@underpostnet/cyberia 3.3.76 → 3.4.0

package/.env.example

@@ -24,6 +24,7 @@ IPFS_CLUSTER_IMAGE=ipfs/ipfs-cluster:latest
 # The engine-cyberia image ships only the underpost CLI; at start it runs the
 # `underpost start --build` bootstrap, which clones ${GITHUB_USERNAME}/engine-cyberia.
 GITHUB_USERNAME=underpostnet
+GITHUB_ORG_NAME=underpost
 GITHUB_TOKEN=change_me_private_repo_token
 
 # --- MongoDB (translation of Secret mongodb-secret) --------------------------

package/.github/workflows/coverall.cyberia.ci.yml

@@ -15,8 +15,11 @@ jobs:
     if: |
       github.actor != 'dependabot[bot]' &&
       (github.repository == 'underpostnet/engine-cyberia' ||
+       github.repository == 'underpost/engine-cyberia' ||
        github.repository == 'underpostnet/engine-ghpkg-cyberia' ||
-       github.repository == 'underpostnet/engine-test-cyberia')
+       github.repository == 'underpost/engine-ghpkg-cyberia' ||
+       github.repository == 'underpostnet/engine-test-cyberia' ||
+       github.repository == 'underpost/engine-test-cyberia')
     runs-on: ubuntu-latest
     container:
       image: quay.io/rockylinux/rockylinux:9
@@ -42,6 +45,11 @@ jobs:
       - name: Install project dependencies
         run: npm install
 
+      # The cyberia tier imports the modules its catalog pins (jimp, pngjs, ethers, ...),
+      # which the engine manifest does not carry.
+      - name: Install cyberia catalog dependencies
+        run: node bin package dd-cyberia --install
+
       # Set the COVERAGE_MIN repository variable to gate below the shipped
       # default while the suite is catching up to it.
       - name: Run tests and enforce coverage threshold
@@ -69,8 +77,11 @@ jobs:
       !cancelled() &&
       github.actor != 'dependabot[bot]' &&
       (github.repository == 'underpostnet/engine-cyberia' ||
+       github.repository == 'underpost/engine-cyberia' ||
        github.repository == 'underpostnet/engine-ghpkg-cyberia' ||
-       github.repository == 'underpostnet/engine-test-cyberia')
+       github.repository == 'underpost/engine-ghpkg-cyberia' ||
+       github.repository == 'underpostnet/engine-test-cyberia' ||
+       github.repository == 'underpost/engine-test-cyberia')
     runs-on: ubuntu-latest
     steps:
       # Coveralls reads the commit and branch metadata from the checkout.
@@ -101,8 +112,11 @@ jobs:
       !cancelled() &&
       github.actor != 'dependabot[bot]' &&
       (github.repository == 'underpostnet/engine-cyberia' ||
+       github.repository == 'underpost/engine-cyberia' ||
        github.repository == 'underpostnet/engine-ghpkg-cyberia' ||
-       github.repository == 'underpostnet/engine-test-cyberia')
+       github.repository == 'underpost/engine-ghpkg-cyberia' ||
+       github.repository == 'underpostnet/engine-test-cyberia' ||
+       github.repository == 'underpost/engine-test-cyberia')
     runs-on: ubuntu-latest
     steps:
       - name: Notify Coveralls Finished

package/.github/workflows/cyberia-client.cd.yml

@@ -16,7 +16,8 @@ permissions:
 jobs:
   deploy:
     if: >-
-      github.repository == 'underpostnet/cyberia-client'
+      (github.repository == 'underpostnet/cyberia-client' ||
+       github.repository == 'underpost/cyberia-client')
       && github.event.inputs.job == 'deploy'
     name: Remote SSH deployment
     runs-on: ubuntu-latest

package/.github/workflows/cyberia-server.cd.yml

@@ -16,7 +16,8 @@ permissions:
 jobs:
   deploy:
     if: >-
-      github.repository == 'underpostnet/cyberia-server'
+      (github.repository == 'underpostnet/cyberia-server' ||
+       github.repository == 'underpost/cyberia-server')
       && github.event.inputs.job == 'deploy'
     name: Remote SSH deployment
     runs-on: ubuntu-latest

package/.github/workflows/docker-image.cyberia-client.ci.yml

@@ -4,7 +4,7 @@ on:
   workflow_dispatch:
 
 env:
-  UNDERPOST_VERSION: '3.3.76'
+  UNDERPOST_VERSION: '3.4.0'
 
 jobs:
   build-and-push:

package/.github/workflows/docker-image.cyberia-client.dev.ci.yml

@@ -4,7 +4,7 @@ on:
   workflow_dispatch:
 
