@underpostnet/cyberia 3.3.73 → 3.3.77

package/src/client-builder/client-bundle.js

@@ -0,0 +1,347 @@
+/**
+ * Client bundle transport: enumerates the zip artifacts a deployment's routes build, uploads
+ * them to file storage, and restores them into the served public directory.
+ *
+ * Push and pull are two directions of one contract, so both resolve their routes, bundle ids,
+ * storage keys and part files through the helpers here rather than re-deriving them. Route
+ * selection mirrors {@link buildClient}: a route that the build skips produces no artifact for
+ * either direction to carry.
+ * @module src/client-builder/client-bundle.js
+ * @namespace clientBundle
+ */
+
+import fs from 'fs-extra';
+import UnderpostFileStorage from '../cli/fs.js';
+import * as dir from 'path';
+import { cli } from '../server/build/execution.js';
+import { loadConfServerJson, loadReplicas } from '../server/runtime/conf.js';
+import { loggerFactory } from '../server/ops/logger.js';
+import { shellArgumentFactory, shellExec } from '../server/runtime/process.js';
+import { clientBundleIdFactory, getZipPartPaths, mergeClientBuildZip, unzipClientBuild } from './client-build.js';
+
+const logger = loggerFactory(import.meta);
+
+/** @type {string} Directory `buildClient --build-zip` writes bundles to, and the only place push and pull look. */
+const CLIENT_BUNDLE_DIRECTORY = './build';
+
+/** @type {number} Part size in MB applied when the caller names none. */
+const DEFAULT_SPLIT_MB = 8;
+
+/** @type {string} `--split` value that turns splitting off. */
+const SPLIT_DISABLED = 'none';
+
+const CLIENT_BUNDLE_STORAGE_ID = 'bundle';
+
+/**
+ * Resolves the conf.server path a deployment's routes are read from.
+ * @function clientBundleConfServerPath
+ * @param {string} deployId - The deployment identifier.
+ * @returns {string} Path to the deployment's `conf.server.json`.
+ * @memberof clientBundle
+ */
+const clientBundleConfServerPath = (deployId) => `./engine-private/conf/${deployId}/conf.server.json`;
+
+/**
+ * Resolves the storage manifest that tracks a deployment's uploaded bundle parts. Push writes
+ * it and pull reads it, so both must name the same file.
+ * @function clientBundleStorageFilePath
+ * @param {string} deployId - The deployment identifier.
+ * @returns {string} Path to the deployment's bundle storage manifest.
+ * @memberof clientBundle
+ */
+const clientBundleStorageFilePath = (deployId) =>
+  UnderpostFileStorage.API.resolveManifest({ deployId, storageId: CLIENT_BUNDLE_STORAGE_ID });
+
+/**
+ * Parses the comma-separated host filter both runners accept as their positional argument.
+ * @function clientBundleHostFilter
+ * @param {string} [hosts] - Comma-separated host names, or empty for every host.
+ * @returns {string[]} The requested hosts, empty when no filter was given.
+ * @memberof clientBundle
+ */
+const clientBundleHostFilter = (hosts = '') =>
+  `${hosts ?? ''}`
+    .split(',')
+    .map((host) => host.trim())
+    .filter(Boolean);
+
+/**
+ * Resolves the `--split` option into the flag `underpost client` expects.
+ * @function clientBundleSplitFlag
+ * @param {string|number} [split] - Part size in MB, or `none` to disable splitting.
+ * @returns {string} The flag to append, empty when splitting is disabled.
+ * @memberof clientBundle
+ */
+const clientBundleSplitFlag = (split) => {
+  const requested = `${split ?? ''}`.trim();
+  if (!requested) return `--split ${DEFAULT_SPLIT_MB}`;
+  if (requested === SPLIT_DISABLED) return '';
+
+  const splitMb = Number(requested);
+  if (Number.isFinite(splitMb) && splitMb > 0) return `--split ${splitMb}`;
+
+  logger.warn('invalid split option, falling back to the default', { split: requested, default: DEFAULT_SPLIT_MB });
+  return `--split ${DEFAULT_SPLIT_MB}`;
+};
+
+/**
+ * Enumerates the bundles a deployment's routes build to.
