This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated.

Releases

@objectstack/cli@16.1.0

Minor Changes

• 9e45b63: feat(cli): preflight that every requires capability has an installable provider
  in the current edition (Preflight that required capabilities have an installable provider in the current edition #3366)

  A capability listed in requires: [...] was only checked at serve/start time,
  and a missing provider produced a generic "not installed — add it to your
  dependencies" error even when the provider has no installable version in the
  current edition. os validate (token-vocabulary only) and os build (never
  resolved providers) both passed, so a validate && build && test CI script never
  caught it — it surfaced only as an opaque boot crash. Seen upgrading an
  open-edition app from 14.7 to 16 after @objectstack/service-ai went
  cloud-only (ADR-0025).

  • @objectstack/spec/kernel now exports PLATFORM_CAPABILITY_PROVIDERS
    (token → provider package + edition) and a pure classifyRequiredCapability() —
    one machine-readable source of truth for the provider/edition knowledge the
    serve resolver previously encoded informally.
  • os build and os validate gained a provider preflight. A requires entry
    whose provider has no installable version in the active edition (e.g. ai →
    @objectstack/service-ai, cloud-only) now fails fast with an edition-aware
    message; an absent-but-installable provider is an advisory pnpm add hint, not
    a hard error; a satisfied requires list passes unchanged.
  • The os serve boot error now renders the same classification, so preflight and
    boot read identically.

• db160dd: Flag dead action/route references in dashboard header & widget actions (ADR-0049 for references, Flag dead action/route references in dashboard header actions (ADR-0049 for references) #3367).

  os validate / os build now run a new validateDashboardActionRefs gate over every dashboard header.actions[] and widget actionUrl:

  • actionType: 'script' | 'modal' — error unless actionUrl resolves to a defined action (stack.actions or an object's actions). modal also resolves via the runtime <verb>_<object> convention (create_/new_/add_/edit_/update_ + a real object) and bare object names. A dangling target ships a button that renders and silently does nothing on click — a false affordance, exactly the "declared ≠ enforced" gap ADR-0049 closes, applied to references.
  • actionType: 'url' — warning when a relative in-app path names a objects/reports/dashboards/pages/views route whose target does not exist in the stack. External URLs, interpolated (${…}) targets, and opaque routes are skipped to keep false positives near zero.

Patch Changes

• Updated dependencies [212b66a]
• Updated dependencies [d10c4dc]
• Updated dependencies [9e45b63]
• Updated dependencies [7b07417]
• Updated dependencies [fa006fb]
• Updated dependencies [db160dd]
• Updated dependencies [b20201f]
• Updated dependencies [818e6a3]
  • @objectstack/platform-objects@16.1.0
  • @objectstack/spec@16.1.0
  • @objectstack/console@16.1.0
  • @objectstack/lint@16.1.0
  • @objectstack/core@16.1.0
  • @objectstack/service-automation@16.1.0
  • @objectstack/trigger-record-change@16.1.0
  • @objectstack/observability@16.1.0
  • @objectstack/rest@16.1.0
  • @objectstack/plugin-hono-server@16.1.0
  • @objectstack/runtime@16.1.0
  • @objectstack/account@16.1.0
  • @objectstack/setup@16.1.0
  • @objectstack/metadata@16.1.0
  • @objectstack/plugin-approvals@16.1.0
  • @objectstack/plugin-audit@16.1.0
  • @objectstack/plugin-auth@16.1.0
  • @objectstack/plugin-email@16.1.0
  • @objectstack/plugin-reports@16.1.0
  • @objectstack/plugin-security@16.1.0
  • @objectstack/plugin-sharing@16.1.0
  • @objectstack/service-job@16.1.0
  • @objectstack/service-queue@16.1.0
  • @objectstack/service-realtime@16.1.0
  • @objectstack/service-settings@16.1.0
  • @objectstack/service-storage@16.1.0
  • @objectstack/client@16.1.0
  • @objectstack/cloud-connection@16.1.0
  • @objectstack/formula@16.1.0
  • @objectstack/mcp@16.1.0
  • @objectstack/objectql@16.1.0
  • @objectstack/driver-memory@16.1.0
  • @objectstack/driver-mongodb@16.1.0
  • @objectstack/driver-sql@16.1.0
  • @objectstack/driver-sqlite-wasm@16.1.0
  • @objectstack/plugin-webhooks@16.1.0
  • @objectstack/service-analytics@16.1.0
  • @objectstack/service-cache@16.1.0
  • @objectstack/service-datasource@16.1.0
  • @objectstack/service-messaging@16.1.0
  • @objectstack/service-package@16.1.0
  • @objectstack/service-sms@16.1.0
  • @objectstack/trigger-api@16.1.0
  • @objectstack/trigger-schedule@16.1.0
  • @objectstack/types@16.1.0
  • @objectstack/verify@16.1.0
  • @objectstack/plugin-pinyin-search@16.1.0

@objectstack/console@16.1.0

Minor Changes

• 7b07417: Console (objectui) refreshed to cf2d56e32a11. Frontend changes in this range:

  • fix(list): keep injected owner_id out of auto-generated list columns ([downstream/hotcrm] Migrate approval approvers from { type: 'role' } to { type: 'position' } (ADR-0090 D3) #2777) ([lint] Escalate approval-role-not-membership-tier from warning to error once downstream migration completes #2779)
  • feat(search): surface record hits on the full search page + i18n group labels (Permission Model v2 — named follow-up ADRs (post-ADR-0090 parking lot) #2776)
  • fix(i18n): apply globalActions label overlays on record-detail action bars (feat(ui): position assignment panels as pure SDUI — Positions tab on sys_user, Holders/Permission Sets tabs on sys_position #2770)
  • fix(command-palette): surface record search hits from /api/v1/search (Console command palette (⌘K) doesn't surface record search hits though /api/v1/search returns them #3371) (fix(spec): sync PROTOCOL_VERSION to 14.0.0 after the major release — main is red without it #2772)
  • fix(SchemaForm): render sort repeater rows for union schemas (objectstack#3379) (feat(auth): 管理员直建用户 + 手机号登录 + sys_user 批量导入（#2766 V1/V1.5/V2） #2771)

  objectui range: 9a5f016f7d5c...cf2d56e32a11

@objectstack/core@16.1.0

Minor Changes

• b20201f: fix(service-automation): runAs:'user' runs data ops with the triggering user's
  real permission sets + positions, not a bare member fallback (service-automation: runAs:'user' runs data ops with a credential-less user — trigger context never carries the actor's permission sets/positions (follow-up to #1888) #3356, follow-up to
  [P0][security] Flow runAs never switches execution identity #1888)

