@underpostnet/cyberia 3.2.90 → 3.3.73

package/.dockerignore

@@ -6,6 +6,7 @@
 /logs
 /build
 /.env
+/.underpost
 /coverage
 /prometheus_data
 /grafana_data

package/.env.example

@@ -70,6 +70,22 @@ CYBERIA_DEFAULT_INSTANCE=amethyst-strata-expansion
 CYBERIA_SERVER_APP_ENV=development
 CYBERIA_SERVER_LOG_LEVEL=
 
+# --- cyberia-server WebSocket admission and rate limits ----------------------
+# Unset keeps the built-in default. An explicit 0 turns that one limit off.
+# The startup log prints the effective profile ("ws limits: ...").
+#
+# Set CYBERIA_DISABLE_CONNECTION_LIMITS=1 to turn every limit off. The load test
+# (test/cyberia-load.test.js) drives every simulated client from one address, so
+# it needs this. NEVER enable it on a public deploy.
+CYBERIA_DISABLE_CONNECTION_LIMITS=
+CYBERIA_MAX_CONNECTIONS=
+CYBERIA_MAX_CONNECTIONS_PER_IP=
+CYBERIA_CONNECT_RATE_PER_IP=
+CYBERIA_CONNECT_BURST_PER_IP=
+CYBERIA_MESSAGE_RATE=
+CYBERIA_MESSAGE_BURST=
+CYBERIA_MAX_STRIKES=
+
 # --- engine-cyberia runtime env (loaded into the container via env_file) -----
 # The dd-cyberia engine (engine-private/conf/dd-cyberia/conf.server.json) needs
 # these to boot: DB auth + per-site DB names, the base PORT (the cyberia host is

package/.github/workflows/coverall.cyberia.ci.yml

@@ -0,0 +1,107 @@
+name: CI | Coverall Cyberia
+
+on:
+  push:
+    branches: ['master', 'main']
+  pull_request:
+    branches: ['master', 'main']
+
+jobs:
+  test:
+    name: Coverall Cyberia Test
+    # Deliberately not the engine repository: two coverage workflows on one commit
+    # are two Coveralls builds, and the badge then shows whichever landed last
+    # rather than the tree's coverage. The engine is served by coverall.ci.yml.
+    if: |
+      github.actor != 'dependabot[bot]' &&
+      (github.repository == 'underpostnet/engine-cyberia' ||
+       github.repository == 'underpostnet/engine-ghpkg-cyberia' ||
+       github.repository == 'underpostnet/engine-test-cyberia')
+    runs-on: ubuntu-latest
+    container:
+      image: quay.io/rockylinux/rockylinux:9
+    steps:
+      - name: Clone repository
+        uses: actions/checkout@v7
+
+      - name: Install required packages
+        run: |
+          dnf install -y sudo tar gzip bzip2 git bash
+          dnf install -y curl --allowerasing
+
+      - name: Install Node.js
+        run: |
+          curl -fsSL https://rpm.nodesource.com/setup_24.x | bash -
+          dnf install nodejs -y
+
+      - name: Install project dependencies
+        run: npm install
+
+      # Set the COVERAGE_MIN repository variable to gate below the shipped
+      # default while the suite is catching up to it.
+      - name: Run tests and enforce coverage threshold
+        run: COVERAGE_ENFORCE=1 node bin test unit,infra,app,cyberia
+        env:
+          COVERAGE_MIN: ${{ vars.COVERAGE_MIN }}
+
+      # Stored even when the threshold step failed — that step still fails the
+      # job, but without the report the badge freezes at the last passing build.
+      - name: Store coverage report
+        if: '!cancelled()'
+        uses: actions/upload-artifact@v7
+        with:
+          name: coverall-cyberia-lcov
+          path: ./coverage/lcov.info
+          if-no-files-found: error
+
+  upload:
+    name: Upload Cyberia Coverage to Coveralls
+    needs: test
+    # Host runner, not the Rocky container the suite runs in: every step of the
+    # Coveralls action declares `shell: bash`, which the runner execs inside the
+    # job container and cannot resolve there.
+    if: |
+      !cancelled() &&
+      github.actor != 'dependabot[bot]' &&
+      (github.repository == 'underpostnet/engine-cyberia' ||
+       github.repository == 'underpostnet/engine-ghpkg-cyberia' ||
+       github.repository == 'underpostnet/engine-test-cyberia')
+    runs-on: ubuntu-latest
+    steps:
+      # Coveralls reads the commit and branch metadata from the checkout.
+      - name: Clone repository
+        uses: actions/checkout@v7
+
+      - name: Restore coverage report
+        uses: actions/download-artifact@v8
+        with:
+          name: coverall-cyberia-lcov
+          path: ./coverage
+
+      - name: Upload coverage to Coveralls
+        uses: coverallsapp/github-action@v2
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          file: ./coverage/lcov.info
+          format: lcov
+          parallel: true
+          fail-on-error: true
+
+  finish:
+    name: Finish Cyberia Coveralls build
+    needs: upload
+    # The build stays open until this webhook lands, so it runs on any upload
+    # outcome rather than leaving a half-reported build behind.
+    if: |
+      !cancelled() &&
+      github.actor != 'dependabot[bot]' &&
+      (github.repository == 'underpostnet/engine-cyberia' ||
+       github.repository == 'underpostnet/engine-ghpkg-cyberia' ||
+       github.repository == 'underpostnet/engine-test-cyberia')
+    runs-on: ubuntu-latest
+    steps:
+      - name: Notify Coveralls Finished
+        uses: coverallsapp/github-action@v2
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          parallel-finished: true

