@underpostnet/cyberia 3.2.90 → 3.3.73

package/src/server/{runtime-status.js → runtime/runtime-status.js}

@@ -1,5 +1,6 @@
 /**
- * Runtime status contract and the in-pod internal status endpoint.
+ * Runtime status contract and the in-pod internal status endpoint: the base module of the
+ * `state` domain, the runtime monitoring / telemetry layer.
  *
  * Single source of truth for the Underpost runtime readiness signal (Phase 2 of
  * the two-phase deployment monitor). The runtime publishes its lifecycle here;
@@ -7,23 +8,34 @@
  * `kubectl port-forward`. Kubernetes pod readiness (Phase 1) is owned by kubelet
  * and is intentionally not modeled in this module.
  *
+ * Three observations make up the layer, and they are deliberately separate:
+ *   - **execution state** — where the runtime is in its lifecycle (`container-status`)
+ *   - **health indicators** — whether it is ready and whether it is still booting
+ *   - **performance metrics** — uptime, memory and CPU of the process serving it
+ * {@link runtimeStatusPayload} carries the first for the monitor's failure classification;
+ * {@link runtimeTelemetryPayload} carries all three for an agent exporting them off-cluster.
+ *
  * Cross-process contract:
- *   - In-pod, the canonical value lives in the underpost root env key
+ *   - In-pod, the canonical value lives in the container state store key
  *     `container-status`, written by `start.js`. For non-error phases it carries
  *     the namespaced form `<deployId>-<env>-<phase>`; a fatal fault collapses to
  *     the bare value `error`.
  *   - The internal HTTP server exposes that value (normalized to the bare
  *     contract phase) and never exposes secrets, env dumps, or configuration.
+ *     Neither payload is ever built from `process.env` wholesale — each field is
+ *     named, so a new environment variable can never widen what is published.
  *
- * @module src/server/runtime-status.js
+ * @module src/server/runtime/runtime-status.js
  * @namespace RuntimeStatus
  */
 
 import http from 'node:http';
+import os from 'node:os';
 import fs from 'fs-extra';
 import dotenv from 'dotenv';
-import Underpost from '../index.js';
-import { loggerFactory } from './logger.js';
+import Underpost from '../../index.js';
+import { EXECUTION_PROFILES, activeExecutionProfile } from '../build/execution.js';
+import { loggerFactory } from '../ops/logger.js';
 
 const logger = loggerFactory(import.meta);
 
@@ -41,9 +53,15 @@ const RUNTIME_STATUS = {
 
 const CONTAINER_STATUS_KEY = 'container-status';
 const START_CONTAINER_STATUS_KEY = 'start-container-status';
+// The boot latch: present from the moment a runtime starts configuring itself until that runtime
+// is listening. Container-scoped like the two above — same owner, same lifetime — so it lives in
+// the container state store. It was previously written to the host configuration store, where
+// `host load` and `host clean` erase the whole file and would silently drop the latch mid-boot.
+const AWAIT_DEPLOY_KEY = 'await-deploy';
 const INTERNAL_STATUS_PATH = '/_internal/status';
 const INTERNAL_READY_PATH = '/_internal/ready';
 const INTERNAL_HEALTH_PATH = '/_internal/health';
+const INTERNAL_TELEMETRY_PATH = '/_internal/telemetry';
 
 /**
  * Resolves the internal status port. Defaults to the deployment base `PORT`
@@ -117,22 +135,47 @@ const normalizeContainerStatus = (raw) => {
  * @returns {string|undefined}
  */
 const getRuntimeStatus = () =>
-  normalizeContainerStatus(Underpost.env.get(CONTAINER_STATUS_KEY, undefined, { disableLog: true }));
+  normalizeContainerStatus(Underpost.state.get(CONTAINER_STATUS_KEY, undefined, { disableLog: true }));
 
