underpost 3.1.3 → 3.2.2

package/CLI-HELP.md

@@ -1,4 +1,4 @@
-## underpost ci/cd cli v3.1.3
+## underpost ci/cd cli v3.2.2
 
 ### Usage: `underpost [options] [command]`
   ```
@@ -34,6 +34,7 @@ Commands:
   run [options] <runner-id> [path]                           Runs specified scripts using various runners.
   lxd [options]                                              Manages LXD virtual machines as K3s nodes (control plane or workers).
   baremetal [options] [workflow-id]                          Manages baremetal server operations, including installation, database setup, commissioning, and user management.
+  release [options] [version]                                Release orchestrator for building new versions and deploying releases of the Underpost CLI.
   help [command]                                             display help for command
  
 ```
@@ -183,7 +184,7 @@ Arguments:
                                      message for the commit.
 
 Options:
-  --log <latest-n>                   Shows commit history from the specified
+  --log [latest-n]                   Shows commit history from the specified
                                      number of latest n path commits.
   --last-msg <latest-n>              Displays the last n commit message.
   --empty                            Allows committing with empty files.
@@ -210,7 +211,14 @@ Options:
   --changelog-no-hash                Excludes commit hashes from the generated
                                      changelog entries (used with
                                      --changelog-build).
+  --unpush                           With --log, automatically sets range to
+                                     unpushed commits ahead of remote.
   -b                                 Shows the current Git branch name.
+  -p [branch]                        Shows the reflog for the specified branch.
+  --bc <commit-hash>                 Shows branches that contain the specified
+                                     commit.
+  --is-remote-repo <url-repo>        Checks whether a remote Git repository URL
+                                     is reachable. Prints true or false.
   -h, --help                         display help for command
  
 ```
@@ -510,6 +518,12 @@ Options:
                                       machine network configuration.
   --kubeadm                           Enables the kubeadm context for deployment
                                       operations.
+  --k3s                               Enables the k3s context for deployment
+                                      operations.
+  --kind                              Enables the kind context for deployment
+                                      operations.
+  --git-clean                         Runs git clean on volume mount paths
+                                      before copying.
   --etc-hosts                         Enables the etc-hosts context for
                                       deployment operations.
   --restore-hosts                     Restores default `/etc/hosts` entries.
@@ -539,13 +553,15 @@ Manages secrets for various platforms.
 
 Arguments:
   platform                            The secret management platform. Options:
-                                      underpost.
+                                      underpost, globalSecretClean.
 
 Options:
   --init                              Initializes the secrets platform
                                       environment.
   --create-from-file <path-env-file>  Creates secrets from a specified
                                       environment file.
+  --create-from-env                   Creates secrets from container environment
+                                      variables (envFrom: secretRef).
   --list                              Lists all available secrets for the
                                       platform.
   -h, --help                          display help for command
@@ -645,6 +661,7 @@ Options:
   --kubeadm                                  Enables the kubeadm context for database operations.
   --kind                                     Enables the kind context for database operations.
   --k3s                                      Enables the k3s context for database operations.
+  --repo-backup                              Backs up repositories (git commit+push) inside deployment pods via kubectl exec.
   -h, --help                                 display help for command
  
 ```
@@ -709,8 +726,6 @@ Options:
   --dry-run                  Preview cron jobs without executing them.
   --create-job-now           After applying manifests, immediately create a Job
                              from each CronJob (requires --apply).
-  --ssh                      Execute backup commands via SSH on the remote node
-                             instead of locally.
   -h, --help                 display help for command
  
 ```
@@ -859,7 +874,7 @@ Options:
 Runs specified scripts using various runners.
 
 Arguments:
-  runner-id                                       The runner ID to run. Options: dev-cluster,ipfs-expose,metadata,svc-ls,svc-rm,ssh-deploy-info,dev-hosts-expose,dev-hosts-restore,cluster-build,template-deploy,template-deploy-image,clean,pull,release-deploy,ssh-deploy,ide,crypto-policy,sync,stop,ssh-deploy-stop,ssh-deploy-db-rollback,ssh-deploy-db,ssh-deploy-db-status,tz,get-proxy,instance-promote,instance,ls-deployments,host-update,dd-container,ip-info,db-client,git-conf,promote,metrics,cluster,deploy,disk-clean,disk-devices,disk-usage,dev,service,etc-hosts,sh,log,ps,pid-info,background,ports,deploy-test,tf-vae-test,spark-template,rmi,kill,secret,underpost-config,gpu-env,tf-gpu-test,deploy-job.
