merge main (cutover #25825 + 4a #25745) into the 2b branch

Co-Authored-By: Claude <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01A6SEitNngAMugGbuJHWsDS

Author: claude

.changeset/25711-console-built-in-workspace.md

@@ -0,0 +1,15 @@
+---
+'@objectstack/console': patch
+'@objectstack/cli': patch
+---
+
+build(console): `@objectstack/console` is built in this workspace from `ui/apps/console`, and the Console no longer arrives through a pinned objectui commit
+
+Clause-②: no
+Metadata-protocol: none
+
+- **The package.** `@objectstack/console` ships the same `dist/` it shipped at 18.1.0: the built Console (`index.html`, `assets/`, the manifests it served). Two files leave the tarball: `dist/.objectui-sha`, which named the objectui commit the Console was built from, and `dist/.objectstack-injection.json`, which recorded the spec and client dists injected into that build. Both described a pin that no longer exists: the Console is built from the `ui/` tree of the same commit as the framework, so its version is the framework's version.
+- **The CLI.** When a framework checkout has no built Console, `objectstack serve` / `objectstack dev` and the 503 at `/_console/` now name `pnpm console:build`, which builds `ui/apps/console` and copies its dist into `packages/console`. The remedy used to be `pnpm objectui:build`, which cloned objectui at the pinned commit.
+- **One version.** The `@object-ui/*` packages and the private VS Code extension join the `@objectstack/*` fixed group, so every public package of both scopes publishes at one version and the extension ships at it.
+
+What to do: nothing as a consumer; install `@objectstack/console` as before. In a framework checkout, run `pnpm console:build` where you ran `pnpm objectui:build`.

.changeset/config.json

@@ -80,13 +80,52 @@
       "@objectstack/account",
       "create-objectstack",
       "@objectstack/connector-openapi",
-      "@objectstack/verify"
+      "@objectstack/verify",
+      "@object-ui/app-shell",
+      "@object-ui/auth",
+      "@object-ui/cli",
+      "@object-ui/collaboration",
+      "@object-ui/components",
+      "@object-ui/console",
+      "@object-ui/core",
+      "@object-ui/create-plugin",
+      "@object-ui/data-objectstack",
+      "@object-ui/fields",
+      "@object-ui/i18n",
+      "@object-ui/layout",
+      "@object-ui/mobile",
+      "@object-ui/permissions",
+      "@object-ui/plugin-ai",
+      "@object-ui/plugin-calendar",
+      "@object-ui/plugin-charts",
+      "@object-ui/plugin-chatbot",
+      "@object-ui/plugin-dashboard",
+      "@object-ui/plugin-designer",
+      "@object-ui/plugin-detail",
+      "@object-ui/plugin-editor",
+      "@object-ui/plugin-form",
+      "@object-ui/plugin-gantt",
+      "@object-ui/plugin-grid",
+      "@object-ui/plugin-kanban",
+      "@object-ui/plugin-list",
+      "@object-ui/plugin-map",
+      "@object-ui/plugin-markdown",
+      "@object-ui/plugin-report",
+      "@object-ui/plugin-timeline",
+      "@object-ui/plugin-tree",
+      "@object-ui/plugin-view",
+      "@object-ui/providers",
+      "@object-ui/react",
+      "@object-ui/react-runtime",
+      "@object-ui/sdui-parser",
+      "@object-ui/types",
+      "object-ui"
     ]
   ],
   "linked": [],
   "access": "public",
   "baseBranch": "main",
   "updateInternalDependencies": "patch",
-  "ignore": [],
+  "ignore": ["@object-ui/example-*", "@object-ui/site", "@object-ui/runner", "@object-ui/test-support"],
   "privatePackages": { "version": true, "tag": false }
 }

.github/workflows/cut-rc.yml

@@ -3064,31 +3064,6 @@ jobs:
         continue-on-error: true
         run: pnpm check:startup-registry-verdict
 