+ *
+ * A route is skipped exactly where {@link buildClient} skips it — redirects and
+ * rebuild-disabled routes emit nothing, and a `singleReplica` route's replicas are built under
+ * their own deploy ids, so they carry their own manifests rather than the parent's.
+ * @function clientBundleEntriesFactory
+ * @param {object} options
+ * @param {string} options.deployId - The deployment identifier.
+ * @param {string[]} [options.hosts] - Optional host filter; empty selects every configured host.
+ * @returns {Array<{host: string, routePath: string, buildId: string, zipPath: string, publicPath: string}>}
+ *   One entry per bundle, in configuration order.
+ * @memberof clientBundle
+ */
+const clientBundleEntriesFactory = ({ deployId, hosts = [] }) => {
+  const confServerPath = clientBundleConfServerPath(deployId);
+  if (!fs.existsSync(confServerPath)) {
+    logger.warn('conf.server not found', { deployId, confServerPath });
+    return [];
+  }
+
+  const confServer = loadReplicas(deployId, loadConfServerJson(confServerPath));
+  const selectedHosts = hosts.length > 0 ? hosts : Object.keys(confServer);
+
+  return selectedHosts.flatMap((host) => {
+    if (!confServer[host]) {
+      logger.warn('host not present in conf.server', { deployId, host });
+      return [];
+    }
+    return Object.keys(confServer[host])
+      .filter((routePath) => {
+        const { redirect, disabledRebuild, singleReplica } = confServer[host][routePath] ?? {};
+        return !redirect && !disabledRebuild && !singleReplica;
+      })
+      .map((routePath) => {
+        const buildId = clientBundleIdFactory(host, routePath);
+        return {
+          host,
+          routePath,
+          buildId,
+          zipPath: `${CLIENT_BUNDLE_DIRECTORY}/${buildId}.zip`,
+          publicPath: routePath === '/' ? `public/${host}` : `public/${host}${routePath}`,
+        };
+      });
+  });
+};
+
+/**
+ * Reads the storage manifest as a plain lookup, for the recorded size of each uploaded artifact.
+ * Read-only and tolerant: a manifest that is absent or unreadable disables verification rather
+ * than failing the pull, since the artifacts themselves are still what the bundle is made of.
+ * @function clientBundleManifestFactory
+ * @param {string} deployId - The deployment identifier.
+ * @returns {Object<string, {bytes?: number}>} The tracked entries, empty when unavailable.
+ * @memberof clientBundle
+ */
+const clientBundleManifestFactory = (deployId) => {
+  const manifestPath = clientBundleStorageFilePath(deployId);
+  try {
+    return UnderpostFileStorage.API.readManifest({ deployId, storageId: CLIENT_BUNDLE_STORAGE_ID }).storage;
+  } catch (error) {
+    logger.warn('bundle manifest unreadable, size verification skipped', { manifestPath, error: error?.message });
+    return {};
+  }
+};
+
+/**
+ * The tracked keys that belong to one bundle.
+ *
+ * A bundle owns its zip and every split part of it, and nothing else: the id already carries the
+ * route, so `underpost.net-` and `underpost.net-peer` cannot claim each other's parts.
+ * @function clientBundleTrackedKeys
+ * @param {object} manifest - The bundle storage manifest.
+ * @param {string} buildId - The bundle's build id.
+ * @returns {string[]} The manifest keys for that bundle.
+ * @memberof clientBundle
+ */
+const clientBundleTrackedKeys = (manifest, buildId) =>
+  Object.keys(manifest).filter((key) =>
+    key.replace(/^\.\//, '').startsWith(`${CLIENT_BUNDLE_DIRECTORY.replace(/^\.\//, '')}/${buildId}.zip`),
+  );
+
+/**
+ * Lists the local artifacts that make up one bundle: its split parts when the build split it,
+ * otherwise the single zip.
+ * @function clientBundleArtifactPaths
+ * @param {string} zipPath - The bundle's zip path.
+ * @returns {{zipPath: string, partPaths: string[], artifactPaths: string[]}} The resolved artifacts.
