@underpostnet/cyberia 3.2.90 → 3.3.0

package/src/client-builder/client-build.js

@@ -525,6 +525,7 @@ const defaultSitemapXsl = `<?xml version="1.0" encoding="UTF-8"?>
  * @param {string|number} options.split - Optional zip split size in MB.
  * @param {boolean} options.fullBuild - Whether to perform a full build.
  * @param {boolean} options.iconsBuild - Whether to build icons.
+ * @param {boolean} options.ssrOnly - Whether to rebuild only views defined in `conf.ssr.json`.
  * @returns {Promise<void>} - Promise that resolves when the build is complete.
  * @throws {Error} - If the build fails.
  * @memberof clientBuild
@@ -548,6 +549,7 @@ const buildClient = async (
   const packageData = JSON.parse(fs.readFileSync(`./package.json`, 'utf8'));
   const acmeChallengePath = `/.well-known/acme-challenge`;
   const publicPath = `./public`;
+  const ssrOnly = options.ssrOnly === true;
 
   /**
    * @async
@@ -691,11 +693,11 @@ const buildClient = async (
         ? `${directory}${acmeChallengePath}`
         : `${publicPath}/${host}${acmeChallengePath}`;
 
-      if (!enableLiveRebuild) buildAcmeChallengePath(acmeChallengeFullPath);
+      if (!enableLiveRebuild && !ssrOnly) buildAcmeChallengePath(acmeChallengeFullPath);
 
       if (redirect || disabledRebuild) continue;
 
-      if (fullBuildEnabled)
+      if (fullBuildEnabled && !ssrOnly)
         await fullBuild({
           path,
           logger,
@@ -710,7 +712,7 @@ const buildClient = async (
           publicCopyNonExistingFiles,
         });
 
-      if (components)
+      if (!ssrOnly && components)
         for (const module of Object.keys(components)) {
           if (!fs.existsSync(`${rootClientPath}/components/${module}`))
             fs.mkdirSync(`${rootClientPath}/components/${module}`, { recursive: true });
@@ -733,7 +735,7 @@ const buildClient = async (
           }
         }
 
-      if (services) {
+      if (!ssrOnly && services) {
         for (const module of services) {
           if (!fs.existsSync(`${rootClientPath}/services/${module}`))
             fs.mkdirSync(`${rootClientPath}/services/${module}`, { recursive: true });
@@ -796,7 +798,9 @@ const buildClient = async (
       const swSrcPath = `./src/client/sw/core.sw.js`;
       const swPublicPath = `${rootClientPath}/sw.js`;
       const swShouldRebuild =
-        views && !(enableLiveRebuild && !options.liveClientBuildPaths.find((p) => p.srcBuildPath === swSrcPath));
+        !ssrOnly &&
+        views &&
+        !(enableLiveRebuild && !options.liveClientBuildPaths.find((p) => p.srcBuildPath === swSrcPath));
       // Transformed SW JS is held in memory; it gets prepended with renderPayload
       // and written once below, after PRE_CACHED_RESOURCES are known.
       let swTransformedJs = '';
@@ -810,13 +814,15 @@ const buildClient = async (
         });
       }
 
-      if (views) {
-        if (!(
-          enableLiveRebuild &&
-          !options.liveClientBuildPaths.find(
-            (p) => p.srcBuildPath.startsWith(`./src/client/ssr`) || p.srcBuildPath.slice(-9) === '.index.js',
+      if (!ssrOnly && views) {
+        if (
+          !(
+            enableLiveRebuild &&
+            !options.liveClientBuildPaths.find(
+              (p) => p.srcBuildPath.startsWith(`./src/client/ssr`) || p.srcBuildPath.slice(-9) === '.index.js',
+            )
           )
-        ))
+        )
           for (const view of views) {
             const buildPath = `${
               rootClientPath[rootClientPath.length - 1] === '/' ? rootClientPath.slice(0, -1) : rootClientPath
@@ -983,7 +989,7 @@ const buildClient = async (
             );
           }
       }
-      if (!enableLiveRebuild && siteMapLinks.length > 0) {
+      if (!ssrOnly && !enableLiveRebuild && siteMapLinks.length > 0) {
         const hasSitemapTemplate = fs.existsSync(`${rootClientPath}/sitemap`);
         const sitemapBaseUrl = `https://${host}${path === '/' ? '' : path}`;
         // Create a stream to write to — omit xslUrl so we can inject a relative href below
@@ -1020,7 +1026,7 @@ Sitemap: ${sitemapBaseUrl}/sitemap.xml`,
         );
       }
 
