@underpostnet/cyberia 3.3.0 → 3.3.76

package/hardhat/hardhat.config.js

@@ -3,7 +3,7 @@
 // Supports deployment to Hyperledger Besu (IBFT2/QBFT) private networks
 // running on kubeadm-managed Kubernetes clusters (manifests/besu/).
 //
-// Compatible with: Hardhat 3.x + Ethers v6 + hardhat-toolbox-mocha-ethers
+// Compatible with: Hardhat 3.x + viem + hardhat-toolbox-viem
 
 import { defineConfig } from 'hardhat/config';
 import hardhatToolboxViem from '@nomicfoundation/hardhat-toolbox-viem';
@@ -126,11 +126,6 @@ const config = defineConfig({
     outputFile: process.env.GAS_REPORT_FILE || undefined,
     noColors: !!process.env.GAS_REPORT_FILE,
   },
-
-  // ── Mocha (test runner) ─────────────────────────────────────────────────────
-  mocha: {
-    timeout: 60000,
-  },
 });
 
 export default config;

package/hardhat/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "cyberia-hardhat",
-  "version": "3.3.0",
+  "version": "3.3.76",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "cyberia-hardhat",
-      "version": "3.3.0",
+      "version": "3.3.76",
       "dependencies": {
         "@openzeppelin/contracts": "~5.6.1",
         "dotenv": "~17.4.2",
@@ -15,7 +15,7 @@
       "devDependencies": {
         "@nomicfoundation/hardhat-toolbox-viem": "^5.0.7",
         "chai": "^6.2.2",
-        "hardhat": "~3.13.0"
+        "hardhat": "~3.15.0"
       },
       "engines": {
         "node": ">=22.0.0"
@@ -1022,90 +1022,151 @@
       }
     },
     "node_modules/@nomicfoundation/edr": {
-      "version": "0.15.0",
-      "resolved": "https://registry.npmjs.org/@nomicfoundation/edr/-/edr-0.15.0.tgz",
-      "integrity": "sha512-RcBnQ0MYsrjhLsN+Kcu7q5mnRmBlxmv+Y0lxgrCsST6YTDH/l5RH3nG88J8sDEGmXyjVzX2HsXQBy9NxFJHFuw==",
+      "version": "0.19.0",
+      "resolved": "https://registry.npmjs.org/@nomicfoundation/edr/-/edr-0.19.0.tgz",
+      "integrity": "sha512-wzuyAylm4XWIahFjy1pFDQfHny4Xsx73T98d8KJAkGG/Rpgp0M36rqS4lzjbGQ1tXDrWEBG0WRr0v1jrQhQ0xg==",
       "dev": true,
       "license": "MIT",
-      "dependencies": {
-        "@nomicfoundation/edr-darwin-arm64": "0.15.0",
-        "@nomicfoundation/edr-darwin-x64": "0.15.0",
-        "@nomicfoundation/edr-linux-arm64-gnu": "0.15.0",
-        "@nomicfoundation/edr-linux-arm64-musl": "0.15.0",
-        "@nomicfoundation/edr-linux-x64-gnu": "0.15.0",
-        "@nomicfoundation/edr-linux-x64-musl": "0.15.0",
-        "@nomicfoundation/edr-win32-x64-msvc": "0.15.0"
-      },
       "engines": {
         "node": ">= 22"
+      },
+      "optionalDependencies": {
+        "@nomicfoundation/edr-darwin-arm64": "0.19.0",
+        "@nomicfoundation/edr-darwin-x64": "0.19.0",
+        "@nomicfoundation/edr-linux-arm64-gnu": "0.19.0",
+        "@nomicfoundation/edr-linux-arm64-musl": "0.19.0",
+        "@nomicfoundation/edr-linux-x64-gnu": "0.19.0",
+        "@nomicfoundation/edr-linux-x64-musl": "0.19.0",
+        "@nomicfoundation/edr-win32-x64-msvc": "0.19.0"
       }
     },
     "node_modules/@nomicfoundation/edr-darwin-arm64": {
-      "version": "0.15.0",
-      "resolved": "https://registry.npmjs.org/@nomicfoundation/edr-darwin-arm64/-/edr-darwin-arm64-0.15.0.tgz",
