it uses that coarser capability flag, not
  features.phoneNumberOtp. When the flag is off the field stays email-only.
- New AuthClient.signInWithPhonePassword(phoneNumber, password) wired through
  AuthContext / AuthProvider / useAuth.
- New normalizePhoneIdentifier / looksLikePhoneIdentifier helpers that mirror
  the backend's normalizePhoneNumber exactly (strip [\s\-().], validate
  ^\+?[0-9]{6,15}$, no forced E.164 / country code — the backend stores the
  light-stripped form, so anything heavier would break the lookup).
- SSO stays email-only (a phone-shaped identifier no longer attempts domain
  routing).
Only works for accounts that have both a phone number and a password set;
phone-only accounts set a password on first OTP sign-in.

Patch Changes

Updated dependencies [6a74160]
- @object-ui/types@13.3.0

@object-ui/components@13.3.0

Minor Changes

6a74160: Sharing-rule form: pick, don't type. Three new widget-hint field components make
the generic object form render pickers where an admin previously had to type
machine data (driven by the framework widget hints on sys_sharing_rule;
generalizes the capability-multiselect pattern). All degrade to the underlying
type renderer when a widget is unregistered.
- object-ref — choose a registered object by name (searchable Combobox),
  backed by the new DataSource.getObjects() (ObjectStackAdapter lists code-
  and DB-defined objects via /api/v1/meta/object), falling back to a
  sys_metadata query. Stores the object's name.
- filter-condition — a visual criteria builder (FilterBuilder) scoped to
  the fields of the object chosen in a sibling field (via getObjectSchema),
  round-tripping the stored MongoDB-style FilterCondition JSON. Criteria the
  builder can't represent (or invalid JSON) fall back to a raw-JSON editor, with
  an always-available "Edit as JSON" toggle — nothing is hidden or lost.
- recipient-picker — a record picker whose target object follows a sibling
  recipient_type (user→sys_user, team→sys_team, business_unit/
  unit_and_subordinates→sys_business_unit, position→sys_position), storing the
  value the evaluator matches on (a record id, or the position name). Resets
  the stored id when the type changes.
Wiring: the three keys join DATA_SOURCE_FIELD_TYPES (form.tsx) so the form
threads dataSource + dependentValues to them, and INLINE_EXCLUDED_FIELD_TYPES
(they're authored in the record form, not a grid cell). DataSource.getObjects()
is optional on the interface; the ObjectStack adapter implements it.

Patch Changes

a44e7b6: Form fields honor their object-schema widget render hint on the field-group /
section layout path. ObjectForm renders objects that declare field groups
(e.g. sys_sharing_rule) via an auto-derived section layout that passed each
field's metadata through without hoisting its widget override to the top-level
form-field config, so a field with widget: 'object-ref' (or filter-condition
/ recipient-picker) degraded to its bare type input — an admin was asked to
hand-type an object name instead of picking it. The form renderer now falls back
to the field metadata's own widget when no top-level override is present, so
the pickers render on sectioned forms just as they do on flat ones.
Updated dependencies [443360a]
Updated dependencies [6a74160]
- @object-ui/core@13.3.0
- @object-ui/types@13.3.0
- @object-ui/react@13.3.0
- @object-ui/i18n@13.3.0
- @object-ui/react-runtime@13.3.0
- @object-ui/sdui-parser@13.3.0

