Repository navigation
chore(deps): move .objectstack-sha to the objectstack 18.1.0 release commit e649c2d91e (objectui#13440) - #13445
Merged
objectstack-fleet[bot] merged 5 commits intoOct 24, 2026
Conversation
chore: version packages (#25606) objectstack@e649c2d91e270e3da26820bcfe54a28445305a75 Moves the pin to the objectstack 18.1.0 release commit (objectui#13440). Claude-Session: https://claude.ai/code/session_01CErMSwkRLW7c7jk23MHfVP Co-authored-by: Claude <noreply@anthropic.com>
… pin carries it (objectui#13440) The pin now names objectstack 18.1.0, whose spec exports MEMBERSHIP_ROLE_EXTERNAL and lists `external` in BUILTIN_MEMBERSHIP_ROLES. This is the swap the org-roles tripwire prescribed: - org-roles.ts re-exports MEMBERSHIP_ROLE_EXTERNAL as ORG_ROLE_EXTERNAL (same name, same value 'external') instead of spelling the literal, and ORG_ROLE_LABELS is typed Record<OrgRole, ...> again. - The tripwire test is deleted, with its now unused spec namespace import. - InviteMemberDialog.roleCap and org-i18n-holdouts-4474 expect external in the invite dialog's role list, as objectui#13427 announced for a spec that lists the role. Claude-Session: https://claude.ai/code/session_01CErMSwkRLW7c7jk23MHfVP Co-authored-by: Claude <noreply@anthropic.com>
…18.1.0 (objectui#13440) The pin's packed manifests now say 18.1.0, so check:installed-pin-claims (blocking through scripts/__tests__/check-installed-spec-pin-claims.test.ts) flagged 34 present-tense "installed 18.0.0" stamps in 24 files, and ci-cd-pipeline-doc.test.ts flagged e2e/live/ci/backend.env. Re-measured before restamping: between 915e9404 and e649c2d91e the spec source moves only automation/flow.zod.ts (the runAs description), data/object.zod.ts (membershipKeys), identity/*, kernel/execution-context, security/explain and rls, stack.zod.ts and one semantic migration entry. No claim's subject is among them (ui/*, data/field, FieldSchema options, flow node config, ComponentPropsMap rows), and packages/lint's validate-expressions.ts and the trigger packages' sources are unchanged. Each stamp moves 18.0.0 -> 18.1.0; a stamp carrying its re-measure list gains objectui#13440. OBJECTSTACK_VERSION moves to 18.1.0, whose @objectstack/cli tag peels to the pin commit e649c2d91e. Claude-Session: https://claude.ai/code/session_01CErMSwkRLW7c7jk23MHfVP Co-authored-by: Claude <noreply@anthropic.com>
…AL re-export (objectui#13440) Claude-Session: https://claude.ai/code/session_01CErMSwkRLW7c7jk23MHfVP Co-authored-by: Claude <noreply@anthropic.com>
Contributor
✅ Console Performance Budget
The eager closure is every chunk the entry reaches through static imports — what the browser fetches and parses before the app renders. The entry chunk on its own is a small fraction of it. 📦 Bundle Size Report
Size Limits
|
… membershipKeys (objectui#13440) @objectstack/spec 18.1.0 adopts ObjectSchema.membershipKeys (objectstack#25513). Measured against the 915e9404 pin: the spec's authorable-surface/data.json gains exactly data/Object:membershipKeys, none lost. Both files carry the count as a corpus guard for their own membership claims, which stay unchanged, so it is re-pointed 46 -> 47 with its history sentence, as the four earlier adoptions were. Claude-Session: https://claude.ai/code/session_01CErMSwkRLW7c7jk23MHfVP Co-authored-by: Claude <noreply@anthropic.com>
Contributor
✅ Console Performance Budget
The eager closure is every chunk the entry reaches through static imports — what the browser fetches and parses before the app renders. The entry chunk on its own is a small fraction of it. 📦 Bundle Size Report
Size Limits
|
Contributor
Author
席位核对ACCEPT — objectui#13440 (p1, S mechanics), head Seat: domain:ui#1 · Clause-②: no
|
os-zhuang
approved these changes
Oct 24, 2026
objectstack-fleet
Bot
deleted the
claude/issue-13440-objectstack-pin-18-1
branch
October 24, 2026 14:55
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Requested by Sales · project thread
Closes #13440
Clause-②: no
Metadata-protocol: none
Unblocks #13285 and #13305 (both wait for a pin that carries 18.1.0).