+ * @memberof clientBundle
+ */
+const clientBundleArtifactPaths = (zipPath) => {
+  const partPaths = fs.existsSync(dir.dirname(zipPath)) ? getZipPartPaths(zipPath) : [];
+  const artifactPaths = partPaths.length > 0 ? partPaths : fs.existsSync(zipPath) ? [zipPath] : [];
+  return { zipPath, partPaths, artifactPaths };
+};
+
+/**
+ * Builds a deployment's client bundles and uploads them to file storage.
+ *
+ * The build and the uploads run as child processes because `underpost app load` writes the
+ * `.env` this deployment's credentials live in, and only a freshly started process reads it.
+ * @function pushClientBundle
+ * @param {object} options
+ * @param {string} options.deployId - The deployment identifier.
+ * @param {string[]} [options.hosts] - Optional host filter; empty selects every configured host.
+ * @param {string|number} [options.split] - Part size in MB, or `none` to upload one zip.
+ * @param {boolean} [options.dev] - Build for development; defaults to production.
+ * @returns {{pushed: number, skipped: number}} How many bundles were uploaded and skipped.
+ * @memberof clientBundle
+ */
+const pushClientBundle = ({ deployId, hosts = [], split, dev = false }) => {
+  const baseCommand = cli('underpost', { local: true });
+  const env = dev ? 'development' : 'production';
+  const splitFlag = clientBundleSplitFlag(split);
+
+  shellExec(`${baseCommand} app load --env ${env} --args deploy-id=${deployId}`);
+  shellExec(`${baseCommand} client ${deployId} --env ${env} --build-zip${splitFlag ? ` ${splitFlag}` : ''}`);
+
+  const entries = clientBundleEntriesFactory({ deployId, hosts });
+  if (entries.length === 0) logger.warn('no bundle routes resolved', { deployId, hosts });
+
+  let pushed = 0;
+  let skipped = 0;
+  for (const { host, routePath, buildId, zipPath } of entries) {
+    const { artifactPaths } = clientBundleArtifactPaths(zipPath);
+    if (artifactPaths.length === 0) {
+      logger.warn('no bundle artifacts found', { host, routePath, buildId });
+      skipped++;
+      continue;
+    }
+    for (const artifactPath of artifactPaths) {
+      shellExec(
+        `${baseCommand} fs ${artifactPath} --deploy-id ${deployId} --storage-id ${CLIENT_BUNDLE_STORAGE_ID} --force`,
+      );
+    }
+
+    // Remove obsolete manifest entries only after all current artifacts upload.
+    const current = new Set(artifactPaths.map((artifactPath) => artifactPath.replace(/^\.\//, '')));
+    const stale = clientBundleTrackedKeys(clientBundleManifestFactory(deployId), buildId).filter(
+      (key) => !current.has(key.replace(/^\.\//, '')),
+    );
+    for (const key of stale) {
+      shellExec(
+        `${baseCommand} fs --tracked --key ${shellArgumentFactory(key)} ` +
+          `--deploy-id ${deployId} --storage-id ${CLIENT_BUNDLE_STORAGE_ID} --rm`,
+      );
+    }
+    if (stale.length > 0) logger.warn('removed bundle parts a smaller build no longer produces', { buildId, stale });
+
+    logger.info('pushed bundle', { host, routePath, artifacts: artifactPaths.length });
+    pushed++;
+  }
+  return { pushed, skipped };
+};
+
+/**
+ * Downloads a deployment's client bundles from file storage and installs them into the served
+ * public directory.
+ *
+ * Merging and extraction run in-process through the build module; only the download needs a
+ * child process, for the same `.env` reason {@link pushClientBundle} documents.
+ * @function pullClientBundle
+ * @param {object} options
+ * @param {string} options.deployId - The deployment identifier.
+ * @param {string[]} [options.hosts] - Optional host filter; empty selects every configured host.
+ * @param {boolean} [options.dev] - Pull the development environment; defaults to production.
+ * @returns {Promise<{pulled: number, skipped: number}>} How many bundles were installed and skipped.
