@underpostnet/cyberia 3.3.73 → 3.3.76

package/src/cli/run.js

@@ -28,10 +28,10 @@ import {
   instancePortFactory,
   instanceProxyRoutesFactory,
   instanceStatusPageEntriesFactory,
+  instanceProjectPathFactory,
   loadConfInstances,
   loadProjectInstanceEnvBuilder,
   loadConfServerJson,
-  loadReplicas,
   resolveEnvScoped,
   selectConfInstances,
   waitForPort,
@@ -49,6 +49,7 @@ import {
   trafficFromRoutingInfoFactory,
 } from '../server/runtime/conf.js';
 import { buildKindPorts, deployRoutesExists, readDeployRoutes, resolveDeployList } from '../server/network/router.js';
+import { clientBundleHostFilter, pullClientBundle, pushClientBundle } from '../client-builder/client-bundle.js';
 import { cronDeployIdResolve } from '../server/ops/cron.js';
 import { deployEnvFactory, getNpmRootPath, writeEnv } from '../server/runtime/environment.js';
 import { actionInitLog, loggerFactory } from '../server/ops/logger.js';
@@ -62,6 +63,7 @@ import { domainContextFactory } from './domains.js';
 import Underpost from '../index.js';
 import dotenv from 'dotenv';
 import { MongoBootstrap } from '../db/mongo/MongoBootstrap.js';
+import { MongoExpress } from '../db/mongo/MongoExpress.js';
 import {
   UNDERPOST_GATEWAY,
   assertStaticAssets,
@@ -140,6 +142,7 @@ const logger = loggerFactory(import.meta);
  * @property {boolean} kind - Whether to run in kind mode.
  * @property {boolean} k3s - Whether to run in k3s mode.
  * @property {string} hosts - The hosts to use.
+ * @property {string} split - Zip part size in MB for push-bundle, or 'none' to upload a single zip.
  * @property {string} deployId - The deployment ID.
  * @property {string} instanceId - The instance ID.
  * @property {string} user - The user to run as.
@@ -238,6 +241,7 @@ const DEFAULT_OPTION = {
   kind: false,
   k3s: false,
   hosts: '',
+  split: '',
   deployId: '',
   instanceId: '',
   user: '',
@@ -2267,19 +2271,25 @@ EOF
      * If `--build` is supplied the image is built from the project Dockerfile and loaded into the
      * cluster before the manifest is written (kind by default; `--kubeadm` / `--k3s` override).
      *
-     * @param {string} path - Comma-separated: `deployId,instanceId[,projectPath]`.
-     *   `projectPath` is the root directory that contains the `Dockerfile` (e.g. `./cyberia-client`).
-     *   Artifacts are written to `<projectPath>/manifests/<env>/Dockerfile` and
-     *   `<projectPath>/manifests/<env>/deployment.yaml`.
-     *   In production, files are also copied to `<projectPath>/Dockerfile` and
-     *   `<projectPath>/deployment.yaml`.
+     * The target is named by `--deploy-id` and `--instance-id`, like every other instance runner.
+     * Where the artifacts land is not an argument: an instance's project directory is derived from
+     * the conf entry itself (see {@link instanceProjectPathFactory}), so the caller cannot pair an
+     * instance with someone else's checkout. Artifacts are written to
+     * `<project>/manifests/deployments/<instance>-<env>/`, and in production the pair is also
+     * copied to `<project>/Dockerfile` and `<project>/deployment.yaml`.
+     *
+     * @param {string} path - Unused; the target comes from `--deploy-id` and `--instance-id`.
      * @param {UnderpostRunDefaultOptions} options - The default underpost runner options for customizing workflow
      * @memberof UnderpostRun
      */
     'instance-build-manifest': async (path, options = DEFAULT_OPTION) => {
       const env = options.dev ? 'development' : 'production';
-      let [deployId, id, projectPath] = path.split(',');
-      const rootPath = projectPath ? projectPath : '.';
+      const deployId = options.deployId;
+      const id = options.instanceId;
+      if (!deployId || !id) {
+        logger.error('[instance-build-manifest] --deploy-id and --instance-id are required');
+        return;
+      }
 
       const confInstances = loadConfInstances(deployId);
       // Targeting a template id builds every world in the family. The fan-out
@@ -2297,20 +2307,23 @@ EOF
       }
       if (!options.instanceOnly && (selected.length > 1 || selected[0].id !== id)) {
         for (const instance of selected)
-          await UnderpostRun.RUNNERS['instance-build-manifest'](
-            [deployId, instance.id, projectPath].filter((v) => v !== undefined).join(','),
-            { ...options, instanceOnly: true },
-          );
+          await UnderpostRun.RUNNERS['instance-build-manifest']('', {
+            ...options,
+            instanceId: instance.id,
+            instanceOnly: true,
+          });
         return;
       }
 
