feat: add multi-project cloud hosting with artifact publishing

hotlong · hotlong · commit 5e01850c2df1 · 2026-05-15T20:02:12.000+08:00
diff --git a/apps/cloud/cloudflare/worker.ts b/apps/cloud/cloudflare/worker.ts
@@ -42,6 +42,7 @@ export interface Env {
     OS_BASE_URL?: string;
     OS_TRUSTED_ORIGINS?: string;
     OS_COOKIE_DOMAIN?: string;
+    OS_ROOT_DOMAIN?: string;
     GOOGLE_CLIENT_ID?: string;
     GOOGLE_CLIENT_SECRET?: string;
     GITHUB_CLIENT_ID?: string;
@@ -126,6 +127,7 @@ const FORWARDED_ENV_KEYS: readonly (keyof Env)[] = [
     'OS_BASE_URL',
     'OS_TRUSTED_ORIGINS',
     'OS_COOKIE_DOMAIN',
+    'OS_ROOT_DOMAIN',
     'GOOGLE_CLIENT_ID',
     'GOOGLE_CLIENT_SECRET',
     'GITHUB_CLIENT_ID',
@@ -296,7 +298,7 @@ export class CloudContainer extends Container<Env> {
         // match the origin the browser hits, otherwise sign-up / OAuth
         // callbacks fail with "Invalid origin". Override per environment
         // via `wrangler secret put AUTH_BASE_URL` or [vars] in wrangler.toml.
-        AUTH_BASE_URL: 'https://objectstack-cloud.objectstack.workers.dev',
+        AUTH_BASE_URL: 'https://cloud.objectos.app',
         // Comma-separated extra origins to add to better-auth's trusted
         // list (custom domains, preview hosts, …). AUTH_BASE_URL is
         // already trusted automatically.
diff --git a/apps/cloud/scripts/setup-cloudflare-secrets.sh b/apps/cloud/scripts/setup-cloudflare-secrets.sh
@@ -36,11 +36,15 @@ APP_BASENAME="$(basename "$APP_DIR")"
 case "$APP_BASENAME" in
   objectos)
     KEYS=( OS_DATABASE_URL OS_DATABASE_AUTH_TOKEN AUTH_SECRET
-           OS_CLOUD_URL OS_CLOUD_API_KEY OS_COOKIE_DOMAIN ) ;;
+           OS_CLOUD_URL OS_CLOUD_API_KEY OS_COOKIE_DOMAIN OS_ROOT_DOMAIN ) ;;
   cloud)
     KEYS=( OS_DATABASE_URL OS_CONTROL_DATABASE_URL OS_DATABASE_AUTH_TOKEN AUTH_SECRET
            OS_CONTROL_PG_POOL_MIN OS_CONTROL_PG_POOL_MAX
-           TURSO_API_TOKEN TURSO_ORG_NAME OS_COOKIE_DOMAIN ) ;;
+           TURSO_API_TOKEN TURSO_ORG_NAME
+           OS_CLOUD_API_KEY OS_COOKIE_DOMAIN OS_ROOT_DOMAIN
+           OS_STORAGE_ADAPTER OS_STORAGE_LOCAL_DIR OS_STORAGE_KEY_PREFIX
+           OS_S3_BUCKET OS_S3_REGION OS_S3_ENDPOINT
+           OS_S3_ACCESS_KEY_ID OS_S3_SECRET_ACCESS_KEY OS_S3_FORCE_PATH_STYLE ) ;;
   *)
     echo "✗ unknown app dir: $APP_BASENAME" >&2; exit 1 ;;
 esac
diff --git a/apps/cloud/wrangler.toml b/apps/cloud/wrangler.toml
@@ -45,7 +45,7 @@ compatibility_flags = ["nodejs_compat"]
 # rebuild + re-push to ship a new version, then run `wrangler deploy`.
 [[containers]]
 class_name = "CloudContainer"
-image = "registry.cloudflare.com/2846eb40a60f4738e292b90dcd8cce10/objectstack-cloud:61dafc8e"
+image = "registry.cloudflare.com/2846eb40a60f4738e292b90dcd8cce10/objectstack-cloud:seed-fix-1"
 max_instances = 3
 instance_type = "standard-1"
 
