underpost 3.1.3 → 3.2.2

package/src/server/backup.js

@@ -6,7 +6,6 @@
 
 import fs from 'fs-extra';
 import { loggerFactory } from './logger.js';
-import { shellExec } from './process.js';
 import Underpost from '../index.js';
 import { loadCronDeployEnv } from './conf.js';
 
@@ -21,42 +20,77 @@ class BackUp {
   /**
    * @method callback
    * @description Initiates a backup operation for the specified deployment list.
-   * @param {string} deployList - The list of deployments to backup.
+   * Orchestrates two backup phases per deployment:
+   *   1. Database export (MariaDB / MongoDB dump via `node bin db --export`).
+   *   2. Repository backup (git commit+push inside the deployment pod via `node bin db --repo-backup`).
+   *
+   * Commands are always forwarded to the host node via SSH because the CronJob
+   * container itself has no kubectl access. GITHUB_TOKEN and GITHUB_USERNAME
+   * are passed as ephemeral inline env vars so they never touch the host filesystem.
+   *
+   * @param {string} deployList - Comma-separated list of deployment IDs.
    * @param {Object} options - The options for the backup operation.
    * @param {boolean} options.git - Whether to backup data using Git.
    * @param {boolean} [options.k3s] - Use k3s cluster context.
    * @param {boolean} [options.kind] - Use kind cluster context.
    * @param {boolean} [options.kubeadm] - Use kubeadm cluster context.
-   * @param {boolean} [options.ssh] - Execute backup commands via SSH on the remote node.
    * @memberof UnderpostBakcUp
    */
   static callback = async function (deployList, options = { git: false }) {
-    loadCronDeployEnv();
-    if ((!deployList || deployList === 'dd') && fs.existsSync(`./engine-private/deploy/dd.router`))
-      deployList = fs.readFileSync(`./engine-private/deploy/dd.router`, 'utf8').trim();
+    const firstDeployId = deployList && deployList !== 'dd' ? deployList.split(',')[0].trim() : '';
+    const { ephemeral } = Underpost.repo.privateEngineRepoFactory(firstDeployId || undefined);
+    try {
+      loadCronDeployEnv();
+      if ((!deployList || deployList === 'dd') && fs.existsSync(`./engine-private/deploy/dd.router`))
+        deployList = fs.readFileSync(`./engine-private/deploy/dd.router`, 'utf8').trim();
 
-    logger.info('init backups callback', deployList);
-    await logger.setUpInfo();
+      logger.info('init backups callback', deployList);
+      await logger.setUpInfo();
 
-    const clusterFlag = options.k3s ? ' --k3s' : options.kind ? ' --kind' : options.kubeadm ? ' --kubeadm' : '';
+      const clusterFlag = options.k3s ? ' --k3s' : options.kind ? ' --kind' : options.kubeadm ? ' --kubeadm' : '';
 
-    for (const _deployId of deployList.split(',')) {
-      const deployId = _deployId.trim();
-      if (!deployId) continue;
+      for (const _deployId of deployList.split(',')) {
+        const deployId = _deployId.trim();
+        if (!deployId) continue;
 
-      const command = `node bin db ${options.git ? '--git --force-clone ' : ''}--export --primary-pod${clusterFlag} ${deployId}`;
+        const dbCommand = `node bin db ${options.git ? '--git --force-clone ' : ''}--export --primary-pod${clusterFlag} ${deployId}`;
+        const repoCommand = `node bin db --repo-backup${clusterFlag} ${deployId}`;
 