  Since [P0][security] Flow runAs never switches execution identity #1888 the automation engine honours flow.runAs (system elevates), but
  the runAs:'user' credential propagation was hollow. A record-change-triggered
  runAs:'user' flow ran its data nodes (update_record, …) with a zero-grant
  principal — only the member/everyone baseline — even when the triggering user
  was fully authorized. Two faces by object config: a private object 403'd the
  in-flow write (not permitted for positions [org_member, everyone] — the user's
  permission sets were invisible); a public_read_write object let the write
  through but silently stripped readonly/FLS-gated fields. The root cause: the
  ObjectQL record-change hook session carries only a userId — never the writer's
  positions/permission sets — and nothing in between resolved them, so the comment
  promising "enforces RLS exactly as the user who made the change" never held.

  The fix resolves the triggering user's actual authorization at run setup, from
  the same tables a direct REST request resolves through:

  • @objectstack/core factors the userId-driven core of resolveAuthzContext
    into a new exported resolveUserAuthzGrants(ql, userId, opts) — the single place
    that reads sys_member / sys_user_position / sys_*_permission_set and
    derives positions, permission-set names, platform_admin, and posture. The
    HTTP resolver now delegates to it (behaviour byte-identical; the full contract
    suite still passes), so a non-HTTP surface that already knows the user id builds
    the SAME envelope instead of re-implementing the reads.
  • @objectstack/service-automation gains AutomationEngine.setUserGrantsResolver,
    wired by the plugin to resolveUserAuthzGrants over the objectql/data engine.
    For a runAs:'user' run whose trigger left the authz envelope unresolved (no
    permissions), the engine now resolves the user's positions + permission sets
    once at run setup and threads them into every data node's ObjectQL context —
    so the run enforces RLS/FLS exactly as that user. Contexts that already carry
    permissions are left untouched (a REST trigger, and notably an ADR-0090 agent
    ceiling acting on-behalf-of a user — always non-empty — so a deliberately
    narrowed identity is never re-broadened). runAs:'system' is unchanged, and a
    resolver error fails safe (warns, keeps the bare user — never elevates).
  • @objectstack/trigger-record-change stops forwarding the misleading
    half-populated positions (empty in practice, and never permissions) from the
    hook session; it forwards userId + tenant only and lets the engine resolve the
    full grants authoritatively.

  When no ObjectQL engine is present (bare engine / tests) the resolver is unwired
  and run identity is unchanged from before.

Patch Changes

• Updated dependencies [9e45b63]
  • @objectstack/spec@16.1.0

@objectstack/lint@16.1.0

Minor Changes

• fa006fb: Validate dashboard filter field-existence at build time (extend ADR-0021, Validate dashboard filter field-existence at build time (extend ADR-0021) #3365).

  validateWidgetBindings now checks that every dashboard-level filter (dateRange

  • each globalFilters[]) resolves to a real field on each bound widget's dataset
    object. Since Dashboard-level filters (date / region) driving multiple charts #2501 wired these filters into every widget's analytics query, a
    filter field absent on a widget's object — e.g. a dateRange bound to
    close_date inherited by an account/contact widget over a different object —
    emitted invalid SQL (no such column: close_date) and crashed the widget at
    render time. That build-decidable invariant previously escaped os validate /
    os build and failed only when a user opened the dashboard.

  It now fails the build (new rule dashboard-filter-field-unknown) with a message
  naming the dashboard, widget, filter, field, and object, unless the widget opts
  out via filterBindings: { <name>: false } or re-targets to an existing field —
  mirroring the field-existence invariant ADR-0032 enforces for CEL references.
  Effective-field resolution matches the runtime (filterBindings re-target /
  opt-out, legacy targetWidgets allow-list, filter default). Registry-injected
  system fields (e.g. created_at, the dateRange default) and objects outside
  the validated stack never false-positive.

• db160dd: Flag dead action/route references in dashboard header & widget actions (ADR-0049 for references, Flag dead action/route references in dashboard header actions (ADR-0049 for references) #3367).

  os validate / os build now run a new validateDashboardActionRefs gate over every dashboard header.actions[] and widget actionUrl:

  • actionType: 'script' | 'modal' — error unless actionUrl resolves to a defined action (stack.actions or an object's actions). modal also resolves via the runtime <verb>_<object> convention (create_/new_/add_/edit_/update_ + a real object) and bare object names. A dangling target ships a button that renders and silently does nothing on click — a false affordance, exactly the "declared ≠ enforced" gap ADR-0049 closes, applied to references.
  • actionType: 'url' — warning when a relative in-app path names a objects/reports/dashboards/pages/views route whose target does not exist in the stack. External URLs, interpolated (${…}) targets, and opaque routes are skipped to keep false positives near zero.

Patch Changes

• Updated dependencies [9e45b63]
  • @objectstack/spec@16.1.0
  • @objectstack/formula@16.1.0
  • @objectstack/sdui-parser@16.1.0

@objectstack/service-automation@16.1.0

Minor Changes

• b20201f: fix(service-automation): runAs:'user' runs data ops with the triggering user's
  real permission sets + positions, not a bare member fallback (service-automation: runAs:'user' runs data ops with a credential-less user — trigger context never carries the actor's permission sets/positions (follow-up to #1888) #3356, follow-up to
  [P0][security] Flow runAs never switches execution identity #1888)

  Since [P0][security] Flow runAs never switches execution identity #1888 the automation engine honours flow.runAs (system elevates), but
  the runAs:'user' credential propagation was hollow. A record-change-triggered
  runAs:'user' flow ran its data nodes (update_record, …) with a zero-grant
  principal — only the member/everyone baseline — even when the triggering user
  was fully authorized. Two faces by object config: a private object 403'd the
  in-flow write (not permitted for positions [org_member, everyone] — the user's
  permission sets were invisible); a public_read_write object let the write
  through but silently stripped readonly/FLS-gated fields. The root cause: the
  ObjectQL record-change hook session carries only a userId — never the writer's
  positions/permission sets — and nothing in between resolved them, so the comment
  promising "enforces RLS exactly as the user who made the change" never held.