 /**
- * Reads the start-container-status env key — an insulated marker set by the
- * start pipeline after it completes the running phase. Unlike container-status
- * (which external scripts / backup failures may clobber), this key is written
- * once and survives globalSecretClean. Used exclusively by the readinessProbe
- * endpoint so K8s pod readiness is never derailed by lifecycle noise.
+ * Reads the start-container-status key — an insulated marker the start pipeline writes once
+ * after completing the running phase. Unlike container-status, which lifecycle hooks and failure
+ * latches also write, this is only ever set by that pipeline, so the readinessProbe endpoint is
+ * never derailed by lifecycle noise.
  * @memberof RuntimeStatus
  * @returns {string|undefined}
  */
 const getStartContainerStatus = () => {
-  const raw = Underpost.env.get(START_CONTAINER_STATUS_KEY, undefined, { disableLog: true });
+  const raw = Underpost.state.get(START_CONTAINER_STATUS_KEY, undefined, { disableLog: true });
   return raw && typeof raw === 'string' && raw.trim() ? raw.trim() : undefined;
 };
 
+/**
+ * Latches this container as still bringing its runtime up. Cleared by {@link clearAwaitDeploy}
+ * once the runtime is listening; polled by `awaitDeployMonitor` in between.
+ * @memberof RuntimeStatus
+ * @returns {void}
+ */
+const latchAwaitDeploy = () => {
+  Underpost.state.set(AWAIT_DEPLOY_KEY, new Date().toISOString());
+};
+
+/**
+ * Whether a runtime in this container is still coming up.
+ * @memberof RuntimeStatus
+ * @returns {boolean}
+ */
+const isAwaitingDeploy = () => Boolean(Underpost.state.get(AWAIT_DEPLOY_KEY, undefined, { disableLog: true }));
+
+/**
+ * Releases the boot latch. Called by the runtime once every configured host and path is bound.
+ * @memberof RuntimeStatus
+ * @returns {void}
+ */
+const clearAwaitDeploy = () => {
+  Underpost.state.delete(AWAIT_DEPLOY_KEY);
+};
+
 /**
  * Minimal, secret-free payload served by the internal status endpoint and used
  * by the monitor for failure classification and observability.
@@ -145,6 +188,43 @@ const runtimeStatusPayload = () => ({
   env: process.env.NODE_ENV ?? null,
 });
 
+/**
+ * Live execution state, health indicators and performance metrics for this container: what a
+ * telemetry agent collects and exports off-cluster.
+ *
+ * A superset of {@link runtimeStatusPayload}, kept separate from it because the monitor's
+ * failure classification must not start depending on metrics that move on every read. Every
+ * field is named individually and none is read from the environment in bulk, so this can never
+ * become an env dump.
+ * @memberof RuntimeStatus
+ * @returns {object} Secret-free telemetry observation.
+ */
+const runtimeTelemetryPayload = () => {
+  const memory = process.memoryUsage();
+  const cpu = process.cpuUsage();
+  return {
+    ...runtimeStatusPayload(),
+    instanceId: process.env.INSTANCE_ID ?? null,
+    health: {
+      // The insulated readiness marker, not the lifecycle status: the two disagree exactly when
+      // a lifecycle hook has moved container-status after the start pipeline signed off.
+      ready: Boolean(getStartContainerStatus()),
+      awaitingDeploy: isAwaitingDeploy(),
+      inContainer: Underpost.state.isInsideContainer(),
+    },
+    metrics: {
+      uptimeSeconds: Math.round(process.uptime()),
+      rssBytes: memory.rss,
+      heapUsedBytes: memory.heapUsed,
+      heapTotalBytes: memory.heapTotal,
+      cpuUserMicros: cpu.user,
+      cpuSystemMicros: cpu.system,
+      loadAverage1m: os.loadavg()[0],
+    },
+    observedAt: new Date().toISOString(),
+  };
+};
+
 /**
  * Emits a structured, secret-free deployment transition event.
  * @memberof RuntimeStatus
@@ -167,10 +247,56 @@ const emitRuntimeEvent = ({ deployId, env, phase }) => {
  * @param {string} phase - One of {@link RUNTIME_STATUS}.
  */
 const setRuntimeStatus = (deployId, env, phase) => {
-  Underpost.env.set(CONTAINER_STATUS_KEY, containerStatusValue(deployId, env, phase));
+  Underpost.state.set(CONTAINER_STATUS_KEY, containerStatusValue(deployId, env, phase));
   emitRuntimeEvent({ deployId, env, phase });
 };
 
