@underpostnet/cyberia 3.2.90 → 3.3.0

package/manifests/cronjobs/dd-cron/dd-cron-vultr.yaml

@@ -0,0 +1,52 @@
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: dd-cron-vultr
+  namespace: default
+  labels:
+    app: dd-cron-vultr
+    managed-by: underpost
+spec:
+  schedule: "*/30 * * * *"
+  concurrencyPolicy: Forbid
+  startingDeadlineSeconds: 200
+  successfulJobsHistoryLimit: 3
+  failedJobsHistoryLimit: 1
+  suspend: false
+  jobTemplate:
+    metadata:
+      labels:
+        app: dd-cron-vultr
+        managed-by: underpost
+    spec:
+      template:
+        metadata:
+          labels:
+            app: dd-cron-vultr
+            managed-by: underpost
+        spec:
+          containers:
+            - name: dd-cron-vultr
+              image: underpost/underpost-engine:v3.3.0
+              command:
+                - /bin/sh
+                - -c
+                - >
+                  cd /home/dd/engine &&
+                  node bin env dd-cron production &&
+                  node bin cron dd-cron vultr --git --kubeadm 
+              volumeMounts:
+                - mountPath: /home/dd/engine
+                  name: underpost-cron-container-volume
+                - mountPath: /usr/lib/node_modules/underpost
+                  name: underpost-share-env
+          volumes:
+            - hostPath:
+                path: /home/dd/engine
+                type: Directory
+              name: underpost-cron-container-volume
+            - hostPath:
+                path: /root/.nvm/versions/node/v24.15.0/lib/node_modules/underpost
+                type: DirectoryOrCreate
+              name: underpost-share-env
+          restartPolicy: OnFailure

package/manifests/deployment/dd-cyberia-development/deployment.yaml

@@ -20,7 +20,7 @@ spec:
     spec:
       containers:
         - name: dd-cyberia-development-blue
-          image: underpost/underpost-engine:v3.2.90
+          image: underpost/underpost-engine:v3.3.0
           imagePullPolicy: IfNotPresent
           envFrom:
             - secretRef:

package/manifests/deployment/dd-default-development/deployment.yaml

@@ -17,7 +17,7 @@ spec:
     spec:
       containers:
         - name: dd-default-development-blue
-          image: underpost/underpost-engine:v3.2.90
+          image: underpost/underpost-engine:v3.3.0
           #          resources:
           #            requests:
           #              memory: "124Ki"
@@ -98,7 +98,7 @@ spec:
     spec:
       containers:
         - name: dd-default-development-green
-          image: underpost/underpost-engine:v3.2.90
+          image: underpost/underpost-engine:v3.3.0
           #          resources:
           #            requests:
           #              memory: "124Ki"

package/package.json

@@ -2,7 +2,7 @@
     "type": "module",
     "main": "src/index.js",
     "name": "@underpostnet/cyberia",
-    "version": "3.2.90",
+    "version": "3.3.0",
     "description": "Cyberia CLI — toolchain for the Cyberia MMO data layer, content pipeline, persistence, gRPC services, and ERC-1155 lifecycle on Hyperledger Besu.",
     "scripts": {
         "start": "node --max-old-space-size=8192 src/server",
@@ -72,7 +72,7 @@
     },
     "homepage": "https://github.com/underpostnet/engine-cyberia#readme",
     "dependencies": {
-        "underpost": "^3.2.90",
+        "underpost": "^3.3.0",
         "adm-zip": "^0.6.0",
         "maxrects-packer": "^2.7.3",
         "pngjs": "^7.0.0",

