@celilo/cli 1.5.0 → 1.7.0

package/src/db/schema.ts

@@ -241,6 +241,11 @@ export const moduleIntegrity = sqliteTable('module_integrity', {
     .unique()
     .references(() => modules.id, { onDelete: 'cascade' }),
   checksums: text('checksums', { mode: 'json' }).$type<Record<string, string>>().notNull(), // { "path/to/file": "xxhash", ... }
+  // Which version these checksums describe. NULL means the row was written
+  // before celilo stamped versions — a fact `module verify` reports rather
+  // than papers over, because a baseline whose version is unknown cannot be
+  // compared to the module's and is not evidence of anything.
+  version: text('version'),
   signature: text('signature'), // Nullable - null for directory imports, populated for .netapp packages
   importedAt: integer('imported_at', { mode: 'timestamp' }).notNull().default(sql`(unixepoch())`),
   updatedAt: integer('updated_at', { mode: 'timestamp' }).notNull().default(sql`(unixepoch())`),

package/src/hooks/capability-loader.test.ts

@@ -29,6 +29,17 @@ export default function registerHost(context) {
 }
 `;
 
+const TEST_DHCP_SERVER_MODULE = `
+export default function createDhcpServer(context) {
+  return {
+    async setDnsServers() {},
+    async getDnsServers() { return [context.config.marker]; },
+    async setDomainName() {},
+    async getDomainName() { return context.config.marker; },
+  };
+}
+`;
+
 describe('Capability Loader', () => {
   let db: DbClient;
   let tempDir: string;
@@ -97,6 +108,50 @@ describe('Capability Loader', () => {
     expect(result.dns_registrar).toBeTruthy();
   });
 
+  test('prefers a provider explicitly scoped to the well-known capability zone', async () => {
+    for (const moduleId of ['upstream-dhcp', 'internal-dhcp']) {
+      const modulePath = join(tempDir, moduleId);
+      const scriptsDir = join(modulePath, 'scripts');
+      mkdirSync(scriptsDir, { recursive: true });
+      writeFileSync(join(scriptsDir, 'dhcp-server-functions.ts'), TEST_DHCP_SERVER_MODULE);
+      db.$client.run(
+        `INSERT INTO modules (id, name, version, source_path, manifest_data) VALUES ('${moduleId}', '${moduleId}', '1.0.0', '${modulePath}', '{}')`,
+      );
+      upsertModuleConfig(db, moduleId, 'marker', moduleId);
+    }
+
+    // Insert the zone-agnostic upstream provider first to prove selection is
+    // policy-driven rather than database-order-driven.
+    db.$client.run(
+      `INSERT INTO capabilities (module_id, capability_name, version, data, zones, registered_at) VALUES ('upstream-dhcp', 'dhcp_server', '1.0.0', '{}', NULL, unixepoch())`,
+    );
+    db.$client.run(
+      `INSERT INTO capabilities (module_id, capability_name, version, data, zones, registered_at) VALUES ('internal-dhcp', 'dhcp_server', '1.0.0', '{}', '["internal"]', unixepoch())`,
+    );
+
+    const result = await loadCapabilityFunctions('dns-consumer', db, noopLogger);
+    const dhcp = result.dhcp_server as { getDomainName(): Promise<string> };
+    expect(await dhcp.getDomainName()).toBe('internal-dhcp');
+  });
+
+  test('falls back to a zone-agnostic provider when no explicit zone provider exists', async () => {
+    const modulePath = join(tempDir, 'upstream-dhcp');
+    const scriptsDir = join(modulePath, 'scripts');
+    mkdirSync(scriptsDir, { recursive: true });
+    writeFileSync(join(scriptsDir, 'dhcp-server-functions.ts'), TEST_DHCP_SERVER_MODULE);
+    db.$client.run(
+      `INSERT INTO modules (id, name, version, source_path, manifest_data) VALUES ('upstream-dhcp', 'upstream-dhcp', '1.0.0', '${modulePath}', '{}')`,
+    );
+    db.$client.run(
+      `INSERT INTO capabilities (module_id, capability_name, version, data, zones, registered_at) VALUES ('upstream-dhcp', 'dhcp_server', '1.0.0', '{}', NULL, unixepoch())`,
+    );
+    upsertModuleConfig(db, 'upstream-dhcp', 'marker', 'upstream-dhcp');
+
+    const result = await loadCapabilityFunctions('dns-consumer', db, noopLogger);
+    const dhcp = result.dhcp_server as { getDomainName(): Promise<string> };
+    expect(await dhcp.getDomainName()).toBe('upstream-dhcp');
+  });
+
   test('injects a read-only web_routes view into the public_web provider own hooks (ISS-0035)', async () => {
     const modulePath = join(tempDir, 'caddy');
     mkdirSync(modulePath, { recursive: true });