-      if (fullBuildEnabled && docs) {
+      if (!ssrOnly && fullBuildEnabled && docs) {
         await buildDocs({
           host,
           path,
@@ -1128,7 +1134,7 @@ ${swTransformedJs}`,
           );
         }
       }
-      if (!enableLiveRebuild && options.buildZip) {
+      if (!ssrOnly && !enableLiveRebuild && options.buildZip) {
         logger.warn('build zip', rootClientPath);
 
         if (!fs.existsSync('./build')) fs.mkdirSync('./build');

package/src/db/mongo/MongooseDB.js

@@ -186,6 +186,10 @@ class MongooseDBService {
       const { ProviderSchema } = await import(`../../api/${api}/${api}.model.js`);
       const keyModel = getCapVariableName(api); // Assuming this returns a capitalized model name
       models[keyModel] = conn.model(keyModel, ProviderSchema);
+      // Mongoose emits 'error' on the model when an autoIndex build fails; with no
+      // listener attached EventEmitter rethrows and takes the whole process down.
+      // A stale or conflicting index must degrade to a log, not kill startup.
+      models[keyModel].on('error', (error) => logger.error(`${keyModel} index build failed: ${error.message}`));
     }
 
     return models;

package/src/index.js

@@ -26,6 +26,8 @@ import UnderpostStatic from './cli/static.js';
 import UnderpostTest from './cli/test.js';
 import UnderpostRelease from './cli/release.js';
 import UnderpostSystemProvisionig from './cli/system.js';
+import UnderpostVultr from './cli/vultr.js';
+import UnderpostWireguard from './cli/wireguard.js';
 
 import UnderpostDns from './server/dns.js';
 import UnderpostBackup from './server/backup.js';
@@ -45,7 +47,7 @@ class Underpost {
    * @type {String}
    * @memberof Underpost
    */
-  static version = 'v3.2.90';
+  static version = 'v3.3.0';
 
   /**
    * Required Node.js major version
@@ -252,6 +254,26 @@ class Underpost {
     return UnderpostSystemProvisionig.API;
   }
 
+  /**
+   * Edge hub WireGuard/HAProxy cli API
+   * @static
+   * @type {UnderpostWireguard.API}
+   * @memberof Underpost
+   */
+  static get wireguard() {
+    return UnderpostWireguard.API;
+  }
+
+  /**
+   * Vultr bandwidth guard cli API
+   * @static
+   * @type {UnderpostVultr.API}
+   * @memberof Underpost
+   */
+  static get vultr() {
+    return UnderpostVultr.API;
+  }
+
   /**
    * Dns server API
    * @static
@@ -352,6 +374,8 @@ export {
   UnderpostStartUp,
   UnderpostRelease,
   UnderpostTLS,
+  UnderpostVultr,
+  UnderpostWireguard,
 };
 
 export default Underpost;

package/src/projects/cyberia/catalog-cyberia.js

@@ -48,6 +48,8 @@ export default {
     '/.github/workflows/docker-image.cyberia-server.dev.ci.yml',
     '/.github/workflows/cyberia-client.cd.yml',
     '/.github/workflows/cyberia-server.cd.yml',
+    '/.github/workflows/coverall.cyberia.ci.yml',
+    '/scripts/coverall-test-cyberia.sh',
   ],
   stripPaths: [
     './src/projects/cyberia',
@@ -56,8 +58,11 @@ export default {
     './src/runtime/cyberia-client',
     './src/runtime/engine-cyberia',
     './test/cyberia-instance-conf-defaults.test.js',
+    './test/cyberia-load.test.js',
+    './test/object-layer-item-id.test.js',
     './test/shape-generator.test.js',
     './src/client/public/cyberia-docs',
+    './scripts/coverall-test-cyberia.sh',
     'bin/cyberia.js',
     './hardhat',
   ],

package/src/projects/cyberia/generate-saga.js

@@ -18,7 +18,6 @@ import fs from 'fs-extra';
 import nodePath from 'path';
 import crypto from 'crypto';
 import { GeminiClient } from './gemini-client.js';
-import { computeSha256 } from './object-layer.js';
 import { loggerFactory } from '../../server/logger.js';
 
 const logger = loggerFactory(import.meta);
@@ -1632,13 +1631,13 @@ function normalizeSagaPayload(raw, { theme }) {
 