@object-ui/data-objectstack@13.3.0

Minor Changes

6a74160: Sharing-rule form: pick, don't type. Three new widget-hint field components make
the generic object form render pickers where an admin previously had to type
machine data (driven by the framework widget hints on sys_sharing_rule;
generalizes the capability-multiselect pattern). All degrade to the underlying
type renderer when a widget is unregistered.
- object-ref — choose a registered object by name (searchable Combobox),
  backed by the new DataSource.getObjects() (ObjectStackAdapter lists code-
  and DB-defined objects via /api/v1/meta/object), falling back to a
  sys_metadata query. Stores the object's name.
- filter-condition — a visual criteria builder (FilterBuilder) scoped to
  the fields of the object chosen in a sibling field (via getObjectSchema),
  round-tripping the stored MongoDB-style FilterCondition JSON. Criteria the
  builder can't represent (or invalid JSON) fall back to a raw-JSON editor, with
  an always-available "Edit as JSON" toggle — nothing is hidden or lost.
- recipient-picker — a record picker whose target object follows a sibling
  recipient_type (user→sys_user, team→sys_team, business_unit/
  unit_and_subordinates→sys_business_unit, position→sys_position), storing the
  value the evaluator matches on (a record id, or the position name). Resets
  the stored id when the type changes.
Wiring: the three keys join DATA_SOURCE_FIELD_TYPES (form.tsx) so the form
threads dataSource + dependentValues to them, and INLINE_EXCLUDED_FIELD_TYPES
(they're authored in the record form, not a grid cell). DataSource.getObjects()
is optional on the interface; the ObjectStack adapter implements it.

Patch Changes

Updated dependencies [443360a]
Updated dependencies [6a74160]
- @object-ui/core@13.3.0
- @object-ui/types@13.3.0

@object-ui/fields@13.3.0

Minor Changes

6a74160: Sharing-rule form: pick, don't type. Three new widget-hint field components make
the generic object form render pickers where an admin previously had to type
machine data (driven by the framework widget hints on sys_sharing_rule;
generalizes the capability-multiselect pattern). All degrade to the underlying
type renderer when a widget is unregistered.
- object-ref — choose a registered object by name (searchable Combobox),
  backed by the new DataSource.getObjects() (ObjectStackAdapter lists code-
  and DB-defined objects via /api/v1/meta/object), falling back to a
  sys_metadata query. Stores the object's name.
- filter-condition — a visual criteria builder (FilterBuilder) scoped to
  the fields of the object chosen in a sibling field (via getObjectSchema),
  round-tripping the stored MongoDB-style FilterCondition JSON. Criteria the
  builder can't represent (or invalid JSON) fall back to a raw-JSON editor, with
  an always-available "Edit as JSON" toggle — nothing is hidden or lost.
- recipient-picker — a record picker whose target object follows a sibling
  recipient_type (user→sys_user, team→sys_team, business_unit/
  unit_and_subordinates→sys_business_unit, position→sys_position), storing the
  value the evaluator matches on (a record id, or the position name). Resets
  the stored id when the type changes.
Wiring: the three keys join DATA_SOURCE_FIELD_TYPES (form.tsx) so the form
threads dataSource + dependentValues to them, and INLINE_EXCLUDED_FIELD_TYPES
(they're authored in the record form, not a grid cell). DataSource.getObjects()
is optional on the interface; the ObjectStack adapter implements it.

Patch Changes

Updated dependencies [443360a]
Updated dependencies [a44e7b6]
Updated dependencies [6a74160]
- @object-ui/core@13.3.0
- @object-ui/components@13.3.0
- @object-ui/types@13.3.0
- @object-ui/react@13.3.0
- @object-ui/providers@13.3.0
- @object-ui/i18n@13.3.0

@object-ui/plugin-chatbot@13.3.0

Minor Changes

7b4fc36: feat(console-ai): ask→build handoff carries conversation context (ADR-0057 P4 / cloud#817)

The P4 "Open in Builder →" handoff previously carried only the build prompt + an
optional package, so the Builder started cold and the user re-explained
themselves. It now also carries the source ask conversation as context —
ADR-0057 P4 / cloud#817 — so the build agent's first turn starts with the thread
the user already had.
- @object-ui/app-shell: both handoff sites (the full-page AiChatPage and the
  console FAB) now append ?parentConversationId=<ask thread id> to the
  /ai/build URL. The build surface reads it and forwards it to useObjectChat;
  the existing URL-mirror drops it once the build conversation id is minted, so a
  reload never re-carries it.
- @object-ui/plugin-chatbot: useObjectChat accepts parentConversationId and
  sends it as context.parentConversationId on the first turn only (held in a
  ref, consumed once) — the backend redeems it into the turn's context and the
  client owns history from there. New pure helper withHandoffContext (unit
  tested) does the non-mutating context merge.
Requires the cloud handoff-context contract (service-ai, cloud#817): the build
agent redeems context.parentConversationId into a single system block on its
first turn — ownership-checked, and carrying only the user/assistant text the
user already saw (ADR-0063 governance boundary). Without it the console degrades
cleanly: the id is sent but ignored, and the handoff is a (working) cold start.
7dea792: feat(console-ai): explicit "Open in Builder →" ask→build handoff (ADR-0057 P4)