package/src/hooks/capability-loader.ts

@@ -27,6 +27,8 @@ import type {
   TrustedSourceStore,
 } from '@celilo/capabilities';
 import { and, eq } from 'drizzle-orm';
+import { selectCapabilityProvider } from '../capabilities/lookup';
+import { WELL_KNOWN_CAPABILITIES } from '../capabilities/well-known';
 import type { DbClient } from '../db/client';
 import {
   NETWORK_ZONES,
@@ -279,7 +281,20 @@ export async function loadCapabilityFunctions(
       continue;
     }
 
-    const capability = allProviders[0];
+    // A well-known capability's required zone is also its runtime selection
+    // context. Prefer a provider that explicitly serves that zone, then fall
+    // back to a zone-agnostic provider. Without this, multiple DHCP providers
+    // (for example an upstream router plus an internal LAN server) are selected
+    // by database insertion order and a consumer can reconfigure the wrong
+    // network boundary.
+    const selectionZone = WELL_KNOWN_CAPABILITIES[capName]?.required_zone;
+    const capability = selectCapabilityProvider(allProviders, selectionZone);
+    if (!capability) {
+      debugLog(
+        `${capName}: no provider serves required zone ${selectionZone ?? '(unspecified)'}, skipping`,
+      );
+      continue;
+    }
     debugLog(`${capName}: found provider module ${capability.moduleId}`);
 
     const providerModule = db

package/src/manifest/json-schema-roundtrip.test.ts

@@ -3,10 +3,18 @@
  * under both the Zod schema (ModuleManifestSchema) and the exported JSON
  * Schema at <repo>/schemas/module-manifest.schema.json.
  *
- * This guards two things:
- *   1. The exported JSON Schema is in sync with the Zod source (the same as
- *      'bun run check:schema'). If someone forgets to regenerate after editing
- *      schema.ts, this test fails.
+ * This is the INDIRECT drift detector, not the primary guard. `bun run
+ * check:schema` (a step in the CI validate job) regenerates the schema and
+ * compares it byte-for-byte, so it fails the moment schema.ts changes without a
+ * regenerate. This test only fails once some real manifest in the repo happens
+ * to declare something a stale schema rejects, which can be days later and in
+ * an unrelated PR. Do not mistake one for the other: if you add a field to
+ * schema.ts, `check:schema` is what tells you to run `bun run export:schema`.
+ *
+ * What this test is actually for:
+ *   1. Every manifest the repo ships really does validate under both
+ *      validators, so a stale schema cannot sit unnoticed once it starts
+ *      rejecting live manifests.
  *   2. zod-to-json-schema's translation hasn't lost fidelity in a way that
  *      would let bad manifests pass the editor (red underlines) while still
  *      failing at module import time. If a real manifest in the repo is

