@underpostnet/cyberia 3.3.73 → 3.3.77

package/src/runtime/engine-cyberia/docker-compose.yml

@@ -135,7 +135,7 @@ services:
   # server starts but rejects connections until seeded). Serves REST/WS on 4005
   # and the engine gRPC data service on 50051.
   engine-cyberia-runtime:
-    image: ${ENGINE_CYBERIA_IMAGE:-underpost/engine-cyberia-dev}:${ENGINE_CYBERIA_TAG:-v3.3.73}
+    image: ${ENGINE_CYBERIA_IMAGE:-underpost/engine-cyberia-dev}:${ENGINE_CYBERIA_TAG:-v3.3.77}
     container_name: dd-cyberia-engine
     command:
       - /bin/sh
@@ -190,14 +190,16 @@ services:
   # gateway on host port 8081, so one port can route every instance path.
 
   cyberia-server-runtime:
-    image: ${CYBERIA_SERVER_IMAGE:-underpost/cyberia-server-dev}:${CYBERIA_SERVER_TAG:-v3.3.73}
+    image: ${CYBERIA_SERVER_IMAGE:-underpost/cyberia-server-dev}:${CYBERIA_SERVER_TAG:-v3.3.77}
     container_name: dd-cyberia-server
     environment:
       INSTANCE_CODE: amethyst-strata-expansion
       CYBERIA_BASE_PATH: /
-      ENGINE_API_BASE_URL: ${ENGINE_API_BASE_URL:-http://engine-cyberia}
+      CYBERIA_PUBLIC_URL: ${CYBERIA_SERVER_PUBLIC_ORIGIN:-http://localhost:8081}
+      CYBERIA_SERVER_API_KEY: ${CYBERIA_SERVER_API_KEY:-}
+      CYBERIA_DATA_SERVER_URL: ${CYBERIA_DATA_SERVER_URL:-http://engine-cyberia}
       ENGINE_PUBLIC_URL: ${ENGINE_PUBLIC_URL:-http://localhost:4005}
-      ENGINE_GRPC_ADDRESS: ${ENGINE_GRPC_ADDRESS:-engine-cyberia-runtime:50051}
+      CYBERIA_DATA_SERVER_GRPC: ${CYBERIA_DATA_SERVER_GRPC:-engine-cyberia-runtime:50051}
       ENGINE_GRPC_RELOAD_INTERVAL_SEC: ${ENGINE_GRPC_RELOAD_INTERVAL_SEC:-300}
       STATIC_DIR: ${CYBERIA_SERVER_STATIC_DIR:-/home/dd/engine/cyberia-server/public}
       APP_ENV: ${CYBERIA_SERVER_APP_ENV:-development}
@@ -226,14 +228,16 @@ services:
     restart: unless-stopped
 
   cyberia-server-forest:
-    image: ${CYBERIA_SERVER_IMAGE:-underpost/cyberia-server-dev}:${CYBERIA_SERVER_TAG:-v3.3.73}
+    image: ${CYBERIA_SERVER_IMAGE:-underpost/cyberia-server-dev}:${CYBERIA_SERVER_TAG:-v3.3.77}
     container_name: dd-cyberia-server-forest
     environment:
       INSTANCE_CODE: FOREST
       CYBERIA_BASE_PATH: /FOREST
-      ENGINE_API_BASE_URL: ${ENGINE_API_BASE_URL:-http://engine-cyberia}
+      CYBERIA_PUBLIC_URL: ${CYBERIA_SERVER_PUBLIC_ORIGIN:-http://localhost:8081}/FOREST
+      CYBERIA_SERVER_API_KEY: ${CYBERIA_SERVER_API_KEY:-}
+      CYBERIA_DATA_SERVER_URL: ${CYBERIA_DATA_SERVER_URL:-http://engine-cyberia}
       ENGINE_PUBLIC_URL: ${ENGINE_PUBLIC_URL:-http://localhost:4005}
-      ENGINE_GRPC_ADDRESS: ${ENGINE_GRPC_ADDRESS:-engine-cyberia-runtime:50051}
+      CYBERIA_DATA_SERVER_GRPC: ${CYBERIA_DATA_SERVER_GRPC:-engine-cyberia-runtime:50051}
       ENGINE_GRPC_RELOAD_INTERVAL_SEC: ${ENGINE_GRPC_RELOAD_INTERVAL_SEC:-300}
       STATIC_DIR: ${CYBERIA_SERVER_STATIC_DIR:-/home/dd/engine/cyberia-server/public}
       APP_ENV: ${CYBERIA_SERVER_APP_ENV:-development}
@@ -262,14 +266,16 @@ services:
     restart: unless-stopped
 