 /**
  * Persist normalized object-layer items into the ObjectLayer collection so they
- * are editable in the viewer. Items are created with an empty (`null`) render
- * and an `OFF_CHAIN` ledger; a render/ledger can be set later from
+ * are editable in the viewer. New items get an empty render and an `OFF_CHAIN`
+ * ledger; both can be set later from the object-layer import or from
  * `src/client/components/cyberia/ObjectLayerEngineViewer.js`.
  *
- * Upserts by `data.item.id`. An existing item's render and ledger are PRESERVED
- * (never clobbered back to null) — only the textual stats/item fields are
- * refreshed. `sha256` is recomputed over the resulting data.
+ * Upserts through `ObjectLayer.upsertByItemId`, so `data.item.id` stays unique
+ * and an existing item's render, ledger and CIDs are PRESERVED — only the
+ * textual stats/item fields are refreshed, and `sha256` is recomputed.
  *
  * @async
  * @param {Object} params
@@ -1647,28 +1646,20 @@ function normalizeSagaPayload(raw, { theme }) {
  * @returns {Promise<number>} Count of items created or updated.
  */
 async function persistObjectLayers({ objectLayers, ObjectLayer }) {
+  await ObjectLayer.ensureUniqueItemIdIndex();
+
   let count = 0;
   for (const ol of objectLayers) {
     const itemId = ol.item?.id;
     if (!itemId) continue;
 
-    const existing = await ObjectLayer.findOne({ 'data.item.id': itemId });
-
-    // Preserve any render already set via the viewer; default to empty render.
-    const hasRender = existing?.data?.render?.cid || existing?.data?.render?.metadataCid;
-    const render = hasRender ? existing.data.render : { cid: null, metadataCid: null };
-    const ledger = existing?.data?.ledger?.type ? existing.data.ledger : { type: 'OFF_CHAIN', tokenId: '' };
-
-    const data = { stats: ol.stats, item: ol.item, ledger, render };
-    const sha256 = computeSha256(data);
-
-    if (existing) {
-      existing.data = data;
-      existing.sha256 = sha256;
-      await existing.save();
-    } else {
-      await ObjectLayer.create({ data, sha256, cid: null });
-    }
+    // The saga only owns the textual/statistical fields. Ledger and render are
+    // seeded on insert and never refreshed, so a re-import cannot clobber an
+    // on-chain registration or a render produced by the object-layer import.
+    await ObjectLayer.upsertByItemId(
+      { data: { stats: ol.stats, item: ol.item } },
+      { setOnInsert: { cid: null, data: { ledger: { type: 'OFF_CHAIN', tokenId: '' }, render: {} } } },
+    );
     count++;
   }
   return count;

package/src/projects/cyberia/instance-data.js

@@ -29,6 +29,7 @@ import {
   DefaultCyberiaItems,
 } from '../../client/components/cyberia/SharedDefaultsCyberia.js';
 import { generateFallbackWorld } from '../../api/cyberia-instance/cyberia-fallback-world.js';
+import { getFallbackDefaultItems } from '../../api/cyberia-instance/cyberia-fallback-default-items.js';
 
 const logger = loggerFactory(import.meta);
 
@@ -421,6 +422,7 @@ function toInstanceConfig(gc) {
     botAggroRange: gc.botAggroRange ?? fb.botAggroRange,
     defaultPlayerWidth: gc.defaultPlayerWidth ?? fb.defaultPlayerWidth,
     defaultPlayerHeight: gc.defaultPlayerHeight ?? fb.defaultPlayerHeight,
+    playerBaseSpeed: gc.playerBaseSpeed ?? fb.playerBaseSpeed,
     playerBaseLifeRegenMin: gc.playerBaseLifeRegenMin ?? fb.playerBaseLifeRegenMin,
     playerBaseLifeRegenMax: gc.playerBaseLifeRegenMax ?? fb.playerBaseLifeRegenMax,
     sumStatsLimit: gc.sumStatsLimit ?? fb.sumStatsLimit,
@@ -553,7 +555,7 @@ async function fetchFullInstance(models, requestedInstanceCode) {
   // ── Fallback: instance not found → return a multi-map procedural world ──
   if (!inst) {
     logger.info(`Instance "${instanceCode}" not found — returning fallback world.`);
-    const world = generateFallbackWorld();
+    const world = generateFallbackWorld({ itemIds: getFallbackDefaultItems() });
     const fallbackConf = buildFallbackConfig();
 