-      "integrity": "sha512-kFgoiou9yfzojAki3yOnOlFZfkC0oQeS8G3i/8lXaTnjEjQ2C1lLDgRQt8Q0kjSdVOs5daiC+eQx+8to4R5/ug==",
+      "version": "0.19.0",
+      "resolved": "https://registry.npmjs.org/@nomicfoundation/edr-darwin-arm64/-/edr-darwin-arm64-0.19.0.tgz",
+      "integrity": "sha512-Yo2MkZoM85zkasUPJDj8l8QezPdrMzqQUJhp78TUQDq8FQXhdJTZ39k3Jax5OQ3hqjMhMkrGbctn9w9h6mEusg==",
+      "cpu": [
+        "arm64"
+      ],
       "dev": true,
       "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
       "engines": {
         "node": ">= 22"
       }
     },
     "node_modules/@nomicfoundation/edr-darwin-x64": {
-      "version": "0.15.0",
-      "resolved": "https://registry.npmjs.org/@nomicfoundation/edr-darwin-x64/-/edr-darwin-x64-0.15.0.tgz",
-      "integrity": "sha512-vnFHCj2oxd7N8Eg760yY5gPAHz6tL7NB9Pt1nrP8/+XIutEdUJjpIDGadG0jsTHNmq303EvHh4nkpuO3zBCSZw==",
+      "version": "0.19.0",
+      "resolved": "https://registry.npmjs.org/@nomicfoundation/edr-darwin-x64/-/edr-darwin-x64-0.19.0.tgz",
+      "integrity": "sha512-RC7RVX1iATg9SlJTnKD57A8jRBIBiUKmAdi8maBN4zhmK5Z7aAeiwdQX6VjPOum3c2Mdpp2Q7JfooJxxF6bCvw==",
+      "cpu": [
+        "x64"
+      ],
       "dev": true,
       "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
       "engines": {
         "node": ">= 22"
       }
     },
     "node_modules/@nomicfoundation/edr-linux-arm64-gnu": {
-      "version": "0.15.0",
-      "resolved": "https://registry.npmjs.org/@nomicfoundation/edr-linux-arm64-gnu/-/edr-linux-arm64-gnu-0.15.0.tgz",
-      "integrity": "sha512-klBqsMWl19NVok/9BOcX/PeV7M7DrTM4C7eSOQyc6wglZZRwKSm8tDtwQVh/bJkOCqqgVMO6IOi+IQ4xQbsgog==",
+      "version": "0.19.0",
+      "resolved": "https://registry.npmjs.org/@nomicfoundation/edr-linux-arm64-gnu/-/edr-linux-arm64-gnu-0.19.0.tgz",
+      "integrity": "sha512-vhEKPUomGwM0Lsjpwd5q/Jc6yE2hpspJBCRYFkCghzCmwgZHtoYn/2nd1nOLsTt7jqMlvAKJSaLCrhz1HCTCTA==",
+      "cpu": [
+        "arm64"
+      ],
       "dev": true,
+      "libc": [
+        "glibc"
+      ],
       "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
       "engines": {
         "node": ">= 22"
       }
     },
     "node_modules/@nomicfoundation/edr-linux-arm64-musl": {
-      "version": "0.15.0",
-      "resolved": "https://registry.npmjs.org/@nomicfoundation/edr-linux-arm64-musl/-/edr-linux-arm64-musl-0.15.0.tgz",
-      "integrity": "sha512-PQ6oqCCOjQaGCyDA1XFDWbpGrXGKZ8Fr3JQrd7cCCqVvIBshg68WrJ7gqlf4DdeidppIi3m9CNRsWsRfj9Y17w==",
+      "version": "0.19.0",
+      "resolved": "https://registry.npmjs.org/@nomicfoundation/edr-linux-arm64-musl/-/edr-linux-arm64-musl-0.19.0.tgz",
+      "integrity": "sha512-mlkpVUolkSpMIriZyiJeTbgx/m4Ngm9lQtah2BG92H+dgtwMIMze6Q6OQfZG6oi6wMrhDgu8WEyAy3XgIwlcRg==",
+      "cpu": [
+        "arm64"
+      ],
       "dev": true,
+      "libc": [
+        "musl"
+      ],
       "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
       "engines": {
         "node": ">= 22"
       }
     },
     "node_modules/@nomicfoundation/edr-linux-x64-gnu": {
-      "version": "0.15.0",
