@underpostnet/cyberia 3.3.76 → 3.4.0

package/test/unit/cyberia/instance-data.test.js

@@ -0,0 +1,314 @@
+import { describe, it, expect } from 'vitest';
+import {
+  buildCyberiaMmoInstanceEnv,
+  getInstanceModels,
+  parseRgba,
+  toEntityMsg,
+  toMapMsg,
+  toInstanceMsg,
+  toObjectLayerMsg,
+  toActionMsg,
+  toQuestMsg,
+  toInstanceConfig,
+  buildFallbackConfig,
+  pingData,
+  objectLayerQueryFilter,
+  fetchObjectLayerBatch,
+  fetchObjectLayer,
+  fetchMapData,
+  fetchObjectLayerManifest,
+  fetchFullInstance,
+  skillDocsToConfig,
+  entityTypeDefaultDocsToConfig,
+  mergeEntityDefaults,
+  itemTypesOf,
+} from '../../../src/projects/cyberia/instance-data.js';
+import {
+  CYBERIA_INSTANCE_CONF_DEFAULTS,
+  DEFAULT_DEAD_ITEM_ID,
+  ENTITY_TYPE_DEFAULTS,
+} from '../../../src/api/cyberia-server-defaults/cyberia-server-defaults.js';
+import { DEFAULT_INSTANCE_CODE } from '../../../src/client/components/cyberia/SharedDefaultsCyberia.js';
+
+const lean = (value) => ({ lean: async () => value, populate: () => lean(value) });
+
+describe('instance env', () => {
+  it('derives the server and client variables from the variant runtime', () => {
+    const server = buildCyberiaMmoInstanceEnv({
+      instance: { runtime: 'cyberia-server', path: '/forest', instanceCode: 'FOREST' },
+      env: { PORT: '4001' },
+    });
+    expect(server).toEqual({ PORT: '4001', INSTANCE_CODE: 'FOREST', CYBERIA_BASE_PATH: '/forest' });
+
+    const client = buildCyberiaMmoInstanceEnv({ instance: { runtime: 'cyberia-client', path: '/' } });
+    expect(client).toEqual({
+      CYBERIA_INSTANCE_CODE: DEFAULT_INSTANCE_CODE,
+      CYBERIA_DEFAULT_INSTANCE: DEFAULT_INSTANCE_CODE,
+      CYBERIA_BASE_PATH: '/',
+    });
+  });
+
+  it('leaves a runtime it does not know alone', () => {
+    expect(buildCyberiaMmoInstanceEnv({ instance: { runtime: 'nodejs', path: '/x' }, env: { A: '1' } })).toEqual({
+      A: '1',
+    });
+    expect(buildCyberiaMmoInstanceEnv({})).toEqual({});
+  });
+
+  it('names the context when no database provider was loaded for it', () => {
+    expect(() => getInstanceModels({ host: 'nowhere.test', path: '/' })).toThrow('nowhere.test');
+  });
+});
+
+describe('wire converters', () => {
+  it('parses css colours into wire components and treats anything else as transparent', () => {
+    expect(parseRgba('rgba(10, 20, 30, 0.5)')).toEqual({ r: 10, g: 20, b: 30, a: 128 });
+    expect(parseRgba('rgb(1,2,3)')).toEqual({ r: 1, g: 2, b: 3, a: 255 });
+    expect(parseRgba('')).toEqual({ r: 0, g: 0, b: 0, a: 0 });
+    expect(parseRgba('#ff0000')).toEqual({ r: 0, g: 0, b: 0, a: 0 });
+  });
+
+  it('fills every entity, map and instance field an empty document leaves out', () => {
+    const entity = toEntityMsg({});
+    expect(entity).toMatchObject({ entityType: 'floor', level: 0, dimX: 1, dimY: 1, objectLayerItemIds: [] });
+    expect(toEntityMsg({ level: 3, color: 'rgb(9,8,7)' })).toMatchObject({ level: 3, colorR: 9, colorB: 7 });
+
+    const map = toMapMsg({ _id: 'm1', entities: [{ entityType: 'bot' }] });
+    expect(map).toMatchObject({ mongoId: 'm1', gridX: 16, cellWidth: 32 });
+    expect(map.entities[0].entityType).toBe('bot');
+
+    const instance = toInstanceMsg({ _id: 'i1', portals: [{ sourceMapCode: 'a' }] });
+    expect(instance).toMatchObject({ mongoId: 'i1', topologyMode: 'hybrid', mapCodes: [] });