   cyberia-server-test:
-    image: ${CYBERIA_SERVER_IMAGE:-underpost/cyberia-server-dev}:${CYBERIA_SERVER_TAG:-v3.3.73}
+    image: ${CYBERIA_SERVER_IMAGE:-underpost/cyberia-server-dev}:${CYBERIA_SERVER_TAG:-v3.3.77}
     container_name: dd-cyberia-server-test
     environment:
       INSTANCE_CODE: TEST
       CYBERIA_BASE_PATH: /TEST
-      ENGINE_API_BASE_URL: ${ENGINE_API_BASE_URL:-http://engine-cyberia}
+      CYBERIA_PUBLIC_URL: ${CYBERIA_SERVER_PUBLIC_ORIGIN:-http://localhost:8081}/TEST
+      CYBERIA_SERVER_API_KEY: ${CYBERIA_SERVER_API_KEY:-}
+      CYBERIA_DATA_SERVER_URL: ${CYBERIA_DATA_SERVER_URL:-http://engine-cyberia}
       ENGINE_PUBLIC_URL: ${ENGINE_PUBLIC_URL:-http://localhost:4005}
-      ENGINE_GRPC_ADDRESS: ${ENGINE_GRPC_ADDRESS:-engine-cyberia-runtime:50051}
+      CYBERIA_DATA_SERVER_GRPC: ${CYBERIA_DATA_SERVER_GRPC:-engine-cyberia-runtime:50051}
       ENGINE_GRPC_RELOAD_INTERVAL_SEC: ${ENGINE_GRPC_RELOAD_INTERVAL_SEC:-300}
       STATIC_DIR: ${CYBERIA_SERVER_STATIC_DIR:-/home/dd/engine/cyberia-server/public}
       APP_ENV: ${CYBERIA_SERVER_APP_ENV:-development}
@@ -299,7 +305,7 @@ services:
 
   # === Tier 4: presentation, one per variant ===============================
   # One WASM bundle serves every variant; the instance is resolved from the URL
-  # sub-path (docker-driver injects CYBERIA_BASE_PATH / _WS_ORIGIN /
+  # sub-path (wasm-driver injects CYBERIA_BASE_PATH / _WS_ORIGIN /
   # _ENGINE_API_ORIGIN / _DEFAULT_INSTANCE). Each client waits ONLY for its own
   # server, so the three
   # server->client pipelines advance independently (in parallel) once the shared
@@ -309,7 +315,7 @@ services:
   #   cyberia-server-test   -> cyberia-client-test
 
   cyberia-client-runtime:
-    image: ${CYBERIA_CLIENT_IMAGE:-underpost/cyberia-client-dev}:${CYBERIA_CLIENT_TAG:-v3.3.73}
+    image: ${CYBERIA_CLIENT_IMAGE:-underpost/cyberia-client-dev}:${CYBERIA_CLIENT_TAG:-v3.3.77}
     container_name: dd-cyberia-client
     environment:
       CYBERIA_PORT: '8081'
@@ -317,7 +323,7 @@ services:
       CYBERIA_BASE_PATH: /
       CYBERIA_DEFAULT_INSTANCE: ${CYBERIA_DEFAULT_INSTANCE:-amethyst-strata-expansion}
       CYBERIA_WS_ORIGIN: ${CYBERIA_WS_ORIGIN:-ws://localhost:8081}
-      CYBERIA_ENGINE_API_ORIGIN: ${CYBERIA_ENGINE_API_ORIGIN:-http://localhost}
+      CYBERIA_DATA_SERVER_URL: ${CYBERIA_CLIENT_DATA_SERVER_URL:-http://localhost}
     networks:
       - dd-cyberia-internal
     expose:
@@ -334,7 +340,7 @@ services:
     restart: unless-stopped
 