+  runner-id                                       The runner ID to run. Options: dev-cluster,ipfs-expose,metadata,svc-ls,svc-rm,ssh-deploy-info,dev-hosts-expose,dev-hosts-restore,cluster-build,template-deploy,template-deploy-local,template-deploy-image,docker-image,clean,pull,release-deploy,ssh-deploy,ide,crypto-policy,sync,stop,ssh-deploy-stop,ssh-deploy-db-rollback,ssh-deploy-db,ssh-deploy-db-status,tz,get-proxy,instance-promote,instance,ls-deployments,host-update,dd-container,ip-info,db-client,git-conf,promote,metrics,cluster,deploy,disk-clean,disk-devices,disk-usage,dev,service,etc-hosts,sh,log,ps,pid-info,background,ports,deploy-test,tf-vae-test,spark-template,rmi,kill,generate-pass,secret,underpost-config,gpu-env,tf-gpu-test,deploy-job.
   path                                            The input value, identifier, or path for the operation.
 
 Options:
@@ -906,6 +921,7 @@ Options:
   --kubeadm                                       Sets the kubeadm cluster context for the runner execution.
   --k3s                                           Sets the k3s cluster context for the runner execution.
   --kind                                          Sets the kind cluster context for the runner execution.
+  --git-clean                                     Runs git clean on volume mount paths before copying.
   --log-type <log-type>                           Sets the log type for the runner execution.
   --deploy-id <deploy-id>                         Sets deploy id context for the runner execution.
   --user <user>                                   Sets user context for the runner execution.
@@ -926,6 +942,7 @@ Options:
   --from-n-commit <n>                             Number of commits back to use for message propagation in template-deploy (default: 1, last commit only).
   --create-job-now                                After applying cron manifests, immediately create a Job from each CronJob (forwarded to cron runner).
   --host-aliases <host-aliases>                   Adds entries to the Pod /etc/hosts via hostAliases. Format: semicolon-separated entries of "ip=hostname1,hostname2" (e.g., "127.0.0.1=foo.local,bar.local;10.1.2.3=foo.remote,bar.remote").
+  --copy                                          Copies the runner output to the clipboard (supported by: generate-pass, template-deploy-local).
   -h, --help                                      display help for command
  
 ```
@@ -1038,4 +1055,34 @@ Options:
   -h, --help                                    display help for command
  
 ```
+  
+
+### `release` :
+```
+ Usage: underpost release [options] [version]
+
+Release orchestrator for building new versions and deploying releases of the
+Underpost CLI.
+
+Arguments:
+  version                The new version string to set (e.g., "3.1.4"). Defaults
+                         to current version.
+
+Options:
+  --build                Builds a new version: tests template, bumps versions,
+                         rebuilds manifests and configs.
+  --deploy               Deploys the release: syncs secrets, commits, and pushes
+                         to remote repositories.
+  --ci-push <deploy-id>  Local equivalent of engine-*.ci.yml: builds
+                         dd-{deploy-id} and pushes to the engine-{deploy-id}
+                         repository. Accepts the suffix (e.g., "cyberia"),
+                         "dd-cyberia", or "engine-cyberia".
+  --message <message>    Commit message for --ci-push or --pwa-build (defaults
+                         to last commit of the engine repository).
+  --pwa-build            Runs the pwa-microservices-template update flow: always
+                         re-clones, syncs engine sources, installs, builds, and
+                         pushes.