-      # objectui pin-changeset guard (#4731). A frontend-only refresh reaches the
-      # platform release record ONLY through the changeset `bump-objectui.sh`
-      # writes, and that list used to be guessed off objectui's commit subjects
-      # (`feat|fix` + a silent `head -40`). On one real range the guess dropped
-      # all 13 releasing non-feat/fix commits — every breaking `refactor(...)!`
-      # among them — and pulled in 5 that release nothing. The list and the bump
-      # level now come from what objectui DECLARED (`.changeset/*.md` added over
-      # the range; empty frontmatter = release-nothing). This self-test builds
-      # throwaway git repos carrying those exact shapes, runs the real scripts
-      # over them, and asserts the emitted changeset — including that a cap which
-      # fires announces itself and that an unwalkable range degrades loudly.
-      # #4843 folded `scripts/objectui-range.mjs` — the release page's Console
-      # section — onto that same `classifyRange()` criterion, so both self-tests
-      # run here: one criterion, two consumers, no room to drift apart.
-      - name: objectui pin-changeset digest guard
-        id: objectui-pin-changeset-digest-guard
-        continue-on-error: true
-        run: pnpm check:objectui-changeset
-
-      # Rationale: `scripts/bump-objectui.selftest.sh` header (#10797).
-      - name: objectui pin write-ordering guard
-        id: objectui-pin-write-ordering-guard
-        continue-on-error: true
-        run: pnpm check:objectui-bump
-
       # Changeset-family gate self-tests (#6509). The SELF-TEST halves only —
       # the real scans stay in pr-automation.yml's `changeset-check`, and the
       # split is the whole point of this step.

.github/workflows/lint.yml

@@ -1835,109 +1835,26 @@ jobs:
         run: node scripts/check-changeset-fixed.mjs
 
       # ──────────────────────────────────────────────────────────────────────
-      # ⛔ TOMBSTONE — the #3340 pin-currency gate that used to sit here is gone
-      # (2026-08-20 ruling, #10134). Do not re-add one.
+      # ⛔ TOMBSTONE — no objectui pin is read, built or checked here, and none
+      # is re-added (objectstack#25711, D1 ruling 「同一个版本号组」).
       #
-      # It compared `.objectui-sha` against objectui `main` at publish time and
-      # refused a release whose pin lagged. The ruling removed the question, not
-      # just the job: WHICH objectui revision this repo pins is a decision taken
-      # in an objectstack issue, never derived from another repo's HEAD, so
-      # "the pin is behind main" is not a defect a release lane may diagnose.
-      #
-      # R4's lesson (#6170 — "a gate required on a PR the publishing lane can
-      # skip is not a gate") is untouched and does not resurrect this one:
-      # #3340's actual invariant is "everything published is covered by the
-      # changeset record", and that is carried by `scripts/bump-objectui.sh` +
-      # `scripts/objectui-changeset-digest.mjs` at BUMP time — on the manual pin
-      # PR, which is now the only way the pin ever moves. Publishing an old
-      # console is therefore a published decision, not an unnoticed gap.
+      # The Console is a workspace package now: `ui/apps/console`
+      # (@object-ui/console) builds against this tree's @objectstack/* through
+      # `workspace:^`, and `@objectstack/console#build:dist` (root turbo.json)
+      # copies that dist with the tracked sdui.manifest.json; `pnpm run release`
+      # runs it (`pnpm run console:build`) after the build below. The
+      # pin-currency gate, the vendored-dist cache keyed on `.objectui-sha`,
+      # its SHA stamp check and
+      # its spec-injection check are gone with the pin: each answered "was the
+      # Console built from the objectui commit, and against the spec, this
+      # release names", and both are true by construction when the Console
+      # source and the spec are one tree at one commit. The single-zod canary
+      # survives inside packages/console/build-dist.sh, on the bytes it ships.
       # ──────────────────────────────────────────────────────────────────────
 