+/**
+ * Whether this process is executing under a test runner.
+ * @memberof RuntimeStatus
+ * @returns {boolean} True under `NODE_ENV=test` or a Vitest worker.
+ */
+const isTestRuntime = () =>
+  process.env.NODE_ENV === 'test' || Boolean(process.env.VITEST || process.env.VITEST_WORKER_ID);
+
+/**
+ * Whether this process may write the runtime status contract.
+ *
+ * Only a live workload observes itself. A test run and a non-live execution profile both
+ * execute commands whose non-zero exit is the expected outcome — a suite asserting a failure
+ * path, a hermetic build eliding a cluster call — and neither is an observation of a running
+ * deployment. Letting them latch `container-status` published a false `error` to the CD
+ * monitor and failed rollouts that were healthy.
+ * @memberof RuntimeStatus
+ * @returns {boolean} True when this process speaks for a live container.
+ */
+const runtimeStatusWritable = () =>
+  Underpost.state.isInsideContainer() &&
+  !isTestRuntime() &&
+  activeExecutionProfile().name === EXECUTION_PROFILES.LIVE_CLUSTER.name;
+
+/**
+ * Latches the container as failed, for a failure detected outside the lifecycle phases — a shell
+ * command, a database connection, a backup. A no-op wherever the contract is not writable:
+ * outside a container, under a test runner, or under a non-live execution profile.
+ * @memberof RuntimeStatus
+ * @returns {void}
+ */
+const latchRuntimeError = () => {
+  if (runtimeStatusWritable()) Underpost.state.set(CONTAINER_STATUS_KEY, RUNTIME_STATUS.ERROR);
+};
+
+/**
+ * Marks the start pipeline's own completion. Written once, read only by the readinessProbe.
+ * @memberof RuntimeStatus
+ * @param {string} deployId
+ * @param {string} env
+ * @returns {void}
+ */
+const setStartContainerStatus = (deployId, env) => {
+  Underpost.state.set(START_CONTAINER_STATUS_KEY, containerStatusValue(deployId, env, RUNTIME_STATUS.RUNNING));
+};
+
 let internalServer;
 
 /**
@@ -178,9 +304,10 @@ let internalServer;
  * the already-listening server. Exposes only the three internal endpoints and
  * never serves secrets or configuration.
  *
- *   GET /_internal/status  → 200, `{status, deployId, env}` (monitor transport)
- *   GET /_internal/ready   → 200 iff running-deployment, else 503 (readinessProbe)
- *   GET /_internal/health  → 200 while the process is alive (livenessProbe)
+ *   GET /_internal/status    → 200, `{status, deployId, env}` (monitor transport)
+ *   GET /_internal/ready     → 200 iff running-deployment, else 503 (readinessProbe)
+ *   GET /_internal/health    → 200 while the process is alive (livenessProbe)
+ *   GET /_internal/telemetry → 200, state + health + metrics (telemetry agent)
  *
  * @memberof RuntimeStatus
  * @param {number} [port]
@@ -208,6 +335,8 @@ const startInternalStatusServer = (port = resolveInternalStatusPort()) => {
           : sendJson(503, { status: getRuntimeStatus() ?? null });
       case INTERNAL_STATUS_PATH:
         return sendJson(200, runtimeStatusPayload());
+      case INTERNAL_TELEMETRY_PATH:
+        return sendJson(200, runtimeTelemetryPayload());
       default:
         return sendJson(404, { error: 'not_found' });
     }
@@ -236,16 +365,26 @@ export {
   RUNTIME_STATUS,
   CONTAINER_STATUS_KEY,
   START_CONTAINER_STATUS_KEY,
+  AWAIT_DEPLOY_KEY,
   INTERNAL_STATUS_PATH,
   INTERNAL_READY_PATH,
   INTERNAL_HEALTH_PATH,
+  INTERNAL_TELEMETRY_PATH,
   resolveInternalStatusPort,
   deployStatusPort,
   containerStatusValue,
   normalizeContainerStatus,
   getRuntimeStatus,
   getStartContainerStatus,
+  latchAwaitDeploy,
+  isAwaitingDeploy,
+  clearAwaitDeploy,
+  isTestRuntime,
+  latchRuntimeError,
+  runtimeStatusWritable,
+  setStartContainerStatus,
   runtimeStatusPayload,
+  runtimeTelemetryPayload,
   setRuntimeStatus,
   startInternalStatusServer,
   stopInternalStatusServer,

