@celilo/cli 1.12.0 → 1.14.0

package/src/cli/index.ts

@@ -25,6 +25,7 @@ import { handleCapabilityInfo } from './commands/capability-info';
 import { handleCapabilityList } from './commands/capability-list';
 import { handleCommands } from './commands/commands-json';
 import { handleCompletion } from './commands/completion';
+import { handleConsoleGet, handleConsoleStatus } from './commands/console';
 import { handleDnsRegistrations } from './commands/dns';
 import {
   handleEventsAck,
@@ -123,6 +124,7 @@ import { handleSystemAudit } from './commands/system-audit';
 import { handleSystemConfigGet, handleSystemConfigSet } from './commands/system-config';
 import { handleSystemDiscoverNetwork } from './commands/system-discover-network';
 import { handleSystemDoctor } from './commands/system-doctor';
+import { handleSystemEnsureFleetKey } from './commands/system-ensure-fleet-key';
 import { handleSystemInit } from './commands/system-init';
 import { handleSystemMigrate } from './commands/system-migrate';
 import { handleSystemSecretGet } from './commands/system-secret-get';
@@ -225,6 +227,7 @@ Commands:
   api                      Manage remote-API access (principals, grants, authorized_keys)
   completion               Generate shell completion scripts (bash/zsh)
   commands                 Print the CLI command registry as JSON (drives @celilo/mcp)
+  console                  Narrow read-only projections for the web console
 
   help, --help, -h         Show this help message
 
@@ -803,7 +806,11 @@ Subcommands:
 
   list [module-id]         List available backups
     Options:
-      --limit <n>          Number of backups to show (default: 20)
+      --limit <n>          Number of backups to show (default: 20; 5000 with --json)
+      --json               Emit the listing as JSON with EXACT timestamps.
+                           The human output buckets ages past six days into
+                           "last week", so it cannot be parsed back into days.
+      --since <days>       Only attempts from the last N days
 
   restore <backup-id>      Restore from a backup
     Options:
@@ -1116,6 +1123,7 @@ Subcommands:
                                        to define, not a module's.
 
   discover-network                     Record the network this box sits on, from its own routing table (idempotent)
+  ensure-fleet-key                     Mint celilo's fleet SSH key if absent, record ssh.public_key, print the public half
 
   config set <key> <value>             Set system-wide configuration value
   config get [key]                     Get system configuration value(s)
@@ -1275,6 +1283,24 @@ export async function runCli(argv: string[]): Promise<CommandResult> {
     return handleCommands(parsed.args, parsed.flags);
   }
 
+  // The web console's narrow reads.
+  if (parsed.command === 'console') {
+    const flagError = checkFlags('console', parsed.subcommand, parsed.flags, parsed.args);
+    if (flagError) return flagError;
+
+    switch (parsed.subcommand) {
+      case 'status':
+        return handleConsoleStatus(parsed.flags);
+      case 'get':
+        return handleConsoleGet(parsed.args, parsed.flags);
+      default:
+        return {
+          success: false,
+          error: 'Console subcommand required: status | get',
+        };
+    }
+  }
+
   // Top-level alias: `celilo audit` → `celilo system audit`
   if (parsed.command === 'audit') {
     return handleSystemAudit(parsed.args, parsed.flags);
@@ -2197,6 +2223,10 @@ export async function runCli(argv: string[]): Promise<CommandResult> {
       return handleSystemDiscoverNetwork();
     }
 
+    if (parsed.subcommand === 'ensure-fleet-key') {
+      return handleSystemEnsureFleetKey();
+    }
+
     if (parsed.subcommand === 'config') {
       const configSubcommand = parsed.args[0];
       if (!configSubcommand) {