+ * @memberof clientBundle
+ */
+const expectedBundleBytes = ({ manifest, partPaths }) => {
+  const sizes = partPaths.map((partPath) => manifest[clientBundleManifestKey(partPath)]?.bytes);
+  return sizes.every((bytes) => Number.isFinite(bytes)) ? sizes.reduce((total, bytes) => total + bytes, 0) : undefined;
+};
+
+/**
+ * The manifest key a locally pulled part corresponds to. A pull writes the downloaded archive as
+ * `<key>.zip`, so the wrapper suffix is what has to come off to address the entry that produced it.
+ * @function clientBundleManifestKey
+ * @param {string} partPath - Local path of a pulled part.
+ * @returns {string} The tracked storage key.
+ * @memberof clientBundle
+ */
+const clientBundleManifestKey = (partPath) => partPath.replace(/^\.\//, '').replace(/\.zip$/i, '');
+
+const pullClientBundle = async ({ deployId, hosts = [], dev = false }) => {
+  const baseCommand = cli('underpost', { local: true });
+  const env = dev ? 'development' : 'production';
+
+  const entries = clientBundleEntriesFactory({ deployId, hosts });
+  if (entries.length === 0) {
+    logger.error('no bundle routes resolved', { deployId, hosts });
+    return { pulled: 0, skipped: 0 };
+  }
+
+  shellExec(`${baseCommand} app load --env ${env} --args deploy-id=${deployId}`);
+  fs.mkdirSync(CLIENT_BUNDLE_DIRECTORY, { recursive: true });
+  shellExec(
+    `${baseCommand} fs ${CLIENT_BUNDLE_DIRECTORY.replace(/^\.\//, '')} --tracked --deploy-id ${deployId} ` +
+      `--storage-id ${CLIENT_BUNDLE_STORAGE_ID} --pull --omit-unzip`,
+  );
+
+  const manifest = clientBundleManifestFactory(deployId);
+
+  let pulled = 0;
+  let skipped = 0;
+  for (const { host, routePath, buildId, zipPath, publicPath } of entries) {
+    const { partPaths, artifactPaths } = clientBundleArtifactPaths(zipPath);
+    if (artifactPaths.length === 0) {
+      logger.warn('bundle not found, skipping', { host, routePath, buildId, zipPath });
+      skipped++;
+      continue;
+    }
+
+    if (partPaths.length > 0) {
+      const { mergedBytes } = await mergeClientBuildZip({ buildPrefix: zipPath, logger });
+      // The parts are reassembled blind, so a single stale or short one is only visible as a
+      // corrupt archive far downstream. The pushed sizes are what identify it here instead.
+      const expectedBytes = expectedBundleBytes({ manifest, partPaths });
+      if (expectedBytes !== undefined && expectedBytes !== mergedBytes)
+        throw new Error(
+          `Bundle ${buildId} reassembled to ${mergedBytes} bytes, expected ${expectedBytes} from ${partPaths.length} pushed parts`,
+        );
+    }
+    const { outputPath } = await unzipClientBuild({ buildPrefix: zipPath, logger });
+
+    fs.removeSync(zipPath);
+    for (const partPath of partPaths) fs.removeSync(partPath);
+
+    if (!fs.existsSync(outputPath)) {
+      logger.warn('extracted bundle directory not found, skipping', { host, routePath, outputPath });
+      skipped++;
+      continue;
+    }
+
+    // The previous deployment's document root can be owned by the web server user, so the
+    // replace goes through sudo; the extracted tree this process just wrote does not.
+    shellExec(`sudo rm -rf ${publicPath}`);
+    if (routePath !== '/') shellExec(`sudo mkdir -p public/${host}`);
+    fs.copySync(outputPath, publicPath);
+
+    logger.info('pulled bundle', { host, routePath, publicPath });
+    pulled++;
+  }
+  return { pulled, skipped };
+};
+
+export {
+  CLIENT_BUNDLE_DIRECTORY,
+  clientBundleTrackedKeys,
+  clientBundleManifestFactory,
+  clientBundleManifestKey,
+  DEFAULT_SPLIT_MB,
+  clientBundleArtifactPaths,
+  clientBundleConfServerPath,
+  clientBundleEntriesFactory,
+  clientBundleHostFilter,
+  clientBundleSplitFlag,
+  clientBundleStorageFilePath,
+  pullClientBundle,
+  pushClientBundle,
+};

