@objectstack/runtime 3.0.10 → 3.1.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/runtime",
-  "version": "3.0.10",
+  "version": "3.1.0",
   "license": "Apache-2.0",
   "description": "ObjectStack Core Runtime & Query Engine",
   "type": "module",
@@ -15,10 +15,10 @@
   },
   "dependencies": {
     "zod": "^4.3.6",
-    "@objectstack/core": "3.0.10",
-    "@objectstack/rest": "3.0.10",
-    "@objectstack/spec": "3.0.10",
-    "@objectstack/types": "3.0.10"
+    "@objectstack/core": "3.1.0",
+    "@objectstack/rest": "3.1.0",
+    "@objectstack/spec": "3.1.0",
+    "@objectstack/types": "3.1.0"
   },
   "devDependencies": {
     "typescript": "^5.0.0",

package/src/dispatcher-plugin.ts

@@ -199,6 +199,24 @@ export function createDispatcherPlugin(config: DispatcherPluginConfig = {}): Plu
                 }
             });
 
+            server.post(`${prefix}/packages/:id/publish`, async (req: any, res: any) => {
+                try {
+                    const result = await dispatcher.handlePackages(`/${req.params.id}/publish`, 'POST', req.body, {}, { request: req });
+                    sendResult(result, res);
+                } catch (err: any) {
+                    errorResponse(err, res);
+                }
+            });
+
+            server.post(`${prefix}/packages/:id/revert`, async (req: any, res: any) => {
+                try {
+                    const result = await dispatcher.handlePackages(`/${req.params.id}/revert`, 'POST', req.body, {}, { request: req });
+                    sendResult(result, res);
+                } catch (err: any) {
+                    errorResponse(err, res);
+                }
+            });
+
             // ── Storage ─────────────────────────────────────────────────
             server.post(`${prefix}/storage/upload`, async (req: any, res: any) => {
                 try {