package/scripts/audit-selinux.sh

@@ -0,0 +1,64 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+SINCE="recent"
+FAIL_ON_AVC="1"
+
+while [ "$#" -gt 0 ]; do
+    case "$1" in
+        --since)
+            [ "$#" -ge 2 ] || { echo "--since requires an ausearch time value" >&2; exit 2; }
+            SINCE="$2"
+            shift 2
+            ;;
+        --no-fail)
+            FAIL_ON_AVC="0"
+            shift
+            ;;
+        -h|--help)
+            echo "Usage: $0 [--since recent|today|boot|TIME] [--no-fail]"
+            exit 0
+            ;;
+        *)
+            echo "Unknown option: $1" >&2
+            exit 2
+            ;;
+    esac
+done
+
+command -v getenforce >/dev/null 2>&1 || {
+    echo "SELinux userspace is unavailable. Install policycoreutils." >&2
+    exit 2
+}
+command -v ausearch >/dev/null 2>&1 || {
+    echo "ausearch is unavailable. Install audit and start auditd." >&2
+    exit 2
+}
+
+MODE="$(getenforce)"
+echo "SELinux mode: $MODE"
+[ "$MODE" = "Enforcing" ] || echo "WARNING: expected Enforcing mode" >&2
+command -v sestatus >/dev/null 2>&1 && sestatus
+
+AUDIT=(ausearch)
+[ "$(id -u)" -eq 0 ] || AUDIT=(sudo ausearch)
+RAW_FILE="$(mktemp /tmp/underpost-selinux-avc.XXXXXX)"
+trap 'rm -f "$RAW_FILE"' EXIT
+
+"${AUDIT[@]}" -m AVC,USER_AVC,SELINUX_ERR -ts "$SINCE" --raw > "$RAW_FILE" 2>/dev/null || true
+if ! grep -q '^type=' "$RAW_FILE"; then
+    echo "No SELinux AVC denials found since: $SINCE"
+    [ "$MODE" = "Enforcing" ]
+    exit
+fi
+
+echo "SELinux AVC denials found since: $SINCE" >&2
+"${AUDIT[@]}" -m AVC,USER_AVC,SELINUX_ERR -ts "$SINCE" -i || true
+if command -v sealert >/dev/null 2>&1; then
+    echo "sealert analysis:"
+    sealert -a "$RAW_FILE" || true
+else
+    echo "Install setroubleshoot-server for sealert analysis." >&2
+fi
+
+[ "$FAIL_ON_AVC" = "0" ] || exit 1

package/scripts/coverall-test-cyberia.sh

@@ -0,0 +1,24 @@
+#!/usr/bin/env bash
+set -u -o pipefail
+
+EXCLUDES=(
+    --exclude="test/cluster-instances.test.js"
+    --exclude="test/deploy-monitor.test.js"
+    --exclude="test/deploy-node-placement.test.js"
+    --exclude="test/instance-traffic-plan.test.js"
+    --exclude="test/sops-secret-store.test.js"
+    --exclude="test/underpost-gateway.test.js"
+    --exclude="test/underpost-ingress.test.js"
+    --exclude="test/wireguard-edge.test.js"
+)
+
+TESTS=(
+    test/cyberia-instance-conf-defaults.test.js
+    test/cyberia-load.test.js
+    test/object-layer-item-id.test.js
+    test/api.test.js
+    test/crypto.test.js
+    test/shape-generator.test.js
+)
+
+c8 "${EXCLUDES[@]}" mocha "${TESTS[@]}"

package/scripts/coverall-test.sh

@@ -0,0 +1,24 @@
+#!/usr/bin/env bash
+set -u -o pipefail
+
+EXCLUDES=(
+    --exclude="test/cyberia-instance-conf-defaults.test.js"
+    --exclude="test/cyberia-load.test.js"
+    --exclude="test/object-layer-item-id.test.js"
+    --exclude="test/api.test.js"
+    --exclude="test/crypto.test.js"
+    --exclude="test/shape-generator.test.js"
+)
+
+TESTS=(
+    test/cluster-instances.test.js
+    test/deploy-monitor.test.js
+    test/deploy-node-placement.test.js
+    test/instance-traffic-plan.test.js
+    test/sops-secret-store.test.js
+    test/underpost-gateway.test.js
+    test/underpost-ingress.test.js
+    test/wireguard-edge.test.js
+)
+
+c8 "${EXCLUDES[@]}" mocha "${TESTS[@]}"