     // Collect all objectLayerItemIds from the generated maps so the
@@ -599,6 +601,23 @@ async function fetchFullInstance(models, requestedInstanceCode) {
 
     const fallbackConfig = buildFallbackInstanceConfig(fallbackConf, world.instance.itemIds);
 
+    // Opaque version over everything mutable in this payload, mirroring the
+    // persisted path below. A constant here would make hot reload a silent
+    // no-op: WorldBuilder.ReloadWorld skips the rebuild — and therefore
+    // ApplyInstanceConfig — whenever the version is unchanged. The world
+    // geometry itself is deterministic (code defaults + seed), so the inputs
+    // that can actually differ are the staged default items and the
+    // ObjectLayer docs, which are the only things read from the DB here.
+    const fallbackVersionParts = ['fallback'];
+    for (const entry of world.instance.itemIds || []) {
+      fallbackVersionParts.push(`${entry.id}:${entry.defaultPlayerInventory ? 1 : 0}`);
+    }
+    for (const doc of fallbackOlDocs) fallbackVersionParts.push(String(doc.sha256 || doc._id));
+    const fallbackVersion = `fallback-${crypto
+      .createHash('sha256')
+      .update(fallbackVersionParts.join('|'))
+      .digest('hex')}`;
+
     return {
       instance: toInstanceMsg({ ...world.instance, _id: '', seed: instanceCode }),
       maps: world.maps.map((m) => ({
@@ -613,7 +632,7 @@ async function fetchFullInstance(models, requestedInstanceCode) {
       })),
       objectLayers: fallbackOlDocs.map(toObjectLayerMsg),
       config: fallbackConfig,
-      version: 'fallback',
+      version: fallbackVersion,
       // Mission content for the procedural fallback comes straight from
       // the canonical defaults — no DB, fully self-contained.
       actions: DefaultCyberiaActions.map(toActionMsg),

package/src/projects/cyberia/object-layer.js

@@ -10,9 +10,7 @@ import path from 'path';
 import { PNG } from 'pngjs';
 import sharp from 'sharp';
 import { Jimp, intToRGBA, rgbaToInt } from 'jimp';
-import crypto from 'crypto';
-import stringify from 'fast-json-stable-stringify';
-
+import { computeObjectLayerSha256 } from '../../api/object-layer/object-layer.model.js';
 import { range } from '../../client/components/core/CommonJs.js';
 import {
   generateRandomStats,
@@ -450,7 +448,7 @@ export class ObjectLayerEngine {
    * @memberof CyberiaObjectLayer
    */
   static computeSha256(data) {
-    return crypto.createHash('sha256').update(stringify(data)).digest('hex');
+    return computeObjectLayerSha256(data);
   }
 
   /**
@@ -642,23 +640,15 @@ export class ObjectLayerEngine {
     }
 
     // 4. Atomic create/upsert - ObjectLayer is fully populated with all CIDs
-    let objectLayer;
-    const existingByItemId = await ObjectLayer.findOne({ 'data.item.id': objectLayerData.data.item.id });
-    if (existingByItemId) {
-      const oldRenderFramesId = existingByItemId.objectLayerRenderFramesId;
-      logger.info(
-        `ObjectLayer for item "${objectLayerData.data.item.id}" exists (${existingByItemId._id}), replacing atomically...`,
-      );
-      objectLayer = await ObjectLayer.findByIdAndUpdate(existingByItemId._id, objectLayerData, {
-        returnDocument: 'after',
-      }).populate('objectLayerRenderFramesId');
-      if (oldRenderFramesId && !oldRenderFramesId.equals(objectLayerRenderFramesDoc._id)) {
-        await ObjectLayerRenderFrames.findByIdAndDelete(oldRenderFramesId);
-      }
-    } else {
-      objectLayer = await (await ObjectLayer.create(objectLayerData)).populate('objectLayerRenderFramesId');
-      logger.info(`ObjectLayer created successfully with id: ${objectLayer._id}`);
+    const existingByItemId = await ObjectLayer.findByItemId(objectLayerData.data.item.id);
+    const oldRenderFramesId = existingByItemId?.objectLayerRenderFramesId;
+
+    const objectLayer = await (await ObjectLayer.upsertByItemId(objectLayerData)).populate('objectLayerRenderFramesId');
+
+    if (oldRenderFramesId && !oldRenderFramesId.equals(objectLayerRenderFramesDoc._id)) {
+      await ObjectLayerRenderFrames.findByIdAndDelete(oldRenderFramesId);
     }
+    logger.info(`ObjectLayer for item "${objectLayerData.data.item.id}" persisted with id: ${objectLayer._id}`);
 