package/.github/workflows/cyberia-client.cd.yml

@@ -32,21 +32,9 @@ jobs:
           script: |
             set -e
             set -o pipefail
-            echo "Starting remote deploy"
-            cd /home/dd/engine
-            TARGET_NODE=hp-envy-iso-ram-rocky9
-            INGRESS_NODE=localhost.localdomain
-            sudo -n -- /bin/bash -lc "node bin run pull"
-            sudo -n -- /bin/bash -lc "node bin run secret"
-            sudo -n -- /bin/bash -lc "node bin/build dd-cyberia --conf"
-            sudo -n -- /bin/bash -lc "kubectl wait --for=condition=Ready node/${TARGET_NODE} --timeout=2m"
-            sudo -n -- /bin/bash -lc "kubectl rollout status deployment/underpost-ingress -n default --timeout=5m"
-            sudo -n -- /bin/bash -lc "kubectl rollout status deployment/underpost-gateway -n default --timeout=5m"
-            sudo -n -- /bin/bash -lc "node bin run instance \
-              --kubeadm \
-              --gateway-api \
-              --image-pull-policy Always \
-              --node-name ${TARGET_NODE} \
-              --ingress-node ${INGRESS_NODE} \
-              --ssh-key-path /home/dd/tmp/897as9dxhaskd9 \
-              'dd-cyberia,mmo-client'"
+            # Carried across the SSH hop so the far side reports in GitHub Actions form:
+            # deploy/lib/github-actions-logging.sh folds its monitor frames into collapsed groups, and the
+            # state domain's telemetry export emits ::notice::/::error:: annotations this job
+            # surfaces. GITHUB_ACTIONS itself is a runner-local variable and does not travel.
+            export RUN_QUIET_CI=github
+            bash /home/dd/engine/deploy/cyberia-client/deploy.sh

package/.github/workflows/cyberia-server.cd.yml

@@ -32,21 +32,9 @@ jobs:
           script: |
             set -e
             set -o pipefail
-            echo "Starting remote deploy"
-            cd /home/dd/engine
-            TARGET_NODE=hp-envy-iso-ram-rocky9
-            INGRESS_NODE=localhost.localdomain
-            sudo -n -- /bin/bash -lc "node bin run pull"
-            sudo -n -- /bin/bash -lc "node bin run secret"
-            sudo -n -- /bin/bash -lc "node bin/build dd-cyberia --conf"
-            sudo -n -- /bin/bash -lc "kubectl wait --for=condition=Ready node/${TARGET_NODE} --timeout=2m"
-            sudo -n -- /bin/bash -lc "kubectl rollout status deployment/underpost-ingress -n default --timeout=5m"
-            sudo -n -- /bin/bash -lc "kubectl rollout status deployment/underpost-gateway -n default --timeout=5m"
-            sudo -n -- /bin/bash -lc "node bin run instance \
-              --kubeadm \
-              --gateway-api \
-              --image-pull-policy Always \
-              --node-name ${TARGET_NODE} \
-              --ingress-node ${INGRESS_NODE} \
-              --ssh-key-path /home/dd/tmp/897as9dxhaskd9 \
-              'dd-cyberia,mmo-server'"
+            # Carried across the SSH hop so the far side reports in GitHub Actions form:
+            # deploy/lib/github-actions-logging.sh folds its monitor frames into collapsed groups, and the
+            # state domain's telemetry export emits ::notice::/::error:: annotations this job
+            # surfaces. GITHUB_ACTIONS itself is a runner-local variable and does not travel.
+            export RUN_QUIET_CI=github
+            bash /home/dd/engine/deploy/cyberia-server/deploy.sh