When the ask agent declines an app-authoring request it now calls the cloud
suggest_builder tool (structured decline). The console renders that as an
explicit "Open in Builder →" action that opens the full-page build surface
seeded with the handoff prompt — ADR-0063 decline-and-redirect: an explicit,
user-initiated switch, never a silent re-route into authoring.
- @object-ui/plugin-chatbot: detectBuilderHandoff lifts the
  { status:'build_handoff', prompt, packageId? } result onto the tool
  invocation; ChatbotEnhanced renders the "Open in Builder →" card and calls a
  new onOpenBuilder prop (disabled when no host wires it).
- @object-ui/app-shell: the full-page AiChatPage (ask) and the console FAB
  wire onOpenBuilder to navigate to /ai/build?package=…&handoffPrompt=…; the
  build surface seeds that prompt as its first message (auto-sent once the
  conversation is minted), and the URL-mirror strips ?handoffPrompt so a reload
  never re-sends it. Full ask-conversation context transfer is a later upgrade
  (cloud#817); v1 carries the build prompt + optional package.
Requires the cloud suggest_builder signal (service-ai-studio) to light up; the
console degrades cleanly (no card) without it.
9d0fdb1: feat(console-ai): render agent behavior by declared capability (cloud#816 / ADR-0057 "B+")

GET /api/v1/ai/agents now serves per-agent capabilities; the console
consumes them instead of hard-coding isBuildAgent(name):
- @object-ui/plugin-chatbot: AgentDescriptor.capabilities (normalized from
  the catalog) + new agentHasCapability(agents, name, cap) — declaration wins
  when present; falls back to the legacy isBuildAgent(name) check when absent
  (older server), so shipping order doesn't matter.
- @object-ui/app-shell: the build-doctor drawer + showDebug key off
  'debug', the FAB's resume-vs-fresh keys off 'resume', HomePage's
  "Build with AI" availability keys off 'authoring'. The ADR-0063 product-axis
  sites (surface→agent resolver, conversation scope keying, picker availability)
  intentionally stay name-based — capability describes RENDERED behavior, not
  which product an agent is.
A future skill-driven build variant now needs no console change.

Patch Changes

1273f1e: fix(console-ai): reliable ask→build handoff auto-send + second-handoff context re-carry (ADR-0057 P4)

Two follow-ups to the P4 "Open in Builder →" handoff:
- Auto-send swallow. The handoff's auto-sent first message could be dropped on
  a brand-new build conversation: the seed gated on the async-resolved
  activeAgent, which can settle after the conversation id is minted, so the
  deferred-send replay ran with an empty pending and never re-fired. The seed now
  gates on the route (agentSegment, synchronous) and bumps a pendingSignal
  that useDeferredFirstSend lists in its replay deps, so the seed always fires —
  no more empty build conversation on handoff.
- Second-handoff re-carry. A second "Open in Builder →" into the (singleton)
  build conversation now re-carries the latest ask context. The transport re-arms
  parentConversationId on each falsy→truthy transition of the prop (the ask
  thread is a singleton, so the same id repeats — the fresh-arrival signal is the
  transition the URL-mirror produces, not a changed value), and the seed re-arms
  on each new handoffPrompt.
Unit-tested: deferred-send replays a post-id seed via the signal; the transport
re-carries across a strip→re-supply cycle.
Updated dependencies [443360a]
Updated dependencies [a44e7b6]
Updated dependencies [6a74160]
- @object-ui/core@13.3.0
- @object-ui/components@13.3.0
- @object-ui/types@13.3.0
- @object-ui/react@13.3.0