-      if (options.ssh) {
-        logger.info('Executing database export via SSH for', deployId);
-        await Underpost.ssh.sshRemoteRunner(command, {
-          remote: true,
-          useSudo: true,
-          cd: '/home/dd/engine',
-        });
-      } else {
-        logger.info('Executing database export for', deployId);
-        shellExec(command);
+        // Pass GITHUB_TOKEN and GITHUB_USERNAME ephemerally through the SSH command
+        // so git operations can push backups without relying on host env files.
+        const envPrefix = [
+          process.env.GITHUB_TOKEN ? `GITHUB_TOKEN=${process.env.GITHUB_TOKEN}` : '',
+          process.env.GITHUB_USERNAME ? `GITHUB_USERNAME=${process.env.GITHUB_USERNAME}` : '',
+        ]
+          .filter(Boolean)
+          .join(' ');
+        const prefixCmd = (cmd) => (envPrefix ? `${envPrefix} ${cmd}` : cmd);
+
+        try {
+          logger.info('Executing database export via SSH for', deployId);
+          await Underpost.ssh.sshRemoteRunner(prefixCmd(dbCommand), {
+            remote: true,
+            useSudo: true,
+            cd: '/home/dd/engine',
+          });
+        } catch (err) {
+          logger.error(`Error during database export for ${deployId}:`, err);
+        }
+
+        // Repository backup: Cron container → SSH to host → host finds pod → kubectl exec git backup
+        try {
+          logger.info('Executing repository backup via SSH for', deployId);
+          await Underpost.ssh.sshRemoteRunner(prefixCmd(repoCommand), {
+            remote: true,
+            useSudo: true,
+            cd: '/home/dd/engine',
+          });
+        } catch (err) {
+          logger.error(`Error during repository backup for ${deployId}:`, err);
+        }
       }
+    } finally {
+      if (ephemeral) Underpost.repo.cleanupPrivateEngineRepo();
     }
   };
 }

package/src/server/client-build-docs.js

@@ -394,6 +394,7 @@ const buildCoverage = async ({ host, path, docs }) => {
   const jsDocSourcePath = docs.jsJsonPath;
   const jsDocsConfig = JSON.parse(fs.readFileSync(jsDocSourcePath, 'utf8'));
   const coveragePath = docs.coveragePath;
+  const coverageOutputDir = docs.coverageOutputDir || 'coverage';
 
   const coverageOutputPath = `${coveragePath}/coverage`;
   if (!fs.existsSync(coverageOutputPath)) {
@@ -411,9 +412,15 @@ const buildCoverage = async ({ host, path, docs }) => {
   }
 
   if (fs.existsSync(coverageOutputPath) && fs.readdirSync(coverageOutputPath).length > 0) {
-    const coverageBuildPath = `${jsDocsConfig.opts.destination}coverage`;
+    const coverageBuildPath = `${jsDocsConfig.opts.destination}${coverageOutputDir}`;
     fs.mkdirSync(coverageBuildPath, { recursive: true });
-    fs.copySync(coverageOutputPath, coverageBuildPath);
+    // Hardhat 3 outputs HTML to coverage/html/; Hardhat 2 / c8 output directly to coverage/
+    const coverageHtmlSubdir = `${coverageOutputPath}/html`;
+    if (fs.existsSync(coverageHtmlSubdir) && fs.existsSync(`${coverageHtmlSubdir}/index.html`)) {
+      fs.copySync(coverageHtmlSubdir, coverageBuildPath);
+    } else {
+      fs.copySync(coverageOutputPath, coverageBuildPath);
+    }
     logger.warn('build coverage', coverageBuildPath);
   } else {
     logger.warn('no coverage output found, skipping', coverageOutputPath);

package/src/server/client-build.js

@@ -7,7 +7,7 @@
 'use strict';
 
 import fs from 'fs-extra';
-import { srcFormatted, componentFormatted, viewFormatted, JSONweb } from './client-formatted.js';
+import { transformClientJs, JSONweb } from './client-formatted.js';
 import { loggerFactory } from './logger.js';
 import {
   getCapVariableName,
@@ -16,7 +16,6 @@ import {
   uniqueArray,
 } from '../client/components/core/CommonJs.js';
 import { readConfJson } from './conf.js';
-import UglifyJS from 'uglify-js';
 import { minify } from 'html-minifier-terser';
 import AdmZip from 'adm-zip';
 import * as dir from 'path';
@@ -317,7 +316,8 @@ const buildClient = async (
         shellExec(`cd /home/dd && git clone https://github.com/designmodo/html-website-templates.git`);
       if (!fs.existsSync(`${rootClientPath}/index.php`)) {
         fs.copySync(`/home/dd/html-website-templates/${publicClientId.split('-publicClientId-')[1]}`, rootClientPath);
-        shellExec(`cd ${rootClientPath} && git init && git add . && git commit -m "Base template implementation"`);
+        Underpost.repo.initLocalRepo({ path: rootClientPath });
+        shellExec(`cd ${rootClientPath} && git add . && git commit -m "Base template implementation"`);
         // git remote add origin git@github.com:<username>/<repo>.git
         fs.writeFileSync(`${rootClientPath}/.git/.htaccess`, `Deny from all`, 'utf8');
       }
@@ -447,15 +447,15 @@ const buildClient = async (
 
             if (enableLiveRebuild && !options.liveClientBuildPaths.find((p) => p.srcBuildPath === jsSrcPath)) continue;
 
