fix(cli/serve): wire unknown-hostname guard via Plugin so http.server is available

hotlong · Copilot · hotlong · commit d344047cc7be · 2026-05-21T00:49:20.000+08:00
The prior attempt called `kernel.getService('http.server')` immediately
after `kernel.use(serverPlugin)`, but `kernel.use()` only registers
the plugin — `init()` (which registers the http.server service) runs
later during `kernel.bootstrap()`. So getService returned undefined,
the guard install silently no-op'd, and unknown subdomains still
fell through to the Console SPA.

Wrap the middleware install in a tiny inline Plugin whose own
`init()` runs during the kernel init phase, when sibling plugins
(including HonoServerPlugin) have already registered their services.
Env-registry is resolved lazily on each request because it's
registered by ObjectOSProjectPlugin's start() phase, not init.

Also resolves merge-conflict markers in CHANGELOG.md and
package/publish.ts (kept both unreleased changelog entries; kept
the DEFAULT_CLOUD_URL constant form of the --server flag default).

Co-authored-by: Copilot &lt;223556219+Copilot@users.noreply.github.com&gt;
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -54,6 +54,33 @@ registry" workflows.
 - `packages/cli/src/utils/auth-flows.ts` — shared `loginWithBrowser` /
   `loginWithPassword` flows so runtime and cloud login paths can stay
   in sync without duplicating the RFC 8628 polling loop.
+### Added — `objectstack package publish` CLI (ADR-0006 v4 Phase B)
+
+New CLI command for uploading a compiled artifact as a versioned package
+into the caller's organization on ObjectStack Cloud. Pairs with the
+`POST /cloud/packages` + `POST /cloud/packages/:id/versions` routes
+that landed in commit `9f87aa8f`.
+
+- `packages/cli/src/commands/package/publish.ts` — new oclif command
+  `os package publish [artifact]`. Flow:
+  1. Reads `dist/objectstack.json` (or path arg).
+  2. Derives `manifest_id` (default `local.<slug>` if artifact lacks
+     a reverse-domain id) and version (default `artifact.manifest.version`
+     or a timestamped `0.0.0-dev.<ts>`).
+  3. POSTs to `/api/v1/cloud/packages` for idempotent package upsert.
+  4. POSTs to `/api/v1/cloud/packages/:id/versions` to publish the bundle
+     as a new `sys_package_version` snapshot.
+  5. Optionally auto-installs into a target env via `--env <id> --install`.
+- Flags cover the full publish surface — `--manifest-id`, `--version`,
+  `--display-name`, `--description`, `--category`, `--visibility`,
+  `--org`, `--note`, `--pre-release`, `--seed-sample-data`, `--timeout`.
+- Re-exported from `packages/cli/src/index.ts` as `PackagePublishCommand`.
+
+Closes the user-facing half of the ADR-0006 v4 unified Package path: a
+local code base can now land in the org Marketplace (or stay private)
+without manual SQL or Console clicks. The legacy `objectstack publish`
+command (writes `sys_environment_revision`) remains in place for
+backward compatibility until the loader fully migrates.
 
 ### Changed — ADR-0006 v4: drop dev-workspace Project, unify deploy on Package
 
diff --git a/packages/cli/src/commands/package/publish.ts b/packages/cli/src/commands/package/publish.ts
@@ -78,6 +78,7 @@ export default class PackagePublish extends Command {
     '$ os package publish --manifest-id com.acme.crm --version 1.2.0',
     '$ os package publish --env env_abc123 --install',
     '$ os package publish dist/objectstack.json --visibility org --note "first cut"',
+    '$ OS_CLOUD_URL=http://localhost:4000 os package publish    # local dev (apps/cloud)',
   ];
 
