@celilo/cli 1.13.0 → 2.0.0

package/src/cli/commands/system-ensure-fleet-key.ts

@@ -0,0 +1,52 @@
+/**
+ * `celilo system ensure-fleet-key` — mint celilo's fleet SSH keypair if it
+ * is absent, record its public half, and print it.
+ *
+ * The celilo-side half of "minting the fleet key is not the module's job"
+ * (openspec/changes/hook-process-boundary, design D9b). celilo-mgmt's
+ * `on_install` used to generate the keypair itself, writing into celilo's
+ * data directory from inside a hook — the one directory the hook jail
+ * exists to keep out of the mount set. The hook now asks for the key
+ * through this command and receives the public half, rather than producing
+ * it.
+ *
+ * Idempotent: an existing key is reused. Re-keying would strand every
+ * machine whose authorized_keys holds the old public half.
+ */
+
+import { getDb } from '../../db/client';
+import { ensureFleetKey, getFleetSshDir } from '../../services/fleet-key';
+import { initializeSystem } from '../../services/system-init';
+import type { CommandResult } from '../types';
+
+export async function handleSystemEnsureFleetKey(): Promise<CommandResult> {
+  let key: ReturnType<typeof ensureFleetKey>;
+  try {
+    key = ensureFleetKey();
+  } catch (err) {
+    return {
+      success: false,
+      error: `Could not create the fleet SSH key in ${getFleetSshDir()}: ${
+        err instanceof Error ? err.message : String(err)
+      }`,
+    };
+  }
+
+  try {
+    initializeSystem(getDb(), { 'ssh.public_key': key.publicKey });
+  } catch (err) {
+    return {
+      success: false,
+      error: `Fleet key is on disk but recording ssh.public_key failed: ${
+        err instanceof Error ? err.message : String(err)
+      }`,
+    };
+  }
+
+  // The public key alone, and `rawOutput` to say so on the record: this
+  // command exists to be read by celilo-mgmt's on_install as much as by an
+  // operator, and the key IS the answer either way (an operator pastes it into
+  // a machine's authorized_keys). Wrapping it in prose would make the caller
+  // parse for it, which is how a hook ends up depending on a sentence.
+  return { success: true, message: key.publicKey, rawOutput: true };
+}

package/src/cli/completion.ts

@@ -8,6 +8,8 @@ import { getDb } from '../db/client';
 import { capabilities, modules } from '../db/schema';
 import type { ModuleManifest } from '../manifest/schema';
 import { SCHEDULABLE_BUILTIN_CHECKS } from '../services/alerting/builtin-source';
+import { HEALTH_COVERAGE_CHECK } from '../services/alerting/health-coverage';
+import { HOOK_JAIL_CHECK } from '../services/alerting/hook-jail';
 import { listPrincipals } from '../services/api-access';
 import { listBackups } from '../services/backup-metadata';
 import { listBackupStorages } from '../services/backup-storage';
@@ -532,7 +534,9 @@ export async function getCompletions(words: string[], current: number): Promise<
 
   // Monitor targets - a module ID or one of celilo's own schedulable checks.
   // Sourced from SCHEDULABLE_BUILTIN_CHECKS rather than a hand-copied list, so
-  // a new built-in check is completable the moment it is schedulable.
+  // a new built-in check is completable the moment it is schedulable. The two
+  // local-state checks (health coverage, hook jail) are deliberately not in
+  // that list — it is the audit categories — so they ride alongside by name.
   if (
     command === 'monitor' &&
     (args[1] === 'add' ||
@@ -548,7 +552,10 @@ export async function getCompletions(words: string[], current: number): Promise<
       .from(modules)
       .all()
       .map((m) => m.id);
-    return filterSuggestions([...SCHEDULABLE_BUILTIN_CHECKS, ...moduleIds], args[2] || '');
+    return filterSuggestions(
+      [...SCHEDULABLE_BUILTIN_CHECKS, HEALTH_COVERAGE_CHECK, HOOK_JAIL_CHECK, ...moduleIds],
+      args[2] || '',
+    );
   }
 
