cyberia 3.2.22 → 3.2.70

package/src/api/cyberia-instance/cyberia-fallback-world.js

@@ -24,21 +24,25 @@ import {
   generateObstacles,
   generateForeground,
   generateResources,
+  generateStatic,
   generateFloorEntities,
   generatePortalEntity,
   generatePortalEntities,
   generateBots,
+  generateActionProviderBots,
   OccupancyGrid,
 } from './cyberia-world-generator.js';
 
 import {
   CYBERIA_INSTANCE_CONF_DEFAULTS,
+  DEFAULT_PLAYER_SPAWN,
   ENTITY_TYPE_DEFAULTS,
   RESOURCE_ENTITY_TYPE_DEFAULTS,
-  DefaultCyberiaItems,
+  DefaultSkillConfig,
 } from '../cyberia-server-defaults/cyberia-server-defaults.js';
 import {
   CYBERIA_CLIENT_HINTS_DEFAULTS,
+  DefaultCyberiaItems,
   PALETTE,
 } from '../../client/components/cyberia/SharedDefaultsCyberia.js';
 
@@ -62,7 +66,9 @@ const KNOWN_DEFAULT_ITEM_IDS = new Set(DefaultCyberiaItems.map((e) => e.item.id)
 
 function collectReferencedItemIds() {
   const ids = new Set();
-  const push = (id) => { if (typeof id === 'string' && id.length > 0) ids.add(id); };
+  const push = (id) => {
+    if (typeof id === 'string' && id.length > 0) ids.add(id);
+  };
 
   for (const e of ENTITY_TYPE_DEFAULTS) {
     (e.liveItemIds || []).forEach(push);
@@ -75,6 +81,17 @@ function collectReferencedItemIds() {
     (r.deadItemIds || []).forEach(push);
     (r.dropItemIds || []).forEach(push);
   }
+  // Skill trigger items and the entities they summon must also resolve to an
+  // ObjectLayer. Runtime placeholders ('$active_skin', …) are resolved by the
+  // server and are intentionally excluded.
+  for (const sk of DefaultSkillConfig) {
+    push(sk.triggerItemId);
+    for (const s of sk.skills || []) {
+      if (typeof s.summonedEntityItemId === 'string' && !s.summonedEntityItemId.startsWith('$')) {
+        push(s.summonedEntityItemId);
+      }
+    }
+  }
   return ids;
 }
 
@@ -96,6 +113,16 @@ function auditFallbackItemIds() {
 
 // ── Single map generator ─────────────────────────────────────────────────────
 
+/** AABB overlap test for two entities in cell space. */
+function entitiesOverlap(a, b) {
+  return (
+    a.initCellX < b.initCellX + b.dimX &&
+    a.initCellX + a.dimX > b.initCellX &&
+    a.initCellY < b.initCellY + b.dimY &&
+    a.initCellY + a.dimY > b.initCellY
+  );
+}
+
 /**
  * Generate a complete in-memory map with all entity types.
  * Everything except floor tiles is randomized.
@@ -108,6 +135,7 @@ function auditFallbackItemIds() {
  * @param {number} [opts.foregroundCount]
  * @param {number} [opts.botCount]
  * @param {number} [opts.resourceCount]
+ * @param {number} [opts.staticCount]
  * @returns {object}  CyberiaMap-shaped plain object.
  */
 function generateFallbackMap(mapCode, colors, opts = {}) {
@@ -117,26 +145,46 @@ function generateFallbackMap(mapCode, colors, opts = {}) {
   // 1. Floor — deterministic full coverage
   const floors = generateFloorEntities(mapDims, colors);
 
-  // 2. Obstacles — random count, position, dimensions (placed first)
-  const obstacles = generateObstacles(mapDims, colors, { count: opts.obstacleCount });
+  // 2. Action-provider NPCs — fixed cells from DefaultCyberiaActions. Built
+  //    first so their mission cells are guaranteed clear and walkable.
+  const actionProviders = generateActionProviderBots(mapCode, colors);
 