package/scripts/k3s-node-setup.sh

@@ -49,22 +49,25 @@ if [ -z "$(ls -A "$ENGINE_ROOT")" ]; then
 fi
 
 # ---------------------------------------------------------------------------
-# NVM and Node.js — required for `node bin ...` entrypoints
+# System-wide Node.js is required by service units under SELinux.
 # ---------------------------------------------------------------------------
-echo "Installing NVM and Node.js v24.15.0..."
-
-curl -o- https://cdn.jsdelivr.net/gh/nvm-sh/nvm@v0.40.1/install.sh | bash
-
-export NVM_DIR="$([ -z "${XDG_CONFIG_HOME-}" ] && printf %s "${HOME}/.nvm" || printf %s "${XDG_CONFIG_HOME}/nvm")"
-# shellcheck disable=SC1090
-[ -s "$NVM_DIR/nvm.sh" ] && \. "$NVM_DIR/nvm.sh"
+if command -v dnf >/dev/null 2>&1; then
+    sudo dnf install -y policycoreutils policycoreutils-python-utils selinux-policy-targeted audit
+fi
 
-nvm install 24.15.0
-nvm use 24.15.0
-nvm alias default 24.15.0
-ln -sf "$(command -v node)" /usr/local/bin/node
-ln -sf "$(command -v npm)" /usr/local/bin/npm
-ln -sf "$(command -v npx)" /usr/local/bin/npx
+if ! command -v node >/dev/null 2>&1 || ! node --version 2>/dev/null | grep -q '^v24'; then
+    echo "Installing system-wide Node.js 24..."
+    if command -v dnf >/dev/null 2>&1; then
+        curl -fsSL https://rpm.nodesource.com/setup_24.x | sudo bash -
+        sudo dnf install -y nodejs
+    elif command -v apt-get >/dev/null 2>&1; then
+        curl -fsSL https://deb.nodesource.com/setup_24.x | sudo bash -
+        sudo apt-get install -y nodejs
+    else
+        echo "ERROR: a supported system package manager is required for Node.js 24" >&2
+        exit 1
+    fi
+fi
 
 echo "
 ██╗░░░██╗███╗░░██╗██████╗░███████╗██████╗░██████╗░░█████╗░░██████╗████████╗
@@ -116,7 +119,7 @@ if [ "$ROLE" = "control" ]; then
     curl -sfL https://get.k3s.io | \
     K3S_URL="https://${CONTROL_IP}:6443" \
     K3S_TOKEN="${K3S_TOKEN}" \
-    sh -s - agent
+    sh -s - agent $(if command -v selinuxenabled >/dev/null 2>&1 && selinuxenabled; then printf '%s' '--selinux'; fi)
     
     echo ""
     echo "K3s worker joined https://${CONTROL_IP}:6443 successfully."

package/scripts/kubeadm-node-setup.sh

@@ -5,8 +5,8 @@ set -euo pipefail
 # Underpost Kubeadm Node Setup (bare-metal physical node)
 #
 # Mirrors scripts/k3s-node-setup.sh but for kubeadm on real hardware: it runs on
-# the freshly deployed OS (disk-installed Rocky) after first boot, installs NVM +
-# Node.js, ensures the engine source is present, and drives the cluster bring-up
+# the freshly deployed OS (disk-installed Rocky) after first boot, installs
+# system-wide Node.js, ensures the engine source is present, and drives the cluster bring-up
 # through the local engine entrypoint `node bin cluster` (src/cli/cluster.js) —
 # reusing its kubeadm + Contour + host-init logic instead of reimplementing it.
 #
@@ -146,33 +146,22 @@ if [ "$JOIN_ONLY" = "1" ]; then
 fi
 