   static override args = {
diff --git a/packages/cli/src/commands/serve.ts b/packages/cli/src/commands/serve.ts
@@ -599,65 +599,81 @@ export default class Serve extends Command {
       // unchanged. Infra paths under /_admin or /.well-known are always
       // allowed so health checks / cert flows aren't broken.
       //
-      // Registered BEFORE config plugins so it intercepts before any
-      // route handler (including the Console static plugin) claims the
-      // request.
+      // Implemented as a Plugin so the middleware is wired during init
+      // (when http.server is available) and BEFORE start() runs on the
+      // Console static plugin / route-registering plugins. Hono's
+      // `app.use('*')` is order-independent for matching, so as long as
+      // the middleware is added before kernel:listening fires, it
+      // intercepts every request regardless of which plugin registered
+      // its handler.
       const __rootDomain = (process.env.OS_ROOT_DOMAIN || '').trim().toLowerCase();
       if (__rootDomain) {
-        try {
-          const httpServer: any = kernel.getService?.('http.server') ?? kernel.getService?.('http-server');
-          const rawApp = httpServer?.getRawApp?.();
-          if (rawApp && typeof rawApp.use === 'function') {
-            const RESERVED = new Set(['', 'cloud', 'www', 'api', 'docs', 'admin', 'app']);
-            let envRegistryRef: any;
-            const getEnvRegistry = async () => {
-              if (envRegistryRef !== undefined) return envRegistryRef;
-              try {
-                envRegistryRef = (await (kernel as any).getServiceAsync?.('env-registry'))
-                  ?? (kernel as any).getService?.('env-registry')
-                  ?? null;
-              } catch {
-                envRegistryRef = null;
-              }
-              return envRegistryRef;
-            };
-            rawApp.use('*', async (c: any, next: any) => {
-              const rawHost = c.req.header('host') || '';
-              const host = rawHost.split(':')[0].toLowerCase();
-              if (!host) return next();
-              const isPlatformHost = host === __rootDomain || host.endsWith('.' + __rootDomain);
-              if (!isPlatformHost) return next();
-              const sub = host === __rootDomain ? '' : host.slice(0, -(__rootDomain.length + 1));
-              const head = sub.split('.').pop() || '';
-              if (RESERVED.has(sub) || RESERVED.has(head)) return next();
-              const p = c.req.path;
-              if (p.startsWith('/_admin/') || p === '/_admin' || p.startsWith('/.well-known/')) {
-                return next();
-              }
-              const registry = await getEnvRegistry();
-              if (!registry || typeof registry.resolveByHostname !== 'function') {
-                return next();
-              }
-              try {
-                const hit = await registry.resolveByHostname(host);
-                if (hit) return next();
-              } catch {
-                return next();
+        const RESERVED = new Set(['', 'cloud', 'www', 'api', 'docs', 'admin', 'app']);
+        const guardPlugin: any = {
+          name: 'com.objectstack.cli.unknown-hostname-guard',
+          version: '1.0.0',
+          init: async (ctx: any) => {
+            try {
+              const httpServer: any = ctx.getService?.('http.server') ?? ctx.getService?.('http-server');
+              const rawApp = httpServer?.getRawApp?.();
+              if (!rawApp || typeof rawApp.use !== 'function') {
+                ctx.logger?.warn?.('[unknown-hostname-guard] http.server unavailable; guard not installed');
+                return;
               }
-              return c.json(
-                {
-                  error: 'environment_not_found',
-                  message: `No environment is bound to hostname '${host}'.`,
-                  hostname: host,
-                },
-                404,
-              );
-            });
-            trackPlugin('UnknownHostnameGuard');
-          }
+              const getEnvRegistry = () => {
+                try {
+                  return ctx.getService?.('env-registry') ?? null;
+                } catch {
+                  return null;
+                }
+              };
+              rawApp.use('*', async (c: any, next: any) => {
+                const rawHost = c.req.header('host') || '';
+                const host = rawHost.split(':')[0].toLowerCase();
+                if (!host) return next();
+                const isPlatformHost = host === __rootDomain || host.endsWith('.' + __rootDomain);
+                if (!isPlatformHost) return next();
+                const sub = host === __rootDomain ? '' : host.slice(0, -(__rootDomain.length + 1));
+                const head = sub.split('.').pop() || '';
+                if (RESERVED.has(sub) || RESERVED.has(head)) return next();
+                const p = c.req.path;
+                if (p.startsWith('/_admin/') || p === '/_admin' || p.startsWith('/.well-known/')) {
+                  return next();
+                }
+                // Resolve env-registry lazily on each request — it may
+                // not be registered yet at init() time (registered by
+                // ObjectOSProjectPlugin's init which runs in plugin
+                // dependency order; we don't want to rely on ordering).
+                const registry: any = getEnvRegistry();
+                if (!registry || typeof registry.resolveByHostname !== 'function') {
+                  return next();
+                }
+                try {
+                  const hit = await registry.resolveByHostname(host);
+                  if (hit) return next();
+                } catch {
+                  return next();
+                }
+                return c.json(
+                  {
+                    error: 'environment_not_found',
+                    message: `No environment is bound to hostname '${host}'.`,
+                    hostname: host,
+                  },
+                  404,
+                );
+              });
+              ctx.logger?.info?.('[unknown-hostname-guard] installed', { rootDomain: __rootDomain });
+            } catch (err: any) {
+              ctx.logger?.warn?.('[unknown-hostname-guard] install failed', { error: err?.message ?? err });
+            }
+          },
+        };
+        try {
+          await kernel.use(guardPlugin);
+          trackPlugin('UnknownHostnameGuard');
         } catch {
-          // Best-effort: if http.server isn't registered or rawApp missing,
-          // skip the guard. Falls back to legacy behaviour.
+          // Best-effort.
         }
       }
 