package/.github/workflows/docker-image.cyberia-client.ci.yml

@@ -4,7 +4,7 @@ on:
   workflow_dispatch:
 
 env:
-  UNDERPOST_VERSION: '3.2.90'
+  UNDERPOST_VERSION: '3.3.73'
 
 jobs:
   build-and-push:
@@ -34,9 +34,15 @@ jobs:
       - name: Build cyberia-server SSR dashboard
         working-directory: engine
         run: |
-          node bin/deploy cyberia
+          node bin package dd-cyberia --install
           node bin/cyberia run-workflow build-cyberia-404 --output-path ../assets/404/index.html
 
+      - name: Stage underpost CLI package
+        working-directory: engine
+        # Bakes the CLI into the runtime image from this checkout instead of the registry, so a
+        # starting pod never fetches it. The Dockerfiles COPY ../underpost-cli.tgz.
+        run: node bin/cyberia run-workflow stage-cli --output-path ..
+
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v4
 
@@ -65,7 +71,4 @@ jobs:
           push: true
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
-
-          build-args: |
-            UNDERPOST_VERSION=${{ env.UNDERPOST_VERSION }}
             BUILD_MODE=RELEASE

package/.github/workflows/docker-image.cyberia-client.dev.ci.yml

@@ -4,7 +4,7 @@ on:
   workflow_dispatch:
 
 env:
-  UNDERPOST_VERSION: '3.2.90'
+  UNDERPOST_VERSION: '3.3.73'
 
 jobs:
   build-and-push:
@@ -34,9 +34,15 @@ jobs:
       - name: Build cyberia-server SSR dashboard
         working-directory: engine
         run: |
-          node bin/deploy cyberia
+          node bin package dd-cyberia --install
           node bin/cyberia run-workflow build-cyberia-404 --output-path ../assets/404/index.html
 
+      - name: Stage underpost CLI package
+        working-directory: engine
+        # Bakes the CLI into the runtime image from this checkout instead of the registry, so a
+        # starting pod never fetches it. The Dockerfiles COPY ../underpost-cli.tgz.
+        run: node bin/cyberia run-workflow stage-cli --output-path ..
+
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v4
 
@@ -66,5 +72,4 @@ jobs:
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
           build-args: |
-            UNDERPOST_VERSION=${{ env.UNDERPOST_VERSION }}
             BUILD_MODE=DEBUG

package/.github/workflows/docker-image.cyberia-server.ci.yml

@@ -4,7 +4,7 @@ on:
   workflow_dispatch:
 
 env:
-  UNDERPOST_VERSION: '3.2.90'
+  UNDERPOST_VERSION: '3.3.73'
 
 jobs:
   build-and-push:
@@ -34,10 +34,16 @@ jobs:
       - name: Build cyberia-server SSR dashboard
         working-directory: engine
         run: |
-          node bin/deploy cyberia
+          node bin package dd-cyberia --install
           node bin/cyberia run-workflow build-server-dashboard --output-path ../public/index.html
           node bin/cyberia run-workflow build-cyberia-404 --output-path ../public/404/index.html
 
+      - name: Stage underpost CLI package
+        working-directory: engine
+        # Bakes the CLI into the runtime image from this checkout instead of the registry, so a
+        # starting pod never fetches it. The Dockerfiles COPY ../underpost-cli.tgz.
+        run: node bin/cyberia run-workflow stage-cli --output-path ..
+
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v4
 