package/src/server/{runtime.js → runtime/runtime.js}

@@ -2,21 +2,22 @@
  * The main runtime orchestrator responsible for reading configuration,
  * initializing services (Prometheus, Ports, DB, Mailer), and building the
  * specific server runtime for each host/path (e.g., nodejs, lampp).
- * @module src/server/runtime.js
+ * @module src/server/runtime/runtime.js
  * @namespace Runtime
  */
 
 import * as promClient from 'prom-client';
 
-import { loggerFactory } from './logger.js';
-import { newInstance } from '../client/components/core/CommonJs.js';
-import { Lampp } from '../runtime/lampp/Lampp.js';
-import { WpService } from '../runtime/wp/Wp.js';
+import { loggerFactory } from '../ops/logger.js';
+import { newInstance } from '../../client/components/core/CommonJs.js';
+import { Lampp } from '../../runtime/lampp/Lampp.js';
+import { WpService } from '../../runtime/wp/Wp.js';
 import { getInstanceContext, readConfJson } from './conf.js';
+import { clearAwaitDeploy } from './runtime-status.js';
 
-import ExpressService from '../runtime/express/Express.js';
+import ExpressService from '../../runtime/express/Express.js';
 
-import Underpost from '../index.js';
+import Underpost from '../../index.js';
 
 const logger = loggerFactory(import.meta);
 
@@ -140,6 +141,7 @@ const buildRuntime = async () => {
               path,
               directory,
               rootHostPath,
+              repository,
               redirect,
               redirectTarget,
               resetRouter: currentPort === initPort,
@@ -176,7 +178,9 @@ const buildRuntime = async () => {
   }
 
   if (Lampp.enabled() && Lampp.router) Lampp.initService();
-  Underpost.env.delete('await-deploy');
+  // Container-scoped boot latch, not host configuration: this releases the runtime this
+  // container just brought up, so it belongs to the same store as `container-status`.
+  clearAwaitDeploy();
   Underpost.start.logRuntimeRouter();
 };
 

package/src/server/{start.js → runtime/start.js}

@@ -1,24 +1,26 @@
 /**
  * Manages the startup and runtime configuration of Underpost applications.
- * @module src/server/start.js
+ * @module src/server/runtime/start.js
  * @namespace UnderpostStartUp
  */
 
 import fs from 'fs-extra';
 import { awaitDeployMonitor } from './conf.js';
-import { actionInitLog, loggerFactory } from './logger.js';
-import { shellCd, shellExec } from './process.js';
+import { actionInitLog, loggerFactory } from '../ops/logger.js';
+import { shellArgumentFactory, shellCd, shellExec, shellExecAsync } from './process.js';
 import {
   RUNTIME_STATUS,
-  START_CONTAINER_STATUS_KEY,
   setRuntimeStatus,
   startInternalStatusServer,
   deployStatusPort,
-  containerStatusValue,
+  setStartContainerStatus,
 } from './runtime-status.js';
-import Underpost from '../index.js';
+import Underpost from '../../index.js';
 const logger = loggerFactory(import.meta);
 