   // Alerts subcommands
@@ -674,6 +681,7 @@ export async function getCompletions(words: string[], current: number): Promise<
       'init',
       'apply-config',
       'discover-network',
+      'ensure-fleet-key',
       'config',
       'secret',
       'vault-password',

package/src/cli/index.ts

@@ -124,6 +124,7 @@ import { handleSystemAudit } from './commands/system-audit';
 import { handleSystemConfigGet, handleSystemConfigSet } from './commands/system-config';
 import { handleSystemDiscoverNetwork } from './commands/system-discover-network';
 import { handleSystemDoctor } from './commands/system-doctor';
+import { handleSystemEnsureFleetKey } from './commands/system-ensure-fleet-key';
 import { handleSystemInit } from './commands/system-init';
 import { handleSystemMigrate } from './commands/system-migrate';
 import { handleSystemSecretGet } from './commands/system-secret-get';
@@ -618,7 +619,7 @@ Subcommands:
   show-config <id>                     Show all config including auto-derived values
   show-zone <id>                       Show module's network zone and config
 
-  build <module-id>                    Execute build scripts (Nix + Ansible)
+  build <module-id>                    Execute module build scripts (Ansible)
 
   generate <id>                        Generate infrastructure code for module
     Options:
@@ -1122,6 +1123,7 @@ Subcommands:
                                        to define, not a module's.
 
   discover-network                     Record the network this box sits on, from its own routing table (idempotent)
+  ensure-fleet-key                     Mint celilo's fleet SSH key if absent, record ssh.public_key, print the public half
 
   config set <key> <value>             Set system-wide configuration value
   config get [key]                     Get system configuration value(s)
@@ -2221,6 +2223,10 @@ export async function runCli(argv: string[]): Promise<CommandResult> {
       return handleSystemDiscoverNetwork();
     }
 
+    if (parsed.subcommand === 'ensure-fleet-key') {
+      return handleSystemEnsureFleetKey();
+    }
+
     if (parsed.subcommand === 'config') {
       const configSubcommand = parsed.args[0];
       if (!configSubcommand) {

package/src/console/closure.test.ts

@@ -232,6 +232,82 @@ describe('the walk follows real bindings, not declarations', () => {
     expect(result.nodes.map((n) => n.moduleId)).toEqual(['iptables']);
   });
 
+  test('a delegated provider is reached, though no manifest names it', () => {
+    // The case the whole chain exists for. `app` is BOUND to iptables, so the
+    // manifest walk stops there and the ISP router the packet actually leaves
+    // through never appears — even though iptables cannot reach the internet
+    // without it. celilo wires that edge at hook time; nothing declares it.
+    const multi: ProviderRow[] = [
+      { moduleId: 'iptables', capabilityName: 'firewall' },
+      { moduleId: 'axon', capabilityName: 'firewall' },
+    ];
+    const result = computeClosure({
+      rootModuleId: 'app',
+      manifests: new Map([
+        ['app', manifest({ requires: ['firewall'] })],
+        ['iptables', manifest({})],
+        ['axon', manifest({})],
+      ]),
+      providerRows: multi,
+      providerStates: deployed('iptables', 'axon'),
+      bindings: new Map([['app', new Map([['firewall', 'iptables']])]]),
+      chains: [{ capability: 'firewall', moduleIds: ['iptables', 'axon'] }],
+    });
+
+    expect(result.nodes.map((n) => n.moduleId)).toEqual(['iptables', 'axon']);
+    // Hop 2, because it is reached THROUGH iptables. Not a second hop-1
+    // dependency of the selection, which is what a fan would say.
+    expect(result.nodes.find((n) => n.moduleId === 'axon')?.hop).toBe(2);
+    // A packet has no alternative route to the internet.
+    expect(result.nodes.find((n) => n.moduleId === 'axon')?.optional).toBe(false);
+    expect(result.chains).toEqual([{ capability: 'firewall', moduleIds: ['iptables', 'axon'] }]);
+  });
+
+  test('a chain the walk never touched is not reported', () => {
+    // The chain is a fleet fact and the closure is about one module. A selection
+    // that consumes no firewall stands on none of it.
+    const result = computeClosure({
+      rootModuleId: 'site',
+      manifests,
+      providerRows: rows,
+      providerStates: deployed('cpanel', 'caddy', 'forgejo'),
+      chains: [{ capability: 'firewall', moduleIds: ['iptables', 'axon'] }],
+    });
+
+    expect(result.chains).toEqual([]);
+  });
+
+  test('the depth bound cuts a delegated provider like any other', () => {
+    // Three layers, bounded at two, so the LAST link is the one the bound cuts.
+    // The delegation edges are walked inside the same loop as the declared ones
+    // and get the same bound; a rule applied after the walk would smuggle the
+    // whole chain into a two-hop answer.
+    //
+    // A two-layer chain would not test this. `iptables` is the only declared
+    // dependency, so the walk exhausts at hop 2 whether or not the delegation
+    // is followed, and the assertion would hold for the wrong reason.
+    const result = computeClosure({
+      rootModuleId: 'app',
+      manifests: new Map([
+        ['app', manifest({ requires: ['firewall'] })],
+        ['iptables', manifest({})],
+        ['mid', manifest({})],
+        ['axon', manifest({})],
+      ]),
+      providerRows: [{ moduleId: 'iptables', capabilityName: 'firewall' }],
+      providerStates: deployed('iptables', 'mid', 'axon'),
+      depth: 2,
+      chains: [{ capability: 'firewall', moduleIds: ['iptables', 'mid', 'axon'] }],
+    });
+
+    expect(result.nodes.map((n) => n.moduleId)).toEqual(['iptables', 'mid']);
+    expect(result.truncated).toBe(true);
+    // Still reported WHOLE, including the member past the bound. Half a path is
+    // not a path, and the operator asked to see less, not to be told the packet
+    // stops at `mid`.
+    expect(result.chains[0]?.moduleIds).toEqual(['iptables', 'mid', 'axon']);
+  });
+
   test('a module with no bindings at all depends on nothing', () => {
     const result = computeClosure({
       rootModuleId: 'site',