 # ---------------------------------------------------------------------------
-# 0. Base prerequisites — a minimal @core Rocky install lacks tar/xz/git, which
-#    NVM needs to extract Node.js and the engine clone needs. Install them first.
+# 0. Base prerequisites.
 # ---------------------------------------------------------------------------
-log "Installing base prerequisites (tar, xz, gzip, git, curl)..."
-sudo dnf install -y tar xz gzip bzip2 git curl ca-certificates which findutils 2>/dev/null \
-|| dnf install -y tar xz gzip bzip2 git curl ca-certificates which findutils
+log "Installing base prerequisites..."
+sudo dnf install -y tar xz gzip bzip2 git curl ca-certificates which findutils policycoreutils policycoreutils-python-utils selinux-policy-targeted audit 2>/dev/null \
+|| dnf install -y tar xz gzip bzip2 git curl ca-certificates which findutils policycoreutils policycoreutils-python-utils selinux-policy-targeted audit
 
 # ---------------------------------------------------------------------------
-# 1. NVM and Node.js — required for the `node bin ...` entrypoints. Idempotent so
-#    a retried run does not reinstall Node from scratch.
+# 1. System-wide Node.js. Home-directory runtimes cannot be used by hardened
+#    systemd services under SELinux.
 # ---------------------------------------------------------------------------
 if command -v node >/dev/null 2>&1 && node --version 2>/dev/null | grep -q '^v24'; then
-    log "Node.js $(node --version) already installed; skipping NVM setup"
+    log "Node.js $(node --version) already installed"
 else
-    log "Installing NVM and Node.js v24.15.0..."
-    curl -o- https://cdn.jsdelivr.net/gh/nvm-sh/nvm@v0.40.1/install.sh | bash
-    
-    export NVM_DIR="$([ -z "${XDG_CONFIG_HOME-}" ] && printf %s "${HOME}/.nvm" || printf %s "${XDG_CONFIG_HOME}/nvm")"
-    # shellcheck disable=SC1090
-    [ -s "$NVM_DIR/nvm.sh" ] && \. "$NVM_DIR/nvm.sh"
-    
-    nvm install 24.15.0
-    nvm use 24.15.0
-    nvm alias default 24.15.0
-    ln -sf "$(command -v node)" /usr/local/bin/node
-    ln -sf "$(command -v npm)" /usr/local/bin/npm
-    ln -sf "$(command -v npx)" /usr/local/bin/npx
+    log "Installing system-wide Node.js 24..."
+    curl -fsSL https://rpm.nodesource.com/setup_24.x | sudo bash -
+    sudo dnf install -y nodejs
 fi
 
 echo "

package/scripts/nat-iptables.sh

@@ -42,12 +42,14 @@ echo "[INFO] Opening Kubernetes control plane ports..."
 
 # Kubernetes API Server
 sudo firewall-cmd --permanent --zone=public --add-port=6443/tcp
+sudo firewall-cmd --permanent --zone=public --add-port=6443/udp
 
 # etcd
 sudo firewall-cmd --permanent --zone=public --add-port=2379-2380/tcp
 
 # kubelet API
 sudo firewall-cmd --permanent --zone=public --add-port=10250/tcp
+sudo firewall-cmd --permanent --zone=public --add-port=10250/udp
 
 # kube-scheduler
 sudo firewall-cmd --permanent --zone=public --add-port=10259/tcp

package/scripts/rocky-kickstart.sh

@@ -168,7 +168,7 @@ PermitEmptyPasswords no
 PasswordAuthentication ${SSHD_PASSWORD_AUTH}
 ChallengeResponseAuthentication ${SSHD_KBD_INTERACTIVE}
 KbdInteractiveAuthentication ${SSHD_KBD_INTERACTIVE}
-UsePAM no
+UsePAM yes
 X11Forwarding no
 PrintMotd no
 TCPKeepAlive yes
@@ -585,7 +585,7 @@ fi
 post_status "installing" "\"detail\":\"installing packages\",\"disk\":\"\$REAL_DISK\""
 
