@underpostnet/cyberia 3.2.90 → 3.3.73

package/.github/workflows/hardhat.ci.yml

@@ -5,13 +5,10 @@ name: CI | Hardhat
 
 on:
   push:
-    paths:
-      - 'hardhat/**'
-      - '.github/workflows/hardhat.ci.yml'
+    branches: ['master', 'main']
   pull_request:
-    paths:
-      - 'hardhat/**'
-      - '.github/workflows/hardhat.ci.yml'
+    branches: ['master', 'main']
+
   workflow_dispatch:
 
 permissions:
@@ -20,6 +17,11 @@ permissions:
 jobs:
   build-and-test:
     name: Compile, Test & Audit
+    if: |
+      github.actor != 'dependabot[bot]' &&
+      (github.repository == 'underpostnet/engine-cyberia' ||
+       github.repository == 'underpostnet/engine-ghpkg-cyberia' ||
+       github.repository == 'underpostnet/engine-test-cyberia')
     runs-on: ubuntu-latest
     defaults:
       run:
@@ -59,18 +61,17 @@ jobs:
 
       # ── Compile ──────────────────────────────────────────────────────────
       - name: Compile Solidity contracts
-        run: npx hardhat compile
+        run: npm run compile
 
       # ── Test ─────────────────────────────────────────────────────────────
       - name: Run tests
-        run: npx hardhat test
+        run: npm test
         env:
           REPORT_GAS: 'true'
 
-      # ── Coverage (optional, only on primary Node version) ────────────────
+      # ── Coverage ─────────────────────────────────────────────────────────
       - name: Solidity coverage
-        if: matrix.node-version == '20'
-        run: npx hardhat coverage
+        run: npm run coverage
 
       # ── Lockfile integrity check ─────────────────────────────────────────
       # Fail if package-lock.json is out of sync with package.json

package/.github/workflows/npmpkg.ci.yml

@@ -51,26 +51,28 @@ jobs:
           curl -fsSL https://rpm.nodesource.com/setup_24.x | bash -
           dnf install nodejs -y
 
+      - name: Install dependencies
+        run: npm install
+
+      # Placed after the install because it resolves the payload through the CLI, which needs the
+      # dependencies. The dispatch input wins; a push carries its own commit message instead.
       - name: Capture commit message
+        env:
+          # Never interpolated into the script: the propagated payload is multi-line and a shell
+          # expansion would corrupt entries holding `$` and execute anything in `$(...)`.
+          PROPAGATED_MESSAGE: ${{ github.event.inputs.message || github.event.head_commit.message }}
         run: |
-          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
-            LAST_COMMIT_MESSAGE="${{ github.event.inputs.message }}"
-            if [ -z "$LAST_COMMIT_MESSAGE" ]; then
-              LAST_COMMIT_MESSAGE="Update repository"
-            fi
-          else
-            FULL_MSG="${{ github.event.head_commit.message }}"
-            REST="$(echo "$FULL_MSG" | tail -n +2 | awk 'NR==1{first=$0; has_first=1; next} NR==2{print first " " $0; has_first=0; next} {print} END{if(has_first) print first}')"
-            LAST_COMMIT_MESSAGE="${REST:-$FULL_MSG}"
+          LAST_COMMIT_MESSAGE=$(node bin cmt --propagate-msg 2>/dev/null || echo "")
+          if [ -z "$LAST_COMMIT_MESSAGE" ]; then
+            LAST_COMMIT_MESSAGE="Update repository"
           fi
-          echo "LAST_COMMIT_MESSAGE<<EOF" >> $GITHUB_ENV
-          echo "$LAST_COMMIT_MESSAGE" >> $GITHUB_ENV
-          echo "EOF" >> $GITHUB_ENV
+          {
+            echo "LAST_COMMIT_MESSAGE<<PROPAGATION_EOF"
+            echo "$LAST_COMMIT_MESSAGE"
+            echo "PROPAGATION_EOF"
+          } >> $GITHUB_ENV
           echo "[INFO] Extracted payload: $LAST_COMMIT_MESSAGE"
 
-      - name: Install dependencies
-        run: npm install
-
       - name: Set git global credentials
         run: |
           git config --global --add safe.directory '*'

package/.github/workflows/pwa-microservices-template-page.cd.yml

@@ -32,23 +32,8 @@ jobs:
       # - name: Checkout LFS objects
       #   run: git lfs checkout
 