   cyberia-client-forest:
-    image: ${CYBERIA_CLIENT_IMAGE:-underpost/cyberia-client-dev}:${CYBERIA_CLIENT_TAG:-v3.3.73}
+    image: ${CYBERIA_CLIENT_IMAGE:-underpost/cyberia-client-dev}:${CYBERIA_CLIENT_TAG:-v3.3.77}
     container_name: dd-cyberia-client-forest
     environment:
       CYBERIA_PORT: '8081'
@@ -342,7 +348,7 @@ services:
       CYBERIA_BASE_PATH: /FOREST
       CYBERIA_DEFAULT_INSTANCE: ${CYBERIA_DEFAULT_INSTANCE:-amethyst-strata-expansion}
       CYBERIA_WS_ORIGIN: ${CYBERIA_WS_ORIGIN:-ws://localhost:8081}
-      CYBERIA_ENGINE_API_ORIGIN: ${CYBERIA_ENGINE_API_ORIGIN:-http://localhost}
+      CYBERIA_DATA_SERVER_URL: ${CYBERIA_CLIENT_DATA_SERVER_URL:-http://localhost}
     networks:
       - dd-cyberia-internal
     expose:
@@ -359,7 +365,7 @@ services:
     restart: unless-stopped
 
   cyberia-client-test:
-    image: ${CYBERIA_CLIENT_IMAGE:-underpost/cyberia-client-dev}:${CYBERIA_CLIENT_TAG:-v3.3.73}
+    image: ${CYBERIA_CLIENT_IMAGE:-underpost/cyberia-client-dev}:${CYBERIA_CLIENT_TAG:-v3.3.77}
     container_name: dd-cyberia-client-test
     environment:
       CYBERIA_PORT: '8081'
@@ -367,7 +373,7 @@ services:
       CYBERIA_BASE_PATH: /TEST
       CYBERIA_DEFAULT_INSTANCE: ${CYBERIA_DEFAULT_INSTANCE:-amethyst-strata-expansion}
       CYBERIA_WS_ORIGIN: ${CYBERIA_WS_ORIGIN:-ws://localhost:8081}
-      CYBERIA_ENGINE_API_ORIGIN: ${CYBERIA_ENGINE_API_ORIGIN:-http://localhost}
+      CYBERIA_DATA_SERVER_URL: ${CYBERIA_CLIENT_DATA_SERVER_URL:-http://localhost}
     networks:
       - dd-cyberia-internal
     expose:

package/src/server/build/coverage.js

@@ -1,85 +1,152 @@
 /**
- * The coverage HTML report as a build artifact: where a run leaves it, where an assembled
- * deploy artifact carries it, and what is published when nothing was carried.
+ * The coverage HTML reports as build artifacts: which reports a deploy declares, where a run
+ * leaves each, where an assembled deploy artifact carries them, and what is published when
+ * one was not carried.
  *
- * The report is produced by the test stage (`npm run test:coverage`) and bundled into the
- * deploy artifact at {@link COVERAGE_BUNDLE_DIRECTORY}. A workload container only ever
- * copies it: running a test runner inside a pod costs minutes of the build phase, needs the
- * dev dependency tree, and — because a suite's expected non-zero exits latch the runtime
- * status contract — publishes a false `error` to the deployment monitor.
+ * A deploy declares its reports in `conf.server.json` under `docs.coverage`, one entry per
+ * report it publishes at `/docs/coverage/<id>`:
+ *
+ * - `{ id, label, suite }` — a test tier selection run by `node bin test <suite>`, whose HTML
+ *   report the runner writes under `coverage/<key>` (see `coverageReportKey`). A deploy shows
+ *   the run it names, never the last run a host happened to make.
+ * - `{ id, label, path }` — a report another tree produces on its own (Hardhat's Solidity
+ *   coverage), read from that tree's `coverage/` output.
+ *
+ * Reports are produced by the test stage and bundled into the deploy artifact under
+ * {@link COVERAGE_BUNDLE_DIRECTORY}. A workload container only ever copies them: running a
+ * test runner inside a pod costs minutes of the build phase, needs the dev dependency tree,
+ * and — because a suite's expected non-zero exits latch the runtime status contract —
+ * publishes a false `error` to the deployment monitor.
  *
  * @module src/server/build/coverage.js
  * @namespace UnderpostCoverage
  */
 
 import fs from 'fs-extra';
-import { UNDERPOST_TESTING } from './testing.js';
+import { UNDERPOST_TESTING, coverageReportKey } from './testing.js';
 
