diff --git a/‎.changeset/18931-me-permissions-unrestricted-export-annotation.md‎
Lines changed: 16 additions & 0 deletions b/‎.changeset/18931-me-permissions-unrestricted-export-annotation.md‎
Lines changed: 16 additions & 0 deletions
diff --git a/‎packages/plugins/plugin-hono-server/src/current-user-endpoints.ts‎
Lines changed: 28 additions & 7 deletions b/‎packages/plugins/plugin-hono-server/src/current-user-endpoints.ts‎
Lines changed: 28 additions & 7 deletions
diff --git a/‎packages/plugins/plugin-hono-server/src/effective-api-operations.test.ts‎
Lines changed: 70 additions & 2 deletions b/‎packages/plugins/plugin-hono-server/src/effective-api-operations.test.ts‎
Lines changed: 70 additions & 2 deletions
@@ -0,0 +1,16 @@
+---
+"@objectstack/plugin-hono-server": patch
+---
+
+`/auth/me/permissions` now reports an unrestricted object's effective operation set whenever the export axis withholds `export`, so the Console stops rendering an Export button the server answers `403 EXPORT_NOT_PERMITTED` (#18931).
+
+`Clause-②: no`
+
+The endpoint builds its per-object map in four passes — seed, fold, clamp, annotate. `seedSuperUserRestrictedObjects` resolved each registered schema **without** the export slot and skipped every `unrestricted` one; `annotateEffectiveApiOperations` resolves **with** it and iterates existing entries only. Two predicates for one question, and they disagreed on exactly one population: a principal whose only grant is a `'*'` wildcard carrying `modifyAllRecords` and no `allowExport` — which, since #8681 removed the wildcard export grant from the built-in admin sets, is every platform administrator holding no app-authored set.
+
+For that principal an unrestricted object got no entry, so annotate never saw it and the response said nothing about it at all. The client reads `apiOperations: undefined`, takes the default-allow path #3391 gave it, renders **Export**, and the click is refused. A sibling object declaring `apiMethods` got an entry, an `apiOperations` without `export`, and no button — the same principal, the same session, two answers.
+
+- **The seed now applies annotate's own predicate**: resolve with the export slot annotate will read for the entry being seeded, and skip only an object that is unrestricted **and** keeps `export`. A seeded entry carries no `allowExport` of its own and `foldWildcardSuperUser` does not add one, so annotate's `acc.allowExport ?? wildExport` resolves to the same wildcard bit the seed read — the two passes cannot diverge again.
+- **The export axis is the only axis this reaches.** Measured across the `enable` shapes an unrestricted object can carry: withholding `export` subtracts `export` and nothing else, and `mode` stays `unrestricted` either way — which is why the old `mode`-only guard could not tell the two cases apart. The CRUD axis needed no annotation and still gets none.
+- **What the response gains**: for such a principal, one entry per unrestricted object, each the full closure minus `export`. Its CRUD bits are folded `true` — the same answer the client already computed by falling back to `'*'`, now stated explicitly rather than inherited.
+- **Denial is unchanged.** `enforceExportPermission` → `security.canExport` still answers `403 EXPORT_NOT_PERMITTED`, and no request that was refused is now accepted. This is the affordance half: the channel that is supposed to tell the client now does.
@@ -457,18 +457,35 @@ export interface ApiExposureSchemaLike {
  * materializing a `false` entry would flip the client's `check('edit')` from
  * "undefined → default-allow" to "explicit false → deny" — a scope-exceeding
  * behavior change. A modify-all caller is folded to `true` anyway, so seeding is
- * harmless there. Unrestricted objects are skipped (they carry no annotation).
+ * harmless there.
+ *
+ * [#18931] A schema is skipped only when it needs NO annotation, which is the
+ * predicate {@link annotateEffectiveApiOperations} itself applies: unrestricted
+ * AND the export axis leaves `export` in place. Resolving WITHOUT the export
+ * slot made this pass disagree with annotate's — an unrestricted object whose
+ * `export` the axis withholds got no entry, annotate (which iterates existing
+ * entries only) never saw it, and `/me/permissions` stayed silent for exactly
+ * the population #8681 created: a wildcard-only admin holding no `allowExport`.