diff --git a/packages/platform-objects/src/identity/sys-member.object.ts b/packages/platform-objects/src/identity/sys-member.object.ts
@@ -24,7 +24,30 @@ export const SysMember = ObjectSchema.create({
   // Row-level actions: better-auth `organization/update-member-role` and
   // `organization/remove-member`. Generic CRUD is suppressed on better-auth
   // managed tables, so these are the canonical edit/delete entry points.
+  // The `add_member` toolbar action covers the admin "attach an existing
+  // user directly without sending an invitation" flow.
   actions: [
+    {
+      // Admin-only: directly attach an existing user to the active org,
+      // bypassing the invite-accept flow. Better-auth:
+      // `organization/add-member { userId, role, organizationId?, teamId? }`.
+      // organizationId/teamId default to the caller's active org/team when
+      // omitted, so we leave them as optional params.
+      name: 'add_member',
+      label: 'Add Member',
+      icon: 'user-plus',
+      variant: 'primary',
+      locations: ['list_toolbar'],
+      type: 'api',
+      target: '/api/v1/auth/organization/add-member',
+      successMessage: 'Member added',
+      refreshAfter: true,
+      params: [
+        { name: 'userId', field: 'user_id', required: true },
+        { field: 'role', required: true },
+        { name: 'organizationId', field: 'organization_id' },
+      ],
+    },
     {
       name: 'update_member_role',
       label: 'Change Role',
diff --git a/packages/platform-objects/src/identity/sys-organization.object.ts b/packages/platform-objects/src/identity/sys-organization.object.ts
@@ -74,6 +74,40 @@ export const SysOrganization = ObjectSchema.create({
       successMessage: 'Organization deleted',
       refreshAfter: true,
     },
+    {
+      // Switch the caller's active organization context. Standard
+      // better-auth endpoint; no extra params needed (org id ships as
+      // the row id). Used from the Setup list and the record header so
+      // admins can context-switch without leaving the page.
+      name: 'set_active_organization',
+      label: 'Set Active',
+      icon: 'check-circle-2',
+      variant: 'secondary',
+      mode: 'custom',
+      locations: ['list_item', 'record_header'],
+      type: 'api',
+      target: '/api/v1/auth/organization/set-active',
+      recordIdParam: 'organizationId',
+      successMessage: 'Active organization switched',
+      refreshAfter: true,
+    },
+    {
+      // Current user leaves the org. Distinct from `delete_organization`
+      // (admin-only, destroys the org) — `leave` only removes the caller's
+      // own membership. Better-auth: `organization/leave { organizationId }`.
+      name: 'leave_organization',
+      label: 'Leave Organization',
+      icon: 'log-out',
+      variant: 'danger',
+      mode: 'custom',
+      locations: ['list_item', 'record_header'],
+      type: 'api',
+      target: '/api/v1/auth/organization/leave',
+      recordIdParam: 'organizationId',
+      confirmText: 'Leave this organization? You will lose access to all of its resources.',
+      successMessage: 'You have left the organization',
+      refreshAfter: true,
+    },
   ],
 