  The fix resolves the triggering user's actual authorization at run setup, from
  the same tables a direct REST request resolves through:

  • @objectstack/core factors the userId-driven core of resolveAuthzContext
    into a new exported resolveUserAuthzGrants(ql, userId, opts) — the single place
    that reads sys_member / sys_user_position / sys_*_permission_set and
    derives positions, permission-set names, platform_admin, and posture. The
    HTTP resolver now delegates to it (behaviour byte-identical; the full contract
    suite still passes), so a non-HTTP surface that already knows the user id builds
    the SAME envelope instead of re-implementing the reads.
  • @objectstack/service-automation gains AutomationEngine.setUserGrantsResolver,
    wired by the plugin to resolveUserAuthzGrants over the objectql/data engine.
    For a runAs:'user' run whose trigger left the authz envelope unresolved (no
    permissions), the engine now resolves the user's positions + permission sets
    once at run setup and threads them into every data node's ObjectQL context —
    so the run enforces RLS/FLS exactly as that user. Contexts that already carry
    permissions are left untouched (a REST trigger, and notably an ADR-0090 agent
    ceiling acting on-behalf-of a user — always non-empty — so a deliberately
    narrowed identity is never re-broadened). runAs:'system' is unchanged, and a
    resolver error fails safe (warns, keeps the bare user — never elevates).
  • @objectstack/trigger-record-change stops forwarding the misleading
    half-populated positions (empty in practice, and never permissions) from the
    hook session; it forwards userId + tenant only and lets the engine resolve the
    full grants authoritatively.

  When no ObjectQL engine is present (bare engine / tests) the resolver is unwired
  and run identity is unchanged from before.

Patch Changes

• Updated dependencies [9e45b63]
• Updated dependencies [b20201f]
  • @objectstack/spec@16.1.0
  • @objectstack/core@16.1.0
  • @objectstack/formula@16.1.0

@objectstack/spec@16.1.0

Minor Changes

• 9e45b63: feat(cli): preflight that every requires capability has an installable provider
  in the current edition (Preflight that required capabilities have an installable provider in the current edition #3366)

  A capability listed in requires: [...] was only checked at serve/start time,
  and a missing provider produced a generic "not installed — add it to your
  dependencies" error even when the provider has no installable version in the
  current edition. os validate (token-vocabulary only) and os build (never
  resolved providers) both passed, so a validate && build && test CI script never
  caught it — it surfaced only as an opaque boot crash. Seen upgrading an
  open-edition app from 14.7 to 16 after @objectstack/service-ai went
  cloud-only (ADR-0025).

  • @objectstack/spec/kernel now exports PLATFORM_CAPABILITY_PROVIDERS
    (token → provider package + edition) and a pure classifyRequiredCapability() —
    one machine-readable source of truth for the provider/edition knowledge the
    serve resolver previously encoded informally.
  • os build and os validate gained a provider preflight. A requires entry
    whose provider has no installable version in the active edition (e.g. ai →
    @objectstack/service-ai, cloud-only) now fails fast with an edition-aware
    message; an absent-but-installable provider is an advisory pnpm add hint, not
    a hard error; a satisfied requires list passes unchanged.
  • The os serve boot error now renders the same classification, so preflight and
    boot read identically.

@objectstack/hono@16.1.0

Patch Changes

• Updated dependencies [818e6a3]
  • @objectstack/plugin-hono-server@16.1.0
  • @objectstack/runtime@16.1.0
  • @objectstack/types@16.1.0

@objectstack/account@16.1.0

Patch Changes

• Updated dependencies [212b66a]
• Updated dependencies [d10c4dc]
• Updated dependencies [9e45b63]
  • @objectstack/platform-objects@16.1.0
  • @objectstack/spec@16.1.0

@objectstack/setup@16.1.0

Patch Changes

• Updated dependencies [212b66a]
• Updated dependencies [d10c4dc]
• Updated dependencies [9e45b63]
  • @objectstack/platform-objects@16.1.0
  • @objectstack/spec@16.1.0

@objectstack/studio@16.1.0

Patch Changes

• Updated dependencies [212b66a]
• Updated dependencies [d10c4dc]
• Updated dependencies [9e45b63]
  • @objectstack/platform-objects@16.1.0
  • @objectstack/spec@16.1.0

@objectstack/client@16.1.0

Patch Changes

• Updated dependencies [9e45b63]
• Updated dependencies [b20201f]
  • @objectstack/spec@16.1.0
  • @objectstack/core@16.1.0

@objectstack/client-react@16.1.0

Patch Changes

• Updated dependencies [9e45b63]
• Updated dependencies [b20201f]
  • @objectstack/spec@16.1.0
  • @objectstack/core@16.1.0
  • @objectstack/client@16.1.0

@objectstack/cloud-connection@16.1.0

Patch Changes

• Updated dependencies [9e45b63]
• Updated dependencies [b20201f]
• Updated dependencies [818e6a3]
  • @objectstack/spec@16.1.0
  • @objectstack/core@16.1.0
  • @objectstack/runtime@16.1.0
  • @objectstack/types@16.1.0

@objectstack/connector-mcp@16.1.0

Patch Changes

• Updated dependencies [9e45b63]
• Updated dependencies [b20201f]
  • @objectstack/spec@16.1.0
  • @objectstack/core@16.1.0

@objectstack/connector-openapi@16.1.0

Patch Changes

• Updated dependencies [9e45b63]
• Updated dependencies [b20201f]
  • @objectstack/spec@16.1.0
  • @objectstack/core@16.1.0

@objectstack/connector-rest@16.1.0

Patch Changes

• Updated dependencies [9e45b63]
• Updated dependencies [b20201f]
  • @objectstack/spec@16.1.0
  • @objectstack/core@16.1.0

@objectstack/connector-slack@16.1.0

Patch Changes

• Updated dependencies [9e45b63]
• Updated dependencies [b20201f]
  • @objectstack/spec@16.1.0
  • @objectstack/core@16.1.0