+  -h, --help             display help for command
+ 
+```
   

package/Dockerfile

@@ -34,9 +34,11 @@ RUN npm --version
 RUN npm install -g underpost
 RUN underpost --version
 
+# Create non-root user for secure container execution (cron jobs, init containers)
+# Deployment containers override to root via securityContext when npm install -g is needed
+RUN useradd -m -u 1000 -s /bin/bash dd
+
 # Create working directory
-RUN mkdir /home/dd
-VOLUME /home/dd
 WORKDIR /home/dd
 
 # Expose necessary ports

package/README.md

@@ -16,7 +16,7 @@
 
 <div align="center">
 
-[![Node.js CI](https://github.com/underpostnet/engine/actions/workflows/docker-image.ci.yml/badge.svg?branch=master)](https://github.com/underpostnet/engine/actions/workflows/docker-image.ci.yml) [![Test](https://github.com/underpostnet/engine/actions/workflows/coverall.ci.yml/badge.svg?branch=master)](https://github.com/underpostnet/engine/actions/workflows/coverall.ci.yml) [![Downloads](https://img.shields.io/npm/dm/underpost.svg)](https://www.npmjs.com/package/underpost) [![Socket Badge](https://socket.dev/api/badge/npm/package/underpost/3.1.3)](https://socket.dev/npm/package/underpost/overview/3.1.3) [![Coverage Status](https://coveralls.io/repos/github/underpostnet/engine/badge.svg?branch=master)](https://coveralls.io/github/underpostnet/engine?branch=master) [![Version](https://img.shields.io/npm/v/underpost.svg)](https://www.npmjs.org/package/underpost) [![License](https://img.shields.io/npm/l/underpost.svg)](https://www.npmjs.com/package/underpost)
+[![Node.js CI](https://github.com/underpostnet/engine/actions/workflows/docker-image.ci.yml/badge.svg?branch=master)](https://github.com/underpostnet/engine/actions/workflows/docker-image.ci.yml) [![Test](https://github.com/underpostnet/engine/actions/workflows/coverall.ci.yml/badge.svg?branch=master)](https://github.com/underpostnet/engine/actions/workflows/coverall.ci.yml) [![Downloads](https://img.shields.io/npm/dm/underpost.svg)](https://www.npmjs.com/package/underpost) [![Socket Badge](https://socket.dev/api/badge/npm/package/underpost/3.2.2)](https://socket.dev/npm/package/underpost/overview/3.2.2) [![Coverage Status](https://coveralls.io/repos/github/underpostnet/engine/badge.svg?branch=master)](https://coveralls.io/github/underpostnet/engine?branch=master) [![Version](https://img.shields.io/npm/v/underpost.svg)](https://www.npmjs.org/package/underpost) [![License](https://img.shields.io/npm/l/underpost.svg)](https://www.npmjs.com/package/underpost)
 
 </div>
 
@@ -61,7 +61,7 @@ npm run dev
 <a target="_top" href="https://www.nexodev.org/docs?cid=src">See Docs here.</a>
 
 <!-- cli-index-start -->
-## underpost ci/cd cli v3.1.3
+## underpost ci/cd cli v3.2.2
 
 ### Usage: `underpost [options] [command]`
   ```
@@ -97,6 +97,7 @@ Commands:
   run [options] <runner-id> [path]                           Runs specified scripts using various runners.
   lxd [options]                                              Manages LXD virtual machines as K3s nodes (control plane or workers).
   baremetal [options] [workflow-id]                          Manages baremetal server operations, including installation, database setup, commissioning, and user management.
+  release [options] [version]                                Release orchestrator for building new versions and deploying releases of the Underpost CLI.
   help [command]                                             display help for command
  
 ```

package/bin/build.js

@@ -169,21 +169,22 @@ const { DefaultConf } = await import(`../conf.${confName}.js`);
       packageJson.description = 'Cyberia Engine - Object Layer and Assets Management Microservice';
       const { CyberiaDependencies } = await import(`../src/client/components/cyberia-portal/CommonCyberiaPortal.js`);
       packageJson.dependencies = {
-        ...packageJson.dependencies,
+        ...originPackageJson.dependencies,
         ...CyberiaDependencies,
       };
-      packageJson.overrides = originPackageJson.overrides;
       fs.writeFileSync(`${basePath}/bin/index.js`, fs.readFileSync(`./bin/cyberia.js`, 'utf8'), 'utf8');
       fs.copyFileSync(`./src/api/object-layer/README.md`, `${basePath}/README.md`);
       fs.copySync(`./hardhat`, `${basePath}/hardhat`);