package/src/console/closure.ts

@@ -57,6 +57,32 @@ export interface ClosureRequest {
    * without a database, not so the distinction is optional.
    */
   bindings?: ReadonlyMap<string, ReadonlyMap<string, string>>;
+  /**
+   * Ordered provider chains, most downstream first.
+   *
+   * These are edges NO MANIFEST DECLARES. celilo wires the `firewall`
+   * providers into a chain at hook time from `has_external`, so `iptables`
+   * genuinely stands on `axon` while neither manifest says a word about the
+   * other. A walk over manifests alone stops at `iptables`, and the box the
+   * packet actually leaves through never appears in the answer.
+   *
+   * Supplied by the caller rather than derived here so this stays pure. The CLI
+   * reads them with `loadFirewallChain`.
+   */
+  chains?: readonly DelegationChain[];
+}
+
+/**
+ * One capability's providers in delegation order.
+ *
+ * Ordered because for `firewall` they are not alternatives: the order is the
+ * packet's path. Same shape as the console protocol's `DelegationChain`, so the
+ * server hands it on rather than translating it.
+ */
+export interface DelegationChain {
+  capability: string;
+  /** Module ids, most downstream first. */
+  moduleIds: string[];
 }
 
 export interface ClosureNode {
@@ -78,6 +104,15 @@ export interface ClosureNode {
 
 export interface ClosureResult {
   nodes: ClosureNode[];
+  /**
+   * The delegation chains this closure touched, whole.
+   *
+   * A chain is emitted when the walk reached ANY of its members, and it carries
+   * every member rather than only the reached ones, because half a path is not
+   * a path. Empty means the closure touched no chain — which, now that
+   * something computes them, is an answer rather than a gap.
+   */
+  chains: DelegationChain[];
   /** Hops actually walked. Echoes the request so the console can say what it bounded. */
   depth: number;
   /**
@@ -107,10 +142,35 @@ function optionalCapabilityNames(manifest: ConsumedCapabilities): Set<string> {
   );
 }
 
+/**
+ * A chain's consecutive pairs, as edges out of each member.
+ *
+ * `[iptables, axon]` becomes one edge `iptables -> axon`. The last member has
+ * no edge out of it: it is the internet-facing end and delegates to nothing.
+ */
+function delegationEdgesByModule(
+  chains: readonly DelegationChain[],
+): Map<string, { to: string; capability: string }[]> {
+  const byModule = new Map<string, { to: string; capability: string }[]>();
+  for (const chain of chains) {
+    for (let i = 0; i + 1 < chain.moduleIds.length; i += 1) {
+      const from = chain.moduleIds[i];
+      const to = chain.moduleIds[i + 1];
+      if (from === undefined || to === undefined) continue;
+      const out = byModule.get(from) ?? [];
+      out.push({ to, capability: chain.capability });
+      byModule.set(from, out);
+    }
+  }
+  return byModule;
+}
+
 export function computeClosure(request: ClosureRequest): ClosureResult {
   const depth = request.depth ?? DEFAULT_CLOSURE_DEPTH;
   const providerRows = [...request.providerRows];
   const providerStates = [...request.providerStates];
+  const chains = request.chains ?? [];
+  const delegationsOut = delegationEdgesByModule(chains);
 