     return { objectLayer, objectLayerRenderFramesDoc };
   }
@@ -848,7 +838,7 @@ export class ObjectLayerEngine {
    * @memberof CyberiaObjectLayer
    */
   static async resolveCanonicalCid({ itemId, ObjectLayer, ipfsClient = null, options }) {
-    const objectLayer = await ObjectLayer.findOne({ 'data.item.id': itemId });
+    const objectLayer = await ObjectLayer.findByItemId(itemId);
     if (!objectLayer) {
       throw new Error(`ObjectLayer "${itemId}" not found in database`);
     }

package/src/projects/underpost/catalog-underpost.js

@@ -18,7 +18,10 @@ const TEMPLATE_RESTORE_PATHS = [
   `./.github/workflows/gitlab.ci.yml`,
   `./.github/workflows/publish.ci.yml`,
   `./.github/workflows/release.cd.yml`,
-  `./src/client/services/user/guest.service.js`,
+  `./deploy/lib`,
+  './deploy/release',
+  './deploy/pwa-microservices-template',
+  './src/client/services/user/guest.service.js',
   './src/api/user/guest.service.js',
   './src/ws/IoInterface.js',
   './src/ws/IoServer.js',

package/src/runtime/cyberia-client/Dockerfile

@@ -14,7 +14,7 @@ RUN make -f Web.mk clean all BUILD_MODE=${BUILD_MODE} OUTPUT_DIR=bin/
 
 # --- Runtime Image ---
 FROM rockylinux/rockylinux:9 AS runtime
-ARG UNDERPOST_VERSION=3.2.90
+ARG UNDERPOST_VERSION=3.3.0
 ARG NODE_VERSION=24.15.0
 
 RUN set -eux; \

package/src/runtime/cyberia-client/Dockerfile.dev

@@ -43,7 +43,7 @@ RUN make -f Web.mk all BUILD_MODE=${BUILD_MODE} OUTPUT_DIR=bin/
 # --- Runtime Image ---
 FROM rockylinux/rockylinux:9 AS runtime
 
-ARG UNDERPOST_VERSION=3.2.90
+ARG UNDERPOST_VERSION=3.3.0
 ARG NODE_VERSION=24.15.0
 RUN set -eux; \
     dnf -y update; \

package/src/runtime/cyberia-server/Dockerfile

@@ -11,7 +11,7 @@ RUN CGO_ENABLED=0 go build -trimpath -ldflags="-s -w" -o server ./cmd/cyberia-se
 
 # --- Runtime Image ---
 FROM rockylinux/rockylinux:9 AS runtime
-ARG UNDERPOST_VERSION=3.2.90
+ARG UNDERPOST_VERSION=3.3.0
 ARG NODE_VERSION=24.15.0
 
 RUN set -eux; \

package/src/runtime/cyberia-server/Dockerfile.dev

@@ -25,7 +25,7 @@ RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 \
 # --- Runtime Image ---
 FROM rockylinux/rockylinux:9 AS runtime
 
-ARG UNDERPOST_VERSION=3.2.90
+ARG UNDERPOST_VERSION=3.3.0
 ARG NODE_VERSION=24.15.0
 RUN set -eux; \
     dnf -y update; \

package/src/runtime/engine-cyberia/Dockerfile

@@ -6,7 +6,7 @@
 # Stage 1 — builder: clone the private deploy, build it, then scrub secrets.
 # ---------------------------------------------------------------------------
 FROM rockylinux/rockylinux:9 AS builder
-ARG UNDERPOST_VERSION=3.2.90
+ARG UNDERPOST_VERSION=3.3.0
 # Pin Node to an exact patch: dnf's nodejs:24 module lags (24.14.1) while
 # underpost's dependencies require >=24.15.0, so install the official binary.
 ARG NODE_VERSION=24.15.0

