@underpostnet/cyberia 3.3.0 → 3.3.76

package/.dockerignore

@@ -6,6 +6,7 @@
 /logs
 /build
 /.env
+/.underpost
 /coverage
 /prometheus_data
 /grafana_data

package/.env.example

@@ -43,25 +43,37 @@ VALKEY_PORT=6379
 # cyberia-server-* -> stable engine gateway for HTTP and the raw engine runtime
 # for gRPC. The public engine-cyberia name belongs to nginx, avoiding ambiguous
 # Docker DNS while keeping one stable HTTP endpoint for every module.
-ENGINE_API_BASE_URL=http://engine-cyberia
-ENGINE_GRPC_ADDRESS=engine-cyberia-runtime:50051
+CYBERIA_DATA_SERVER_URL=http://engine-cyberia
+CYBERIA_DATA_SERVER_GRPC=engine-cyberia-runtime:50051
 
 # Client-visible Content Authority origin, forwarded to browser/Raylib clients
 # for every engine-cyberia content/asset/metadata request. Host-reachable
 # (Docker publishes the raw engine runtime on host :4005). Unlike the internal
-# ENGINE_API_BASE_URL, this value is consumed outside the Compose network:
+# CYBERIA_DATA_SERVER_URL, this value is consumed outside the Compose network:
 # the two responsibilities must never overwrite each other.
 ENGINE_PUBLIC_URL=http://localhost:4005
 ENGINE_GRPC_RELOAD_INTERVAL_SEC=300
 
-# --- Browser-facing client runtime config (injected by docker-driver.py) -----
+# Shared secret between the engine and every game server. It guards the server
+# registry report (server -> engine) and the hot-reload trigger (engine ->
+# server). Unset disables both: a server then stays out of the public list.
+CYBERIA_SERVER_API_KEY=change_me_dev_server_api_key
+
+# Public origin of the server gateway. Each server reports this origin plus its
+# own sub-path, which is the URL a client dials.
+CYBERIA_SERVER_PUBLIC_ORIGIN=http://localhost:8081
+
+# --- Browser-facing client runtime config (injected by wasm-driver.py) -----
 # The single WASM bundle resolves its instance from the URL sub-path and builds
 # its endpoints from these origins. HTTP client/API traffic uses nginx on :80;
 # WebSocket traffic uses the dedicated multi-path server gateway on :8081.
 #   http://localhost/          -> default, ws://localhost:8081/ws
 #   http://localhost/FOREST    -> FOREST,  ws://localhost:8081/FOREST/ws
 CYBERIA_WS_ORIGIN=ws://localhost:8081
-CYBERIA_ENGINE_API_ORIGIN=http://localhost
+# The browser's own route to the Data Server, through nginx on :80. Distinct from the internal
+# CYBERIA_DATA_SERVER_URL above: both name a Data Server origin, but from opposite sides of the
+# Compose network, and one file cannot hold two values under one name.
+CYBERIA_CLIENT_DATA_SERVER_URL=http://localhost
 CYBERIA_DEFAULT_INSTANCE=amethyst-strata-expansion
 
 # cyberia-server logging. This is the dev stack, so default to DEBUG. Set

package/.github/workflows/coverall.cyberia.ci.yml

@@ -9,11 +9,14 @@ on:
 jobs:
   test:
     name: Coverall Cyberia Test
+    # Deliberately not the engine repository: two coverage workflows on one commit
+    # are two Coveralls builds, and the badge then shows whichever landed last
+    # rather than the tree's coverage. The engine is served by coverall.ci.yml.
     if: |
       github.actor != 'dependabot[bot]' &&
-      (github.repository == 'underpostnet/engine' ||
-       github.repository == 'underpostnet/engine-cyberia' ||
-       github.repository == 'underpostnet/engine-ghpkg-cyberia')
+      (github.repository == 'underpostnet/engine-cyberia' ||
+       github.repository == 'underpostnet/engine-ghpkg-cyberia' ||
+       github.repository == 'underpostnet/engine-test-cyberia')
     runs-on: ubuntu-latest
     container:
       image: quay.io/rockylinux/rockylinux:9
@@ -31,14 +34,26 @@ jobs:
           curl -fsSL https://rpm.nodesource.com/setup_24.x | bash -
           dnf install nodejs -y
 
