@objectstack/cli 7.5.0 → 7.6.0

package/dist/commands/plugin/publish.js

@@ -0,0 +1,211 @@
+// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.
+/**
+ * `os plugin publish` — upload a signed `.osplugin` to ObjectStack Cloud
+ * (ADR-0025 §3.4 step 3). Completes the build → sign → publish pipeline.
+ *
+ * Flow:
+ *   1. Read the `.osplugin` bytes + the detached `.sig` (publisher signature).
+ *   2. Extract the compiled `objectstack.plugin.json` from inside the
+ *      artifact (id / version / name / runtime / permissions / integrity).
+ *   3. POST /cloud/packages          — ensure the sys_package row exists.
+ *   4. POST /cloud/packages/:id/versions with `artifact_kind: 'plugin'`,
+ *      the base64 artifact, the declared manifest, the signature, and the
+ *      whole-artifact sha256 checksum. The cloud verifies the signature,
+ *      audits permissions/runtime tier, stores the blob, and sets
+ *      listing_status=pending_review (or approved with --auto-approve).
+ *
+ * The platform counter-signature is written by the marketplace review/approve
+ * flow, not here.
+ */
+import { readFile, readdir } from 'node:fs/promises';
+import { existsSync } from 'node:fs';
+import { resolve as resolvePath, basename } from 'node:path';
+import { Args, Command, Flags } from '@oclif/core';
+import { printHeader, printKV, printSuccess, printError, printStep } from '../../utils/format.js';
+import { DEFAULT_CLOUD_URL, tryReadCloudConfig } from '../../utils/cloud-config.js';
+import { OSPLUGIN_EXT, sha256Hex, readOspluginManifest } from '../../utils/osplugin.js';
+export default class PluginPublish extends Command {
+    static description = 'Publish a signed .osplugin to ObjectStack Cloud (ADR-0025 §3.4)';
+    static examples = [
+        '$ os plugin publish ./com.acme.stripe-1.0.0.osplugin --visibility marketplace --submit',
+        '$ os plugin publish ./x.osplugin --sig ./x.osplugin.sig --org org_123',
+        '$ OS_CLOUD_URL=http://localhost:4000 os plugin publish ./x.osplugin --auto-approve',
+    ];
+    static args = {
+        artifact: Args.string({ description: 'Path to the .osplugin (default: the single .osplugin in cwd)', required: false }),
+    };
+    static flags = {
+        server: Flags.string({ char: 's', description: 'Cloud control-plane URL', env: 'OS_CLOUD_URL', default: DEFAULT_CLOUD_URL }),
+        token: Flags.string({ char: 't', description: 'Cloud API key (bearer)', env: 'OS_CLOUD_API_KEY' }),
+        sig: Flags.string({ description: 'Path to the detached signature (default: <artifact>.sig)' }),
+        'manifest-id': Flags.string({ description: 'Override package id (default: from the manifest)' }),
+        'display-name': Flags.string({ description: 'Marketplace display name (default: manifest.name)' }),
+        visibility: Flags.string({ description: 'Who can see/install', options: ['private', 'org', 'marketplace'], default: 'private' }),
+        org: Flags.string({ description: 'owner_org_id (service mode)', env: 'OS_ORG_ID' }),
+        note: Flags.string({ char: 'n', description: 'Release notes (markdown ok)' }),
+        'pre-release': Flags.boolean({ description: 'Mark as a pre-release', default: false }),
+        submit: Flags.boolean({ description: 'Submit for marketplace review after publish', default: false }),
+        'auto-approve': Flags.boolean({ description: 'Platform admin only: skip review queue', default: false }),
+        timeout: Flags.integer({ description: 'HTTP timeout (ms, 0 disables)', env: 'OS_CLOUD_TIMEOUT_MS', default: 120_000 }),
+    };
+    async run() {
+        const { args, flags } = await this.parse(PluginPublish);
+        printHeader('Publish Plugin');
+        // 1. Resolve the artifact path. ────────────────────────────────────
+        let artifactPath;
+        if (args.artifact) {
+            artifactPath = resolvePath(process.cwd(), args.artifact);
+        }
+        else {
+            const here = (await readdir(process.cwd())).filter((f) => f.endsWith(OSPLUGIN_EXT));
+            if (here.length === 0) {
+                printError(`No ${OSPLUGIN_EXT} found in cwd. Run \`os plugin build\` first, or pass a path.`);
+                this.exit(1);
+                return;
+            }
+            if (here.length > 1) {
+                printError(`Multiple ${OSPLUGIN_EXT} files found — pass one explicitly.`);
+                this.exit(1);
+                return;
+            }
+            artifactPath = resolvePath(process.cwd(), here[0]);
+        }
+        if (!existsSync(artifactPath)) {
+            printError(`Artifact not found: ${artifactPath}`);
+            this.exit(1);
+            return;
+        }
+        const bytes = new Uint8Array(await readFile(artifactPath));
+        const checksum = sha256Hex(bytes);
+        const base64 = Buffer.from(bytes).toString('base64');
+        // 2. Extract the compiled manifest from inside the artifact. ────────
+        let manifest;
+        try {
+            manifest = readOspluginManifest(bytes);
+        }
+        catch (err) {
+            printError(`Cannot read manifest from artifact: ${err?.message ?? err}`);
+            this.exit(1);
+            return;
+        }
+        const id = String(flags['manifest-id'] ?? manifest.id ?? '').trim();
+        const version = String(manifest.version ?? '').trim();
+        const displayName = String(flags['display-name'] ?? manifest.name ?? id).trim();
