@celilo/cli 0.13.2 → 0.14.0

package/src/services/alerting/ack.test.ts

@@ -0,0 +1,212 @@
+import { afterEach, beforeEach, describe, expect, test } from 'bun:test';
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import type { DbClient } from '../../db/client';
+import { type Route, alerts, modules, monitors } from '../../db/schema';
+import { setupTestDatabase } from '../../test-utils/setup-test-db';
+import { acknowledgeAlert, findLiveAlertByKey, resolveAlertManually, silenceAlert } from './ack';
+import { moduleCheckAlertKey } from './keys';
+import { createPerson, createRoute } from './people';
+import { mintDelivery } from './tokens';
+
+const NOW = new Date('2026-07-28T03:00:00Z');
+const LATER = new Date('2026-07-28T04:00:00Z');
+const KEY = moduleCheckAlertKey('caddy', 'disk-space');
+
+describe('ack / silence / resolve', () => {
+  let dir: string;
+  let db: DbClient;
+  let peterRoute: Route;
+  let wifeRoute: Route;
+  let peterId: string;
+  let wifeId: string;
+
+  beforeEach(async () => {
+    dir = mkdtempSync(join(tmpdir(), 'ack-'));
+    const dbPath = join(dir, 'celilo.db');
+    process.env.CELILO_DB_PATH = dbPath;
+    db = await setupTestDatabase(dbPath);
+
+    db.insert(modules)
+      .values({
+        id: 'signal',
+        name: 'Signal',
+        version: '0.1.0',
+        manifestData: {},
+        sourcePath: '/tmp/signal',
+      })
+      .run();
+    db.insert(monitors)
+      .values({
+        id: 'mon-1',
+        kind: 'module_hook',
+        target: 'caddy',
+        intervalMinutes: 15,
+        severity: 'critical',
+      })
+      .run();
+    db.insert(alerts)
+      .values({
+        id: 'alert-1',
+        key: KEY,
+        activeKey: KEY,
+        monitorId: 'mon-1',
+        state: 'firing',
+        severity: 'critical',
+        graceUntil: NOW,
+        message: '/var 94% used',
+      })
+      .run();
+
+    const peter = createPerson(db, { name: 'peter', timezone: 'UTC' });
+    const wife = createPerson(db, { name: 'wife', timezone: 'UTC' });
+    peterId = peter.id;
+    wifeId = wife.id;
+    peterRoute = createRoute(db, {
+      personId: peter.id,
+      transportModuleId: 'signal',
+      address: '+1555001',
+      canAck: true,
+    });
+    wifeRoute = createRoute(db, {
+      personId: wife.id,
+      transportModuleId: 'signal',
+      address: '+1555002',
+      canAck: true,
+    });
+  });
+
+  afterEach(() => {
+    db.$client.close();
+    process.env.CELILO_DB_PATH = undefined;
+    try {
+      rmSync(dir, { recursive: true, force: true });
+    } catch {
+      /* ignore */
+    }
+  });
+
+  const page = (routeId: string) =>
+    mintDelivery(db, {
+      kind: 'alert',
+      targetId: 'alert-1',
+      routeId,
+      now: NOW,
+      ttlMs: 86_400_000,
+    });
+
+  describe('acknowledge', () => {
+    // Ack stops escalation. It does NOT resolve — the problem is still
+    // happening, someone is just dealing with it.
+    test('sets acked state and records who and when, leaving it unresolved', () => {
+      const result = acknowledgeAlert(db, 'alert-1', peterId, LATER);
+      expect(result?.alert.state).toBe('acked');
+      expect(result?.alert.ackedBy).toBe(peterId);
+      expect(result?.alert.ackedAt).toEqual(LATER);
+      expect(result?.alert.resolvedAt).toBeNull();
+      expect(result?.alert.activeKey).toBe(KEY);
+    });
+
+    // Without this the primary keeps believing they must act, which is the
+    // duplicated effort the escalation chain exists to avoid.
+    test("a secondary's ack is broadcast to everyone else who was paged", () => {