+      # gofmt formats the generated stat contract; the cyberia tier's contract
+      # check fails without it on PATH.
+      - name: Install Go
+        run: dnf install -y golang
+
       - name: Install project dependencies
         run: npm install
 
-      - name: Run tests and generate coverage
-        run: scripts/coverall-test-cyberia.sh
+      # Set the COVERAGE_MIN repository variable to gate below the shipped
+      # default while the suite is catching up to it.
+      - name: Run tests and enforce coverage threshold
+        run: COVERAGE_ENFORCE=1 node bin test unit,infra,app,cyberia
+        env:
+          COVERAGE_MIN: ${{ vars.COVERAGE_MIN }}
 
+      # Stored even when the threshold step failed — that step still fails the
+      # job, but without the report the badge freezes at the last passing build.
       - name: Store coverage report
-        uses: actions/upload-artifact@v4
+        if: '!cancelled()'
+        uses: actions/upload-artifact@v7
         with:
           name: coverall-cyberia-lcov
           path: ./coverage/lcov.info
@@ -47,18 +62,23 @@ jobs:
   upload:
     name: Upload Cyberia Coverage to Coveralls
     needs: test
+    # Host runner, not the Rocky container the suite runs in: every step of the
+    # Coveralls action declares `shell: bash`, which the runner execs inside the
+    # job container and cannot resolve there.
     if: |
+      !cancelled() &&
       github.actor != 'dependabot[bot]' &&
-      (github.repository == 'underpostnet/engine' ||
-       github.repository == 'underpostnet/engine-cyberia' ||
-       github.repository == 'underpostnet/engine-ghpkg-cyberia')
+      (github.repository == 'underpostnet/engine-cyberia' ||
+       github.repository == 'underpostnet/engine-ghpkg-cyberia' ||
+       github.repository == 'underpostnet/engine-test-cyberia')
     runs-on: ubuntu-latest
     steps:
+      # Coveralls reads the commit and branch metadata from the checkout.
       - name: Clone repository
         uses: actions/checkout@v7
 
       - name: Restore coverage report
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: coverall-cyberia-lcov
           path: ./coverage
@@ -68,16 +88,21 @@ jobs:
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           file: ./coverage/lcov.info
-          flag-name: cyberia
+          format: lcov
           parallel: true
+          fail-on-error: true
 
   finish:
+    name: Finish Cyberia Coveralls build
     needs: upload
+    # The build stays open until this webhook lands, so it runs on any upload
+    # outcome rather than leaving a half-reported build behind.
     if: |
+      !cancelled() &&
       github.actor != 'dependabot[bot]' &&
-      (github.repository == 'underpostnet/engine' ||
-       github.repository == 'underpostnet/engine-cyberia' ||
-       github.repository == 'underpostnet/engine-ghpkg-cyberia')
+      (github.repository == 'underpostnet/engine-cyberia' ||
+       github.repository == 'underpostnet/engine-ghpkg-cyberia' ||
+       github.repository == 'underpostnet/engine-test-cyberia')
     runs-on: ubuntu-latest
     steps:
       - name: Notify Coveralls Finished

package/.github/workflows/cyberia-client.cd.yml

@@ -32,4 +32,9 @@ jobs:
           script: |
             set -e
             set -o pipefail
+            # Carried across the SSH hop so the far side reports in GitHub Actions form:
+            # deploy/lib/github-actions-logging.sh folds its monitor frames into collapsed groups, and the
+            # state domain's telemetry export emits ::notice::/::error:: annotations this job
+            # surfaces. GITHUB_ACTIONS itself is a runner-local variable and does not travel.
+            export RUN_QUIET_CI=github
             bash /home/dd/engine/deploy/cyberia-client/deploy.sh

package/.github/workflows/cyberia-server.cd.yml

@@ -32,4 +32,9 @@ jobs:
           script: |
             set -e
             set -o pipefail
+            # Carried across the SSH hop so the far side reports in GitHub Actions form:
+            # deploy/lib/github-actions-logging.sh folds its monitor frames into collapsed groups, and the
+            # state domain's telemetry export emits ::notice::/::error:: annotations this job
+            # surfaces. GITHUB_ACTIONS itself is a runner-local variable and does not travel.
+            export RUN_QUIET_CI=github
             bash /home/dd/engine/deploy/cyberia-server/deploy.sh