@object-ui/types@13.3.0

Minor Changes

6a74160: Sharing-rule form: pick, don't type. Three new widget-hint field components make
the generic object form render pickers where an admin previously had to type
machine data (driven by the framework widget hints on sys_sharing_rule;
generalizes the capability-multiselect pattern). All degrade to the underlying
type renderer when a widget is unregistered.
- object-ref — choose a registered object by name (searchable Combobox),
  backed by the new DataSource.getObjects() (ObjectStackAdapter lists code-
  and DB-defined objects via /api/v1/meta/object), falling back to a
  sys_metadata query. Stores the object's name.
- filter-condition — a visual criteria builder (FilterBuilder) scoped to
  the fields of the object chosen in a sibling field (via getObjectSchema),
  round-tripping the stored MongoDB-style FilterCondition JSON. Criteria the
  builder can't represent (or invalid JSON) fall back to a raw-JSON editor, with
  an always-available "Edit as JSON" toggle — nothing is hidden or lost.
- recipient-picker — a record picker whose target object follows a sibling
  recipient_type (user→sys_user, team→sys_team, business_unit/
  unit_and_subordinates→sys_business_unit, position→sys_position), storing the
  value the evaluator matches on (a record id, or the position name). Resets
  the stored id when the type changes.
Wiring: the three keys join DATA_SOURCE_FIELD_TYPES (form.tsx) so the form
threads dataSource + dependentValues to them, and INLINE_EXCLUDED_FIELD_TYPES
(they're authored in the record form, not a grid cell). DataSource.getObjects()
is optional on the interface; the ObjectStack adapter implements it.

@object-ui/console@13.3.0

Patch Changes

94d00d4: feat(auth): phone number + password sign-in on the login page

The login page's password mode now accepts an email OR a phone number as the
identifier and routes by shape — email → /sign-in/email, phone →
/sign-in/phone-number (better-auth phoneNumber plugin, framework#2780). It
coexists with the existing phone-OTP mode.
- Gated on features.phoneNumber (phoneNumber plugin enabled). Unlike phone-OTP
  it needs no SMS service, so it uses that coarser capability flag, not
  features.phoneNumberOtp. When the flag is off the field stays email-only.
- New AuthClient.signInWithPhonePassword(phoneNumber, password) wired through
  AuthContext / AuthProvider / useAuth.
- New normalizePhoneIdentifier / looksLikePhoneIdentifier helpers that mirror
  the backend's normalizePhoneNumber exactly (strip [\s\-().], validate
  ^\+?[0-9]{6,15}$, no forced E.164 / country code — the backend stores the
  light-stripped form, so anything heavier would break the lookup).
- SSO stays email-only (a phone-shaped identifier no longer attempts domain
  routing).
Only works for accounts that have both a phone number and a password set;
phone-only accounts set a password on first OTP sign-in.
- @object-ui/react-runtime@13.3.0
- @object-ui/sdui-parser@13.3.0

@object-ui/cli@13.3.0

Patch Changes

Updated dependencies [a44e7b6]
Updated dependencies [6a74160]
- @object-ui/components@13.3.0
- @object-ui/types@13.3.0
- @object-ui/react@13.3.0

@object-ui/collaboration@13.3.0

Patch Changes

Updated dependencies [6a74160]
- @object-ui/types@13.3.0

@object-ui/core@13.3.0

Patch Changes

443360a: Action params support a visible CEL predicate — the param dialog omits a param
when it evaluates false, against the same scope as action visible (features /
user / app / data). Fixes the create-user form offering a Phone Number field
the default backend rejects ("Phone numbers require the phoneNumber auth plugin"):
paired with the framework gating that param on features.phoneNumber, the form
now follows the plugin — no phone field unless the opt-in phoneNumber auth plugin
is loaded. filterVisibleParams is exported + unit-tested (feature-off hides,
feature-on shows, malformed predicate fails open).
Updated dependencies [6a74160]
- @object-ui/types@13.3.0

@object-ui/layout@13.3.0

Patch Changes

Updated dependencies [443360a]
Updated dependencies [a44e7b6]
Updated dependencies [6a74160]
- @object-ui/core@13.3.0
- @object-ui/components@13.3.0
- @object-ui/types@13.3.0
- @object-ui/react@13.3.0