 /**
  * @constant COVERAGE_BUNDLE_DIRECTORY
- * @description Path, relative to a source tree root, where an assembled deploy artifact
- * carries the report. Deliberately not under `coverage/`, which every engine `.gitignore`
- * excludes, so the bundled artifact is publishable source rather than a local run's output.
+ * @description Path, relative to a source tree root, under which an assembled deploy
+ * artifact carries each report as `<id>/`. Deliberately not under `coverage/`, which every
+ * engine `.gitignore` excludes, so the bundled artifact is publishable source rather than a
+ * local run's output.
  * @memberof UnderpostCoverage
  */
 const COVERAGE_BUNDLE_DIRECTORY = 'docs/coverage';
 
 const normalizeRoot = (root) => `${root ?? ''}`.replace(/\/+$/, '');
 
+/**
+ * @method coverageReportsFactory
+ * @description The reports a deploy's `docs` conf declares, validated: every entry names an
+ * id and exactly one source, and no two entries publish under the same id.
+ * @param {object} [docs] - The `docs` block of one `conf.server.json` route.
+ * @returns {Array<{id: string, label: string, suite?: string, path?: string}>} Declared reports.
+ * @throws {Error} When an entry is malformed or an id repeats.
+ * @memberof UnderpostCoverage
+ */
+const coverageReportsFactory = (docs = {}) => {
+  const reports = docs.coverage ?? [];
+  const ids = new Set();
+  for (const report of reports) {
+    const { id, suite, path } = report;
+    if (!id || !/^[a-z0-9-]+$/.test(id)) throw new Error(`[coverage] report id must be a slug, got '${id}'`);
+    if (ids.has(id)) throw new Error(`[coverage] report id '${id}' is declared twice`);
+    if (!suite === !path) throw new Error(`[coverage] report '${id}' needs exactly one of 'suite' or 'path'`);
+    ids.add(id);
+  }
+  return reports.map(({ id, label = id, suite, path }) => ({ id, label, suite, path }));
+};
+
+/**
+ * @method deployCoverageReports
+ * @description Every report a deploy declares across its routes, once each: two routes may
+ * publish the same report, never the same id with different sources.
+ * @param {object} confServer - A parsed `conf.server.json`.
+ * @returns {Array<{id: string, label: string, suite?: string, path?: string}>} Declared reports.
+ * @throws {Error} When an id is declared with two different sources.
+ * @memberof UnderpostCoverage
+ */
+const deployCoverageReports = (confServer) => {
+  const reports = new Map();
+  for (const routes of Object.values(confServer)) {
+    for (const { docs } of Object.values(routes)) {
+      for (const report of coverageReportsFactory(docs)) {
+        const known = reports.get(report.id);
+        if (known && (known.suite !== report.suite || known.path !== report.path))
+          throw new Error(`[coverage] report id '${report.id}' is declared with two different sources`);
+        reports.set(report.id, report);
+      }
+    }
+  }
+  return [...reports.values()];
+};
+
 /**
  * @method coverageReportCandidates
- * @description Every place a coverage HTML report can live in a source tree, most local
- * first: the reporters a run writes, then the bundled artifact a deploy artifact carries.
- * @param {string} root - Source tree root.
+ * @description Every place one report can live, most local first: the output of the run
+ * that produces it, then the bundled artifact a deploy artifact carries.
+ * @param {{id: string, suite?: string, path?: string}} report - A declared report.
  * @returns {string[]} Candidate report directories.
  * @memberof UnderpostCoverage
  */
-const coverageReportCandidates = (root) => {
-  const base = normalizeRoot(root);
-  if (!base) return [];
-  const coverage = `${base}/${UNDERPOST_TESTING.coverageDirectory}`;
-  return [`${coverage}/html`, `${coverage}/lcov-report`, coverage, `${base}/${COVERAGE_BUNDLE_DIRECTORY}`];
+const coverageReportCandidates = ({ id, suite, path }) => {
+  const bundled = `${COVERAGE_BUNDLE_DIRECTORY}/${id}`;
+  if (suite) return [`${UNDERPOST_TESTING.coverageDirectory}/${coverageReportKey(suite)}`, bundled];
+  const coverage = `${normalizeRoot(path)}/${UNDERPOST_TESTING.coverageDirectory}`;
+  return [`${coverage}/html`, `${coverage}/lcov-report`, coverage, bundled];
 };
 