package/.github/workflows/docker-image.cyberia-client.ci.yml

@@ -4,7 +4,7 @@ on:
   workflow_dispatch:
 
 env:
-  UNDERPOST_VERSION: '3.3.0'
+  UNDERPOST_VERSION: '3.3.76'
 
 jobs:
   build-and-push:
@@ -34,9 +34,15 @@ jobs:
       - name: Build cyberia-server SSR dashboard
         working-directory: engine
         run: |
-          node bin/deploy cyberia
+          node bin package dd-cyberia --install
           node bin/cyberia run-workflow build-cyberia-404 --output-path ../assets/404/index.html
 
+      - name: Stage underpost CLI package
+        working-directory: engine
+        # Bakes the CLI into the runtime image from this checkout instead of the registry, so a
+        # starting pod never fetches it. The Dockerfiles COPY ../underpost-cli.tgz.
+        run: node bin/cyberia run-workflow stage-cli --output-path ..
+
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v4
 
@@ -65,7 +71,4 @@ jobs:
           push: true
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
-
-          build-args: |
-            UNDERPOST_VERSION=${{ env.UNDERPOST_VERSION }}
             BUILD_MODE=RELEASE

package/.github/workflows/docker-image.cyberia-client.dev.ci.yml

@@ -4,7 +4,7 @@ on:
   workflow_dispatch:
 
 env:
-  UNDERPOST_VERSION: '3.3.0'
+  UNDERPOST_VERSION: '3.3.76'
 
 jobs:
   build-and-push:
@@ -34,9 +34,15 @@ jobs:
       - name: Build cyberia-server SSR dashboard
         working-directory: engine
         run: |
-          node bin/deploy cyberia
+          node bin package dd-cyberia --install
           node bin/cyberia run-workflow build-cyberia-404 --output-path ../assets/404/index.html
 
+      - name: Stage underpost CLI package
+        working-directory: engine
+        # Bakes the CLI into the runtime image from this checkout instead of the registry, so a
+        # starting pod never fetches it. The Dockerfiles COPY ../underpost-cli.tgz.
+        run: node bin/cyberia run-workflow stage-cli --output-path ..
+
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v4
 
@@ -66,5 +72,4 @@ jobs:
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
           build-args: |
-            UNDERPOST_VERSION=${{ env.UNDERPOST_VERSION }}
             BUILD_MODE=DEBUG

package/.github/workflows/docker-image.cyberia-server.ci.yml

@@ -4,7 +4,7 @@ on:
   workflow_dispatch:
 
 env:
-  UNDERPOST_VERSION: '3.3.0'
+  UNDERPOST_VERSION: '3.3.76'
 
 jobs:
   build-and-push:
@@ -34,10 +34,16 @@ jobs:
       - name: Build cyberia-server SSR dashboard
         working-directory: engine
         run: |
-          node bin/deploy cyberia
+          node bin package dd-cyberia --install
           node bin/cyberia run-workflow build-server-dashboard --output-path ../public/index.html
           node bin/cyberia run-workflow build-cyberia-404 --output-path ../public/404/index.html
 
+      - name: Stage underpost CLI package
+        working-directory: engine
+        # Bakes the CLI into the runtime image from this checkout instead of the registry, so a
+        # starting pod never fetches it. The Dockerfiles COPY ../underpost-cli.tgz.
+        run: node bin/cyberia run-workflow stage-cli --output-path ..
+
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v4
 
@@ -66,6 +72,3 @@ jobs:
           push: true
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
-
-          build-args: |
-            UNDERPOST_VERSION=${{ env.UNDERPOST_VERSION }}

package/.github/workflows/docker-image.cyberia-server.dev.ci.yml

@@ -4,7 +4,7 @@ on:
   workflow_dispatch:
 
 env:
-  UNDERPOST_VERSION: '3.3.0'
+  UNDERPOST_VERSION: '3.3.76'
 
 jobs:
   build-and-push:
@@ -34,10 +34,16 @@ jobs:
       - name: Build cyberia-server SSR dashboard (dev)
         working-directory: engine
         run: |
-          node bin/deploy cyberia
+          node bin package dd-cyberia --install
           node bin/cyberia run-workflow build-server-dashboard --dev --output-path ../public/index.html
           node bin/cyberia run-workflow build-cyberia-404 --output-path ../public/404/index.html
 