-      "resolved": "https://registry.npmjs.org/@nomicfoundation/edr-linux-x64-gnu/-/edr-linux-x64-gnu-0.15.0.tgz",
-      "integrity": "sha512-j89Ywivbs78xWjoSFcZLp+pUqe0p0p3vqiG1utGFj/fJ7zEgTQBcC+DUiyddFpYB3TE79TZMUoaAnEVdxTi4Xw==",
+      "version": "0.19.0",
+      "resolved": "https://registry.npmjs.org/@nomicfoundation/edr-linux-x64-gnu/-/edr-linux-x64-gnu-0.19.0.tgz",
+      "integrity": "sha512-d0Z+WVbX5mm6s9ozc5TXrCRjQykdN81tGI+eaM4hQcD/S5VSY9rwKuCXyLJ/GkgeI5S8HEHsyVdXEsDJznPyhA==",
+      "cpu": [
+        "x64"
+      ],
       "dev": true,
+      "libc": [
+        "glibc"
+      ],
       "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
       "engines": {
         "node": ">= 22"
       }
     },
     "node_modules/@nomicfoundation/edr-linux-x64-musl": {
-      "version": "0.15.0",
-      "resolved": "https://registry.npmjs.org/@nomicfoundation/edr-linux-x64-musl/-/edr-linux-x64-musl-0.15.0.tgz",
-      "integrity": "sha512-bJuCPxihvSFyoGAxmYL5CyN9id5mqncyikywTa7+/+g7ge2Pnz+w7GHbim+tvHeMA9XQv1vSy4QgNkkZXGBzLg==",
+      "version": "0.19.0",
+      "resolved": "https://registry.npmjs.org/@nomicfoundation/edr-linux-x64-musl/-/edr-linux-x64-musl-0.19.0.tgz",
+      "integrity": "sha512-UIrlNqYj9lbUXpBy++WwHeC0xZqyFw9TXy06/8+0PLffI7Si4kiTKfXqdITGQhP6Vf/JuJ8y+jos8oy6bL8jFQ==",
+      "cpu": [
+        "x64"
+      ],
       "dev": true,
+      "libc": [
+        "musl"
+      ],
       "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
       "engines": {
         "node": ">= 22"
       }
     },
     "node_modules/@nomicfoundation/edr-win32-x64-msvc": {
-      "version": "0.15.0",
-      "resolved": "https://registry.npmjs.org/@nomicfoundation/edr-win32-x64-msvc/-/edr-win32-x64-msvc-0.15.0.tgz",
-      "integrity": "sha512-pnUdVgZ4VwqbZu9XTAxJeuGavAY1w3txd/HkpqiOuu43Yrt0nnsRO5gAdj4smXJmQ5Bzy2x2GJ0/68rP4T1Pgw==",
+      "version": "0.19.0",
+      "resolved": "https://registry.npmjs.org/@nomicfoundation/edr-win32-x64-msvc/-/edr-win32-x64-msvc-0.19.0.tgz",
+      "integrity": "sha512-pIyEJBiS8l09Yndz+aE/JmkD39FCqtyiRO+wlx6tX426o4290acRfJ0r7GwTBmqqZD5G4pLOOB0uLIMRyDrY+g==",
+      "cpu": [
+        "x64"
+      ],
       "dev": true,
       "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
       "engines": {
         "node": ">= 22"
       }
@@ -2004,13 +2065,13 @@
       "license": "ISC"
     },
     "node_modules/hardhat": {
-      "version": "3.13.0",
-      "resolved": "https://registry.npmjs.org/hardhat/-/hardhat-3.13.0.tgz",
-      "integrity": "sha512-ERVBunuWWBTT3BNfZlozqGB0cSG84xi/P380wGNUxt+pl5e309ZVmNvXiwrMxZn4Ua4LJYW93yC1RnAtf7fLNw==",
+      "version": "3.15.0",
+      "resolved": "https://registry.npmjs.org/hardhat/-/hardhat-3.15.0.tgz",
+      "integrity": "sha512-41S+2ZCRRKfIcHLnfrpvGdBCaUf468U+YYqAeBSFZFivB7cY3qqDtOxOiLuLaJ7dw75yA/K3VHKZ2QF8nAd+iA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@nomicfoundation/edr": "0.15.0",
+        "@nomicfoundation/edr": "0.19.0",
         "@nomicfoundation/hardhat-errors": "^3.0.17",
         "@nomicfoundation/hardhat-utils": "^4.1.6",
         "@nomicfoundation/hardhat-vendored": "^3.0.4",