@objectstack/formula@16.1.0

Patch Changes

• Updated dependencies [9e45b63]
  • @objectstack/spec@16.1.0

@objectstack/mcp@16.1.0

Patch Changes

• Updated dependencies [9e45b63]
• Updated dependencies [b20201f]
  • @objectstack/spec@16.1.0
  • @objectstack/core@16.1.0
  • @objectstack/formula@16.1.0
  • @objectstack/types@16.1.0

@objectstack/metadata@16.1.0

Patch Changes

• Updated dependencies [212b66a]
• Updated dependencies [d10c4dc]
• Updated dependencies [9e45b63]
• Updated dependencies [b20201f]
  • @objectstack/platform-objects@16.1.0
  • @objectstack/spec@16.1.0
  • @objectstack/core@16.1.0
  • @objectstack/metadata-core@16.1.0
  • @objectstack/types@16.1.0
  • @objectstack/metadata-fs@16.1.0

@objectstack/metadata-core@16.1.0

Patch Changes

• Updated dependencies [9e45b63]
  • @objectstack/spec@16.1.0

@objectstack/metadata-fs@16.1.0

Patch Changes

• @objectstack/metadata-core@16.1.0

@objectstack/metadata-protocol@16.1.0

Patch Changes

• Updated dependencies [9e45b63]
• Updated dependencies [b20201f]
  • @objectstack/spec@16.1.0
  • @objectstack/core@16.1.0
  • @objectstack/formula@16.1.0
  • @objectstack/metadata-core@16.1.0
  • @objectstack/types@16.1.0

@objectstack/objectql@16.1.0

Patch Changes

• Updated dependencies [9e45b63]
• Updated dependencies [b20201f]
  • @objectstack/spec@16.1.0
  • @objectstack/core@16.1.0
  • @objectstack/formula@16.1.0
  • @objectstack/metadata-core@16.1.0
  • @objectstack/metadata-protocol@16.1.0
  • @objectstack/types@16.1.0

@objectstack/observability@16.1.0

Patch Changes

• 818e6a3: fix(server-timing): emit the per-request, admin-gated Server-Timing header on the standard server (os serve/dev) (v16.0: per-request admin-gated Server-Timing never emits on the hono server (os serve/dev) #3361)

  The per-request Server-Timing path (feat(observability): per-request performance timing → Server-Timing (perf-tuning mode) #2408) — where an admin sends
  X-OS-Debug-Timing: 1 (or json) and gets phase timings while an ordinary user
  gets nothing — never emitted on the shipped Hono server. The disclosure gate the
  Hono middleware opens is only ever flipped by the runtime dispatcher's
  timedResolveExecutionContext, but the data (/api/v1/data/*) and metadata
  (/api/v1/meta/*) routes on os serve/dev are served by @objectstack/rest's
  RestServer (which shadows the Hono plugin's own CRUD), and its identity
  resolver never opened the gate. Only global mode (OS_SERVER_TIMING=true) — which
  discloses to every caller, not just admins — worked.

  • observability: the disclosure predicate isPerfDisclosurePrincipal(ec) now
    lives here (the home of the gate), the single definition of "who may pull
    per-request timings" shared by every HTTP entry point. @objectstack/runtime
    re-exports it for back-compat.
  • rest: RestServer.resolveExecCtx opens the gate for an admin/service
    principal (via the carried posture rung), the REST-server analog of the
    dispatcher — this is the fix that makes os serve/dev emit.
  • plugin-hono-server: the standalone CRUD surface's self-contained
    resolveCtx opens the gate too (deriving the rung for the gate decision only,
    never writing it onto the enforcement context). Adds an e2e test that boots the
    Hono app and asserts an admin gets Server-Timing while a member/anon does not.

• Updated dependencies [9e45b63]

  • @objectstack/spec@16.1.0

@objectstack/platform-objects@16.1.0

Patch Changes

• 212b66a: fix(platform-objects): allow import/export on sys_business_unit (业务单元需要支持导入:列表页导入按钮 405(apiMethods 白名单缺 import/export) #3025)

  The Business Units list (Setup → Business Units) surfaces Import/Export buttons,
  but sys_business_unit declared a restrictive enable.apiMethods whitelist of
  only the five CRUD verbs. The REST data plane gates import/export on that
  whitelist (ADR-0049), so both buttons returned 405 OBJECT_API_METHOD_NOT_ALLOWED.

  This was an unintentional gap, not a deliberate restriction: the object's fields
  (external_ref, effective_from/to) are designed for HRIS batch sync, and the
  org tree is expected to support bulk import. Added 'import' and 'export' to
  the whitelist. Import reuses the create/update affordances the object already
  grants, and the managed-object reconciliation backstop leaves import/export
  untouched (it only strips write verbs). Regression test added.

• d10c4dc: fix(platform-objects): allow import/export on sys_business_unit_member (业务单元需要支持导入:列表页导入按钮 405(apiMethods 白名单缺 import/export) #3025 / 跟踪:UI 操作按钮与 apiMethods 白名单一致性契约落地(#3026 设计定稿) #3391 P0)

  Completes the 业务单元需要支持导入:列表页导入按钮 405(apiMethods 白名单缺 import/export) #3025 point-fix. fix(platform-objects): allow import/export on sys_business_unit (#3025) #3392 unblocked sys_business_unit's Import/Export
  buttons (405 OBJECT_API_METHOD_NOT_ALLOWED) by adding 'import'/'export' to its
  enable.apiMethods whitelist, but the HRIS org-tree sync scenario imports two
  tables together — the units and their memberships — and the sibling
  sys_business_unit_member was left on the CRUD-only whitelist, so the membership
  Import/Export path still 405'd. 跟踪:UI 操作按钮与 apiMethods 白名单一致性契约落地(#3026 设计定稿) #3391's P0 checklist pairs both tables; this is the
  half fix(platform-objects): allow import/export on sys_business_unit (#3025) #3392 missed.

  • packages/platform-objects/src/identity/sys-business-unit-member.object.ts:
    apiMethods gains 'import', 'export'. Import reuses the object's
    already-granted create/update affordances; export is a bulk read.
  • Reconcile-safe: the object is managedBy:'platform', but
    reconcileManagedApiMethods only strips generic write verbs
    (create/update/upsert/delete/purge — MANAGED_WRITE_VERB_AFFORDANCE). It never
    touches import/export, so the declared whitelist reaches the REST gate intact
    (no false-green: the static whitelist the regression test asserts IS what
    apiAccessDenialFromEnable enforces at runtime).
  • Regression test (platform-objects.test.ts) locks import/export presence and
    CRUD retention. Proven red-before-green: reverting the object edit fails with
    expected [...] to include 'import'.