@object-ui/mobile@13.3.0

Patch Changes

Updated dependencies [6a74160]
- @object-ui/types@13.3.0

@object-ui/permissions@13.3.0

Patch Changes

Updated dependencies [6a74160]
- @object-ui/types@13.3.0

@object-ui/plugin-ai@13.3.0

Patch Changes

Updated dependencies [443360a]
Updated dependencies [a44e7b6]
Updated dependencies [6a74160]
- @object-ui/core@13.3.0
- @object-ui/components@13.3.0
- @object-ui/types@13.3.0
- @object-ui/react@13.3.0

@object-ui/plugin-calendar@13.3.0

Patch Changes

Updated dependencies [443360a]
Updated dependencies [a44e7b6]
Updated dependencies [eef832b]
Updated dependencies [6a74160]
- @object-ui/core@13.3.0
- @object-ui/components@13.3.0
- @object-ui/plugin-detail@13.3.0
- @object-ui/fields@13.3.0
- @object-ui/types@13.3.0
- @object-ui/react@13.3.0
- @object-ui/mobile@13.3.0
- @object-ui/i18n@13.3.0

@object-ui/plugin-charts@13.3.0

Patch Changes

Updated dependencies [443360a]
Updated dependencies [a44e7b6]
Updated dependencies [6a74160]
- @object-ui/core@13.3.0
- @object-ui/components@13.3.0
- @object-ui/types@13.3.0
- @object-ui/react@13.3.0
- @object-ui/i18n@13.3.0

@object-ui/plugin-dashboard@13.3.0

Patch Changes

Updated dependencies [443360a]
Updated dependencies [a44e7b6]
Updated dependencies [6a74160]
- @object-ui/core@13.3.0
- @object-ui/components@13.3.0
- @object-ui/fields@13.3.0
- @object-ui/types@13.3.0
- @object-ui/react@13.3.0
- @object-ui/i18n@13.3.0

@object-ui/plugin-designer@13.3.0

Patch Changes

Updated dependencies [443360a]
Updated dependencies [a44e7b6]
Updated dependencies [6a74160]
- @object-ui/core@13.3.0
- @object-ui/components@13.3.0
- @object-ui/fields@13.3.0
- @object-ui/data-objectstack@13.3.0
- @object-ui/types@13.3.0
- @object-ui/plugin-form@13.3.0
- @object-ui/plugin-grid@13.3.0
- @object-ui/react@13.3.0
- @object-ui/i18n@13.3.0

@object-ui/plugin-detail@13.3.0

Patch Changes

eef832b: 修复记录抽屉绕过甘特图行级锁定的问题(甘特图产品化补齐:依赖校验、行级只读完整性、预警描边、树筛选、写后回读、刷新按钮(7 项) #2436 第 5 项)。
- RecordDetailDrawer 的编辑/删除能力现在由调用方是否传入 onFieldSave / onDelete 决定:两者都省略时抽屉严格只读(无内联编辑、无删除入口)。此前抽屉硬编码 inlineEdit 与 showDelete: true,并无条件向内层 DetailView 传包装函数,导致锁定记录仍可"编辑"(且改动静默丢失)。
- ObjectGantt 对 lockField 锁定的行、以及全局 readOnly 的甘特图,不再向抽屉传入 onFieldSave / onDelete,与时间轴上禁止拖拽/调整的行为保持一致。
- @object-ui/i18n@13.3.0

@object-ui/plugin-editor@13.3.0

Patch Changes

Updated dependencies [443360a]
Updated dependencies [a44e7b6]
Updated dependencies [6a74160]
- @object-ui/core@13.3.0
- @object-ui/components@13.3.0
- @object-ui/types@13.3.0
- @object-ui/react@13.3.0

@object-ui/plugin-form@13.3.0

Patch Changes

Updated dependencies [443360a]
Updated dependencies [a44e7b6]
Updated dependencies [6a74160]
- @object-ui/core@13.3.0
- @object-ui/components@13.3.0
- @object-ui/fields@13.3.0
- @object-ui/types@13.3.0
- @object-ui/react@13.3.0
- @object-ui/permissions@13.3.0
- @object-ui/i18n@13.3.0

@object-ui/plugin-gantt@13.3.0

Patch Changes

a506e6d: ObjectGantt now supports the api data source for both read and write-back.
Previously provider: 'api' logged "API provider not yet implemented" and rendered
nothing, and every write-back (reschedule, dependency edit, delete, drawer
inline-edit) was hard-wired to the context ObjectQL dataSource + objectName,
so the api provider's write config was never used.