package/src/http-dispatcher.test.ts

@@ -204,4 +204,389 @@ describe('HttpDispatcher', () => {
             expect(mockAutomationService.trigger).toHaveBeenCalledWith('flow_a', { data: 1 }, { request: {} });
         });
     });
+
+    // ═══════════════════════════════════════════════════════════════
+    // Async Service Resolution Tests
+    // Covers: getService awaits Promise-based (async factory) services
+    // ═══════════════════════════════════════════════════════════════
+
+    describe('Async service resolution (Promise-based injection)', () => {
+
+        describe('handleAnalytics with async service', () => {
+            it('should resolve analytics service from Promise (async factory)', async () => {
+                const mockAnalytics = {
+                    query: vi.fn().mockResolvedValue({ rows: [{ id: 1 }], total: 1 }),
+                    getMetadata: vi.fn().mockResolvedValue({ tables: ['t1'] }),
+                    generateSql: vi.fn().mockResolvedValue({ sql: 'SELECT 1' }),
+                };
+                // Inject as Promise (simulates async factory registration)
+                (kernel as any).getService = vi.fn().mockImplementation((name: string) => {
+                    if (name === 'analytics') return Promise.resolve(mockAnalytics);
+                    return null;
+                });
+
+                const result = await dispatcher.handleAnalytics('query', 'POST', { sql: 'SELECT 1' }, { request: {} });
+                expect(result.handled).toBe(true);
+                expect(result.response?.status).toBe(200);
+                expect(mockAnalytics.query).toHaveBeenCalled();
+            });
+
+            it('should handle POST /analytics/sql with async service', async () => {
+                const mockAnalytics = {
+                    generateSql: vi.fn().mockResolvedValue({ sql: 'SELECT * FROM t' }),
+                };
+                (kernel as any).getService = vi.fn().mockResolvedValue(mockAnalytics);
+
+                const result = await dispatcher.handleAnalytics('sql', 'POST', { object: 'test' }, { request: {} });
+                expect(result.handled).toBe(true);
+                expect(result.response?.status).toBe(200);
+                expect(mockAnalytics.generateSql).toHaveBeenCalled();
+            });
+
+            it('should handle GET /analytics/meta with async service', async () => {
+                const mockAnalytics = {
+                    getMetadata: vi.fn().mockResolvedValue({ tables: ['users', 'orders'] }),
+                };
+                (kernel as any).getService = vi.fn().mockResolvedValue(mockAnalytics);
+
+                const result = await dispatcher.handleAnalytics('meta', 'GET', {}, { request: {} });
+                expect(result.handled).toBe(true);
+                expect(result.response?.status).toBe(200);
+                expect(result.response?.body?.data?.tables).toEqual(['users', 'orders']);
+            });
+
+            it('should return unhandled when analytics service is not registered', async () => {
+                (kernel as any).getService = vi.fn().mockResolvedValue(null);
+                (kernel as any).services = new Map();
+
+                const result = await dispatcher.handleAnalytics('query', 'POST', {}, { request: {} });
+                expect(result.handled).toBe(false);
+            });
+
+            it('should return unhandled for unknown analytics sub-path', async () => {
+                const mockAnalytics = { query: vi.fn() };
+                (kernel as any).getService = vi.fn().mockResolvedValue(mockAnalytics);
+
+                const result = await dispatcher.handleAnalytics('unknown', 'POST', {}, { request: {} });
+                expect(result.handled).toBe(false);
+            });
+        });
+
+        describe('handleAuth with async service', () => {
+            it('should resolve auth service from Promise', async () => {
+                const mockAuth = {
+                    handler: vi.fn().mockResolvedValue({ user: { id: '1' } }),
+                };
+                (kernel as any).getService = vi.fn().mockImplementation((name: string) => {
+                    if (name === 'auth') return Promise.resolve(mockAuth);
+                    return null;
+                });
+
+                const result = await dispatcher.handleAuth('', 'POST', {}, { request: {}, response: {} });
+                expect(result.handled).toBe(true);
+                expect(mockAuth.handler).toHaveBeenCalled();
+            });
+
+            it('should fallback to legacy login when async auth service has no handler', async () => {
+                (kernel as any).getService = vi.fn().mockResolvedValue({});
+                mockBroker.call.mockResolvedValue({ token: 'abc' });
+
+                const result = await dispatcher.handleAuth('/login', 'POST', { user: 'a' }, { request: {} });
+                expect(result.handled).toBe(true);
+                expect(mockBroker.call).toHaveBeenCalledWith('auth.login', { user: 'a' }, { request: {} });
+            });
+
+            it('should return unhandled when auth service not registered and no legacy match', async () => {
+                (kernel as any).getService = vi.fn().mockResolvedValue(null);
+                (kernel as any).services = new Map();
+
+                const result = await dispatcher.handleAuth('/profile', 'GET', {}, { request: {} });
+                expect(result.handled).toBe(false);
+            });
+        });
+
+        describe('handleStorage with async service', () => {
+            it('should resolve storage service from Promise', async () => {
+                const mockStorage = {
+                    upload: vi.fn().mockResolvedValue({ id: 'file_1', url: '/files/1' }),
+                };
+                (kernel as any).getService = vi.fn().mockImplementation((name: string) => {
+                    if (name === 'file-storage') return Promise.resolve(mockStorage);
+                    return null;
+                });
+
+                const result = await dispatcher.handleStorage('/upload', 'POST', { name: 'test.txt' }, { request: {} });
+                expect(result.handled).toBe(true);
+                expect(result.response?.status).toBe(200);
+                expect(mockStorage.upload).toHaveBeenCalled();
+            });
+
+            it('should return 501 when storage service is not registered (async null)', async () => {
+                (kernel as any).getService = vi.fn().mockResolvedValue(null);
+                (kernel as any).services = new Map();