 /**
  * @method resolveCoverageReportPath
  * @description First candidate that actually carries an HTML index. A directory holding
  * only `lcov.info` is not a report and is not published.
- * @param {string} root - Source tree root.
+ * @param {{id: string, suite?: string, path?: string}} report - A declared report.
  * @returns {string|undefined} Report directory, or undefined when none is available.
  * @memberof UnderpostCoverage
  */
-const resolveCoverageReportPath = (root) =>
-  coverageReportCandidates(root).find((candidate) => fs.existsSync(`${candidate}/index.html`));
+const resolveCoverageReportPath = (report) =>
+  coverageReportCandidates(report).find((candidate) => fs.existsSync(`${candidate}/index.html`));
+
+/**
+ * @method coverageReportCommand
+ * @description The command that produces a report, for the operator who finds it missing.
+ * @param {{suite?: string, path?: string}} report - A declared report.
+ * @returns {string} Shell command.
+ * @memberof UnderpostCoverage
+ */
+const coverageReportCommand = ({ suite, path }) =>
+  suite ? `node bin test ${suite}` : `npm run coverage --prefix ${normalizeRoot(path)}`;
 
 /**
- * @method bundleCoverageReport
- * @description Copies the report of `fromRoot` into `toRoot`'s bundle directory, so the
+ * @method bundleCoverageReports
+ * @description Copies each declared report into `toRoot`'s bundle directory, so the
  * assembled artifact carries it into every container started from that source.
- * @param {string} fromRoot - Tree the report was generated in.
+ * @param {Array<{id: string, suite?: string, path?: string}>} reports - Declared reports.
  * @param {string} toRoot - Assembled artifact root.
- * @returns {{bundled: boolean, from?: string, to: string}} What was bundled, and where.
+ * @returns {Array<{id: string, bundled: boolean, from?: string, to: string}>} What was bundled, and where.
  * @memberof UnderpostCoverage
  */
-const bundleCoverageReport = (fromRoot, toRoot) => {
-  const to = `${normalizeRoot(toRoot)}/${COVERAGE_BUNDLE_DIRECTORY}`;
-  const from = resolveCoverageReportPath(fromRoot);
-  if (!from) return { bundled: false, to };
-  fs.emptyDirSync(to);
-  fs.copySync(from, to);
-  return { bundled: true, from, to };
-};
+const bundleCoverageReports = (reports, toRoot) =>
+  reports.map((report) => {
+    const to = `${normalizeRoot(toRoot)}/${COVERAGE_BUNDLE_DIRECTORY}/${report.id}`;
+    const from = resolveCoverageReportPath(report);
+    if (!from) return { id: report.id, bundled: false, to };
+    fs.emptyDirSync(to);
+    fs.copySync(from, to);
+    return { id: report.id, bundled: true, from, to };
+  });
 
 /**
  * @method coverageUnavailablePage
  * @description The page served where a report was expected but none was bundled. A static
  * document, never an invitation to generate one at runtime.
- * @param {object} [options]
- * @param {string} [options.command] - Command that produces the report.
+ * @param {{id: string, suite?: string, path?: string}} report - The missing report.
  * @returns {string} HTML document.
  * @memberof UnderpostCoverage
  */
-const coverageUnavailablePage = ({ command = 'npm run test:coverage' } = {}) => `<!doctype html>
+const coverageUnavailablePage = (report) => `<!doctype html>
 <html lang="en">
   <head>
     <meta charset="utf-8" />
@@ -99,10 +166,11 @@ const coverageUnavailablePage = ({ command = 'npm run test:coverage' } = {}) =>
   <body>
     <main>
       <h1>Coverage report unavailable</h1>
-      <p>This build carried no coverage report. The report is generated by the test stage and
-      bundled into the deploy artifact under <code>${COVERAGE_BUNDLE_DIRECTORY}</code>.</p>
-      <p>Run <code>${command}</code> in the build environment, then assemble and publish the
-      artifact again.</p>
+      <p>This build carried no <code>${report.id}</code> coverage report. The report is generated
+      by the test stage and bundled into the deploy artifact under
+      <code>${COVERAGE_BUNDLE_DIRECTORY}/${report.id}</code>.</p>
+      <p>Run <code>${coverageReportCommand(report)}</code> in the build environment, then assemble
+      and publish the artifact again.</p>
     </main>
   </body>
 </html>
@@ -110,8 +178,11 @@ const coverageUnavailablePage = ({ command = 'npm run test:coverage' } = {}) =>
 
