@underpostnet/cyberia 3.3.76 → 3.4.0

package/package.json

@@ -2,7 +2,7 @@
     "type": "module",
     "main": "src/index.js",
     "name": "@underpostnet/cyberia",
-    "version": "3.3.76",
+    "version": "3.4.0",
     "description": "Cyberia CLI — toolchain for the Cyberia MMO data layer, content pipeline, persistence, gRPC services, and ERC-1155 lifecycle on Hyperledger Besu.",
     "scripts": {
         "start": "node --max-old-space-size=8192 src/server",
@@ -18,14 +18,17 @@
         "docs": "typedoc --options typedoc.json",
         "install:global": "npm install -g prettier",
         "install:test": "npm install -g coveralls-next",
-        "install": "npm run install:global && npm run install:test",
+        "install:tools": "npm run install:global && npm run install:test",
+        "prepare": "node bin socketsecurity --patch-apply",
         "prettier": "prettier --write .",
         "fix": "npm audit fix --force && npm audit",
         "baremetal": "node bin baremetal --dev --commission --ls --create-machine",
         "security:secrets": "gitleaks detect --source . --config .gitleaks.toml --report-path ./gitleaks-report.json --report-format json --redact=0",
         "security:secrets:ci": "gitleaks detect --source . --config .gitleaks.toml --redact=1",
         "security:deps": "npm audit",
-        "security": "npm run security:secrets:ci && npm run security:deps",
+        "security:socket": "node bin socketsecurity --audit",
+        "security:socket:ci": "node bin socketsecurity --ci",
+        "security": "npm run security:secrets:ci && npm run security:deps && npm run security:socket",
         "docker:generate": "node bin docker-compose --generate --deploy-id dd-cyberia --docker-compose-id cyberia",
         "docker:up": "node bin docker-compose --up --deploy-id dd-cyberia --docker-compose-id cyberia",
         "docker:up:build": "node bin docker-compose --up --build --deploy-id dd-cyberia --docker-compose-id cyberia",
@@ -72,7 +75,7 @@
     },
     "homepage": "https://github.com/underpostnet/engine-cyberia#readme",
     "dependencies": {
-        "underpost": "^3.3.76",
+        "@underpostnet/underpost": "^3.4.0",
         "maxrects-packer": "^2.7.3",
         "pngjs": "^7.0.0",
         "jimp": "^1.6.0",
@@ -89,7 +92,7 @@
         "minimatch": "^10.2.2",
         "glob": "^11.0.0",
         "diff": ">=8.0.3",
-        "js-yaml": "$js-yaml",
+        "js-yaml": "^5.4.1",
         "debug": ">=4.3.6",
         "serialize-javascript": ">=7.0.5",
         "router": {
@@ -105,12 +108,8 @@
         "@grpc/grpc-js": "^1.14.4",
         "@grpc/proto-loader": "^0.8.1",
         "@neodrag/vanilla": "^2.3.1",
-        "@vitest/coverage-v8": "5.0.0",
         "ag-grid-community": "^36.1.0",
-        "allure-vitest": "3.12.0",
         "axios": "^1.20.0",
-        "bumpp": "^12.3.0",
-        "chai": "^6.2.2",
         "clipboardy": "^5.3.2",
         "cloudinary": "^2.11.0",
         "colors": "^1.4.0",
@@ -119,11 +118,10 @@
         "cookie-parser": "^1.4.7",
         "cors": "^2.8.6",
         "d3": "^7.9.0",
-        "dexie": "^4.4.5",
+        "dexie": "^4.4.6",
         "dotenv": "^17.4.2",
         "easymde": "^2.21.0",
         "esbuild": "^0.28.2",
-        "escape-string-regexp": "^5.0.0",
         "express": "^5.2.1",
         "express-fileupload": "^1.4.3",
         "express-rate-limit": "^8.7.0",
@@ -142,15 +140,14 @@
         "jsonwebtoken": "^9.0.3",
         "jszip": "^3.10.2",
         "mariadb": "^3.5.4",
-        "marked": "^18.0.11",
-        "mongoose": "^9.9.5",
+        "marked": "^18.0.12",
+        "mongoose": "^9.10.0",
         "morgan": "^1.12.0",
-        "nodemailer": "^10.0.0",
+        "nodemailer": "^10.0.3",
         "nodemon": "^3.0.1",
         "peer": "^1.0.2",
         "peerjs": "^1.5.5",
         "prom-client": "^15.1.2",
-        "read": "^6.0.0",
         "rrule": "^2.8.1",
         "shelljs": "^0.10.0",
         "sitemap": "^9.0.1",
@@ -163,7 +160,6 @@
         "typescript": "6.0.3",
         "validator": "^13.15.35",
         "vanilla-jsoneditor": "^3.13.0",
-        "vitest": "5.0.0",
         "winston": "^3.19.0",
         "workbox-background-sync": "^7.4.1",
         "workbox-cacheable-response": "^7.4.1",
@@ -171,6 +167,12 @@
         "workbox-expiration": "^7.4.1",
         "workbox-precaching": "^7.4.1",
         "workbox-routing": "^7.4.1",
-        "workbox-strategies": "^7.4.1"
+        "workbox-strategies": "^7.4.1",
+        "@socketsecurity/cli": "1.1.171",
+        "@vitest/coverage-v8": "5.0.0",
+        "allure-vitest": "3.12.1",
+        "bumpp": "^12.3.0",
+        "chai": "^6.2.2",
+        "vitest": "5.0.0"
     }
 }