@@ -66,6 +72,3 @@ jobs:
           push: true
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
-
-          build-args: |
-            UNDERPOST_VERSION=${{ env.UNDERPOST_VERSION }}

package/.github/workflows/docker-image.cyberia-server.dev.ci.yml

@@ -4,7 +4,7 @@ on:
   workflow_dispatch:
 
 env:
-  UNDERPOST_VERSION: '3.2.90'
+  UNDERPOST_VERSION: '3.3.73'
 
 jobs:
   build-and-push:
@@ -34,10 +34,16 @@ jobs:
       - name: Build cyberia-server SSR dashboard (dev)
         working-directory: engine
         run: |
-          node bin/deploy cyberia
+          node bin package dd-cyberia --install
           node bin/cyberia run-workflow build-server-dashboard --dev --output-path ../public/index.html
           node bin/cyberia run-workflow build-cyberia-404 --output-path ../public/404/index.html
 
+      - name: Stage underpost CLI package
+        working-directory: engine
+        # Bakes the CLI into the runtime image from this checkout instead of the registry, so a
+        # starting pod never fetches it. The Dockerfiles COPY ../underpost-cli.tgz.
+        run: node bin/cyberia run-workflow stage-cli --output-path ..
+
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v4
 
@@ -66,6 +72,3 @@ jobs:
           push: true
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
-
-          build-args: |
-            UNDERPOST_VERSION=${{ env.UNDERPOST_VERSION }}

package/.github/workflows/docker-image.engine-cyberia.ci.yml

@@ -4,7 +4,7 @@ on:
   workflow_dispatch:
 
 env:
-  UNDERPOST_VERSION: '3.2.90'
+  UNDERPOST_VERSION: '3.3.73'
 
 jobs:
   build-and-push:
@@ -16,6 +16,20 @@ jobs:
     steps:
       - uses: actions/checkout@v7
 
+      - name: Setup Node.js
+        uses: actions/setup-node@v7
+        with:
+          node-version: '24.x'
+
+      - name: Install engine dependencies
+        run: npm ci --ignore-scripts
+
+      - name: Stage underpost CLI package
+        # Bakes the CLI into the image from this checkout instead of the registry, so a starting
+        # pod never fetches it. The Dockerfiles COPY underpost-cli.tgz from the build context,
+        # which for this workflow is the repository root.
+        run: node bin/cyberia run-workflow stage-cli --output-path .
+
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v4
 

package/.github/workflows/docker-image.engine-cyberia.dev.ci.yml

@@ -4,7 +4,7 @@ on:
   workflow_dispatch:
 
 env:
-  UNDERPOST_VERSION: '3.2.90'
+  UNDERPOST_VERSION: '3.3.73'
 
 jobs:
   build-and-push:
@@ -16,6 +16,20 @@ jobs:
     steps:
       - uses: actions/checkout@v7
 
+      - name: Setup Node.js
+        uses: actions/setup-node@v7
+        with:
+          node-version: '24.x'
+
+      - name: Install engine dependencies
+        run: npm ci --ignore-scripts
+
+      - name: Stage underpost CLI package
+        # Bakes the CLI into the image from this checkout instead of the registry, so a starting
+        # pod never fetches it. The Dockerfiles COPY underpost-cli.tgz from the build context,
+        # which for this workflow is the repository root.
+        run: node bin/cyberia run-workflow stage-cli --output-path .
+
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v4
 