       fs.copySync(`./hardhat/WHITE-PAPER.md`, `${basePath}/WHITE-PAPER.md`);
-      fs.copyFileSync(`./jsdoc.${confName}.json`, `${basePath}/jsdoc.json`);
       for (const path of [
+        '/src/grpc/cyberia',
         '/src/client/ssr/pages/CyberiaServerMetrics.js',
         '/src/server/object-layer.js',
         '/src/server/atlas-sprite-sheet-generator.js',
         '/src/server/shape-generator.js',
         '/src/server/semantic-layer-generator.js',
+        '/src/server/semantic-layer-generator-floor.js',
+        '/src/server/semantic-layer-generator-skin.js',
         '/test/shape-generator.test.js',
         '/src/server/besu-genesis-generator.js',
         '/.github/workflows/hardhat.ci.yml',
@@ -203,25 +204,30 @@ const { DefaultConf } = await import(`../conf.${confName}.js`);
   fs.copySync(`./src/cli`, `${basePath}/src/cli`);
   if (!fs.existsSync(`${basePath}/images`)) fs.mkdirSync(`${basePath}/images`);
 
-  const env = process.argv.includes('development') ? 'development' : 'production';
-  const deploymentsFiles = ['proxy.yaml', 'deployment.yaml', 'secret.yaml'];
-  // remove engine-private of .dockerignore for local testing
-  for (const file of deploymentsFiles) {
-    if (fs.existsSync(`./manifests/deployment/${confName}-${env}/${file}`)) {
-      fs.copyFileSync(`./manifests/deployment/${confName}-${env}/${file}`, `${basePath}/${file}`);
-    }
-  }
-
   fs.copyFileSync(`./.github/workflows/${repoName}.ci.yml`, `${basePath}/.github/workflows/${repoName}.ci.yml`);
   fs.copyFileSync(`./.github/workflows/${repoName}.cd.yml`, `${basePath}/.github/workflows/${repoName}.cd.yml`);
 
+  if (fs.existsSync(`./jsdoc.${confName}.json`)) {
+    fs.copyFileSync(`./jsdoc.${confName}.json`, `${basePath}/jsdoc.json`);
+    fs.copyFileSync(`./jsdoc.${confName}.json`, `${basePath}/jsdoc.${confName}.json`);
+  }
+
+  if (fs.existsSync(`./manifests/deployment/${confName}-development`))
+    fs.copySync(
+      `./manifests/deployment/${confName}-development`,
+      `${basePath}/manifests/deployment/${confName}-development`,
+    );
+
   // Copy conf.<deploy-id>.js to conf.js for the respective deployment
   fs.copyFileSync(`./conf.${confName}.js`, `${basePath}/conf.js`);
   fs.copyFileSync(`./manifests/deployment/${confName}-development/proxy.yaml`, `${basePath}/proxy.yaml`);
   fs.copyFileSync(`./manifests/deployment/${confName}-development/deployment.yaml`, `${basePath}/deployment.yaml`);
+  const pvPvcPath = `./manifests/deployment/${confName}-development/pv-pvc.yaml`;
+  if (fs.existsSync(pvPvcPath)) fs.copyFileSync(pvPvcPath, `${basePath}/pv-pvc.yaml`);
 
   if (fs.existsSync(`./src/ws/${confName.split('-')[1]}`)) {
     fs.copySync(`./src/ws/${confName.split('-')[1]}`, `${basePath}/src/ws/${confName.split('-')[1]}`);
   }
+  fs.copyFileSync(`.gitignore`, `${basePath}/.gitignore`);
   shellExec(`cd ${basePath} && npm install --ignore-scripts`);
 }

package/bin/deploy.js

@@ -3,7 +3,7 @@ import axios from 'axios';
 
 import dotenv from 'dotenv';
 
-import { pbcopy, shellCd, shellExec } from '../src/server/process.js';
+import { pbcopy, shellExec } from '../src/server/process.js';
 import { loggerFactory } from '../src/server/logger.js';
 import {
   addApiConf,
@@ -218,115 +218,6 @@ try {
       break;
     }
 
-    case 'version-build': {
-      dotenv.config({ path: `./engine-private/conf/dd-cron/.env.production`, override: true });
-      shellCd(`/home/dd/engine`);
-      Underpost.repo.clean({ paths: ['/home/dd/engine', '/home/dd/engine/engine-private '] });
-      shellExec(`node bin pull . ${process.env.GITHUB_USERNAME}/engine`);
-      shellExec(`node bin run kill 4001`);
-      shellExec(`node bin run kill 4002`);
-      shellExec(`node bin run kill 4003`);
-      shellExec(`npm run update:template`);
-      shellExec(`cd ../pwa-microservices-template && npm install && npm run build`);
-      console.log(fs.existsSync(`../pwa-microservices-template/engine-private/conf/dd-default`));
-      shellExec(`cd ../pwa-microservices-template && ENABLE_FILE_LOGS=true timeout 5s npm run dev`, {
-        async: true,
-      });
-      await timer(5500);
-      const templateRunnerResult = fs.readFileSync(`../pwa-microservices-template/logs/start.js/all.log`, 'utf8');
-      logger.info('Test template runner result');
-      console.log(templateRunnerResult);