 env:
-  UNDERPOST_VERSION: '3.3.76'
+  UNDERPOST_VERSION: '3.4.0'
 
 jobs:
   build-and-push:

package/.github/workflows/docker-image.cyberia-server.ci.yml

@@ -4,7 +4,7 @@ on:
   workflow_dispatch:
 
 env:
-  UNDERPOST_VERSION: '3.3.76'
+  UNDERPOST_VERSION: '3.4.0'
 
 jobs:
   build-and-push:

package/.github/workflows/docker-image.cyberia-server.dev.ci.yml

@@ -4,7 +4,7 @@ on:
   workflow_dispatch:
 
 env:
-  UNDERPOST_VERSION: '3.3.76'
+  UNDERPOST_VERSION: '3.4.0'
 
 jobs:
   build-and-push:

package/.github/workflows/docker-image.engine-cyberia.ci.yml

@@ -4,7 +4,7 @@ on:
   workflow_dispatch:
 
 env:
-  UNDERPOST_VERSION: '3.3.76'
+  UNDERPOST_VERSION: '3.4.0'
 
 jobs:
   build-and-push:

package/.github/workflows/docker-image.engine-cyberia.dev.ci.yml

@@ -4,7 +4,7 @@ on:
   workflow_dispatch:
 
 env:
-  UNDERPOST_VERSION: '3.3.76'
+  UNDERPOST_VERSION: '3.4.0'
 
 jobs:
   build-and-push:

package/.github/workflows/engine-cyberia.ci.yml

@@ -79,7 +79,7 @@ jobs:
           cd engine
           git clone --depth 1 --no-checkout https://$GITHUB_TOKEN@github.com/underpostnet/engine-private.git ./engine-private
           cd ./engine-private && git sparse-checkout set conf/dd-cyberia && git checkout && cd ..
-          node bin/build dd-cyberia development
+          node bin/build dd-cyberia development --coverage
           cd ../pwa-microservices-template
           rm -rf ./.git
           mv ../engine-cyberia.git ./.git
@@ -97,6 +97,12 @@ jobs:
           else
             git commit -m "$LAST_COMMIT_MESSAGE"
             node ../engine/bin push . underpostnet/engine-cyberia
+            MIRROR_PAYLOAD=$(REPO=engine-cyberia node -e 'process.stdout.write(JSON.stringify({ ref: "master", inputs: { repos: process.env.REPO } }))')
+            curl -sS -f -X POST \
+              -H "Accept: application/vnd.github.v3+json" \
+              -H "Authorization: token ${GITHUB_TOKEN}" \
+              "https://api.github.com/repos/underpostnet/engine/actions/workflows/mirror-to-org.yml/dispatches" \
+              -d "$MIRROR_PAYLOAD"
             echo "[INFO] Dispatching canonical github package build engine-ghpkg-cyberia"
             GHPKG_PAYLOAD=$(MSG="$LAST_COMMIT_MESSAGE" node -e '
               const i = { conf_id: "cyberia" };

package/.github/workflows/ghpkg.ci.yml

@@ -21,7 +21,7 @@ permissions:
 jobs:
   pwa-microservices-template-ghpk:
     if: >-
-      github.repository == 'underpostnet/pwa-microservices-template' &&
+      (github.repository == 'underpostnet/pwa-microservices-template') &&
        (
          startsWith(github.event.head_commit.message, 'ci(package-pwa-microservices-template-ghpkg)')
          || 
@@ -94,12 +94,23 @@ jobs:
           git config user.name 'underpostnet'
           git config user.email 'fcoverdugoa@underpost.net'
           git add .
+          # Installed modules never enter the package repository; a deletion is the cleanup and passes.
+          if git diff --cached --name-only --diff-filter=AM | grep -q '^node_modules/'; then
+            echo "::error::node_modules is staged for commit; the template .gitignore must ignore it."
+            exit 1
+          fi
           git status
           git commit -m "$LAST_COMMIT_MESSAGE"
           node bin push . underpostnet/pwa-microservices-template-ghpkg
+          MIRROR_PAYLOAD=$(REPO=pwa-microservices-template-ghpkg node -e 'process.stdout.write(JSON.stringify({ ref: "master", inputs: { repos: process.env.REPO } }))')
+          curl -sS -f -X POST \
+            -H "Accept: application/vnd.github.v3+json" \
+            -H "Authorization: token ${GITHUB_TOKEN}" \
+            "https://api.github.com/repos/underpostnet/engine/actions/workflows/mirror-to-org.yml/dispatches" \
+            -d "$MIRROR_PAYLOAD"
 