package/hardhat/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cyberia-hardhat",
-  "version": "3.3.0",
+  "version": "3.3.76",
   "type": "module",
   "description": "Hardhat project for Cyberia Online ObjectLayerToken (ERC-1155) on Hyperledger Besu",
   "private": true,
@@ -21,7 +21,7 @@
   "devDependencies": {
     "@nomicfoundation/hardhat-toolbox-viem": "^5.0.7",
     "chai": "^6.2.2",
-    "hardhat": "~3.13.0"
+    "hardhat": "~3.15.0"
   },
   "dependencies": {
     "@openzeppelin/contracts": "~5.6.1",

package/manifests/alertmanager/deployment.yaml

@@ -0,0 +1,81 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: alertmanager
+  labels:
+    app: alertmanager
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: alertmanager
+  template:
+    metadata:
+      labels:
+        app: alertmanager
+    spec:
+      containers:
+        - name: alertmanager
+          image: prom/alertmanager:latest
+          args:
+            - '--config.file=/etc/alertmanager/alertmanager.yml'
+            - '--storage.path=/alertmanager'
+          ports:
+            - containerPort: 9093
+              name: web
+          volumeMounts:
+            - name: alertmanager-config
+              mountPath: /etc/alertmanager/
+            # The bearer token Alertmanager presents to the event dispatcher,
+            # written by the monitor CLI before this workload is applied. Marked
+            # optional so a missing Secret surfaces as a config-load error naming
+            # the file, rather than a pod stuck in ContainerCreating.
+            - name: alertmanager-webhook
+              mountPath: /etc/alertmanager/secret/
+              readOnly: true
+            - name: alertmanager-data
+              mountPath: /alertmanager
+          readinessProbe:
+            httpGet:
+              path: /-/ready
+              port: 9093
+            initialDelaySeconds: 10
+            periodSeconds: 15
+          livenessProbe:
+            httpGet:
+              path: /-/healthy
+              port: 9093
+            initialDelaySeconds: 30
+            periodSeconds: 20
+          resources:
+            requests:
+              memory: '64Mi'
+              cpu: '50m'
+      volumes:
+        - name: alertmanager-config
+          configMap:
+            name: alertmanager-config
+        - name: alertmanager-webhook
+          secret:
+            secretName: alertmanager-webhook
+            optional: true
+        - name: alertmanager-data
+          emptyDir: {}
+
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: alertmanager
+  labels:
+    app: alertmanager
+spec:
+  ports:
+    - port: 9093
+      targetPort: 9093
+      protocol: TCP
+      name: web
+  selector:
+    app: alertmanager
+  type: ClusterIP