+// Every deployment builds and runs out of this path inside the workload container.
+const ENGINE_PATH = '/home/dd/engine';
+
 /**
  * @class UnderpostStartUp
  * @description Manages the startup and runtime configuration of Underpost applications.
@@ -139,9 +141,11 @@ class UnderpostStartUp {
      * @param {boolean} options.build - Whether to build the deployment.
      * @param {boolean} options.run - Whether to run the deployment.
      * @param {boolean} options.underpostQuicklyInstall - Whether to use underpost quickly install.
-     * @param {boolean} options.skipPullBase - Whether to skip pulling the base code.
+     * @param {boolean} options.skipPullRepoBase - Whether to skip pulling the engine source repository.
+     * @param {boolean} options.skipPullPrivateRepo - Whether to skip cloning the private configuration repository.
      * @param {boolean} options.skipFullBuild - Whether to skip building the full client bundle.
      * @param {boolean} options.pullBundle - When true, download pre-built client bundle from Cloudinary via pull-bundle before starting.
+     * @param {boolean} options.privateTestRepo - When true, the base pull clones `engine-test-<id>` instead of `engine-<id>`.
      */
     async callback(
       deployId = 'dd-default',
@@ -150,11 +154,24 @@ class UnderpostStartUp {
         build: false,
         run: false,
         underpostQuicklyInstall: false,
-        skipPullBase: false,
+        skipPullRepoBase: false,
+        skipPullPrivateRepo: false,
         skipFullBuild: false,
         pullBundle: false,
+        privateTestRepo: false,
       },
     ) {
+      // Host configuration first: the pod command names only `start`, so the container env the
+      // `underpost-config` Secret injects is folded into the host configuration store here rather than by
+      // a second command the image's CLI might not have. A direct call, not a shell-out, so it
+      // does not depend on CLI surface either.
+      if (Underpost.state.isInsideContainer()) Underpost.host.load({ env });
+
+      // One phase, and the source pull belongs to `build`: a pod arrives here either through
+      // its bootstrap, which already replaced this checkout and linked the CLI, or with
+      // `--build` and no `--skip-pull-repo-base`, which pulls it here. Every long step shells
+      // out through `node bin`, so those run the pulled source either way.
+      //
       // Bring the internal status endpoint up first so Phase-2 readiness is
       // observable through every lifecycle phase, including build and init. Bind
       // the deployment-resolved port so it always matches the monitor's target.
@@ -167,15 +184,85 @@ class UnderpostStartUp {
       } catch (error) {
         logger.error('Deployment build/init failed', { deployId, env, message: error?.message });
         setRuntimeStatus(deployId, env, RUNTIME_STATUS.ERROR);
-        if (!Underpost.env.isInsideContainer()) throw error;
+        if (!Underpost.state.isInsideContainer()) throw error;
+      }
+    },
+    /**
+     * Replaces `/home/dd/engine` with the deployment's own source and points the global
+     * `underpost` command at it — the base pull that makes the rest of the flow independent
+     * of how recently the npm package was published.
+     *
+     * One pull per container: {@link UnderpostStartUp.build} performs it unless
+     * `--skip-pull-repo-base` says the pod's own bootstrap (`pod_bootstrap_cmd`) already
+     * replaced the checkout and linked the CLI before `start` was ever invoked.
+     * @param {string} deployId - The ID of the deployment.
+     * @param {Object} [options] - Options for the pull.
+     * @param {boolean} [options.underpostQuicklyInstall] - Use `underpost install` instead of `npm install`.
+     * @param {boolean} [options.privateTestRepo] - Clone `engine-test-<id>` instead of `engine-<id>`.
+     * @memberof UnderpostStartUp
+     */
+    pullRepoBase(deployId = 'dd-default', options = {}) {
+      const buildBasePath = `/home/dd`;
+      // `--private-test-repo` clones the isolated test source repo published by
+      // `node bin/build <deployId> --update-private`, instead of the production one.
+      const repoName = Underpost.repo.engineRepoFactory(deployId, { test: options?.privateTestRepo === true });
+      shellExec(`cd ${buildBasePath} && underpost clone ${process.env.GITHUB_USERNAME}/${repoName}`);