package/src/manifest/schema.ts

@@ -677,6 +677,29 @@ export const ModuleManifestSchema = z
 
     hooks: z.object(HOOK_SCHEMAS).strict().optional(),
 
+    /**
+     * How much of `celilo module verify` this module can honestly answer.
+     *
+     * `deep: false` opts the module out of the host plane — the `--deep` pass
+     * that evaluates its generated playbook in check mode. The escape hatch
+     * exists because Ansible's check mode SKIPS a task it cannot evaluate, so a
+     * role driven by `command:` / `shell:` can report `changed=0` having never
+     * been applied. For most roles that lands as `unmeasured`, which is honest.
+     * A role where it would land as a persistent false `drift` should say so
+     * here instead of training operators to ignore the output.
+     *
+     * `reason` is REQUIRED. An opt-out with no stated reason is a check that
+     * disappeared, and celilo prints the reason wherever the module is verified
+     * (openspec/changes/module-integrity-rigor, D4 / task 6.3).
+     */
+    verify: z
+      .object({
+        deep: z.literal(false),
+        reason: z.string().min(1),
+      })
+      .strict()
+      .optional(),
+
     build: z
       .object({
         /** Inline shell command to build the module (run via bash -c). Mutually exclusive with script. */

package/src/module/import.ts

@@ -1,7 +1,7 @@
 import { execSync } from 'node:child_process';
 import { existsSync, statSync, writeFileSync } from 'node:fs';
 import { copyFile, mkdir, readFile, readdir } from 'node:fs/promises';
-import { join } from 'node:path';
+import { join, relative } from 'node:path';
 import { eq } from 'drizzle-orm';
 import { z } from 'zod';
 import { getWellKnownCapability, isWellKnown } from '../capabilities/well-known';
@@ -23,6 +23,7 @@ import {
 } from '../manifest/validate';
 import { parseJsonWithValidation } from '../validation/schemas';
 import { cleanupTempDir, extractPackage, verifyPackageIntegrity } from './packaging/extract';
+import { classifyModulePath } from './packaging/package-rules';
 
 /**
  * Phase-timing helper for `celilo module import`. Set CELILO_IMPORT_DEBUG=1
@@ -232,29 +233,14 @@ export async function copyModuleFiles(sourcePath: string, targetPath: string): P
     for (const entry of entries) {
       const srcPath = join(src, entry.name);
       const destPath = join(dest, entry.name);
-
-      // Skip metadata files
-      if (entry.name === 'checksums.json' || entry.name === 'signature.sig') {
-        continue;
-      }
-
-      // Skip directories that shouldn't be copied into celilo's data store.
-      // node_modules inside scripts/ ARE kept — they contain the module's
-      // runtime deps (@celilo/capabilities etc.). Top-level node_modules
-      // (monorepo workspace deps, build tools) are skipped.
-      if (
-        entry.isDirectory() &&
-        (entry.name === '.git' || entry.name === '.next' || entry.name === '.cache')
-      ) {
-        continue;
-      }
-
-      if (
-        entry.isDirectory() &&
-        entry.name === 'node_modules' &&
-        !src.endsWith('/scripts') &&
-        !src.endsWith('\\scripts')
-      ) {
+      const relPath = relative(sourcePath, srcPath);
+
+      // `unknown` is everything that belongs to the module's SOURCE tree and
+      // not to its install: `.git/`, `e2e/`, tests, `tsconfig.json`, the
+      // node_modules the canonical rule drops. Skipping it here is what keeps
+      // the `unknown` class empty on a healthy install, so any `unknown` that
+      // audit later reports is real. `package` and `derived` both land.
+      if (classifyModulePath(relPath) === 'unknown') {
         continue;
       }
 
@@ -314,7 +300,8 @@ export function moduleExists(moduleId: string, db = getDb()): boolean {
  * Validate well-known capabilities
  *
  * Policy function - checks if module's well-known capabilities are valid:
- * 1. No other module provides the same well-known capability (uniqueness)
+ * 1. No other module provides the same well-known capability in an
+ *    overlapping scope (zone-aware uniqueness)
  * 2. Module's zone matches capability's required zone (zone enforcement)
  *
  * @param manifest - Module manifest
@@ -335,16 +322,30 @@ export async function validateWellKnownCapabilities(
 
     const wellKnown = getWellKnownCapability(capability.name);
 