+        if (!id || !version) {
+            printError('Artifact manifest is missing id or version.');
+            this.exit(1);
+            return;
+        }
+        printStep(`${id}@${version} (${(bytes.byteLength / 1024).toFixed(1)} KB, runtime: ${manifest.runtime ?? 'unset'})`);
+        // 3. Detached publisher signature. ─────────────────────────────────
+        const sigPath = resolvePath(process.cwd(), flags.sig ?? `${artifactPath}.sig`);
+        let signature;
+        if (existsSync(sigPath)) {
+            signature = (await readFile(sigPath, 'utf-8')).trim();
+            printKV('  Signature', signature.length > 48 ? signature.slice(0, 48) + '…' : signature);
+        }
+        else {
+            printStep(`No signature sidecar at ${basename(sigPath)} — publishing UNSIGNED (a "node"-tier plugin will be rejected by the server unless the publisher is verified). Run \`os plugin sign\` first.`);
+        }
+        // 4. Auth + server URL (same precedence as `os package publish`). ───
+        let token = flags.token ?? process.env.OS_TOKEN ?? undefined;
+        let baseUrl = flags.server.replace(/\/+$/, '');
+        const serverFlagWasDefault = !process.env.OS_CLOUD_URL && baseUrl === DEFAULT_CLOUD_URL;
+        if (!token || serverFlagWasDefault) {
+            const stored = await tryReadCloudConfig();
+            if (!token && stored?.token)
+                token = stored.token;
+            if (serverFlagWasDefault && stored?.url)
+                baseUrl = stored.url.replace(/\/+$/, '');
+        }
+        if (!token) {
+            printError('Not logged in. Run `os cloud login`, or pass --token / set $OS_CLOUD_API_KEY.');
+            this.exit(1);
+            return;
+        }
+        // 5. Register the package row. ──────────────────────────────────────
+        printStep(`Registering package '${id}'...`);
+        const pkgBody = { manifest_id: id, display_name: displayName, visibility: flags.visibility };
+        if (flags.org)
+            pkgBody.owner_org_id = flags.org;
+        if (typeof manifest.description === 'string')
+            pkgBody.description = manifest.description;
+        const pkgRes = await this.postJson(`${baseUrl}/api/v1/cloud/packages`, pkgBody, token, flags.timeout);
+        if (!pkgRes.ok) {
+            printError(`Register package failed (${pkgRes.status}): ${pkgRes.error}`);
+            this.exit(1);
+            return;
+        }
+        const pkg = pkgRes.body?.data ?? pkgRes.body;
+        printSuccess(`${pkg?.created ? 'Created' : 'Updated'} sys_package ${pkg?.id} (${id})`);
+        // 6. Publish the plugin version. ────────────────────────────────────
+        printStep(`Publishing version ${version}...`);
+        const verBody = {
+            version,
+            artifact_kind: 'plugin',
+            osplugin: base64,
+            plugin_manifest: manifest,
+            artifact_checksum: checksum,
+            is_pre_release: flags['pre-release'] || /-(alpha|beta|rc|dev|preview|staging|pr)/i.test(version),
+        };
+        if (signature)
+            verBody.signature = signature;
+        if (flags.note)
+            verBody.release_notes = flags.note;
+        if (flags.submit)
+            verBody.submit_for_review = true;
+        if (flags['auto-approve'])
+            verBody.auto_approve = true;
+        const verRes = await this.postJson(`${baseUrl}/api/v1/cloud/packages/${encodeURIComponent(pkg.id)}/versions`, verBody, token, flags.timeout);
+        if (!verRes.ok) {
+            printError(`Publish version failed (${verRes.status}): ${verRes.error}`);
+            const violations = Array.isArray(verRes.body?.violations) ? verRes.body.violations : [];
+            if (violations.length > 0) {
+                console.log('\n  Violations:');
+                for (const v of violations)
+                    console.log(`    • ${v}`);
+            }
+            this.exit(1);
+            return;
+        }
+        const ver = verRes.body?.data ?? verRes.body;
+        printSuccess('Plugin version published');
+        printKV('  Version', String(ver?.version ?? version));
+        printKV('  Listing status', String(ver?.listing_status ?? (flags.submit ? 'pending_review' : 'draft')));
+        printKV('  Artifact sha256', checksum);
+        if (!flags.submit && !flags['auto-approve'] && flags.visibility === 'marketplace') {
+            printStep('Re-run with --submit to send this version for marketplace review.');
+        }
+    }
+    /** Tiny fetch wrapper returning a normalized envelope; honours a timeout. */
+    async postJson(url, body, token, timeoutMs) {
+        const controller = new AbortController();
+        const timer = timeoutMs > 0 ? setTimeout(() => controller.abort(), timeoutMs) : undefined;
+        try {
+            const response = await fetch(url, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${token}` },
+                body: JSON.stringify(body),
+                signal: controller.signal,
+            });
+            let parsed = null;
+            try {
+                parsed = await response.json();
+            }
+            catch { /* empty body */ }
+            if (!response.ok) {
+                const errMsg = parsed?.error?.message ?? parsed?.error ?? response.statusText;
+                return { ok: false, status: response.status, body: parsed, error: String(errMsg) };
+            }