+
+                const result = await dispatcher.handleStorage('/upload', 'POST', {}, { request: {} });
+                expect(result.handled).toBe(true);
+                expect(result.response?.status).toBe(501);
+                expect(result.response?.body?.error?.message).toBe('File storage not configured');
+            });
+
+            it('should handle GET /storage/file/:id with async service', async () => {
+                const mockStorage = {
+                    download: vi.fn().mockResolvedValue({ data: 'content', mimeType: 'text/plain' }),
+                };
+                (kernel as any).getService = vi.fn().mockImplementation((name: string) => {
+                    if (name === 'file-storage') return Promise.resolve(mockStorage);
+                    return null;
+                });
+
+                const result = await dispatcher.handleStorage('/file/abc123', 'GET', null, { request: {} });
+                expect(result.handled).toBe(true);
+                expect(mockStorage.download).toHaveBeenCalledWith('abc123', { request: {} });
+            });
+
+            it('should return 400 when upload has no file', async () => {
+                const mockStorage = { upload: vi.fn() };
+                (kernel as any).getService = vi.fn().mockResolvedValue(mockStorage);
+
+                const result = await dispatcher.handleStorage('/upload', 'POST', null, { request: {} });
+                expect(result.handled).toBe(true);
+                expect(result.response?.status).toBe(400);
+                expect(result.response?.body?.error?.message).toBe('No file provided');
+            });
+        });
+
+        describe('handleAutomation with async service', () => {
+            it('should resolve automation service from Promise (async factory)', async () => {
+                const mockAuto = {
+                    listFlows: vi.fn().mockResolvedValue(['f1']),
+                };
+                (kernel as any).getService = vi.fn().mockImplementation((name: string) => {
+                    if (name === 'automation') return Promise.resolve(mockAuto);
+                    return null;
+                });
+
+                const result = await dispatcher.handleAutomation('', 'GET', {}, { request: {} });
+                expect(result.handled).toBe(true);
+                expect(result.response?.body?.data?.flows).toEqual(['f1']);
+            });
+
+            it('should return unhandled when automation service not registered', async () => {
+                (kernel as any).getService = vi.fn().mockResolvedValue(null);
+                (kernel as any).services = new Map();
+
+                const result = await dispatcher.handleAutomation('', 'GET', {}, { request: {} });
+                expect(result.handled).toBe(false);
+            });
+        });
+
+        describe('handleMetadata with async protocol service', () => {
+            it('should resolve protocol service from async getService', async () => {
+                const asyncProtocol = {
+                    saveMetaItem: vi.fn().mockResolvedValue({ success: true }),
+                };
+                (kernel as any).context.getService = vi.fn().mockImplementation((name: string) => {
+                    if (name === 'protocol') return Promise.resolve(asyncProtocol);
+                    return null;
+                });
+
+                const result = await dispatcher.handleMetadata('/objects/my_obj', { request: {} }, 'PUT', { label: 'Test' });
+                expect(result.handled).toBe(true);
+                expect(result.response?.status).toBe(200);
+                expect(asyncProtocol.saveMetaItem).toHaveBeenCalled();
+            });
+
+            it('should fallback to broker when async protocol returns null', async () => {
+                (kernel as any).context.getService = vi.fn().mockResolvedValue(null);
+                mockBroker.call.mockResolvedValue({ name: 'my_obj' });
+
+                const result = await dispatcher.handleMetadata('/objects/my_obj', { request: {} }, 'GET');
+                expect(result.handled).toBe(true);
+                expect(mockBroker.call).toHaveBeenCalledWith(
+                    'metadata.getObject',
+                    { objectName: 'my_obj' },
+                    { request: {} }
+                );
+            });
+        });
+    });
+
+    // ═══════════════════════════════════════════════════════════════
+    // Synchronous service resolution (backward compatibility)
+    // ═══════════════════════════════════════════════════════════════
+
+    describe('Synchronous service resolution (backward compat)', () => {
+        it('should work with synchronous service from services Map', async () => {
+            const syncAnalytics = {
+                query: vi.fn().mockResolvedValue({ rows: [], total: 0 }),
+            };
+            (kernel as any).services = new Map([['analytics', syncAnalytics]]);
+
+            const result = await dispatcher.handleAnalytics('query', 'POST', {}, { request: {} });
+            expect(result.handled).toBe(true);
+            expect(syncAnalytics.query).toHaveBeenCalled();
+        });
+
+        it('should work with synchronous getService returning service directly', async () => {
+            const syncAuto = {
+                listFlows: vi.fn().mockResolvedValue(['flow_x']),
+            };
+            (kernel as any).getService = vi.fn().mockReturnValue(syncAuto);
+
+            const result = await dispatcher.handleAutomation('', 'GET', {}, { request: {} });
+            expect(result.handled).toBe(true);
+            expect(result.response?.body?.data?.flows).toEqual(['flow_x']);
+        });
+    });
+
+    // ═══════════════════════════════════════════════════════════════
+    // Error handling for service method failures
+    // ═══════════════════════════════════════════════════════════════
+
+    describe('Service method error handling', () => {
+        it('should propagate analytics query error', async () => {
+            const badAnalytics = {
+                query: vi.fn().mockRejectedValue(new Error('Query timeout')),
+            };
+            (kernel as any).getService = vi.fn().mockResolvedValue(badAnalytics);
+
+            await expect(
+                dispatcher.handleAnalytics('query', 'POST', {}, { request: {} })
+            ).rejects.toThrow('Query timeout');
+        });
+
+        it('should propagate storage upload error', async () => {
+            const badStorage = {