-      if (!templateRunnerResult || templateRunnerResult.toLowerCase().match('error')) {
-        logger.error('Test template runner result failed');
-        break;
-      }
-      shellCd(`/home/dd/engine`);
-      Underpost.repo.clean({ paths: ['/home/dd/engine', '/home/dd/engine/engine-private '] });
-      const originPackageJson = JSON.parse(fs.readFileSync(`package.json`, 'utf8'));
-      const newVersion = process.argv[3] ?? originPackageJson.version;
-      const { version } = originPackageJson;
-      originPackageJson.version = newVersion;
-      fs.writeFileSync(`package.json`, JSON.stringify(originPackageJson, null, 4), 'utf8');
-
-      const originPackageLockJson = JSON.parse(fs.readFileSync(`package-lock.json`, 'utf8'));
-      originPackageLockJson.version = newVersion;
-      originPackageLockJson.packages[''].version = newVersion;
-      fs.writeFileSync(`package-lock.json`, JSON.stringify(originPackageLockJson, null, 4), 'utf8');
-
-      if (fs.existsSync(`./engine-private/conf`)) {
-        const files = await fs.readdir(`./engine-private/conf`, { recursive: true });
-        for (const relativePath of files) {
-          const filePah = `./engine-private/conf/${relativePath.replaceAll(`\\`, '/')}`;
-          if (filePah.split('/').pop() === 'package.json') {
-            const originPackage = JSON.parse(fs.readFileSync(filePah, 'utf8'));
-            originPackage.version = newVersion;
-            fs.writeFileSync(filePah, JSON.stringify(originPackage, null, 4), 'utf8');
-          }
-          if (filePah.split('/').pop() === 'deployment.yaml') {
-            fs.writeFileSync(
-              filePah,
-              fs
-                .readFileSync(filePah, 'utf8')
-                .replaceAll(`v${version}`, `v${newVersion}`)
-                .replaceAll(`engine.version: ${version}`, `engine.version: ${newVersion}`),
-              'utf8',
-            );
-          }
-        }
-      }
-
-      fs.writeFileSync(
-        `./manifests/deployment/dd-default-development/deployment.yaml`,
-        fs
-          .readFileSync(`./manifests/deployment/dd-default-development/deployment.yaml`, 'utf8')
-          .replaceAll(`underpost:v${version}`, `underpost:v${newVersion}`),
-        'utf8',
-      );
-
-      if (fs.existsSync(`./.github/workflows/docker-image.ci.yml`))
-        fs.writeFileSync(
-          `./.github/workflows/docker-image.ci.yml`,
-          fs
-            .readFileSync(`./.github/workflows/docker-image.ci.yml`, 'utf8')
-            .replaceAll(`underpost-engine:v${version}`, `underpost-engine:v${newVersion}`),
-          'utf8',
-        );
-
-      fs.writeFileSync(
-        `./src/index.js`,
-        fs.readFileSync(`./src/index.js`, 'utf8').replaceAll(`${version}`, `${newVersion}`),
-        'utf8',
-      );
-      shellExec(`node bin/deploy cli-docs ${version} ${newVersion}`);
-      shellExec(`node bin/deploy update-dependencies`);
-      shellExec(`node bin/build dd`);
-      shellExec(`node bin deploy --build-manifest --sync --info-router --replicas 1 dd production`);
-      shellExec(`node bin deploy --build-manifest --sync --info-router --replicas 1 dd development`);
-      shellExec(`node bin/deploy build-default-confs`);
-      shellExec(`sudo rm -rf ./engine-private/conf/dd-default`);
-      shellExec(`node bin new --deploy-id dd-default`);
-      console.log(fs.existsSync(`./engine-private/conf/dd-default`));
-      shellExec(`sudo rm -rf ./engine-private/conf/dd-default`);
-      shellExec(`node bin cron --dev --setup-start`);
-      shellExec(`node bin cmt --changelog-build`);
-      process.exit(0);
-      break;
-    }
-
-    case 'version-deploy': {
-      dotenv.config({ path: `./engine-private/conf/dd-cron/.env.production`, override: true });
-      shellExec(
-        `underpost secret underpost --create-from-file /home/dd/engine/engine-private/conf/dd-cron/.env.production`,
-      );
-      shellExec(`node bin/build dd conf`);
-      shellExec(`git add . && cd ./engine-private && git add .`);
-      shellExec(`node bin cmt . ci package-pwa-microservices-template 'New release v:${process.argv[3]}'`);
-      shellExec(`node bin cmt ./engine-private ci package-pwa-microservices-template`);
-      shellExec(`node bin push . ${process.env.GITHUB_USERNAME}/engine`);