-      - name: Install required packages
-        run: |
-          dnf install -y sudo tar gzip bzip2 git
-          dnf install -y curl --allowerasing
-
-      - name: Install Node.js
-        run: |
-          curl -fsSL https://rpm.nodesource.com/setup_24.x | bash -
-          dnf install nodejs -y
-
       - name: Build the site
-        run: |
-          npm install
-          node bin new --default-conf --conf-workflow-id dd-github-pages
-          node bin new --deploy-id dd-github-pages
-          node bin env dd-github-pages production
-          NODE_ENV=production node bin client dd-github-pages '' underpostnet.github.io /pwa-microservices-template-ghpkg
+        run: bash deploy/pwa-microservices-template/deploy.sh
       # git lfs install
       # git lfs track
       # git lfs ls-files

package/.github/workflows/pwa-microservices-template-test.ci.yml

@@ -1,4 +1,4 @@
-name: CI | Gihub page | PWA Microservices Template Test
+name: CI | PWA Microservices | Unit & Infra Tests
 
 on: [push]
 
@@ -30,4 +30,4 @@ jobs:
         run: npm install
 
       - name: Run test
-        run: npm test
+        run: node bin test unit,infra

package/.github/workflows/release.cd.yml

@@ -35,12 +35,5 @@ jobs:
           script: |
             set -e
             set -o pipefail
-            echo "Starting remote release deploy"
-            cd /home/dd/engine
-            sudo -n -- /bin/bash -lc "node bin run pull"
-            sudo -n -- /bin/bash -lc "npm install"
-            sudo -n -- /bin/bash -lc "node bin run secret"
-            sudo -n -- /bin/bash -lc "npm install -g underpost"
-            sudo -n -- /bin/bash -lc "node bin run secret"
-            sudo -n -- /bin/bash -lc "node bin run --dev git-conf"
-            sudo -n -- /bin/bash -lc "node bin run docker-image"
+            export RUN_QUIET_CI=github
+            bash /home/dd/engine/deploy/release/deploy.sh

package/.prettierignore

@@ -6,6 +6,7 @@
 /build
 /.env
 /coverage
+/allure-results
 /prometheus_data
 /grafana_data
 .nyc_output

package/AGENTS.md

@@ -0,0 +1,47 @@
+## Commenting policy
+
+- Keep code comments minimal, no redundant or lengthy comment.
+- Prefer clear names, small functions, and extracted helpers over explanatory comments.
+- Comment only non-obvious intent: invariants, protocol boundaries, security constraints, cross-process contracts, or temporary workarounds.
+- Remove stale, redundant, or narrative comments during refactors.
+- Use `TODO:` only for concrete, actionable follow-ups.
+
+## Consistency guardrails
+
+- Keep one source of truth for config, deploy IDs, runtime selection, startup order, and generated assets.
+- Reuse existing helpers, conventions, and resolution logic instead of introducing parallel implementations.
+- Do not duplicate parsing, environment resolution, or path normalization.
+- Keep generated artifacts read-only outputs; never hand-edit them.
+- No dead code, no legacy code, and no legacy concepts.
+- Keep responsibilities explicit and avoid introducing abstractions without a concrete ownership boundary.
+
+## Host, LXD, and orchestration safety
+
+- Treat every host-level change as idempotent, reversible, and explicit.
+- Validate target paths, permissions, ownership, mounts, users, groups, namespaces, and volumes before mutating.
+- Never assume host resources already exist.
+- Prefer dry-run, guarded cleanup, and rollback paths over destructive operations.
+- Protect host-mounted volumes and VM bootstrap flows from partial configuration.
+- Make orchestration safe to interrupt and safe to rerun.
+
+## Testing and verification
+
+- When changing orchestration, bootstrap, config loading, or runtime startup order, add or update focused tests for parsing, validation, and selection logic.
+- For live-service tests, document the required runtime environment and keep execution deterministic.
+- Prefer small, targeted verification over broad manual validation.
+- Verify changed behavior at the closest layer that owns it.
+
+## Cyberia architecture boundaries
+
+- `engine-cyberia` owns content, validation, persistence, gRPC/REST data services, and asset metadata.
+- `cyberia-server` owns authoritative real-time simulation and tick processing.
+- `cyberia-client` owns rendering, input, prediction, reconciliation, and presentation.
+- Keep authoritative simulation out of the client.
+- Keep content-authority and persistence concerns out of the Go runtime.
+- Preserve these boundaries when introducing new flows, APIs, or shared helpers.
+
+## Documentation hot paths
+
+- `src/client/public/nexodev/docs/references/` — Underpost CLI, cluster, baremetal, DB, cron, image, LXD, SSH, and static-generator references.
+- `src/client/public/cyberia-docs/` — Cyberia architecture, server, client, CLI, action, quest, economy, whitepaper, and roadmap documentation.
+- `engine-private/` is private. Do not assume it exists locally; treat references to it as external/private context.