  Transitional: 跟踪:UI 操作按钮与 apiMethods 白名单一致性契约落地(#3026 设计定稿) #3391 P2 replaces per-object import/export declarations with a
  single derived mapping (import ⊆ create/update, export ⊆ list) and reclaims the
  explicit entries on both business-unit objects together.

  Refs 业务单元需要支持导入:列表页导入按钮 405(apiMethods 白名单缺 import/export) #3025, 跟踪:UI 操作按钮与 apiMethods 白名单一致性契约落地(#3026 设计定稿) #3391.

• Updated dependencies [9e45b63]

  • @objectstack/spec@16.1.0
  • @objectstack/metadata-core@16.1.0

@objectstack/driver-memory@16.1.0

Patch Changes

• Updated dependencies [9e45b63]
• Updated dependencies [b20201f]
  • @objectstack/spec@16.1.0
  • @objectstack/core@16.1.0

@objectstack/driver-mongodb@16.1.0

Patch Changes

• Updated dependencies [9e45b63]
• Updated dependencies [b20201f]
  • @objectstack/spec@16.1.0
  • @objectstack/core@16.1.0

@objectstack/driver-sql@16.1.0

Patch Changes

• Updated dependencies [9e45b63]
• Updated dependencies [b20201f]
• Updated dependencies [818e6a3]
  • @objectstack/spec@16.1.0
  • @objectstack/core@16.1.0
  • @objectstack/observability@16.1.0
  • @objectstack/types@16.1.0

@objectstack/driver-sqlite-wasm@16.1.0

Patch Changes

• Updated dependencies [9e45b63]
• Updated dependencies [b20201f]
  • @objectstack/spec@16.1.0
  • @objectstack/core@16.1.0
  • @objectstack/driver-sql@16.1.0

@objectstack/embedder-openai@16.1.0

Patch Changes

• Updated dependencies [9e45b63]
  • @objectstack/spec@16.1.0

@objectstack/knowledge-memory@16.1.0

Patch Changes

• Updated dependencies [9e45b63]
• Updated dependencies [b20201f]
  • @objectstack/spec@16.1.0
  • @objectstack/core@16.1.0
  • @objectstack/service-knowledge@16.1.0

@objectstack/knowledge-ragflow@16.1.0

Patch Changes

• Updated dependencies [9e45b63]
• Updated dependencies [b20201f]
  • @objectstack/spec@16.1.0
  • @objectstack/core@16.1.0
  • @objectstack/service-knowledge@16.1.0

@objectstack/plugin-approvals@16.1.0

Patch Changes

• Updated dependencies [212b66a]
• Updated dependencies [d10c4dc]
• Updated dependencies [9e45b63]
• Updated dependencies [b20201f]
  • @objectstack/platform-objects@16.1.0
  • @objectstack/spec@16.1.0
  • @objectstack/core@16.1.0
  • @objectstack/formula@16.1.0
  • @objectstack/metadata-core@16.1.0

@objectstack/plugin-audit@16.1.0

Patch Changes

• Updated dependencies [212b66a]
• Updated dependencies [d10c4dc]
• Updated dependencies [9e45b63]
• Updated dependencies [b20201f]
  • @objectstack/platform-objects@16.1.0
  • @objectstack/spec@16.1.0
  • @objectstack/core@16.1.0

@objectstack/plugin-auth@16.1.0

Patch Changes

• Updated dependencies [212b66a]
• Updated dependencies [d10c4dc]
• Updated dependencies [9e45b63]
• Updated dependencies [b20201f]
• Updated dependencies [818e6a3]
  • @objectstack/platform-objects@16.1.0
  • @objectstack/spec@16.1.0
  • @objectstack/core@16.1.0
  • @objectstack/rest@16.1.0
  • @objectstack/types@16.1.0

@objectstack/plugin-dev@16.1.0

Patch Changes

• Updated dependencies [9e45b63]
• Updated dependencies [b20201f]
• Updated dependencies [818e6a3]
  • @objectstack/spec@16.1.0
  • @objectstack/core@16.1.0
  • @objectstack/rest@16.1.0
  • @objectstack/plugin-hono-server@16.1.0
  • @objectstack/runtime@16.1.0
  • @objectstack/account@16.1.0
  • @objectstack/setup@16.1.0
  • @objectstack/plugin-auth@16.1.0
  • @objectstack/plugin-security@16.1.0
  • @objectstack/objectql@16.1.0
  • @objectstack/driver-memory@16.1.0
  • @objectstack/service-i18n@16.1.0
  • @objectstack/types@16.1.0

@objectstack/plugin-email@16.1.0

Patch Changes

• Updated dependencies [212b66a]
• Updated dependencies [d10c4dc]
• Updated dependencies [9e45b63]
• Updated dependencies [b20201f]
  • @objectstack/platform-objects@16.1.0
  • @objectstack/spec@16.1.0
  • @objectstack/core@16.1.0
  • @objectstack/formula@16.1.0

@objectstack/plugin-hono-server@16.1.0

Patch Changes

• 818e6a3: fix(server-timing): emit the per-request, admin-gated Server-Timing header on the standard server (os serve/dev) (v16.0: per-request admin-gated Server-Timing never emits on the hono server (os serve/dev) #3361)

  The per-request Server-Timing path (feat(observability): per-request performance timing → Server-Timing (perf-tuning mode) #2408) — where an admin sends
  X-OS-Debug-Timing: 1 (or json) and gets phase timings while an ordinary user
  gets nothing — never emitted on the shipped Hono server. The disclosure gate the
  Hono middleware opens is only ever flipped by the runtime dispatcher's
  timedResolveExecutionContext, but the data (/api/v1/data/*) and metadata
  (/api/v1/meta/*) routes on os serve/dev are served by @objectstack/rest's
  RestServer (which shadows the Hono plugin's own CRUD), and its identity
  resolver never opened the gate. Only global mode (OS_SERVER_TIMING=true) — which
  discloses to every caller, not just admins — worked.