+      const instance = selected[0];
+      // The conf names the project: its repository, else its runtime, else its id. A world and the
+      // checkout it publishes to cannot disagree, because only one of them is stated.
+      const rootPath = instanceProjectPathFactory(instance);
       const envManifestPath = `${rootPath}/manifests/deployments/${id}-${env}`;
       const outputPath = `${envManifestPath}/deployment.yaml`;
       const dockerfileManifestPath = `${envManifestPath}/Dockerfile`;
 
       fs.mkdirpSync(envManifestPath);
-
-      const instance = selected[0];
       const isDefaultInstance = instance.id === instance.templateId || !instance.templateId;
       const instanceEnvBuilder = await loadProjectInstanceEnvBuilder(deployId);
 
@@ -2357,14 +2370,15 @@ EOF
       const _fromPort = instancePortFactory({ instance, env });
       const _toPort = instancePortFactory({ instance, env, container: true });
 
-      // Build image from projectPath Dockerfile and load into cluster when --build is set.
-      if (options.build && projectPath) {
+      // Build the image from the project's own Dockerfile and load it into the cluster when
+      // --build is set.
+      if (options.build) {
         const isKind = !options.kubeadm && !options.k3s;
         Underpost.image.build({
-          path: projectPath,
+          path: rootPath,
           imageName: _image,
           podmanSave: true,
-          imageOutPath: projectPath,
+          imageOutPath: rootPath,
           kind: isKind,
           kubeadm: !!options.kubeadm,
           k3s: !!options.k3s,
@@ -2484,12 +2498,11 @@ EOF
       // a rewrite never points at a document that cannot exist. The check is a
       // read: placing the document into the gateway volume is `deploy
       // --sync-static`'s job at apply time, and a build must not mutate the host.
-      // `projectPath` is passed through because this runner is given one
-      // explicitly; the sync derives the same root from the instance itself.
-      const statusPageEntries = instanceStatusPageEntriesFactory({
-        instances: [instance],
-        projectPath: rootPath,
-      }).filter((entry) => fs.existsSync(entry.sourcePath));
+      // No project override: this runner and the sync now derive the root from the same instance
+      // by the same rule, so passing one here could only make them disagree.
+      const statusPageEntries = instanceStatusPageEntriesFactory({ instances: [instance] }).filter((entry) =>
+        fs.existsSync(entry.sourcePath),
+      );
 
       // httproute.yaml — this instance's own routes, including the status routes
       // that reach the static utility instead of this workload. No Gateway is
@@ -3066,7 +3079,7 @@ EOF`);
         const hostListenResult = etcHostFactory(hosts);
         logger.info(hostListenResult.renderHosts);
       }
-      const version = 'v3.3.73';
+      const version = 'v3.3.76';
       const instanceOptionsFactory = (deployId, instanceId) => ({
         ...options,
         ...clusterContextFactory(clusterType),
@@ -3850,9 +3863,9 @@ EOF`);
       );
       switch (serviceId) {
         case 'mongo-express-service': {
-          shellExec(`kubectl delete svc mongo-express-service -n ${options.namespace} --ignore-not-found`);
-          shellExec(`kubectl delete deployment mongo-express -n ${options.namespace} --ignore-not-found`);
-          shellExec(`kubectl apply -f manifests/deployment/mongo-express/deployment.yaml -n ${options.namespace}`);
+          // One deploy path for the client, shared with `cluster --mongo-express`: the secret,
+          // the auth-mode overlay selection and the readiness wait live there.
+          await MongoExpress.deploy({ namespace: options.namespace, options });
           podToMonitor = 'mongo-express';
           break;
         }
@@ -4398,186 +4411,47 @@ EOF`;
 