All reads and writes now flow through a single adapter resolved by
resolveDataSource(schema.data, dataSource): object → context DataSource
(unchanged), api → ApiDataSource (executes the read/write HttpRequest
config), value → in-memory ValueDataSource. A pure-api view needs no
objectName and no context dataSource prop. Object-backed views are behavior-
preserving. Lookup/master_detail quick-filter option domains still resolve from
the context object backend (they degrade to distinct in-row values when absent).
42b36c4: 新增逐任务预警描边(甘特图产品化补齐:依赖校验、行级只读完整性、预警描边、树筛选、写后回读、刷新按钮(7 项) #2436 第 3 项):视图配置 borderColorField 指向
记录上的预警颜色字段(常为服务端计算的超期/临期字段),该行条形在保留
原有填充色的同时,以该颜色描边并加 2px 光晕——任务条、里程碑菱形、
汇总条均生效。语义色名(red/orange/…)映射为调色板 hex,其余 CSS 颜色
原样透传;空值不描边。开启关键路径高亮时,关键路径样式在其标记行上优先。
8a7d5af: 拖拽连线增加内建校验与宿主否决钩子(甘特图产品化补齐:依赖校验、行级只读完整性、预警描边、树筛选、写后回读、刷新按钮(7 项) #2436 第 1、2 项)。落点为锁定行
(locked)或分组行(type: 'group')时,悬停不再高亮、松手不再创建;
成环依赖(直接回边、跨层级传递回边)基于全量任务集检测并拒绝——不受
折叠子树导致可见连线缺边的影响。新增 onBeforeDependencyCreate(source, target, type) 钩子,在内建校验通过后调用,返回 false 可否决本次连线
(即 DHTMLX onBeforeLinkAdd / Syncfusion actionBegin 惯例)。
wouldCreateDependencyCycle 从 scheduling 导出并单测覆盖。
eef832b: 修复记录抽屉绕过甘特图行级锁定的问题(甘特图产品化补齐:依赖校验、行级只读完整性、预警描边、树筛选、写后回读、刷新按钮(7 项) #2436 第 5 项)。
- RecordDetailDrawer 的编辑/删除能力现在由调用方是否传入 onFieldSave / onDelete 决定:两者都省略时抽屉严格只读(无内联编辑、无删除入口)。此前抽屉硬编码 inlineEdit 与 showDelete: true,并无条件向内层 DetailView 传包装函数,导致锁定记录仍可"编辑"(且改动静默丢失)。
- ObjectGantt 对 lockField 锁定的行、以及全局 readOnly 的甘特图,不再向抽屉传入 onFieldSave / onDelete,与时间轴上禁止拖拽/调整的行为保持一致。
0b03b34: 快速筛选改为树感知(甘特图产品化补齐:依赖校验、行级只读完整性、预警描边、树筛选、写后回读、刷新按钮(7 项) #2436 第 4 项):命中任务的全部祖先链一并保留。
此前 displayTasks 是平铺过滤,项目/产品等分组行本身没有可筛字段值,
一筛就被丢掉,命中的子任务成孤儿、树结构被打散。现在祖先随命中下级
自动保留、无命中下级时照常剔除,多分支命中共享祖先不重复。
07b2cda: 甘特图写后回读 + 工具栏手动刷新按钮(甘特图产品化补齐:依赖校验、行级只读完整性、预警描边、树筛选、写后回读、刷新按钮(7 项) #2436 第 6/7 项)。
- 拖拽改期、依赖增删、抽屉内联编辑、删除记录成功后,静默重新读取数据源,让服务端重算的字段(父级汇总、预警颜色、工期重算)刷新到图上;此前乐观补丁只保留客户端写入的字段,派生字段一直陈旧直到整页刷新。静默刷新不闪 loading、不卸载 GanttView(保留滚动/折叠状态),并发请求按序号防乱序覆盖;失败时保留屏上最后一份好数据。
- GanttView 工具栏新增手动刷新按钮(onRefresh / refreshing props),object 数据源自动接线;内联 value 数据无可回读来源,不显示按钮。
Updated dependencies [443360a]
Updated dependencies [a44e7b6]
Updated dependencies [eef832b]
Updated dependencies [6a74160]
- @object-ui/core@13.3.0
- @object-ui/components@13.3.0
- @object-ui/plugin-detail@13.3.0
- @object-ui/fields@13.3.0
- @object-ui/types@13.3.0
- @object-ui/react@13.3.0
- @object-ui/i18n@13.3.0