 export {
   COVERAGE_BUNDLE_DIRECTORY,
-  bundleCoverageReport,
+  bundleCoverageReports,
   coverageReportCandidates,
+  coverageReportCommand,
+  coverageReportsFactory,
   coverageUnavailablePage,
+  deployCoverageReports,
   resolveCoverageReportPath,
 };

package/src/server/build/package.js

@@ -93,12 +93,10 @@ const replaceTemplateReferences = (value, templateRepositoryName, repositoryName
 /**
  * Builds the development dependency set for a generated product repository.
  *
- * Product packages replace the engine's broad runtime dependency set with a
- * deliberately small product-specific one. The generated repository still
- * contains the engine source, build scripts, Vitest configuration and tests,
- * though, so those engine dependencies remain necessary when developing or
- * testing the checkout. Keeping them as dev dependencies makes CI complete
- * without adding them to installations of the published product package.
+ * A product's runtime set is the engine's plus whatever its catalog pins, so what stays here is
+ * the toolchain the generated repository needs to build and test itself: engine dev
+ * dependencies, the template's own, and anything the product already declares at runtime is
+ * dropped rather than pinned twice.
  *
  * @param {object} [params]
  * @param {Record<string, string>} [params.engineDependencies]
@@ -181,6 +179,46 @@ const buildProductPackageJson = ({
   };
 };
 
+/**
+ * The manifest a product publishes to npm, from the one its repository runs on.
+ *
+ * A product repository declares the engine's runtime dependencies because it runs the engine
+ * source it ships. Somebody installing the product from the registry does not run that
+ * checkout: they get the engine through the published `underpost` package, so the tarball
+ * declares that package and the catalog's pins, and everything else stays the toolchain the
+ * repository builds and tests itself with. Publishing the repository's manifest unchanged
+ * would install a second copy of the engine's dependency set next to `underpost`'s own.
+ *
+ * The rewrite belongs to the publish step alone — never to the checkout, whose install is what
+ * a node and a pod run from.
+ * @param {object} params
+ * @param {object} params.packageJson - The repository's manifest.
+ * @param {object} [params.catalog] - That product's catalog.
+ * @param {string} [params.underpostVersion] - Engine CLI version to pin; the manifest's own otherwise.
+ * @returns {object} The manifest to publish.
+ * @memberof PackageBuilder
+ */
+const publishedProductPackageJson = ({ packageJson, catalog = {}, underpostVersion = '' } = {}) => {
+  if (!packageJson || typeof packageJson !== 'object')
+    throw new TypeError('publishedProductPackageJson requires packageJson');
+
+  const version = `${underpostVersion || packageJson.version || ''}`.replace(/^v/, '');
+  if (!version) throw new TypeError('publishedProductPackageJson requires a version to pin the engine CLI at');
+
+  const dependencies = { underpost: `^${version}`, ...(catalog.packageDependencies ?? {}) };
+  const devDependencies = productDevDependenciesFactory({
+    engineDependencies: packageJson.dependencies,
+    engineDevDependencies: packageJson.devDependencies,
+    productDependencies: dependencies,
+  });
+
+  return {
+    ...packageJson,
+    dependencies,
+    ...(Object.keys(devDependencies).length ? { devDependencies } : {}),
+  };
+};
+
 /**
  * Where a deploy id's package manifest lives.
  *
@@ -276,22 +314,26 @@ const buildDeployPackageJson = ({
 /**
  * The product-CLI manifest overrides a catalog declares, for {@link buildProductPackageJson}.
  *
- * A product package replaces the engine's runtime dependency set with its own, so it always
- * carries the published `underpost` alongside whatever the catalog pins. A catalog that
- * declares no package contract returns nothing, leaving the base template's manifest as it is.
+ * A product package carries the engine's own runtime dependencies, not the published
+ * `underpost` package. A product repository ships the engine source and runs it directly, so
+ * depending on the package installed a second copy of the engine whose nested tree `src/`
+ * cannot resolve from — and a dependency pinned at a different version there was reachable
+ * only as a dev entry, which a production install omits, leaving the deployment unable to
+ * import its own modules. A catalog that declares no package contract returns nothing, leaving
+ * the base template's manifest as it is.
  * @param {object} params
  * @param {object} params.catalog - The deploy's product catalog.
- * @param {string} params.underpostVersion - Version of the engine CLI the product depends on.
+ * @param {Record<string, string>} [params.engineDependencies] - The engine's runtime dependencies.
  * @returns {{customDependencies?: object, customScripts?: object, customBin?: object}} Overrides.
  * @memberof PackageBuilder
  */
-const productPackageOptionsFactory = ({ catalog = {}, underpostVersion = '' } = {}) => {
+const productPackageOptionsFactory = ({ catalog = {}, engineDependencies = {} } = {}) => {
   const dependencies = catalog.packageDependencies ?? {};
   const bin = catalog.packageBin ?? {};
   if (Object.keys(dependencies).length === 0 && Object.keys(bin).length === 0) return {};
 