       - name: Build
         run: pnpm run build
 
-      - name: Read the spec's declared zod range (Console dist key input)
-        id: spec-zod
-        # Fails rather than keying on an empty or `undefined` range: a key that
-        # silently stopped carrying the range would restore across a zod move.
-        run: |
-          node -e '
-            const range = require("./packages/spec/package.json").dependencies?.zod;
-            if (typeof range !== "string" || range.trim() === "") {
-              console.error("packages/spec/package.json declares no dependencies.zod, so the Console dist key cannot carry it.");
-              process.exit(1);
-            }
-            console.log("range=" + range.trim());
-          ' >> "$GITHUB_OUTPUT"
-
-      # This key hashes the pin and the build script, and carries the spec's
-      # DECLARED zod range (the step above). ci.yml's Console Pin Gate (#4290)
-      # hashes a SUPERSET of the files: those two, the probe scripts and the
-      # spec's entry layout (#20765). So the two workflows no longer share dist
-      # entries, and each one builds its own on a miss. Keeping this key narrower
-      # is deliberate.
-      # Following ci.yml would rebuild the console on every Version Packages
-      # merge, and publishing a cached console whose spec content lags is the
-      # existing cache design.
-      #
-      # The zod range is the one spec input the cached dist is NOT allowed to
-      # lag (#21108). The console bundles a single zod instance, the console's
-      # own copy, and its build refuses a console zod outside the injected spec's
-      # declared `zod` range (objectui#11353). A dist restored after that range
-      # moved would publish a console the build never judged against it. The
-      # range is read out of packages/spec/package.json, not hashed with it: the
-      # file's `version` moves on every Version Packages merge, and hashing the
-      # whole file would turn every publish into a cold console rebuild.
-      #
-      # Split restore/save, matching ci.yml, and not the combined actions/cache
-      # action: the combined form's post-step saves even when the job FAILED,
-      # and build-console.sh writes the SHA stamp BEFORE it asserts the bundle
-      # canary — so a canary failure here would seed this shared, repo-scoped
-      # key with a stamped-but-broken dist that later runs restore and sail
-      # through. See ci.yml's split-restore note for the full rationale.
-      - name: Restore vendored Console dist (keyed on the objectui pin)
-        id: console-dist-cache
-        uses: actions/cache/restore@v6
-        with:
-          path: packages/console/dist
-          key: ${{ runner.os }}-console-dist-${{ hashFiles('.objectui-sha', 'scripts/build-console.sh') }}-zod-${{ steps.spec-zod.outputs.range }}
-
-      - name: Build vendored @objectstack/console SPA
-        # Clones objectstack-ai/objectui at the SHA pinned in .objectui-sha,
-        # builds @object-ui/console, and copies dist/ into
-        # packages/console/dist/. Must run before publish so the prepublishOnly
-        # guard in @objectstack/console passes.
-        if: steps.console-dist-cache.outputs.cache-hit != 'true'
-        run: bash scripts/build-console.sh
-
-      - name: Verify Console dist stamp matches pin
-        run: pnpm check:console-sha
-
-      # The spec-injection half of the same question, spelled exactly as
-      # ci.yml's Console Pin Gate spells it — both consumers of one cache key
-      # apply one check. check:console-sha answers only "which objectui SHA",
-      # and scripts/assert-console-spec-injection.mjs runs INSIDE
-      # build-console.sh, which the `if: cache-hit != 'true'` above skips — so
-      # on a cache hit nothing had asked whether the dist this job is about to
-      # PUBLISH bundles this tree's @objectstack/spec rather than the published
-      # tarball. --require-stamp because the vacuity check:console-sha tolerates
-      # (no dist, or a dist no build ever stamped) is wrong on a publish lane.
-      - name: Verify the restored Console dist bundles this tree's spec
-        env:
-          CONSOLE_DIST_CACHE_KEY: ${{ runner.os }}-console-dist-${{ hashFiles('.objectui-sha', 'scripts/build-console.sh') }}-zod-${{ steps.spec-zod.outputs.range }}
-        run: pnpm check:console-injection --require-stamp
-
-      # Reached only with every console assertion above green: Actions steps
-      # default to `success()`, and nothing between the restore and here carries
-      # `if: always()` or `continue-on-error`. Saving only on a miss keeps an
-      # immutable entry from being rewritten on every release run.
-      - name: Save vendored Console dist
-        if: steps.console-dist-cache.outputs.cache-hit != 'true'
-        uses: actions/cache/save@v6
-        with:
-          path: packages/console/dist
-          key: ${{ runner.os }}-console-dist-${{ hashFiles('.objectui-sha', 'scripts/build-console.sh') }}-zod-${{ steps.spec-zod.outputs.range }}
-
       - name: Downstream backward-compat smoke (live hotcrm)
         # Pre-publish gate (#2035): the about-to-publish @objectstack/spec must
         # not break a real third-party consumer pinned to a published release.
@@ -2031,9 +1948,10 @@ jobs:
         run: bash scripts/release-spec-changes.sh --verify
 
       # ──────────────────────────────────────────────────────────────────────
-      # The publish itself. `pnpm run release` = build + build-console +
-      # scripts/release-publish.sh, which is `changeset publish` followed by ONE
-      # atomic `git push origin --tags` (#2191: the action's concurrent per-tag
+      # The publish itself. `pnpm run release` = build (both scopes; the turbo
+      # cache makes it the build above) + console:build (the Console dist into
+      # packages/console) + scripts/release-publish.sh, which is `changeset
+      # publish` followed by ONE atomic `git push origin --tags` (#2191: the action's concurrent per-tag
       # pushes raced GitHub's ref backend and lost ~half the tags).
       #
       # changesets/action is NOT used here, and that is deliberate: handed a