+      - name: Stage underpost CLI package
+        working-directory: engine
+        # Bakes the CLI into the runtime image from this checkout instead of the registry, so a
+        # starting pod never fetches it. The Dockerfiles COPY ../underpost-cli.tgz.
+        run: node bin/cyberia run-workflow stage-cli --output-path ..
+
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v4
 
@@ -66,6 +72,3 @@ jobs:
           push: true
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
-
-          build-args: |
-            UNDERPOST_VERSION=${{ env.UNDERPOST_VERSION }}

package/.github/workflows/docker-image.engine-cyberia.ci.yml

@@ -4,7 +4,7 @@ on:
   workflow_dispatch:
 
 env:
-  UNDERPOST_VERSION: '3.3.0'
+  UNDERPOST_VERSION: '3.3.76'
 
 jobs:
   build-and-push:
@@ -16,6 +16,20 @@ jobs:
     steps:
       - uses: actions/checkout@v7
 
+      - name: Setup Node.js
+        uses: actions/setup-node@v7
+        with:
+          node-version: '24.x'
+
+      - name: Install engine dependencies
+        run: npm ci --ignore-scripts
+
+      - name: Stage underpost CLI package
+        # Bakes the CLI into the image from this checkout instead of the registry, so a starting
+        # pod never fetches it. The Dockerfiles COPY underpost-cli.tgz from the build context,
+        # which for this workflow is the repository root.
+        run: node bin/cyberia run-workflow stage-cli --output-path .
+
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v4
 

package/.github/workflows/docker-image.engine-cyberia.dev.ci.yml

@@ -4,7 +4,7 @@ on:
   workflow_dispatch:
 
 env:
-  UNDERPOST_VERSION: '3.3.0'
+  UNDERPOST_VERSION: '3.3.76'
 
 jobs:
   build-and-push:
@@ -16,6 +16,20 @@ jobs:
     steps:
       - uses: actions/checkout@v7
 
+      - name: Setup Node.js
+        uses: actions/setup-node@v7
+        with:
+          node-version: '24.x'
+
+      - name: Install engine dependencies
+        run: npm ci --ignore-scripts
+
+      - name: Stage underpost CLI package
+        # Bakes the CLI into the image from this checkout instead of the registry, so a starting
+        # pod never fetches it. The Dockerfiles COPY underpost-cli.tgz from the build context,
+        # which for this workflow is the repository root.
+        run: node bin/cyberia run-workflow stage-cli --output-path .
+
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v4
 

package/.github/workflows/engine-cyberia.cd.yml

@@ -40,6 +40,7 @@ jobs:
           script: |
             set -e
             set -o pipefail
+            export RUN_QUIET_CI=github
             bash /home/dd/engine/deploy/dd-cyberia/deploy.sh
   sync-and-deploy:
     if: github.event.inputs.job == 'sync-and-deploy'
@@ -65,6 +66,7 @@ jobs:
           script: |
             set -e
             set -o pipefail
+            export RUN_QUIET_CI=github
             bash /home/dd/engine/deploy/dd-cyberia/sync-deploy.sh
   init:
     if: github.event.inputs.job == 'init'
@@ -90,4 +92,5 @@ jobs:
           script: |
             set -e
             set -o pipefail
+            export RUN_QUIET_CI=github
             bash /home/dd/engine/deploy/dd-cyberia/init.sh