package/src/db/mongo/MongoExpress.js

@@ -0,0 +1,187 @@
+/**
+ * Mongo Express Deployment Module
+ * @module src/db/mongo/MongoExpress
+ * @namespace MongoExpress
+ * @description Deploys the mongo-express web client used to inspect the cluster's MongoDB
+ * StatefulSet collections. The workload is a plain Deployment plus a ClusterIP Service, so the
+ * same manifests converge identically under Kind, Kubeadm and K3s; the only runtime-dependent
+ * decision is whether the deployed mongod enforces authentication, which selects the overlay.
+ */
+
+import { loggerFactory } from '../../server/ops/logger.js';
+import { shellExec } from '../../server/runtime/process.js';
+// Cyclic by construction (index -> cluster -> MongoExpress -> index), same as MongoBootstrap.js.
+// Safe because the binding is only dereferenced inside method bodies, never at module scope.
+import Underpost from '../../index.js';
+import { MONGODB_DEFAULT_PORT, MONGODB_SERVICE_NAME, MONGODB_STATEFULSET_NAME } from './MongooseDB.js';
+
+const logger = loggerFactory(import.meta);
+
+const MONGO_EXPRESS_NAME = 'mongo-express';
+const MONGO_EXPRESS_SERVICE_NAME = 'mongo-express-service';
+const MONGO_EXPRESS_IMAGE = 'mongo-express:1.0.2';
+const MONGO_EXPRESS_PORT = 8081;
+const MONGO_EXPRESS_NODE_PORT = 32081;
+const MONGO_EXPRESS_BASE_URL = '/mongo/';
+// The UI reads the root credentials and gates its own session with the same pair, so it consumes
+// the StatefulSet's secret rather than owning a second credential of its own.
+const MONGO_EXPRESS_SECRET_NAME = 'mongodb-secret';
+const MONGO_EXPRESS_MANIFEST_DIR = 'manifests/deployment/mongo-express';
+const MONGO_EXPRESS_NO_AUTH_MANIFEST_DIR = 'manifests/deployment/mongo-express-no-auth';
+
+// Literal and unescaped: kubectl's jsonpath quotes carry escape sequences of their own, and no
+// mongod argument contains a pipe.
+const MONGOD_ARGS_FIELD_SEPARATOR = '|';
+
+/**
+ * Parses the mongod argument vector reported by `kubectl -o jsonpath` for the StatefulSet.
+ * @param {string} raw - Raw jsonpath stdout: the StatefulSet name, then one field per argument.
+ * @returns {Array<string>|null} Argument vector, or null when no StatefulSet was reported.
+ * @memberof MongoExpress
+ */
+const parseMongodArgs = (raw) => {
+  const value = `${raw || ''}`;
+  if (!value.trim()) return null;
+  const [, ...args] = value.split(MONGOD_ARGS_FIELD_SEPARATOR);
+  return args.map((arg) => arg.trim()).filter(Boolean);
+};
+
+/**
+ * Decides whether mongo-express must authenticate against the deployed mongod.
+ *
+ * The deployed StatefulSet is the authority: `manifests/mongodb` starts mongod with `--auth` and
+ * `manifests/mongodb-4.4` does not, and either can be the one running regardless of which flag
+ * this invocation carries. The flags only answer for a cluster with no StatefulSet deployed yet,
+ * where `--mongodb` (the auth-enabled manifest set) is the default the platform installs.
+ * @param {object} [params={}] - Resolution inputs.
+ * @param {Array<string>|null} [params.args=null] - mongod argument vector, or null when undeployed.
+ * @param {object} [params.options={}] - Cluster options (`mongodb`, `mongodb4`).
+ * @returns {boolean} True when the admin credential pair must be projected.
+ * @memberof MongoExpress
+ */
+const mongoAuthEnabledFactory = ({ args = null, options = {} } = {}) => {
+  if (Array.isArray(args)) return args.includes('--auth');
+  return options.mongodb4 !== true;
+};
+
+/**
+ * Resolves the kustomization root the auth mode selects.
+ * @param {object} [params={}] - Path inputs.
+ * @param {string} [params.underpostRoot='.'] - Repository root holding `manifests/`.
+ * @param {boolean} [params.authEnabled=true] - Whether mongod enforces authentication.
+ * @returns {string} Kustomization directory path.
+ * @memberof MongoExpress
+ */
+const mongoExpressManifestPathFactory = ({ underpostRoot = '.', authEnabled = true } = {}) =>
+  `${underpostRoot}/${authEnabled ? MONGO_EXPRESS_MANIFEST_DIR : MONGO_EXPRESS_NO_AUTH_MANIFEST_DIR}`;
+
+/**
+ * Resolves the opt-in NodePort Service manifest path. It lives in the base directory and is left
+ * out of both kustomizations: exposing an admin UI on the node network is a caller's decision.
+ * @param {object} [params={}] - Path inputs.
+ * @param {string} [params.underpostRoot='.'] - Repository root holding `manifests/`.
+ * @returns {string} NodePort manifest path.
+ * @memberof MongoExpress
+ */
+const mongoExpressNodePortManifestFactory = ({ underpostRoot = '.' } = {}) =>