diff --git a/apps/console/package.json b/apps/console/package.json
@@ -5,6 +5,9 @@
   "type": "module",
   "description": "ObjectStack Console - opinionated, fork-ready runtime console built on @object-ui/app-shell with the full plugin set wired up.",
   "license": "Apache-2.0",
+  "files": [
+    "dist"
+  ],
   "scripts": {
     "dev": "vite",
     "build": "tsc && vite build",
diff --git a/apps/objectos/Dockerfile b/apps/objectos/Dockerfile
@@ -74,6 +74,8 @@ COPY package.json pnpm-workspace.yaml turbo.json tsconfig.json tsup.config.ts ./
 COPY packages ./packages
 COPY examples ./examples
 COPY apps/objectos ./apps/objectos
+COPY apps/console ./apps/console
+COPY apps/account ./apps/account
 
 RUN --mount=type=cache,id=pnpm-store,target=/pnpm/store \
     pnpm install --frozen-lockfile --prefer-offline --prod=false
diff --git a/apps/objectos/cloudflare/worker.ts b/apps/objectos/cloudflare/worker.ts
@@ -36,6 +36,7 @@ export interface Env {
     OS_BASE_URL?: string;
     OS_TRUSTED_ORIGINS?: string;
     OS_COOKIE_DOMAIN?: string;
+    OS_ROOT_DOMAIN?: string;
     GOOGLE_CLIENT_ID?: string;
     GOOGLE_CLIENT_SECRET?: string;
     GITHUB_CLIENT_ID?: string;
@@ -94,7 +95,7 @@ const FORWARDED_ENV_KEYS: readonly (keyof Env)[] = [
     // auth
     'AUTH_SECRET', 'OS_AUTH_SECRET',
     'AUTH_BASE_URL', 'OS_BASE_URL',
-    'OS_TRUSTED_ORIGINS', 'OS_COOKIE_DOMAIN',
+    'OS_TRUSTED_ORIGINS', 'OS_COOKIE_DOMAIN', 'OS_ROOT_DOMAIN',
     'GOOGLE_CLIENT_ID', 'GOOGLE_CLIENT_SECRET',
     'GITHUB_CLIENT_ID', 'GITHUB_CLIENT_SECRET',
     // cloud client
@@ -132,13 +133,59 @@ export class ObjectOSContainer extends Container<Env> {
     enableInternet = true;
     requiredPorts = [3000];
 
+    /**
+     * Cold start budget for the Node app to bind port 3000. The default
+     * in `@cloudflare/containers` is 20s which is not enough for a fresh
+     * boot that has to open a remote DB connection + run schema sync for
+     * every registered `sys_*` object. See apps/cloud/cloudflare/worker.ts
+     * for the full rationale — this is the same override.
+     */
+    private readonly PORT_READY_TIMEOUT_MS = 120_000;
+
+    override async startAndWaitForPorts(
+        portsOrArgs?: any,
+        cancellationOptions?: any,
+        startOptions?: any,
+    ): Promise<void> {
+        const TIMEOUT = this.PORT_READY_TIMEOUT_MS;
+        if (
+            portsOrArgs !== null &&
+            typeof portsOrArgs === 'object' &&
+            !Array.isArray(portsOrArgs) &&
+            ('ports' in portsOrArgs || 'cancellationOptions' in portsOrArgs || 'startOptions' in portsOrArgs)
+        ) {
+            const inner = { ...(portsOrArgs.cancellationOptions ?? {}) };
+            delete inner.abort;
+            const merged = {
+                ...portsOrArgs,
+                cancellationOptions: {
+                    portReadyTimeoutMS: TIMEOUT,
+                    instanceGetTimeoutMS: TIMEOUT,
+                    ...inner,
+                },
+            };
+            return super.startAndWaitForPorts(merged);
+        }
+        const inner = { ...(cancellationOptions ?? {}) };
+        delete inner.abort;
+        const merged = {
+            portReadyTimeoutMS: TIMEOUT,
+            instanceGetTimeoutMS: TIMEOUT,
+            ...inner,
+        };
+        return super.startAndWaitForPorts(portsOrArgs, merged, startOptions);
+    }
+
     envVars: Record<string, string> = {
         NODE_ENV: 'production',
         PORT: '3000',
         HOST: '0.0.0.0',
         OS_KERNEL_CACHE_SIZE: '50',
         OS_KERNEL_TTL_MS: '1800000',
         OS_ENV_CACHE_TTL_MS: '300000',
+        // Schema sync against a cold remote DB easily exceeds Workers'
+        // ~30s inbound budget; run migrations out of band before deploy.
+        OS_SKIP_SCHEMA_SYNC: '1',
     };
 