+            return { ok: true, status: response.status, body: parsed };
+        }
+        catch (err) {
+            return { ok: false, status: 0, body: null, error: err?.message ?? String(err) };
+        }
+        finally {
+            if (timer)
+                clearTimeout(timer);
+        }
+    }
+}
+//# sourceMappingURL=publish.js.map

package/dist/commands/plugin/publish.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"publish.js","sourceRoot":"","sources":["../../../src/commands/plugin/publish.ts"],"names":[],"mappings":"AAAA,yEAAyE;AAEzE;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClG,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACpF,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAIxF,MAAM,CAAC,OAAO,OAAO,aAAc,SAAQ,OAAO;IAChD,MAAM,CAAU,WAAW,GACzB,iEAAiE,CAAC;IAEpE,MAAM,CAAU,QAAQ,GAAG;QACzB,wFAAwF;QACxF,uEAAuE;QACvE,oFAAoF;KACrF,CAAC;IAEF,MAAM,CAAU,IAAI,GAAG;QACrB,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,8DAA8D,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;KACxH,CAAC;IAEF,MAAM,CAAU,KAAK,GAAG;QACtB,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,yBAAyB,EAAE,GAAG,EAAE,cAAc,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC;QAC5H,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,wBAAwB,EAAE,GAAG,EAAE,kBAAkB,EAAE,CAAC;QAClG,GAAG,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,0DAA0D,EAAE,CAAC;QAC9F,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,kDAAkD,EAAE,CAAC;QAChG,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,mDAAmD,EAAE,CAAC;QAClG,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,qBAAqB,EAAE,OAAO,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,aAAa,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;QAChI,GAAG,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,6BAA6B,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC;QACnF,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,6BAA6B,EAAE,CAAC;QAC7E,aAAa,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,WAAW,EAAE,uBAAuB,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QACtF,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,WAAW,EAAE,6CAA6C,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QACrG,cAAc,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,WAAW,EAAE,wCAAwC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QACxG,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,WAAW,EAAE,+BAA+B,EAAE,GAAG,EAAE,qBAAqB,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;KACvH,CAAC;IAEF,KAAK,CAAC,GAAG;QACP,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QACxD,WAAW,CAAC,gBAAgB,CAAC,CAAC;QAE9B,qEAAqE;QACrE,IAAI,YAAoB,CAAC;QACzB,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,YAAY,GAAG,WAAW,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC3D,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,GAAG,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC;YACpF,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAAC,UAAU,CAAC,MAAM,YAAY,+DAA+D,CAAC,CAAC;gBAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAAC,OAAO;YAAC,CAAC;YAC/I,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAAC,UAAU,CAAC,YAAY,YAAY,qCAAqC,CAAC,CAAC;gBAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAAC,OAAO;YAAC,CAAC;YACzH,YAAY,GAAG,WAAW,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACrD,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YAAC,UAAU,CAAC,uBAAuB,YAAY,EAAE,CAAC,CAAC;YAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QAE3G,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC;QAC3D,MAAM,QAAQ,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;QAClC,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAErD,sEAAsE;QACtE,IAAI,QAA6B,CAAC;QAClC,IAAI,CAAC;YACH,QAAQ,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;QACzC,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,UAAU,CAAC,uCAAuC,GAAG,EAAE,OAAO,IAAI,GAAG,EAAE,CAAC,CAAC;YACzE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACb,OAAO;QACT,CAAC;QACD,MAAM,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACpE,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACtD,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAChF,IAAI,CAAC,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;YAAC,UAAU,CAAC,6CAA6C,CAAC,CAAC;YAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QACzG,SAAS,CAAC,GAAG,EAAE,IAAI,OAAO,KAAK,CAAC,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,iBAAiB,QAAQ,CAAC,OAAO,IAAI,OAAO,GAAG,CAAC,CAAC;QAEpH,qEAAqE;QACrE,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,KAAK,CAAC,GAAG,IAAI,GAAG,YAAY,MAAM,CAAC,CAAC;QAC/E,IAAI,SAA6B,CAAC;QAClC,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YACxB,SAAS,GAAG,CAAC,MAAM,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACtD,OAAO,CAAC,aAAa,EAAE,SAAS,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC3F,CAAC;aAAM,CAAC;YACN,SAAS,CAAC,2BAA2B,QAAQ,CAAC,OAAO,CAAC,8IAA8I,CAAC,CAAC;QACxM,CAAC;QAED,sEAAsE;QACtE,IAAI,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,SAAS,CAAC;QAC7D,IAAI,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC/C,MAAM,oBAAoB,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,OAAO,KAAK,iBAAiB,CAAC;QACxF,IAAI,CAAC,KAAK,IAAI,oBAAoB,EAAE,CAAC;YACnC,MAAM,MAAM,GAAG,MAAM,kBAAkB,EAAE,CAAC;YAC1C,IAAI,CAAC,KAAK,IAAI,MAAM,EAAE,KAAK;gBAAE,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;YAClD,IAAI,oBAAoB,IAAI,MAAM,EAAE,GAAG;gBAAE,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,IAAI,CAAC,KAAK,EAAE,CAAC;YAAC,UAAU,CAAC,+EAA+E,CAAC,CAAC;YAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QAElI,sEAAsE;QACtE,SAAS,CAAC,wBAAwB,EAAE,MAAM,CAAC,CAAC;QAC5C,MAAM,OAAO,GAAwB,EAAE,WAAW,EAAE,EAAE,EAAE,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC;QAClH,IAAI,KAAK,CAAC,GAAG;YAAE,OAAO,CAAC,YAAY,GAAG,KAAK,CAAC,GAAG,CAAC;QAChD,IAAI,OAAO,QAAQ,CAAC,WAAW,KAAK,QAAQ;YAAE,OAAO,CAAC,WAAW,GAAG,QAAQ,CAAC,WAAW,CAAC;QACzF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,OAAO,wBAAwB,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QACtG,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YAAC,UAAU,CAAC,4BAA4B,MAAM,CAAC,MAAM,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;YAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QACpH,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,EAAE,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC;QAC7C,YAAY,CAAC,GAAG,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,gBAAgB,GAAG,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;QAEvF,sEAAsE;QACtE,SAAS,CAAC,sBAAsB,OAAO,KAAK,CAAC,CAAC;QAC9C,MAAM,OAAO,GAAwB;YACnC,OAAO;YACP,aAAa,EAAE,QAAQ;YACvB,QAAQ,EAAE,MAAM;YAChB,eAAe,EAAE,QAAQ;YACzB,iBAAiB,EAAE,QAAQ;YAC3B,cAAc,EAAE,KAAK,CAAC,aAAa,CAAC,IAAI,0CAA0C,CAAC,IAAI,CAAC,OAAO,CAAC;SACjG,CAAC;QACF,IAAI,SAAS;YAAE,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC;QAC7C,IAAI,KAAK,CAAC,IAAI;YAAE,OAAO,CAAC,aAAa,GAAG,KAAK,CAAC,IAAI,CAAC;QACnD,IAAI,KAAK,CAAC,MAAM;YAAE,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;QACnD,IAAI,KAAK,CAAC,cAAc,CAAC;YAAE,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;QAEvD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAChC,GAAG,OAAO,0BAA0B,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,CACzG,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,UAAU,CAAC,2BAA2B,MAAM,CAAC,MAAM,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;YACzE,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;YACxF,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC1B,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;gBAC/B,KAAK,MAAM,CAAC,IAAI,UAAU;oBAAE,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YACxD,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACb,OAAO;QACT,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,EAAE,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC;QAC7C,YAAY,CAAC,0BAA0B,CAAC,CAAC;QACzC,OAAO,CAAC,WAAW,EAAE,MAAM,CAAC,GAAG,EAAE,OAAO,IAAI,OAAO,CAAC,CAAC,CAAC;QACtD,OAAO,CAAC,kBAAkB,EAAE,MAAM,CAAC,GAAG,EAAE,cAAc,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QACxG,OAAO,CAAC,mBAAmB,EAAE,QAAQ,CAAC,CAAC;QACvC,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,KAAK,CAAC,UAAU,KAAK,aAAa,EAAE,CAAC;YAClF,SAAS,CAAC,mEAAmE,CAAC,CAAC;QACjF,CAAC;IACH,CAAC;IAED,6EAA6E;IACrE,KAAK,CAAC,QAAQ,CAAC,GAAW,EAAE,IAAa,EAAE,KAAa,EAAE,SAAiB;QACjF,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1F,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;gBAChC,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;gBACjF,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;gBAC1B,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CAAC,CAAC;YACH,IAAI,MAAM,GAAQ,IAAI,CAAC;YACvB,IAAI,CAAC;gBAAC,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,gBAAgB,CAAC,CAAC;YAClE,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,MAAM,GAAG,MAAM,EAAE,KAAK,EAAE,OAAO,IAAI,MAAM,EAAE,KAAK,IAAI,QAAQ,CAAC,UAAU,CAAC;gBAC9E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YACrF,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAC7D,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;QAClF,CAAC;gBAAS,CAAC;YACT,IAAI,KAAK;gBAAE,YAAY,CAAC,KAAK,CAAC,CAAC;QACjC,CAAC;IACH,CAAC"}

package/dist/commands/plugin/sign.d.ts

@@ -0,0 +1,15 @@
+import { Command } from '@oclif/core';
+export default class PluginSign extends Command {
+    static description: string;
+    static examples: string[];
+    static args: {
+        artifact: import("@oclif/core/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        key: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        'key-id': import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        out: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+    };
+    run(): Promise<void>;
+}
+//# sourceMappingURL=sign.d.ts.map

package/dist/commands/plugin/sign.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sign.d.ts","sourceRoot":"","sources":["../../../src/commands/plugin/sign.ts"],"names":[],"mappings":"AAmBA,OAAO,EAAQ,OAAO,EAAS,MAAM,aAAa,CAAC;AAKnD,MAAM,CAAC,OAAO,OAAO,UAAW,SAAQ,OAAO;IAC7C,OAAgB,WAAW,SAC6C;IAExE,OAAgB,QAAQ,WAGtB;IAEF,OAAgB,IAAI;;MAElB;IAEF,OAAgB,KAAK;;;;MAcnB;IAEI,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;CA2D3B"}

package/dist/commands/plugin/sign.js

@@ -0,0 +1,102 @@
+// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.
+/**
+ * `os plugin sign` — produce a publisher signature over a built `.osplugin`
+ * (ADR-0025 §3.4 step 2, framework F3).
+ *
+ * The signature is DETACHED and computed over the exact artifact bytes that
+ * will be uploaded — the same bytes the cloud control plane verifies at
+ * publish time (`verifyPublisherSignature`) and the runtime re-verifies at
+ * materialize time. It is emitted as `ed25519:<keyId>:<base64url>` and
+ * written to a `<artifact>.sig` sidecar (and printed), to be passed as the
+ * `signature` field when publishing. The artifact itself is NOT modified, so
+ * signing is idempotent and the signed bytes are exactly the built bytes.