+  `${underpostRoot}/${MONGO_EXPRESS_MANIFEST_DIR}/mongo-express-nodeport.yaml`;
+
+/**
+ * @class MongoExpress
+ * @description Static deployment surface for the mongo-express admin client.
+ * @memberof MongoExpress
+ */
+class MongoExpress {
+  /**
+   * Reads the mongod argument vector from the deployed MongoDB StatefulSet.
+   *
+   * The projection leads with the StatefulSet name so a deployed server that declares no arguments
+   * stays distinguishable from no server at all — one is mongod on its defaults, the other is a
+   * cluster with no data tier yet, and both would otherwise reduce to empty output.
+   * @param {string} [namespace='default'] - Namespace holding the StatefulSet.
+   * @returns {Array<string>|null} Argument vector, or null when no StatefulSet is deployed.
+   * @memberof MongoExpress
+   */
+  static readMongodArgs(namespace = 'default') {
+    const raw = shellExec(
+      `kubectl get statefulset ${MONGODB_STATEFULSET_NAME} -n ${namespace} --ignore-not-found -o jsonpath=` +
+        `'{.metadata.name}{"${MONGOD_ARGS_FIELD_SEPARATOR}"}` +
+        `{range .spec.template.spec.containers[?(@.name=="${MONGODB_STATEFULSET_NAME}")].args[*]}` +
+        `{@}{"${MONGOD_ARGS_FIELD_SEPARATOR}"}{end}'`,
+      { stdout: true, silent: true, silentOnError: true },
+    );
+    return parseMongodArgs(raw);
+  }
+
+  /**
+   * Deploys mongo-express and, once it is Ready, applies the exposure and placement the caller
+   * asked for. Cluster-type agnostic by construction: only the image pull differs between Kind
+   * (loaded into the node's image store) and Kubeadm/K3s (pulled through the CRI).
+   * @param {object} [params={}] - Deployment parameters.
+   * @param {string} [params.namespace='default'] - Target namespace.
+   * @param {string} [params.underpostRoot='.'] - Repository root holding `manifests/`.
+   * @param {object} [params.options={}] - Cluster options (`pullImage`, `nodePort`, `nodeName`, `mongodb4`).
+   * @returns {Promise<boolean>} Whether the deployment reported Ready.
+   * @memberof MongoExpress
+   */
+  static async deploy({ namespace = 'default', underpostRoot = '.', options = {} } = {}) {
+    // Secret before workload: the Deployment's secretKeyRef must resolve at pod admission, and
+    // the encrypted store stays the source of truth wherever a manifest exists.
+    if (!Underpost.secret.applyIfPresent(MONGO_EXPRESS_SECRET_NAME, namespace))
+      Underpost.secret.applyFromOriginSeed(MONGO_EXPRESS_SECRET_NAME, namespace);
+
+    if (options.pullImage) Underpost.cluster.pullImage(MONGO_EXPRESS_IMAGE, options);
+
+    const args = MongoExpress.readMongodArgs(namespace);
+    const authEnabled = mongoAuthEnabledFactory({ args, options });
+    const manifestPath = mongoExpressManifestPathFactory({ underpostRoot, authEnabled });
+    logger.info('Deploying mongo-express', {
+      namespace,
+      authEnabled,
+      manifestPath,
+      mongodb: args ? 'deployed' : 'not deployed',
+    });
+    shellExec(`kubectl apply -k ${manifestPath} -n ${namespace}`);
+
+    const ready = await Underpost.test.statusMonitor(MONGO_EXPRESS_NAME, 'Running', 'pods', 1000, 60 * 10);
+    if (!ready) {
+      logger.error('mongo-express did not report Running', { namespace });
+      return false;
+    }
+
+    if (options.nodePort)
+      shellExec(`kubectl apply -f ${mongoExpressNodePortManifestFactory({ underpostRoot })} -n ${namespace}`);
+    if (options.nodeName)
+      Underpost.cluster.pinToNode({
+        kind: 'deployment',
+        name: MONGO_EXPRESS_NAME,
+        namespace,
+        node: options.nodeName,
+      });
+
+    logger.info('mongo-express ready', {
+      server: `${MONGODB_STATEFULSET_NAME}-0.${MONGODB_SERVICE_NAME}:${MONGODB_DEFAULT_PORT}`,
+      basicAuth: `secret/${MONGO_EXPRESS_SECRET_NAME}`,
+      clusterIp: `${MONGO_EXPRESS_SERVICE_NAME}:${MONGO_EXPRESS_PORT}${MONGO_EXPRESS_BASE_URL}`,
+      nodePort: options.nodePort ? `<node>:${MONGO_EXPRESS_NODE_PORT}${MONGO_EXPRESS_BASE_URL}` : null,
+      portForward: `kubectl port-forward -n ${namespace} svc/${MONGO_EXPRESS_SERVICE_NAME} ${MONGO_EXPRESS_PORT}:${MONGO_EXPRESS_PORT}`,
+    });
+    return true;
+  }
+}
+
+export {
+  MONGO_EXPRESS_BASE_URL,
+  MONGO_EXPRESS_IMAGE,
+  MONGO_EXPRESS_NAME,
+  MONGO_EXPRESS_NODE_PORT,
+  MONGO_EXPRESS_PORT,
+  MONGO_EXPRESS_SECRET_NAME,
+  MONGO_EXPRESS_SERVICE_NAME,
+  MongoExpress,
+  mongoAuthEnabledFactory,
+  mongoExpressManifestPathFactory,
+  mongoExpressNodePortManifestFactory,
+  parseMongodArgs,
+};
+export default MongoExpress;