+      shellExec(`mkdir -p ${ENGINE_PATH}`);
+      shellExec(`cd ${buildBasePath} && sudo cp -a ./${repoName}/. ./engine`);
+      shellExec(`cd ${buildBasePath} && sudo rm -rf ./${repoName}`);
+      shellCd(ENGINE_PATH);
+      // Dependencies before the link: stage 2 boots through this checkout's `bin/index.js`
+      // and cannot start without its node_modules.
+      shellExec(options?.underpostQuicklyInstall ? `underpost install` : `npm install`);
+      Underpost.start.linkRuntimeCli();
+    },
+    /**
+     * Repoints the global `underpost` command at the engine checkout.
+     *
+     * `--force` because the image already owns a global `underpost` from npm; without it npm
+     * refuses the bin with `EEXIST`. Only the bin is repointed — the published package
+     * directory stays in place, so `getUnderpostRootPath()` keeps resolving to it and both
+     * stages share the one container state store holding `container-status`.
+     *
+     * Failure is not fatal. A host that cannot write its global prefix falls back to the npm
+     * snapshot, which is exactly the behaviour before this step existed, rather than losing
+     * the deployment over a link.
+     * @param {string} [enginePath] - Checkout to link.
+     * @returns {boolean} Whether the global command now resolves to the checkout.
+     * @memberof UnderpostStartUp
+     */
+    linkRuntimeCli(enginePath = ENGINE_PATH) {
+      const checkout = shellArgumentFactory(enginePath);
+      const result = shellExec(
+        `cd ${checkout} && npm link --force && ` +
+          `test "$(readlink -f "$(command -v underpost)")" = "$(readlink -f ./bin/index.js)"`,
+        {
+          silent: true,
+          silentOnError: true,
+        },
+      );
+      if (result?.code === 0) {
+        logger.info('Global underpost CLI linked to the engine checkout', { enginePath });
+        return true;
       }
+      logger.warn('Could not link the global underpost CLI; continuing with the image snapshot', {
+        enginePath,
+        code: result?.code,
+        stderr: `${result?.stderr ?? ''}`.trim().split('\n').slice(-1)[0],
+      });
+      return false;
     },
     /**
-     * Run itc-scripts and builds client bundle.
+     * Materializes the deployment environment and builds the client bundle.
+     *
+     * Container-specific values are not applied by a script here: `app load` resolves the
+     * deployment's `.env.<env>.oci` overlay when it runs inside a container, so the working tree
+     * this build renders from already carries the cluster endpoints.
      * @param {string} deployId - The ID of the deployment.
      * @param {string} env - The environment of the deployment.
      * @param {Object} options - Options for the build.
-     * @param {boolean} options.skipPullBase - Whether to skip pulling the base code and use the current workspace code directly.
+     * @param {boolean} options.skipPullRepoBase - Whether to skip pulling the engine source repository and use the current workspace code directly.
+     * @param {boolean} options.skipPullPrivateRepo - Whether to skip cloning the private configuration repository, for a pod whose bootstrap already placed `engine-private`.
      * @param {boolean} options.underpostQuicklyInstall - Whether to use underpost quickly install.
      * @param {boolean} options.skipFullBuild - Whether to skip building the full client bundle.
      * @param {boolean} options.pullBundle - When true, download pre-built client bundle from Cloudinary via pull-bundle (must be pushed first with push-bundle).
@@ -187,31 +274,29 @@ class UnderpostStartUp {
     async build(
       deployId = 'dd-default',
       env = 'development',
-      options = { underpostQuicklyInstall: false, skipPullBase: false, skipFullBuild: false, pullBundle: false },
+      options = {
+        underpostQuicklyInstall: false,
+        skipPullRepoBase: false,
+        skipPullPrivateRepo: false,
+        skipFullBuild: false,
+        pullBundle: false,
+      },
     ) {
-      const buildBasePath = `/home/dd`;
-      // `--private-test-repo` clones the isolated test source repo published by
-      // `node bin/build <deployId> --update-private`, instead of the production one.
-      const repoName = options?.privateTestRepo
-        ? `engine-test-${deployId.split('-')[1]}`
-        : `engine-${deployId.split('-')[1]}`;