   engine-ghpkg:
-    if: github.repository == 'underpostnet/engine' && github.event_name == 'workflow_dispatch'
+    if: (github.repository == 'underpostnet/engine' || github.repository == 'underpost/engine') && github.event_name == 'workflow_dispatch'
     name: Build engine ${{ github.event.inputs.conf_id || 'cyberia' }} ghpkg repository
     runs-on: ubuntu-latest
     container:
@@ -178,4 +189,10 @@ jobs:
           else
             git commit -m "$LAST_COMMIT_MESSAGE"
             node ../engine/bin push . underpostnet/$GHPKG_REPO
+            MIRROR_PAYLOAD=$(REPO="$GHPKG_REPO" node -e 'process.stdout.write(JSON.stringify({ ref: "master", inputs: { repos: process.env.REPO } }))')
+            curl -sS -f -X POST \
+              -H "Accept: application/vnd.github.v3+json" \
+              -H "Authorization: token ${GITHUB_TOKEN}" \
+              "https://api.github.com/repos/underpostnet/engine/actions/workflows/mirror-to-org.yml/dispatches" \
+              -d "$MIRROR_PAYLOAD"
           fi

package/.github/workflows/gitlab.ci.yml

@@ -1,20 +1,22 @@
 name: CI | Publish gitlab repository package
+
 on: [push]
+
 jobs:
   pwa-microservices-template:
-    if: github.repository == 'underpostnet/pwa-microservices-template' && startsWith(github.event.head_commit.message, 'ci(package-pwa-microservices-template-ghpkg)')
+    if: github.repository == 'underpost/pwa-microservices-template'
     name: Update gitlab repo package Jobs
     runs-on: ubuntu-latest
+
     steps:
       - uses: actions/checkout@v7
         with:
           fetch-depth: 0
-          lfs: true
+
       - name: Push to GitLab
         run: |
-          git remote add gitlab https://oauth2:${{ secrets.GITLAB_TOKEN }}@gitlab.com/underpostnet/pwa-microservices-template.git
-          git lfs install
-          git lfs fetch --all
-          git lfs push --all gitlab
+          git remote add gitlab https://oauth2:${{ secrets.GITLAB_TOKEN }}@gitlab.com/underpost/pwa-microservices-template.git
+          git config user.name 'underpostnet'
+          git config user.email 'development@underpost.net'
           git push gitlab HEAD:main --force
           git push gitlab --force --tags

package/.github/workflows/hardhat.ci.yml

@@ -20,8 +20,11 @@ jobs:
     if: |
       github.actor != 'dependabot[bot]' &&
       (github.repository == 'underpostnet/engine-cyberia' ||
+       github.repository == 'underpost/engine-cyberia' ||
        github.repository == 'underpostnet/engine-ghpkg-cyberia' ||
-       github.repository == 'underpostnet/engine-test-cyberia')
+       github.repository == 'underpost/engine-ghpkg-cyberia' ||
+       github.repository == 'underpostnet/engine-test-cyberia' ||
+       github.repository == 'underpost/engine-test-cyberia')
     runs-on: ubuntu-latest
     defaults:
       run:

package/.github/workflows/npmpkg.ci.yml

@@ -25,7 +25,7 @@ permissions:
 jobs:
   pwa-microservices-template:
     if: |
-      github.repository == 'underpostnet/engine'
+      (github.repository == 'underpostnet/engine' || github.repository == 'underpost/engine')
       && (
         startsWith(github.event.head_commit.message, 'ci(package-pwa-microservices-template')
         || github.event_name == 'workflow_dispatch'
@@ -100,10 +100,14 @@ jobs:
             node ../engine/bin push . underpostnet/pwa-microservices-template
           fi
 
+      # A failed dispatch fails the run: its success is what the organization mirror waits on.
       - name: Dispatch all engine CIs
+        env:
+          # Never interpolated into the script: a dispatch input is free text.
+          DEPLOY_CONF_ID: ${{ github.event.inputs.deploy_conf_id }}
+          DEPLOY_TYPE: ${{ github.event.inputs.deploy_type }}
+          GIT_AUTH_TOKEN: ${{ secrets.GIT_AUTH_TOKEN }}
         run: |
-          DEPLOY_CONF_ID="${{ github.event.inputs.deploy_conf_id }}"
-          DEPLOY_TYPE="${{ github.event.inputs.deploy_type }}"
           for ENGINE in engine-core engine-prototype engine-cyberia engine-lampp engine-test; do
             SYNC="false"
             DT=""
@@ -120,9 +124,9 @@ jobs:
               if (process.env.MSG) i.message = process.env.MSG;
               process.stdout.write(JSON.stringify({ ref: "master", inputs: i }));
             ')
-            curl -s -X POST \
+            curl -sS -f -X POST \
               -H "Accept: application/vnd.github.v3+json" \
-              -H "Authorization: token ${{ secrets.GIT_AUTH_TOKEN }}" \
+              -H "Authorization: token ${GIT_AUTH_TOKEN}" \
               "https://api.github.com/repos/underpostnet/engine/actions/workflows/${ENGINE}.ci.yml/dispatches" \
               -d "$PAYLOAD"
           done