-    // Check 1: Capability uniqueness - only one module can provide this capability
+    // Check 1: Capability uniqueness within an overlapping scope. An explicit
+    // zone-scoped provider may coexist with a zone-agnostic fallback because
+    // lookup deterministically prefers the explicit match. Two agnostic
+    // providers, or two explicit providers sharing a zone, remain ambiguous.
     const existingCapability = await db
       .select()
       .from(capabilities)
       .where(eq(capabilities.capabilityName, capability.name))
       .all();
 
-    if (existingCapability.length > 0) {
-      const conflictingModule = existingCapability[0];
-      return `Well-known capability '${capability.name}' is already provided by module '${conflictingModule.moduleId}'. A home lab can only have one module providing this capability. Remove '${conflictingModule.moduleId}' before importing this module.`;
+    const newZones = capability.zones ?? null;
+    const conflictingModule = existingCapability.find((candidate) => {
+      const existingZones = candidate.zones ?? null;
+
+      if (newZones === null || existingZones === null) {
+        return newZones === null && existingZones === null;
+      }
+
+      return newZones.some((zone) => existingZones.includes(zone));
+    });
+
+    if (conflictingModule) {
+      const scope = newZones ? ` zone(s) ${newZones.join(', ')}` : ' the zone-agnostic scope';
+      return `Well-known capability '${capability.name}' is already provided in${scope} by module '${conflictingModule.moduleId}'. Remove '${conflictingModule.moduleId}' or use a non-overlapping explicit zone scope before importing this module.`;
     }
 
     // Check 2: Zone enforcement - module must be in the correct zone
@@ -699,17 +700,32 @@ export async function importModule(options: ModuleImportOptions): Promise<Module
     // Execution: Store integrity data from the package's checksums + signature.
     // Directory imports go through the packager too (see top of importModule),
     // so by the time we reach this point we always have these.
-    try {
-      const integrityData: NewModuleIntegrity = {
-        moduleId: manifest.id,
-        checksums: checksums ?? {},
-        signature: signature?.trim() ?? null,
-      };
-      db.insert(moduleIntegrity).values(integrityData).run();
-    } catch (error) {
-      // Non-fatal - module is already imported
-      console.warn('Warning: Failed to store module integrity data', error);
-    }
+    //
+    // UPSERT, not INSERT. `moduleId` is UNIQUE, so a re-import of an already
+    // imported module used to collide, get caught by a warn-and-continue, and
+    // leave the FIRST import's checksums in place forever. Every file that
+    // legitimately changed since then read as [MODIFIED] and the baseline
+    // described a version nobody could name. Failing to record the baseline is
+    // not "non-fatal": it is the state that made `module verify` useless, so
+    // this no longer swallows its own errors.
+    const integrityData: NewModuleIntegrity = {
+      moduleId: manifest.id,
+      checksums: checksums ?? {},
+      version: manifest.version,
+      signature: signature?.trim() ?? null,
+    };
+    db.insert(moduleIntegrity)
+      .values(integrityData)
+      .onConflictDoUpdate({
+        target: moduleIntegrity.moduleId,
+        set: {
+          checksums: integrityData.checksums,
+          version: integrityData.version,
+          signature: integrityData.signature,
+          updatedAt: new Date(),
+        },
+      })
+      .run();
 
     // Record a successful build entry so deploy-time validation sees the
     // artifacts in place and skips rebuild. The packager runs the manifest

package/src/module/packaging/audit.ts

@@ -4,8 +4,12 @@ import { join, relative } from 'node:path';
 import { eq } from 'drizzle-orm';
 import { getDb } from '../../db/client';
 import { moduleIntegrity, modules } from '../../db/schema';
+import type { ModuleManifest } from '../../manifest/schema';
 import { computeFileChecksum } from './checksum';
 import type { IntegrityViolation } from './extract';
+import { compareVerbatimRoleAssets, readVerbatimRoleAssets } from './generated-plane';
+import { type HostPlaneResult, verifyModuleOnHosts } from './host-plane';
+import { classifyModulePath } from './package-rules';
 