package/.github/workflows/engine-cyberia.ci.yml

@@ -62,13 +62,12 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GIT_AUTH_TOKEN }}
           GITHUB_USERNAME: ${{ github.repository_owner }}
+          # Never interpolated into the script: the propagated payload is multi-line and a shell
+          # expansion would corrupt entries holding `$` and execute anything in `$(...)`.
+          PROPAGATED_MESSAGE: ${{ github.event.inputs.message }}
         run: |
           cd .. && node engine/bin clone underpostnet/pwa-microservices-template
-          if [ -n "${{ github.event.inputs.message }}" ]; then
-            LAST_COMMIT_MESSAGE="${{ github.event.inputs.message }}"
-          else
-            LAST_COMMIT_MESSAGE=$(cd engine && node bin cmt --changelog-msg --from-n-commit 1 --changelog-no-hash 2>/dev/null || echo "")
-          fi
+          LAST_COMMIT_MESSAGE=$(cd engine && node bin cmt --propagate-msg 2>/dev/null || echo "")
           SHOULD_CD="${{ github.event.inputs.sync }}"
           DEPLOY_TYPE="${{ github.event.inputs.deploy_type }}"
           if [ -z "$LAST_COMMIT_MESSAGE" ]; then

package/.github/workflows/ghpkg.ci.yml

@@ -48,20 +48,30 @@ jobs:
           curl -fsSL https://rpm.nodesource.com/setup_24.x | bash -
           dnf install nodejs -y
 
-      - name: Capture commit message
-        run: |
-          FULL_MSG="${{ github.event.head_commit.message }}"
-          LAST_COMMIT_MESSAGE="${FULL_MSG:-update package}"
-          echo "LAST_COMMIT_MESSAGE<<EOF" >> $GITHUB_ENV
-          echo "$LAST_COMMIT_MESSAGE" >> $GITHUB_ENV
-          echo "EOF" >> $GITHUB_ENV
-          echo "[INFO] Commit message: $LAST_COMMIT_MESSAGE"
-
       - name: Install dependencies and set repo configuration
         run: |
           npm install
-          node ./bin/deploy rename-package @underpostnet/underpost
-          node ./bin/deploy set-repo underpostnet/pwa-microservices-template-ghpkg
+          node ./bin package --rename @underpostnet/underpost
+          node ./bin package --set-repo underpostnet/pwa-microservices-template-ghpkg
+
+      # Placed after the install because it resolves the payload through the CLI, which needs the
+      # dependencies. The push that triggers this job carries the payload the engine propagated.
+      - name: Capture commit message
+        env:
+          # Never interpolated into the script: the propagated payload is multi-line and a shell
+          # expansion would corrupt entries holding `$` and execute anything in `$(...)`.
+          PROPAGATED_MESSAGE: ${{ github.event.head_commit.message }}
+        run: |
+          LAST_COMMIT_MESSAGE=$(node ./bin cmt --propagate-msg 2>/dev/null || echo "")
+          if [ -z "$LAST_COMMIT_MESSAGE" ]; then
+            LAST_COMMIT_MESSAGE="update package"
+          fi
+          {
+            echo "LAST_COMMIT_MESSAGE<<PROPAGATION_EOF"
+            echo "$LAST_COMMIT_MESSAGE"
+            echo "PROPAGATION_EOF"
+          } >> $GITHUB_ENV
+          echo "[INFO] Commit message: $LAST_COMMIT_MESSAGE"
 
       - name: Set git global credentials
         run: |
@@ -124,15 +134,20 @@ jobs:
           echo "[INFO] Canonical github package repo: underpostnet/engine-ghpkg-$CONF_ID"
 
       - name: Capture commit message
+        env:
+          # Never interpolated into the script: the propagated payload is multi-line and a shell
+          # expansion would corrupt entries holding `$` and execute anything in `$(...)`.
+          PROPAGATED_MESSAGE: ${{ github.event.inputs.message }}
         run: |
-          FULL_MSG="${{ github.event.inputs.message }}"
-          if [ -z "$FULL_MSG" ]; then
-            FULL_MSG=$(node bin cmt --changelog-msg --from-n-commit 1 --changelog-no-hash 2>/dev/null || echo "")
+          LAST_COMMIT_MESSAGE=$(node bin cmt --propagate-msg 2>/dev/null || echo "")
+          if [ -z "$LAST_COMMIT_MESSAGE" ]; then
+            LAST_COMMIT_MESSAGE="Update canonical github package repo"
           fi
-          LAST_COMMIT_MESSAGE="${FULL_MSG:-Update canonical github package repo}"
-          echo "LAST_COMMIT_MESSAGE<<EOF" >> $GITHUB_ENV
-          echo "$LAST_COMMIT_MESSAGE" >> $GITHUB_ENV
-          echo "EOF" >> $GITHUB_ENV
+          {
+            echo "LAST_COMMIT_MESSAGE<<PROPAGATION_EOF"
+            echo "$LAST_COMMIT_MESSAGE"
+            echo "PROPAGATION_EOF"
+          } >> $GITHUB_ENV
           echo "[INFO] Commit message: $LAST_COMMIT_MESSAGE"
 