-  // 3. Build occupancy grid from obstacles
+  // 3. Obstacles — random, minus any overlapping an action-provider cell so
+  //    the mission NPCs always stand on walkable ground.
+  const obstacles = generateObstacles(mapDims, colors, { count: opts.obstacleCount }).filter(
+    (o) => !actionProviders.some((ap) => entitiesOverlap(o, ap)),
+  );
+
+  // 4. Build occupancy grid from obstacles, then reserve action-provider cells.
   const grid = new OccupancyGrid(gridSize, gridSize);
   grid.addObstacles(obstacles);
+  for (const ap of actionProviders) grid.block(ap.initCellX, ap.initCellY, ap.dimX, ap.dimY);
 
-  // 4. Portals — placed on walkable cells only, then blocked so bots avoid them
+  // 5. Portals — placed on walkable cells only, then blocked so bots avoid them
   const portalEntities = generatePortalEntities(mapDims, colors, { grid });
 
-  // 5. Bots — placed on walkable cells (avoids obstacles and portals)
+  // 6. Bots — placed on walkable cells (avoids obstacles, portals, NPCs)
   const bots = generateBots(mapDims, colors, { count: opts.botCount, grid });
 
-  // 6. Resources — static exploitable entities placed on walkable cells
+  // 7. Resources — static exploitable entities placed on walkable cells
   const resources = generateResources(mapDims, colors, { count: opts.resourceCount, grid });
 
-  // 7. Foreground — decorative, no collision restriction
+  // 8. Foreground — decorative, no collision restriction
   const foreground = generateForeground(mapDims, colors, { count: opts.foregroundCount });
 
-  const entities = [...floors, ...obstacles, ...portalEntities, ...foreground, ...bots, ...resources];
+  // 9. Statics — non-moving, passable decorators; depth-sorted with entities.
+  const statics = generateStatic(mapDims, colors, { count: opts.staticCount });
+
+  const entities = [
+    ...floors,
+    ...obstacles,
+    ...portalEntities,
+    ...foreground,
+    ...actionProviders,
+    ...bots,
+    ...resources,
+    ...statics,
+  ];
 
   return {
     code: mapCode,
@@ -167,6 +215,7 @@ function generateFallbackMap(mapCode, colors, opts = {}) {
  * @param {number} [opts.foregroundCount]     Foreground entities per map (random if omitted).
  * @param {number} [opts.botCount]            Bots per map (random if omitted).
  * @param {number} [opts.resourceCount]        Resources per map (random if omitted).
+ * @param {number} [opts.staticCount]          Static decorators per map (random if omitted).
  * @param {Array}  [opts.colors]              Override palette.
  * @returns {{
  *   instance: object,
@@ -185,6 +234,7 @@ function generateFallbackWorld(opts = {}) {
     foregroundCount,
     botCount,
     resourceCount,
+    staticCount,
     // Palette lives in SharedDefaultsCyberia (presentation-owned). The
     // world generator only uses it to stamp a cosmetic rgba(...) string on
     // entities so the browser editor / preview can render a coloured
@@ -220,6 +270,7 @@ function generateFallbackWorld(opts = {}) {
       foregroundCount,
       botCount,
       resourceCount,
+      staticCount,
     }),
   );
 
@@ -235,6 +286,7 @@ function generateFallbackWorld(opts = {}) {
     cyberiaMapCodes: mapCodes,
     portals,
     topologyMode: 'procedural',
+    playerSpawn: { ...DEFAULT_PLAYER_SPAWN },
   };
 
   return {

package/src/api/cyberia-instance/cyberia-instance.model.js

@@ -31,6 +31,22 @@ const PortalEdgeSchema = new Schema(
   { _id: false },
 );
 
+/**
+ * Authoritative initial spawn position for new players joining this instance.
+ * When `random` is false and `sourceMapCode` names a loaded map, players spawn at
+ * (sourceCellX, sourceCellY) on it; otherwise (random true, or no/unknown map)
+ * the server spawns them at a random walkable cell on a random map.
+ */
+const PlayerSpawnSchema = new Schema(
+  {
+    sourceMapCode: { type: String, trim: true },
+    sourceCellX: { type: Number },
+    sourceCellY: { type: Number },
+    random: { type: Boolean, default: false },
+  },
+  { _id: false },
+);
+
 /**
  * Graph container / instance.
  * The instance stores:
@@ -52,12 +68,26 @@ const CyberiaInstanceSchema = new Schema(
     // Vertex set of the graph
     cyberiaMapCodes: { type: [String], default: [] },
 