package/src/runtime/engine-cyberia/Dockerfile.dev

@@ -6,7 +6,7 @@
 # Stage 1 — builder: clone the private deploy, build it, then scrub secrets.
 # ---------------------------------------------------------------------------
 FROM rockylinux/rockylinux:9 AS builder
-ARG UNDERPOST_VERSION=3.2.90
+ARG UNDERPOST_VERSION=3.3.0
 # Pin Node to an exact patch: dnf's nodejs:24 module lags (24.14.1) while
 # underpost's dependencies require >=24.15.0, so install the official binary.
 ARG NODE_VERSION=24.15.0

package/src/runtime/engine-cyberia/Dockerfile.test

@@ -6,7 +6,7 @@
 # Stage 1 — builder: clone the private deploy, build it, then scrub secrets.
 # ---------------------------------------------------------------------------
 FROM rockylinux/rockylinux:9 AS builder
-ARG UNDERPOST_VERSION=3.2.90
+ARG UNDERPOST_VERSION=3.3.0
 # Pin Node to an exact patch: dnf's nodejs:24 module lags (24.14.1) while
 # underpost's dependencies require >=24.15.0, so install the official binary.
 ARG NODE_VERSION=24.15.0

package/src/runtime/engine-cyberia/compose.env

@@ -70,6 +70,22 @@ CYBERIA_DEFAULT_INSTANCE=amethyst-strata-expansion
 CYBERIA_SERVER_APP_ENV=development
 CYBERIA_SERVER_LOG_LEVEL=
 
+# --- cyberia-server WebSocket admission and rate limits ----------------------
+# Unset keeps the built-in default. An explicit 0 turns that one limit off.
+# The startup log prints the effective profile ("ws limits: ...").
+#
+# Set CYBERIA_DISABLE_CONNECTION_LIMITS=1 to turn every limit off. The load test
+# (test/cyberia-load.test.js) drives every simulated client from one address, so
+# it needs this. NEVER enable it on a public deploy.
+CYBERIA_DISABLE_CONNECTION_LIMITS=
+CYBERIA_MAX_CONNECTIONS=
+CYBERIA_MAX_CONNECTIONS_PER_IP=
+CYBERIA_CONNECT_RATE_PER_IP=
+CYBERIA_CONNECT_BURST_PER_IP=
+CYBERIA_MESSAGE_RATE=
+CYBERIA_MESSAGE_BURST=
+CYBERIA_MAX_STRIKES=
+
 # --- engine-cyberia runtime env (loaded into the container via env_file) -----
 # The dd-cyberia engine (engine-private/conf/dd-cyberia/conf.server.json) needs
 # these to boot: DB auth + per-site DB names, the base PORT (the cyberia host is

package/src/runtime/engine-cyberia/docker-compose.yml

@@ -4,36 +4,6 @@
 # (MongoDB + Valkey + IPFS), then the Cyberia content-authority engine and its
 # per-instance server/client tiers, fronted by an nginx reverse proxy.
 #
-# Canonical location (custom docker-compose workflow):
-#   engine-private/conf/dd-cyberia/docker-compose/cyberia/
-#     ├── docker-compose.yml     (this file — the ENTIRE stack, single source)
-#     ├── compose.env            (working env-file, used as-is — not generated)
-#     ├── nginx.conf             (custom per-variant sub-path routing)
-#     └── mongodb/entrypoint.sh  (replica-set bootstrap)
-# All bind mounts below are relative to this directory: the CLI runs compose with
-# `--project-directory` pinned here (see src/cli/docker-compose.js).
-#
-# Multi-instance: one engine-cyberia (content + asset authority) feeds three
-# cyberia-server + three cyberia-client tiers, one per conf.instances.json
-# multiInstance variant (amethyst-strata-expansion "/", FOREST "/FOREST",
-# TEST "/TEST"). This custom workflow owns nginx.conf and the services below;
-# keep both in sync when its instance topology changes.
-#
-# Startup is a strict health-gated chain: the stable gateway starts after the
-# engine, then each server/client pipeline advances independently:
-#   mongodb + valkey -> engine runtime -> proxy -> 3x server -> 3x client
-#
-# Architecture boundaries (see CLAUDE.md "Cyberia architecture boundaries"):
-#   engine-cyberia  — content, validation, persistence, gRPC(:50051)+REST(:4005)
-#                     data services, asset metadata. The authority layer.
-#   cyberia-server  — authoritative real-time simulation / tick processing (Go).
-#   cyberia-client  — rendering, input, prediction, presentation (WASM bundle).
-#
-# Usage:
-#   underpost docker-compose --up --deploy-id dd-cyberia --docker-compose-id cyberia
-#   (or the docker:cyberia:* npm scripts). The engine-cyberia image bakes the
-#   dd-cyberia build at image-build time, so no private-repo credentials are
-#   required at container start.
 
