fix(rest): resolve hostname → projectId in resolveExecCtx

resolveProtocol already mapped hostname → projectId for multi-tenant
hosts, but resolveExecCtx didn't. Result: on objectos, every
authenticated request to /api/v1/data/:object (unscoped URL) returned
401 even with a valid cookie/Bearer token because the auth service
was looked up against projectId=undefined.

Mirror the hostname/header resolution at the top of resolveExecCtx
so per-project AuthManager.getApi().getSession({headers}) is called
on the right kernel. Verified on local + CF after rebuild.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: hotlong

ROADMAP.md

@@ -56,7 +56,7 @@ Code that exists and matches the intended architecture. Do not regress these.
 | Studio Flow Viewer + Flow Test Runner + Flow Runs panel | [apps/studio/src/components/FlowViewer.tsx](apps/studio/src/components/FlowViewer.tsx) |
 | Automation: flow auto-discovery from ObjectQL registry | [packages/services/service-automation/src/plugin.ts](packages/services/service-automation/src/plugin.ts) |
 | **D1** ObjectOS metadata DB bridge removed - `MetadataPlugin` no longer registers `sys_metadata` / `sys_metadata_history` or auto-bridges ObjectQL to `DatabaseLoader` | [packages/metadata/src/plugin.ts](packages/metadata/src/plugin.ts) |
-| **S1** REST `requireAuth` gate (resolved 2026-05-17) — anonymous `/api/v1/data/*` returns 401 when `auth` tier is enabled (CRUD + batch routes both gated); auto-enabled by CLI when `tierEnabled('auth')`. Plugs the CF data-leak reported via crm.objectos.app. | [packages/rest/src/rest-server.ts](packages/rest/src/rest-server.ts), [packages/cli/src/commands/serve.ts](packages/cli/src/commands/serve.ts) |
+| **S1** REST `requireAuth` gate (resolved 2026-05-18) — anonymous `/api/v1/data/*` returns 401 on multi-tenant ObjectOS hosts (CRUD + batch routes both gated). Auto-enabled by CLI when `tierEnabled('auth')`; force-enabled on `createObjectOSStack` since project artifacts own auth per-tenant. Verified live on crm.objectos.app / app.objectos.app — anonymous reads + writes now 401 (were leaking before). | [packages/rest/src/rest-server.ts](packages/rest/src/rest-server.ts), [packages/runtime/src/cloud/objectos-stack.ts](packages/runtime/src/cloud/objectos-stack.ts), [packages/cli/src/commands/serve.ts](packages/cli/src/commands/serve.ts) |
 
 ---
 

apps/objectos/wrangler.toml

@@ -44,7 +44,7 @@ compatibility_flags = ["nodejs_compat"]
 # rebuild + re-push to ship a new version, then run `wrangler deploy`.
 [[containers]]
 class_name = "ObjectOSContainer"
-image = "registry.cloudflare.com/2846eb40a60f4738e292b90dcd8cce10/objectos:7dcde27c"
+image = "registry.cloudflare.com/2846eb40a60f4738e292b90dcd8cce10/objectos:9138536d"
 max_instances = 5
 instance_type = "standard-1"
 

packages/rest/src/rest-server.ts

@@ -366,6 +366,32 @@ export class RestServer {
      */
     private async resolveExecCtx(projectId: string | undefined, req: any): Promise<any | undefined> {
         try {
+            // For multi-tenant hosts (objectos), incoming requests on unscoped
+            // URLs like `/api/v1/data/:object` arrive with `projectId === undefined`.
+            // The route's protocol resolver already maps hostname → projectId
+            // (see resolveProtocol). We mirror that here so getSession() can
+            // find the right per-project auth service. Without this, the
+            // hostname-routed requests fall through to defaultProjectIdProvider/
+            // authServiceProvider (neither of which is wired in objectos) and
+            // every authenticated user sees 401.
+            if (!projectId && req && this.envRegistry && this.kernelManager) {
+                const host = this.extractHostname(req);
+                if (host) {
+                    try {
+                        const result = await this.envRegistry.resolveByHostname(host);
+                        if (result?.projectId) projectId = result.projectId;
+                    } catch { /* fall through */ }
+                }
+                if (!projectId && typeof this.envRegistry.resolveById === 'function') {
+                    const headerVal = this.extractProjectIdHeader(req);
+                    if (headerVal) {
+                        try {
+                            const driver = await this.envRegistry.resolveById(headerVal);
+                            if (driver) projectId = headerVal;
+                        } catch { /* fall through */ }
+                    }
+                }
+            }
             // Look up the auth service in the right kernel. For unscoped
             // single-project apps the kernelManager will hand us the lone
             // tenant kernel; for multi-project hosts we use the resolved