-            const jsSrc = componentFormatted(
-              await srcFormatted(fs.readFileSync(jsSrcPath, 'utf8')),
-              module,
+            const jsSrc = await transformClientJs(jsSrcPath, {
               dists,
-              path,
-              'components',
+              proxyPath: path,
+              basePath: 'components',
+              module,
               baseHost,
-            );
-            fs.writeFileSync(jsPublicPath, minifyBuild ? UglifyJS.minify(jsSrc).code : jsSrc, 'utf8');
+              minify: minifyBuild,
+            });
+            fs.writeFileSync(jsPublicPath, jsSrc, 'utf8');
           }
         }
 
@@ -469,15 +469,15 @@ const buildClient = async (
             const jsPublicPath = `${rootClientPath}/services/${module}/${module}.service.js`;
             if (enableLiveRebuild && !options.liveClientBuildPaths.find((p) => p.srcBuildPath === jsSrcPath)) continue;
 
-            let jsSrc = componentFormatted(
-              await srcFormatted(fs.readFileSync(jsSrcPath, 'utf8')),
-              module,
+            const jsSrc = await transformClientJs(jsSrcPath, {
               dists,
-              path,
-              'services',
+              proxyPath: path,
+              basePath: 'services',
+              module,
               baseHost,
-            );
-            fs.writeFileSync(jsPublicPath, minifyBuild ? UglifyJS.minify(jsSrc).code : jsSrc, 'utf8');
+              minify: minifyBuild,
+            });
+            fs.writeFileSync(jsPublicPath, jsSrc, 'utf8');
           }
         }
 
@@ -487,15 +487,15 @@ const buildClient = async (
             const jsPublicPath = `${rootClientPath}/services/${module}/${module}.management.js`;
             if (enableLiveRebuild && !options.liveClientBuildPaths.find((p) => p.srcBuildPath === jsSrcPath)) continue;
 
-            const jsSrc = componentFormatted(
-              await srcFormatted(fs.readFileSync(jsSrcPath, 'utf8')),
-              module,
+            const jsSrc = await transformClientJs(jsSrcPath, {
               dists,
-              path,
-              'services',
+              proxyPath: path,
+              basePath: 'services',
+              module,
               baseHost,
-            );
-            fs.writeFileSync(jsPublicPath, minifyBuild ? UglifyJS.minify(jsSrc).code : jsSrc, 'utf8');
+              minify: minifyBuild,
+            });
+            fs.writeFileSync(jsPublicPath, jsSrc, 'utf8');
           }
         }
       }
@@ -513,9 +513,9 @@ const buildClient = async (
         const jsPublicPath = `${rootClientPath}/sw.js`;
 
         if (!(enableLiveRebuild && !options.liveClientBuildPaths.find((p) => p.srcBuildPath === jsSrcPath))) {
-          const jsSrc = viewFormatted(await srcFormatted(fs.readFileSync(jsSrcPath, 'utf8')), dists, path, baseHost);
+          const jsSrc = await transformClientJs(jsSrcPath, { dists, proxyPath: path, baseHost, minify: minifyBuild });
 
-          fs.writeFileSync(jsPublicPath, minifyBuild ? UglifyJS.minify(jsSrc).code : jsSrc, 'utf8');
+          fs.writeFileSync(jsPublicPath, jsSrc, 'utf8');
         }
 
         if (
@@ -535,14 +535,14 @@ const buildClient = async (
 
             logger.info('View build', buildPath);
 
-            const jsSrc = viewFormatted(
-              await srcFormatted(fs.readFileSync(`./src/client/${view.client}.index.js`, 'utf8')),
+            const jsSrc = await transformClientJs(`./src/client/${view.client}.index.js`, {
               dists,
-              path,
+              proxyPath: path,
               baseHost,
-            );
+              minify: minifyBuild,
+            });
 