   return {
-    customDependencies: { underpost: `^${`${underpostVersion}`.replace(/^v/, '')}`, ...dependencies },
+    customDependencies: { ...engineDependencies, ...dependencies },
     customScripts: { ...catalog.packageScripts },
     ...(Object.keys(bin).length ? { customBin: { ...bin } } : {}),
   };
@@ -457,6 +499,7 @@ export {
   packageRepositoryFactory,
   productDevDependenciesFactory,
   productPackageOptionsFactory,
+  publishedProductPackageJson,
   renamePackage,
   setPackageRepository,
   stageCliPackage,

package/src/server/build/testing.js

@@ -103,8 +103,22 @@ const TEST_TIERS = [
       'src/server/runtime/conf.js',
       'src/server/security/crypto.js',
     ],
+    // Non-recursive: the cyberia extension underneath is its own tier, so a
+    // tree that strips the product keeps a unit tier that imports none of it.
+    recursive: false,
     description: 'Pure functions with no host, cluster or network dependency.',
   },
+  {
+    name: 'cyberia:unit',
+    directory: 'test/unit/cyberia',
+    groupOrder: 1,
+    sources: [
+      'src/projects/cyberia/instance-backup.js',
+      'src/projects/cyberia/instance-data.js',
+      'src/projects/cyberia/stat-balance.js',
+    ],
+    description: 'Cyberia MMO extension: pure functions over instance data, backups and stat policies.',
+  },
   {
     name: 'infra:1-security',
     directory: 'test/integration/infra/1-security',
@@ -128,7 +142,7 @@ const TEST_TIERS = [
     name: 'infra:3-cluster',
     directory: 'test/integration/infra/3-cluster',
     groupOrder: 4,
-    sources: ['src/cli/docker-compose.js', 'src/server/runtime/conf.js'],
+    sources: ['src/cli/docker-compose.js', 'src/db/mongo/MongoExpress.js', 'src/server/runtime/conf.js'],
     description: 'Instance clustering, node assignment and compute scheduling.',
   },
   {
@@ -136,6 +150,7 @@ const TEST_TIERS = [
     directory: 'test/integration/infra/4-ingress',
     groupOrder: 5,
     sources: [
+      'src/server/network/middlewares.js',
       'src/server/network/router.js',
       'src/server/network/underpost-compression.js',
       'src/server/network/underpost-gateway.js',
@@ -169,16 +184,17 @@ const TEST_TIERS = [
     description: 'Platform application layer served over the provisioned stack.',
   },
   {
-    name: 'cyberia',
+    name: 'cyberia:app',
     directory: 'test/integration/app/cyberia',
     groupOrder: 7,
     sources: [
       'src/api/cyberia-server-defaults/*.js',
       'src/api/cyberia-instance/cyberia-fallback-capture.js',
       'src/api/object-layer/object-layer.model.js',
+      'src/projects/cyberia/atlas-sprite-sheet-generator.js',
       'src/projects/cyberia/shape-generator.js',
     ],
-    description: 'Cyberia MMO extension: content, persistence and shape generation.',
+    description: 'Cyberia MMO extension: content, persistence, sprite atlases and shape generation.',
   },
   {
     name: 'contracts',
@@ -346,12 +362,44 @@ const coverageThresholdFactory = ({ COVERAGE_ENFORCE, COVERAGE_MIN } = {}) => {
  * @throws {Error} When a selected project matches no declared tier.
  * @memberof UnderpostTesting
  */
-const coverageIncludeFactory = (argv = []) => {