+                upload: vi.fn().mockRejectedValue(new Error('Disk full')),
+            };
+            (kernel as any).getService = vi.fn().mockImplementation((name: string) => {
+                if (name === 'file-storage') return Promise.resolve(badStorage);
+                return null;
+            });
+
+            await expect(
+                dispatcher.handleStorage('/upload', 'POST', { data: 'file' }, { request: {} })
+            ).rejects.toThrow('Disk full');
+        });
+    });
+
+    // ═══════════════════════════════════════════════════════════════
+    // Package Publish / Revert Endpoints
+    // ═══════════════════════════════════════════════════════════════
+
+    describe('Package publish/revert endpoints', () => {
+        it('should handle POST /packages/:id/publish via metadata service', async () => {
+            const mockMetadata = {
+                publishPackage: vi.fn().mockResolvedValue({
+                    success: true,
+                    packageId: 'com.acme.crm',
+                    version: 2,
+                    publishedAt: '2025-06-01T00:00:00Z',
+                    itemsPublished: 3,
+                }),
+            };
+            const mockRegistry = {
+                getAllPackages: vi.fn().mockReturnValue([]),
+                enablePackage: vi.fn(),
+                disablePackage: vi.fn(),
+            };
+            (kernel as any).getService = vi.fn().mockImplementation((name: string) => {
+                if (name === 'metadata') return Promise.resolve(mockMetadata);
+                if (name === 'objectql') return Promise.resolve({ registry: mockRegistry });
+                return null;
+            });
+
+            const result = await dispatcher.handlePackages('/com.acme.crm/publish', 'POST', { publishedBy: 'admin' }, {}, { request: {} });
+            expect(result.handled).toBe(true);
+            expect(result.response?.status).toBe(200);
+            expect(mockMetadata.publishPackage).toHaveBeenCalledWith('com.acme.crm', { publishedBy: 'admin' });
+        });
+
+        it('should handle POST /packages/:id/revert via metadata service', async () => {
+            const mockMetadata = {
+                revertPackage: vi.fn().mockResolvedValue(undefined),
+            };
+            const mockRegistry = {
+                getAllPackages: vi.fn().mockReturnValue([]),
+                enablePackage: vi.fn(),
+                disablePackage: vi.fn(),
+            };
+            (kernel as any).getService = vi.fn().mockImplementation((name: string) => {
+                if (name === 'metadata') return Promise.resolve(mockMetadata);
+                if (name === 'objectql') return Promise.resolve({ registry: mockRegistry });
+                return null;
+            });
+
+            const result = await dispatcher.handlePackages('/com.acme.crm/revert', 'POST', {}, {}, { request: {} });
+            expect(result.handled).toBe(true);
+            expect(result.response?.status).toBe(200);
+            expect(mockMetadata.revertPackage).toHaveBeenCalledWith('com.acme.crm');
+        });
+
+        it('should fallback to broker for publish when metadata service unavailable', async () => {
+            const mockRegistry = {
+                getAllPackages: vi.fn().mockReturnValue([]),
+            };
+            (kernel as any).getService = vi.fn().mockImplementation((name: string) => {
+                if (name === 'metadata') return Promise.resolve(null);
+                if (name === 'objectql') return Promise.resolve({ registry: mockRegistry });
+                return null;
+            });
+            mockBroker.call.mockResolvedValue({ success: true, packageId: 'crm', version: 1, publishedAt: '2025-01-01T00:00:00Z', itemsPublished: 2 });
+
+            const result = await dispatcher.handlePackages('/crm/publish', 'POST', {}, {}, { request: {} });
+            expect(result.handled).toBe(true);
+            expect(mockBroker.call).toHaveBeenCalledWith('metadata.publishPackage', { packageId: 'crm' }, { request: {} });
+        });
+    });
+
+    // ═══════════════════════════════════════════════════════════════
+    // Metadata getPublished Endpoint
+    // ═══════════════════════════════════════════════════════════════
+
+    describe('Metadata getPublished endpoint', () => {
+        it('should handle GET /metadata/:type/:name/published via metadata service', async () => {
+            const mockMetadata = {
+                getPublished: vi.fn().mockResolvedValue({ name: 'account', label: 'Account' }),
+            };
+            (kernel as any).getService = vi.fn().mockImplementation((name: string) => {
+                if (name === 'metadata') return Promise.resolve(mockMetadata);
+                return null;
+            });
+
+            const result = await dispatcher.handleMetadata('/object/account/published', { request: {} }, 'GET');
+            expect(result.handled).toBe(true);
+            expect(result.response?.status).toBe(200);
+            expect(result.response?.body?.data).toEqual({ name: 'account', label: 'Account' });
+            expect(mockMetadata.getPublished).toHaveBeenCalledWith('object', 'account');
+        });
+
+        it('should return 404 when published item not found', async () => {
+            const mockMetadata = {
+                getPublished: vi.fn().mockResolvedValue(undefined),
+            };
+            (kernel as any).getService = vi.fn().mockImplementation((name: string) => {
+                if (name === 'metadata') return Promise.resolve(mockMetadata);
+                return null;
+            });
+
+            const result = await dispatcher.handleMetadata('/object/nonexistent/published', { request: {} }, 'GET');
+            expect(result.handled).toBe(true);
+            expect(result.response?.status).toBe(404);
+        });
+
+        it('should fallback to broker for getPublished when metadata service unavailable', async () => {
+            (kernel as any).getService = vi.fn().mockResolvedValue(null);
+            mockBroker.call.mockResolvedValue({ name: 'account', fields: ['name'] });
+
+            const result = await dispatcher.handleMetadata('/object/account/published', { request: {} }, 'GET');
+            expect(result.handled).toBe(true);
+            expect(result.response?.status).toBe(200);
+            expect(mockBroker.call).toHaveBeenCalledWith(
+                'metadata.getPublished',
+                { type: 'object', name: 'account' },
+                { request: {} }
+            );
+        });
+    });
 });