 name: dd-cyberia
 
@@ -165,7 +135,7 @@ services:
   # server starts but rejects connections until seeded). Serves REST/WS on 4005
   # and the engine gRPC data service on 50051.
   engine-cyberia-runtime:
-    image: ${ENGINE_CYBERIA_IMAGE:-underpost/engine-cyberia-dev}:${ENGINE_CYBERIA_TAG:-v3.2.90}
+    image: ${ENGINE_CYBERIA_IMAGE:-underpost/engine-cyberia-dev}:${ENGINE_CYBERIA_TAG:-v3.3.0}
     container_name: dd-cyberia-engine
     command:
       - /bin/sh
@@ -220,7 +190,7 @@ services:
   # gateway on host port 8081, so one port can route every instance path.
 
   cyberia-server-runtime:
-    image: ${CYBERIA_SERVER_IMAGE:-underpost/cyberia-server-dev}:${CYBERIA_SERVER_TAG:-v3.2.90}
+    image: ${CYBERIA_SERVER_IMAGE:-underpost/cyberia-server-dev}:${CYBERIA_SERVER_TAG:-v3.3.0}
     container_name: dd-cyberia-server
     environment:
       INSTANCE_CODE: amethyst-strata-expansion
@@ -232,6 +202,14 @@ services:
       STATIC_DIR: ${CYBERIA_SERVER_STATIC_DIR:-/home/dd/engine/cyberia-server/public}
       APP_ENV: ${CYBERIA_SERVER_APP_ENV:-development}
       LOG_LEVEL: ${CYBERIA_SERVER_LOG_LEVEL:-}
+      CYBERIA_DISABLE_CONNECTION_LIMITS: ${CYBERIA_DISABLE_CONNECTION_LIMITS:-}
+      CYBERIA_MAX_CONNECTIONS: ${CYBERIA_MAX_CONNECTIONS:-}
+      CYBERIA_MAX_CONNECTIONS_PER_IP: ${CYBERIA_MAX_CONNECTIONS_PER_IP:-}
+      CYBERIA_CONNECT_RATE_PER_IP: ${CYBERIA_CONNECT_RATE_PER_IP:-}
+      CYBERIA_CONNECT_BURST_PER_IP: ${CYBERIA_CONNECT_BURST_PER_IP:-}
+      CYBERIA_MESSAGE_RATE: ${CYBERIA_MESSAGE_RATE:-}
+      CYBERIA_MESSAGE_BURST: ${CYBERIA_MESSAGE_BURST:-}
+      CYBERIA_MAX_STRIKES: ${CYBERIA_MAX_STRIKES:-}
     networks:
       - dd-cyberia-internal
     expose:
@@ -248,7 +226,7 @@ services:
     restart: unless-stopped
 
   cyberia-server-forest:
-    image: ${CYBERIA_SERVER_IMAGE:-underpost/cyberia-server-dev}:${CYBERIA_SERVER_TAG:-v3.2.90}
+    image: ${CYBERIA_SERVER_IMAGE:-underpost/cyberia-server-dev}:${CYBERIA_SERVER_TAG:-v3.3.0}
     container_name: dd-cyberia-server-forest
     environment:
       INSTANCE_CODE: FOREST
@@ -260,6 +238,14 @@ services:
       STATIC_DIR: ${CYBERIA_SERVER_STATIC_DIR:-/home/dd/engine/cyberia-server/public}
       APP_ENV: ${CYBERIA_SERVER_APP_ENV:-development}
       LOG_LEVEL: ${CYBERIA_SERVER_LOG_LEVEL:-}
+      CYBERIA_DISABLE_CONNECTION_LIMITS: ${CYBERIA_DISABLE_CONNECTION_LIMITS:-}
+      CYBERIA_MAX_CONNECTIONS: ${CYBERIA_MAX_CONNECTIONS:-}
+      CYBERIA_MAX_CONNECTIONS_PER_IP: ${CYBERIA_MAX_CONNECTIONS_PER_IP:-}
+      CYBERIA_CONNECT_RATE_PER_IP: ${CYBERIA_CONNECT_RATE_PER_IP:-}
+      CYBERIA_CONNECT_BURST_PER_IP: ${CYBERIA_CONNECT_BURST_PER_IP:-}
+      CYBERIA_MESSAGE_RATE: ${CYBERIA_MESSAGE_RATE:-}
+      CYBERIA_MESSAGE_BURST: ${CYBERIA_MESSAGE_BURST:-}
+      CYBERIA_MAX_STRIKES: ${CYBERIA_MAX_STRIKES:-}
     networks:
       - dd-cyberia-internal
     expose:
@@ -276,7 +262,7 @@ services:
     restart: unless-stopped
 