-      if (!options.skipPullBase) {
-        shellExec(`cd ${buildBasePath} && underpost clone ${process.env.GITHUB_USERNAME}/${repoName}`);
-        shellExec(`mkdir -p ${buildBasePath}/engine`);
-        shellExec(`cd ${buildBasePath} && sudo cp -a ./${repoName}/. ./engine`);
-        shellExec(`cd ${buildBasePath} && sudo rm -rf ./${repoName}`);
-      }
-      shellCd(`${buildBasePath}/engine`);
-      Underpost.repo.privateEngineRepoFactory(deployId);
-      shellExec(options?.underpostQuicklyInstall ? `underpost install` : `npm install`);
-      shellExec(`node bin env ${deployId} ${env}`);
-      if (fs.existsSync('./engine-private/itc-scripts')) {
-        const itcScripts = await fs.readdir('./engine-private/itc-scripts');
-        for (const itcScript of itcScripts)
-          if (itcScript.match(deployId)) shellExec(`node ./engine-private/itc-scripts/${itcScript}`);
-      }
-      if (options.pullBundle === true) shellExec(`node bin run pull-bundle --deploy-id ${deployId}`);
-      else if (!options.skipFullBuild) shellExec(`node bin client ${deployId}`);
+      if (options.skipPullRepoBase !== true) Underpost.start.pullRepoBase(deployId, options);
+      shellCd(ENGINE_PATH);
+      // Containers refresh private config because an image/bootstrap checkout may be stale.
+      // Hosts keep their local checkout, while explicit skip preserves caller-provided config.
+      if (options.skipPullPrivateRepo !== true)
+        Underpost.repo.privateEngineRepoFactory(deployId, { force: Underpost.state.isInsideContainer() });
+      // Awaited rather than blocking: these are the minutes-long steps of a deployment, and a
+      // synchronous child stalls the event loop for its whole duration — leaving the status
+      // endpoint bound but unable to answer, so telemetry went dark across the entire build.
+      await shellExecAsync(options?.underpostQuicklyInstall ? `underpost install` : `npm install`);
+      await shellExecAsync(`node bin app load --env ${env} --args deploy-id=${deployId}`);
+      if (options.pullBundle === true) await shellExecAsync(`node bin run pull-bundle --deploy-id ${deployId}`);
+      // `--env` is explicit rather than inherited: the container's ambient NODE_ENV comes from
+      // the injected `underpost-config`, and a build that guesses it renders the wrong conf.
+      else if (!options.skipFullBuild) await shellExecAsync(`node bin client ${deployId} --env ${env}`);
     },
     /**
      * Runs a deployment.
@@ -232,7 +317,7 @@ class UnderpostStartUp {
         const replicas = await fs.readdir(`./engine-private/replica`);
         for (const replica of replicas) {
           if (!replica.match(deployId)) continue;
-          shellExec(`node bin env ${replica} ${env}`);
+          shellExec(`node bin app load --env ${env} --args deploy-id=${replica}`);
           const replicaCmd = `npm ${runCmd} ${replica}`;
           shellExec(replicaCmd, { async: true, callback: makeDeployCallback(replicaCmd) });
           const result = await awaitDeployMonitor();
@@ -242,15 +327,19 @@ class UnderpostStartUp {
           }
         }
       }
-      shellExec(`node bin env ${deployId} ${env}`);
+      shellExec(`node bin app load --env ${env} --args deploy-id=${deployId}`);
       const deployCmd = `npm ${runCmd} ${deployId}`;
       shellExec(deployCmd, { async: true, callback: makeDeployCallback(deployCmd) });
       const result = await awaitDeployMonitor(true);
       if (result === true) {
-        if (env === 'production' && Underpost.env.isInsideContainer()) Underpost.secret.globalSecretClean();
+        // Withdraw every domain's local traces once the deployment is serving. Three calls
+        // rather than one cross-domain sweep: each domain owns what it put on disk.
+        if (env === 'production' && Underpost.state.isInsideContainer())
+          for (const domain of [Underpost.secret, Underpost.host, Underpost.app])
+            domain.clean({ env, namespace: 'default', args: {}, dryRun: false, force: false });
         setTimeout(() => {
           setRuntimeStatus(deployId, env, RUNTIME_STATUS.RUNNING);
-          Underpost.env.set(START_CONTAINER_STATUS_KEY, containerStatusValue(deployId, env, RUNTIME_STATUS.RUNNING));
+          setStartContainerStatus(deployId, env);
         });
       } else {
         setRuntimeStatus(deployId, env, RUNTIME_STATUS.ERROR);