package/scripts/test-monitor.sh

@@ -24,7 +24,7 @@ MODE=runtime                                  # runtime | instance
 ENV=development                               # development | production
 DEPLOY_ID=dd-test                             # deploy id (instance mode: parent of conf.instances.json)
 INSTANCE_IDS=                                 # instance mode: csv of ids (default: all in conf.instances.json)
-IMAGE=underpost/wp:v3.3.76                    # runtime mode image (instance mode reads image from conf)
+IMAGE=underpost/wp:v3.4.0                    # runtime mode image (instance mode reads image from conf)
 VERSIONS=green                                # csv of blue/green versions
 REPLICAS=1                                    # replicas per deployment
 NAMESPACE=default                             # k8s namespace

package/src/api/file/file.router.js

@@ -4,7 +4,7 @@ import { FileController } from './file.controller.js';
 
 class FileRouter {
   /**
-   * authenticated writes, admin-only deletes.
+   * authenticated writes, admin-only deletes and full listing.
    * @param {import('../types.js').RouterOptions} options
    * @returns {import('express').Router}
    */
@@ -13,6 +13,12 @@ class FileRouter {
     router.post(`/:id`, options.authMiddleware, async (req, res) => await FileController.post(req, res, options));
     router.post(`/`, options.authMiddleware, async (req, res) => await FileController.post(req, res, options));
     router.get(`/blob/:id`, async (req, res) => await FileController.get(req, res, options));
+    router.get(
+      `/all`,
+      options.authMiddleware,
+      adminGuard,
+      async (req, res) => await FileController.get(req, res, options),
+    );
     router.get(`/:id`, async (req, res) => await FileController.get(req, res, options));
     router.get(`/`, async (req, res) => await FileController.get(req, res, options));
     router.delete(

package/src/cli/baremetal.js

@@ -3389,7 +3389,7 @@ fi
         throw new Error('Invalid token format');
       }
 
-      logger.info('Maas api token generated', { consumer_key, consumer_secret, token_key, token_secret });
+      logger.info('Maas api token generated', { consumer_key, token_key });
       return { consumer_key, consumer_secret, token_key, token_secret };
     },
 

package/src/cli/cluster.js

@@ -36,6 +36,13 @@ import os from 'os';
 import fs from 'fs-extra';
 import Underpost from '../index.js';
 
+/**
+ * @constant CERT_MANAGER_VERSION
+ * @description Pinned cert-manager chart version.
+ * @memberof UnderpostCluster
+ */
+const CERT_MANAGER_VERSION = 'v1.17.0';
+
 const logger = loggerFactory(import.meta);
 
 const GATEWAY_API_RELEASE = 'v1.5.1';
@@ -670,22 +677,12 @@ EOF
         }
       }
 