-            fs.writeFileSync(`${buildPath}${buildId}.js`, minifyBuild ? UglifyJS.minify(jsSrc).code : jsSrc, 'utf8');
+            fs.writeFileSync(`${buildPath}${buildId}.js`, jsSrc, 'utf8');
             const title = metadata.title ? metadata.title : title;
 
             const canonicalURL = `https://${host}${path}${

package/src/server/client-formatted.js

@@ -1,87 +1,139 @@
 /**
- * Module for formatting client-side code
+ * Module for formatting client-side code using esbuild for import rewriting and minification.
  * @module src/server/client-formatted.js
  * @namespace clientFormatted
  */
 
 'use strict';
 
+import * as esbuild from 'esbuild';
+import fs from 'fs-extra';
+import * as path from 'path';
+
+/**
+ * Escapes a string for safe use inside a RegExp.
+ * @param {string} s - The string to escape.
+ * @returns {string} The escaped string.
+ * @memberof clientFormatted
+ */
+const escapeRegExp = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+
 /**
- * Formats a source code string by removing 'html`' and 'css`' tags from template literals.
+ * Formats a source code string by removing 'html`' and 'css`' tagged template prefixes.
+ * Used for SSR VM execution where the full esbuild pipeline is not needed.
  * @param {string} src - The source code string.
  * @returns {string} The formatted source code.
  * @memberof clientFormatted
  */
-const srcFormatted = (src) =>
-  src
-    .replaceAll(' html`', '`')
-    .replaceAll(' css`', '`')
-    .replaceAll('{html`', '{`')
-    .replaceAll('{css`', '{`')
-    .replaceAll('(html`', '(`')
-    .replaceAll('(css`', '(`')
-    .replaceAll('[html`', '[`')
-    .replaceAll('[css`', '[`');
+const srcFormatted = (src) => src.replace(/(?<=[\s({[,;=+!?:^])(html|css)`/g, '`');
 
 /**
  * Converts a JavaScript object into a string that can be embedded in client-side code
  * and parsed back into an object (e.g., 'JSON.parse(`{...}`)').
+ * Escapes backticks and template expression markers for safe template literal embedding.
  * @param {*} data - The data to be stringified.
  * @returns {string} A string representing the code to parse the JSON data.
  * @memberof clientFormatted
  */
-const JSONweb = (data) => 'JSON.parse(`' + JSON.stringify(data) + '`)';
+const JSONweb = (data) => {
+  const json = JSON.stringify(data).replace(/`/g, '\\`').replace(/\$\{/g, '\\${');
+  return 'JSON.parse(`' + json + '`)';
+};
 