package/src/console/closure.test.ts

@@ -0,0 +1,322 @@
+/**
+ * The six graph shapes the plan names, five of which the live fleet produced.
+ *
+ * They are here rather than in an e2e suite because every one of them is a
+ * property of the walk, and a walk is testable without a fleet.
+ */
+import { describe, expect, test } from 'bun:test';
+import type { ModuleManifest } from '../manifest/schema';
+import type { ProviderRow, ProviderState } from '../services/consumer-cleanup';
+import { DEFAULT_CLOSURE_DEPTH, UNBOUNDED_CLOSURE_DEPTH, computeClosure } from './closure';
+
+/** Only the two capability lists matter here; the rest of a manifest does not. */
+function manifest(spec: { requires?: string[]; optional?: string[] }): ModuleManifest {
+  return {
+    requires: { capabilities: (spec.requires ?? []).map((name) => ({ name })) },
+    optional: { capabilities: (spec.optional ?? []).map((name) => ({ name })) },
+  } as unknown as ModuleManifest;
+}
+
+function deployed(...moduleIds: string[]): ProviderState[] {
+  return moduleIds.map((moduleId) => ({ moduleId, state: 'VERIFIED' }));
+}
+
+describe('computeClosure', () => {
+  test('follows an optional-only edge, and marks it optional', () => {
+    // The live case: a module reaches the internal resolver ONLY optionally.
+    // Following `requires` alone drops the resolver while looking complete.
+    const rows: ProviderRow[] = [{ moduleId: 'technitium', capabilityName: 'dns_internal' }];
+    const result = computeClosure({
+      rootModuleId: 'wireguard-manager',
+      manifests: new Map([['wireguard-manager', manifest({ optional: ['dns_internal'] })]]),
+      providerRows: rows,
+      providerStates: deployed('technitium'),
+    });
+
+    expect(result.nodes).toHaveLength(1);
+    expect(result.nodes[0]?.moduleId).toBe('technitium');
+    expect(result.nodes[0]?.optional).toBe(true);
+  });
+
+  test('a module reached both ways is not optional', () => {
+    const rows: ProviderRow[] = [
+      { moduleId: 'caddy', capabilityName: 'private_web' },
+      { moduleId: 'caddy', capabilityName: 'public_web' },
+    ];
+    const result = computeClosure({
+      rootModuleId: 'app',
+      manifests: new Map([
+        ['app', manifest({ requires: ['private_web'], optional: ['public_web'] })],
+      ]),
+      providerRows: rows,
+      providerStates: deployed('caddy'),
+    });
+
+    expect(result.nodes[0]?.optional).toBe(false);
+    expect(result.nodes[0]?.via).toEqual(['private_web', 'public_web']);
+  });
+
+  test('the default depth excludes a three-hop dependency', () => {
+    const rows: ProviderRow[] = [
+      { moduleId: 'b', capabilityName: 'cap_b' },
+      { moduleId: 'c', capabilityName: 'cap_c' },
+      { moduleId: 'd', capabilityName: 'cap_d' },
+    ];
+    const manifests = new Map([
+      ['a', manifest({ requires: ['cap_b'] })],
+      ['b', manifest({ requires: ['cap_c'] })],
+      ['c', manifest({ requires: ['cap_d'] })],
+      ['d', manifest({})],
+    ]);
+    const result = computeClosure({
+      rootModuleId: 'a',
+      manifests,
+      providerRows: rows,
+      providerStates: deployed('b', 'c', 'd'),
+    });
+
+    expect(result.depth).toBe(DEFAULT_CLOSURE_DEPTH);
+    expect(result.nodes.map((n) => n.moduleId)).toEqual(['b', 'c']);
+    expect(result.truncated).toBe(true);
+  });
+
+  test('an unbounded walk terminates on a cycle, listing each module once', () => {
+    // caddy requires authentik, authentik requires caddy. The real graph.
+    const rows: ProviderRow[] = [
+      { moduleId: 'authentik', capabilityName: 'idp' },
+      { moduleId: 'caddy', capabilityName: 'private_web' },
+    ];
+    const manifests = new Map([
+      ['caddy', manifest({ requires: ['idp'] })],
+      ['authentik', manifest({ requires: ['private_web'] })],
+    ]);
+    const result = computeClosure({
+      rootModuleId: 'caddy',
+      manifests,
+      providerRows: rows,
+      providerStates: deployed('caddy', 'authentik'),
+      depth: UNBOUNDED_CLOSURE_DEPTH,
+    });
+
+    expect(result.nodes.map((n) => n.moduleId)).toEqual(['authentik']);
+    expect(result.truncated).toBe(false);
+  });
+
+  test('a capability with several providers highlights every one', () => {
+    // firewall is deliberately multi-provider: an edge provider plus inner layers.
+    const rows: ProviderRow[] = [