+      page(peterRoute.id);
+      page(wifeRoute.id);
+
+      const result = acknowledgeAlert(db, 'alert-1', wifeId, LATER);
+      expect(result?.broadcastTo).toEqual([peterRoute.id]);
+    });
+
+    test('the acknowledger is not told about their own ack', () => {
+      page(peterRoute.id);
+      const result = acknowledgeAlert(db, 'alert-1', peterId, LATER);
+      expect(result?.broadcastTo).toEqual([]);
+    });
+
+    test('nobody paged means nobody to broadcast to', () => {
+      const result = acknowledgeAlert(db, 'alert-1', peterId, LATER);
+      expect(result?.broadcastTo).toEqual([]);
+    });
+
+    test('duplicate deliveries to one route broadcast once', () => {
+      page(peterRoute.id);
+      page(peterRoute.id);
+      const result = acknowledgeAlert(db, 'alert-1', wifeId, LATER);
+      expect(result?.broadcastTo).toEqual([peterRoute.id]);
+    });
+
+    // A reply arriving just after recovery is a normal race, not an error.
+    test('acking an already-resolved alert is a no-op, not a failure', () => {
+      resolveAlertManually(db, 'alert-1', LATER);
+      const result = acknowledgeAlert(db, 'alert-1', peterId, LATER);
+      expect(result).not.toBeNull();
+      expect(result?.alert.state).toBe('resolved');
+    });
+
+    test('an unknown alert returns null rather than throwing', () => {
+      expect(acknowledgeAlert(db, 'nope', peterId, LATER)).toBeNull();
+    });
+  });
+
+  describe('silence', () => {
+    // Silence is not ack: nobody owns the problem, they just do not want to
+    // hear about it yet.
+    test('records an expiry without acknowledging', () => {
+      const alert = silenceAlert(db, 'alert-1', LATER);
+      expect(alert?.silencedUntil).toEqual(LATER);
+      expect(alert?.state).toBe('firing');
+      expect(alert?.ackedBy).toBeNull();
+    });
+  });
+
+  describe('manual resolve', () => {
+    test('clears activeKey so the alert leaves the live set', () => {
+      const alert = resolveAlertManually(db, 'alert-1', LATER);
+      expect(alert?.state).toBe('resolved');
+      expect(alert?.activeKey).toBeNull();
+      expect(alert?.resolvedAt).toEqual(LATER);
+    });
+
+    // Manual resolve cannot hide a real problem: the monitor is still the
+    // authority, and a key that is still failing simply fires again.
+    test('a still-failing key can re-fire afterwards', () => {
+      resolveAlertManually(db, 'alert-1', LATER);
+      expect(findLiveAlertByKey(db, KEY)).toBeUndefined();
+
+      db.insert(alerts)
+        .values({
+          id: 'alert-2',
+          key: KEY,
+          activeKey: KEY,
+          monitorId: 'mon-1',
+          state: 'pending',
+          severity: 'critical',
+          graceUntil: LATER,
+          message: '/var 96% used',
+        })
+        .run();
+      expect(findLiveAlertByKey(db, KEY)?.id).toBe('alert-2');
+    });
+  });
+
+  describe('findLiveAlertByKey', () => {
+    test('finds a live alert', () => {
+      expect(findLiveAlertByKey(db, KEY)?.id).toBe('alert-1');
+    });
+
+    test('ignores resolved alerts', () => {
+      resolveAlertManually(db, 'alert-1', LATER);
+      expect(findLiveAlertByKey(db, KEY)).toBeUndefined();
+    });
+
+    test('an unknown key finds nothing', () => {
+      expect(findLiveAlertByKey(db, 'module:nope')).toBeUndefined();
+    });
+
+    test('an acked alert is still live — it is not resolved', () => {
+      acknowledgeAlert(db, 'alert-1', peterId, LATER);
+      expect(findLiveAlertByKey(db, KEY)?.id).toBe('alert-1');
+    });
+  });
+});