 /**
- * Formats a component's source code by rewriting its import paths to be absolute for browser consumption.
- * @param {string} src - The source code of the component.
- * @param {string} module - The name of the module/component.
- * @param {Array<object>} dists - An array of distribution objects with import names.
- * @param {string} proxyPath - The proxy path for the application.
- * @param {string} [componentBasePath=''] - The base path for components.
- * @param {string} [baseHost=''] - The base host URL.
- * @returns {string} The formatted source code with updated import paths.
+ * Creates an esbuild plugin that rewrites import paths for browser consumption.
+ * Handles dist library imports, relative imports, and marks all remaining imports as external.
+ * @param {object} options
+ * @param {Array<object>} [options.dists=[]] - Distribution objects with import_name and import_name_build.
+ * @param {string} options.proxyPath - The proxy path for the application.
+ * @param {string} [options.basePath=''] - The base path for the module type (e.g., 'components', 'services').
+ * @param {string} [options.module=''] - The module/component name for relative import resolution.
+ * @param {string} [options.baseHost=''] - The base host URL.
+ * @returns {import('esbuild').Plugin}
  * @memberof clientFormatted
  */
-const componentFormatted = (src, module, dists, proxyPath, componentBasePath = '', baseHost = '') => {
-  dists.map(
-    (dist) =>
-      (src = src.replaceAll(
-        `from '${dist.import_name}'`,
-        `from '${baseHost}${proxyPath !== '/' ? `${proxyPath}` : ''}${dist.import_name_build}'`,
-      )),
-  );
-  return src
-    .replaceAll(
-      `from '../`,
-      `from '${baseHost}${proxyPath !== '/' ? `${proxyPath}/` : '/'}${
-        componentBasePath === '' ? `` : `${componentBasePath}/`
-      }`,
-    )
-    .replaceAll(
-      `from './`,
-      `from '${baseHost}${proxyPath !== '/' ? `${proxyPath}/` : '/'}${
-        componentBasePath === '' ? `` : `${componentBasePath}/`
-      }${module}/`,
-    );
-};
+const importRewritePlugin = ({ dists = [], proxyPath, basePath = '', module = '', baseHost = '' }) => ({
+  name: 'import-rewrite',
+  setup(build) {
+    const prefix = `${baseHost}${proxyPath !== '/' ? `${proxyPath}/` : '/'}`;
+
+    // Rewrite dist library imports (e.g., '@neodrag/vanilla' → '/proxyPath/dist/@neodrag-vanilla/index.js')
+    if (dists) {
+      for (const dist of dists) {
+        if (!dist.import_name) continue;
+        const filter = new RegExp(`^${escapeRegExp(dist.import_name)}$`);
+        build.onResolve({ filter }, () => ({
+          path: `${baseHost}${proxyPath !== '/' ? proxyPath : ''}${dist.import_name_build}`,
+          external: true,
+        }));
+      }
+    }
+
+    // Rewrite relative imports to absolute paths based on proxy path and module
+    build.onResolve({ filter: /^\.\.?\// }, (args) => {
+      const basePrefix = `${prefix}${basePath ? `${basePath}/` : ''}`;
+      if (args.path.startsWith('./')) {
+        return {
+          path: `${basePrefix}${module ? `${module}/` : ''}${args.path.slice(2)}`,
+          external: true,
+        };
+      }
+      if (args.path.startsWith('../')) {
+        return {
+          path: `${basePrefix}${args.path.slice(3)}`,
+          external: true,
+        };
+      }
+    });
+
+    // Mark any remaining imports as external
+    build.onResolve({ filter: /.*/ }, (args) => {
+      if (args.kind === 'entry-point') return;
+      return { path: args.path, external: true };
+    });
+  },
+});
 
 /**
- * Formats a view's source code by rewriting its import paths.
- * @param {string} src - The source code of the view.
- * @param {Array<object>} dists - An array of distribution objects with import names.
- * @param {string} proxyPath - The proxy path for the application.
- * @param {string} [baseHost=''] - The base host URL.
- * @returns {string} The formatted source code with updated import paths.
+ * Transforms a JavaScript source file using esbuild with import path rewriting,
+ * tagged template stripping, and optional minification.
+ * Replaces the previous srcFormatted + componentFormatted/viewFormatted + UglifyJS pipeline.
+ * @param {string} srcPath - Path to the source file.
+ * @param {object} options
+ * @param {Array<object>} [options.dists=[]] - Distribution objects with import names.
+ * @param {string} options.proxyPath - The proxy path for the application.
+ * @param {string} [options.basePath=''] - Base path for the module type (e.g., 'components', 'services').
+ * @param {string} [options.module=''] - Module name for relative import resolution.
+ * @param {string} [options.baseHost=''] - Base host URL.
+ * @param {boolean} [options.minify=false] - Whether to minify the output.
+ * @returns {Promise<string>} The transformed source code.
  * @memberof clientFormatted
  */
-const viewFormatted = (src, dists, proxyPath, baseHost = '') => {
-  dists.map(
-    (dist) =>
-      (src = src.replaceAll(dist.import_name, `${proxyPath !== '/' ? `${proxyPath}` : ''}${dist.import_name_build}`)),
-  );
-  const componentFromFormatted = `from '${baseHost}${proxyPath !== '/' ? `${proxyPath}/` : '/'}`;
-  return src.replaceAll(`from './`, componentFromFormatted).replaceAll(`from '../`, componentFromFormatted);
+const transformClientJs = async (
+  srcPath,
+  { dists = [], proxyPath, basePath = '', module = '', baseHost = '', minify: shouldMinify = false } = {},
+) => {
+  const src = fs.readFileSync(srcPath, 'utf8');
+  const stripped = srcFormatted(src);
+
+  const result = await esbuild.build({
+    stdin: {
+      contents: stripped,
+      loader: 'js',
+      resolveDir: path.dirname(path.resolve(srcPath)),
+      sourcefile: srcPath,
+    },
+    bundle: true,
+    write: false,
+    format: 'esm',
+    platform: 'browser',
+    target: 'esnext',
+    minify: shouldMinify,
+    logLevel: 'warning',
+    plugins: [importRewritePlugin({ dists, proxyPath, basePath, module, baseHost })],
+  });
+
+  return result.outputFiles[0].text;
 };
 