     constructor(state: DurableObjectState, env: Env) {
diff --git a/apps/objectos/package.json b/apps/objectos/package.json
@@ -27,6 +27,8 @@
     "@example/app-todo": "workspace:*",
     "@hono/node-server": "^2.0.2",
     "@libsql/client": "^0.17.3",
+    "@objectstack/account": "workspace:*",
+    "@objectstack/console": "workspace:*",
     "@objectstack/driver-memory": "workspace:*",
     "@objectstack/driver-mongodb": "workspace:*",
     "@objectstack/driver-sql": "workspace:*",
diff --git a/apps/objectos/scripts/setup-cloudflare-secrets.sh b/apps/objectos/scripts/setup-cloudflare-secrets.sh
@@ -36,11 +36,12 @@ APP_BASENAME="$(basename "$APP_DIR")"
 case "$APP_BASENAME" in
   objectos)
     KEYS=( OS_DATABASE_URL OS_DATABASE_AUTH_TOKEN AUTH_SECRET
-           OS_CLOUD_URL OS_CLOUD_API_KEY OS_COOKIE_DOMAIN ) ;;
+           OS_CLOUD_URL OS_CLOUD_API_KEY OS_COOKIE_DOMAIN OS_ROOT_DOMAIN ) ;;
   cloud)
     KEYS=( OS_DATABASE_URL OS_CONTROL_DATABASE_URL OS_DATABASE_AUTH_TOKEN AUTH_SECRET
            OS_CONTROL_PG_POOL_MIN OS_CONTROL_PG_POOL_MAX
-           TURSO_API_TOKEN TURSO_ORG_NAME OS_COOKIE_DOMAIN ) ;;
+           TURSO_API_TOKEN TURSO_ORG_NAME
+           OS_CLOUD_API_KEY OS_COOKIE_DOMAIN OS_ROOT_DOMAIN ) ;;
   *)
     echo "✗ unknown app dir: $APP_BASENAME" >&2; exit 1 ;;
 esac
diff --git a/apps/objectos/wrangler.toml b/apps/objectos/wrangler.toml
@@ -44,7 +44,7 @@ compatibility_flags = ["nodejs_compat"]
 # rebuild + re-push to ship a new version, then run `wrangler deploy`.
 [[containers]]
 class_name = "ObjectOSContainer"
-image = "registry.cloudflare.com/<account-id>/objectos:latest"
+image = "registry.cloudflare.com/2846eb40a60f4738e292b90dcd8cce10/objectos:59ed1a93-r2"
 max_instances = 5
 instance_type = "standard-1"
 
diff --git a/packages/cli/src/commands/serve.ts b/packages/cli/src/commands/serve.ts
@@ -636,12 +636,30 @@ export default class Serve extends Command {
             if (isDev && !trustedOrigins.includes('http://localhost:*')) {
               trustedOrigins.push('http://localhost:*');
             }
+            // Per-project subdomains: when OS_ROOT_DOMAIN is set (multi-
+            // project hosting under `*.<root>`), every project hostname
+            // must be trusted by better-auth or sign-up/sign-in is
+            // rejected with "Invalid origin". Mirrors the OS_COOKIE_DOMAIN
+            // wildcard semantics — they are always set together.
+            const rootDomain = (process.env.OS_ROOT_DOMAIN ?? process.env.ROOT_DOMAIN)?.trim();
+            if (rootDomain) {
+              const wildcard = `https://*.${rootDomain}`;
+              if (!trustedOrigins.includes(wildcard)) trustedOrigins.push(wildcard);
+            }
 
             await kernel.use(new AuthPlugin({
               secret,
               baseUrl,
               socialProviders: Object.keys(socialProviders).length > 0 ? socialProviders : undefined,
               trustedOrigins: trustedOrigins.length ? trustedOrigins : undefined,
+              advanced: process.env.OS_COOKIE_DOMAIN
+                ? ({
+                    crossSubDomainCookies: {
+                      enabled: true,
+                      domain: process.env.OS_COOKIE_DOMAIN,
+                    },
+                  } as any)
+                : undefined,
             }));
             trackPlugin('Auth');
 
diff --git a/packages/cli/src/utils/console.ts b/packages/cli/src/utils/console.ts
@@ -100,7 +100,7 @@ export function hasConsoleDist(consolePath: string): boolean {
  *     a real 404 surfaces a rebuild/deploy mismatch instead of the
  *     dreaded "asset returns text/html" silent failure.
  */
-export function createConsoleStaticPlugin(distPath: string, options?: { isDev?: boolean }) {
+export function createConsoleStaticPlugin(distPath: string, options?: { isDev?: boolean; rootRedirect?: boolean }) {
   return {
     name: 'com.objectstack.console-static',
 