.github/workflows/release.yml

@@ -55,17 +55,13 @@ jobs:
       # built `dist/`. Build the whole dependency closure (excluding the
       # showcase's own app build, which serve --dev doesn't need).
       - run: pnpm turbo run build --filter=@objectstack/example-showcase^...
-      # The console SPA served at /_console is vendored by build-console.sh
-      # (shallow-clones objectui@.objectui-sha, builds @object-ui/console, copies
-      # dist → packages/console/dist). Without it serve --dev warns "Console dist
-      # not found" and the app shell never renders.
-      - name: Vendor the pinned Console SPA
-        run: bash scripts/build-console.sh
-      # Self-test the drift guard: a fresh build-console.sh must stamp the dist
-      # with the pinned SHA so `pnpm check:console-sha` reports in-sync. Catches
-      # a regression where the stamp step is dropped or the pin/stamp diverge.
-      - name: Verify Console SHA stamp matches pin
-        run: pnpm check:console-sha
+      # The console SPA served at /_console is @objectstack/console's dist: a
+      # copy of the workspace's own ui/apps/console build, which `build` does not
+      # produce (packages/console/build-dist.sh, run by the `build:dist` task).
+      # Without it serve --dev warns "Console dist not found" and the app shell
+      # never renders.
+      - name: Build the Console SPA from ui/apps/console
+        run: pnpm console:build
       - name: Install Playwright Chromium
         working-directory: examples/app-showcase
         run: pnpm exec playwright install --with-deps chromium

.github/workflows/showcase-smoke.yml

@@ -116,7 +116,7 @@ Read the **Breaking?** column, not the version number: in the 17.x minors every
 1. **RFC (Request for Comments)** — Breaking changes are proposed as GitHub issues with the `protocol:breaking` label.
 2. **Deprecation** — The old behavior is deprecated in a MINOR release (see timeline above).
 3. **Migration Guide** — A detailed migration guide is published before the removal lands, in the release notes for the version that carries it.
-4. **Release** — In the 17.x minors the breaking change shipped in the next **MINOR** version, carrying a changeset entry marked `**BREAKING**`, and `scripts/check-changeset-no-major.mjs` failed a pull request that declared a `major` bump, because under lockstep one `major` would promote all 73 published packages. During the v18 prerelease it shipped in the next `18.0.0-next.N`, because the guard stood aside in pre mode and a pull request could declare a major bump. Changesets has exited pre mode, so the guard fails a `major` bump again. See [how a breaking stage lands on the v18 line](/docs/releases/v18#how-a-breaking-stage-lands-on-this-line).
+4. **Release** — In the 17.x minors the breaking change shipped in the next **MINOR** version, carrying a changeset entry marked `**BREAKING**`, and `scripts/check-changeset-no-major.mjs` failed a pull request that declared a `major` bump, because under lockstep one `major` would promote all 111 published packages. During the v18 prerelease it shipped in the next `18.0.0-next.N`, because the guard stood aside in pre mode and a pull request could declare a major bump. Changesets has exited pre mode, so the guard fails a `major` bump again. See [how a breaking stage lands on the v18 line](/docs/releases/v18#how-a-breaking-stage-lands-on-this-line).
 
 ---
 
@@ -196,7 +196,7 @@ The `@objectstack/spec` package provides additional stability guarantees:
 
 ### Which surfaces this covers
 
-**All of them.** It was not scoped to an experimental corner or a pre-release channel: all **73** packages published from this repository belong to a single Changesets `fixed` group, so they share one version number and one policy. No published surface was exempt.
+**All of them.** It was not scoped to an experimental corner or a pre-release channel: all **111** packages published from this repository belong to a single Changesets `fixed` group, so they share one version number and one policy. No published surface was exempt.
 
 The convention was enforced rather than informal — `scripts/check-changeset-no-major.mjs` failed a pull request that introduced a `major` bump, because under lockstep a single `major` on one package would promote the entire stack. During the v18 prerelease Changesets was in pre mode with the tag `next` and the guard stood aside, so a pull request on the v18 line could declare a major bump. Changesets has exited pre mode, and the guard fails a `major` bump again.