-    // Instance-level object layer item IDs.
-    itemIds: { type: [String], default: [] },
+    // Instance-level object layer item IDs. Each entry binds an item id to the
+    // instance and flags whether it seeds every player's starting inventory
+    // (defaultPlayerInventory → merged into the player entityDefault's
+    // defaultObjectLayers when the world is served to cyberia-server).
+    itemIds: {
+      type: [
+        {
+          id: { type: String, required: true },
+          defaultPlayerInventory: { type: Boolean, default: false },
+        },
+      ],
+      default: [],
+    },
 
     // Directed edge set of the graph
     portals: { type: [PortalEdgeSchema], default: [] },
 
+    // Authoritative initial spawn for new players (see PlayerSpawnSchema).
+    playerSpawn: { type: PlayerSpawnSchema, default: () => ({}) },
+
     // Optional topology generation mode
     seed: { type: String, default: '' },
     topologyMode: {

package/src/api/cyberia-instance/cyberia-instance.router.js

@@ -1,6 +1,6 @@
 import { loggerFactory } from '../../server/logger.js';
 import { CyberiaInstanceController } from './cyberia-instance.controller.js';
-import { userGuard, adminGuard } from '../../server/auth.js';
+import { userGuard, moderatorGuard, adminGuard } from '../../server/auth.js';
 import express from 'express';
 
 const logger = loggerFactory(import.meta);
@@ -24,13 +24,13 @@ class CyberiaInstanceRouter {
     router.post(
       `/:id`,
       options.authMiddleware,
-      userGuard,
+      moderatorGuard,
       async (req, res) => await CyberiaInstanceController.post(req, res, options),
     );
     router.post(
       `/`,
       options.authMiddleware,
-      userGuard,
+      moderatorGuard,
       async (req, res) => await CyberiaInstanceController.post(req, res, options),
     );
     router.get(`/:id`, async (req, res) => await CyberiaInstanceController.get(req, res, options));
@@ -38,19 +38,19 @@ class CyberiaInstanceRouter {
     router.put(
       `/:id`,
       options.authMiddleware,
-      userGuard,
+      moderatorGuard,
       async (req, res) => await CyberiaInstanceController.put(req, res, options),
     );
     router.put(
       `/`,
       options.authMiddleware,
-      userGuard,
+      moderatorGuard,
       async (req, res) => await CyberiaInstanceController.put(req, res, options),
     );
     router.delete(
       `/:id`,
       options.authMiddleware,
-      userGuard,
+      moderatorGuard,
       async (req, res) => await CyberiaInstanceController.delete(req, res, options),
     );
     router.delete(

package/src/api/cyberia-instance/cyberia-world-generator.js

@@ -19,10 +19,11 @@
 import {
   ENTITY_TYPE_DEFAULTS,
   RESOURCE_ENTITY_TYPE_DEFAULTS,
-  DefaultCyberiaItems,
-  ITEM_TYPES,
+  DefaultCyberiaActions,
 } from '../cyberia-server-defaults/cyberia-server-defaults.js';
 
+import { DefaultCyberiaItems, ITEM_TYPES } from '../../client/components/cyberia/SharedDefaultsCyberia.js';
+
 import { PORTAL_MODES, PORTAL_MODE_COLOR_KEY, EXTRA_PORTAL_MODES } from './cyberia-portal-connector.js';
 
 // ── Color helpers ────────────────────────────────────────────────────────────
@@ -59,6 +60,7 @@ const OBSTACLE_RANGE = [20, 35];
 const FOREGROUND_RANGE = [10, 20];
 const BOT_RANGE = [8, 16];
 const RESOURCE_RANGE = [6, 12];
+const STATIC_RANGE = [8, 16];
 const BOT_WEAPON_CHANCE = 0.6;
 const PORTAL_DIM_RANGE = [2, 3];
 const PORTAL_COUNT_RANGE = [2, 4];
@@ -273,6 +275,51 @@ function generateForeground(mapDims, colors, opts = {}) {
   return entities;
 }
 