   const edges: Edge[] = [];
   // The root counts as visited from the start, so a cycle back to it terminates
@@ -165,10 +225,36 @@ export function computeClosure(request: ClosureRequest): ClosureResult {
         }
       }
     }
+
+    // The edges the manifests do not carry. Followed here, inside the same loop,
+    // so a delegated provider gets its hop, its cycle check and its depth bound
+    // from the one walk rather than from a second rule applied afterwards.
+    //
+    // Never optional: a packet has no alternative route to the internet, so a
+    // delegation is the strongest kind of dependency there is.
+    for (const moduleId of frontier) {
+      for (const edge of delegationsOut.get(moduleId) ?? []) {
+        if (edge.to === request.rootModuleId) continue;
+        edges.push({ to: edge.to, hop, capability: edge.capability, optional: false });
+        if (!visited.has(edge.to)) {
+          visited.add(edge.to);
+          next.push(edge.to);
+        }
+      }
+    }
+
     frontier = next;
   }
 
-  return { nodes: collectNodes(edges), depth, truncated };
+  const nodes = collectNodes(edges);
+  const reached = new Set([request.rootModuleId, ...nodes.map((node) => node.moduleId)]);
+
+  return {
+    nodes,
+    chains: chains.filter((chain) => chain.moduleIds.some((id) => reached.has(id))),
+    depth,
+    truncated,
+  };
 }
 
 /**

package/src/console/control-plane-boundary.test.ts

@@ -15,12 +15,12 @@
  * caddy-internal" for a further round after that. Prose did not hold this.
  */
 import { describe, expect, test } from 'bun:test';
+import { readFileSync, readdirSync } from 'node:fs';
+import { join } from 'node:path';
 import { parse } from 'yaml';
 
-const MANIFEST_PATH = new URL(
-  '../../../../modules/celilo-web-console/manifest.yml',
-  import.meta.url,
-).pathname;
+const MODULE_DIR = new URL('../../../../modules/celilo-web-console/', import.meta.url).pathname;
+const MANIFEST_PATH = join(MODULE_DIR, 'manifest.yml');
 
 /**
  * Capabilities that give something a way in from the data plane.
@@ -73,3 +73,81 @@ describe('celilo-web-console stays in the control plane', () => {
     expect(manifest.provides?.capabilities ?? []).toEqual([]);
   });
 });
+
+/**
+ * The build output the manifest's `build:` step writes, which is not source.
+ *
+ * Excluded from the walk below for two reasons, and the second is the one that
+ * matters. It holds two ~100MB compiled binaries, so reading it as text is
+ * absurd. And it holds a minified React bundle, which contains almost every
+ * short string you could think to search for — so scanning it reports ingress
+ * that nobody wrote. Both are gitignored, so on a fresh checkout the directory
+ * is absent entirely and the walk would silently be checking a different set of
+ * files than it checks on a machine that has run a build.
+ */
+const BUILD_OUTPUT_DIR = 'files';
+
+/**
+ * Every source file in the module's deployable body.
+ *
+ * A walk rather than a list, because the hole this guards is a file somebody
+ * ADDS. Listing today's files would pass over exactly the new Ansible task that
+ * opens the port.
+ */
+function deployableBody(): { path: string; text: string }[] {
+  const found: { path: string; text: string }[] = [];
+  const walk = (dir: string) => {
+    for (const entry of readdirSync(dir, { withFileTypes: true })) {
+      if (entry.isDirectory()) {
+        if (entry.name !== BUILD_OUTPUT_DIR) walk(join(dir, entry.name));
+        continue;
+      }
+      const path = join(dir, entry.name);
+      found.push({ path, text: readFileSync(path, 'utf8') });
+    }
+  };
+  for (const sub of ['terraform', 'ansible']) walk(join(MODULE_DIR, sub));
+  return found;
+}
+
+/**
+ * How a deployable body would open a path in from the data plane.
+ *
+ * A reverse-proxy vhost, a DNAT or port-forward rule, a `natIp`, or a dedicated
+ * ingress address. None belongs on a `secure-mgmt` module, and every one is a
+ * plausible one-line addition by someone who wanted to reach the console
+ * without bringing up the VPN.
+ */
+const INGRESS_TOKENS = [
+  'caddy',
+  'reverse_proxy',
+  'natip',
+  'exposeservice',
+  'port_forward',
+  'portforward',
+  'dnat',
+];
+
+describe("the console's deployable body opens no path in", () => {
+  test('the walk reaches the terraform and ansible it is checking', () => {
+    // Without this the assertion below is a confident statement about an empty
+    // set as soon as either directory is renamed — and the same is true on a
+    // fresh checkout, where the excluded build output does not exist at all.
+    const paths = deployableBody().map((file) => file.path);
+    expect(paths.some((path) => path.endsWith('terraform/main.tf.tpl'))).toBe(true);
+    expect(paths.some((path) => path.includes('/ansible/roles/'))).toBe(true);
+    expect(paths.some((path) => path.endsWith('.service.j2'))).toBe(true);
+  });
+
+  test('reads no build output, so a local build cannot change the verdict', () => {
+    const paths = deployableBody().map((file) => file.path);
+    expect(paths.filter((path) => path.includes(`/${BUILD_OUTPUT_DIR}/`))).toEqual([]);
+  });
+
+  test('names no reverse proxy, port forward or ingress address', () => {
+    const offenders = deployableBody()
+      .filter((file) => INGRESS_TOKENS.some((token) => file.text.toLowerCase().includes(token)))
+      .map((file) => file.path.slice(MODULE_DIR.length));
+    expect(offenders).toEqual([]);
+  });
+});