     /**
      * @method push-bundle
-     * @description Builds the client zip for the specified deployment, splits it into parts, and uploads to file storage.
-     *   Steps: set env, build+split zip, upload only the zip parts belonging to the deploy-id's hosts (from conf.server.json).
-     *   Only files matching `<host>-<route>.zip.part*` or `<host>-<route>.zip` for each non-skipped route are uploaded.
-     * @param {string} path - Optional `fsPath.splitOption` string.
-     *   Examples: `build` (default split 8), `build.16` (split 16 MB), `build.none-split` (no split flag).
+     * @description Builds the deployment's client bundles and uploads them to file storage.
+     *   Steps: set env, build and split the zips, then upload each resolved route's artifacts
+     *   under the deployment's `storage.bundle.json`. Routes the client build skips — redirects,
+     *   rebuild-disabled routes, and `singleReplica` routes that carry their own deploy id —
+     *   produce no bundle and are not pushed.
+     * @param {string} path - Optional comma-separated host filter (e.g. 'a.com' or 'a.com,b.com').
+     *   Empty selects every host in `engine-private/conf/<deployId>/conf.server.json`.
      * @param {UnderpostRunDefaultOptions} options - The default underpost runner options for customizing workflow.
-     * @param {string} [options.deployId] - Override deploy ID.
+     * @param {string} [options.deployId] - Deploy ID for storage lookup (defaults to 'dd-default').
+     * @param {string} [options.split] - Zip part size in MB, or 'none' to upload one zip. Defaults to 8.
      * @param {boolean} [options.dev] - Use development environment; defaults to production.
      * @memberof UnderpostRun
      */
-    'push-bundle': (path = '', options = DEFAULT_OPTION) => {
-      const baseCommand = cli('underpost', { local: true });
-      const env = options.dev ? 'development' : 'production';
-      const deployId = options.deployId || 'dd-default';
-      const pathParts = (path || '').split('.');
-      const fsPath = (pathParts[0] || '').trim() || 'build';
-      const splitOption = (pathParts[1] || '').trim();
-
-      let splitFlag = '--split 8';
-      if (splitOption) {
-        if (splitOption === 'none-split') {
-          splitFlag = '';
-        } else {
-          const splitMb = Number(splitOption);
-          if (Number.isFinite(splitMb) && splitMb > 0) {
-            splitFlag = `--split ${splitMb}`;
-          } else {
-            logger.warn('push-bundle: invalid split option, using default split 8', {
-              path,
-              splitOption,
-            });
-          }
-        }
-      }
-
-      const confServerPath = `./engine-private/conf/${deployId}/conf.server.json`;
-      const confServer = fs.existsSync(confServerPath)
-        ? loadReplicas(deployId, loadConfServerJson(confServerPath))
-        : {};
-      const storageFilePath = `engine-private/conf/${deployId}/storage.bundle.json`;
-
-      shellExec(`${baseCommand} env ${deployId} ${env}`);
-      shellExec(`${baseCommand} client ${deployId} --env ${env} --build-zip${splitFlag ? ` ${splitFlag}` : ''}`);
-
-      const pushBundleFiles = (host, routePath) => {
-        const buildId = `${host}-${routePath.replaceAll('/', '')}`;
-        const buildDir = `./${fsPath}`;
-        if (!fs.existsSync(buildDir)) return;
-        const partFiles = fs
-          .readdirSync(buildDir)
-          .filter(
-            (name) =>
-              name.startsWith(`${buildId}.zip.part`) ||
-              name.startsWith(`${buildId}.zip-part`) ||
-              name === `${buildId}.zip`,
-          )
-          .map((name) => `${fsPath}/${name}`);
-        if (partFiles.length === 0) {
-          logger.warn(`push-bundle: no bundle files found for '${host}${routePath}'`, { buildId });
-          return;
-        }
-        for (const partFile of partFiles) {
-          shellExec(
-            `${baseCommand} fs ${partFile} --deploy-id ${deployId} --storage-file-path ${storageFilePath} --force`,
-          );
-        }
-      };
-
-      for (const host of Object.keys(confServer)) {
-        for (const routePath of Object.keys(confServer[host])) {
-          const routeConf = confServer[host][routePath] || {};
-          if (routeConf.redirect || routeConf.disabledRebuild) continue;
-          if (routeConf.singleReplica) {
-            if (routeConf.replicas) {
-              for (const replica of routeConf.replicas) {
-                pushBundleFiles(host, replica);
-              }
-            }
-            continue;
-          }
-          pushBundleFiles(host, routePath);
-        }
-      }
-    },
+    'push-bundle': (path = '', options = DEFAULT_OPTION) =>
+      pushClientBundle({
+        deployId: options.deployId || 'dd-default',
+        hosts: clientBundleHostFilter(path),
+        split: options.split,
+        dev: options.dev,
+      }),
 