+/**
+ * Generate procedural static decorator entities for a map.
+ *
+ * Statics are non-moving, passable decorations (rocks, bushes, signage, etc.).
+ * Unlike obstacles they never block movement; unlike foreground they are
+ * depth-sorted with bots/players by the client (Y-axis ordering) so the player
+ * can pass behind or in front of them. They carry no life and are never
+ * exploitable. Placed on any cell (no occupancy reservation — they are
+ * transferable).
+ *
+ * @param {{ gridX: number, gridY: number }} mapDims  Map grid dimensions.
+ * @param {Array<{ key: string, r: number, g: number, b: number, a: number }>} colors  Palette.
+ * @param {object} [opts]
+ * @param {number} [opts.count]         Override count (ignores range).
+ * @param {number} [opts.minDim=2]      Minimum width/height (cells).
+ * @param {number} [opts.maxDim=4]      Maximum width/height (cells).
+ * @returns {object[]}  Array of CyberiaEntity plain objects.
+ */
+function generateStatic(mapDims, colors, opts = {}) {
+  const { minDim = 2, maxDim = 4 } = opts;
+  const count = opts.count ?? randInt(STATIC_RANGE[0], STATIC_RANGE[1]);
+  const { gridX, gridY } = mapDims;
+
+  const staticColor = findColor(colors, 'STATIC');
+  const rgba = staticColor ? colorToRgba(staticColor) : 'rgba(120, 140, 110, 1)';
+
+  const entities = [];
+  for (let i = 0; i < count; i++) {
+    const dimX = randInt(minDim, maxDim);
+    const dimY = randInt(minDim, maxDim);
+    const maxX = Math.max(0, gridX - dimX);
+    const maxY = Math.max(0, gridY - dimY);
+    entities.push({
+      entityType: 'static',
+      initCellX: randInt(0, maxX),
+      initCellY: randInt(0, maxY),
+      dimX,
+      dimY,
+      color: rgba,
+      objectLayerItemIds: [],
+    });
+  }
+  return entities;
+}
+
 /**
  * Generate procedural resource entities for a map.
  *
@@ -435,7 +482,8 @@ function generateBots(mapDims, colors, opts = {}) {
       cellY = randInt(0, maxY);
     }
 
-    const skin = BOT_SKIN_POOL[Math.floor(Math.random() * BOT_SKIN_POOL.length)];
+    // const skin = BOT_SKIN_POOL[Math.floor(Math.random() * BOT_SKIN_POOL.length)];
+    const skin = 'kishins';
     const hasWeapon = Math.random() < BOT_WEAPON_CHANCE;
     const itemIds = hasWeapon ? [skin, 'atlas_pistol_mk2'] : [skin];
 
@@ -456,6 +504,67 @@ function generateBots(mapDims, colors, opts = {}) {
   return entities;
 }
 