package/.github/workflows/engine-cyberia.cd.yml

@@ -40,13 +40,8 @@ jobs:
           script: |
             set -e
             set -o pipefail
-            echo "Starting remote deploy"
-            INGRESS_NODE=localhost.localdomain
-            cd /home/dd/engine
-            sudo -n -- /bin/bash -lc "node bin run pull"
-            sudo -n -- /bin/bash -lc "npm install"
-            sudo -n -- /bin/bash -lc "node bin run secret"
-            sudo -n -- /bin/bash -lc "node bin run deploy dd-cyberia --gateway-api --ingress-node ${INGRESS_NODE}"
+            export RUN_QUIET_CI=github
+            bash /home/dd/engine/deploy/dd-cyberia/deploy.sh
   sync-and-deploy:
     if: github.event.inputs.job == 'sync-and-deploy'
     name: Remote SSH sync and deploy
@@ -71,67 +66,8 @@ jobs:
           script: |
             set -e
             set -o pipefail
-            echo "Starting remote sync and deploy"
-            TARGET_NODE=localhost.localdomain
-            INGRESS_NODE=localhost.localdomain
-            cd /home/dd/engine
-            sudo -n -- /bin/bash -lc "node bin run pull"
-            sudo -n -- /bin/bash -lc "npm install"
-            sudo -n -- /bin/bash -lc "node bin run secret"
-            sudo -n -- /bin/bash -lc "npm run test"
-            sudo -n -- /bin/bash -lc "node bin run clean src/client/public/cyberia"
-            sudo -n -- /bin/bash -lc "node bin run clean src/client/public/underpost"
-            sudo -n -- /bin/bash -lc "node bin cmt src/client/public/cyberia --init-repo"
-            sudo -n -- /bin/bash -lc "node bin cmt src/client/public/underpost --init-repo"
-            sudo -n -- /bin/bash -lc "node bin fs src/client/public/cyberia --pull --recursive --deploy-id dd-cyberia"
-            sudo -n -- /bin/bash -lc "node bin fs src/client/public/underpost --pull --recursive --deploy-id dd-cyberia --storage-file-path './engine-private/conf/dd-cyberia/storage.underpost.json'"
-            CHANGES_CYBERIA=$(sudo -n -- /bin/bash -lc "node bin cmt src/client/public/cyberia --has-changes" | tr -d '\n')
-            if [ "$CHANGES_CYBERIA" = "1" ]; then
-              sudo -n -- /bin/bash -lc "node bin cmt src/client/public/cyberia feat 'Update cyberia public assets'"
-            fi
-            CHANGES_UNDERPOST=$(sudo -n -- /bin/bash -lc "node bin cmt src/client/public/underpost --has-changes" | tr -d '\n')
-            if [ "$CHANGES_UNDERPOST" = "1" ]; then
-              sudo -n -- /bin/bash -lc "node bin cmt src/client/public/underpost feat 'Update underpost public assets'"
-            fi
-            sudo -n -- /bin/bash -lc "npm run fix"
-            sudo -n -- /bin/bash -lc "npm install"
-            sudo -n -- /bin/bash -lc "node bin/deploy cyberia"
-            sudo -n -- /bin/bash -lc "underpost run clean"
-            sudo -n -- /bin/bash -lc "node bin env dd-cyberia production"
-            sudo -n -- /bin/bash -lc "node bin/cyberia run-workflow build-manifest"
-            sudo -n -- /bin/bash -lc "node bin run sync 'dd-cyberia,1,,underpost/engine-cyberia:latest' \
-              --kubeadm \
-              --deploy-id-cron-jobs none \
-              --timeout-response 300000ms \
-              --node-name ${TARGET_NODE} \
-              --gateway-api \
-              --ingress-node ${INGRESS_NODE} \
-              --ssh-key-path /home/dd/tmp/897as9dxhaskd9 \
-              --image-pull-policy Always \
-              --cmd 'cd /home/dd/engine, \
-                underpost clone underpostnet/engine-cyberia, \
-                mkdir -p /home/dd/engine/src/client/public/itemledger \
-                  /home/dd/engine/src/client/public/cryptokoyn \
-                  /home/dd/engine/src/client/components/cryptokoyn \
-                  /home/dd/engine/src/client/components/itemledger \
-                  /home/dd/engine/hardhat, \
-                cp -a ./engine-cyberia/src/client/public/itemledger/. /home/dd/engine/src/client/public/itemledger/, \
-                cp -a ./engine-cyberia/src/client/public/cryptokoyn/. /home/dd/engine/src/client/public/cryptokoyn/, \
-                cp -a ./engine-cyberia/src/client/components/cryptokoyn/. /home/dd/engine/src/client/components/cryptokoyn/, \
-                cp -a ./engine-cyberia/src/client/components/itemledger/. /home/dd/engine/src/client/components/itemledger/, \
-                cp -a ./engine-cyberia/src/client/Itemledger.index.js /home/dd/engine/src/client/Itemledger.index.js, \
-                cp -a ./engine-cyberia/src/client/Cryptokoyn.index.js /home/dd/engine/src/client/Cryptokoyn.index.js, \
-                rm -rf ./engine-cyberia, \
-                sudo rm -rf ./engine-private/, \
-                node bin clone underpostnet/engine-cyberia-private, \
-                sudo mv ./engine-cyberia-private ./engine-private, \
-                node bin env dd-cyberia production, \
-                node ./engine-private/itc-scripts/dd-cyberia-0.js, \
-                sudo chown -R dd:dd /home/dd/engine/src/client/public/cyberia, \
-                node bin/cyberia run-workflow import-default-items, \
-                node bin env dd-cyberia production, \
-                node bin client dd-cyberia, \
-                node bin start dd-cyberia production --run'"
+            export RUN_QUIET_CI=github
+            bash /home/dd/engine/deploy/dd-cyberia/sync-deploy.sh
   init:
     if: github.event.inputs.job == 'init'
     name: Remote SSH init deployment
@@ -156,13 +92,5 @@ jobs:
           script: |
             set -e
             set -o pipefail
-            echo "Starting init deploy"
-            INGRESS_NODE=localhost.localdomain
-            cd /home/dd/engine
-            sudo -n -- /bin/bash -lc "node bin run pull"
-            sudo -n -- /bin/bash -lc "npm install"
-            sudo -n -- /bin/bash -lc "node bin run secret"
-            sudo -n -- /bin/bash -lc "node bin/build dd-cyberia --conf"
-            sudo -n -- /bin/bash -lc "node bin deploy dd-cyberia production --kubeadm --gateway-api --ingress-node ${INGRESS_NODE} --sync --build-manifest --timeout-response 300000ms --versions green --replicas 1"
-            sudo -n -- /bin/bash -lc "node bin deploy dd-cyberia production --kubeadm --gateway-api --ingress-node ${INGRESS_NODE} --disable-update-proxy --git-clean"
-            sudo -n -- /bin/bash -lc "node bin monitor dd-cyberia production --ready-deployment --promote --timeout-response 300000ms --versions green --replicas 1"
+            export RUN_QUIET_CI=github
+            bash /home/dd/engine/deploy/dd-cyberia/init.sh