-      if (options.certManager) {
-        if (!Underpost.kubectl.get('cert-manager').find((p) => p.STATUS === 'Running')) {
-          shellExec(`helm repo add jetstack https://charts.jetstack.io --force-update`);
-          shellExec(
-            `helm install cert-manager jetstack/cert-manager \
---namespace cert-manager \
---create-namespace \
---version v1.17.0 \
---set crds.enabled=true`,
-          );
-        }
-
-        const letsEncName = 'letsencrypt-prod';
-        shellExec(`sudo kubectl delete ClusterIssuer ${letsEncName} --ignore-not-found`);
-        shellExec(`sudo kubectl apply -f ${underpostRoot}/manifests/${letsEncName}.yaml -n ${options.namespace}`);
-      }
+      if (options.certManager)
+        Underpost.cluster.installCertManager({
+          namespace: options.namespace,
+          env: options.dev ? 'development' : 'production',
+          solver: Underpost.cluster.acmeSolverFactory({ options, presence: Underpost.cluster.ingressStackPresence() }),
+        });
     },
 
     /**
@@ -1100,6 +1097,57 @@ EOF
       return true;
     },
 
+    /**
+     * @method acmeSolverFactory
+     * @description Which ingress stack answers the HTTP-01 challenge.
+     *
+     * Read from the cluster, like {@link UnderpostCluster.ingressStackPresence}: the
+     * `cluster` runner installs the issuer in a separate invocation that carries no stack
+     * flag, so the flags alone would always name the Contour solver. `--contour` is the
+     * only explicit override; a cluster with the Gateway API data plane installed routes
+     * every hostname through it, so an Ingress solver there is unreachable.
+     * @param {object} params
+     * @param {object} [params.options] - Cluster init options.
+     * @param {{contour: boolean, gateway: boolean}} params.presence - Installed stacks.
+     * @returns {'gateway'|'ingress'} Solver kind.
+     * @memberof UnderpostCluster
+     */
+    acmeSolverFactory({ options = {}, presence }) {
+      if (options.contour === true && options.gatewayApi !== true) return 'ingress';
+      return options.gatewayApi === true || presence.gateway ? 'gateway' : 'ingress';
+    },
+
+    /**
+     * @method installCertManager
+     * @description Installs or upgrades cert-manager and applies the Let's Encrypt
+     * ClusterIssuer for the stack in use.
+     *
+     * `upgrade --install` rather than a one-time install: the Gateway API solver is
+     * ignored by a controller that was not started with `enableGatewayAPI`, so a cluster
+     * whose cert-manager predates the Gateway API migration must be re-configured, not
+     * skipped because a pod is Running. The version is pinned, so on a cluster already at
+     * it the upgrade is a no-op.
+     * @param {object} params
+     * @param {string} [params.namespace] - Namespace the deploys' Gateways live in.
+     * @param {string} [params.env] - Environment the routed deploys publish under.
+     * @param {'gateway'|'ingress'} params.solver - Which stack answers the challenge.
+     * @returns {{solver: string, parentRefs: Array<{name: string, namespace: string}>}} What was applied.
+     * @memberof UnderpostCluster
+     */
+    installCertManager({ namespace = 'default', env = 'production', solver }) {
+      const gatewayValues =
+        solver === 'gateway'
+          ? ' --set config.apiVersion=controller.config.cert-manager.io/v1alpha1' +
+            ' --set config.kind=ControllerConfiguration --set config.enableGatewayAPI=true'
+          : '';
+      shellExec(`helm repo add jetstack https://charts.jetstack.io --force-update`);
+      shellExec(
+        `helm upgrade --install cert-manager jetstack/cert-manager --namespace cert-manager --create-namespace` +
+          ` --version ${CERT_MANAGER_VERSION} --set crds.enabled=true${gatewayValues} --wait --timeout 5m`,
+      );
+      return Underpost.deploy.applyLetsEncryptIssuer({ solver, namespace, env });
+    },
+
     /**
      * @method ingressStackPresence
      * @description Which ingress data planes are installed right now.
@@ -1358,14 +1406,21 @@ EOF
       }
 