+      { moduleId: 'iptables', capabilityName: 'firewall' },
+      { moduleId: 'opnsense', capabilityName: 'firewall' },
+    ];
+    const result = computeClosure({
+      rootModuleId: 'app',
+      manifests: new Map([['app', manifest({ requires: ['firewall'] })]]),
+      providerRows: rows,
+      providerStates: deployed('iptables', 'opnsense'),
+    });
+
+    expect(result.nodes.map((n) => n.moduleId)).toEqual(['iptables', 'opnsense']);
+  });
+
+  test('a module that depends on nothing returns an empty closure, not a failure', () => {
+    const result = computeClosure({
+      rootModuleId: 'standalone',
+      manifests: new Map([['standalone', manifest({})]]),
+      providerRows: [],
+      providerStates: [],
+    });
+
+    expect(result.nodes).toEqual([]);
+    expect(result.truncated).toBe(false);
+  });
+
+  test('a module that provides what it consumes is not its own dependency', () => {
+    const rows: ProviderRow[] = [
+      { moduleId: 'caddy', capabilityName: 'private_web' },
+      { moduleId: 'other', capabilityName: 'private_web' },
+    ];
+    const result = computeClosure({
+      rootModuleId: 'caddy',
+      manifests: new Map([['caddy', manifest({ requires: ['private_web'] })]]),
+      providerRows: rows,
+      providerStates: deployed('caddy', 'other'),
+    });
+
+    expect(result.nodes.map((n) => n.moduleId)).toEqual(['other']);
+  });
+
+  test('the shortest hop wins when a module is reachable two ways', () => {
+    const rows: ProviderRow[] = [
+      { moduleId: 'b', capabilityName: 'cap_b' },
+      { moduleId: 'shared', capabilityName: 'cap_shared' },
+      { moduleId: 'shared', capabilityName: 'cap_deep' },
+    ];
+    const manifests = new Map([
+      ['a', manifest({ requires: ['cap_b', 'cap_shared'] })],
+      ['b', manifest({ requires: ['cap_deep'] })],
+      ['shared', manifest({})],
+    ]);
+    const result = computeClosure({
+      rootModuleId: 'a',
+      manifests,
+      providerRows: rows,
+      providerStates: deployed('b', 'shared'),
+    });
+
+    const shared = result.nodes.find((n) => n.moduleId === 'shared');
+    expect(shared?.hop).toBe(1);
+  });
+});
+
+describe('the walk follows real bindings, not declarations', () => {
+  const rows: ProviderRow[] = [
+    { moduleId: 'cpanel', capabilityName: 'external_web' },
+    { moduleId: 'caddy', capabilityName: 'public_web' },
+    { moduleId: 'forgejo', capabilityName: 'source_forge' },
+  ];
+  const manifests = new Map([
+    ['site', manifest({ optional: ['external_web', 'public_web', 'source_forge'] })],
+    ['cpanel', manifest({})],
+    ['caddy', manifest({})],
+    ['forgejo', manifest({})],
+  ]);
+
+  test('a declared capability the module never called into is NOT a dependency', () => {
+    // The tango-nexus case, which is what celilo#1072 was filed for: four
+    // optional declarations, one actual binding. Following the declarations
+    // claims the module is standing on three things it has never touched.
+    const result = computeClosure({
+      rootModuleId: 'site',
+      manifests,
+      providerRows: rows,
+      providerStates: deployed('cpanel', 'caddy', 'forgejo'),
+      bindings: new Map([['site', new Map([['external_web', 'cpanel']])]]),
+    });
+
+    expect(result.nodes.map((n) => n.moduleId)).toEqual(['cpanel']);
+  });
+
+  test('without bindings the walk falls back to declarations, and says more', () => {
+    // Not a silent fallback: the caller decides. A walk with no binding data
+    // answers "what could this reach", which is a different and still useful
+    // question, and it must not be mistaken for the other one.
+    const result = computeClosure({
+      rootModuleId: 'site',
+      manifests,
+      providerRows: rows,
+      providerStates: deployed('cpanel', 'caddy', 'forgejo'),
+    });
+
+    expect(result.nodes.map((n) => n.moduleId).sort()).toEqual(['caddy', 'cpanel', 'forgejo']);
+  });
+
+  test('a binding to a DIFFERENT provider of the same capability is not followed', () => {
+    // firewall has several live providers. A consumer bound to one of them is
+    // not thereby standing on the others.
+    const multi: ProviderRow[] = [
+      { moduleId: 'iptables', capabilityName: 'firewall' },
+      { moduleId: 'axon', capabilityName: 'firewall' },
+    ];
+    const result = computeClosure({
+      rootModuleId: 'app',