+ * The client's `apiOperations` is then `undefined`, its default-allow path
+ * renders an Export button, and the click is refused `403 EXPORT_NOT_PERMITTED`.
  */
 export function seedSuperUserRestrictedObjects(
     objects: Record<string, any>,
     allSchemas: readonly ApiExposureSchemaLike[],
 ): void {
     if (objects?.['*']?.modifyAllRecords !== true) return;
+    // [#18931] The export slot annotate will read for an entry seeded here. A
+    // seeded entry carries no `allowExport` of its own and `foldWildcardSuperUser`
+    // does not add one, so annotate's `acc.allowExport ?? wildExport` resolves to
+    // exactly this wildcard bit — the two passes cannot diverge again.
+    const userExportAllowed = objects['*']?.allowExport === true;
     for (const schema of allSchemas) {
         const name = schema?.name;
         if (!name || name === '*' || objects[name]) continue;
-        const eff = resolveEffectiveApiMethods(schema.enable ?? undefined);
-        if (eff.mode === 'unrestricted') continue; // only restricting objects
+        const eff = resolveEffectiveApiMethods(schema.enable ?? undefined, { userExportAllowed });
+        // Same skip predicate as annotate: there is nothing to say about an
+        // unrestricted object that keeps its full operation closure.
+        if (eff.mode === 'unrestricted' && userExportAllowed) continue;
         objects[name] = { allowCreate: false, allowRead: false, allowEdit: false, allowDelete: false };
     }
 }
@@ -479,10 +496,14 @@ export function seedSuperUserRestrictedObjects(
  *
  * This is the single "effective" channel the frontend consumes — it renders the
  * operations the server hands down here, never the raw `apiMethods` whitelist.
- * Only objects whose whitelist actually tightens exposure are annotated (a
- * `deny-all` object gets an empty array; an unrestricted object gets nothing, so
- * the client keeps its default-allow behavior). Runs AFTER fold + clamp so the
- * annotation sits alongside the final CRUD affordances.
+ * An object is annotated whenever its effective set is narrower than the
+ * client's default-allow assumption (a `deny-all` object gets an empty array;
+ * [#3544] an unrestricted object gets one too whenever the export axis withholds
+ * `export`). Only an unrestricted object that keeps its full closure gets
+ * nothing, because for it default-allow is already the right answer. Runs AFTER
+ * fold + clamp so the annotation sits alongside the final CRUD affordances, and
+ * {@link seedSuperUserRestrictedObjects} applies the same predicate so a
+ * wildcard-only principal has an entry here to annotate ([#18931]).
  */
 export function annotateEffectiveApiOperations(
     objects: Record<string, any>,
 
@@ -173,11 +173,19 @@ describe('seedSuperUserRestrictedObjects (#3391)', () => {
   ];
 
   it('for a modify-all super-user, seeds false-init entries for restricting objects only', () => {
-    const objects: Record<string, any> = { '*': { modifyAllRecords: true, viewAllRecords: true } };
+    // [#18931] `allowExport: true` is what keeps this case about the `apiMethods`
+    // DERIVATION — the same reason the annotate block above grants it. Without
+    // it the export axis also withholds `export`, which is its own reason to
+    // seed `open_obj`, and this assertion would be reading that instead. The
+    // withheld-export case is pinned separately below.