package/src/services/alerting/ack.ts

@@ -0,0 +1,119 @@
+/**
+ * Acknowledgement, silence, and manual resolution.
+ *
+ * Three operations that look similar and mean entirely different things
+ * (design S5). Collapsing any two is how an alerting system stops being
+ * trusted:
+ *
+ *   ack      a person has this. Escalation stops; the alert is still FIRING,
+ *            because the problem is still happening.
+ *   silence  deliberate, expiring, audited. "I know, stop telling me until X."
+ *   resolve  the operator asserts the condition is gone. The next successful
+ *            monitor run is still the authority — if it disagrees, the alert
+ *            comes straight back, which is correct.
+ */
+
+import { and, eq, isNull, ne } from 'drizzle-orm';
+import type { DbClient } from '../../db/client';
+import { type Alert, alerts, notificationDeliveries, routes } from '../../db/schema';
+
+export interface AckResult {
+  alert: Alert;
+  /** Routes that were paged and should be told someone has it. */
+  broadcastTo: string[];
+}
+
+/**
+ * Acknowledge an alert.
+ *
+ * Returns every OTHER route that was paged, so the caller can tell them who
+ * took it. Without that, a secondary who acks leaves the primary still
+ * believing they need to act — the exact duplicated-effort the escalation
+ * chain exists to avoid.
+ */
+export function acknowledgeAlert(
+  db: DbClient,
+  alertId: string,
+  personId: string,
+  now: Date,
+): AckResult | null {
+  const alert = db.select().from(alerts).where(eq(alerts.id, alertId)).get();
+  if (!alert) return null;
+
+  // Acking a resolved alert is a no-op rather than an error: a reply that
+  // arrives just after recovery is a normal race, not operator error.
+  if (alert.state === 'resolved') return { alert, broadcastTo: [] };
+
+  db.update(alerts)
+    .set({ state: 'acked', ackedBy: personId, ackedAt: now })
+    .where(eq(alerts.id, alertId))
+    .run();
+
+  const paged = db
+    .select({ routeId: notificationDeliveries.routeId })
+    .from(notificationDeliveries)
+    .where(
+      and(eq(notificationDeliveries.kind, 'alert'), eq(notificationDeliveries.targetId, alertId)),
+    )
+    .all();
+
+  const acknowledgerRoutes = new Set(
+    db
+      .select({ id: routes.id })
+      .from(routes)
+      .where(eq(routes.personId, personId))
+      .all()
+      .map((r) => r.id),
+  );
+
+  // Don't tell the acknowledger about their own ack.
+  const broadcastTo = [...new Set(paged.map((p) => p.routeId))].filter(
+    (routeId) => !acknowledgerRoutes.has(routeId),
+  );
+
+  const updated = db.select().from(alerts).where(eq(alerts.id, alertId)).get() as Alert;
+  return { alert: updated, broadcastTo };
+}
+
+/**
+ * Silence an alert until a given instant.
+ *
+ * Distinct from ack: silence says "stop telling me", ack says "I have this".
+ * An alert can be silenced without anyone owning it, which is exactly the
+ * state worth being able to see later.
+ */
+export function silenceAlert(db: DbClient, alertId: string, until: Date): Alert | null {
+  const alert = db.select().from(alerts).where(eq(alerts.id, alertId)).get();
+  if (!alert) return null;
+
+  db.update(alerts).set({ silencedUntil: until }).where(eq(alerts.id, alertId)).run();
+  return db.select().from(alerts).where(eq(alerts.id, alertId)).get() as Alert;
+}
+
+/**
+ * Manually resolve an alert.
+ *
+ * The operator's assertion, not the monitor's. If the condition is still
+ * failing, the next successful run re-creates the alert — which is correct,
+ * and is why this is safe to offer: it cannot be used to permanently hide a
+ * real problem, only to clear one the operator knows is finished.
+ */
+export function resolveAlertManually(db: DbClient, alertId: string, now: Date): Alert | null {
+  const alert = db.select().from(alerts).where(eq(alerts.id, alertId)).get();
+  if (!alert) return null;
+
+  db.update(alerts)
+    .set({ state: 'resolved', activeKey: null, resolvedAt: now })
+    .where(eq(alerts.id, alertId))
+    .run();
+  return db.select().from(alerts).where(eq(alerts.id, alertId)).get() as Alert;
+}
+
+/** Live alerts whose key matches, for resolving an operator-typed key. */
+export function findLiveAlertByKey(db: DbClient, key: string): Alert | undefined {
+  return db
+    .select()
+    .from(alerts)
+    .where(and(eq(alerts.key, key), isNull(alerts.resolvedAt), ne(alerts.state, 'resolved')))
+    .get();
+}