package/src/server/{auth.js → security/auth.js}

@@ -1,27 +1,27 @@
 /**
  * Module for managing identity and authorization
- * @module src/server/auth.js
+ * @module src/server/security/auth.js
  * @namespace Auth
  */
 
 import jwt from 'jsonwebtoken';
-import { loggerFactory } from './logger.js';
+import { loggerFactory } from '../ops/logger.js';
 import crypto from 'crypto';
 import { promisify } from 'util';
-import { UserDto } from '../api/user/user.model.js';
+import { UserDto } from '../../api/user/user.model.js';
 import {
   commonAdminGuard,
   commonModeratorGuard,
   commonUserGuard,
   validatePassword,
-} from '../client/components/core/CommonJs.js';
+} from '../../client/components/core/CommonJs.js';
 import helmet from 'helmet';
 import rateLimit from 'express-rate-limit';
 import slowDown from 'express-slow-down';
 import cors from 'cors';
 import cookieParser from 'cookie-parser';
-import { DataBaseProviderService } from '../db/DataBaseProvider.js';
-import { isDevProxyContext } from './conf.js';
+import { DataBaseProviderService } from '../../db/DataBaseProvider.js';
+import { isDevProxyContext } from '../runtime/conf.js';
 
 const logger = loggerFactory(import.meta);
 
@@ -618,7 +618,7 @@ function applySecurity(app, opts = {}) {
 
   // Other helpful Helmet policies
   app.use(helmet.noSniff()); // X-Content-Type-Options: nosniff
-  app.use(helmet.frameguard({ action: 'deny' })); // X-Frame-Options: DENY
+  app.use(helmet.frameguard({ action: 'sameorigin' }));
   app.use(helmet.referrerPolicy({ policy: 'no-referrer-when-downgrade' }));
 
   // Content-Security-Policy: include nonce from res.locals
@@ -630,7 +630,6 @@ function applySecurity(app, opts = {}) {
       directives: {
         defaultSrc: ["'self'"],
         baseUri: ["'self'"],
-        blockAllMixedContent: [],
         fontSrc: ["'self'", httpDirective, 'data:'],
         frameAncestors: frameAncestors,
         imgSrc: ["'self'", 'data:', httpDirective, 'https:', 'blob:'],