+ */
+import { readFile, writeFile } from 'node:fs/promises';
+import { existsSync } from 'node:fs';
+import { createPrivateKey, createPublicKey } from 'node:crypto';
+import { resolve as resolvePath } from 'node:path';
+import { Args, Command, Flags } from '@oclif/core';
+import { parseSignature, signPayload, verifyPayload } from '@objectstack/core';
+import { printError, printHeader, printKV, printStep, printSuccess } from '../../utils/format.js';
+import { OSPLUGIN_EXT } from '../../utils/osplugin.js';
+export default class PluginSign extends Command {
+    static description = 'Sign a built .osplugin with a publisher Ed25519 key (ADR-0025 §3.4)';
+    static examples = [
+        '$ os plugin sign my-plugin-1.0.0.osplugin --key ./publisher.key.pem',
+        '$ os plugin sign my-plugin-1.0.0.osplugin --key ./publisher.key.pem --key-id acme-2026',
+    ];
+    static args = {
+        artifact: Args.string({ description: 'Path to the .osplugin artifact', required: true }),
+    };
+    static flags = {
+        key: Flags.string({
+            char: 'k',
+            description: 'Path to the publisher Ed25519 private key (PKCS#8 PEM)',
+            required: true,
+        }),
+        'key-id': Flags.string({
+            description: 'Key identifier embedded in the signature (rotation handle)',
+            default: 'default',
+        }),
+        out: Flags.string({
+            char: 'o',
+            description: 'Output path for the detached signature (defaults to <artifact>.sig)',
+        }),
+    };
+    async run() {
+        const { args, flags } = await this.parse(PluginSign);
+        printHeader('Sign Plugin');
+        const artifactPath = resolvePath(process.cwd(), args.artifact);
+        if (!existsSync(artifactPath)) {
+            printError(`Artifact not found: ${args.artifact}`);
+            this.exit(1);
+            return;
+        }
+        if (!artifactPath.endsWith(OSPLUGIN_EXT)) {
+            printStep(`Warning: ${args.artifact} does not have a ${OSPLUGIN_EXT} extension`);
+        }
+        let privateKeyPem;
+        try {
+            privateKeyPem = await readFile(resolvePath(process.cwd(), flags.key), 'utf-8');
+        }
+        catch (err) {
+            printError(`Cannot read private key: ${err.message}`);
+            this.exit(1);
+            return;
+        }
+        const artifact = new Uint8Array(await readFile(artifactPath));
+        const keyId = flags['key-id'];
+        let signature;
+        try {
+            signature = signPayload(artifact, privateKeyPem, keyId);
+        }
+        catch (err) {
+            printError(`Signing failed: ${err.message}`);
+            this.exit(1);
+            return;
+        }
+        // Self-check: verify the freshly produced signature against the public
+        // half so a bad key / wrong format never ships silently.
+        try {
+            const pub = createPublicKey(createPrivateKey(privateKeyPem));
+            if (!verifyPayload(artifact, signature, pub)) {
+                printError('Self-verification of the produced signature failed.');
+                this.exit(1);
+                return;
+            }
+        }
+        catch (err) {
+            printError(`Self-verification error: ${err.message}`);
+            this.exit(1);
+            return;
+        }
+        const outPath = resolvePath(process.cwd(), flags.out ?? `${args.artifact}.sig`);
+        await writeFile(outPath, signature + '\n', 'utf-8');
+        printSuccess('Plugin signed');
+        printKV('  Artifact', args.artifact);
+        printKV('  Key ID', parseSignature(signature)?.keyId ?? keyId);
+        printKV('  Signature', signature);
+        printKV('  Sidecar', flags.out ?? `${args.artifact}.sig`);
+    }
+}
+//# sourceMappingURL=sign.js.map

package/dist/commands/plugin/sign.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sign.js","sourceRoot":"","sources":["../../../src/commands/plugin/sign.ts"],"names":[],"mappings":"AAAA,yEAAyE;AAEzE;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAChE,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAC/E,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAClG,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAEvD,MAAM,CAAC,OAAO,OAAO,UAAW,SAAQ,OAAO;IAC7C,MAAM,CAAU,WAAW,GACzB,qEAAqE,CAAC;IAExE,MAAM,CAAU,QAAQ,GAAG;QACzB,qEAAqE;QACrE,wFAAwF;KACzF,CAAC;IAEF,MAAM,CAAU,IAAI,GAAG;QACrB,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,gCAAgC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;KACzF,CAAC;IAEF,MAAM,CAAU,KAAK,GAAG;QACtB,GAAG,EAAE,KAAK,CAAC,MAAM,CAAC;YAChB,IAAI,EAAE,GAAG;YACT,WAAW,EAAE,wDAAwD;YACrE,QAAQ,EAAE,IAAI;SACf,CAAC;QACF,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC;YACrB,WAAW,EAAE,4DAA4D;YACzE,OAAO,EAAE,SAAS;SACnB,CAAC;QACF,GAAG,EAAE,KAAK,CAAC,MAAM,CAAC;YAChB,IAAI,EAAE,GAAG;YACT,WAAW,EAAE,qEAAqE;SACnF,CAAC;KACH,CAAC;IAEF,KAAK,CAAC,GAAG;QACP,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACrD,WAAW,CAAC,aAAa,CAAC,CAAC;QAE3B,MAAM,YAAY,GAAG,WAAW,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC/D,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YAC9B,UAAU,CAAC,uBAAuB,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;YACnD,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACb,OAAO;QACT,CAAC;QACD,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;YACzC,SAAS,CAAC,YAAY,IAAI,CAAC,QAAQ,oBAAoB,YAAY,YAAY,CAAC,CAAC;QACnF,CAAC;QAED,IAAI,aAAqB,CAAC;QAC1B,IAAI,CAAC;YACH,aAAa,GAAG,MAAM,QAAQ,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,CAAC;QACjF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,UAAU,CAAC,4BAA6B,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;YACjE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACb,OAAO;QACT,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,UAAU,CAAC,MAAM,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC;QAC9D,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC;QAE9B,IAAI,SAAiB,CAAC;QACtB,IAAI,CAAC;YACH,SAAS,GAAG,WAAW,CAAC,QAAQ,EAAE,aAAa,EAAE,KAAK,CAAC,CAAC;QAC1D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,UAAU,CAAC,mBAAoB,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;YACxD,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACb,OAAO;QACT,CAAC;QAED,uEAAuE;QACvE,yDAAyD;QACzD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,eAAe,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC,CAAC;YAC7D,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,SAAS,EAAE,GAAG,CAAC,EAAE,CAAC;gBAC7C,UAAU,CAAC,qDAAqD,CAAC,CAAC;gBAClE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBACb,OAAO;YACT,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,UAAU,CAAC,4BAA6B,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;YACjE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACb,OAAO;QACT,CAAC;QAED,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,KAAK,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,QAAQ,MAAM,CAAC,CAAC;QAChF,MAAM,SAAS,CAAC,OAAO,EAAE,SAAS,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;QAEpD,YAAY,CAAC,eAAe,CAAC,CAAC;QAC9B,OAAO,CAAC,YAAY,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrC,OAAO,CAAC,UAAU,EAAE,cAAc,CAAC,SAAS,CAAC,EAAE,KAAK,IAAI,KAAK,CAAC,CAAC;QAC/D,OAAO,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;QAClC,OAAO,CAAC,WAAW,EAAE,KAAK,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,QAAQ,MAAM,CAAC,CAAC;IAC5D,CAAC"}

package/dist/commands/serve.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"serve.d.ts","sourceRoot":"","sources":["../../src/commands/serve.ts"],"names":[],"mappings":"AAEA,OAAO,EAAQ,OAAO,EAAS,MAAM,aAAa,CAAC;AAuInD,MAAM,CAAC,OAAO,OAAO,KAAM,SAAQ,OAAO;IACxC,OAAgB,WAAW,SAAkM;IAE7N,OAAgB,IAAI;;MAElB;IAEF,OAAgB,KAAK;;;;;;;;MAenB;IAEF;;;;;;;;;;;;;;;;;OAiBG;IACH,MAAM,CAAC,QAAQ,CAAC,sBAAsB,EAAE,SAAS,MAAM,EAAE,CAEtD;IAEH;;;;OAIG;IACH,MAAM,CAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAIpD;IAEI,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;CAkjD3B"}
+{"version":3,"file":"serve.d.ts","sourceRoot":"","sources":["../../src/commands/serve.ts"],"names":[],"mappings":"AAEA,OAAO,EAAQ,OAAO,EAAS,MAAM,aAAa,CAAC;AAwInD,MAAM,CAAC,OAAO,OAAO,KAAM,SAAQ,OAAO;IACxC,OAAgB,WAAW,SAAkM;IAE7N,OAAgB,IAAI;;MAElB;IAEF,OAAgB,KAAK;;;;;;;;MAenB;IAEF;;;;;;;;;;;;;;;;;OAiBG;IACH,MAAM,CAAC,QAAQ,CAAC,sBAAsB,EAAE,SAAS,MAAM,EAAE,CAEtD;IAEH;;;;OAIG;IACH,MAAM,CAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAIpD;IAEI,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;CA8tD3B"}

package/dist/commands/serve.js

@@ -8,6 +8,7 @@ import { bundleRequire } from 'bundle-require';
 import { BUNDLE_REQUIRE_EXTERNALS } from '../utils/config.js';
 import { shouldBootWithLibrary } from '../utils/plugin-detection.js';
 import { readEnvWithDeprecation } from '@objectstack/types';
+import { resolveObjectStackHome } from '@objectstack/runtime';
 import { printError, printServerReady, } from '../utils/format.js';
 import { CONSOLE_PATH, resolveConsolePath, hasConsoleDist, createConsoleStaticPlugin, } from '../utils/console.js';
 import dotenvFlow from 'dotenv-flow';
@@ -1560,16 +1561,16 @@ export default class Serve extends Command {
                     }
                 }
             }
+            // Shared dev crypto provider for ALL of sys_secret (datasource creds
+            // below + secret fields after start). One instance ⇒ one key, so every
+            // encrypted secret decrypts under the same provider. Created lazily by
+            // whichever block runs first.
+            let sharedCryptoProvider = undefined;
             // ── External Datasource Federation (ADR-0015) ─────────────────
             // Federation (introspect / draft / import / validate of external
-            // tables) ships in the open framework. The runtime-UI datasource
-            // *lifecycle* (ADR-0015 Addendum — the "Add Datasource" wizard backend:
-            // create / update / remove runtime datasources) was extracted into the
-            // private `@objectstack/datasource-admin` package; a private host wires
-            // its `DatasourceAdminServicePlugin` + routes after the data/metadata
-            // services exist (see that package's README).
+            // tables) ships in the open framework.
             try {
-                const dsMod = await import('@objectstack/service-external-datasource');
+                const dsMod = await import('@objectstack/service-datasource');
                 const { ExternalDatasourceServicePlugin } = dsMod;
                 if (ExternalDatasourceServicePlugin &&
                     !hasPluginMatching(['service-external-datasource', 'ExternalDatasourceServicePlugin'])) {
@@ -1590,7 +1591,98 @@ export default class Serve extends Command {
             catch (err) {
                 const msg = err instanceof Error ? err.message : String(err);
                 if (!msg.includes('Cannot find module') && !msg.includes('ERR_MODULE_NOT_FOUND')) {
-                    console.error(`[Datasource] runtime-UI lifecycle wiring failed: ${msg}`);
+                    console.error(`[Datasource] federation wiring failed: ${msg}`);
+                }
+            }
+            // ── Runtime Datasource Admin (ADR-0015 Addendum) ──────────────
+            // The "Add Datasource" wizard backend: list / test / create / update /
+            // remove datasources defined in the UI at runtime. This is open-source
+            // *mechanism* (`@objectstack/service-datasource`); the tier line
+            // falls on which ICryptoProvider / driver factory a host injects, not on
+            // whether the UI can manage datasources. Mounted by default so a
+            // self-host runtime is a complete low-code platform out of the box.