+/**
+ * Action-provider NPC bots — the fixed-position entities that back the
+ * default mission system. One passive bot is placed per `CyberiaAction`
+ * whose `sourceMapCode` matches `mapCode`, at the action's
+ * (`sourceCellX`, `sourceCellY`). The Go server binds each bot back to its
+ * action by these coordinates, so the positions here are the single source
+ * of truth shared with `DefaultCyberiaActions`.
+ *
+ * The NPC skin is derived from the action's first `default-<skin>` dialogue
+ * code (e.g. `default-wason` → skin `wason`) — there is no separate
+ * provideItemId; the bot's own active skin is what 'talk' objectives match.
+ *
+ * @param {string} mapCode
+ * @param {Array<{ key: string, r: number, g: number, b: number, a: number }>} colors
+ * @param {object} [opts]
+ * @param {number} [opts.dim=2]
+ * @param {OccupancyGrid} [opts.grid]   Cells are reserved when provided.
+ * @returns {object[]}  Bot-shaped entities.
+ */
+function actionProviderSkin(action) {
+  // Skin derives from the action's greeting dialogCode (`default-<skin>`).
+  const code = action.dialogCode || '';
+  return code.startsWith('default-') ? code.slice('default-'.length) : '';
+}
+
+function generateActionProviderBots(mapCode, colors, opts = {}) {
+  const dim = opts.dim ?? 2;
+  const botColor = findColor(colors, 'BOT');
+  const rgba = botColor ? colorToRgba(botColor) : 'rgba(255, 128, 0, 1)';
+
+  const entities = [];
+  for (const action of DefaultCyberiaActions) {
+    if (action.sourceMapCode !== mapCode) continue;
+    if (typeof action.sourceCellX !== 'number' || typeof action.sourceCellY !== 'number') continue;
+    const skin = actionProviderSkin(action);
+    if (!skin) continue;
+    const cellX = action.sourceCellX;
+    const cellY = action.sourceCellY;
+
+    if (opts.grid) opts.grid.block(cellX, cellY, dim, dim);
+
+    // Passive quest-giver NPC: no aggro, and a small wander radius so it
+    // drifts near its source cell but stays easy to find. The Go server binds
+    // it by its spawn-centre (the initial cell), so the bind survives movement.
+    entities.push({
+      entityType: 'bot',
+      initCellX: cellX,
+      initCellY: cellY,
+      dimX: dim,
+      dimY: dim,
+      color: rgba,
+      objectLayerItemIds: [skin],
+      spawnRadius: 2,
+      aggroRange: 0,
+      maxLife: 100,
+      lifeRegen: 0,
+    });
+  }
+  return entities;
+}
+
 /**
  * Generate all procedural fallback entities (obstacles + foreground + resources) for a map.
  *
@@ -473,6 +582,7 @@ function generateProceduralEntities(mapDims, colors, opts = {}) {
     obstacles: generateObstacles(mapDims, colors, { count: opts.obstacleCount }),
     foreground: generateForeground(mapDims, colors, { count: opts.foregroundCount }),
     resources: generateResources(mapDims, colors, { count: opts.resourceCount, grid: opts.grid }),
+    statics: generateStatic(mapDims, colors, { count: opts.staticCount }),
   };
 }
 
@@ -490,15 +600,18 @@ export {
   generateObstacles,
   generateForeground,
   generateResources,
+  generateStatic,
   generatePortalEntity,
   generatePortalEntities,
   generateBots,
+  generateActionProviderBots,
   generateProceduralEntities,
   // Ranges
   OBSTACLE_RANGE,
   FOREGROUND_RANGE,
   BOT_RANGE,
   RESOURCE_RANGE,
+  STATIC_RANGE,
   BOT_WEAPON_CHANCE,
   PORTAL_DIM_RANGE,
   PORTAL_COUNT_RANGE,

package/src/api/cyberia-instance-conf/cyberia-instance-conf.model.js

@@ -31,6 +31,9 @@ const EntityDefaultSchema = new Schema(
     // The coin slot must always have active:false — coins are non-activable.
     // When non-empty this supersedes liveItemIds for inventory initialization.
     defaultObjectLayers: { type: [ObjectLayerSlotSchema], default: [] },
+    // Canonical entity behavior (SharedDefaultsCyberia.ENTITY_BEHAVIORS). Empty
+    // lets the runtime derive it (armed → hostile, else passive).
+    behavior: { type: String, default: '' },
   },
   { _id: false },
 );

package/src/api/cyberia-instance-conf/cyberia-instance-conf.router.js

@@ -1,6 +1,7 @@
 import { loggerFactory } from '../../server/logger.js';
 import { CyberiaInstanceConfController } from './cyberia-instance-conf.controller.js';
 import express from 'express';
+import { moderatorGuard, adminGuard } from '../../server/auth.js';
 
 const logger = loggerFactory(import.meta);
 