The pin
.objectstack-shamoves from915e94049922toe649c2d91e270e3da26820bcfe54a28445305a75, the objectstack 18.1.0 release commit ("chore: version packages", chore: version packages objectstack#25606). It carries feat(plugin-security)!: a flow that runs as system writes no identity assignment objectstack#25483 and docs(spec): the runAs description names a system run's refused identity-assignment writes, with its ADR-0087 D3 entry objectstack#25564, which Security: a runAs system flow writes identity-assignment rows (sys_user_position, sys_invitation) past the delegated-administration gate objectstack#25251 required to ship in one release, so the same-release hold is met.git merge-base --is-ancestor e649c2d91e origin/mainexits 0, and the bump script reported "(on origin/main)". The@objectstack/cli@18.1.0tag peels toe649c2d91e.scripts/bump-objectstack.sh e649c2d91e270e3da26820bcfe54a28445305a75 --no-commit(so the commit carries the repo's trailer pair), which fetched the sha and built and packed the 7 packages, thenpnpm install..objectstack-shaand the seven packed manifests in.objectstack-pin/. The manifests change only version strings,18.0.0to18.1.0(the package's own version and its@objectstack/*dependencies).pnpm-lock.yamlis unchanged.pnpm installleft it byte-identical, andpnpm install --frozen-lockfileexits 0. So the Dependabot lockfile PRs (chore(deps): Bump next from 16.3.8 to 16.4.1 #13438, chore(deps-dev): Bump happy-dom from 20.11.2 to 21.0.4 #13439) do not overlap this one.pnpm objectstack:statusanswers✓ built at the pin e649c2d91e27.What the move breaks, and the follow-through in this PR
Each item below is red on the bare pin move and was fixed here because the failing check names its own fix. Nothing else changed.
1. The
externaltripwire in@object-ui/auth(objectui#13427)packages/auth/src/__tests__/org-roles.test.ts› "spells external itself only while the pin predates objectstack#25515" went red as designed. Its message prescribes the swap, and this PR does exactly that:packages/auth/src/org-roles.tsre-exports the spec'sMEMBERSHIP_ROLE_EXTERNALasORG_ROLE_EXTERNALinstead of spelling the literal. The exported name and its value ('external') are unchanged, and its declared type is still the literal"external", so@object-ui/auth's public face does not move (Clause-② staysno).ORG_ROLE_LABELSis typedRecord<OrgRole, …>again, with the| typeof ORG_ROLE_EXTERNALunion dropped.@objectstack/specnamespace import.InviteMemberDialog.roleCap.test.tsxandorg-i18n-holdouts-4474.test.tsxnow expectexternalin the invite dialog's role list. This is the spec's 18.1.0 vocabulary reachingORG_ROLES, which objectui#13427's changeset already described: "Wherever the installed spec lists the role, the invite dialog offers it to every issuer who can invite". It is not a choice made by this card. The owner list gainsexternal, and a delegated admin or an unloaded membership is offered['member', 'external']. The delegate test's name now says "offered member and external only".2.