package/.github/workflows/engine-cyberia.ci.yml

@@ -62,13 +62,12 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GIT_AUTH_TOKEN }}
           GITHUB_USERNAME: ${{ github.repository_owner }}
+          # Never interpolated into the script: the propagated payload is multi-line and a shell
+          # expansion would corrupt entries holding `$` and execute anything in `$(...)`.
+          PROPAGATED_MESSAGE: ${{ github.event.inputs.message }}
         run: |
           cd .. && node engine/bin clone underpostnet/pwa-microservices-template
-          if [ -n "${{ github.event.inputs.message }}" ]; then
-            LAST_COMMIT_MESSAGE="${{ github.event.inputs.message }}"
-          else
-            LAST_COMMIT_MESSAGE=$(cd engine && node bin cmt --changelog-msg --from-n-commit 1 --changelog-no-hash 2>/dev/null || echo "")
-          fi
+          LAST_COMMIT_MESSAGE=$(cd engine && node bin cmt --propagate-msg 2>/dev/null || echo "")
           SHOULD_CD="${{ github.event.inputs.sync }}"
           DEPLOY_TYPE="${{ github.event.inputs.deploy_type }}"
           if [ -z "$LAST_COMMIT_MESSAGE" ]; then

package/.github/workflows/ghpkg.ci.yml

@@ -20,7 +20,13 @@ permissions:
   id-token: write
 jobs:
   pwa-microservices-template-ghpk:
-    if: github.repository == 'underpostnet/pwa-microservices-template' && startsWith(github.event.head_commit.message, 'ci(package-pwa-microservices-template-ghpkg)')
+    if: >-
+      github.repository == 'underpostnet/pwa-microservices-template' &&
+       (
+         startsWith(github.event.head_commit.message, 'ci(package-pwa-microservices-template-ghpkg)')
+         || 
+         github.event_name == 'workflow_dispatch'
+       )
     name: Update github repo package Jobs
     runs-on: ubuntu-latest
     container:
@@ -42,20 +48,30 @@ jobs:
           curl -fsSL https://rpm.nodesource.com/setup_24.x | bash -
           dnf install nodejs -y
 