package/src/services/alerting/builtin-monitors.test.ts

@@ -0,0 +1,132 @@
+import { describe, expect, test } from 'bun:test';
+import type { DriftFinding } from '../audit/types';
+import {
+  failingKeysFromFindings,
+  severityForDriftSeverity,
+  targetKindForCategory,
+} from './builtin-monitors';
+import { healthCoverageFailingKeys } from './health-coverage';
+
+function finding(over: Partial<DriftFinding> = {}): DriftFinding {
+  return {
+    category: 'machines_reachable',
+    severity: 'drift',
+    code: 'machine_unreachable',
+    message: 'iot unreachable',
+    subject: 'iot',
+    ...over,
+  };
+}
+
+describe('targetKindForCategory', () => {
+  test('machine-scoped category', () => {
+    expect(targetKindForCategory('machines_reachable')).toBe('machine');
+  });
+
+  test('module-scoped category', () => {
+    expect(targetKindForCategory('backups')).toBe('module');
+  });
+
+  // Whole-system categories have no narrower subject to suppress against.
+  test('unmapped category falls back to system', () => {
+    expect(targetKindForCategory('cli_version')).toBe('system');
+    expect(targetKindForCategory('schema')).toBe('system');
+  });
+});
+
+describe('severityForDriftSeverity', () => {
+  test('todo never pages, whatever the monitor says', () => {
+    expect(severityForDriftSeverity('todo', 'critical')).toBe('warning');
+  });
+
+  test('drift and blocked take the monitor severity', () => {
+    expect(severityForDriftSeverity('drift', 'critical')).toBe('critical');
+    expect(severityForDriftSeverity('blocked', 'critical')).toBe('critical');
+  });
+});
+
+describe('failingKeysFromFindings', () => {
+  test('projects findings into builtin keys', () => {
+    const keys = failingKeysFromFindings('machines_reachable', [finding()], 'critical');
+    expect(keys).toEqual([
+      {
+        key: 'builtin:machines_reachable/machine:iot',
+        severity: 'critical',
+        message: 'iot unreachable',
+        details: undefined,
+      },
+    ]);
+  });
+
+  // A monitor owns exactly one category. Resolution is set-difference over the
+  // keys a monitor reports, so letting a stray category through would make some
+  // OTHER monitor's alerts resolve at random.
+  test('ignores findings from other categories', () => {
+    const mixed = [finding(), finding({ category: 'backups', subject: 'forgejo' })];
+    const keys = failingKeysFromFindings('machines_reachable', mixed, 'critical');
+    expect(keys).toHaveLength(1);
+    expect(keys[0].key).toBe('builtin:machines_reachable/machine:iot');
+  });
+
+  test('no findings produces an empty failing set', () => {
+    expect(failingKeysFromFindings('machines_reachable', [], 'critical')).toEqual([]);
+  });
+});
+
+describe('healthCoverageFailingKeys', () => {
+  const base = { hasHealthCheckHook: true, hasEnabledMonitor: true } as const;
+
+  test('a monitored module produces no finding', () => {
+    expect(healthCoverageFailingKeys([{ id: 'caddy', state: 'VERIFIED', ...base }])).toEqual([]);
+  });
+
+  test('a module with no health_check hook is surfaced', () => {
+    const keys = healthCoverageFailingKeys([
+      { id: 'signal', state: 'INSTALLED', hasHealthCheckHook: false, hasEnabledMonitor: false },
+    ]);
+    expect(keys).toHaveLength(1);
+    expect(keys[0].key).toBe('builtin:health_coverage/module:signal');
+    expect(keys[0].message).toContain('no health_check hook');
+  });
+
+  test('a module with a hook but no monitor is surfaced differently', () => {
+    const keys = healthCoverageFailingKeys([
+      { id: 'caddy', state: 'VERIFIED', hasHealthCheckHook: true, hasEnabledMonitor: false },
+    ]);
+    expect(keys).toHaveLength(1);
+    expect(keys[0].message).toContain('nothing schedules it');
+  });
+
+  // A coverage gap is real but is not an outage — it must never page.
+  test('findings are warning severity', () => {
+    const keys = healthCoverageFailingKeys([
+      { id: 'caddy', state: 'VERIFIED', hasHealthCheckHook: false, hasEnabledMonitor: false },
+    ]);
+    expect(keys[0].severity).toBe('warning');
+  });
+
+  // Not-yet-deployed modules have nothing to observe; an absent monitor there
+  // is expected, not a gap.
+  test.each(['IMPORTED', 'VALIDATED', 'CONFIGURED', 'DEPLOYING', 'ERROR'] as const)(
+    'ignores a module in state %s',
+    (state) => {
+      expect(
+        healthCoverageFailingKeys([
+          { id: 'x', state, hasHealthCheckHook: false, hasEnabledMonitor: false },
+        ]),
+      ).toEqual([]);
+    },
+  );
+
+  test('reports only the modules that are actually uncovered', () => {
+    const keys = healthCoverageFailingKeys([
+      { id: 'caddy', state: 'VERIFIED', ...base },
+      { id: 'signal', state: 'INSTALLED', hasHealthCheckHook: false, hasEnabledMonitor: false },
+      { id: 'forgejo', state: 'INSTALLED', hasHealthCheckHook: true, hasEnabledMonitor: false },
+    ]);
+    expect(keys.map((k) => k.key)).toEqual([
+      'builtin:health_coverage/module:signal',
+      'builtin:health_coverage/module:forgejo',
+    ]);
+  });
+});