check:installed-pin-claims: 34 present-tense "installed 18.0.0" stampsThe gate is blocking through
scripts/__tests__/check-installed-spec-pin-claims.test.ts. The packed manifests now say 18.1.0, so it flagged 34 lines in 24 files, all comments or test description strings. No code changes.Every stamp was re-measured before it moved. The method:
git diff --name-only 915e9404 e649c2d91e -- packages/spec/src, touches onlyautomation/flow.zod.ts(therunAsdescription text and a comment),data/object.zod.ts(the newmembershipKeyskey and its extension refusal),identity/*(theexternalrole),kernel/execution-context.zod.tsandsecurity/explain.zod.ts(descriptions and comments),security/rls.zod.ts(MembershipKeysSchema),stack.zod.ts(the duplicate membership-key refusal),index.ts(two new exports) and one semantic migration entry, plus tests.ui/*rows (ViewDataSchema,ComponentPropsMap['object-calendar']and['object-kanban'], list-view conditional formatting and card style rules, the chart and dashboardariatombstones, record components, form section groups, master-detail details, the ganttnavigationtombstone),FieldSchemaandSelectOptionSchema, and flow node config (waitForInput, the single-brace mark, the canvas-seed save errors). The two claims about non-spec sources were checked at their own source:packages/lint/src/validate-expressions.ts(thecurrent_userCEL messagecelAuthoring.tsquotes) has an empty diff between the pins, and the trigger packages changed onlyCHANGELOG.mdandpackage.json.Each stamp moves
18.0.0to18.1.0. A stamp that carries its re-measure list (objectui#12030, … objectui#13261) gainsobjectui#13440, the same form objectui#13261 used. After the restamp the gate answers34 at the pinandOK.3.
e2e/live/ci/backend.envscripts/__tests__/ci-cd-pipeline-doc.test.ts› "pins OBJECTSTACK_VERSION to the version the lockfile resolves" went red.OBJECTSTACK_VERSIONmoves18.0.0to18.1.0. Its@objectstack/cli@18.1.0tag peels to this pin's commit, so the live lane's backend and the console's pin are the same release.4. The
ObjectSchemakey-count guards inapp-shellMetadataService.retiredObjectEnabled.test.ts(line 157) andMetadataService.specKeyObjectPayload.test.ts(line 171) count the keysObjectSchemaaccepts, and both went red withexpected 47 to be 46. Spec 18.1.0 adds one key,membershipKeys(objectstack-ai/objectstack#25513). Measured, not assumed: the spec's ownauthorable-surface/data.jsongains exactlydata/Object:membershipKeysbetween915e9404ande649c2d91e, and loses nothing. Both guards now expect 47, and each carries a comment with that basis, in the same form as the earlier re-point (objectui#12971). The two files pass, 25 tests.Changeset
.changeset/13440-objectstack-pin-e649c2d.mddeclares'@object-ui/auth': patch. The published module now importsMEMBERSHIP_ROLE_EXTERNALfrom@objectstack/spec, so it needs a spec that exports it (18.1.0 or later).node scripts/objectstack-floor.mjs --dry-runexits 0 and moves 37 ranges to^18.1.0at publish, so the published ranges will require that version.check-changeset-presence.mjsandcheck-changeset-no-major.mjspass.Acceptance notes
The restamped comments in published packages (
types,core,plugin-calendar,plugin-designer,plugin-detail,plugin-kanban,app-shell) change no behaviour, so the changeset names@object-ui/authonly.After merge the seat reads FlowRunner: a
FLOW_FAILEDenvelope is rendered by the record-save rule — the author'serrorMessage, thenuserMessage, then the declared inner refusal, thenmessage(the console half of objectstack#24914 ruling B′) #13285 and fields: userCell gates by the authoredreferenceof a user field, but objectstack now resolves every user field to sys_user (objectstack#24952) #13305 against the new pin, as the card says.Adds no product-specific widget, dialog, hook or string (see AGENTS.md › Product-neutral renderer)
Session:
https://claude.ai/code/session_01CErMSwkRLW7c7jk23MHfVP🤖 Generated with Claude Code
https://claude.ai/code/session_01CErMSwkRLW7c7jk23MHfVP