+            //
+            // Credentials are bound through the SAME crypto provider used for
+            // `secret` fields below (`sharedCryptoProvider`), so every secret in
+            // `sys_secret` (settings, secret fields, datasource creds) shares one
+            // key. Wired BEFORE runtime.start() so the plugin's kernel:ready boot
+            // rehydration (which decrypts persisted creds) has its binder ready.
+            try {
+                const adminMod = await import('@objectstack/service-datasource');
+                const { DatasourceAdminServicePlugin, createDefaultDatasourceDriverFactory, createDatasourceSecretBinder, registerDatasourceAdminRoutes, } = adminMod;
+                if (DatasourceAdminServicePlugin &&
+                    !hasPluginMatching(['service-datasource-admin', 'DatasourceAdminServicePlugin'])) {
+                    // Lazy data-engine surface for the secret store (resolved per call
+                    // so it works whether the engine is registered as 'data' or
+                    // 'objectql', and regardless of init ordering).
+                    const resolveEngine = () => kernel.getService?.('data') ?? kernel.getService?.('objectql');
+                    const lazySecretEngine = {
+                        insert: (o, d, opt) => resolveEngine()?.insert(o, d, opt),
+                        delete: (o, opt) => resolveEngine()?.delete(o, opt),
+                        find: (o, q) => resolveEngine()?.find(o, q),
+                    };
+                    // Fail-closed binder over the shared dev crypto provider. If the
+                    // provider can't be created, leave `secrets` undefined — the plugin
+                    // then rejects secret-bearing create/update instead of storing
+                    // cleartext (by design).
+                    let secrets = undefined;
+                    try {
+                        const { LocalCryptoProvider } = await import(
+                        /* webpackIgnore: true */ '@objectstack/service-settings');
+                        // First block to touch `sharedCryptoProvider` (still undefined
+                        // here), so create it directly; the secret-field wiring below
+                        // reuses this instance so every sys_secret shares one key.
+                        sharedCryptoProvider = new LocalCryptoProvider();
+                        secrets = createDatasourceSecretBinder({
+                            engine: lazySecretEngine,
+                            cryptoProvider: sharedCryptoProvider,
+                        });
+                    }
+                    catch (cryptoErr) {
+                        // Best-effort fail-closed: leave `secrets` undefined so the plugin
+                        // rejects secret-bearing create/update rather than storing
+                        // cleartext. A production deployment with no stable key still
+                        // aborts boot loudly at the secret-field wiring below (where
+                        // LocalCryptoProvider's "Refusing to start in production" error is
+                        // rethrown), so we don't duplicate that abort here.
+                        console.warn(chalk.yellow(`  ⚠ datasource admin: no CryptoProvider (${cryptoErr?.message ?? cryptoErr}); secret-bearing datasource create/update will fail closed`));
+                    }
+                    await kernel.use(new DatasourceAdminServicePlugin({
+                        driverFactory: createDefaultDatasourceDriverFactory(),
+                        secrets,
+                    }));
+                    trackPlugin('DatasourceAdminServicePlugin');
+                    // REST routes under /api/v1/datasources. Registered via a tiny
+                    // plugin so it resolves http.server during init (same pattern as
+                    // the hostname guard above).
+                    const adminRoutePlugin = {
+                        name: 'com.objectstack.cli.datasource-admin-routes',
+                        version: '1.0.0',
+                        init: async (ctx) => {
+                            try {
+                                const httpServer = ctx.getService?.('http.server') ?? ctx.getService?.('http-server');
+                                if (!httpServer || typeof httpServer.get !== 'function') {
+                                    ctx.logger?.warn?.('[datasource-admin] http.server unavailable; REST routes not installed');
+                                    return;
+                                }
+                                registerDatasourceAdminRoutes(httpServer, ctx, '/api/v1');
+                            }
+                            catch (routeErr) {
+                                ctx.logger?.warn?.(`[datasource-admin] route registration failed: ${routeErr?.message ?? routeErr}`);
+                            }
+                        },
+                    };
+                    await kernel.use(adminRoutePlugin);
+                    trackPlugin('DatasourceAdminRoutes');
+                    if (isDev) {
+                        console.log(chalk.dim('  ↪ datasource admin: runtime UI lifecycle wired (/api/v1/datasources)'));
+                    }
+                }
+            }
+            catch (err) {
+                const msg = err instanceof Error ? err.message : String(err);
+                if (!msg.includes('Cannot find module') && !msg.includes('ERR_MODULE_NOT_FOUND')) {
+                    console.error(`[Datasource] runtime-UI admin wiring failed: ${msg}`);
                 }
             }
             // ── UI portals ────────────────────────────────────────────────
@@ -1632,30 +1724,44 @@ export default class Serve extends Command {
             // objectql's `secret` field type encrypts on write to `sys_secret`
             // and fails closed when no ICryptoProvider is registered. objectql
             // must NOT depend on a crypto implementation (layering), so the
-            // host injects one here. Dev/self-host gets an independent
-            // InMemoryCryptoProvider; production hosts swap this for a
-            // KMS/Vault-backed provider (e.g. via an env-gated branch or a
-            // dedicated plugin) before secrets are written. We resolve the
-            // data engine by its registered service name and feature-detect
-            // `setCryptoProvider` so older engines / alternate data services
-            // degrade gracefully (writing a secret then fails closed, as
-            // designed, rather than silently storing cleartext).
+            // host injects one here. Dev/self-host gets a LocalCryptoProvider
+            // (AES-256-GCM keyed off `OS_SECRET_KEY` or a persisted dev key);
+            // production hosts swap this for a KMS/Vault-backed provider (e.g.