     /**
      * @method pull-bundle
-     * @description Downloads split zip parts from file storage, merges and extracts them, and moves the result into the public directory.
-     *   Steps: set env, download parts (omit-unzip), merge zip, unzip, remove zip + parts, move to public/<host>[/path].
-     *   Iterates over every non-singleReplica, non-redirect, non-disabledRebuild route in conf.server.json
-     *   so that multi-path deployments are handled correctly.
-     * @param {string} path - Optional comma-separated host name(s) to restrict processing (e.g. 'underpost.net' or 'a.com,b.com').
-     *   If omitted, all hosts from `engine-private/conf/<deployId>/conf.server.json` are used.
+     * @description Downloads the deployment's client bundles from file storage and installs them
+     *   into the served public directory.
+     *   Steps: set env, download the parts, merge and extract each resolved route's zip, then
+     *   replace `public/<host>[<route>]` with the extracted tree. Route selection matches
+     *   push-bundle, so the two directions always address the same set of bundles.
+     * @param {string} path - Optional comma-separated host filter (e.g. 'a.com' or 'a.com,b.com').
+     *   Empty selects every host in `engine-private/conf/<deployId>/conf.server.json`.
      * @param {UnderpostRunDefaultOptions} options - The default underpost runner options for customizing workflow.
      * @param {string} [options.deployId] - Deploy ID for storage lookup (defaults to 'dd-default').
      * @param {boolean} [options.dev] - Use development environment; defaults to production.
      * @memberof UnderpostRun
      */
-    'pull-bundle': (path = '', options = DEFAULT_OPTION) => {
-      const baseCommand = cli('underpost', { local: true });
-      const env = options.dev ? 'development' : 'production';
-      const deployId = options.deployId || 'dd-default';
-      const confServerPath = `./engine-private/conf/${deployId}/conf.server.json`;
-      const confServer = fs.existsSync(confServerPath)
-        ? loadReplicas(deployId, loadConfServerJson(confServerPath))
-        : {};
-      const hostsArg = path
-        ? path
-            .split(',')
-            .map((h) => h.trim())
-            .filter(Boolean)
-        : Object.keys(confServer);
-
-      if (hostsArg.length === 0) {
-        logger.error('pull-bundle: no hosts resolved', { deployId, path, confServerPath });
-        return;
-      }
-
-      shellExec(`${baseCommand} env ${deployId} ${env}`);
-      if (!fs.existsSync('./build')) fs.mkdirSync('./build', { recursive: true });
-      shellExec(
-        `${baseCommand} fs build --recursive --deploy-id ${deployId} --storage-file-path engine-private/conf/${deployId}/storage.bundle.json --pull --omit-unzip`,
-      );
-
-      const pullBundleRoute = (host, routePath) => {
-        const buildId = `${host}-${routePath.replaceAll('/', '')}`;
-        const zipPath = `build/${buildId}.zip`;
-        const buildDir = './build';
-        const hasZip = fs.existsSync(zipPath);
-        const hasParts =
-          fs.existsSync(buildDir) &&
-          fs
-            .readdirSync(buildDir)
-            .some((name) => name.startsWith(`${buildId}.zip.part`) || name.startsWith(`${buildId}.zip-part`));
-
-        if (!hasZip && !hasParts) {
-          logger.warn(`Bundle not found for '${host}${routePath}'. Skipping.`, { zipPath, deployId });
-          return;
-        }
-
-        if (hasParts) shellExec(`${baseCommand} client --merge-zip ${zipPath}`);
-        shellExec(`${baseCommand} client --unzip ${zipPath}`);
-        shellExec(`sudo rm -rf ${zipPath}`);
-
-        if (fs.existsSync(buildDir)) {
-          fs.readdirSync(buildDir)
-            .filter((name) => name.startsWith(`${buildId}.zip.part`) || name.startsWith(`${buildId}.zip-part`))
-            .forEach((partFile) => shellExec(`sudo rm -rf ${buildDir}/${partFile}`));
-        }
-
-        const extractedDir = `build/${buildId.replace(/-$/, '')}`;
-        if (!fs.existsSync(extractedDir)) {
-          logger.warn(`Extracted build dir not found: ${extractedDir}. Skipping move for '${host}${routePath}'.`);
-          return;
-        }
-
-        const publicDestPath = routePath === '/' ? `public/${host}` : `public/${host}${routePath}`;
-        if (fs.existsSync(publicDestPath)) shellExec(`sudo rm -rf ${publicDestPath}`);
-        if (routePath !== '/') shellExec(`sudo mkdir -p public/${host}`);
-        fs.copySync(`${extractedDir}`, `${publicDestPath}`);
-      };
-
-      for (const host of hostsArg) {
-        const routePaths = confServer[host] ? Object.keys(confServer[host]) : ['/'];
-
-        for (const routePath of routePaths) {
-          const routeConf = confServer[host] ? confServer[host][routePath] || {} : {};
-          if (routeConf.redirect || routeConf.disabledRebuild) continue;
-          if (routeConf.singleReplica) {
-            if (routeConf.replicas) {
-              for (const replica of routeConf.replicas) {
-                pullBundleRoute(host, replica);
-              }
-            }
-            continue;
-          }
-          pullBundleRoute(host, routePath);
-        }
-      }
-    },
+    'pull-bundle': async (path = '', options = DEFAULT_OPTION) =>
+      await pullClientBundle({
+        deployId: options.deployId || 'dd-default',
+        hosts: clientBundleHostFilter(path),
+        dev: options.dev,
+      }),
 