   cyberia-server-test:
-    image: ${CYBERIA_SERVER_IMAGE:-underpost/cyberia-server-dev}:${CYBERIA_SERVER_TAG:-v3.2.90}
+    image: ${CYBERIA_SERVER_IMAGE:-underpost/cyberia-server-dev}:${CYBERIA_SERVER_TAG:-v3.3.0}
     container_name: dd-cyberia-server-test
     environment:
       INSTANCE_CODE: TEST
@@ -288,6 +274,14 @@ services:
       STATIC_DIR: ${CYBERIA_SERVER_STATIC_DIR:-/home/dd/engine/cyberia-server/public}
       APP_ENV: ${CYBERIA_SERVER_APP_ENV:-development}
       LOG_LEVEL: ${CYBERIA_SERVER_LOG_LEVEL:-}
+      CYBERIA_DISABLE_CONNECTION_LIMITS: ${CYBERIA_DISABLE_CONNECTION_LIMITS:-}
+      CYBERIA_MAX_CONNECTIONS: ${CYBERIA_MAX_CONNECTIONS:-}
+      CYBERIA_MAX_CONNECTIONS_PER_IP: ${CYBERIA_MAX_CONNECTIONS_PER_IP:-}
+      CYBERIA_CONNECT_RATE_PER_IP: ${CYBERIA_CONNECT_RATE_PER_IP:-}
+      CYBERIA_CONNECT_BURST_PER_IP: ${CYBERIA_CONNECT_BURST_PER_IP:-}
+      CYBERIA_MESSAGE_RATE: ${CYBERIA_MESSAGE_RATE:-}
+      CYBERIA_MESSAGE_BURST: ${CYBERIA_MESSAGE_BURST:-}
+      CYBERIA_MAX_STRIKES: ${CYBERIA_MAX_STRIKES:-}
     networks:
       - dd-cyberia-internal
     expose:
@@ -315,7 +309,7 @@ services:
   #   cyberia-server-test   -> cyberia-client-test
 
   cyberia-client-runtime:
-    image: ${CYBERIA_CLIENT_IMAGE:-underpost/cyberia-client-dev}:${CYBERIA_CLIENT_TAG:-v3.2.90}
+    image: ${CYBERIA_CLIENT_IMAGE:-underpost/cyberia-client-dev}:${CYBERIA_CLIENT_TAG:-v3.3.0}
     container_name: dd-cyberia-client
     environment:
       CYBERIA_PORT: '8081'
@@ -340,7 +334,7 @@ services:
     restart: unless-stopped
 
   cyberia-client-forest:
-    image: ${CYBERIA_CLIENT_IMAGE:-underpost/cyberia-client-dev}:${CYBERIA_CLIENT_TAG:-v3.2.90}
+    image: ${CYBERIA_CLIENT_IMAGE:-underpost/cyberia-client-dev}:${CYBERIA_CLIENT_TAG:-v3.3.0}
     container_name: dd-cyberia-client-forest
     environment:
       CYBERIA_PORT: '8081'
@@ -365,7 +359,7 @@ services:
     restart: unless-stopped
 
   cyberia-client-test:
-    image: ${CYBERIA_CLIENT_IMAGE:-underpost/cyberia-client-dev}:${CYBERIA_CLIENT_TAG:-v3.2.90}
+    image: ${CYBERIA_CLIENT_IMAGE:-underpost/cyberia-client-dev}:${CYBERIA_CLIENT_TAG:-v3.3.0}
     container_name: dd-cyberia-client-test
     environment:
       CYBERIA_PORT: '8081'

package/src/server/backup.js

@@ -7,7 +7,7 @@
 import fs from 'fs-extra';
 import { loggerFactory } from './logger.js';
 import Underpost from '../index.js';
-import { loadCronDeployEnv } from './conf.js';
+import { loadCronDeployEnv } from './cron.js';
 
 const logger = loggerFactory(import.meta);