package/src/console/projection.test.ts

@@ -8,7 +8,7 @@ import { afterEach, beforeEach, describe, expect, test } from 'bun:test';
 import type { DbClient } from '../db/client';
 import { NETWORK_ZONES } from '../db/schema';
 import { cleanupTestDatabase, setupTestDatabase } from '../test-utils/database';
-import { consoleStatus } from './projection';
+import { consoleStatus, loadClosureInputs } from './projection';
 
 /** A manifest big enough to notice if it ever leaked into the payload. */
 const FAT_MANIFEST = JSON.stringify({
@@ -229,3 +229,65 @@ describe('consoleStatus derived facts', () => {
     expect(moduleOf('forgejo').backupStale).toBe(true);
   });
 });
+
+/**
+ * The reach probe for the chain (CLAUDE.md, "a check that cannot reach the
+ * thing it is checking").
+ *
+ * `orderFirewallChain` is unit-tested against hand-built rows. That says
+ * nothing about whether the closure's loader queries the right table with the
+ * right filter, and a wrong query here returns a well-formed empty list that
+ * reads exactly like a fleet with one firewall. So this drives the REAL loader
+ * against real `capabilities` rows.
+ */
+describe('loadClosureInputs, and the chain it carries', () => {
+  let db: DbClient;
+
+  beforeEach(async () => {
+    db = await setupTestDatabase();
+    for (const id of ['iptables', 'axon', 'caddy']) {
+      db.$client.run(
+        `INSERT INTO modules (id, name, version, source_path, manifest_data, state)
+         VALUES ('${id}', '${id}', '1.0.0', '/path', '{}', 'VERIFIED')`,
+      );
+    }
+  });
+
+  afterEach(async () => {
+    await cleanupTestDatabase(db);
+  });
+
+  function firewallProvider(moduleId: string, data: string) {
+    db.$client.run(
+      `INSERT INTO capabilities (module_id, capability_name, version, data)
+       VALUES ('${moduleId}', 'firewall', '1.0.0', '${data}')`,
+    );
+  }
+
+  test('reads the live registration and orders it, iptables first', () => {
+    firewallProvider('iptables', '{"firewall_ip":"192.168.0.254","nat_ip":"192.168.0.253"}');
+    firewallProvider('axon', '{"has_external":true,"router_ip":"192.168.0.1"}');
+
+    expect(loadClosureInputs(db).chains).toEqual([
+      { capability: 'firewall', moduleIds: ['iptables', 'axon'] },
+    ]);
+  });
+
+  test('a non-firewall capability is not swept into the chain', () => {
+    // `axon` provides dhcp_server too. A loader that read every row would put a
+    // module in the packet's path on the strength of an unrelated capability.
+    firewallProvider('iptables', '{"firewall_ip":"192.168.0.254","nat_ip":"192.168.0.253"}');
+    firewallProvider('axon', '{"has_external":true}');
+    db.$client.run(
+      `INSERT INTO capabilities (module_id, capability_name, version, data)
+       VALUES ('caddy', 'public_web', '1.0.0', '{}')`,
+    );
+
+    expect(loadClosureInputs(db).chains[0]?.moduleIds).toEqual(['iptables', 'axon']);
+  });
+
+  test('a fleet with one firewall has no chain', () => {
+    firewallProvider('axon', '{"has_external":true}');
+    expect(loadClosureInputs(db).chains).toEqual([]);
+  });
+});