package/.github/workflows/publish.ci.yml

@@ -9,8 +9,9 @@ permissions:
   id-token: write
 jobs:
   build-and-publish:
-    # prevents this action from running on forks
-    if: github.repository == 'underpostnet/pwa-microservices-template'
+    # The unscoped `underpost` package has one publisher: a version can be published once, and
+    # the organization mirror publishes the owner-scoped package from its ghpkg repository.
+    if: (github.repository == 'underpostnet/pwa-microservices-template' || github.repository == 'underpost/pwa-microservices-template')
     runs-on: ubuntu-latest
     permissions:
       contents: write
@@ -42,12 +43,15 @@ jobs:
           curl -s -f -X POST \
             -H "Accept: application/vnd.github.v3+json" \
             -H "Authorization: token ${{ secrets.GIT_AUTH_TOKEN }}" \
-            "https://api.github.com/repos/underpostnet/pwa-microservices-template/actions/workflows/release.cd.yml/dispatches" \
+            "https://api.github.com/repos/${{ github.repository }}/actions/workflows/release.cd.yml/dispatches" \
             -d '{"ref":"master"}'
 
   build-and-publish-ghpkg:
-    # prevents this action from running on forks
-    if: github.repository == 'underpostnet/pwa-microservices-template-ghpkg'
+    # The scoped package takes the repository owner as its scope, so the personal account and the
+    # organization mirror each publish their own; any other owner is a fork.
+    if: >-
+      github.event.repository.name == 'pwa-microservices-template-ghpkg' &&
+      contains(fromJSON('["underpostnet","underpost"]'), github.repository_owner)
     runs-on: ubuntu-latest
     permissions:
       contents: write
@@ -60,11 +64,17 @@ jobs:
         with:
           node-version: '24.x'
           registry-url: 'https://registry.npmjs.org'
-          scope: '@underpostnet'
+          scope: '@${{ github.repository_owner }}'
 
       - name: Install Dependencies
         run: npm ci
 
+      # The committed manifest names the personal account. Provenance is refused when the
+      # manifest's repository differs from the one the workflow runs in, and GitHub Packages
+      # accepts only the owner's scope, so both follow the owner here — a no-op on the source.
+      - name: Align the package identity with the repository owner
+        run: node bin package --rename "@${{ github.repository_owner }}/underpost" --set-repo "${{ github.repository }}"
+
       - name: Publish to npm
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
@@ -75,13 +85,12 @@ jobs:
         with:
           node-version: '24.x'
           registry-url: 'https://npm.pkg.github.com'
-          scope: '@underpostnet'
+          scope: '@${{ github.repository_owner }}'
 
       - name: Publish to GitHub Packages
-        run: |
-          npm config set //npm.pkg.github.com/:_authToken=${{ secrets.GIT_AUTH_TOKEN }}
-          echo "//npm.pkg.github.com/:_authToken=${{ secrets.GIT_AUTH_TOKEN }}" > ~/.npmrc
-          echo "@underpostnet:registry=https://npm.pkg.github.com" >> ~/.npmrc
-          npm publish
         env:
           NODE_AUTH_TOKEN: ${{ secrets.GIT_AUTH_TOKEN }}
+        run: |
+          echo "//npm.pkg.github.com/:_authToken=${NODE_AUTH_TOKEN}" > ~/.npmrc
+          echo "@${{ github.repository_owner }}:registry=https://npm.pkg.github.com" >> ~/.npmrc
+          npm publish

package/.github/workflows/publish.cyberia.ci.yml

@@ -9,8 +9,9 @@ permissions:
   id-token: write
 jobs:
   build-and-publish:
-    # prevents this action from running on forks
-    if: github.repository == 'underpostnet/engine-cyberia'
+    # The unscoped `cyberia` package has one publisher: a version can be published once, and the
+    # organization mirror publishes the owner-scoped package from its ghpkg repository.
+    if: (github.repository == 'underpostnet/engine-cyberia' || github.repository == 'underpost/engine-cyberia')
     runs-on: ubuntu-latest
     permissions:
       contents: write
@@ -60,8 +61,11 @@ jobs:
         run: npm publish --provenance --access public
 