+    const objects: Record<string, any> = {
+      '*': { modifyAllRecords: true, viewAllRecords: true, allowExport: true },
+    };
     seedSuperUserRestrictedObjects(objects, schemas);
     expect(objects.widget).toEqual({ allowCreate: false, allowRead: false, allowEdit: false, allowDelete: false });
     expect(objects.locked).toBeDefined();
-    // unrestricted objects are NOT seeded (no annotation to attach)
+    // an unrestricted object that keeps its FULL closure is NOT seeded — for it
+    // the client's default-allow path is already the right answer
     expect(objects.open_obj).toBeUndefined();
   });
 
@@ -218,4 +226,64 @@ describe('seedSuperUserRestrictedObjects (#3391)', () => {
     annotateEffectiveApiOperations(objects, (name) => schemas.find((s) => s.name === name));
     expect(objects.widget.apiOperations).toEqual(['get', 'list', 'aggregate', 'search', 'export']);
   });
+
+  // [#18931] The class this pass used to SUBTRACT: an object with NO `apiMethods`
+  // declaration, for a principal whose only grant is a wildcard carrying no
+  // `allowExport` — every built-in admin since #8681. It got no entry, so
+  // `annotateEffectiveApiOperations` (which iterates existing entries only)
+  // never saw it and `/me/permissions` said nothing about it at all; the client
+  // read `apiOperations: undefined`, took its default-allow path, rendered
+  // Export, and the click came back `403 EXPORT_NOT_PERMITTED`.
+  describe('the unrestricted object a wildcard-only principal cannot be told about (#18931)', () => {
+    // Exactly the card's shape: `{ apiEnabled: true }` and nothing else.
+    const unrestricted: ApiExposureSchemaLike[] = [{ name: 'crm_lead', enable: { apiEnabled: true } }];
+    // The card's principal: org owner holding no app-authored set. Its wildcard
+    // carries the super-user bits and NO `allowExport` (#8681, by design).
+    const wildcardOnlyAdmin = () => ({
+      '*': {
+        allowCreate: true, allowRead: true, allowEdit: true, allowDelete: true,
+        viewAllRecords: true, modifyAllRecords: true, allowTransfer: false,
+      },
+    });
+
+    it('is seeded, and its annotation withholds export while keeping everything else', () => {
+      const objects: Record<string, any> = wildcardOnlyAdmin();
+      seedSuperUserRestrictedObjects(objects, unrestricted);
+      annotateEffectiveApiOperations(objects, (name) => unrestricted.find((s) => s.name === name));
+
+      // PEDIGREE, not a count — a bare "an entry exists" is satisfied by the
+      // wrong entry, and a bare length is satisfied by the wrong set.
+      expect(objects.crm_lead).toBeDefined();
+      expect(objects.crm_lead.apiOperations).toBeDefined();
+      // The one operation the server refuses for this principal is the one the
+      // client must not offer.
+      expect(objects.crm_lead.apiOperations).not.toContain('export');
+      // …and withholding it costs the object nothing else: this is the full
+      // unrestricted closure minus `export`, so the fix cannot be satisfied by
+      // an over-narrow entry that hides unrelated affordances too.
+      expect(objects.crm_lead.apiOperations).toEqual(
+        ['get', 'list', 'create', 'update', 'delete', 'upsert', 'bulk', 'aggregate', 'search', 'import'],
+      );
+    });
+
+    it('stays silent for the same object once the principal really may export', () => {
+      // The control: same schema, same super-user bits, `allowExport` granted.
+      // Nothing is withheld, so there is nothing to say and the client's
+      // default-allow path is correct — no entry, exactly as before #18931.
+      const objects: Record<string, any> = wildcardOnlyAdmin();
+      objects['*'].allowExport = true;
+      seedSuperUserRestrictedObjects(objects, unrestricted);
+      annotateEffectiveApiOperations(objects, (name) => unrestricted.find((s) => s.name === name));
+      expect(objects.crm_lead).toBeUndefined();
+    });
+
+    it('does not reach a viewAll-only principal (the seed guard is unchanged)', () => {
+      // Materialising a `false` entry for a caller the fold does NOT pull true
+      // would flip the client's `check()` from default-allow to explicit deny.
+      // #18931 widens WHICH schemas are considered, never WHICH principals.
+      const objects: Record<string, any> = { '*': { viewAllRecords: true } };
+      seedSuperUserRestrictedObjects(objects, unrestricted);
+      expect(objects.crm_lead).toBeUndefined();
+    });
+  });
 });