+            // via an env-gated branch or a dedicated plugin) before secrets are
+            // written. We resolve the data engine by its registered service name
+            // and feature-detect `setCryptoProvider` so older engines / alternate
+            // data services degrade gracefully (writing a secret then fails
+            // closed, as designed, rather than silently storing cleartext).
             try {
                 const dataEngine = kernel.getService?.('data') ?? kernel.getService?.('objectql');
                 if (dataEngine && typeof dataEngine.setCryptoProvider === 'function') {
-                    const { InMemoryCryptoProvider } = await import(
-                    /* webpackIgnore: true */ '@objectstack/service-settings');
-                    dataEngine.setCryptoProvider(new InMemoryCryptoProvider());
+                    if (!sharedCryptoProvider) {
+                        const { LocalCryptoProvider } = await import(
+                        /* webpackIgnore: true */ '@objectstack/service-settings');
+                        // In production LocalCryptoProvider throws when no stable key
+                        // (OS_SECRET_KEY / persisted file) is available — the fail-loud
+                        // guard against silently minting an ephemeral key and losing
+                        // every sys_secret value after a restart. Let that error be loud:
+                        // secret writes must not proceed under an unstable key.
+                        sharedCryptoProvider = new LocalCryptoProvider();
+                    }
+                    dataEngine.setCryptoProvider(sharedCryptoProvider);
                     if (isDev) {
-                        console.log(chalk.dim('  ↪ secret fields: InMemoryCryptoProvider wired (dev) — swap for KMS/Vault in production'));
+                        console.log(chalk.dim('  ↪ secret fields: LocalCryptoProvider wired (dev) — set OS_SECRET_KEY and swap for KMS/Vault in production'));
                     }
                 }
             }
             catch (err) {
-                // Non-fatal: without a provider, secret writes fail closed by
-                // design. Surface a hint so operators know why a `secret` field
+                const msg = String(err?.message ?? err);
+                if (msg.includes('Refusing to start in production')) {
+                    // Fail-loud config error: print the actionable guidance verbatim.
+                    console.error(chalk.red(msg));
+                    throw err;
+                }
+                // Otherwise non-fatal: without a provider, secret writes fail closed
+                // by design. Surface a hint so operators know why a `secret` field
                 // write might reject.
-                console.warn(chalk.yellow(`  ⚠ secret fields: no CryptoProvider wired (${err?.message ?? err}); writing a secret field will fail closed`));
+                console.warn(chalk.yellow(`  ⚠ secret fields: no CryptoProvider wired (${msg}); writing a secret field will fail closed`));
             }
             // ── Migrate-and-exit short-circuit ─────────────────────────────
             // Out-of-band migration mode: the caller (e.g.
@@ -1693,6 +1799,18 @@ export default class Serve extends Command {
                     // best-effort only
                 }
             }
+            // Surface the dev admin seeded this boot (if any) in the banner. The
+            // seed runs in-process during runtime.start() under serve's boot-quiet
+            // window, so plugin-auth records the result on the `auth` service and
+            // we print it here, after stdout is restored. Visible in both
+            // `serve --dev` and `os dev` (the child's stdout is inherited).
+            let seededAdmin;
+            try {
+                const authSvc = kernel.getService?.('auth');
+                if (authSvc?.devSeedResult?.email)
+                    seededAdmin = authSvc.devSeedResult;
+            }
+            catch { /* auth service not present — nothing to show */ }
             // ── Clean startup summary ──────────────────────────────────────
             printServerReady({
                 port,
@@ -1705,7 +1823,41 @@ export default class Serve extends Command {
                 driverLabel: resolvedDriverLabel,
                 databaseUrl: redactDbUrl(resolvedDatabaseUrl),
                 multiTenant: String(readEnvWithDeprecation('OS_MULTI_ORG_ENABLED', 'OS_MULTI_TENANT') ?? 'false').toLowerCase() !== 'false',
+                seededAdmin,
             });
+            // ── Publish the actually-bound port ────────────────────────────
+            // `port` here is the port the HTTP server actually bound — already
+            // resolved past any dev auto-shift (busy 3000 → 3001). Publish it so
+            // supervisors and the `os dev` parent never have to guess:
+            //   • IPC: when spawned with an 'ipc' channel (as `os dev` does), the
+            //     parent learns the real port without polling.
+            //   • runtime.json: a small state file under OS_HOME for external
+            //     supervisors / health checks (pid + port + url).
+            const runtimeUrl = `http://localhost:${port}`;
+            try {
+                if (typeof process.send === 'function') {
+                    process.send({ type: 'objectstack:listening', port: Number(port), url: runtimeUrl });
+                }
+            }
+            catch { /* IPC channel closed — best-effort */ }
+            try {
+                const environmentId = process.env.OS_ENVIRONMENT_ID ?? 'env_local';
+                const runtimeFile = path.join(resolveObjectStackHome(), `runtime.${environmentId}.json`);
+                fs.mkdirSync(path.dirname(runtimeFile), { recursive: true });
+                fs.writeFileSync(runtimeFile, JSON.stringify({
+                    pid: process.pid,
+                    port: Number(port),
+                    url: runtimeUrl,
+                    environmentId,
+                    startedAt: new Date().toISOString(),
+                }, null, 2));
+                const cleanupRuntimeFile = () => { try {
+                    fs.rmSync(runtimeFile, { force: true });
+                }
+                catch { /* noop */ } };
+                process.on('exit', cleanupRuntimeFile);
+            }
+            catch { /* non-fatal — supervision file is best-effort */ }
             // Kernel already registers SIGINT/SIGTERM handlers during bootstrap.
             // No duplicate handler needed here — just keep the process alive.
         }