package/src/http-dispatcher.ts

@@ -173,7 +173,7 @@ export class HttpDispatcher {
      */
     async handleAuth(path: string, method: string, body: any, context: HttpProtocolContext): Promise<HttpDispatcherResult> {
         // 1. Try generic Auth Service
-        const authService = this.getService(CoreServiceName.enum.auth);
+        const authService = await this.getService(CoreServiceName.enum.auth);
         if (authService && typeof authService.handler === 'function') {
             const response = await authService.handler(context.request, context.response);
             return { handled: true, result: response };
@@ -202,7 +202,7 @@ export class HttpDispatcher {
         // GET /metadata/types
         if (parts[0] === 'types') {
             // Try protocol service for dynamic types
-            const protocol = this.kernel?.context?.getService ? this.kernel.context.getService('protocol') : null;
+            const protocol = this.kernel?.context?.getService ? await this.kernel.context.getService('protocol') : null;
             if (protocol && typeof protocol.getMetaTypes === 'function') {
                 const result = await protocol.getMetaTypes({});
                 return { handled: true, response: this.success(result) };
@@ -217,6 +217,24 @@ export class HttpDispatcher {
             }
         }
 
+        // GET /metadata/:type/:name/published → get published version
+        if (parts.length === 3 && parts[2] === 'published' && (!method || method === 'GET')) {
+            const [type, name] = parts;
+            const metadataService = await this.getService(CoreServiceName.enum.metadata);
+            if (metadataService && typeof (metadataService as any).getPublished === 'function') {
+                const data = await (metadataService as any).getPublished(type, name);
+                if (data === undefined) return { handled: true, response: this.error('Not found', 404) };
+                return { handled: true, response: this.success(data) };
+            }
+            // Broker fallback
+            try {
+                const data = await broker.call('metadata.getPublished', { type, name }, { request: context.request });
+                return { handled: true, response: this.success(data) };
+            } catch (e: any) {
+                return { handled: true, response: this.error(e.message, 404) };
+            }
+        }
+
         // /metadata/:type/:name
         if (parts.length === 2) {
             const [type, name] = parts;
@@ -224,7 +242,7 @@ export class HttpDispatcher {
             // PUT /metadata/:type/:name (Save)
             if (method === 'PUT' && body) {
                 // Try to get the protocol service directly
-                const protocol = this.kernel?.context?.getService ? this.kernel.context.getService('protocol') : null;
+                const protocol = this.kernel?.context?.getService ? await this.kernel.context.getService('protocol') : null;
                 