-export { srcFormatted, JSONweb, componentFormatted, viewFormatted };
+export { srcFormatted, JSONweb, transformClientJs };

package/src/server/cron.js

@@ -33,7 +33,9 @@ const underpostContainerEnvPath = '/usr/lib/node_modules/underpost/.env';
  * @param {string} [params.cmd] - Optional pre-script commands to run before cron execution
  * @param {boolean} [params.suspend=false] - Whether the CronJob is suspended
  * @param {boolean} [params.dryRun=false] - Pass --dry-run flag to the cron command inside the container
- * @param {boolean} [params.ssh=false] - Execute backup commands via SSH on the remote node
+ * @param {boolean} [params.k3s=false] - Pass --k3s flag to the cron command inside the container
+ * @param {boolean} [params.kind=false] - Pass --kind flag to the cron command inside the container
+ * @param {boolean} [params.kubeadm=false] - Pass --kubeadm flag to the cron command inside the container
  * @returns {string} Kubernetes CronJob YAML manifest
  * @memberof UnderpostCron
  */
@@ -49,7 +51,9 @@ const cronJobYamlFactory = ({
   cmd,
   suspend = false,
   dryRun = false,
-  ssh = false,
+  k3s = false,
+  kind = false,
+  kubeadm = false,
 }) => {
   const containerImage = image || `underpost/underpost-engine:${Underpost.version}`;
 
@@ -60,10 +64,12 @@ const cronJobYamlFactory = ({
     .replace(/^-|-$/g, '')
     .substring(0, 52);
 
-  const cmdPart = cmd ? `${cmd} && ` : '';
   const cronBin = dev ? 'node bin' : 'underpost';
-  const flags = `${git ? '--git ' : ''}${dev ? '--dev ' : ''}${dryRun ? '--dry-run ' : ''}${ssh ? '--ssh ' : ''}`;
-  const cronCommand = `${cmdPart}${cronBin} cron ${flags}${deployList} ${jobList}`;
+  const flags = `${git ? '--git ' : ''}${dev ? '--dev ' : ''}${dryRun ? '--dry-run ' : ''}${k3s ? '--k3s ' : ''}${kind ? '--kind ' : ''}${kubeadm ? '--kubeadm ' : ''}`;
+  const commands = [`cd ${enginePath}`, `node bin run secret`];
+  if (cmd) commands.push(cmd);
+  commands.push(`${cronBin} cron ${flags}${deployList} ${jobList}`);
+  const fullCommand = commands.join(' &&\n                  ');
 
   return `apiVersion: batch/v1
 kind: CronJob
@@ -95,7 +101,7 @@ spec:
                 - /bin/sh
                 - -c
                 - >
-                  ${cronCommand}
+                  ${fullCommand}
               volumeMounts:
                 - mountPath: ${enginePath}
                   name: ${cronVolumeName}
@@ -183,7 +189,6 @@ class UnderpostCron {
      * @param {boolean} [options.kubeadm] - Use kubeadm cluster context (apply directly on host)
      * @param {boolean} [options.dryRun] - Preview cron jobs without executing them
      * @param {boolean} [options.createJobNow] - After applying, immediately create a Job from each CronJob (requires --apply)
-     * @param {boolean} [options.ssh] - Execute backup commands via SSH on the remote node
      * @memberof UnderpostCron
      */
     callback: async function (
@@ -227,7 +232,6 @@ class UnderpostCron {
      * @param {boolean} [options.k3s] - k3s cluster context (apply directly on host)
      * @param {boolean} [options.kind] - kind cluster context (apply via kind-worker container)
      * @param {boolean} [options.kubeadm] - kubeadm cluster context (apply directly on host)
-     * @param {boolean} [options.ssh] - Execute backup commands via SSH on the remote node
      * @memberof UnderpostCron
      */
     setupDeployStart: async function (deployId, options = {}) {
@@ -270,20 +274,20 @@ class UnderpostCron {
       }
 