+    expect(instance.portals[0]).toMatchObject({ sourceMapCode: 'a', portalMode: 'inter-portal', targetCellX: 0 });
+    expect(instance.playerSpawn).toEqual({ sourceMapCode: '', sourceCellX: 0, sourceCellY: 0, random: false });
+  });
+
+  it('carries an object layer with its ledger and render, defaulting the ledger to off-chain', () => {
+    const msg = toObjectLayerMsg({ _id: 'o1', data: { item: { id: 'hatchet', type: 'weapon', activable: 1 } } });
+    expect(msg).toMatchObject({
+      mongoId: 'o1',
+      item: { id: 'hatchet', type: 'weapon', description: '', activable: true },
+      ledger: { type: 'OFF_CHAIN', address: '', tokenId: '' },
+      render: { cid: '', metadataCid: '' },
+      sha256: '',
+      cid: '',
+    });
+    expect(toObjectLayerMsg({ _id: 'o2' }).item.id).toBe('');
+  });
+
+  it('carries vendor, craft and quest content with their defaults', () => {
+    const action = toActionMsg({
+      code: 'shop',
+      shopItems: [{ itemId: 'hatchet' }],
+      craftRecipes: [{ outputItems: [{ itemId: 'plank' }], ingredients: [{ itemId: 'wood-1', qty: 2 }] }],
+      questDialogueCodes: [{ questCode: 'q1' }],
+    });
+    expect(action.shopItems[0]).toEqual({ itemId: 'hatchet', priceItemId: 'coin', priceQty: 1 });
+    expect(action.craftRecipes[0]).toEqual({
+      outputItems: [{ itemId: 'plank', qty: 1 }],
+      ingredients: [{ itemId: 'wood-1', qty: 2 }],
+      craftTimeMs: 0,
+    });
+    expect(action.questDialogueCodes[0]).toEqual({ questCode: 'q1', dialogCode: '' });
+    expect(toActionMsg({})).toMatchObject({ code: '', storageSlots: 0, shopItems: [] });
+
+    const quest = toQuestMsg({
+      code: 'q1',
+      steps: [{ id: 's1', objectives: [{ type: 'collect', itemId: 'wood-1' }] }],
+      rewards: [{ itemId: 'coin' }],
+    });
+    expect(quest.steps[0].objectives[0]).toEqual({ type: 'collect', itemId: 'wood-1', quantity: 1 });
+    expect(quest.rewards[0]).toEqual({ itemId: 'coin', quantity: 1 });
+    expect(toQuestMsg({})).toMatchObject({ code: '', steps: [], unlocksQuestCodes: [] });
+  });
+});
+
+describe('instance config', () => {
+  it('is the canonical defaults for a world without a conf', () => {
+    expect(toInstanceConfig(null)).toEqual(buildFallbackConfig());
+    expect(buildFallbackConfig()).toEqual(CYBERIA_INSTANCE_CONF_DEFAULTS);
+    expect(buildFallbackConfig()).not.toBe(CYBERIA_INSTANCE_CONF_DEFAULTS);
+  });
+
+  it('keeps every field a conf sets and fills the rest from the defaults', () => {
+    const config = toInstanceConfig({
+      tickRate: 5,
+      economyRules: { portalFee: 9 },
+      skillRules: { projectileWidth: 3, doppelgangerSpawnChance: 0.2 },
+      equipmentRules: { requireSkin: false },
+      lifeRegenChance: 7,
+    });
+    const fb = CYBERIA_INSTANCE_CONF_DEFAULTS;
+    expect(config.tickRate).toBe(5);
+    expect(config.snapshotRate).toBe(fb.snapshotRate);
+    expect(config.economyRules).toEqual({ ...fb.economyRules, portalFee: 9 });
+    expect(config.skillRules).toEqual({ ...fb.skillRules, projectileWidth: 3, doppelgangerSpawnChance: 0.2 });
+    expect(config.equipmentRules).toEqual({ ...fb.equipmentRules, requireSkin: false });
+    expect(config.lifeRegenChance).toBe(fb.lifeRegenChance);
+    expect(config.skillConfig).toEqual([]);
+    expect(config.entityDefaults.map(({ entityType }) => entityType)).toEqual(
+      ENTITY_TYPE_DEFAULTS.map(({ entityType }) => entityType),
+    );
+  });
+