package/src/services/alerting/builtin-monitors.ts

@@ -0,0 +1,84 @@
+/**
+ * Built-in monitors — scheduling celilo's own audit checks.
+ *
+ * `celilo system audit` already implements fourteen checks that know how to
+ * find a broken fleet; until now nothing ran them on a schedule or told anyone
+ * what they found. A `builtin_check` monitor runs ONE of those categories and
+ * projects its findings into alert keys, so the same machinery that carries a
+ * module's failing health check carries "machine iot is unreachable".
+ *
+ * See openspec/changes/add-alerting/design.md (Gap 6 → D4).
+ */
+
+import type { AlertSeverity } from '../../db/schema';
+import type { DriftCategory, DriftFinding, DriftSeverity } from '../audit/types';
+import { type FailingKey, builtinAlertKey } from './keys';
+
+/**
+ * What kind of entity a category's findings are about.
+ *
+ * This is not cosmetic: suppression resolves a key's ancestors through the
+ * deployment topology, and it can only do that if it knows whether
+ * `builtin:…/x:iot` names a machine or a module. Categories absent from the map
+ * are about the management system as a whole and have no narrower subject.
+ */
+const TARGET_KIND_BY_CATEGORY: Partial<Record<DriftCategory, string>> = {
+  machines_reachable: 'machine',
+  services_reachable: 'service',
+  services_credentials: 'service',
+  backups: 'module',
+  health: 'module',
+  module_versions: 'module',
+  module_configs: 'module',
+  undeployed_modules: 'module',
+  unconfigured_modules: 'module',
+};
+
+const SYSTEM_TARGET_KIND = 'system';
+
+export function targetKindForCategory(category: DriftCategory): string {
+  return TARGET_KIND_BY_CATEGORY[category] ?? SYSTEM_TARGET_KIND;
+}
+
+/**
+ * Map a drift severity to the severity its alert carries.
+ *
+ * `todo` findings are next-step reminders ("you imported this and haven't
+ * deployed it"), not divergence — they are recorded but never page, mirroring
+ * how a `warn` health-check item behaves. `drift` and `blocked` take the
+ * monitor's configured severity.
+ */
+export function severityForDriftSeverity(
+  driftSeverity: DriftSeverity,
+  monitorSeverity: AlertSeverity,
+): AlertSeverity {
+  return driftSeverity === 'todo' ? 'warning' : monitorSeverity;
+}
+
+/**
+ * Project the findings of ONE audit category into the complete set of currently
+ * failing keys for that monitor.
+ *
+ * Findings from other categories are ignored rather than silently folded in: a
+ * `builtin_check` monitor owns exactly one category, and resolution works by
+ * set difference over the keys a monitor reports. Letting a stray category's
+ * findings through would make another monitor's alerts resolve at random.
+ */
+export function failingKeysFromFindings(
+  category: DriftCategory,
+  findings: DriftFinding[],
+  monitorSeverity: AlertSeverity,
+): FailingKey[] {
+  const kind = targetKindForCategory(category);
+  const failing: FailingKey[] = [];
+  for (const finding of findings) {
+    if (finding.category !== category) continue;
+    failing.push({
+      key: builtinAlertKey(category, kind, finding.subject),
+      severity: severityForDriftSeverity(finding.severity, monitorSeverity),
+      message: finding.message,
+      details: finding.details,
+    });
+  }
+  return failing;
+}