-  const projects = argv.flatMap((arg, index) =>
-    arg === '--project' ? [argv[index + 1]] : arg.startsWith('--project=') ? [arg.slice('--project='.length)] : [],
-  );
-  return [...new Set(resolveTestTiers(projects.filter(Boolean).join(',')).flatMap(({ sources = [] }) => sources))];
-};
+const coverageIncludeFactory = (argv = []) => [
+  ...new Set(resolveTestTiers(vitestProjectSelector(argv)).flatMap(({ sources = [] }) => sources)),
+];
+
+/**
+ * @method vitestProjectSelector
+ * @description The tier selector a Vitest argument vector carries, as `--project` flags.
+ * @param {string[]} [argv] - Argument vector.
+ * @returns {string} Comma separated selector, empty when no project was named.
+ * @memberof UnderpostTesting
+ */
+const vitestProjectSelector = (argv = []) =>
+  argv
+    .flatMap((arg, index) =>
+      arg === '--project' ? [argv[index + 1]] : arg.startsWith('--project=') ? [arg.slice('--project='.length)] : [],
+    )
+    .filter(Boolean)
+    .join(',');
+
+/**
+ * @method coverageReportKey
+ * @description The directory under `coverage/` a selection's HTML report is written to,
+ * derived from the suites the selection spans so a deploy that names `unit,infra,app` and
+ * a run that was handed the same tiers as `--project` flags address one report — and so
+ * two selections never overwrite each other's on a host that serves both.
+ * @param {string} [selector] - Suite names, tier names, or empty for every tier.
+ * @returns {string} Suite names in declaration order, joined with `-`.
+ * @throws {Error} When a selector matches no declared tier.
+ * @memberof UnderpostTesting
+ */
+const coverageReportKey = (selector = '') =>
+  [
+    ...new Set(
+      resolveTestTiers(selector)
+        .filter(({ delegate }) => !delegate)
+        .map(({ name }) => name.split(':')[0]),
+    ),
+  ].join('-');
 
 /**
  * @method allureManifestsFactory
@@ -518,6 +566,7 @@ export {
   TEST_TIERS,
   allureManifestsFactory,
   coverageIncludeFactory,
+  coverageReportKey,
   coverageThresholdFactory,
   resolveTestSelection,
   resolveTestTiers,
@@ -525,4 +574,5 @@ export {
   testProjectsFactory,
   testSuiteNames,
   vitestArgsFactory,
+  vitestProjectSelector,
 };

package/src/server/network/middlewares.js

@@ -152,8 +152,14 @@ const buildCrudController = (service, extend = {}) => {
   class CrudController {
     /** @static @memberof Middlewares */
     static post = serviceHandler(service.post);
-    /** @static @memberof Middlewares */
-    static get = serviceHandler(service.get, { pagination: true });
+    /**
+     * Reads are public and cross-origin by default: the browser client is served from its own
+     * origin and every list/read it issues is a plain GET against this API. Without the header
+     * the response arrives with status 200 and is then discarded by the same-origin policy,
+     * which reads as a silent feature failure rather than a transport error.
+     * @static @memberof Middlewares
+     */
+    static get = serviceHandler(service.get, { pagination: true, crossOrigin: true });
     /** @static @memberof Middlewares */
     static put = serviceHandler(service.put);
     /** @static @memberof Middlewares */