 /**
  * Audit result for a module
@@ -15,24 +19,27 @@ export interface AuditResult {
   moduleId: string;
   violations: IntegrityViolation[];
   error?: string;
+  /** What the module records, and what version the baseline describes. */
+  moduleVersion?: string;
+  baselineVersion?: string | null;
+  /** Present only under `deep`. See `host-plane.ts`. */
+  hostPlane?: HostPlaneResult;
 }
 
-/**
- * Files the framework manages on the imported module's behalf and which
- * are NOT part of the package's signed checksums. Audit treats them as
- * neither modified nor extra — they're owned by Celilo, not the
- * module's source.
- *
- * `celilo/types.d.ts` is regenerated by `module import` (HOOK_API_V2
- * Phase 2 belt-and-suspenders). A fresh copy appears on disk after
- * extracting the package, but it isn't in `checksums.json` because the
- * package may have been built before the type was generated.
- */
-const FRAMEWORK_OWNED_PATHS = new Set(['celilo/types.d.ts']);
+export interface AuditOptions {
+  /**
+   * Also ask each of the module's systems whether what is running is what
+   * celilo generated. One SSH per system, so it is off by default.
+   */
+  deep?: boolean;
+}
 
 /**
- * Recursively scan directory and return all file paths, skipping
- * framework-owned files that shouldn't participate in audit checks.
+ * Recursively scan the installed tree, keeping only paths whose content is a
+ * stable integrity claim (`package`) or whose presence is a finding in itself
+ * (`unknown`). `derived` paths — `generated/**`, the hook runtime closure,
+ * `checksums.json` — are celilo's own and are dropped here, because a check
+ * that reports them can only ever be wrong.
  */
 async function scanDirectory(dir: string, baseDir: string): Promise<string[]> {
   const files: string[] = [];
@@ -42,21 +49,14 @@ async function scanDirectory(dir: string, baseDir: string): Promise<string[]> {
     const fullPath = join(dir, entry.name);
     const relativePath = relative(baseDir, fullPath);
 
-    if (FRAMEWORK_OWNED_PATHS.has(relativePath)) {
-      continue;
-    }
-
-    // Skip node_modules anywhere in the tree — these are installed by
-    // the framework during `module import` (NPM_PACKAGE_RESOLUTION
-    // Option B), not part of the module's signed checksums.
-    if (entry.isDirectory() && entry.name === 'node_modules') {
-      continue;
-    }
-
     if (entry.isDirectory()) {
+      // Prune whole derived subtrees rather than walking them. `generated/`
+      // alone carries terraform provider binaries.
+      if (classifyModulePath(relativePath) === 'derived') continue;
       const subFiles = await scanDirectory(fullPath, baseDir);
       files.push(...subFiles);
     } else if (entry.isFile()) {
+      if (classifyModulePath(relativePath) === 'derived') continue;
       files.push(relativePath);
     }
   }
@@ -71,7 +71,11 @@ async function scanDirectory(dir: string, baseDir: string): Promise<string[]> {
  * @param db - Database client (optional, for testing)
  * @returns Audit result with any violations found
  */
-export async function auditModule(moduleId: string, db = getDb()): Promise<AuditResult> {
+export async function auditModule(
+  moduleId: string,
+  db = getDb(),
+  options: AuditOptions = {},
+): Promise<AuditResult> {
   const violations: IntegrityViolation[] = [];
 
   try {
@@ -106,6 +110,26 @@ export async function auditModule(moduleId: string, db = getDb()): Promise<Audit
     const expectedChecksums: Record<string, string> = integrity.checksums;
     const moduleDir = module.sourcePath;
 