@object-ui/plugin-grid@13.3.0

Patch Changes

Updated dependencies [443360a]
Updated dependencies [a44e7b6]
Updated dependencies [6a74160]
- @object-ui/core@13.3.0
- @object-ui/components@13.3.0
- @object-ui/fields@13.3.0
- @object-ui/types@13.3.0
- @object-ui/react@13.3.0
- @object-ui/mobile@13.3.0
- @object-ui/i18n@13.3.0

@object-ui/plugin-kanban@13.3.0

Patch Changes

Updated dependencies [443360a]
Updated dependencies [a44e7b6]
Updated dependencies [eef832b]
Updated dependencies [6a74160]
- @object-ui/core@13.3.0
- @object-ui/components@13.3.0
- @object-ui/plugin-detail@13.3.0
- @object-ui/fields@13.3.0
- @object-ui/types@13.3.0
- @object-ui/react@13.3.0
- @object-ui/i18n@13.3.0

@object-ui/plugin-map@13.3.0

Patch Changes

Updated dependencies [443360a]
Updated dependencies [a44e7b6]
Updated dependencies [6a74160]
- @object-ui/core@13.3.0
- @object-ui/components@13.3.0
- @object-ui/types@13.3.0
- @object-ui/react@13.3.0

@object-ui/plugin-markdown@13.3.0

Patch Changes

Updated dependencies [443360a]
Updated dependencies [a44e7b6]
Updated dependencies [6a74160]
- @object-ui/core@13.3.0
- @object-ui/components@13.3.0
- @object-ui/types@13.3.0
- @object-ui/react@13.3.0

@object-ui/plugin-report@13.3.0

Patch Changes

Updated dependencies [443360a]
Updated dependencies [a44e7b6]
Updated dependencies [6a74160]
- @object-ui/core@13.3.0
- @object-ui/components@13.3.0
- @object-ui/fields@13.3.0
- @object-ui/types@13.3.0
- @object-ui/plugin-grid@13.3.0
- @object-ui/react@13.3.0
- @object-ui/i18n@13.3.0

@object-ui/plugin-timeline@13.3.0

Patch Changes

Updated dependencies [443360a]
Updated dependencies [a44e7b6]
Updated dependencies [6a74160]
- @object-ui/core@13.3.0
- @object-ui/components@13.3.0
- @object-ui/types@13.3.0
- @object-ui/react@13.3.0
- @object-ui/mobile@13.3.0

@object-ui/plugin-tree@13.3.0

Patch Changes

Updated dependencies [443360a]
Updated dependencies [a44e7b6]
Updated dependencies [6a74160]
- @object-ui/core@13.3.0
- @object-ui/components@13.3.0
- @object-ui/types@13.3.0
- @object-ui/react@13.3.0

@object-ui/plugin-view@13.3.0

Patch Changes

Updated dependencies [443360a]
Updated dependencies [a44e7b6]
Updated dependencies [6a74160]
- @object-ui/core@13.3.0
- @object-ui/components@13.3.0
- @object-ui/types@13.3.0
- @object-ui/plugin-form@13.3.0
- @object-ui/plugin-grid@13.3.0
- @object-ui/react@13.3.0
- @object-ui/i18n@13.3.0

@object-ui/providers@13.3.0

Patch Changes

Updated dependencies [6a74160]
- @object-ui/types@13.3.0

@object-ui/react@13.3.0

Patch Changes

Updated dependencies [443360a]
Updated dependencies [6a74160]
- @object-ui/core@13.3.0
- @object-ui/data-objectstack@13.3.0
- @object-ui/types@13.3.0
- @object-ui/i18n@13.3.0