       try {
-        shellExec(`kubectl apply -f - -n ${namespace} <<'EOF'
+        // The manifest carries the whole nginx.conf: echoing it as the command line
+        // buries the lines that follow it — the fallback probes above all — under
+        // a page of routing tables on every sync.
+        logger.info('Applying the underpost ingress manifests', { namespace, node: ingressNode });
+        shellExec(
+          `kubectl apply -f - -n ${namespace} <<'EOF'
 ${underpostIngressManifestsFactory({
   namespace,
   conf,
   nodeName: ingressNode,
 })}
 EOF
-`);
+`,
+          { disableLog: true },
+        );
       } catch (error) {
         if (shouldHotReload)
           execIngress(`sh -c 'cp /tmp/nginx.previous.conf /tmp/nginx.conf && nginx -s reload -c /tmp/nginx.conf'`, {

package/src/cli/deploy.js

@@ -50,6 +50,8 @@ import nodePath from 'node:path';
 import dotenv from 'dotenv';
 import os from 'node:os';
 import crypto from 'node:crypto';
+import { fileURLToPath } from 'node:url';
+import { dump as yamlDump, load as yamlLoad } from 'js-yaml';
 import { appSecretName } from './app.js';
 import { domainContextFactory } from './domains.js';
 import Underpost from '../index.js';
@@ -93,6 +95,23 @@ const UPSTREAM_FAILURE_STATUSES = [502, 503, 504];
 
 const CONTAINER_ENGINE_ROOT = '/home/dd/engine';
 