 ilog "Installing base packages with dnf --installroot ..."
-PKGS="@core kernel grub2-tools openssh-server NetworkManager chrony dracut-config-generic rocky-release"
+PKGS="@core kernel grub2-tools openssh-server NetworkManager chrony dracut-config-generic rocky-release policycoreutils policycoreutils-python-utils selinux-policy-targeted audit sudo"
 if [ "\$FW" = "uefi" ]; then
     PKGS="\$PKGS grub2-efi-x64 shim-x64 efibootmgr"
 else
@@ -622,15 +622,10 @@ ilog "Configuring installed system (hostname, network, ssh, users) ..."
 echo "\${TARGET_HOSTNAME:-rocky9}" > "\$TARGET_MNT/etc/hostname"
 
 chroot "\$TARGET_MNT" /bin/bash -s << CHROOTEOF >> "\$KS_LOG" 2>&1
-set +e
+set -e
 systemctl enable sshd NetworkManager chronyd 2>/dev/null
 
-# SELinux -> permissive in the DEPLOYED OS. Critical: with SELinux enforcing on
-# first boot, files written from this installer chroot (authorized_keys, home
-# dirs) carry the wrong security context, so sshd drops sessions ("Connection
-# reset by peer") and PAM can block console logins. Permissive ignores contexts
-# (no relabel reboot needed) and matches what kubeadm/cluster.js expect.
-sed -i 's/^SELINUX=.*/SELINUX=permissive/' /etc/selinux/config 2>/dev/null || true
+sed -i 's/^SELINUX=.*/SELINUX=enforcing/' /etc/selinux/config
 
 # Ensure sshd host keys exist so sshd actually starts on first boot.
 ssh-keygen -A 2>/dev/null || true
@@ -708,11 +703,19 @@ fi
 # Key-only SSH on the installed system.
 mkdir -p /etc/ssh/sshd_config.d
 cat > /etc/ssh/sshd_config.d/00-underpost.conf <<SSHDEOF
+Port ${SSH_PORT}
 PermitRootLogin prohibit-password
 PubkeyAuthentication yes
 PasswordAuthentication no
+KbdInteractiveAuthentication no
+UsePAM yes
 SSHDEOF
 
+if [ "${SSH_PORT}" != "22" ]; then
+    semanage port -a -t ssh_port_t -p tcp "${SSH_PORT}" 2>/dev/null || \
+        semanage port -m -t ssh_port_t -p tcp "${SSH_PORT}"
+fi
+
 # Create the admin login accounts. create_user <name> writes the authorized key,
 # wheel membership and passwordless sudo. Passwords are applied after the chroot.
 create_user() {
@@ -738,11 +741,24 @@ chmod 600 /root/.ssh/authorized_keys
 create_user "\${ADMIN_USER}"
 create_user "\${DEPLOY_USER}"
 
+restorecon -RF /etc/ssh /etc/sudoers.d /root/.ssh /home 2>/dev/null
+touch /.autorelabel
+
 # Build initramfs for the installed kernel.
 KVER=\\\$(ls /lib/modules | head -1)
 [ -n "\\\$KVER" ] && dracut -f /boot/initramfs-\\\$KVER.img "\\\$KVER"
 CHROOTEOF
 
+CHROOT_RC=\$?
+if [ "\$CHROOT_RC" -ne 0 ]; then
+    ilog "FATAL: installed-system configuration failed (rc=\$CHROOT_RC)"
+    post_status "failed" "\"detail\":\"installed-system configuration rc=\$CHROOT_RC\""
+    for d in dev proc sys run; do umount -l "\$TARGET_MNT/\$d" 2>/dev/null; done
+    umount -R "\$TARGET_MNT" 2>/dev/null || true
+    rm -f "\$INSTALL_LOCK"
+    exit 1
+fi
+
 # Set console passwords AFTER the chroot heredoc, from decoded installer vars.
 # Primary path: pipe 'user:password' into 'chroot chpasswd' (keeps password
 # characters out of any heredoc). Fallback: hash with openssl and apply via