       - name: Set git global credentials
@@ -152,8 +167,8 @@ jobs:
           cd engine-$CONF_ID
           rm -rf ./.git
           mv ../$GHPKG_REPO.git ./.git
-          node ../engine/bin/deploy rename-package "$PACKAGE_NAME"
-          node ../engine/bin/deploy set-repo underpostnet/$GHPKG_REPO
+          node ../engine/bin package --rename "$PACKAGE_NAME"
+          node ../engine/bin package --set-repo underpostnet/$GHPKG_REPO
           git init
           git config user.name 'underpostnet'
           git config user.email 'development@underpost.net'

package/.github/workflows/hardhat.ci.yml

@@ -5,13 +5,10 @@ name: CI | Hardhat
 
 on:
   push:
-    paths:
-      - 'hardhat/**'
-      - '.github/workflows/hardhat.ci.yml'
+    branches: ['master', 'main']
   pull_request:
-    paths:
-      - 'hardhat/**'
-      - '.github/workflows/hardhat.ci.yml'
+    branches: ['master', 'main']
+
   workflow_dispatch:
 
 permissions:
@@ -20,6 +17,11 @@ permissions:
 jobs:
   build-and-test:
     name: Compile, Test & Audit
+    if: |
+      github.actor != 'dependabot[bot]' &&
+      (github.repository == 'underpostnet/engine-cyberia' ||
+       github.repository == 'underpostnet/engine-ghpkg-cyberia' ||
+       github.repository == 'underpostnet/engine-test-cyberia')
     runs-on: ubuntu-latest
     defaults:
       run:
@@ -59,18 +61,17 @@ jobs:
 
       # ── Compile ──────────────────────────────────────────────────────────
       - name: Compile Solidity contracts
-        run: npx hardhat compile
+        run: npm run compile
 
       # ── Test ─────────────────────────────────────────────────────────────
       - name: Run tests
-        run: npx hardhat test
+        run: npm test
         env:
           REPORT_GAS: 'true'
 
-      # ── Coverage (optional, only on primary Node version) ────────────────
+      # ── Coverage ─────────────────────────────────────────────────────────
       - name: Solidity coverage
-        if: matrix.node-version == '20'
-        run: npx hardhat coverage
+        run: npm run coverage
 
       # ── Lockfile integrity check ─────────────────────────────────────────
       # Fail if package-lock.json is out of sync with package.json

package/.github/workflows/npmpkg.ci.yml

@@ -51,26 +51,28 @@ jobs:
           curl -fsSL https://rpm.nodesource.com/setup_24.x | bash -
           dnf install nodejs -y
 
+      - name: Install dependencies
+        run: npm install
+
+      # Placed after the install because it resolves the payload through the CLI, which needs the
+      # dependencies. The dispatch input wins; a push carries its own commit message instead.
       - name: Capture commit message
+        env:
+          # Never interpolated into the script: the propagated payload is multi-line and a shell
+          # expansion would corrupt entries holding `$` and execute anything in `$(...)`.
+          PROPAGATED_MESSAGE: ${{ github.event.inputs.message || github.event.head_commit.message }}
         run: |
-          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
-            LAST_COMMIT_MESSAGE="${{ github.event.inputs.message }}"
-            if [ -z "$LAST_COMMIT_MESSAGE" ]; then
-              LAST_COMMIT_MESSAGE="Update repository"
-            fi
-          else
-            FULL_MSG="${{ github.event.head_commit.message }}"
-            REST="$(echo "$FULL_MSG" | tail -n +2 | awk 'NR==1{first=$0; has_first=1; next} NR==2{print first " " $0; has_first=0; next} {print} END{if(has_first) print first}')"
-            LAST_COMMIT_MESSAGE="${REST:-$FULL_MSG}"
+          LAST_COMMIT_MESSAGE=$(node bin cmt --propagate-msg 2>/dev/null || echo "")
+          if [ -z "$LAST_COMMIT_MESSAGE" ]; then
+            LAST_COMMIT_MESSAGE="Update repository"
           fi
-          echo "LAST_COMMIT_MESSAGE<<EOF" >> $GITHUB_ENV
-          echo "$LAST_COMMIT_MESSAGE" >> $GITHUB_ENV
-          echo "EOF" >> $GITHUB_ENV
+          {
+            echo "LAST_COMMIT_MESSAGE<<PROPAGATION_EOF"
+            echo "$LAST_COMMIT_MESSAGE"
+            echo "PROPAGATION_EOF"
+          } >> $GITHUB_ENV
           echo "[INFO] Extracted payload: $LAST_COMMIT_MESSAGE"
 