-      shellExec(`cd ./engine-private && node ../bin push . ${process.env.GITHUB_USERNAME}/engine-private`);
-      break;
-    }
-
     case 'build-default-confs': {
       for (const deployId of fs
         .readFileSync(`./engine-private/deploy/dd.router`, 'utf8')
@@ -475,7 +366,10 @@ ${shellExec(`git log | grep Author: | sort -u`, { stdout: true }).split(`\n`).jo
         `${path}/.env`,
         fs
           .readFileSync(`${path}/.env`, 'utf8')
-          .replace(`FIRST_SUPERUSER=admin@example.com`, `FIRST_SUPERUSER=development@underpost.net`)
+          .replace(
+            `FIRST_SUPERUSER=admin@example.com`,
+            `FIRST_SUPERUSER=${process.env.GITHUB_EMAIL || 'development@underpost.net'}`,
+          )
           .replace(`FIRST_SUPERUSER_PASSWORD=changethis`, `FIRST_SUPERUSER_PASSWORD=${password}`)
           .replace(`SECRET_KEY=changethis`, `SECRET_KEY=${password}`)
           .replace(`POSTGRES_DB=app`, `POSTGRES_DB=postgresdb`)
@@ -561,7 +455,7 @@ ${shellExec(`git log | grep Author: | sort -u`, { stdout: true }).split(`\n`).jo
           shellExec(
             `sudo kubectl create secret generic ${secretSelector}` +
               ` --from-file=SECRET_KEY=/home/dd/engine/engine-private/postgresql-password` +
-              ` --from-literal=FIRST_SUPERUSER=development@underpost.net` +
+              ` --from-literal=FIRST_SUPERUSER=${process.env.GITHUB_EMAIL || 'development@underpost.net'}` +
               ` --from-file=FIRST_SUPERUSER_PASSWORD=/home/dd/engine/engine-private/postgresql-password` +
               ` --dry-run=client -o yaml | kubectl apply -f - -n ${namespace}`,
           );
@@ -798,6 +692,7 @@ nvidia/gpu-operator \
         for (const file of fs.readdirSync(`./engine-private/conf/${deployId}/`)) {
           const deployPackage = JSON.parse(fs.readFileSync(`./engine-private/conf/${deployId}/package.json`, 'utf8'));
           deployPackage.overrides = originPackageJson.overrides;
+          deployPackage.dependencies = originPackageJson.dependencies;
           fs.writeFileSync(
             `./engine-private/conf/${deployId}/package.json`,
             JSON.stringify(deployPackage, null, 4),
@@ -810,7 +705,7 @@ nvidia/gpu-operator \
               for (const path of Object.keys(confObj[host])) {
               }
             }
-            fs.writeFileSync(filePath, JSON.stringify(confObj, null, 4), 'utf8');
+            // fs.writeFileSync(filePath, JSON.stringify(confObj, null, 4), 'utf8');
             logger.info(`sync-conf`, { deployId, file });
           }
         }
@@ -839,7 +734,7 @@ nvidia/gpu-operator \
       if (fs.existsSync(toPath)) fs.removeSync(toPath);
       shellExec(`node bin/deploy pw-conf ${scriptPath}`);
       shellExec(`kubectl delete deployment playwright-server --ignore-not-found`);
-      while (Underpost.deploy.get('playwright-server').length > 0) {
+      while (Underpost.kubectl.get('playwright-server').length > 0) {
         logger.info(`Waiting for playwright-server deployment to be deleted...`);
         await timer(1000);
       }
@@ -847,13 +742,13 @@ nvidia/gpu-operator \
       const id = 'playwright-server';
       await Underpost.test.statusMonitor(id);
       const nameSpace = 'default';
-      const [pod] = Underpost.deploy.get(id);
+      const [pod] = Underpost.kubectl.get(id);
       const podName = pod.NAME;
       shellExec(`kubectl logs -f ${podName} -n ${nameSpace}`, {
         async: true,
       });
       (async () => {
-        while (!Underpost.deploy.existsContainerFile({ podName, path: fromPath })) {
+        while (!Underpost.kubectl.existsFile({ podName, path: fromPath })) {
           await timer(1000);
           logger.info(`Waiting for file ${fromPath} in pod ${podName}...`);
         }
@@ -874,7 +769,8 @@ nvidia/gpu-operator \
     }
 
     case 'dependabot': {
-      shellExec(`git fetch origin`);
+      dotenv.config({ path: `./engine-private/conf/dd-cron/.env.production`, override: true });
+      shellExec(`git fetch origin --prune`);
 
       const { stdout: branchOutput } = shellExec(`git branch -r`, { silent: true });
       const dependabotBranches = branchOutput
@@ -890,20 +786,177 @@ nvidia/gpu-operator \
 
       logger.info('Found dependabot branches:', dependabotBranches);
 