package/src/services/alerting/builtin-source.ts

@@ -0,0 +1,82 @@
+/**
+ * Running a built-in check for a monitor.
+ *
+ * Deliberately NOT `runAudit`. That runner computes all fourteen categories and
+ * needs the whole world injected — proxmox connections, a registry client,
+ * secret decryption, a terraform binary — which is the wrong cost and the wrong
+ * failure surface for a check that runs every few minutes. A monitor owns one
+ * category, so it calls that category directly.
+ *
+ * Only the categories the MVP schedules are wired. An unwired one fails loudly
+ * rather than silently returning no findings, which the reconciler would read
+ * as "nothing is wrong".
+ */
+
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+import { auditMachinesReachable } from '../audit/machines-reachable';
+import type { MachineReachableResult } from '../audit/machines-reachable';
+import type { DriftCategory, DriftFinding } from '../audit/types';
+import { listMachines } from '../machine-pool';
+
+const execFileAsync = promisify(execFile);
+
+/** Categories a monitor can currently schedule. */
+export const SCHEDULABLE_BUILTIN_CHECKS: readonly DriftCategory[] = ['machines_reachable'];
+
+export function isSchedulableBuiltin(category: string): category is DriftCategory {
+  return (SCHEDULABLE_BUILTIN_CHECKS as readonly string[]).includes(category);
+}
+
+/**
+ * SSH-probe every pool machine.
+ *
+ * `BatchMode=yes` prevents a password prompt from hanging the probe forever,
+ * and `ConnectTimeout` bounds the wait on an unresponsive host — the exact
+ * condition this check exists to detect must not be the one that wedges it.
+ */
+async function probeMachines(): Promise<MachineReachableResult[]> {
+  const machines = await listMachines();
+  return Promise.all(
+    machines.map(async (m): Promise<MachineReachableResult> => {
+      try {
+        await execFileAsync(
+          'ssh',
+          [
+            '-o',
+            'BatchMode=yes',
+            '-o',
+            'ConnectTimeout=5',
+            '-o',
+            'StrictHostKeyChecking=no',
+            '-o',
+            'UserKnownHostsFile=/dev/null',
+            `${m.sshUser}@${m.ipAddress}`,
+            'true',
+          ],
+          { timeout: 8000 },
+        );
+        return { id: m.id, hostname: m.hostname, ipAddress: m.ipAddress, reachable: true };
+      } catch (err) {
+        const e = err as { stderr?: string; message?: string };
+        return {
+          id: m.id,
+          hostname: m.hostname,
+          ipAddress: m.ipAddress,
+          reachable: false,
+          message: e.stderr?.trim() || e.message || 'SSH probe failed',
+        };
+      }
+    }),
+  );
+}
+
+export async function runBuiltinCheckForMonitor(category: DriftCategory): Promise<DriftFinding[]> {
+  if (category === 'machines_reachable') {
+    return auditMachinesReachable({ results: await probeMachines() });
+  }
+
+  throw new Error(
+    `Built-in check "${category}" is not schedulable yet. Schedulable: ${SCHEDULABLE_BUILTIN_CHECKS.join(', ')}.`,
+  );
+}

package/src/services/alerting/coverage-source.ts

@@ -0,0 +1,38 @@
+/**
+ * Reading the module roster for the health-coverage check.
+ *
+ * Split out from `health-coverage.ts` so that the decision — which modules
+ * count as unobserved — stays pure and testable, while the query that feeds it
+ * lives here. See Rule 2.3.
+ */
+
+import { eq } from 'drizzle-orm';
+import type { DbClient } from '../../db/client';
+import { modules, monitors } from '../../db/schema';
+import type { ModuleManifest } from '../../manifest/schema';
+import type { ModuleCoverageInput } from './health-coverage';
+
+export function loadModuleCoverage(db: DbClient): ModuleCoverageInput[] {
+  const monitored = new Set(
+    db
+      .select({ target: monitors.target })
+      .from(monitors)
+      .where(eq(monitors.enabled, true))
+      .all()
+      .map((row) => row.target),
+  );
+
+  return db
+    .select({ id: modules.id, state: modules.state, manifestData: modules.manifestData })
+    .from(modules)
+    .all()
+    .map((module) => {
+      const manifest = module.manifestData as ModuleManifest;
+      return {
+        id: module.id,
+        state: module.state,
+        hasHealthCheckHook: Boolean(manifest.hooks?.health_check),
+        hasEnabledMonitor: monitored.has(module.id),
+      };
+    });
+}