package/src/console/projection.ts

@@ -14,16 +14,25 @@
  * succeed quietly.
  */
 
+import { FIREWALL_CAPABILITY_NAME, orderFirewallChain } from '@celilo/capabilities';
 import { desc, eq } from 'drizzle-orm';
 import { z } from 'zod';
 import type { DbClient } from '../db/client';
-import { NETWORK_ZONES, backups, moduleSystems, modules, monitors } from '../db/schema';
+import {
+  NETWORK_ZONES,
+  backups,
+  capabilities,
+  moduleSystems,
+  modules,
+  monitors,
+} from '../db/schema';
 import { loadObservedHealthDetail } from '../services/alerting/observed-health';
 import { loadBackupAuditInfo } from '../services/audit/backup-source';
 import { backupStaleThresholdMs, moduleHasBackupHook } from '../services/audit/backups';
 import { effectiveBackupSchedule } from '../services/backup-schedule';
 import { listCapabilityBindings } from '../services/capability-bindings';
 import type { ConsumedCapabilities } from '../services/consumer-cleanup';
+import type { DelegationChain } from './closure';
 
 /**
  * Just the capability lists, validated at the boundary.
@@ -302,10 +311,18 @@ export function loadBindings(db: DbClient, moduleId: string): Map<string, string
   );
 }
 
-/** Everything the closure walk needs, read in one place. */
+/**
+ * Everything the closure walk needs, read in ONE place.
+ *
+ * The chains are in here rather than beside it deliberately. A separate loader
+ * a caller has to remember is a caller that forgets, and the answer when it
+ * forgets is an empty chain list that reads exactly like a fleet with no
+ * delegation. There is one call site, and it cannot get a partial set.
+ */
 export function loadClosureInputs(db: DbClient): {
   manifests: Map<string, ConsumedCapabilities>;
   providerStates: { moduleId: string; state: string }[];
+  chains: DelegationChain[];
 } {
   return {
     manifests: new Map(
@@ -316,9 +333,29 @@ export function loadClosureInputs(db: DbClient): {
         .map((row) => [row.id, CONSUMED_CAPABILITIES.parse(row.manifestData)] as const),
     ),
     providerStates: db.select({ moduleId: modules.id, state: modules.state }).from(modules).all(),
+    chains: loadFirewallChain(db),
   };
 }
 
+/**
+ * The `firewall` providers in delegation order, as at most one chain.
+ *
+ * At most one because `firewall` is the only capability celilo chains, and
+ * `orderFirewallChain` — the SAME function the hook loader wires the live
+ * providers with — is what decides the order. A fleet with one firewall, or
+ * with none that reaches the internet, yields no chain at all.
+ */
+export function loadFirewallChain(db: DbClient): DelegationChain[] {
+  const providers = db
+    .select({ moduleId: capabilities.moduleId, data: capabilities.data })
+    .from(capabilities)
+    .where(eq(capabilities.capabilityName, FIREWALL_CAPABILITY_NAME))
+    .all();
+
+  const ordered = orderFirewallChain(providers).map((provider) => provider.moduleId);
+  return ordered.length === 0 ? [] : [{ capability: FIREWALL_CAPABILITY_NAME, moduleIds: ordered }];
+}
+
 /** A module's row, or undefined. Used to reject a closure request for a module that is gone. */
 export function moduleExists(db: DbClient, moduleId: string): boolean {
   return (

package/src/db/schema.ts

@@ -447,7 +447,6 @@ export const moduleBuilds = sqliteTable('module_builds', {
   version: text('version').notNull(),
   builtAt: integer('built_at', { mode: 'timestamp' }).notNull().default(sql`(unixepoch())`),
   artifacts: text('artifacts', { mode: 'json' }).$type<string[]>().notNull(), // Array of artifact paths
-  environment: text('environment').$type<'nix' | 'system'>(),
   status: text('status').$type<BuildStatus>().notNull(),
   buildLog: text('build_log'), // Build output for debugging
 });