@@ -11,17 +12,48 @@ class CyberiaInstanceConfRouter {
    */
   static router(options) {
     const router = express.Router();
-    router.post(`/:id`, async (req, res) => await CyberiaInstanceConfController.post(req, res, options));
-    router.post(`/`, async (req, res) => await CyberiaInstanceConfController.post(req, res, options));
-    router.get(`/:id`,
+    router.post(
+      `/:id`,
+      options.authMiddleware,
+      moderatorGuard,
+      async (req, res) => await CyberiaInstanceConfController.post(req, res, options),
+    );
+    router.post(
+      `/`,
+      options.authMiddleware,
+      moderatorGuard,
+      async (req, res) => await CyberiaInstanceConfController.post(req, res, options),
+    );
+    router.get(
+      `/:id`,
       // options.authMiddleware,
       async (req, res) => await CyberiaInstanceConfController.get(req, res, options),
     );
     router.get(`/`, async (req, res) => await CyberiaInstanceConfController.get(req, res, options));
-    router.put(`/:id`, async (req, res) => await CyberiaInstanceConfController.put(req, res, options));
-    router.put(`/`, async (req, res) => await CyberiaInstanceConfController.put(req, res, options));
-    router.delete(`/:id`, async (req, res) => await CyberiaInstanceConfController.delete(req, res, options));
-    router.delete(`/`, async (req, res) => await CyberiaInstanceConfController.delete(req, res, options));
+    router.put(
+      `/:id`,
+      options.authMiddleware,
+      moderatorGuard,
+      async (req, res) => await CyberiaInstanceConfController.put(req, res, options),
+    );
+    router.put(
+      `/`,
+      options.authMiddleware,
+      moderatorGuard,
+      async (req, res) => await CyberiaInstanceConfController.put(req, res, options),
+    );
+    router.delete(
+      `/:id`,
+      options.authMiddleware,
+      moderatorGuard,
+      async (req, res) => await CyberiaInstanceConfController.delete(req, res, options),
+    );
+    router.delete(
+      `/`,
+      options.authMiddleware,
+      adminGuard,
+      async (req, res) => await CyberiaInstanceConfController.delete(req, res, options),
+    );
     return router;
   }
 }

package/src/api/cyberia-map/cyberia-map.router.js

@@ -1,6 +1,6 @@
 import { loggerFactory } from '../../server/logger.js';
 import { CyberiaMapController } from './cyberia-map.controller.js';
-import { userGuard, adminGuard } from '../../server/auth.js';
+import { moderatorGuard, adminGuard } from '../../server/auth.js';
 import express from 'express';
 
 const logger = loggerFactory(import.meta);
@@ -15,19 +15,34 @@ class CyberiaMapRouter {
     router.post(
       `/:id`,
       options.authMiddleware,
-      userGuard,
+      moderatorGuard,
+      async (req, res) => await CyberiaMapController.post(req, res, options),
+    );
+    router.post(
+      `/`,
+      options.authMiddleware,
+      moderatorGuard,
       async (req, res) => await CyberiaMapController.post(req, res, options),
     );
-    router.post(`/`, options.authMiddleware, userGuard, async (req, res) => await CyberiaMapController.post(req, res, options));
     router.get(`/search-codes`, async (req, res) => await CyberiaMapController.get(req, res, options));
     router.get(`/:id`, async (req, res) => await CyberiaMapController.get(req, res, options));
     router.get(`/`, async (req, res) => await CyberiaMapController.get(req, res, options));
-    router.put(`/:id`, options.authMiddleware, userGuard, async (req, res) => await CyberiaMapController.put(req, res, options));
-    router.put(`/`, options.authMiddleware, userGuard, async (req, res) => await CyberiaMapController.put(req, res, options));
+    router.put(
+      `/:id`,
+      options.authMiddleware,
+      moderatorGuard,
+      async (req, res) => await CyberiaMapController.put(req, res, options),
+    );
+    router.put(
+      `/`,
+      options.authMiddleware,
+      moderatorGuard,
+      async (req, res) => await CyberiaMapController.put(req, res, options),
+    );
     router.delete(
       `/:id`,
       options.authMiddleware,
-      userGuard,
+      moderatorGuard,
       async (req, res) => await CyberiaMapController.delete(req, res, options),
     );
     router.delete(