+/**
+ * @constant LETSENCRYPT_ISSUER_NAME
+ * @description The ClusterIssuer every generated Certificate references.
+ * @memberof UnderpostDeploy
+ */
+const LETSENCRYPT_ISSUER_NAME = 'letsencrypt-prod';
+
+/**
+ * @constant LETSENCRYPT_ISSUER_MANIFEST
+ * @description Base ClusterIssuer manifest: account, ACME server and key Secret. Resolved
+ * from this module so an installed CLI and a checkout read the same file.
+ * @memberof UnderpostDeploy
+ */
+const LETSENCRYPT_ISSUER_MANIFEST = fileURLToPath(
+  new URL(`../../manifests/${LETSENCRYPT_ISSUER_NAME}.yaml`, import.meta.url),
+);
+
 // The manifest set `deploy --build-manifest` produces for one environment.
 const DEFAULT_MANIFEST_FILES = [
   'deployment.yaml',
@@ -255,12 +274,68 @@ ${buildKindPorts(fromPort, toPort)}`;
           : Underpost.deploy.trafficServiceYamlFactory({ deployId, env, traffic, namespace, fromPort, toPort });
       const escaped = `${deployId}-${env}`.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
       manifest = manifest.replace(new RegExp(`app: ${escaped}-(?:blue|green)`), `app: ${deployId}-${env}-${traffic}`);
-      shellExec(`kubectl apply -f - -n ${namespace} <<'EOF'
+      logger.info('Applying the traffic Service', { deployId, env, traffic, namespace });
+      shellExec(
+        `kubectl apply -f - -n ${namespace} <<'EOF'
 ${manifest}
 EOF
-`);
+`,
+        { disableLog: true },
+      );
       return Underpost.deploy.trafficServiceNameFactory({ deployId, env });
     },
+    /**
+     * Removes the Gateway API objects an earlier model of this deploy left behind, so
+     * they stop competing with the consolidated `<deployId>-<env>` Gateway.
+     *
+     * The per-host model emitted one Gateway and one `<host>-http3` ClientTrafficPolicy
+     * per hostname. Left in place they duplicate that hostname's listeners in the same
+     * merged set, and the oldest resource retains traffic. `undefined` / `undefined-http3`
+     * is the same problem under a different name: the consolidated objects were briefly
+     * emitted with an unresolved host in their metadata, and merged listeners are
+     * configured by the oldest policy that targets them.
+     *
+     * The namespace is listed once and only objects that exist are deleted: a sweep that
+     * issued a blind delete per host per kind spent two dozen `kubectl` round-trips per
+     * sync on names that were gone after the first migration, and buried the one line
+     * that mattered when something was actually removed.
+     * @param {object} params
+     * @param {string[]} params.hosts - Hostnames the deploy's `conf.server.json` declares.
+     * @param {string} params.namespace - Namespace the deploy's Gateway objects live in.
+     * @returns {{gateways: string[], policies: string[]}} Names removed, per kind.
+     * @memberof UnderpostDeploy
+     */
+    sweepLegacyGatewayObjects({ hosts = [], namespace = 'default' }) {
+      const existing = (kind) =>
+        new Set(
+          `${
+            shellExec(`kubectl get ${kind} -n ${namespace} -o name --ignore-not-found`, {
+              stdout: true,
+              silent: true,
+              silentOnError: true,
+              disableLog: true,
+            }) ?? ''
+          }`
+            .split('\n')
+            .map((line) => line.trim().split('/').pop())
+            .filter(Boolean),
+        );
+      const legacy = [...new Set(hosts.filter(Boolean)), 'undefined'];
+      const gateways = existing('Gateway');
+      const policies = existing('ClientTrafficPolicy');
+      const removed = {
+        gateways: legacy.filter((name) => gateways.has(name)),
+        policies: legacy.map((name) => `${name}-http3`).filter((name) => policies.has(name)),
+      };
+      for (const name of removed.gateways)
+        shellExec(`sudo kubectl delete Gateway ${name} -n ${namespace} --ignore-not-found`);
+      for (const name of removed.policies)
+        shellExec(`sudo kubectl delete ClientTrafficPolicy ${name} -n ${namespace} --ignore-not-found`);
+      if (removed.gateways.length > 0 || removed.policies.length > 0)
+        logger.warn('Legacy per-host Gateway API objects removed', { namespace, ...removed });
+      return removed;
+    },
+
     /**
      * Removes the route kind owned by the inactive ingress stack. The active
      * route is already published before this runs, so migration never creates a
@@ -1112,6 +1187,125 @@ spec:
     kind: ClusterIssuer
   secretName: ${host}`;
     },
+
+    /**
+     * The Gateways an ACME HTTP-01 challenge route must attach to: every Gateway the
+     * namespace holds now, plus the one each routed deploy publishes under, whether or
+     * not it exists yet. A challenge HTTPRoute lists them all as parents; the data plane
+     * attaches it to whichever one carries a listener for the challenged hostname, and
+     * reports the rest as unmatched, which is harmless.
+     *
+     * The union rather than either side alone: the live list covers Gateways a deploy
+     * outside `dd.routes` created, the route table covers a deploy that has not been
+     * applied yet — an issuer that only knew the live list would have to be re-applied
+     * after every first deploy before that deploy's certificate could issue.
+     * @param {object} params
+     * @param {string} [params.namespace] - Namespace the Gateways live in.
+     * @param {string} [params.env] - Environment the routed deploys publish under.
+     * @returns {Array<{name: string, namespace: string}>} Parent references, sorted by name.
+     * @memberof UnderpostDeploy
+     */
+    acmeGatewayParentRefsFactory({ namespace = 'default', env = 'production' } = {}) {
+      const live = `${
+        shellExec(`kubectl get gateway -n ${namespace} -o name --ignore-not-found`, {
+          stdout: true,
+          silent: true,
+          silentOnError: true,
+          disableLog: true,
+        }) ?? ''
+      }`
+        .split('\n')
+        .map((line) => line.trim().split('/').pop())
+        .filter(Boolean);
+      const routed = readDeployRoutes().map((deployId) => Underpost.deploy.gatewayNameFactory({ deployId, env }));
+      return [...new Set([...live, ...routed])].sort().map((name) => ({ name, namespace }));
+    },
+
+    /**
+     * Renders the Let's Encrypt ClusterIssuer for the ingress stack that actually
+     * carries the HTTP-01 challenge.
+     *
+     * The base manifest fixes the account (email, ACME server, key Secret); only the
+     * solver is decided here. With the Gateway API stack, the challenge must be answered
+     * through an HTTPRoute on the deploy's Gateway: an `ingress`-class solver creates an
+     * Ingress nothing on the request path reads, so `/.well-known/acme-challenge/*` is
+     * routed by the application's own HTTPRoute to the workload — a 404 — or, with no
+     * workload behind it, to the maintenance fallback. Every renewal fails that way while
+     * the solver pods sit there ready, and the failure only surfaces when the certificate
+     * expires.
+     * @param {object} params
+     * @param {'gateway'|'ingress'} params.solver - Which stack answers the challenge.
+     * @param {Array<{name: string, namespace: string}>} [params.parentRefs] - Gateways for the `gateway` solver.
+     * @param {string} [params.basePath] - Base ClusterIssuer manifest.
+     * @returns {string} ClusterIssuer YAML.
+     * @throws {Error} When the Gateway solver is requested with no Gateway to attach to.
+     * @memberof UnderpostDeploy
+     */
+    letsEncryptIssuerYamlFactory({ solver, parentRefs = [], basePath = LETSENCRYPT_ISSUER_MANIFEST }) {
+      const issuer = yamlLoad(fs.readFileSync(basePath, 'utf8'));
+      if (solver === 'gateway') {
+        if (parentRefs.length === 0)
+          throw new Error('[cert-manager] the Gateway API HTTP-01 solver needs at least one Gateway parentRef');
+        issuer.spec.acme.solvers = [
+          {
+            http01: {
+              gatewayHTTPRoute: {
+                parentRefs: parentRefs.map(({ name, namespace }) => ({ name, namespace, kind: 'Gateway' })),
+              },
+            },
+          },
+        ];
+      } else issuer.spec.acme.solvers = [{ http01: { ingress: { class: 'contour' } } }];
+      return yamlDump(issuer, { lineWidth: -1, noRefs: true });
+    },
+
+    /**
+     * Whether the Let's Encrypt ClusterIssuer is installed. False both when it was never
+     * applied and when cert-manager's CRDs are absent, which is the same answer here.
+     * @returns {boolean}
+     * @memberof UnderpostDeploy
+     */
+    letsEncryptIssuerExists() {
+      return (
+        `${
+          shellExec(`kubectl get clusterissuer ${LETSENCRYPT_ISSUER_NAME} -o name --ignore-not-found`, {
+            stdout: true,
+            silent: true,
+            silentOnError: true,
+            disableLog: true,
+          }) ?? ''
+        }`.trim().length > 0
+      );
+    },
+
+    /**
+     * Applies the Let's Encrypt ClusterIssuer for the stack in use, so certificates keep
+     * renewing through whichever data plane the deploy's hostnames are served by.
+     * @param {object} params
+     * @param {'gateway'|'ingress'} params.solver - Which stack answers the challenge.
+     * @param {string} [params.namespace] - Namespace the Gateways live in.
+     * @param {string} [params.env] - Environment the routed deploys publish under.
+     * @param {string} [params.basePath] - Base ClusterIssuer manifest.
+     * @returns {{solver: string, parentRefs: Array<{name: string, namespace: string}>}} What was applied.
+     * @memberof UnderpostDeploy
+     */
+    applyLetsEncryptIssuer({ solver, namespace = 'default', env = 'production', basePath } = {}) {
+      const parentRefs = solver === 'gateway' ? Underpost.deploy.acmeGatewayParentRefsFactory({ namespace, env }) : [];
+      const manifest = Underpost.deploy.letsEncryptIssuerYamlFactory({ solver, parentRefs, basePath });
+      const stagePath = `/dev/shm/underpost-${LETSENCRYPT_ISSUER_NAME}.yaml`;
+      fs.writeFileSync(stagePath, manifest, 'utf8');
+      try {
+        shellExec(`sudo kubectl apply -f ${stagePath}`);
+      } finally {
+        fs.removeSync(stagePath);
+      }
+      logger.info("Let's Encrypt ClusterIssuer applied", {
+        issuer: LETSENCRYPT_ISSUER_NAME,
+        solver,
+        gateways: parentRefs.map(({ name }) => name),
+      });
+      return { solver, parentRefs };
+    },
     /**
      * Mirrors each deploy's built development manifests into the project tree, and refreshes the
      * public default configuration they belong to.
@@ -2341,34 +2535,15 @@ EOF`);
                 });
           }
 