+    // Which version do these checksums describe? Ahead of every file finding,
+    // because when the answer is "not the installed one" the file findings are
+    // a consequence of it and not independent evidence. Before D1 this was
+    // unanswerable: the row was written once at first import and `module
+    // update` never touched it, so verify reported the same violations whether
+    // the files were old or the checksums were old.
+    if (integrity.version === null) {
+      violations.push({
+        type: 'stale-baseline',
+        path: 'checksums.json',
+        message: `Baseline records no version — it was written before celilo stamped them, so it cannot be compared to the installed ${module.version}. Re-run 'celilo module update' for this module to refresh it.`,
+      });
+    } else if (integrity.version !== module.version) {
+      violations.push({
+        type: 'stale-baseline',
+        path: 'checksums.json',
+        message: `Baseline describes ${integrity.version}, module records ${module.version}. The checksums are old, not the files. Re-run 'celilo module update' for this module to refresh it.`,
+      });
+    }
+
     // Check if module directory exists
     if (!existsSync(moduleDir)) {
       return {
@@ -116,8 +140,12 @@ export async function auditModule(moduleId: string, db = getDb()): Promise<Audit
       };
     }
 
-    // Validate all expected files exist and have correct checksums
+    // Validate all expected files exist and have correct checksums. A baseline
+    // entry for a derived path is not checkable: celilo rewrites those bytes
+    // after install (`bun install` over the hook runtime closure), so comparing
+    // them to what the package shipped can only ever produce a false positive.
     for (const [filePath, expectedChecksum] of Object.entries(expectedChecksums)) {
+      if (classifyModulePath(filePath) === 'derived') continue;
       const fullPath = join(moduleDir, filePath);
 
       if (!existsSync(fullPath)) {
@@ -125,6 +153,8 @@ export async function auditModule(moduleId: string, db = getDb()): Promise<Audit
           type: 'missing',
           path: filePath,
           message: `Missing file: ${filePath}`,
+          expectedDigest: expectedChecksum,
+          actualDigest: null,
         });
         continue;
       }
@@ -135,6 +165,33 @@ export async function auditModule(moduleId: string, db = getDb()): Promise<Audit
           type: 'modified',
           path: filePath,
           message: `Checksum mismatch: ${filePath}`,
+          expectedDigest: expectedChecksum,
+          actualDigest: actualChecksum,
+        });
+      }
+    }
+
+    // Plane two: is what we would deploy built from what we installed? Only
+    // verbatim role assets have a meaningful expected digest — Ansible
+    // templates the rest, and a `.j2` in `generated/` is SUPPOSED to differ.
+    // A module that has never been generated has nothing to compare and is not
+    // a finding; it is simply pre-deploy.
+    const generatedDir = join(moduleDir, 'generated');
+    if (existsSync(generatedDir)) {
+      const differences = compareVerbatimRoleAssets(
+        await readVerbatimRoleAssets(moduleDir),
+        await readVerbatimRoleAssets(generatedDir),
+      );
+      for (const difference of differences) {
+        violations.push({
+          type: 'stale-generated',
+          path: difference.relPath,
+          expectedDigest: difference.installedDigest,
+          actualDigest: difference.generatedDigest,
+          message:
+            difference.reason === 'missing'
+              ? `Generated project is missing ${difference.relPath} — the next deploy would ship nothing for it. Run 'celilo module generate ${moduleId}'.`
+              : `Generated project holds different bytes for ${difference.relPath} (generated ${difference.generatedDigest}, installed ${difference.installedDigest}) — the next deploy would ship the wrong ones. Run 'celilo module generate ${moduleId}'.`,
         });
       }
     }
@@ -153,10 +210,28 @@ export async function auditModule(moduleId: string, db = getDb()): Promise<Audit
       }
     }
 