   build-and-publish-ghpkg:
-    # prevents this action from running on forks
-    if: github.repository == 'underpostnet/engine-ghpkg-cyberia'
+    # The scoped package takes the repository owner as its scope, so the personal account and the
+    # organization mirror each publish their own; any other owner is a fork.
+    if: >-
+      github.event.repository.name == 'engine-ghpkg-cyberia' &&
+      contains(fromJSON('["underpostnet","underpost"]'), github.repository_owner)
     runs-on: ubuntu-latest
     permissions:
       contents: write
@@ -74,15 +78,22 @@ jobs:
         with:
           node-version: '24.x'
           registry-url: 'https://registry.npmjs.org'
-          scope: '@underpostnet'
+          scope: '@${{ github.repository_owner }}'
 
       - name: Install Dependencies
         run: npm ci
 
+      # The committed manifest names the personal account. Provenance is refused when the
+      # manifest's repository differs from the one the workflow runs in, and GitHub Packages
+      # accepts only the owner's scope, so both follow the owner here — a no-op on the source.
+      - name: Align the package identity with the repository owner
+        run: node bin package --rename "@${{ github.repository_owner }}/cyberia" --set-repo "${{ github.repository }}"
+
       # The repository declares the engine's runtime dependencies because it runs the engine
-      # source it ships; a registry consumer gets them through `underpost` instead. This restores
-      # the manifest the package published before that split, and only in the tarball — after
-      # `npm ci`, so the lockfile the checkout installs from is the repository's own.
+      # source it ships; a registry consumer gets them through `@underpost/underpost` instead,
+      # because the scoped package is what GitHub Packages resolves. This restores the manifest
+      # the package published before that split, and only in the tarball — after `npm ci`, so
+      # the lockfile the checkout installs from is the repository's own.
       - name: Restore the published dependency set
         run: |
           node --input-type=module -e '
@@ -93,6 +104,7 @@ jobs:
             const published = publishedProductPackageJson({
               packageJson,
               catalog: await loadDeployCatalog("dd-cyberia"),
+              underpostPackageName: "@${{ github.repository_owner }}/underpost",
             });
             fs.writeFileSync("./package.json", JSON.stringify(published, null, DEPLOY_MANIFEST_INDENT) + "\n", "utf8");
             console.log("published manifest", {
@@ -111,13 +123,12 @@ jobs:
         with:
           node-version: '24.x'
           registry-url: 'https://npm.pkg.github.com'
-          scope: '@underpostnet'
+          scope: '@${{ github.repository_owner }}'
 
       - name: Publish to GitHub Packages
-        run: |
-          npm config set //npm.pkg.github.com/:_authToken=${{ secrets.GIT_AUTH_TOKEN }}
-          echo "//npm.pkg.github.com/:_authToken=${{ secrets.GIT_AUTH_TOKEN }}" > ~/.npmrc
-          echo "@underpostnet:registry=https://npm.pkg.github.com" >> ~/.npmrc
-          npm publish
         env:
           NODE_AUTH_TOKEN: ${{ secrets.GIT_AUTH_TOKEN }}
+        run: |
+          echo "//npm.pkg.github.com/:_authToken=${NODE_AUTH_TOKEN}" > ~/.npmrc
+          echo "@${{ github.repository_owner }}:registry=https://npm.pkg.github.com" >> ~/.npmrc
+          npm publish

package/.github/workflows/pwa-microservices-template-page.cd.yml

@@ -17,7 +17,7 @@ concurrency:
 
 jobs:
   deploy:
-    if: github.repository == 'underpostnet/pwa-microservices-template-ghpkg'
+    if: (github.repository == 'underpostnet/pwa-microservices-template-ghpkg' || github.repository == 'underpost/pwa-microservices-template-ghpkg')
     environment:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}
@@ -33,6 +33,8 @@ jobs:
       #   run: git lfs checkout
 
       - name: Build the site
+        env:
+          GITHUB_USERNAME: ${{ github.repository_owner }}
         run: bash deploy/pwa-microservices-template/deploy.sh
       # git lfs install
       # git lfs track
@@ -44,7 +46,7 @@ jobs:
         uses: actions/upload-pages-artifact@v5
         with:
           # Upload entire repository
-          path: './public/underpostnet.github.io/pwa-microservices-template-ghpkg/'
+          path: './public/${{ github.repository_owner }}.github.io/pwa-microservices-template-ghpkg/'
       - name: Deploy to GitHub Pages
         id: deployment
         uses: actions/deploy-pages@v5