package/src/grpc/cyberia/grpc-server.js

@@ -1,10 +1,9 @@
 /**
  * gRPC transport for the Cyberia Engine data pipeline.
  *
- * Runs alongside Express on a separate port (default 50051).
- * Thin adapter over src/projects/cyberia/instance-data.js — the shared
- * world-load/boot assembly also served by the REST fallback at
- * /api/cyberia-instance/boot/* — so both transports stay equivalent.
+ * Runs beside Express on its own port (default 50051). Thin adapter over
+ * src/projects/cyberia/instance-data.js, the same assembly the REST fallback
+ * at /api/cyberia-instance/boot/* serves, so both transports stay equivalent.
  *
  * @module src/grpc/cyberia/grpc-server.js
  */
@@ -16,7 +15,6 @@ import { fileURLToPath } from 'url';
 import { loggerFactory } from '../../server/ops/logger.js';
 import {
   buildFallbackConfig,
-  buildFallbackInstanceConfig,
   fetchFullInstance,
   fetchMapData,
   fetchObjectLayer,
@@ -131,7 +129,7 @@ class GrpcServer {
 
     server.addService(proto.CyberiaDataService.service, buildHandlers(dbKey));
 
-    // gRPC runs over Kubernetes internal network (ClusterIP) — always insecure
+    // gRPC stays on the cluster-internal network, so credentials are insecure.
     const creds = grpc.ServerCredentials.createInsecure();
 
     return new Promise((resolve, reject) => {
@@ -159,4 +157,4 @@ class GrpcServer {
   }
 }
 
-export { GrpcServer, buildFallbackConfig, buildFallbackInstanceConfig };
+export { GrpcServer, buildFallbackConfig };

package/src/index.js

@@ -52,7 +52,7 @@ class Underpost {
    * @type {String}
    * @memberof Underpost
    */
-  static version = 'v3.3.73';
+  static version = 'v3.3.77';
 
   /**
    * Required Node.js major version