@@ -124,10 +124,13 @@ export function createConsoleStaticPlugin(distPath: string, options?: { isDev?:
 
       const readIndexHtml = () => fs.readFileSync(indexPath, 'utf-8');
 
-      // In dev mode, the Console is the default UI surface — root `/`
-      // redirects here. Mirrors the convention Studio used to own; we now
-      // prefer the Console because it is the opinionated end-user surface.
-      if (options?.isDev) {
+      // The Console is the default end-user surface — root `/` redirects
+      // here whenever the Console is mounted (`rootRedirect !== false`).
+      // Mirrors the studio plugin's `rootRedirect` option. The CLI's
+      // serve.ts gates whether the Console mounts at all via `--no-console`
+      // / `OS_DISABLE_CONSOLE=1`; once mounted, claiming `/` is the
+      // intended behaviour in both dev and production deployments.
+      if (options?.rootRedirect !== false) {
         app.get('/', (c: any) => c.redirect(`${CONSOLE_PATH}/`));
       }
 
diff --git a/packages/runtime/src/http-dispatcher.ts b/packages/runtime/src/http-dispatcher.ts
@@ -1753,7 +1753,7 @@ export class HttpDispatcher {
                     try {
                         const orgRow = await findOne('sys_organization', { id: req.organization_id });
                         const orgSlug = orgRow?.slug || req.organization_id;
-                        const rootDomain = getEnv('ROOT_DOMAIN', 'objectstack.app');
+                        const rootDomain = getEnv('OS_ROOT_DOMAIN') ?? getEnv('ROOT_DOMAIN', 'objectstack.app');
                         computedHostname = `${orgSlug}-${shortId}.${rootDomain}`;
                     } catch {
                         // Fallback if sys_organization doesn't exist
diff --git a/packages/services/service-cloud/src/cloud-artifact-helpers.ts b/packages/services/service-cloud/src/cloud-artifact-helpers.ts
@@ -141,6 +141,116 @@ export async function readProjectCredentials(driver: IDataDriver, projectId: str
     }
 }
 