       // Generate and apply cron job manifests for this deploy-id
+      const hasExplicitCluster = options.k3s || options.kind || options.kubeadm;
       await Underpost.cron.generateK8sCronJobs({
         deployId,
         namespace: options.namespace,
         image: options.image,
         apply: options.apply,
         createJobNow: options.createJobNow,
-        git: true,
-        dev: true,
-        kubeadm: true,
-        ssh: true,
-        cmd: ` cd ${enginePath} && node bin env ${deployId} production`,
-        k3s: false,
-        kind: false,
-        dryRun: false,
+        git: options.git !== undefined ? options.git : true,
+        dev: options.dev !== undefined ? options.dev : true,
+        kubeadm: hasExplicitCluster ? !!options.kubeadm : true,
+        cmd: options.cmd || `node bin env ${deployId} production`,
+        k3s: !!options.k3s,
+        kind: !!options.kind,
+        dryRun: !!options.dryRun,
       });
     },
 
@@ -305,7 +309,6 @@ class UnderpostCron {
      * @param {boolean} [options.kubeadm=false] - kubeadm cluster context (apply directly on host)
      * @param {boolean} [options.createJobNow=false] - After applying, create a Job from each CronJob immediately
      * @param {boolean} [options.dryRun=false] - Pass --dry-run=client to kubectl commands
-     * @param {boolean} [options.ssh=false] - Execute backup commands via SSH on the remote node
      * @memberof UnderpostCron
      */
     generateK8sCronJobs: async function (options = {}) {
@@ -362,7 +365,9 @@ class UnderpostCron {
           cmd: options.cmd,
           suspend: false,
           dryRun: !!options.dryRun,
-          ssh: !!options.ssh,
+          k3s: !!options.k3s,
+          kind: !!options.kind,
+          kubeadm: !!options.kubeadm,
         });
 
         const yamlFilePath = `${outputDir}/${cronJobName}.yaml`;

package/src/server/ipfs-client.js

@@ -244,7 +244,11 @@ const unpinCid = async (cid) => {
     });
     if (!clusterRes.ok) {
       const text = await clusterRes.text();
-      logger.warn(`IPFS Cluster unpin failed (${clusterRes.status}): ${text}`);
+      if (clusterRes.status === 404) {
+        logger.info(`IPFS Cluster unpin – CID already not pinned: ${cid}`);
+      } else {
+        logger.warn(`IPFS Cluster unpin failed (${clusterRes.status}): ${text}`);
+      }
     } else {
       logger.info(`IPFS Cluster unpin OK – CID: ${cid}`);
     }
@@ -428,6 +432,25 @@ const IpfsClient = {
   listClusterPins,
   listKuboPins,
   removeMfsPath,
+  /**
+   * Check whether a single CID is currently pinned on the local Kubo node.
+   * Uses the pin/ls?arg=<cid> endpoint which returns only that one pin
+   * (much cheaper than fetching the full list).
+   *
+   * @param {string} cid - IPFS Content Identifier to check.
+   * @returns {Promise<boolean>} true when the CID is pinned.
+   */
+  isCidPinned: async (cid) => {
+    const kuboUrl = getIpfsApiUrl();
+    try {
+      const res = await fetch(`${kuboUrl}/api/v0/pin/ls?arg=${encodeURIComponent(cid)}&type=all`, { method: 'POST' });
+      if (!res.ok) return false;
+      const json = await res.json();
+      return !!(json.Keys && json.Keys[cid]);
+    } catch {
+      return false;
+    }
+  },
 };
 
 export { IpfsClient };

package/src/server/peer.js

@@ -44,6 +44,14 @@ const logger = loggerFactory(import.meta);
  */
 const createPeerServer = async ({ port, origins, path }) => {
   logger.info('origins', origins);
+
+  // In development, allow the local client origin (peer runs on port+1 relative to the client)
+  if (process.env.NODE_ENV === 'development') {
+    const clientPort = port - 1;
+    const devOrigin = `http://localhost:${clientPort}`;
+    if (!origins.includes(devOrigin)) origins.push(devOrigin);
+  }
+
   /** @type {import('peer').IConfig} */
   const options = {
     port,