+  it('shapes skill and entity-type documents for the wire and drops the ones without a key', () => {
+    expect(skillDocsToConfig([{ triggerItemId: 'gun', skills: [{ logicEventId: 'projectile' }] }, {}, null])).toEqual([
+      {
+        triggerItemId: 'gun',
+        skills: [{ logicEventId: 'projectile', name: '', description: '', summonedEntityItemId: '' }],
+      },
+    ]);
+    expect(
+      entityTypeDefaultDocsToConfig([{ entityType: 'bot', liveItemIds: ['x'] }, { liveItemIds: ['y'] }]),
+    ).toMatchObject([{ entityType: 'bot', liveItemIds: ['x'], deadItemIds: [] }]);
+  });
+
+  it('completes a partial set of entity defaults with the canonical types it does not cover', () => {
+    const merged = mergeEntityDefaults([{ entityType: 'bot', liveItemIds: ['ghost'] }], { ghost: 'skin' });
+    const bots = merged.filter(({ entityType }) => entityType === 'bot');
+    expect(bots).toHaveLength(1);
+    expect(bots[0].liveItemIds).toEqual(['ghost']);
+    expect(merged.some(({ entityType }) => entityType === 'player')).toBe(true);
+    expect(itemTypesOf([{ data: { item: { id: 'ghost', type: 'skin' } } }, { data: {} }, null])).toEqual({
+      ghost: 'skin',
+    });
+  });
+});
+
+describe('transport-agnostic fetchers', () => {
+  const ol = (id, type = 'skin') => ({ _id: `ol-${id}`, sha256: `sha-${id}`, data: { item: { id, type } } });
+
+  it('answers a ping with the server clock', () => {
+    expect(pingData().serverTimeMs).toBeGreaterThan(0);
+  });
+
+  it('filters object layers by item type only when one is asked for', async () => {
+    expect(objectLayerQueryFilter('')).toEqual({});
+    expect(objectLayerQueryFilter('skin')).toEqual({ 'data.item.type': 'skin' });
+    const filters = [];
+    const models = { ObjectLayer: { find: (filter) => (filters.push(filter), lean([ol('anon')])) } };
+    const batch = await fetchObjectLayerBatch(models, 'skin');
+    expect(filters).toEqual([{ 'data.item.type': 'skin' }]);
+    expect(batch.map(({ item }) => item.id)).toEqual(['anon']);
+  });
+
+  it('resolves one object layer by item id, or null', async () => {
+    const models = { ObjectLayer: { findOne: ({ 'data.item.id': id }) => lean(id === 'anon' ? ol('anon') : null) } };
+    expect((await fetchObjectLayer(models, 'anon')).mongoId).toBe('ol-anon');
+    expect(await fetchObjectLayer(models, 'ghost')).toBeNull();
+  });
+
+  it('lists the id and digest of every object layer', async () => {
+    const models = { ObjectLayer: { find: () => lean([ol('anon'), { _id: 'x' }]) } };
+    expect(await fetchObjectLayerManifest(models)).toEqual({
+      entries: [
+        { itemId: 'anon', sha256: 'sha-anon' },
+        { itemId: '', sha256: '' },
+      ],
+    });
+  });
+
+  it('serves a map and records which instance serves it, surviving a registry failure', async () => {
+    const registry = [];
+    const models = {
+      CyberiaMap: { findOne: ({ code }) => lean(code === 'forest-1' ? { _id: 'm1', code } : null) },
+      GlobalMapCodeRegistry: {
+        findOneAndUpdate: (filter, update) => {
+          registry.push({ filter, update });
+          return Promise.reject(new Error('registry down'));
+        },
+      },
+    };
+    expect(await fetchMapData(models, { mapCode: 'ghost' })).toBeNull();
+    expect(await fetchMapData(models, { mapCode: 'forest-1' })).toMatchObject({ map: { code: 'forest-1' } });
+    expect(registry).toEqual([]);