package/scripts/test-monitor.sh

@@ -24,7 +24,7 @@ MODE=runtime                                  # runtime | instance
 ENV=development                               # development | production
 DEPLOY_ID=dd-test                             # deploy id (instance mode: parent of conf.instances.json)
 INSTANCE_IDS=                                 # instance mode: csv of ids (default: all in conf.instances.json)
-IMAGE=underpost/wp:v3.2.90                    # runtime mode image (instance mode reads image from conf)
+IMAGE=underpost/wp:v3.3.0                    # runtime mode image (instance mode reads image from conf)
 VERSIONS=green                                # csv of blue/green versions
 REPLICAS=1                                    # replicas per deployment
 NAMESPACE=default                             # k8s namespace

package/src/api/cyberia-instance/cyberia-fallback-default-items.js

@@ -0,0 +1,63 @@
+/**
+ * Fallback-world default items — process-local override store.
+ *
+ * The procedural fallback world is never persisted, so its default item set
+ * has no collection to live in. This module holds the set the FallbackWorldEngine
+ * view composed, in memory, for the lifetime of the engine process:
+ *
+ *   - written by  POST /api/cyberia-instance/fallback-world/hot-reload
+ *   - read by     fetchFullInstance()'s fallback branch (instance-data.js) and
+ *                 GET /api/cyberia-instance/fallback-world[/default-items]
+ *
+ * Deliberately NOT persisted: an engine restart drops back to the code defaults,
+ * so a stale editor session can never become the permanent shape of the world.
+ * This keeps the fallback path's "code defaults are authoritative" invariant —
+ * the only thing an operator can layer on top is this explicit, volatile list.
+ *
+ * @module src/api/cyberia-instance/cyberia-fallback-default-items.js
+ */
+
+/** @typedef {{ id: string, defaultPlayerInventory: boolean }} FallbackDefaultItem */
+
+/** @type {FallbackDefaultItem[]} */
+let defaultItems = [];
+
+/**
+ * Coerce a caller-supplied list into the canonical `{ id, defaultPlayerInventory }`
+ * shape. Accepts the legacy `string[]` form and drops blank/duplicate ids so the
+ * world generator never sees a malformed entry.
+ *
+ * @param {Array<string|FallbackDefaultItem>} entries
+ * @returns {FallbackDefaultItem[]}
+ */
+function normalizeFallbackDefaultItems(entries) {
+  if (!Array.isArray(entries)) return [];
+  const seen = new Set();
+  const normalized = [];
+  for (const entry of entries) {
+    const raw = typeof entry === 'string' ? { id: entry } : entry;
+    const id = typeof raw?.id === 'string' ? raw.id.trim() : '';
+    if (!id || seen.has(id)) continue;
+    seen.add(id);
+    normalized.push({ id, defaultPlayerInventory: !!raw.defaultPlayerInventory });
+  }
+  return normalized;
+}
+
+/**
+ * Current override set. Returns a copy so callers cannot mutate the store.
+ * @returns {FallbackDefaultItem[]}
+ */
+const getFallbackDefaultItems = () => defaultItems.map((entry) => ({ ...entry }));
+
+/**
+ * Replace the override set. An empty list clears it, restoring pure code defaults.
+ * @param {Array<string|FallbackDefaultItem>} entries
+ * @returns {FallbackDefaultItem[]} The stored set.
+ */
+function setFallbackDefaultItems(entries) {
+  defaultItems = normalizeFallbackDefaultItems(entries);
+  return getFallbackDefaultItems();
+}
+
+export { getFallbackDefaultItems, setFallbackDefaultItems, normalizeFallbackDefaultItems };

package/src/api/cyberia-instance/cyberia-fallback-world.js

@@ -179,7 +179,7 @@ function generateFallbackMap(mapCode, colors, opts = {}) {
   const portalEntities = generatePortalEntities(mapDims, colors, { grid });
 