   listViews: {
diff --git a/packages/platform-objects/src/identity/sys-team-member.object.ts b/packages/platform-objects/src/identity/sys-team-member.object.ts
@@ -20,7 +20,50 @@ export const SysTeamMember = ObjectSchema.create({
   description: 'Team membership records linking users to teams',
   titleFormat: '{user_id} in {team_id}',
   compactLayout: ['user_id', 'team_id', 'created_at'],
-  
+
+  // Custom actions calling better-auth's team-member endpoints. Generic
+  // CRUD is suppressed (managedBy: 'better-auth') so these are the
+  // canonical add/remove entry points.
+  actions: [
+    {
+      // Better-auth: `organization/add-team-member { teamId, userId }`.
+      name: 'add_team_member',
+      label: 'Add Member',
+      icon: 'user-plus',
+      variant: 'primary',
+      locations: ['list_toolbar'],
+      type: 'api',
+      target: '/api/v1/auth/organization/add-team-member',
+      successMessage: 'Team member added',
+      refreshAfter: true,
+      params: [
+        { name: 'teamId', field: 'team_id', required: true },
+        { name: 'userId', field: 'user_id', required: true },
+      ],
+    },
+    {
+      // Better-auth: `organization/remove-team-member { teamId, userId }`.
+      // The endpoint identifies the membership by the (teamId, userId)
+      // pair rather than the join-row id, so we pull both from the row
+      // via `defaultFromRow` instead of using `recordIdParam`.
+      name: 'remove_team_member',
+      label: 'Remove from Team',
+      icon: 'user-minus',
+      variant: 'danger',
+      mode: 'delete',
+      locations: ['list_item'],
+      type: 'api',
+      target: '/api/v1/auth/organization/remove-team-member',
+      confirmText: 'Remove this user from the team? They will lose any team-scoped access.',
+      successMessage: 'Team member removed',
+      refreshAfter: true,
+      params: [
+        { name: 'teamId', field: 'team_id', required: true, defaultFromRow: true },
+        { name: 'userId', field: 'user_id', required: true, defaultFromRow: true },
+      ],
+    },
+  ],
+
   fields: {
     id: Field.text({
       label: 'Team Member ID',
diff --git a/packages/platform-objects/src/identity/sys-team.object.ts b/packages/platform-objects/src/identity/sys-team.object.ts
@@ -22,6 +22,64 @@ export const SysTeam = ObjectSchema.create({
   titleFormat: '{name}',
   compactLayout: ['name', 'organization_id'],
 
+  // Custom actions calling better-auth's team endpoints. Generic CRUD is
+  // suppressed (managedBy: 'better-auth'), so these are the canonical
+  // entry points for create/update/delete.
+  actions: [
+    {
+      // Better-auth: `organization/create-team { name, organizationId? }`.
+      // organizationId defaults to the caller's active org when omitted.
+      name: 'create_team',
+      label: 'Create Team',
+      icon: 'plus',
+      variant: 'primary',
+      locations: ['list_toolbar'],
+      type: 'api',
+      target: '/api/v1/auth/organization/create-team',
+      successMessage: 'Team created',
+      refreshAfter: true,
+      params: [
+        { field: 'name', required: true },
+        { name: 'organizationId', field: 'organization_id' },
+      ],
+    },
+    {
+      // Better-auth: `organization/update-team { teamId, data: { name } }`.
+      // teamId stays flat (top-level); the user-editable params nest under
+      // `data` via bodyShape.
+      name: 'update_team',
+      label: 'Edit Team',
+      icon: 'pencil',
+      mode: 'edit',
+      locations: ['list_item'],
+      type: 'api',
+      target: '/api/v1/auth/organization/update-team',
+      recordIdParam: 'teamId',
+      bodyShape: { wrap: 'data' },
+      successMessage: 'Team updated',
+      refreshAfter: true,
+      params: [
+        { field: 'name', required: true, defaultFromRow: true },
+      ],
+    },
+    {
+      // Better-auth: `organization/remove-team { teamId, organizationId? }`.
+      // organizationId defaults to the caller's active org when omitted.
+      name: 'remove_team',
+      label: 'Delete Team',
+      icon: 'trash-2',
+      variant: 'danger',
+      mode: 'delete',
+      locations: ['list_item'],
+      type: 'api',
+      target: '/api/v1/auth/organization/remove-team',
+      recordIdParam: 'teamId',
+      confirmText: 'Delete this team? Members will lose any team-scoped access. This cannot be undone.',
+      successMessage: 'Team deleted',
+      refreshAfter: true,
+    },
+  ],
+
   listViews: {
     by_org: {
       type: 'grid',