-      - name: Install dependencies
-        run: npm install
-
       - name: Set git global credentials
         run: |
           git config --global --add safe.directory '*'

package/.github/workflows/publish.cyberia.ci.yml

@@ -32,6 +32,28 @@ jobs:
       - name: Install Dependencies
         run: npm ci
 
+      # The repository declares the engine's runtime dependencies because it runs the engine
+      # source it ships; a registry consumer gets them through `underpost` instead. This restores
+      # the manifest the package published before that split, and only in the tarball — after
+      # `npm ci`, so the lockfile the checkout installs from is the repository's own.
+      - name: Restore the published dependency set
+        run: |
+          node --input-type=module -e '
+            import fs from "node:fs";
+            import { publishedProductPackageJson, DEPLOY_MANIFEST_INDENT } from "./src/server/build/package.js";
+            import { loadDeployCatalog } from "./src/server/build/catalog.js";
+            const packageJson = JSON.parse(fs.readFileSync("./package.json", "utf8"));
+            const published = publishedProductPackageJson({
+              packageJson,
+              catalog: await loadDeployCatalog("dd-cyberia"),
+            });
+            fs.writeFileSync("./package.json", JSON.stringify(published, null, DEPLOY_MANIFEST_INDENT) + "\n", "utf8");
+            console.log("published manifest", {
+              dependencies: Object.keys(published.dependencies).length,
+              devDependencies: Object.keys(published.devDependencies ?? {}).length,
+            });
+          '
+
       - name: Publish to npm
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
@@ -57,6 +79,28 @@ jobs:
       - name: Install Dependencies
         run: npm ci
 
+      # The repository declares the engine's runtime dependencies because it runs the engine
+      # source it ships; a registry consumer gets them through `underpost` instead. This restores
+      # the manifest the package published before that split, and only in the tarball — after
+      # `npm ci`, so the lockfile the checkout installs from is the repository's own.
+      - name: Restore the published dependency set
+        run: |
+          node --input-type=module -e '
+            import fs from "node:fs";
+            import { publishedProductPackageJson, DEPLOY_MANIFEST_INDENT } from "./src/server/build/package.js";
+            import { loadDeployCatalog } from "./src/server/build/catalog.js";
+            const packageJson = JSON.parse(fs.readFileSync("./package.json", "utf8"));
+            const published = publishedProductPackageJson({
+              packageJson,
+              catalog: await loadDeployCatalog("dd-cyberia"),
+            });
+            fs.writeFileSync("./package.json", JSON.stringify(published, null, DEPLOY_MANIFEST_INDENT) + "\n", "utf8");
+            console.log("published manifest", {
+              dependencies: Object.keys(published.dependencies).length,
+              devDependencies: Object.keys(published.devDependencies ?? {}).length,
+            });
+          '
+
       - name: Publish to npm
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

package/.github/workflows/pwa-microservices-template-test.ci.yml

@@ -1,4 +1,4 @@
-name: CI | Gihub page | PWA Microservices Template Test
+name: CI | PWA Microservices | Unit & Infra Tests
 
 on: [push]
 
@@ -30,4 +30,4 @@ jobs:
         run: npm install
 
       - name: Run test
-        run: scripts/coverall-test.sh
+        run: node bin test unit,infra