   // 6. Bots — placed on walkable cells (avoids obstacles, portals, NPCs)
-  const bots = generateBots(mapDims, colors, { count: opts.botCount, grid });
+  const bots = mapCode === 'fallback-map-0' ? [] : generateBots(mapDims, colors, { count: opts.botCount, grid });
 
   // 7. Resources — static exploitable entities placed on walkable cells
   const resources = generateResources(mapDims, colors, { count: opts.resourceCount, grid });
@@ -232,6 +232,11 @@ function generateFallbackMap(mapCode, colors, opts = {}) {
  * @param {number} [opts.resourceCount]        Resources per map (random if omitted).
  * @param {number} [opts.staticCount]          Static decorators per map (random if omitted).
  * @param {Array}  [opts.colors]              Override palette.
+ * @param {Array<{id: string, defaultPlayerInventory: boolean}>} [opts.itemIds=[]]
+ *   Instance-level default items, mirroring `CyberiaInstance.itemIds`. Entries
+ *   flagged `defaultPlayerInventory` are merged into the player entity default
+ *   by `applyInstanceDefaultPlayerInventory`; every id is also resolved to an
+ *   atlas at boot. Layout is unaffected, so this stays outside the world seed.
  * @returns {{
  *   instance: object,
  *   maps: object[],
@@ -256,6 +261,7 @@ function generateFallbackWorld(opts = {}) {
     // fallback before atlases load. The C client resolves real colours
     // through domain/presentation_runtime — it does not read this value.
     colors = PALETTE,
+    itemIds = [],
   } = opts;
 
   // Surface item-id drift loudly on the very first build, so a missing
@@ -314,6 +320,7 @@ function generateFallbackWorld(opts = {}) {
     portals,
     topologyMode: 'procedural',
     playerSpawn: { ...DEFAULT_PLAYER_SPAWN },
+    itemIds: itemIds.map((entry) => ({ ...entry })),
   };
 
   return {

package/src/api/cyberia-instance/cyberia-instance.controller.js

@@ -30,6 +30,9 @@ const CyberiaInstanceController = buildCrudController(CyberiaInstanceService, {
   portalConnect: serviceHandler(CyberiaInstanceService.portalConnect),
   // Moderator/admin-triggered world reload on a running cyberia-server.
   hotReload: serviceHandler(CyberiaInstanceService.hotReload, { errorStatus: 502 }),
+  // Fallback-world default items (volatile) + its own reload trigger.
+  fallbackDefaultItems: serviceHandler(CyberiaInstanceService.fallbackDefaultItems),
+  fallbackHotReload: serviceHandler(CyberiaInstanceService.fallbackHotReload, { errorStatus: 502 }),
   // Boot transport (REST fallback of the gRPC CyberiaDataService).
   bootPing: serviceHandler(CyberiaInstanceBootService.ping),
   bootObjectLayerBatch: serviceHandler(CyberiaInstanceBootService.objectLayerBatch, { errorStatus: 500 }),

package/src/api/cyberia-instance/cyberia-instance.router.js

@@ -38,6 +38,19 @@ class CyberiaInstanceRouter {
       async (req, res) => await CyberiaInstanceController.bootFullInstance(req, res, options),
     );
     router.get(`/fallback-world`, async (req, res) => await CyberiaInstanceController.fallbackWorld(req, res, options));
+    // Fallback-world default items — volatile, process-local (never persisted).
+    // The read is open (same as /fallback-world); staging them and triggering a
+    // rebuild is elevated privilege, like every other hot-reload path.
+    router.get(
+      `/fallback-world/default-items`,
+      async (req, res) => await CyberiaInstanceController.fallbackDefaultItems(req, res, options),
+    );
+    router.post(
+      `/fallback-world/hot-reload`,
+      options.authMiddleware,
+      moderatorGuard,
+      async (req, res) => await CyberiaInstanceController.fallbackHotReload(req, res, options),
+    );
     // Instance Map — static topology/presence plus dynamic player capability activity.
     router.get(
       `/instance-map/:instanceCode/static`,