-      - name: Capture commit message
-        run: |
-          FULL_MSG="${{ github.event.head_commit.message }}"
-          LAST_COMMIT_MESSAGE="${FULL_MSG:-update package}"
-          echo "LAST_COMMIT_MESSAGE<<EOF" >> $GITHUB_ENV
-          echo "$LAST_COMMIT_MESSAGE" >> $GITHUB_ENV
-          echo "EOF" >> $GITHUB_ENV
-          echo "[INFO] Commit message: $LAST_COMMIT_MESSAGE"
-
       - name: Install dependencies and set repo configuration
         run: |
           npm install
-          node ./bin/deploy rename-package @underpostnet/underpost
-          node ./bin/deploy set-repo underpostnet/pwa-microservices-template-ghpkg
+          node ./bin package --rename @underpostnet/underpost
+          node ./bin package --set-repo underpostnet/pwa-microservices-template-ghpkg
+
+      # Placed after the install because it resolves the payload through the CLI, which needs the
+      # dependencies. The push that triggers this job carries the payload the engine propagated.
+      - name: Capture commit message
+        env:
+          # Never interpolated into the script: the propagated payload is multi-line and a shell
+          # expansion would corrupt entries holding `$` and execute anything in `$(...)`.
+          PROPAGATED_MESSAGE: ${{ github.event.head_commit.message }}
+        run: |
+          LAST_COMMIT_MESSAGE=$(node ./bin cmt --propagate-msg 2>/dev/null || echo "")
+          if [ -z "$LAST_COMMIT_MESSAGE" ]; then
+            LAST_COMMIT_MESSAGE="update package"
+          fi
+          {
+            echo "LAST_COMMIT_MESSAGE<<PROPAGATION_EOF"
+            echo "$LAST_COMMIT_MESSAGE"
+            echo "PROPAGATION_EOF"
+          } >> $GITHUB_ENV
+          echo "[INFO] Commit message: $LAST_COMMIT_MESSAGE"
 
       - name: Set git global credentials
         run: |
@@ -118,15 +134,20 @@ jobs:
           echo "[INFO] Canonical github package repo: underpostnet/engine-ghpkg-$CONF_ID"
 
       - name: Capture commit message
+        env:
+          # Never interpolated into the script: the propagated payload is multi-line and a shell
+          # expansion would corrupt entries holding `$` and execute anything in `$(...)`.
+          PROPAGATED_MESSAGE: ${{ github.event.inputs.message }}
         run: |
-          FULL_MSG="${{ github.event.inputs.message }}"
-          if [ -z "$FULL_MSG" ]; then
-            FULL_MSG=$(node bin cmt --changelog-msg --from-n-commit 1 --changelog-no-hash 2>/dev/null || echo "")
+          LAST_COMMIT_MESSAGE=$(node bin cmt --propagate-msg 2>/dev/null || echo "")
+          if [ -z "$LAST_COMMIT_MESSAGE" ]; then
+            LAST_COMMIT_MESSAGE="Update canonical github package repo"
           fi
-          LAST_COMMIT_MESSAGE="${FULL_MSG:-Update canonical github package repo}"
-          echo "LAST_COMMIT_MESSAGE<<EOF" >> $GITHUB_ENV
-          echo "$LAST_COMMIT_MESSAGE" >> $GITHUB_ENV
-          echo "EOF" >> $GITHUB_ENV
+          {
+            echo "LAST_COMMIT_MESSAGE<<PROPAGATION_EOF"
+            echo "$LAST_COMMIT_MESSAGE"
+            echo "PROPAGATION_EOF"
+          } >> $GITHUB_ENV
           echo "[INFO] Commit message: $LAST_COMMIT_MESSAGE"
 
       - name: Set git global credentials
@@ -146,8 +167,8 @@ jobs:
           cd engine-$CONF_ID
           rm -rf ./.git
           mv ../$GHPKG_REPO.git ./.git
-          node ../engine/bin/deploy rename-package "$PACKAGE_NAME"
-          node ../engine/bin/deploy set-repo underpostnet/$GHPKG_REPO
+          node ../engine/bin package --rename "$PACKAGE_NAME"
+          node ../engine/bin package --set-repo underpostnet/$GHPKG_REPO
           git init
           git config user.name 'underpostnet'
           git config user.email 'development@underpost.net'