+      manifests: new Map([
+        ['app', manifest({ requires: ['firewall'] })],
+        ['iptables', manifest({})],
+        ['axon', manifest({})],
+      ]),
+      providerRows: multi,
+      providerStates: deployed('iptables', 'axon'),
+      bindings: new Map([['app', new Map([['firewall', 'iptables']])]]),
+    });
+
+    expect(result.nodes.map((n) => n.moduleId)).toEqual(['iptables']);
+  });
+
+  test('a delegated provider is reached, though no manifest names it', () => {
+    // The case the whole chain exists for. `app` is BOUND to iptables, so the
+    // manifest walk stops there and the ISP router the packet actually leaves
+    // through never appears — even though iptables cannot reach the internet
+    // without it. celilo wires that edge at hook time; nothing declares it.
+    const multi: ProviderRow[] = [
+      { moduleId: 'iptables', capabilityName: 'firewall' },
+      { moduleId: 'axon', capabilityName: 'firewall' },
+    ];
+    const result = computeClosure({
+      rootModuleId: 'app',
+      manifests: new Map([
+        ['app', manifest({ requires: ['firewall'] })],
+        ['iptables', manifest({})],
+        ['axon', manifest({})],
+      ]),
+      providerRows: multi,
+      providerStates: deployed('iptables', 'axon'),
+      bindings: new Map([['app', new Map([['firewall', 'iptables']])]]),
+      chains: [{ capability: 'firewall', moduleIds: ['iptables', 'axon'] }],
+    });
+
+    expect(result.nodes.map((n) => n.moduleId)).toEqual(['iptables', 'axon']);
+    // Hop 2, because it is reached THROUGH iptables. Not a second hop-1
+    // dependency of the selection, which is what a fan would say.
+    expect(result.nodes.find((n) => n.moduleId === 'axon')?.hop).toBe(2);
+    // A packet has no alternative route to the internet.
+    expect(result.nodes.find((n) => n.moduleId === 'axon')?.optional).toBe(false);
+    expect(result.chains).toEqual([{ capability: 'firewall', moduleIds: ['iptables', 'axon'] }]);
+  });
+
+  test('a chain the walk never touched is not reported', () => {
+    // The chain is a fleet fact and the closure is about one module. A selection
+    // that consumes no firewall stands on none of it.
+    const result = computeClosure({
+      rootModuleId: 'site',
+      manifests,
+      providerRows: rows,
+      providerStates: deployed('cpanel', 'caddy', 'forgejo'),
+      chains: [{ capability: 'firewall', moduleIds: ['iptables', 'axon'] }],
+    });
+
+    expect(result.chains).toEqual([]);
+  });
+
+  test('the depth bound cuts a delegated provider like any other', () => {
+    // Three layers, bounded at two, so the LAST link is the one the bound cuts.
+    // The delegation edges are walked inside the same loop as the declared ones
+    // and get the same bound; a rule applied after the walk would smuggle the
+    // whole chain into a two-hop answer.
+    //
+    // A two-layer chain would not test this. `iptables` is the only declared
+    // dependency, so the walk exhausts at hop 2 whether or not the delegation
+    // is followed, and the assertion would hold for the wrong reason.
+    const result = computeClosure({
+      rootModuleId: 'app',
+      manifests: new Map([
+        ['app', manifest({ requires: ['firewall'] })],
+        ['iptables', manifest({})],
+        ['mid', manifest({})],
+        ['axon', manifest({})],
+      ]),
+      providerRows: [{ moduleId: 'iptables', capabilityName: 'firewall' }],
+      providerStates: deployed('iptables', 'mid', 'axon'),
+      depth: 2,
+      chains: [{ capability: 'firewall', moduleIds: ['iptables', 'mid', 'axon'] }],
+    });
+
+    expect(result.nodes.map((n) => n.moduleId)).toEqual(['iptables', 'mid']);
+    expect(result.truncated).toBe(true);
+    // Still reported WHOLE, including the member past the bound. Half a path is
+    // not a path, and the operator asked to see less, not to be told the packet
+    // stops at `mid`.
+    expect(result.chains[0]?.moduleIds).toEqual(['iptables', 'mid', 'axon']);
+  });
+
+  test('a module with no bindings at all depends on nothing', () => {
+    const result = computeClosure({
+      rootModuleId: 'site',
+      manifests,
+      providerRows: rows,
+      providerStates: deployed('cpanel', 'caddy', 'forgejo'),
+      bindings: new Map([['site', new Map()]]),
+    });
+
+    expect(result.nodes).toEqual([]);
+  });
+});