                 if (protocol && typeof protocol.saveMetaItem === 'function') {
                     try {
@@ -257,7 +275,7 @@ export class HttpDispatcher {
                 const singularType = type.endsWith('s') ? type.slice(0, -1) : type;
                 
                 // Try Protocol Service First (Preferred)
-                const protocol = this.kernel?.context?.getService ? this.kernel.context.getService('protocol') : null;
+                const protocol = this.kernel?.context?.getService ? await this.kernel.context.getService('protocol') : null;
                 if (protocol && typeof protocol.getMetaItem === 'function') {
                      try {
                         const data = await protocol.getMetaItem({ type: singularType, name });
@@ -286,7 +304,7 @@ export class HttpDispatcher {
             const packageId = query?.package || undefined;
             
             // Try protocol service first for any type
-            const protocol = this.kernel?.context?.getService ? this.kernel.context.getService('protocol') : null;
+            const protocol = this.kernel?.context?.getService ? await this.kernel.context.getService('protocol') : null;
             if (protocol && typeof protocol.getMetaItems === 'function') {
                 try {
                     const data = await protocol.getMetaItems({ type: typeOrName, packageId });
@@ -325,7 +343,7 @@ export class HttpDispatcher {
         // GET /metadata — return available metadata types
         if (parts.length === 0) {
             // Try protocol service for dynamic types
-            const protocol = this.kernel?.context?.getService ? this.kernel.context.getService('protocol') : null;
+            const protocol = this.kernel?.context?.getService ? await this.kernel.context.getService('protocol') : null;
             if (protocol && typeof protocol.getMetaTypes === 'function') {
                 const result = await protocol.getMetaTypes({});
                 return { handled: true, response: this.success(result) };
@@ -429,7 +447,7 @@ export class HttpDispatcher {
      * path: sub-path after /analytics/
      */
     async handleAnalytics(path: string, method: string, body: any, context: HttpProtocolContext): Promise<HttpDispatcherResult> {
-        const analyticsService = this.getService(CoreServiceName.enum.analytics);
+        const analyticsService = await this.getService(CoreServiceName.enum.analytics);
         if (!analyticsService) return { handled: false }; // 404 handled by caller if unhandled
 
         const m = method.toUpperCase();
@@ -467,6 +485,8 @@ export class HttpDispatcher {
      * - DELETE  /packages/:id      → uninstall a package
      * - PATCH  /packages/:id/enable  → enable a package
      * - PATCH  /packages/:id/disable → disable a package
+     * - POST   /packages/:id/publish → publish a package (metadata snapshot)
+     * - POST   /packages/:id/revert  → revert a package to last published state
      * 
      * Uses ObjectQL SchemaRegistry directly (via the 'objectql' service)
      * with broker fallback for backward compatibility.
@@ -476,7 +496,7 @@ export class HttpDispatcher {
         const parts = path.replace(/^\/+/, '').split('/').filter(Boolean);
 
         // Try to get SchemaRegistry from the ObjectQL service
-        const qlService = this.getObjectQLService();
+        const qlService = await this.getObjectQLService();
         const registry = qlService?.registry;
 
         // If no registry available, try broker as fallback
@@ -525,6 +545,38 @@ export class HttpDispatcher {
                 return { handled: true, response: this.success(pkg) };
             }
 