@object-ui/runner@13.3.0

Patch Changes

Updated dependencies [443360a]
Updated dependencies [a44e7b6]
Updated dependencies [6a74160]
- @object-ui/core@13.3.0
- @object-ui/components@13.3.0
- @object-ui/types@13.3.0
- @object-ui/plugin-charts@13.3.0
- @object-ui/plugin-kanban@13.3.0
- @object-ui/react@13.3.0

@object-ui/tenant@13.3.0

Patch Changes

Updated dependencies [6a74160]
- @object-ui/types@13.3.0

@object-ui/create-plugin@13.3.0

@object-ui/i18n@13.3.0

@object-ui/plugin-list@13.3.0

@object-ui/react-runtime@13.3.0

@object-ui/sdui-parser@13.3.0

object-ui@13.3.0

Patch Changes

Updated dependencies [443360a]
Updated dependencies [6a74160]
- @object-ui/core@13.3.0
- @object-ui/types@13.3.0

vercel · 2026-07-13T11:37:39Z

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
objectui	Ignored		Jul 13, 2026 2:31pm

github-actions Bot force-pushed the changeset-release/main branch 6 times, most recently from f87d7be to e14d8cf Compare July 13, 2026 14:17

chore: release packages

c226dca

github-actions Bot force-pushed the changeset-release/main branch from e14d8cf to c226dca Compare July 13, 2026 14:31

os-zhuang closed this Jul 13, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore: release packages#2445

chore: release packages#2445
github-actions[bot] wants to merge 1 commit into
mainfrom
changeset-release/main

github-actions Bot commented Jul 13, 2026 •

edited

Loading

Uh oh!

vercel Bot commented Jul 13, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

github-actions Bot commented Jul 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Releases

@object-ui/app-shell@13.3.0

Minor Changes

Patch Changes

@object-ui/auth@13.3.0

Minor Changes

Patch Changes

@object-ui/components@13.3.0

Minor Changes

Patch Changes

@object-ui/data-objectstack@13.3.0

Minor Changes

Patch Changes

@object-ui/fields@13.3.0

Minor Changes

Patch Changes

@object-ui/plugin-chatbot@13.3.0

Minor Changes

Patch Changes

@object-ui/types@13.3.0

Minor Changes

@object-ui/console@13.3.0

Patch Changes

@object-ui/cli@13.3.0

Patch Changes

@object-ui/collaboration@13.3.0

Patch Changes

@object-ui/core@13.3.0

Patch Changes

@object-ui/layout@13.3.0

Patch Changes

@object-ui/mobile@13.3.0

Patch Changes

@object-ui/permissions@13.3.0

Patch Changes

@object-ui/plugin-ai@13.3.0

Patch Changes

@object-ui/plugin-calendar@13.3.0

Patch Changes

@object-ui/plugin-charts@13.3.0

Patch Changes

@object-ui/plugin-dashboard@13.3.0

Patch Changes

@object-ui/plugin-designer@13.3.0

Patch Changes

@object-ui/plugin-detail@13.3.0

Patch Changes

@object-ui/plugin-editor@13.3.0

Patch Changes

@object-ui/plugin-form@13.3.0

Patch Changes

@object-ui/plugin-gantt@13.3.0

Patch Changes

@object-ui/plugin-grid@13.3.0

Patch Changes

@object-ui/plugin-kanban@13.3.0

Patch Changes

@object-ui/plugin-map@13.3.0

Patch Changes

@object-ui/plugin-markdown@13.3.0

Patch Changes

@object-ui/plugin-report@13.3.0

Patch Changes

@object-ui/plugin-timeline@13.3.0

Patch Changes

@object-ui/plugin-tree@13.3.0

Patch Changes

@object-ui/plugin-view@13.3.0

Patch Changes

@object-ui/providers@13.3.0

Patch Changes

@object-ui/react@13.3.0

Patch Changes

@object-ui/runner@13.3.0

Patch Changes

@object-ui/tenant@13.3.0

github-actions Bot commented Jul 13, 2026 •

edited

Loading

vercel Bot commented Jul 13, 2026 •

edited

Loading