package/src/console/closure.ts

@@ -0,0 +1,294 @@
+/**
+ * The bounded capability closure: which modules a selected module stands on.
+ *
+ * Pure, so the console's central question is answerable without a database and
+ * the awkward graph shapes below are testable directly.
+ *
+ * The edge is `planConsumerCleanup()`'s edge, called rather than copied. That
+ * function already answers "which providers does this module reach", already
+ * counts `requires` AND `optional` as dependency edges, and already handles the
+ * two cases a fresh implementation gets wrong: a capability with several
+ * providers (firewall has an edge provider plus inner layers, all of them real)
+ * and a module that both provides and consumes a capability, which must not
+ * become its own dependency. A second walk would drift from it.
+ *
+ * What this adds is the part a one-hop cleanup plan has no use for: distance,
+ * optionality, and termination.
+ */
+
+import {
+  type ConsumedCapabilities,
+  type ProviderRow,
+  type ProviderState,
+  planConsumerCleanup,
+} from '../services/consumer-cleanup';
+
+/**
+ * Hops to walk when the caller does not say.
+ *
+ * Two, because the fleet's useful answer is "what this stands on, and what that
+ * stands on". Deliberately a default and not a law: `depth: UNBOUNDED` walks the
+ * whole graph, and the walk terminates on cycles either way.
+ */
+export const DEFAULT_CLOSURE_DEPTH = 2;
+
+/** Walk until the graph runs out rather than until a hop count does. */
+export const UNBOUNDED_CLOSURE_DEPTH = 0;
+
+export interface ClosureRequest {
+  rootModuleId: string;
+  /**
+   * Each module's consumed capabilities, by module id. A module with no entry
+   * ends that branch of the walk rather than failing the whole thing: a manifest
+   * celilo cannot parse is a real state, and one bad row must not blank the
+   * picture.
+   */
+  manifests: ReadonlyMap<string, ConsumedCapabilities>;
+  providerRows: readonly ProviderRow[];
+  providerStates: readonly ProviderState[];
+  depth?: number;
+  /**
+   * Which providers each module has actually called into, keyed by module id
+   * then capability name.
+   *
+   * When supplied, the walk follows only real bindings. Without it the walk
+   * follows every declared capability, which answers "what could this reach"
+   * rather than "what is this standing on". Optional so the walk stays testable
+   * without a database, not so the distinction is optional.
+   */
+  bindings?: ReadonlyMap<string, ReadonlyMap<string, string>>;
+  /**
+   * Ordered provider chains, most downstream first.
+   *
+   * These are edges NO MANIFEST DECLARES. celilo wires the `firewall`
+   * providers into a chain at hook time from `has_external`, so `iptables`
+   * genuinely stands on `axon` while neither manifest says a word about the
+   * other. A walk over manifests alone stops at `iptables`, and the box the
+   * packet actually leaves through never appears in the answer.
+   *
+   * Supplied by the caller rather than derived here so this stays pure. The CLI
+   * reads them with `loadFirewallChain`.
+   */
+  chains?: readonly DelegationChain[];
+}
+
+/**
+ * One capability's providers in delegation order.
+ *
+ * Ordered because for `firewall` they are not alternatives: the order is the
+ * packet's path. Same shape as the console protocol's `DelegationChain`, so the
+ * server hands it on rather than translating it.
+ */
+export interface DelegationChain {
+  capability: string;
+  /** Module ids, most downstream first. */
+  moduleIds: string[];
+}
+
+export interface ClosureNode {
+  moduleId: string;
+  /** 1 is a direct dependency of the root. */
+  hop: number;
+  /**
+   * True when every edge that reaches this module is an `optional.capabilities`