-        for (const host of Object.keys(confServer)) {
-          if (!options.disableUpdateProxy) {
-            // The host's route object is left in place and replaced by the `apply`
-            // below. Deleting it first unpublished the hostname for the whole
-            // reconciliation window, so every promote dropped live requests before
-            // the new colour was ever the question.
-            //
-            // A deploy that previously ran the per-host model left a Gateway
-            // named after each host. Those are superseded by the consolidated
-            // one, and leaving them behind duplicates that hostname's listeners
-            // in the same merged set. The oldest resource would retain traffic.
-            //
-            // `undefined-http3` is the same problem under a different name: the
-            // consolidated policy was briefly emitted with an unresolved host in
-            // its metadata. Merged listeners are configured by the oldest policy
-            // that targets them, so that object outranks the correctly named one
-            // for as long as it exists.
-            if (options.gatewayApi)
-              for (const name of [host, 'undefined']) {
-                shellExec(`sudo kubectl delete Gateway ${name} -n ${namespace} --ignore-not-found`, { silent: true });
-                shellExec(`sudo kubectl delete ClientTrafficPolicy ${name}-http3 -n ${namespace} --ignore-not-found`, {
-                  silent: true,
-                });
-              }
-            if (Underpost.deploy.isCertManagerContext({ host, env, options }))
-              shellExec(`sudo kubectl delete Certificate ${host} -n ${namespace} --ignore-not-found`);
-          }
-        }
+        // The host's route object is left in place and replaced by the `apply`
+        // below. Deleting it first unpublished the hostname for the whole
+        // reconciliation window, so every promote dropped live requests before
+        // the new colour was ever the question.
+        if (!options.disableUpdateProxy && options.gatewayApi)
+          Underpost.deploy.sweepLegacyGatewayObjects({ hosts: Object.keys(confServer), namespace });
+        for (const host of Object.keys(confServer))
+          if (!options.disableUpdateProxy && Underpost.deploy.isCertManagerContext({ host, env, options }))
+            shellExec(`sudo kubectl delete Certificate ${host} -n ${namespace} --ignore-not-found`);
 