  • observability: the disclosure predicate isPerfDisclosurePrincipal(ec) now
    lives here (the home of the gate), the single definition of "who may pull
    per-request timings" shared by every HTTP entry point. @objectstack/runtime
    re-exports it for back-compat.
  • rest: RestServer.resolveExecCtx opens the gate for an admin/service
    principal (via the carried posture rung), the REST-server analog of the
    dispatcher — this is the fix that makes os serve/dev emit.
  • plugin-hono-server: the standalone CRUD surface's self-contained
    resolveCtx opens the gate too (deriving the rung for the gate decision only,
    never writing it onto the enforcement context). Adds an e2e test that boots the
    Hono app and asserts an admin gets Server-Timing while a member/anon does not.

• Updated dependencies [9e45b63]

• Updated dependencies [b20201f]

• Updated dependencies [818e6a3]

  • @objectstack/spec@16.1.0
  • @objectstack/core@16.1.0
  • @objectstack/observability@16.1.0
  • @objectstack/types@16.1.0

@objectstack/plugin-pinyin-search@16.1.0

Patch Changes

• Updated dependencies [b20201f]
  • @objectstack/core@16.1.0
  • @objectstack/objectql@16.1.0
  • @objectstack/types@16.1.0

@objectstack/plugin-reports@16.1.0

Patch Changes

• Updated dependencies [212b66a]
• Updated dependencies [d10c4dc]
• Updated dependencies [9e45b63]
• Updated dependencies [b20201f]
  • @objectstack/platform-objects@16.1.0
  • @objectstack/spec@16.1.0
  • @objectstack/core@16.1.0

@objectstack/plugin-security@16.1.0

Patch Changes

• Updated dependencies [212b66a]
• Updated dependencies [d10c4dc]
• Updated dependencies [9e45b63]
• Updated dependencies [b20201f]
  • @objectstack/platform-objects@16.1.0
  • @objectstack/spec@16.1.0
  • @objectstack/core@16.1.0
  • @objectstack/formula@16.1.0

@objectstack/plugin-sharing@16.1.0

Patch Changes

• Updated dependencies [212b66a]
• Updated dependencies [d10c4dc]
• Updated dependencies [9e45b63]
• Updated dependencies [b20201f]
  • @objectstack/platform-objects@16.1.0
  • @objectstack/spec@16.1.0
  • @objectstack/core@16.1.0
  • @objectstack/formula@16.1.0
  • @objectstack/objectql@16.1.0

@objectstack/plugin-webhooks@16.1.0

Patch Changes

• Updated dependencies [9e45b63]
• Updated dependencies [b20201f]
  • @objectstack/spec@16.1.0
  • @objectstack/core@16.1.0
  • @objectstack/service-messaging@16.1.0

@objectstack/rest@16.1.0

Patch Changes

• 818e6a3: fix(server-timing): emit the per-request, admin-gated Server-Timing header on the standard server (os serve/dev) (v16.0: per-request admin-gated Server-Timing never emits on the hono server (os serve/dev) #3361)

  The per-request Server-Timing path (feat(observability): per-request performance timing → Server-Timing (perf-tuning mode) #2408) — where an admin sends
  X-OS-Debug-Timing: 1 (or json) and gets phase timings while an ordinary user
  gets nothing — never emitted on the shipped Hono server. The disclosure gate the
  Hono middleware opens is only ever flipped by the runtime dispatcher's
  timedResolveExecutionContext, but the data (/api/v1/data/*) and metadata
  (/api/v1/meta/*) routes on os serve/dev are served by @objectstack/rest's
  RestServer (which shadows the Hono plugin's own CRUD), and its identity
  resolver never opened the gate. Only global mode (OS_SERVER_TIMING=true) — which
  discloses to every caller, not just admins — worked.

  • observability: the disclosure predicate isPerfDisclosurePrincipal(ec) now
    lives here (the home of the gate), the single definition of "who may pull
    per-request timings" shared by every HTTP entry point. @objectstack/runtime
    re-exports it for back-compat.
  • rest: RestServer.resolveExecCtx opens the gate for an admin/service
    principal (via the carried posture rung), the REST-server analog of the
    dispatcher — this is the fix that makes os serve/dev emit.
  • plugin-hono-server: the standalone CRUD surface's self-contained
    resolveCtx opens the gate too (deriving the rung for the gate decision only,
    never writing it onto the enforcement context). Adds an e2e test that boots the
    Hono app and asserts an admin gets Server-Timing while a member/anon does not.

• Updated dependencies [212b66a]

• Updated dependencies [d10c4dc]

• Updated dependencies [9e45b63]

• Updated dependencies [b20201f]

• Updated dependencies [818e6a3]

  • @objectstack/platform-objects@16.1.0
  • @objectstack/spec@16.1.0
  • @objectstack/core@16.1.0
  • @objectstack/observability@16.1.0
  • @objectstack/service-package@16.1.0
  • @objectstack/types@16.1.0

@objectstack/runtime@16.1.0

Patch Changes

• 818e6a3: fix(server-timing): emit the per-request, admin-gated Server-Timing header on the standard server (os serve/dev) (v16.0: per-request admin-gated Server-Timing never emits on the hono server (os serve/dev) #3361)

  The per-request Server-Timing path (feat(observability): per-request performance timing → Server-Timing (perf-tuning mode) #2408) — where an admin sends
  X-OS-Debug-Timing: 1 (or json) and gets phase timings while an ordinary user
  gets nothing — never emitted on the shipped Hono server. The disclosure gate the
  Hono middleware opens is only ever flipped by the runtime dispatcher's
  timedResolveExecutionContext, but the data (/api/v1/data/*) and metadata
  (/api/v1/meta/*) routes on os serve/dev are served by @objectstack/rest's
  RestServer (which shadows the Hono plugin's own CRUD), and its identity
  resolver never opened the gate. Only global mode (OS_SERVER_TIMING=true) — which
  discloses to every caller, not just admins — worked.

  • observability: the disclosure predicate isPerfDisclosurePrincipal(ec) now
    lives here (the home of the gate), the single definition of "who may pull
    per-request timings" shared by every HTTP entry point. @objectstack/runtime
    re-exports it for back-compat.
  • rest: RestServer.resolveExecCtx opens the gate for an admin/service
    principal (via the carried posture rung), the REST-server analog of the
    dispatcher — this is the fix that makes os serve/dev emit.
  • plugin-hono-server: the standalone CRUD surface's self-contained
    resolveCtx opens the gate too (deriving the rung for the gate decision only,
    never writing it onto the enforcement context). Adds an e2e test that boots the
    Hono app and asserts an admin gets Server-Timing while a member/anon does not.