+   * edge.
+   *
+   * Load-bearing rather than cosmetic: on a real fleet the internal DNS resolver
+   * is reached only optionally, so a walk that followed `requires` alone drops
+   * the resolver out of the picture entirely while looking complete.
+   */
+  optional: boolean;
+  /** Capability names by which the walk reached this module, sorted. */
+  via: string[];
+}
+
+export interface ClosureResult {
+  nodes: ClosureNode[];
+  /**
+   * The delegation chains this closure touched, whole.
+   *
+   * A chain is emitted when the walk reached ANY of its members, and it carries
+   * every member rather than only the reached ones, because half a path is not
+   * a path. Empty means the closure touched no chain — which, now that
+   * something computes them, is an answer rather than a gap.
+   */
+  chains: DelegationChain[];
+  /** Hops actually walked. Echoes the request so the console can say what it bounded. */
+  depth: number;
+  /**
+   * True when the walk stopped because it hit the bound and the graph continued.
+   * Distinct from an exhausted graph, which is a complete answer.
+   */
+  truncated: boolean;
+}
+
+interface Edge {
+  to: string;
+  hop: number;
+  capability: string;
+  optional: boolean;
+}
+
+/**
+ * Which of a module's consumed capabilities it declared as optional.
+ *
+ * A name in both sets counts as required: `requires` is the stronger claim, and
+ * a module that declares a capability both ways still fails without it.
+ */
+function optionalCapabilityNames(manifest: ConsumedCapabilities): Set<string> {
+  const required = new Set((manifest.requires?.capabilities ?? []).map((c) => c.name));
+  return new Set(
+    (manifest.optional?.capabilities ?? []).map((c) => c.name).filter((n) => !required.has(n)),
+  );
+}
+
+/**
+ * A chain's consecutive pairs, as edges out of each member.
+ *
+ * `[iptables, axon]` becomes one edge `iptables -> axon`. The last member has
+ * no edge out of it: it is the internet-facing end and delegates to nothing.
+ */
+function delegationEdgesByModule(
+  chains: readonly DelegationChain[],
+): Map<string, { to: string; capability: string }[]> {
+  const byModule = new Map<string, { to: string; capability: string }[]>();
+  for (const chain of chains) {
+    for (let i = 0; i + 1 < chain.moduleIds.length; i += 1) {
+      const from = chain.moduleIds[i];
+      const to = chain.moduleIds[i + 1];
+      if (from === undefined || to === undefined) continue;
+      const out = byModule.get(from) ?? [];
+      out.push({ to, capability: chain.capability });
+      byModule.set(from, out);
+    }
+  }
+  return byModule;
+}
+
+export function computeClosure(request: ClosureRequest): ClosureResult {
+  const depth = request.depth ?? DEFAULT_CLOSURE_DEPTH;
+  const providerRows = [...request.providerRows];
+  const providerStates = [...request.providerStates];
+  const chains = request.chains ?? [];
+  const delegationsOut = delegationEdgesByModule(chains);
+
+  const edges: Edge[] = [];
+  // The root counts as visited from the start, so a cycle back to it terminates
+  // rather than re-entering, and the selection never lists itself.
+  const visited = new Set([request.rootModuleId]);
+  let frontier = [request.rootModuleId];
+  let hop = 0;
+  let truncated = false;
+
+  while (frontier.length > 0) {
+    hop += 1;
+    if (depth !== UNBOUNDED_CLOSURE_DEPTH && hop > depth) {
+      // Something was still reachable when the bound stopped us. That is a
+      // different answer from an exhausted graph and the console says so.
+      truncated = true;
+      break;
+    }
+
+    const next: string[] = [];
+    for (const moduleId of frontier) {
+      const manifest = request.manifests.get(moduleId);