         const manifestsPath =
           env === 'production'
@@ -2480,6 +2655,11 @@ EOF`);
           }
 
           if (Underpost.deploy.isCertManagerContext({ host: Object.keys(confServer)[0], env, options })) {
+            // The issuer's challenge route must list this deploy's Gateway as a parent, or
+            // the certificates applied below can never issue. Re-rendered from the live
+            // Gateway list, so a deploy created after `cluster --cert-manager` is covered.
+            if (options.gatewayApi && Underpost.deploy.letsEncryptIssuerExists())
+              Underpost.deploy.applyLetsEncryptIssuer({ solver: 'gateway', namespace, env });
             const secretPath = `./${manifestsPath}/secret.yaml`;
             if (fs.existsSync(secretPath) && fs.readFileSync(secretPath, 'utf8').trim()) {
               shellExec(`sudo kubectl apply -f ${secretPath} -n ${namespace}`);
@@ -3143,3 +3323,4 @@ spec:
 }
 
 export default UnderpostDeploy;
+export { LETSENCRYPT_ISSUER_MANIFEST, LETSENCRYPT_ISSUER_NAME };

package/src/cli/docker-compose.js

@@ -192,7 +192,7 @@ services:
 MONGO_IMAGE=mongo:latest
 VALKEY_IMAGE=valkey/valkey:latest
 APP_IMAGE=underpost/underpost-engine
-APP_TAG=v3.3.76
+APP_TAG=v3.4.0
 PROXY_IMAGE=nginx:stable-alpine
 PROMETHEUS_IMAGE=prom/prometheus:latest
 GRAFANA_IMAGE=grafana/grafana:latest

package/src/cli/index.js

@@ -7,6 +7,7 @@ import { commitData } from '../client/components/core/CommonJs.js';
 import { registerDomainCommand } from './domains.js';
 import { TEST_TIERS, testSuiteNames } from '../server/build/testing.js';
 import { EXECUTION_PROFILES, profileFromOptionsFactory, setExecutionProfile } from '../server/build/execution.js';
+import { SEVERITIES } from '../server/security/socketsecurity.js';
 
 import Underpost from '../index.js';
 