-      for (const branch of dependabotBranches) {
-        logger.info(`Checking out branch: ${branch}`);
-        shellExec(`git checkout -B ${branch} origin/${branch}`);
+      // Stash local changes to prevent checkout/merge conflicts
+      const stashResult = shellExec(`git stash --include-untracked`, { silent: true });
+      const hasStash = !stashResult.stdout.includes('No local changes to save');
+
+      // Checkout master
+      const checkoutResult = shellExec(`git checkout master`);
+      if (checkoutResult.code !== 0) {
+        logger.error('Failed to checkout master');
+        if (hasStash) shellExec(`git stash pop`);
+        break;
       }
 
-      logger.info('Checking out master');
-      shellExec(`git checkout master`);
+      // Pull latest master
+      shellExec(`git pull origin master`);
+
+      // Get repo URI from remote
+      const remoteUrl = shellExec(`git config --get remote.origin.url`, { stdout: true, silent: true }).trim();
+      const gitUri = remoteUrl.replace(/.*github\.com[:/]/, '').replace(/\.git$/, '');
+
+      const mergedBranches = [];
+      const failedBranches = [];
 
       for (const branch of dependabotBranches) {
         logger.info(`Merging branch: ${branch}`);
-        shellExec(`git merge ${branch}`);
+        const mergeResult = shellExec(`git merge origin/${branch}`);
+        if (mergeResult.code === 0) {
+          const isAlreadyMerged = mergeResult.stdout && mergeResult.stdout.includes('Already up to date');
+          mergedBranches.push({ branch, isAlreadyMerged });
+        } else {
+          logger.error(`Failed to merge branch: ${branch}`);
+          shellExec(`git merge --abort`, { silent: true });
+          failedBranches.push(branch);
+        }
       }
 
-      logger.info('All dependabot branches merged into master');
+      // Delete merged local and remote branches
+      for (const { branch, isAlreadyMerged } of mergedBranches) {
+        shellExec(`git branch -D ${branch}`, { silent: true });
+        // logger.info(`Deleting remote branch: ${branch}${isAlreadyMerged ? ' (already merged)' : ''}`);
+        // shellExec(`git push https://${process.env.GITHUB_TOKEN}@github.com/${gitUri}.git --delete ${branch}`, {
+        //   disableLog: true,
+        // });
+      }
+
+      // Restore stashed changes
+      if (hasStash) shellExec(`git stash pop`);
+
+      logger.info(
+        'Merged branches:',
+        mergedBranches.map((m) => m.branch),
+      );
+      if (failedBranches.length > 0) logger.warn('Failed branches:', failedBranches);
+      logger.info('Dependabot merge completed');
+      break;
+    }
+
+    case 'add-api': {
+      // node bin/deploy add-api <apiId> <deployId> [clientId] [host]
+      // Example: node bin/deploy add-api cyberia-dialogue dd-cyberia cyberia-portal
+      // Example: node bin/deploy add-api cyberia-dialogue dd-cyberia cyberia-portal underpost.net
+      //
+      // Adds an API to server conf files (main + dev variants) and client conf.
+      // - conf.server.json: adds apiId to every host/path that has an `apis` array
+      //   (or only to the specified host if [host] is provided)
+      // - conf.server.dev.*.json: same treatment for all dev variants
+      // - conf.client.json: adds apiId to the specified clientId's `services` array
+      // Idempotent: skips if the API is already present.
+
+      const apiId = process.argv[3];
+      const deployId = process.argv[4];
+      const clientId = process.argv[5];
+      const targetHost = process.argv[6];
+
+      if (!apiId || !deployId) {
+        logger.error('Usage: node bin/deploy add-api <apiId> <deployId> [clientId] [host]');
+        logger.error('Example: node bin/deploy add-api cyberia-dialogue dd-cyberia cyberia-portal');
+        logger.error('Example: node bin/deploy add-api cyberia-dialogue dd-cyberia cyberia-portal underpost.net');
+        process.exit(1);
+      }
+
+      const confFolder = `./engine-private/conf/${deployId}`;
+      if (!fs.existsSync(confFolder)) {
+        logger.error(`Config folder not found: ${confFolder}`);
+        process.exit(1);
+      }
+
+      // Helper: add apiId to apis[] arrays in a server conf file (idempotent)
+      // When targetHost is set, only entries under that host are modified.