     /**
      * @method kubeadm-wireguard

package/src/cli/test.js

@@ -19,6 +19,7 @@ import { shellExec } from '../server/runtime/process.js';
 import {
   UNDERPOST_TESTING,
   allureManifestsFactory,
+  coverageReportKey,
   resolveTestSelection,
   testJobManifestFactory,
   vitestArgsFactory,
@@ -82,6 +83,9 @@ class UnderpostTest {
           'NODE_ENV=test',
           ...(allureResultsDirectory ? [`${UNDERPOST_TESTING.allureResultsEnvKey}=${allureResultsDirectory}`] : []),
         ];
+        // Only this selection's report starts from nothing: the ones beside it belong to
+        // other selections a deploy on this host may publish.
+        if (coverage) fs.removeSync(`${root}/${UNDERPOST_TESTING.coverageDirectory}/${coverageReportKey(suite)}`);
         shellExec(
           `cd ${root} && ${env.join(' ')} npx vitest ${vitestArgsFactory({ projects, grep, watch, coverage }).join(' ')}`,
         );

package/src/cli/wireguard.js

@@ -95,42 +95,27 @@ const EVENT_SERVICE_UNIT_PATH = '/etc/systemd/system/underpost-event.service';
 
 /**
  * @constant ENGINE_SYNC_STEPS
- * @description What bringing one node's checkout up to date consists of.
+ * @description Sequence of steps to bring a node's checkout up to date.
  *
- * The deploy's package script runs twice, and that is the shape of the whole sequence: every
- * step between them is the node's own CLI, which cannot load from a checkout whose installed
- * packages no longer match its manifest — so the first run repairs the tree it finds, and the
- * second installs the manifest the switch just landed. The first is advisory because a node
- * whose tree predates that script must still reach the switch that gives it one.
+ * The sync runs the node's own CLI, bracketed by two critical installs:
  *
- * The switch moves the node between package scopes, and everything the node runs off that scope
- * has to follow it, or the sync leaves the node running the previous one:
- * - the repository pair is written into the node's host configuration, because that store is the
- *   only place `deploy/lib/host.sh` reads the source a later `prepare_host` pulls from. Without
- *   it that preparation resolves the default pairing and undoes the switch.
- * - the cluster's CronJob manifests are regenerated and republished, because their pod bodies run
- *   the checkout that just changed.
- * - the supervised services are reconciled through their own generators, on the unit file's
- *   existence rather than on the unit being active: one the previous scope's tree left dead is
- *   exactly the one that has to come back, and `is-active` skipped precisely that case.
+ * 1. **Bootstrap Install:** Restores the original `package.json` from git and installs it.
+ *    This ensures the CLI remains runnable with the current code tree before any changes are applied.
+ * 2. **Deploy Install:** Installs the deploy's `package.json` and links the CLI. This happens
+ *    after both the configuration and source code switches have landed.
  *
- * All of those are scoped to the role of the node reached — see {@link NODE_ROLE_STEPS}.
- *
- * A step whose placeholder resolves to nothing is dropped rather than run empty: a monorepo sync
- * belongs to no deploy, a deploy that ships no package script has nothing to run, and a run
- * without a token must not overwrite the node's with a blank.
  * @memberof UnderpostWireguard
  */
 const ENGINE_SYNC_STEPS = [
-  { command: 'bash <deploy-package-script>', halt: false },
+  { command: 'git checkout -- package.json; npm install', halt: false },