package/src/api/cyberia-instance/cyberia-instance.service.js

@@ -7,6 +7,8 @@ import {
   fallbackListInstance,
   DEFAULT_FALLBACK_INSTANCE_CODE,
 } from './cyberia-fallback-world.js';
+import { getFallbackDefaultItems, setFallbackDefaultItems } from './cyberia-fallback-default-items.js';
+import { CYBERIA_INSTANCE_CONF_DEFAULTS } from '../cyberia-server-defaults/cyberia-server-defaults.js';
 import { triggerHotReload } from '../../projects/cyberia/hot-reload-trigger.js';
 
 const logger = loggerFactory(import.meta);
@@ -183,8 +185,49 @@ class CyberiaInstanceService {
       botCount: q.botCount ? parseInt(q.botCount, 10) : undefined,
       obstacleCount: q.obstacleCount ? parseInt(q.obstacleCount, 10) : undefined,
       foregroundCount: q.foregroundCount ? parseInt(q.foregroundCount, 10) : undefined,
+      itemIds: getFallbackDefaultItems(),
     });
   };
+
+  /**
+   * Current fallback-world default items — the volatile set the
+   * FallbackWorldEngine view last pushed, or `[]` when the engine is running on
+   * pure code defaults. Lets the view reopen showing what this process serves.
+   *
+   * `entityDefaultItemIds` are the ids the code defaults already ship in an
+   * entity's `defaultObjectLayers`. Selecting one of them and leaving
+   * `defaultPlayerInventory` unchecked REMOVES it (see
+   * applyInstanceDefaultPlayerInventory), so the editor needs to be able to warn
+   * before an operator silently strips the player's starting skin or weapon.
+   */
+  static fallbackDefaultItems = async () => {
+    const entityDefaultItemIds = new Set();
+    for (const entityDefault of CYBERIA_INSTANCE_CONF_DEFAULTS.entityDefaults || []) {
+      for (const layer of entityDefault.defaultObjectLayers || []) {
+        if (layer.itemId) entityDefaultItemIds.add(layer.itemId);
+      }
+    }
+    return { itemIds: getFallbackDefaultItems(), entityDefaultItemIds: [...entityDefaultItemIds].sort() };
+  };
+
+  /**
+   * Stage the fallback world's default items, then ask a running cyberia-server
+   * to rebuild. The items are not persisted (see cyberia-fallback-default-items):
+   * they are staged here first so the rebuild's `getFullInstance` re-fetch picks
+   * them up, which is what makes them reach the server at all.
+   *
+   * `instanceCode` is intentionally left empty — the target world is addressed by
+   * `serverUrl` (origin, or origin + variant sub-path), and naming the synthetic
+   * `fallback` code would be rejected by any server serving a real instance code.
+   */
+  static fallbackHotReload = async (req) => {
+    const { serverUrl, mode, itemIds } = req.body || {};
+    if (!serverUrl) throw new Error('serverUrl is required');
+
+    const staged = setFallbackDefaultItems(itemIds || []);
+    const { transport, result, grpcError } = await triggerHotReload({ serverUrl, instanceCode: '', mode });
+    return { transport, itemIds: staged, grpcError, ...result };
+  };
 }
 
 export { CyberiaInstanceService };

package/src/api/cyberia-instance-conf/cyberia-instance-conf.model.js

@@ -148,6 +148,7 @@ const CyberiaInstanceConfSchema = new Schema(
     // ── Player defaults ──────────────────────────────────────────────
     defaultPlayerWidth: { type: Number, default: D.defaultPlayerWidth },
     defaultPlayerHeight: { type: Number, default: D.defaultPlayerHeight },
+    playerBaseSpeed: { type: Number, default: D.playerBaseSpeed },
     playerBaseLifeRegenMin: { type: Number, default: D.playerBaseLifeRegenMin },
     playerBaseLifeRegenMax: { type: Number, default: D.playerBaseLifeRegenMax },
     sumStatsLimit: { type: Number, default: D.sumStatsLimit },