+    const served = await fetchMapData(models, { mapCode: 'forest-1', instanceCode: 'FOREST' });
+    expect(served.map.mongoId).toBe('m1');
+    expect(registry).toEqual([
+      { filter: { mapCode: 'forest-1' }, update: { instanceCode: 'FOREST', status: 'active' } },
+    ]);
+    await new Promise((resolve) => setImmediate(resolve));
+  });
+});
+
+describe('full world load', () => {
+  const ol = (id, type = 'skin') => ({ _id: `ol-${id}`, sha256: `sha-${id}`, data: { item: { id, type } } });
+
+  it('serves the procedural world, with the canonical content, when the instance is unknown', async () => {
+    const queries = [];
+    const models = {
+      CyberiaInstance: { findOne: () => lean(null) },
+      ObjectLayer: { find: (filter) => (queries.push(filter), lean([ol('anon'), ol(DEFAULT_DEAD_ITEM_ID)])) },
+    };
+    const world = await fetchFullInstance(models, '');
+    expect(world.instance.seed).toBe('default');
+    expect(world.maps.length).toBeGreaterThan(0);
+    expect(world.maps[0].entities[0]).toHaveProperty('colorA');
+    expect(world.objectLayers.map(({ item }) => item.id)).toEqual(['anon', DEFAULT_DEAD_ITEM_ID]);
+    expect(world.config.skillConfig.map(({ triggerItemId }) => triggerItemId)).toContain('atlas_pistol_mk2');
+    expect(world.actions.length).toBeGreaterThan(0);
+    expect(world.quests.length).toBeGreaterThan(0);
+    expect(world.version).toMatch(/^fallback-[0-9a-f]{64}$/);
+    // Every canonical item is asked for, so anything a player can pick up resolves an atlas.
+    const wanted = queries[0]['data.item.id'].$in;
+    expect(wanted).toContain('anon');
+    expect(wanted).toContain(DEFAULT_DEAD_ITEM_ID);
+
+    const again = await fetchFullInstance(models, '');
+    expect(again.version).toBe(world.version);
+  });
+
+  it('loads a stored world from its conf, maps, content and the skills its items trigger', async () => {
+    const conf = { _id: 'c1', instanceCode: 'FOREST', tickRate: 7, entityTypeDefaults: [], updatedAt: 't1' };
+    const models = {
+      CyberiaInstance: {
+        findOne: () => lean({ _id: 'i1', code: 'FOREST', cyberiaMapCodes: ['forest-1'], conf, updatedAt: 't0' }),
+      },
+      CyberiaMap: {
+        find: () => lean([{ _id: 'm1', code: 'forest-1', entities: [{ objectLayerItemIds: ['atlas_pistol_mk2'] }] }]),
+      },
+      CyberiaEntityTypeDefault: { find: () => lean([]) },
+      CyberiaAction: {
+        find: () => lean([{ code: 'shop', sourceMapCode: 'forest-1', shopItems: [{ itemId: 'hatchet' }] }]),
+      },
+      CyberiaQuest: { find: () => lean([{ code: 'q1', sourceMapCode: 'forest-1' }]) },
+      CyberiaSkill: { find: () => lean([]) },
+      ObjectLayer: {
+        find: ({ 'data.item.id': { $in } }) =>
+          lean(
+            ['atlas_pistol_mk2', 'hatchet', 'atlas_pistol_mk2_bullet']
+              .filter((id) => $in.includes(id))
+              .map((id) => ol(id)),
+          ),
+      },
+    };
+    const world = await fetchFullInstance(models, 'FOREST');
+    expect(world.instance.code).toBe('FOREST');
+    expect(world.config.tickRate).toBe(7);
+    // The map places the pistol and the vendor sells the hatchet: both trigger skills this world runs.
+    const triggers = world.config.skillConfig.map(({ triggerItemId }) => triggerItemId);
+    expect(triggers).toContain('atlas_pistol_mk2');
+    expect(triggers).toContain('hatchet');
+    // What the skill summons needs an atlas too.