@@ -1403,6 +1404,41 @@ program
   )
   .action(Underpost.package.callback);
 
+program
+  .command('socketsecurity')
+  .option(
+    '--audit',
+    "Audits the checkout (default). Dependency security: segregation, npm audit, the Socket patch scan and, with SOCKET_CLI_API_TOKEN set, the Socket full scan of the dependency manifests. Source code risk: with SOCKET_CLI_API_TOKEN set, the alerts Socket's registry analysis raises on this project's own published package, as refactoring tasks. Writes the JSON and Markdown reports.",
+  )
+  .option(
+    '--reach',
+    'Runs the full application reachability analysis over the local working tree with the Socket scan (tier 1 evidence); no pushed commit is needed.',
+  )
+  .option(
+    '--ci',
+    'Audits, then exits non-zero when the Socket scan violates the organization policy or a finding remains at --fail-on.',
+  )
+  .option('--fail-on <severity>', `Severity --ci fails at. One of: ${SEVERITIES.join(', ')}. Defaults to high.`)
+  .option(
+    '--fix',
+    'Runs the remediation pass before the audit: npm audit fix, every available Socket patch, socket fix without major upgrades, socket patch apply.',
+  )
+  .option('--major', 'With --fix: lets socket fix apply major upgrades.')
+  .option('--patch-scan', 'Lists the Socket patches available for the installed packages.')
+  .option(
+    '--patch-get <identifier>',
+    'Downloads one patch (UUID, CVE, GHSA or PURL) into .socket/manifest.json and applies it.',
+  )
+  .option('--patch-apply', 'Applies the patch manifest; the prepare hook. A host without the Socket CLI skips it.')
+  .option('--patch-setup', 'Installs the prepare hook in package.json.')
+  .option('--out <dir>', 'Report directory (default: security-reports).')
+  .option('--dry-run', 'Previews --patch-setup; verifies --patch-apply without writing.')
+  .description(
+    'Security audit through Socket.dev: dependency security (advisories, supply chain alerts, reachability, ' +
+      "security patches in .socket/manifest.json) and source code risk (alerts on this project's own code).",
+  )
+  .action(Underpost.socketSecurity.callback);
+
 program
   .command('release')
   .argument('[version]', 'The new version string to set (e.g., "3.1.4"). Defaults to current version.')

package/src/cli/kubectl.js

@@ -7,7 +7,7 @@
  */
 
 import { loggerFactory, redactSensitiveText } from '../server/ops/logger.js';
-import { shellExec, sleepSync } from '../server/runtime/process.js';
+import { shellArgumentFactory, shellExec, sleepSync } from '../server/runtime/process.js';
 import { timer } from '../client/components/core/CommonJs.js';
 import Underpost from '../index.js';
 
@@ -275,7 +275,8 @@ class UnderpostKubectl {
     },
 
     /**
-     * Runs a shell command inside a pod container via `kubectl exec`.
+     * Runs a shell command inside a pod container via `kubectl exec`. The command is quoted as one
+     * argument, so the pod's shell parses it and the host shell never expands it.
      * @param {object} params
      * @param {string} params.podName - Target pod name.
      * @param {string} params.namespace - Pod namespace.
@@ -287,7 +288,7 @@ class UnderpostKubectl {
      * @memberof UnderpostKubectl
      */
     exec({ podName, namespace, command, retries = DEFAULT_POD_RETRIES, timeoutSeconds = 0 }) {
-      const kubectlCmd = `sudo kubectl exec -n ${namespace} -i ${podName} -- sh -c "${command}"`;
+      const kubectlCmd = `sudo kubectl exec -n ${shellArgumentFactory(namespace)} -i ${shellArgumentFactory(podName)} -- sh -c ${shellArgumentFactory(command)}`;
       return Underpost.kubectl.run(kubectlCmd, {
         context: `exec in pod ${podName}`,
         retries,