package/src/api/cyberia-quest/cyberia-quest.controller.js

@@ -39,6 +39,44 @@ class CyberiaQuestController {
       });
     }
   };
+  static getByCode = async (req, res, options) => {
+    try {
+      if (req && req.headers && req.headers.origin) {
+        res.set('Access-Control-Allow-Origin', req.headers.origin);
+      } else res.setHeader('Access-Control-Allow-Origin', '*');
+      res.setHeader('Cross-Origin-Resource-Policy', 'cross-origin');
+      const result = await CyberiaQuestService.getByCode(req, res, options);
+      return res.status(200).json({
+        status: 'success',
+        data: result,
+      });
+    } catch (error) {
+      logger.error(error, error.stack);
+      return res.status(404).json({
+        status: 'error',
+        message: error.message,
+      });
+    }
+  };
+  static getByCell = async (req, res, options) => {
+    try {
+      if (req && req.headers && req.headers.origin) {
+        res.set('Access-Control-Allow-Origin', req.headers.origin);
+      } else res.setHeader('Access-Control-Allow-Origin', '*');
+      res.setHeader('Cross-Origin-Resource-Policy', 'cross-origin');
+      const result = await CyberiaQuestService.getByCell(req, res, options);
+      return res.status(200).json({
+        status: 'success',
+        data: result,
+      });
+    } catch (error) {
+      logger.error(error, error.stack);
+      return res.status(404).json({
+        status: 'error',
+        message: error.message,
+      });
+    }
+  };
   static put = async (req, res, options) => {
     try {
       const result = await CyberiaQuestService.put(req, res, options);

package/src/api/cyberia-quest/cyberia-quest.router.js

@@ -1,6 +1,7 @@
 import { loggerFactory } from '../../server/logger.js';
 import { CyberiaQuestController } from './cyberia-quest.controller.js';
 import express from 'express';
+import { moderatorGuard, adminGuard } from '../../server/auth.js';
 
 const logger = loggerFactory(import.meta);
 
@@ -11,17 +12,56 @@ class CyberiaQuestRouter {
    */
   static router(options) {
     const router = express.Router();
-    router.post(`/:id`, async (req, res) => await CyberiaQuestController.post(req, res, options));
-    router.post(`/`, async (req, res) => await CyberiaQuestController.post(req, res, options));
-    router.get(`/:id`,
+    router.post(
+      `/:id`,
+      options.authMiddleware,
+      moderatorGuard,
+      async (req, res) => await CyberiaQuestController.post(req, res, options),
+    );
+    router.post(
+      `/`,
+      options.authMiddleware,
+      moderatorGuard,
+      async (req, res) => await CyberiaQuestController.post(req, res, options),
+    );
+    // Direct lookup by code — C client fetches quest metadata by code.
+    router.get(`/code/:code`, async (req, res) => await CyberiaQuestController.getByCode(req, res, options));
+    // Quest offers located by binding cell — C client resolves the Quest tab from
+    // here using the interacted entity's cell, decoupled from CyberiaAction.
+    router.get(
+      `/cell/:mapCode/:cellX/:cellY`,
+      async (req, res) => await CyberiaQuestController.getByCell(req, res, options),
+    );
+    router.get(
+      `/:id`,
       // options.authMiddleware,
       async (req, res) => await CyberiaQuestController.get(req, res, options),
     );
     router.get(`/`, async (req, res) => await CyberiaQuestController.get(req, res, options));
-    router.put(`/:id`, async (req, res) => await CyberiaQuestController.put(req, res, options));
-    router.put(`/`, async (req, res) => await CyberiaQuestController.put(req, res, options));
-    router.delete(`/:id`, async (req, res) => await CyberiaQuestController.delete(req, res, options));
-    router.delete(`/`, async (req, res) => await CyberiaQuestController.delete(req, res, options));
+    router.put(
+      `/:id`,
+      options.authMiddleware,
+      moderatorGuard,
+      async (req, res) => await CyberiaQuestController.put(req, res, options),
+    );
+    router.put(
+      `/`,
+      options.authMiddleware,
+      moderatorGuard,
+      async (req, res) => await CyberiaQuestController.put(req, res, options),
+    );
+    router.delete(
+      `/:id`,
+      options.authMiddleware,
+      moderatorGuard,
+      async (req, res) => await CyberiaQuestController.delete(req, res, options),
+    );
+    router.delete(
+      `/`,
+      options.authMiddleware,
+      adminGuard,
+      async (req, res) => await CyberiaQuestController.delete(req, res, options),
+    );
     return router;
   }
 }