package/manifests/blackbox-exporter/deployment.yaml

@@ -0,0 +1,75 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: blackbox-exporter
+  labels:
+    app: blackbox-exporter
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: blackbox-exporter
+  template:
+    metadata:
+      labels:
+        app: blackbox-exporter
+    spec:
+      containers:
+        - name: blackbox-exporter
+          image: prom/blackbox-exporter:latest
+          args:
+            - '--config.file=/etc/blackbox_exporter/blackbox.yml'
+          ports:
+            - containerPort: 9115
+              name: http
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+              # The icmp prober opens a raw socket. Without NET_RAW the module
+              # loads and every probe fails at send time, which reads as the
+              # target being down rather than as a misconfigured exporter.
+              add:
+                - NET_RAW
+          volumeMounts:
+            - name: blackbox-exporter-config
+              mountPath: /etc/blackbox_exporter/
+          readinessProbe:
+            httpGet:
+              path: /-/healthy
+              port: 9115
+            initialDelaySeconds: 5
+            periodSeconds: 15
+          livenessProbe:
+            httpGet:
+              path: /-/healthy
+              port: 9115
+            initialDelaySeconds: 15
+            periodSeconds: 20
+          resources:
+            requests:
+              memory: '32Mi'
+              cpu: '25m'
+      volumes:
+        - name: blackbox-exporter-config
+          configMap:
+            name: blackbox-exporter-config
+
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: blackbox-exporter
+  labels:
+    app: blackbox-exporter
+spec:
+  ports:
+    - port: 9115
+      targetPort: 9115
+      protocol: TCP
+      name: http
+  selector:
+    app: blackbox-exporter
+  type: ClusterIP

package/manifests/cronjobs/dd-cron/dd-cron-backup.yaml

@@ -27,26 +27,51 @@ spec:
         spec:
           containers:
             - name: dd-cron-backup
-              image: underpost/underpost-engine:v3.3.0
+              image: underpost/underpost-engine:v3.3.76
               command:
                 - /bin/sh
                 - -c
                 - >
                   cd /home/dd/engine &&
-                  node bin env dd-cron production &&
                   node bin cron dd-lampp,dd-cyberia,dd-core,dd-prototype,dd-test backup --git --kubeadm 
+              # Explicit, so the environment the pod runs is the one this manifest resolved:
+              # a container env entry wins over envFrom, whatever the projected Secret carries.
+              env:
+                - name: NODE_ENV
+                  value: production
+              envFrom:
+                - secretRef:
+                    name: underpost-cron-env
+                    optional: true
               volumeMounts:
                 - mountPath: /home/dd/engine
                   name: underpost-cron-container-volume
-                - mountPath: /usr/lib/node_modules/underpost
-                  name: underpost-share-env
+                - mountPath: /var/lib/node_exporter/textfile
+                  name: underpost-node-exporter-textfile
+                - mountPath: /etc/underpost/secrets/ssh
+                  name: underpost-ssh-key
+                  readOnly: true
           volumes:
+            # The engine mirror: a copy of the checkout kept outside every home tree, because
+            # `container_t` is denied every read under one. The job body runs this repository's CLI
+            # (`node bin ...`), so it needs the source tree, its node_modules and engine-private's
+            # deploy configuration — the mount cannot be narrowed below that. Refreshed and labeled
+            # by prepareCronHostStorage(); see src/server/ops/cron.js's module header.
             - hostPath:
-                path: /home/dd/engine
+                path: /opt/engine
                 type: Directory
               name: underpost-cron-container-volume
+            # Metrics the cluster cannot scrape for itself are written here and read by the
+            # node-exporter collector. Prepared and labeled by prepareCronHostStorage().
             - hostPath:
-                path: /root/.nvm/versions/node/v24.15.0/lib/node_modules/underpost
+                path: /var/lib/node_exporter/textfile
                 type: DirectoryOrCreate
-              name: underpost-share-env
+              name: underpost-node-exporter-textfile
+            # Optional for the same reason the credential Secret is: a cluster that has onboarded
+            # no key still schedules, and the job that needs one reports its own failure.
+            - secret:
+                secretName: underpost-ssh-key
+                optional: true
+                defaultMode: 0400
+              name: underpost-ssh-key
           restartPolicy: OnFailure