+      if (!manifest) continue;
+
+      const optionalNames = optionalCapabilityNames(manifest);
+      const bound = request.bindings?.get(moduleId);
+
+      for (const target of planConsumerCleanup(moduleId, manifest, providerRows, providerStates)) {
+        // A cycle walks back to the selection. Terminating the WALK there is not
+        // enough: the edge is still real, and recording it would list the
+        // selected module as one of its own dependencies. caddy requires
+        // authentik and authentik requires caddy, so this is the ordinary case
+        // on a real fleet rather than a pathological one.
+        if (target.providerId === request.rootModuleId) continue;
+
+        for (const capability of target.capabilityNames) {
+          // A capability the consumer declared and never called into is not a
+          // dependency. Following it would put a provider inside the closure on
+          // the strength of a manifest line, which is a claim that the module is
+          // standing on something it has never touched.
+          if (bound && bound.get(capability) !== target.providerId) continue;
+
+          edges.push({
+            to: target.providerId,
+            hop,
+            capability,
+            optional: optionalNames.has(capability),
+          });
+        }
+        if (!visited.has(target.providerId)) {
+          visited.add(target.providerId);
+          next.push(target.providerId);
+        }
+      }
+    }
+
+    // The edges the manifests do not carry. Followed here, inside the same loop,
+    // so a delegated provider gets its hop, its cycle check and its depth bound
+    // from the one walk rather than from a second rule applied afterwards.
+    //
+    // Never optional: a packet has no alternative route to the internet, so a
+    // delegation is the strongest kind of dependency there is.
+    for (const moduleId of frontier) {
+      for (const edge of delegationsOut.get(moduleId) ?? []) {
+        if (edge.to === request.rootModuleId) continue;
+        edges.push({ to: edge.to, hop, capability: edge.capability, optional: false });
+        if (!visited.has(edge.to)) {
+          visited.add(edge.to);
+          next.push(edge.to);
+        }
+      }
+    }
+
+    frontier = next;
+  }
+
+  const nodes = collectNodes(edges);
+  const reached = new Set([request.rootModuleId, ...nodes.map((node) => node.moduleId)]);
+
+  return {
+    nodes,
+    chains: chains.filter((chain) => chain.moduleIds.some((id) => reached.has(id))),
+    depth,
+    truncated,
+  };
+}
+
+/**
+ * Fold the edge list into one node per module.
+ *
+ * A module is recorded at the SHORTEST hop that reached it, and is optional only
+ * if no edge anywhere in the walk reached it by a required capability. Deciding
+ * either from the first edge seen would make the answer depend on iteration
+ * order.
+ */
+function collectNodes(edges: readonly Edge[]): ClosureNode[] {
+  const byModule = new Map<string, { hop: number; via: Set<string>; anyRequired: boolean }>();
+
+  for (const edge of edges) {
+    const existing = byModule.get(edge.to);
+    if (!existing) {
+      byModule.set(edge.to, {
+        hop: edge.hop,
+        via: new Set([edge.capability]),
+        anyRequired: !edge.optional,
+      });
+      continue;
+    }
+    existing.hop = Math.min(existing.hop, edge.hop);
+    existing.via.add(edge.capability);
+    existing.anyRequired = existing.anyRequired || !edge.optional;
+  }
+
+  return [...byModule.entries()]
+    .map(([moduleId, v]) => ({
+      moduleId,
+      hop: v.hop,
+      optional: !v.anyRequired,
+      via: [...v.via].sort(),
+    }))
+    .sort((a, b) => a.hop - b.hop || a.moduleId.localeCompare(b.moduleId));
+}