+      const addApiToServerConf = (filePath) => {
+        if (!fs.existsSync(filePath)) return 0;
+        const conf = JSON.parse(fs.readFileSync(filePath, 'utf8'));
+        let count = 0;
+        const hosts = targetHost ? (conf[targetHost] ? [targetHost] : []) : Object.keys(conf);
+        for (const host of hosts) {
+          for (const path of Object.keys(conf[host])) {
+            const entry = conf[host][path];
+            if (Array.isArray(entry.apis) && entry.apis.length > 0 && !entry.apis.includes(apiId)) {
+              entry.apis.push(apiId);
+              count++;
+            }
+          }
+        }
+        if (count > 0) {
+          fs.writeFileSync(filePath, JSON.stringify(conf, null, 4), 'utf8');
+        }
+        return count;
+      };
+
+      // 1. Main conf.server.json
+      const mainPath = `${confFolder}/conf.server.json`;
+      const mainCount = addApiToServerConf(mainPath);
+      logger.info(`conf.server.json: added "${apiId}" to ${mainCount} path(s)`);
+
+      // 2. All dev variants: conf.server.dev.*.json
+      const devFiles = fs
+        .readdirSync(confFolder)
+        .filter((f) => f.startsWith('conf.server.dev.') && f.endsWith('.json'));
+      for (const devFile of devFiles) {
+        const devPath = `${confFolder}/${devFile}`;
+        const devCount = addApiToServerConf(devPath);
+        logger.info(`${devFile}: added "${apiId}" to ${devCount} path(s)`);
+      }
+
+      // Helper: add apiId to a client conf file's clientId services (idempotent)
+      const addApiToClientConf = (filePath, label) => {
+        if (!clientId || !fs.existsSync(filePath)) return;
+        const confClient = JSON.parse(fs.readFileSync(filePath, 'utf8'));
+        if (confClient[clientId] && Array.isArray(confClient[clientId].services)) {
+          if (!confClient[clientId].services.includes(apiId)) {
+            confClient[clientId].services.push(apiId);
+            fs.writeFileSync(filePath, JSON.stringify(confClient, null, 4), 'utf8');
+            logger.info(`${label}: added "${apiId}" to "${clientId}" services`);
+          } else {
+            logger.info(`${label}: "${apiId}" already in "${clientId}" services`);
+          }
+        } else {
+          logger.warn(`${label}: clientId "${clientId}" not found or has no services array`);
+        }
+      };
+
+      // 3. Client conf.client.json
+      addApiToClientConf(`${confFolder}/conf.client.json`, 'conf.client.json');
+
+      // 4. Replicas: engine-private/replica/<deployId>-*
+      const replicaBase = './engine-private/replica';
+      if (fs.existsSync(replicaBase)) {
+        const replicaDirs = fs
+          .readdirSync(replicaBase)
+          .filter((d) => d.startsWith(`${deployId}-`) && fs.statSync(`${replicaBase}/${d}`).isDirectory());
+        for (const replicaDir of replicaDirs) {
+          const replicaFolder = `${replicaBase}/${replicaDir}`;
+          // Server conf
+          const rMainCount = addApiToServerConf(`${replicaFolder}/conf.server.json`);
+          logger.info(`replica/${replicaDir}/conf.server.json: added "${apiId}" to ${rMainCount} path(s)`);
+          // Dev variants
+          const rDevFiles = fs
+            .readdirSync(replicaFolder)
+            .filter((f) => f.startsWith('conf.server.dev.') && f.endsWith('.json'));
+          for (const rDevFile of rDevFiles) {
+            const rDevCount = addApiToServerConf(`${replicaFolder}/${rDevFile}`);
+            logger.info(`replica/${replicaDir}/${rDevFile}: added "${apiId}" to ${rDevCount} path(s)`);
+          }
+          // Client conf
+          addApiToClientConf(`${replicaFolder}/conf.client.json`, `replica/${replicaDir}/conf.client.json`);
+        }
+      }
+
+      // 5. Rebuild default conf
+      shellExec(`node bin new --default-conf --deploy-id ${deployId}`);
+      logger.info(`Rebuilt default conf for ${deployId}`);
+
       break;
     }
   }

package/bin/file.js

@@ -99,7 +99,10 @@ try {
           './src/server/atlas-sprite-sheet-generator.js',
           './src/server/shape-generator.js',
           './src/server/semantic-layer-generator.js',
+          './src/server/semantic-layer-generator-floor.js',
+          './src/server/semantic-layer-generator-skin.js',
           './src/server/besu-genesis-generator.js',
+          './src/grpc/cyberia',
           './test/shape-generator.test.js',
           'bin/cyberia.js',
         ]) {

package/conf.js

@@ -63,12 +63,13 @@ const DefaultConf = /**/ {
           'Pagination',
           'windowGetDimensions',
           'SearchBox',
+          'SocketIoHandler',
+          'AppStore',
         ],
         default: [
           'MenuDefault',
           'RoutesDefault',
-          'ElementsDefault',
-          'CommonDefault',
+          'AppStoreDefault',
           'CssDefault',
           'LogInDefault',
           'LogOutDefault',