• Updated dependencies [9e45b63]

• Updated dependencies [b20201f]

• Updated dependencies [818e6a3]

  • @objectstack/spec@16.1.0
  • @objectstack/core@16.1.0
  • @objectstack/observability@16.1.0
  • @objectstack/rest@16.1.0
  • @objectstack/metadata@16.1.0
  • @objectstack/plugin-auth@16.1.0
  • @objectstack/plugin-security@16.1.0
  • @objectstack/formula@16.1.0
  • @objectstack/metadata-core@16.1.0
  • @objectstack/objectql@16.1.0
  • @objectstack/driver-memory@16.1.0
  • @objectstack/driver-sql@16.1.0
  • @objectstack/driver-sqlite-wasm@16.1.0
  • @objectstack/service-cluster@16.1.0
  • @objectstack/service-datasource@16.1.0
  • @objectstack/service-i18n@16.1.0
  • @objectstack/types@16.1.0

@objectstack/service-analytics@16.1.0

Patch Changes

• Updated dependencies [9e45b63]
• Updated dependencies [b20201f]
  • @objectstack/spec@16.1.0
  • @objectstack/core@16.1.0

@objectstack/service-cache@16.1.0

Patch Changes

• Updated dependencies [9e45b63]
• Updated dependencies [b20201f]
• Updated dependencies [818e6a3]
  • @objectstack/spec@16.1.0
  • @objectstack/core@16.1.0
  • @objectstack/observability@16.1.0

@objectstack/service-cluster@16.1.0

Patch Changes

• Updated dependencies [9e45b63]
• Updated dependencies [b20201f]
  • @objectstack/spec@16.1.0
  • @objectstack/core@16.1.0

@objectstack/service-cluster-redis@16.1.0

Patch Changes

• Updated dependencies [9e45b63]
  • @objectstack/spec@16.1.0
  • @objectstack/service-cluster@16.1.0

@objectstack/service-datasource@16.1.0

Patch Changes

• Updated dependencies [9e45b63]
• Updated dependencies [b20201f]
  • @objectstack/spec@16.1.0
  • @objectstack/core@16.1.0

@objectstack/service-i18n@16.1.0

Patch Changes

• Updated dependencies [9e45b63]
• Updated dependencies [b20201f]
  • @objectstack/spec@16.1.0
  • @objectstack/core@16.1.0

@objectstack/service-job@16.1.0

Patch Changes

• Updated dependencies [212b66a]
• Updated dependencies [d10c4dc]
• Updated dependencies [9e45b63]
• Updated dependencies [b20201f]
  • @objectstack/platform-objects@16.1.0
  • @objectstack/spec@16.1.0
  • @objectstack/core@16.1.0

@objectstack/service-knowledge@16.1.0

Patch Changes

• Updated dependencies [9e45b63]
• Updated dependencies [b20201f]
  • @objectstack/spec@16.1.0
  • @objectstack/core@16.1.0

@objectstack/service-messaging@16.1.0

Patch Changes

• Updated dependencies [9e45b63]
• Updated dependencies [b20201f]
  • @objectstack/spec@16.1.0
  • @objectstack/core@16.1.0

@objectstack/service-package@16.1.0

Patch Changes

• Updated dependencies [9e45b63]
• Updated dependencies [b20201f]
  • @objectstack/spec@16.1.0
  • @objectstack/core@16.1.0
  • @objectstack/metadata-core@16.1.0

@objectstack/service-queue@16.1.0

Patch Changes

• Updated dependencies [212b66a]
• Updated dependencies [d10c4dc]
• Updated dependencies [9e45b63]
• Updated dependencies [b20201f]
  • @objectstack/platform-objects@16.1.0
  • @objectstack/spec@16.1.0
  • @objectstack/core@16.1.0

@objectstack/service-realtime@16.1.0

Patch Changes

• Updated dependencies [212b66a]
• Updated dependencies [d10c4dc]
• Updated dependencies [9e45b63]
• Updated dependencies [b20201f]
  • @objectstack/platform-objects@16.1.0
  • @objectstack/spec@16.1.0
  • @objectstack/core@16.1.0

@objectstack/service-settings@16.1.0

Patch Changes

• Updated dependencies [212b66a]
• Updated dependencies [d10c4dc]
• Updated dependencies [9e45b63]
• Updated dependencies [b20201f]
  • @objectstack/platform-objects@16.1.0
  • @objectstack/spec@16.1.0
  • @objectstack/core@16.1.0
  • @objectstack/types@16.1.0

@objectstack/service-sms@16.1.0

Patch Changes

• Updated dependencies [9e45b63]
• Updated dependencies [b20201f]
  • @objectstack/spec@16.1.0
  • @objectstack/core@16.1.0

@objectstack/service-storage@16.1.0

Patch Changes

• Updated dependencies [212b66a]
• Updated dependencies [d10c4dc]
• Updated dependencies [9e45b63]
• Updated dependencies [b20201f]
• Updated dependencies [818e6a3]
  • @objectstack/platform-objects@16.1.0
  • @objectstack/spec@16.1.0
  • @objectstack/core@16.1.0
  • @objectstack/observability@16.1.0

@objectstack/trigger-api@16.1.0

Patch Changes

• Updated dependencies [9e45b63]
• Updated dependencies [b20201f]
  • @objectstack/spec@16.1.0
  • @objectstack/core@16.1.0

@objectstack/trigger-record-change@16.1.0

Patch Changes

• b20201f: fix(service-automation): runAs:'user' runs data ops with the triggering user's
  real permission sets + positions, not a bare member fallback (service-automation: runAs:'user' runs data ops with a credential-less user — trigger context never carries the actor's permission sets/positions (follow-up to #1888) #3356, follow-up to
  [P0][security] Flow runAs never switches execution identity #1888)

  Since [P0][security] Flow runAs never switches execution identity #1888 the automation engine honours flow.runAs (system elevates), but
  the runAs:'user' credential propagation was hollow. A record-change-triggered
  runAs:'user' flow ran its data nodes (update_record, …) with a zero-grant
  principal — only the member/everyone baseline — even when the triggering user
  was fully authorized. Two faces by object config: a private object 403'd the
  in-flow write (not permitted for positions [org_member, everyone] — the user's
  permission sets were invisible); a public_read_write object let the write
  through but silently stripped readonly/FLS-gated fields. The root cause: the
  ObjectQL record-change hook session carries only a userId — never the writer's
  positions/permission sets — and nothing in between resolved them, so the comment
  promising "enforces RLS exactly as the user who made the change" never held.