+    expect(world.objectLayers.map(({ item }) => item.id)).toContain('atlas_pistol_mk2_bullet');
+    expect(world.objectLayers.map(({ item }) => item.id)).toContain('hatchet');
+    expect(world.actions[0].shopItems[0].itemId).toBe('hatchet');
+    expect(world.quests[0].code).toBe('q1');
+    expect(world.version).toMatch(/^[0-9a-f]{64}$/);
+  });
+
+  it('runs a world whose conf reference is gone on the canonical defaults', async () => {
+    const models = {
+      CyberiaInstance: { findOne: () => lean({ _id: 'i1', code: 'BARE', cyberiaMapCodes: [], conf: null }) },
+      CyberiaInstanceConf: { findOne: () => lean(null) },
+      CyberiaEntityTypeDefault: { find: () => lean([]) },
+      ObjectLayer: { find: () => lean([]) },
+    };
+    const world = await fetchFullInstance(models, 'BARE');
+    expect(world.config.tickRate).toBe(CYBERIA_INSTANCE_CONF_DEFAULTS.tickRate);
+    expect(world.maps).toEqual([]);
+    expect(world.actions).toEqual([]);
+    expect(world.quests).toEqual([]);
+    expect(world.objectLayers).toEqual([]);
+  });
+});

package/test/unit/deploy-legacy-gateway-sweep.test.js

@@ -0,0 +1,63 @@
+'use strict';
+
+import { expect } from 'chai';
+import shell from 'shelljs';
+import { vi } from 'vitest';
+import UnderpostDeploy from '../../src/cli/deploy.js';
+
+describe('deploy legacy Gateway API sweep', () => {
+  let commands;
+  let listed;
+
+  beforeEach(() => {
+    commands = [];
+    listed = { Gateway: '', ClientTrafficPolicy: '' };
+    vi.spyOn(shell, 'exec').mockImplementation((command) => {
+      commands.push(command);
+      const kind = command.match(/^kubectl get (\w+) /)?.[1];
+      const stdout = kind ? listed[kind] : '';
+      return { code: 0, stdout, stderr: '', toString: () => stdout };
+    });
+  });
+
+  afterEach(() => vi.restoreAllMocks());
+
+  const deletes = () => commands.filter((command) => command.includes('kubectl delete'));
+
+  it('lists each kind once and deletes nothing on a namespace that was already migrated', () => {
+    // Regression: the sweep deleted `Gateway <host>`, `Gateway undefined` and both
+    // `-http3` policies blind, once per host — two dozen no-op round-trips per sync.
+    listed.Gateway = 'gateway.gateway.networking.k8s.io/dd-prototype-production\n';
+    listed.ClientTrafficPolicy = 'clienttrafficpolicy.gateway.envoyproxy.io/dd-prototype-production-http3\n';
+    const removed = UnderpostDeploy.API.sweepLegacyGatewayObjects({
+      hosts: ['healthcare.nexodev.org', 'www.bymyelectrics.com', 'bymyelectrics.com'],
+      namespace: 'default',
+    });
+    expect(removed).to.deep.equal({ gateways: [], policies: [] });
+    expect(commands.filter((command) => command.startsWith('kubectl get ')).length).to.equal(2);
+    expect(deletes()).to.deep.equal([]);
+  });
+
+  it('removes only the per-host and unresolved-host objects that still exist', () => {
+    listed.Gateway = [
+      'gateway.gateway.networking.k8s.io/dd-prototype-production',
+      'gateway.gateway.networking.k8s.io/healthcare.nexodev.org',
+      'gateway.gateway.networking.k8s.io/undefined',
+      'gateway.gateway.networking.k8s.io/other-deploy-production',
+    ].join('\n');
+    listed.ClientTrafficPolicy = 'clienttrafficpolicy.gateway.envoyproxy.io/undefined-http3\n';
+    const removed = UnderpostDeploy.API.sweepLegacyGatewayObjects({
+      hosts: ['healthcare.nexodev.org', 'www.bymyelectrics.com'],
+      namespace: 'default',
+    });
+    expect(removed).to.deep.equal({
+      gateways: ['healthcare.nexodev.org', 'undefined'],
+      policies: ['undefined-http3'],
+    });
+    expect(deletes()).to.deep.equal([
+      'sudo kubectl delete Gateway healthcare.nexodev.org -n default --ignore-not-found',
+      'sudo kubectl delete Gateway undefined -n default --ignore-not-found',
+      'sudo kubectl delete ClientTrafficPolicy undefined-http3 -n default --ignore-not-found',
+    ]);
+  });
+});

package/test/unit/deploy-log-table.test.js

@@ -516,3 +516,41 @@ function render(output, columns, lines) {
 
   return screen.filter((line) => line.trim().length > 0);
 }
+
+describe('run_quiet stream wiring', () => {
+  let wiringDir;
+
+  beforeEach(() => {
+    wiringDir = fs.mkdtempSync(path.join(os.tmpdir(), 'run-quiet-wiring-'));
+  });
+
+  afterEach(() => fs.removeSync(wiringDir));
+
+  // A command that finishes before tee holds the merged writer lets awk read EOF, and tee then
+  // blocks on an open with no reader until the 10 s drain kills it. A delay between tee's two
+  // opens, in the order the helper declares them, turns that scheduling race into a certainty.