package/manifests/cronjobs/dd-cron/dd-cron-vultr.yaml

@@ -27,26 +27,51 @@ spec:
         spec:
           containers:
             - name: dd-cron-vultr
-              image: underpost/underpost-engine:v3.3.0
+              image: underpost/underpost-engine:v3.3.76
               command:
                 - /bin/sh
                 - -c
                 - >
                   cd /home/dd/engine &&
-                  node bin env dd-cron production &&
                   node bin cron dd-cron vultr --git --kubeadm 
+              # Explicit, so the environment the pod runs is the one this manifest resolved:
+              # a container env entry wins over envFrom, whatever the projected Secret carries.
+              env:
+                - name: NODE_ENV
+                  value: production
+              envFrom:
+                - secretRef:
+                    name: underpost-cron-env
+                    optional: true
               volumeMounts:
                 - mountPath: /home/dd/engine
                   name: underpost-cron-container-volume
-                - mountPath: /usr/lib/node_modules/underpost
-                  name: underpost-share-env
+                - mountPath: /var/lib/node_exporter/textfile
+                  name: underpost-node-exporter-textfile
+                - mountPath: /etc/underpost/secrets/ssh
+                  name: underpost-ssh-key
+                  readOnly: true
           volumes:
+            # The engine mirror: a copy of the checkout kept outside every home tree, because
+            # `container_t` is denied every read under one. The job body runs this repository's CLI
+            # (`node bin ...`), so it needs the source tree, its node_modules and engine-private's
+            # deploy configuration — the mount cannot be narrowed below that. Refreshed and labeled
+            # by prepareCronHostStorage(); see src/server/ops/cron.js's module header.
             - hostPath:
-                path: /home/dd/engine
+                path: /opt/engine
                 type: Directory
               name: underpost-cron-container-volume
+            # Metrics the cluster cannot scrape for itself are written here and read by the
+            # node-exporter collector. Prepared and labeled by prepareCronHostStorage().
             - hostPath:
-                path: /root/.nvm/versions/node/v24.15.0/lib/node_modules/underpost
+                path: /var/lib/node_exporter/textfile
                 type: DirectoryOrCreate
-              name: underpost-share-env
+              name: underpost-node-exporter-textfile
+            # Optional for the same reason the credential Secret is: a cluster that has onboarded
+            # no key still schedules, and the job that needs one reports its own failure.
+            - secret:
+                secretName: underpost-ssh-key
+                optional: true
+                defaultMode: 0400
+              name: underpost-ssh-key
           restartPolicy: OnFailure

package/manifests/deployment/dd-cyberia-development/deployment.yaml

@@ -20,11 +20,17 @@ spec:
     spec:
       containers:
         - name: dd-cyberia-development-blue
-          image: underpost/underpost-engine:v3.3.0
+          image: underpost/underpost-engine:v3.3.76
           imagePullPolicy: IfNotPresent
           envFrom:
             - secretRef:
                 name: underpost-config
+            # The deployment's own environment, with its .env.<env>.oci overlay already
+            # applied by 'app apply'. Optional so a deployment predating that Secret still
+            # starts; the in-pod 'app load' resolves the same overlay as a second path.
+            - secretRef:
+                name: dd-cyberia-development-env
+                optional: true
           env:
             - name: UNDERPOST_INTERNAL_PORT
               value: "4004"
@@ -33,7 +39,6 @@ spec:
             - /bin/sh
             - -c
             - >
-              underpost secret underpost --create-from-env &&
               underpost start --build --run dd-cyberia development
           readinessProbe:
             {

package/manifests/deployment/dd-default-development/deployment.yaml

@@ -17,7 +17,7 @@ spec:
     spec:
       containers:
         - name: dd-default-development-blue
-          image: underpost/underpost-engine:v3.3.0
+          image: underpost/underpost-engine:v3.3.76
           #          resources:
           #            requests:
           #              memory: "124Ki"
@@ -98,7 +98,7 @@ spec:
     spec:
       containers:
         - name: dd-default-development-green
-          image: underpost/underpost-engine:v3.3.0
+          image: underpost/underpost-engine:v3.3.76
           #          resources:
           #            requests:
           #              memory: "124Ki"