+    // Plane three: is what is running what we generated? One SSH per system,
+    // so it is asked only when the caller says so.
+    let hostPlane: HostPlaneResult | undefined;
+    if (options.deep) {
+      hostPlane = await verifyModuleOnHosts({
+        moduleId,
+        manifest: module.manifestData as unknown as ModuleManifest,
+        generatedPath: generatedDir,
+      });
+    }
+
+    // An `unmeasured` host is not a pass. A check that could not reach its
+    // subject says so, and does not count as green.
+    const hostPlaneClean = (hostPlane?.findings ?? []).every((f) => f.state === 'converged');
+
     return {
-      success: violations.length === 0,
+      success: violations.length === 0 && hostPlaneClean,
       moduleId,
       violations,
+      moduleVersion: module.version,
+      baselineVersion: integrity.version,
+      hostPlane,
     };
   } catch (error) {
     return {

package/src/module/packaging/build.ts

@@ -9,7 +9,7 @@ import { log } from '../../cli/prompts';
 import { formatViolations, scanModuleDirectory } from '../../policy/module-script-scan';
 import { validateModuleDirectory } from '../import';
 import { computeFileChecksum } from './checksum';
-import { includeNodeModulesPath } from './package-rules';
+import { classifyModulePath, includeNodeModulesPath } from './package-rules';
 import { signChecksums } from './signature';
 import { rewriteWorkspaceDeps } from './workspace-deps';
 
@@ -49,63 +49,22 @@ export interface ModuleBuildResult {
 }
 
 /**
- * Files/directories to exclude from package.
+ * Check if a path inside the source dir should be excluded from the package.
  *
- * `node_modules` is NOT listed here — it's path-aware via the canonical
- * `includeNodeModulesPath` rule (package-rules.ts), so the hook-script runtime
- * closure is bundled while other node_modules is dropped.
- */
-const EXCLUDE_PATTERNS = [
-  '.git',
-  '.DS_Store',
-  '*.netapp',
-  '*.test.ts',
-  // Dev-only, same bucket as the tests: scripts/tsconfig.json exists so tsc can
-  // check hooks in CI. Nothing on a target ever runs tsc, and shipping it would
-  // make every module's packaged content change whenever the shared base moves.
-  'tsconfig.json',
-  'checksums.json',
-  'signature.sig',
-];
-
-/**
- * Path-relative files the framework manages and that should never be
- * bundled into a `.netapp` package. `celilo/types.d.ts` is generated
- * post-import by `module import` (HOOK_API_V2 Phase 2 belt-and-suspenders),
- * so shipping the local copy would just stamp the package with whatever
- * was on the author's disk at build time — including potentially stale
- * versions if the manifest changed since.
- */
-const FRAMEWORK_OWNED_PATHS = new Set(['celilo/types.d.ts']);
-
-/**
- * Check if a path inside the source dir should be excluded from the
- * package.
- *
- * The `node_modules` decision is delegated to the canonical
- * `includeNodeModulesPath` rule (package-rules.ts) — the single source of truth
- * the registry-server's bootstrap packager is held to as well (ISS-0046).
+ * `classifyModulePath` (package-rules.ts) is the one answer to what belongs to
+ * a module. Packaging differs from it in exactly one place: the hook runtime
+ * closure under `scripts/node_modules/` is `derived` (celilo's `bun install`
+ * owns the on-disk copy) and still SHIPS, because a target may have no
+ * reachable registry (ISS-0046). Everything else `derived` is celilo's own
+ * output, or the checksum manifest that cannot list itself.
  */
 function shouldExclude(filePath: string): boolean {
-  if (FRAMEWORK_OWNED_PATHS.has(filePath)) return true;
-
-  const segments = filePath.split('/');
-
-  // Module's e2e/ directory at the source root is tests + their deps —
-  // not part of the deployed module.
-  if (segments[0] === 'e2e') return true;
-
-  if (segments.includes('node_modules')) {
+  const cls = classifyModulePath(filePath);
+  if (cls === 'package') return false;
+  if (cls === 'derived' && filePath.split('/').includes('node_modules')) {
     return !includeNodeModulesPath(filePath);
   }
-
-  const name = basename(filePath);
-  return EXCLUDE_PATTERNS.some((pattern) => {
-    if (pattern.startsWith('*')) {
-      return name.endsWith(pattern.slice(1));
-    }
-    return name === pattern;
-  });
+  return true;
 }
 
 /**