+  it('finishes a short command even when tee opens its streams late', () => {
+    const wiring = /^(\s*)tee -a "\$error_log" (\S+) (\S+) &$/m;
+    const source = fs.readFileSync(loggingLib, 'utf8');
+    const [line, indent, first, second] = source.match(wiring) ?? [];
+    expect(line, 'tee wiring line').to.be.a('string');
+    const delayedLib = path.join(wiringDir, 'logging.sh');
+    fs.writeFileSync(
+      delayedLib,
+      source.replace(line, `${indent}{ sleep 0.3; exec tee -a "$error_log" ${second}; } ${first} &`),
+    );
+    const env = { ...process.env, TERM: 'xterm' };
+    for (const key of ['GITHUB_ACTIONS', 'RUN_QUIET_CI', 'RUN_QUIET_DEBUG']) delete env[key];
+
+    const started = Date.now();
+    execFileSync(
+      'bash',
+      [
+        '-c',
+        `source ${JSON.stringify(delayedLib)}; run_quiet "Sync probe" "Target pod:" 14 bash -c 'echo out; echo err >&2'`,
+      ],
+      { env, stdio: ['ignore', 'pipe', 'pipe'] },
+    );
+    expect(Date.now() - started).to.be.below(5000);
+  }, 20_000);
+});

package/test/unit/execution-profiles.test.js

@@ -61,6 +61,7 @@ describe('command capability classification', () => {
     expect(classifyCommand('sudo dnf install -y cockpit')).to.equal('host:write');
     expect(classifyCommand('sudo systemctl enable --now cockpit.socket')).to.equal('host:write');
     expect(classifyCommand('curl https://example.com')).to.equal('net');
+    expect(classifyCommand("'/x/node_modules/.bin/socket' 'scan' 'create' '--json' '.'")).to.equal('net');
     expect(classifyCommand('git add .')).to.equal('git');
   });
 

package/test/unit/gateway-pod-fetch.test.js

@@ -0,0 +1,95 @@
+'use strict';
+
+import { expect } from 'chai';
+import shell from 'shelljs';
+import { vi } from 'vitest';
+import { gatewayPodFetch, parseRawHttpResponse } from '../../src/server/network/underpost-gateway.js';
+
+describe('gateway pod fetch', () => {
+  let commands;
+  let answer;
+
+  beforeEach(() => {
+    commands = [];
+    answer = (command) =>
+      command.includes('| nc ') ? 'HTTP/1.1 502 Bad Gateway\r\nServer: nginx\r\n\r\n<h1>maintenance</h1>\n' : '';
+    vi.spyOn(shell, 'exec').mockImplementation((command) => {
+      commands.push(command);
+      const stdout = answer(command);
+      return { code: 0, stdout, stderr: '', toString: () => stdout };
+    });
+  });
+
+  afterEach(() => vi.restoreAllMocks());
+
+  it('reads the status and the body of an error response off the socket', () => {
+    // Regression: busybox wget discards the body of any non-2xx answer, so the fallback
+    // document — delivered with an upstream-failure status by definition — never
+    // matched, and the probe polled every attempt against a correct edge.