   { command: 'node bin host set GITHUB_TOKEN <github-token>' },
-  { command: 'underpost run clean', halt: true },
-  { command: 'underpost cmt --switch-repo <engine> --target-branch <engine-branch>', halt: true },
+  { command: 'node bin run clean', halt: true },
   {
-    command: 'underpost cmt ./engine-private --switch-repo <engine-private> --target-branch <engine-private-branch>',
+    command: 'node bin cmt ./engine-private --switch-repo <engine-private> --target-branch <engine-private-branch>',
     halt: true,
   },
-  { command: 'bash <deploy-package-script>', halt: true },
+  { command: 'node bin cmt --switch-repo <engine> --target-branch <engine-branch>', halt: true },
+  { command: '<package-install-command>', halt: true },
   { command: 'node bin host set ENGINE_SRC_REPO <engine>', halt: true },
   { command: 'node bin host set ENGINE_SRC_PRIVATE_REPO <engine-private>', halt: true },
   { command: '<cron-reconcile-command>', halt: false },
@@ -159,10 +144,9 @@ const deployIdFactory = (deployId) => {
  * being synced actually ships one.
  *
  * Both halves have to hold. A monorepo sync belongs to no deploy, and a deploy that ships no
- * script of its own would leave the node running `bash` against a path that does not exist —
- * which the second, halting occurrence turns into a failed sync rather than a missing install.
- * The check reads this checkout because it is the tree the node lands on once the switch
- * completes, which is the only tree whose contents the step can be resolved against.
+ * script of its own would leave the node running `bash` against a path that does not exist. The
+ * check reads this checkout because it is the tree the node lands on once the switch completes,
+ * which is the only tree whose contents the step can be resolved against.
  * @param {string} engine - Engine source repository the node is switched onto.
  * @returns {string} Path to that deploy's package script, or `''` when there is none to run.
  * @memberof UnderpostWireguard
@@ -173,6 +157,23 @@ const deployPackageScriptFactory = (engine = '') => {
   return path && fs.existsSync(path) ? path : '';
 };
 
+/**
+ * @method packageInstallCommandFactory
+ * @description How a node installs against the source a switch just landed.
+ *
+ * A deploy's own script is preferred because it installs that deploy's manifest and links the
+ * CLI. Where there is none — a monorepo sync, or a deploy that ships no script — the checkout's
+ * own manifest is installed instead, so the step is never dropped: every sync replaces the
+ * source, and source the installed packages predate is what breaks the next command.
+ * @param {string} engine - Engine source repository the node is switched onto.
+ * @returns {string} The install command for that source.
+ * @memberof UnderpostWireguard
+ */
+const packageInstallCommandFactory = (engine = '') => {
+  const packageScript = deployPackageScriptFactory(engine);
+  return packageScript ? `bash ${packageScript}` : 'npm install';
+};
+
 /**
  * @method deployListFactory
  * @description The deploys whose hostnames a run publishes.
@@ -2666,7 +2667,7 @@ class UnderpostWireguard {
         '<engine-private>': enginePrivate,
         '<engine-branch>': Underpost.repo.getDefaultBranch(engine),
         '<engine>': engine,
-        '<deploy-package-script>': deployPackageScriptFactory(engine),
+        '<package-install-command>': packageInstallCommandFactory(engine),
         ...nodeRoleStepsFactory(options.nodeRole),
         '<github-token>': process.env.GITHUB_TOKEN || '',
       };