  The fix resolves the triggering user's actual authorization at run setup, from
  the same tables a direct REST request resolves through:

  • @objectstack/core factors the userId-driven core of resolveAuthzContext
    into a new exported resolveUserAuthzGrants(ql, userId, opts) — the single place
    that reads sys_member / sys_user_position / sys_*_permission_set and
    derives positions, permission-set names, platform_admin, and posture. The
    HTTP resolver now delegates to it (behaviour byte-identical; the full contract
    suite still passes), so a non-HTTP surface that already knows the user id builds
    the SAME envelope instead of re-implementing the reads.
  • @objectstack/service-automation gains AutomationEngine.setUserGrantsResolver,
    wired by the plugin to resolveUserAuthzGrants over the objectql/data engine.
    For a runAs:'user' run whose trigger left the authz envelope unresolved (no
    permissions), the engine now resolves the user's positions + permission sets
    once at run setup and threads them into every data node's ObjectQL context —
    so the run enforces RLS/FLS exactly as that user. Contexts that already carry
    permissions are left untouched (a REST trigger, and notably an ADR-0090 agent
    ceiling acting on-behalf-of a user — always non-empty — so a deliberately
    narrowed identity is never re-broadened). runAs:'system' is unchanged, and a
    resolver error fails safe (warns, keeps the bare user — never elevates).
  • @objectstack/trigger-record-change stops forwarding the misleading
    half-populated positions (empty in practice, and never permissions) from the
    hook session; it forwards userId + tenant only and lets the engine resolve the
    full grants authoritatively.

  When no ObjectQL engine is present (bare engine / tests) the resolver is unwired
  and run identity is unchanged from before.

• Updated dependencies [9e45b63]

• Updated dependencies [b20201f]

  • @objectstack/spec@16.1.0
  • @objectstack/core@16.1.0

@objectstack/trigger-schedule@16.1.0

Patch Changes

• Updated dependencies [9e45b63]
• Updated dependencies [b20201f]
  • @objectstack/spec@16.1.0
  • @objectstack/core@16.1.0

@objectstack/types@16.1.0

Patch Changes

• Updated dependencies [9e45b63]
  • @objectstack/spec@16.1.0

@objectstack/verify@16.1.0

Patch Changes

• Updated dependencies [9e45b63]
• Updated dependencies [b20201f]
• Updated dependencies [818e6a3]
  • @objectstack/spec@16.1.0
  • @objectstack/core@16.1.0
  • @objectstack/service-automation@16.1.0
  • @objectstack/rest@16.1.0
  • @objectstack/plugin-hono-server@16.1.0
  • @objectstack/runtime@16.1.0
  • @objectstack/plugin-auth@16.1.0
  • @objectstack/plugin-security@16.1.0
  • @objectstack/plugin-sharing@16.1.0
  • @objectstack/service-settings@16.1.0
  • @objectstack/objectql@16.1.0
  • @objectstack/driver-sqlite-wasm@16.1.0
  • @objectstack/service-analytics@16.1.0
  • @objectstack/service-datasource@16.1.0

create-objectstack@16.1.0

@objectstack/sdui-parser@16.1.0

objectstack-vscode@16.1.0

@objectstack/example-crm@4.0.91

Patch Changes

• Updated dependencies [9e45b63]
• Updated dependencies [818e6a3]
  • @objectstack/spec@16.1.0
  • @objectstack/runtime@16.1.0

@objectstack/example-showcase@0.3.13

Patch Changes

• Updated dependencies [9e45b63]
• Updated dependencies [818e6a3]
  • @objectstack/spec@16.1.0
  • @objectstack/runtime@16.1.0
  • @objectstack/cloud-connection@16.1.0
  • @objectstack/connector-mcp@16.1.0
  • @objectstack/connector-openapi@16.1.0
  • @objectstack/connector-rest@16.1.0
  • @objectstack/connector-slack@16.1.0
  • @objectstack/driver-sql@16.1.0
  • @objectstack/service-datasource@16.1.0

@objectstack/example-todo@4.0.91

Patch Changes

• Updated dependencies [9e45b63]
• Updated dependencies [818e6a3]
  • @objectstack/spec@16.1.0
  • @objectstack/runtime@16.1.0
  • @objectstack/metadata@16.1.0
  • @objectstack/client@16.1.0
  • @objectstack/mcp@16.1.0
  • @objectstack/objectql@16.1.0
  • @objectstack/driver-sqlite-wasm@16.1.0
  • @objectstack/knowledge-memory@16.1.0
  • @objectstack/service-knowledge@16.1.0

@objectstack/example-embed-objectql@0.0.31

Patch Changes

• Updated dependencies [9e45b63]
  • @objectstack/spec@16.1.0
  • @objectstack/objectql@16.1.0
  • @objectstack/driver-memory@16.1.0

@objectstack/dogfood@0.0.39

Patch Changes

• Updated dependencies [9e45b63]
  • @objectstack/spec@16.1.0
  • @objectstack/plugin-audit@16.1.0
  • @objectstack/plugin-auth@16.1.0
  • @objectstack/plugin-security@16.1.0
  • @objectstack/service-storage@16.1.0
  • @objectstack/example-crm@4.0.91
  • @objectstack/example-showcase@0.3.13
  • @objectstack/connector-mcp@16.1.0
  • @objectstack/connector-openapi@16.1.0
  • @objectstack/connector-rest@16.1.0
  • @objectstack/mcp@16.1.0
  • @objectstack/objectql@16.1.0
  • @objectstack/verify@16.1.0

@objectstack/downstream-contract@0.0.37

Patch Changes

• Updated dependencies [9e45b63]
  • @objectstack/spec@16.1.0

@objectstack/http-conformance@0.0.5

Patch Changes

• Updated dependencies [b20201f]
  • @objectstack/core@16.1.0