+    const result = gatewayPodFetch({ namespace: 'default', host: 'www.bymyelectrics.com', path: '/' });
+    expect(result).to.deep.equal({ status: '502', body: '<h1>maintenance</h1>\n' });
+    expect(commands.length).to.equal(1);
+    expect(commands[0]).to.include(
+      "printf 'GET / HTTP/1.0\\r\\nHost: www.bymyelectrics.com\\r\\n\\r\\n' | nc -w 10 127.0.0.1 80",
+    );
+  });
+
+  it('falls back to the wget pair for the status where nc is absent', () => {
+    answer = (command) => (command.includes('wget -S') ? 'HTTP/1.1 503 Service Unavailable\n' : '');
+    const result = gatewayPodFetch({ namespace: 'default', host: 'healthcare.nexodev.org' });
+    expect(result.status).to.equal('503');
+    expect(commands.length).to.equal(3);
+  });
+
+  it('parses a raw response byte for byte after the first blank line', () => {
+    expect(parseRawHttpResponse('')).to.deep.equal({ status: '', body: '' });
+    expect(parseRawHttpResponse('HTTP/1.0 200 OK\r\nX: y\r\n\r\n')).to.deep.equal({ status: '200', body: '' });
+    expect(parseRawHttpResponse('HTTP/1.1 504 Gateway Time-out\n\nline\n\nmore')).to.deep.equal({
+      status: '504',
+      body: 'line\n\nmore',
+    });
+  });
+});
+
+describe('gateway fetch', () => {
+  afterEach(() => vi.restoreAllMocks());
+
+  const mock = (answer) => {
+    const commands = [];
+    vi.spyOn(shell, 'exec').mockImplementation((command) => {
+      commands.push(command);
+      const stdout = answer(command);
+      return { code: 0, stdout, stderr: '', toString: () => stdout };
+    });
+    return commands;
+  };
+
+  it('asks the gateway Service from this host with curl, keeping the error body', async () => {
+    const { gatewayFetch } = await import('../../src/server/network/underpost-gateway.js');
+    const commands = mock((command) => {
+      if (command.includes('kubectl get svc underpost-gateway-service')) return '10.96.151.82\n';
+      if (command.startsWith('curl ')) return 'HTTP/1.1 502 Bad Gateway\r\nServer: nginx\r\n\r\n<h1>maintenance</h1>\n';
+      return '';
+    });
+    const result = gatewayFetch({ namespace: 'default', host: 'healthcare.nexodev.org', path: '/' });
+    expect(result).to.deep.equal({ status: '502', body: '<h1>maintenance</h1>\n', via: 'host' });
+    expect(commands.find((command) => command.startsWith('curl '))).to.include(
+      "-H 'Host: healthcare.nexodev.org' http://10.96.151.82:80/",
+    );
+    expect(commands.some((command) => command.includes('kubectl exec'))).to.equal(false);
+  });
+
+  it('falls back to the pod when the Service cannot be reached from here', async () => {
+    const { gatewayFetch } = await import('../../src/server/network/underpost-gateway.js');
+    mock((command) => {
+      if (command.includes('kubectl get svc underpost-gateway-service')) return '10.96.151.82\n';
+      if (command.includes('| nc ')) return 'HTTP/1.1 503 Service Unavailable\r\n\r\nbody';
+      return '';
+    });
+    expect(gatewayFetch({ namespace: 'default', host: 'healthcare.nexodev.org' })).to.deep.equal({
+      status: '503',
+      body: 'body',
+      via: 'pod',
+    });
+  });
+});

package/test/unit/letsencrypt-issuer.test.js

@@ -0,0 +1,101 @@
+'use strict';
+
+import { expect } from 'chai';
+import { load as yamlLoad } from 'js-yaml';
+import shell from 'shelljs';
+import { vi } from 'vitest';
+import UnderpostCluster from '../../src/cli/cluster.js';
+import UnderpostDeploy, { LETSENCRYPT_ISSUER_MANIFEST, LETSENCRYPT_ISSUER_NAME } from '../../src/cli/deploy.js';
+
+describe("Let's Encrypt issuer for the ingress stack in use", () => {
+  afterEach(() => vi.restoreAllMocks());
+
+  describe('acmeSolverFactory', () => {
+    it('answers through the Gateway API whenever its data plane is installed', () => {
+      // The `cluster` runner installs the issuer in an invocation that carries no stack
+      // flag, so the decision has to come from the cluster, not from the flags.