+// ---------------------------------------------------------------------------
+// Publish helper — shared by POST /cloud/projects/:id/metadata and the
+// MultiProjectPlugin template seeder. Uploads the artifact bundle to the
+// configured storage adapter and inserts/refreshes a sys_project_revision
+// row so the next GET /cloud/projects/:id/artifact resolves it.
+// ---------------------------------------------------------------------------
+
+export interface PublishProjectRevisionParams {
+    /** Control-plane data driver (sys_project / sys_project_revision). */
+    driver: IDataDriver;
+    /** Storage adapter (R2, S3, local FS) — must implement upload/exists. */
+    storage: { upload: (key: string, data: Buffer) => Promise<void>; exists: (key: string) => Promise<boolean> };
+    /** Storage adapter name persisted on the revision row. */
+    storageAdapter: string;
+    /** Storage key prefix (defaults to `artifacts`). */
+    keyPrefix?: string;
+    /** Project row (id + organization_id are required). */
+    project: { id: string; organization_id?: string | null };
+    /** Artifact body — already-shaped JSON object (will be JSON-serialised). */
+    bundle: any;
+    /** Optional commit id override; defaults to the first 16 hex chars of the body hash. */
+    commitId?: string;
+    /** Branch name for branch-head book-keeping; defaults to `main`. */
+    branch?: string;
+    /** Optional note attached to the revision. */
+    note?: string;
+}
+
+export interface PublishProjectRevisionResult {
+    commitId: string;
+    revisionId: string;
+    storageKey: string;
+    checksum: string;
+    created: boolean;
+}
+
+export async function publishProjectRevision(
+    params: PublishProjectRevisionParams,
+): Promise<PublishProjectRevisionResult> {
+    const { driver, storage, storageAdapter, project, bundle, note } = params;
+    const keyPrefix = params.keyPrefix ?? 'artifacts';
+    const branch = (params.branch ?? 'main').trim() || 'main';
+
+    const bodyStr = JSON.stringify(bundle ?? {});
+    const bodyBuf = Buffer.from(bodyStr, 'utf-8');
+    const fullHash = sha256Hex(bodyStr);
+    const commitId = params.commitId ?? fullHash.slice(0, 16);
+    const checksum = (bundle as any)?.checksum && typeof (bundle as any).checksum === 'string'
+        ? (bundle as any).checksum
+        : fullHash;
+    const orgId = project.organization_id ?? null;
+    const storageKey = orgId
+        ? `${keyPrefix}/orgs/${orgId}/projects/${project.id}/${commitId}.json`
+        : `${keyPrefix}/${project.id}/${commitId}.json`;
+
+    if (!(await storage.exists(storageKey))) {
+        await storage.upload(storageKey, bodyBuf);
+    }
+
+    let created = false;
+    let revisionId: string;
+    const existing = await (driver.findOne as any)('sys_project_revision', {
+        where: { project_id: project.id, commit_id: commitId },
+    });
+    if (existing) {
+        revisionId = existing.id;
+        if (!existing.is_current) {
+            try {
+                const oldCurrent = await (driver.findOne as any)('sys_project_revision', {
+                    where: { project_id: project.id, is_current: true },
+                });
+                if (oldCurrent && oldCurrent.id !== existing.id) {
+                    await (driver.update as any)('sys_project_revision', oldCurrent.id, { is_current: false });
+                }
+            } catch { /* table may not exist yet */ }
+            await (driver.update as any)('sys_project_revision', existing.id, { is_current: true });
+        }
+    } else {
+        try {
+            const oldCurrent = await (driver.findOne as any)('sys_project_revision', {
+                where: { project_id: project.id, is_current: true },
+            });
+            if (oldCurrent) {
+                await (driver.update as any)('sys_project_revision', oldCurrent.id, { is_current: false });
+            }
+        } catch { /* ok */ }
+        const { randomUUID } = await import('node:crypto');
+        revisionId = randomUUID();
+        await (driver.create as any)('sys_project_revision', {
+            id: revisionId,
+            project_id: project.id,
+            commit_id: commitId,
+            checksum,
+            storage_key: storageKey,
+            storage_adapter: storageAdapter,
+            size_bytes: bodyBuf.byteLength,
+            built_at: (bundle as any)?.builtAt ?? new Date().toISOString(),
+            built_with: (bundle as any)?.builtWith ? JSON.stringify((bundle as any).builtWith) : null,
+            published_at: new Date().toISOString(),
+            note: note ?? null,
+            is_current: true,
+            branch,
+            is_branch_head: true,
+        });
+        created = true;
+    }
+
+    return { commitId, revisionId, storageKey, checksum, created };
+}
+
 export function buildRuntimeBlock(project: SysProjectRow, cred: SysCredentialRow | null) {
     const driver = (cred?.database_driver ?? project.database_driver ?? '').trim();
     const url = (cred?.database_url ?? project.database_url ?? '').trim();
diff --git a/packages/services/service-cloud/src/control-plane-preset.ts b/packages/services/service-cloud/src/control-plane-preset.ts
@@ -210,6 +210,16 @@ export function createControlPlanePlugins(cfg: ControlPlanePresetConfig): any[]
       if (isDev && !trustedOrigins.includes('http://localhost:*')) {
         trustedOrigins.push('http://localhost:*');
       }
+      // Per-project subdomains: when OS_ROOT_DOMAIN is set (multi-project
+      // hosting under `*.<root>`), every project hostname must be trusted
+      // by better-auth or sign-up/sign-in / cookie operations are blocked
+      // with "Invalid origin". The wildcard mirrors the OS_COOKIE_DOMAIN
+      // semantics — they are always set together.
+      const rootDomain = (process.env.OS_ROOT_DOMAIN ?? process.env.ROOT_DOMAIN)?.trim();
+      if (rootDomain) {
+        const wildcard = `https://*.${rootDomain}`;
+        if (!trustedOrigins.includes(wildcard)) trustedOrigins.push(wildcard);
+      }
 
       return new AuthPlugin({
         secret: cfg.authSecret,
diff --git a/packages/services/service-cloud/src/multi-project-plugin.ts b/packages/services/service-cloud/src/multi-project-plugin.ts
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