+            // POST /packages/:id/publish → publish package metadata
+            if (parts.length === 2 && parts[1] === 'publish' && m === 'POST') {
+                const id = decodeURIComponent(parts[0]);
+                const metadataService = await this.getService(CoreServiceName.enum.metadata);
+                if (metadataService && typeof (metadataService as any).publishPackage === 'function') {
+                    const result = await (metadataService as any).publishPackage(id, body || {});
+                    return { handled: true, response: this.success(result) };
+                }
+                // Broker fallback
+                if (this.kernel.broker) {
+                    const result = await this.kernel.broker.call('metadata.publishPackage', { packageId: id, ...body }, { request: context.request });
+                    return { handled: true, response: this.success(result) };
+                }
+                return { handled: true, response: this.error('Metadata service not available', 503) };
+            }
+
+            // POST /packages/:id/revert → revert package to last published state
+            if (parts.length === 2 && parts[1] === 'revert' && m === 'POST') {
+                const id = decodeURIComponent(parts[0]);
+                const metadataService = await this.getService(CoreServiceName.enum.metadata);
+                if (metadataService && typeof (metadataService as any).revertPackage === 'function') {
+                    await (metadataService as any).revertPackage(id);
+                    return { handled: true, response: this.success({ success: true }) };
+                }
+                // Broker fallback
+                if (this.kernel.broker) {
+                    await this.kernel.broker.call('metadata.revertPackage', { packageId: id }, { request: context.request });
+                    return { handled: true, response: this.success({ success: true }) };
+                }
+                return { handled: true, response: this.error('Metadata service not available', 503) };
+            }
+
             // GET /packages/:id → get package
             if (parts.length === 1 && m === 'GET') {
                 const id = decodeURIComponent(parts[0]);
@@ -594,7 +646,7 @@ export class HttpDispatcher {
      * path: sub-path after /storage/
      */
     async handleStorage(path: string, method: string, file: any, context: HttpProtocolContext): Promise<HttpDispatcherResult> {
-        const storageService = this.getService(CoreServiceName.enum['file-storage']) || this.kernel.services?.['file-storage'];
+        const storageService = await this.getService(CoreServiceName.enum['file-storage']) || this.kernel.services?.['file-storage'];
         if (!storageService) {
              return { handled: true, response: this.error('File storage not configured', 501) };
         }
@@ -656,7 +708,7 @@ export class HttpDispatcher {
             // Support both path param /view/obj/list AND query param /view/obj?type=list
             const type = parts[2] || query?.type || 'list';
 
-            const protocol = this.kernel?.context?.getService ? this.kernel.context.getService('protocol') : null;
+            const protocol = this.kernel?.context?.getService ? await this.kernel.context.getService('protocol') : null;
             
             if (protocol && typeof protocol.getUiView === 'function') {
                 try {
@@ -689,7 +741,7 @@ export class HttpDispatcher {
      *   GET    /:name/runs/:runId    → getRun
      */
     async handleAutomation(path: string, method: string, body: any, context: HttpProtocolContext, query?: any): Promise<HttpDispatcherResult> {
-        const automationService = this.getService(CoreServiceName.enum.automation);
+        const automationService = await this.getService(CoreServiceName.enum.automation);
         if (!automationService) return { handled: false };
 
         const m = method.toUpperCase();
@@ -799,9 +851,9 @@ export class HttpDispatcher {
         return this.kernel.services || {};
     }
 
-    private getService(name: CoreServiceName) {
+    private async getService(name: CoreServiceName) {
         if (typeof this.kernel.getService === 'function') {
-            return this.kernel.getService(name);
+            return await this.kernel.getService(name);
         }
         const services = this.getServicesMap();
         return services[name];
@@ -811,18 +863,18 @@ export class HttpDispatcher {
      * Get the ObjectQL service which provides access to SchemaRegistry.
      * Tries multiple access patterns since kernel structure varies.
      */
-    private getObjectQLService(): any {
+    private async getObjectQLService(): Promise<any> {
         // 1. Try via kernel.getService
         if (typeof this.kernel.getService === 'function') {
             try {
-                const svc = this.kernel.getService('objectql');
+                const svc = await this.kernel.getService('objectql');
                 if (svc?.registry) return svc;
             } catch { /* ignore */ }
         }
         // 2. Try via kernel context
         if (this.kernel?.context?.getService) {
             try {
-                const svc = this.kernel.context.getService('objectql');
+                const svc = await this.kernel.context.getService('objectql');
                 if (svc?.registry) return svc;
             } catch { /* ignore */ }
         }