+      const presence = { contour: false, gateway: true };
+      expect(UnderpostCluster.API.acmeSolverFactory({ options: {}, presence })).to.equal('gateway');
+      expect(UnderpostCluster.API.acmeSolverFactory({ options: { gatewayApi: true }, presence })).to.equal('gateway');
+      expect(
+        UnderpostCluster.API.acmeSolverFactory({
+          options: { gatewayApi: true },
+          presence: { contour: true, gateway: false },
+        }),
+      ).to.equal('gateway');
+    });
+
+    it('keeps the Contour Ingress solver only where nothing else carries the challenge', () => {
+      expect(
+        UnderpostCluster.API.acmeSolverFactory({ options: {}, presence: { contour: true, gateway: false } }),
+      ).to.equal('ingress');
+      expect(
+        UnderpostCluster.API.acmeSolverFactory({
+          options: { contour: true },
+          presence: { contour: false, gateway: true },
+        }),
+      ).to.equal('ingress');
+    });
+  });
+
+  describe('letsEncryptIssuerYamlFactory', () => {
+    it('keeps the account from the base manifest and swaps in the Gateway solver', () => {
+      const base = yamlLoad(
+        UnderpostDeploy.API.letsEncryptIssuerYamlFactory({ solver: 'ingress', basePath: LETSENCRYPT_ISSUER_MANIFEST }),
+      );
+      const issuer = yamlLoad(
+        UnderpostDeploy.API.letsEncryptIssuerYamlFactory({
+          solver: 'gateway',
+          parentRefs: [
+            { name: 'dd-core-production', namespace: 'default' },
+            { name: 'dd-prototype-production', namespace: 'default' },
+          ],
+        }),
+      );
+      expect(issuer.kind).to.equal('ClusterIssuer');
+      expect(issuer.metadata.name).to.equal(LETSENCRYPT_ISSUER_NAME);
+      expect(issuer.spec.acme.email).to.equal(base.spec.acme.email);
+      expect(issuer.spec.acme.server).to.equal(base.spec.acme.server);
+      expect(issuer.spec.acme.privateKeySecretRef).to.deep.equal(base.spec.acme.privateKeySecretRef);
+      expect(issuer.spec.acme.solvers).to.deep.equal([
+        {
+          http01: {
+            gatewayHTTPRoute: {
+              parentRefs: [
+                { name: 'dd-core-production', namespace: 'default', kind: 'Gateway' },
+                { name: 'dd-prototype-production', namespace: 'default', kind: 'Gateway' },
+              ],
+            },
+          },
+        },
+      ]);
+      expect(base.spec.acme.solvers).to.deep.equal([{ http01: { ingress: { class: 'contour' } } }]);
+    });
+
+    it('refuses a Gateway solver with nothing to attach the challenge route to', () => {
+      expect(() => UnderpostDeploy.API.letsEncryptIssuerYamlFactory({ solver: 'gateway', parentRefs: [] })).to.throw(
+        /parentRef/,
+      );
+    });
+  });
+
+  describe('acmeGatewayParentRefsFactory', () => {
+    it('unions the live Gateways with the routed deploys, once each, sorted', () => {
+      vi.spyOn(shell, 'exec').mockImplementation((command) => {
+        const stdout = command.startsWith('kubectl get gateway')
+          ? 'gateway.gateway.networking.k8s.io/dd-core-production\ngateway.gateway.networking.k8s.io/other-production\n'
+          : '';
+        return { code: 0, stdout, stderr: '', toString: () => stdout };
+      });
+      vi.spyOn(UnderpostDeploy.API, 'gatewayNameFactory').mockImplementation(
+        ({ deployId, env }) => `${deployId}-${env}`,
+      );
+      const refs = UnderpostDeploy.API.acmeGatewayParentRefsFactory({ namespace: 'default', env: 'production' });
+      const names = refs.map(({ name }) => name);
+      expect(names).to.include('dd-core-production');
+      expect(names).to.include('other-production');
+      expect(names).to.deep.equal([...new Set(names)].sort());
+      expect(refs.every(({ namespace }) => namespace === 'default')).to.equal(true);
+    });
+  });
+});