@celilo/cli 1.6.0 → 1.8.0

package/src/variables/context.ts

@@ -19,6 +19,7 @@ import { allocateResources, getAllocation } from '../ipam/allocator';
 import { type ModuleManifest, getDeclaredSystems, getSingularSystemSpec } from '../manifest/schema';
 import { decryptSecret } from '../secrets/encryption';
 import { getOrCreateMasterKey } from '../secrets/master-key';
+import { resolveMachineIdentityAddress } from '../services/deployed-systems';
 import { upsertModuleConfig } from '../services/module-config';
 import { resolveComputedFields } from './computed/evaluate';
 import { containsComputedMarker } from './computed/marker';
@@ -419,10 +420,17 @@ async function assembleResolutionContext(
             `Machine '${infraSelection.machineId}' for module '${moduleId}' has no ipAddress`,
           );
         }
+        const deployedZone = machineRow.zone ?? zone;
+        const machineIdentity = resolveMachineIdentityAddress(machineRow, deployedZone);
+        if (!machineIdentity) {
+          throw new Error(
+            `Machine '${infraSelection.machineId}' for module '${moduleId}' has no non-loopback interface in zone '${deployedZone}'`,
+          );
+        }
         upsertDeployedSystem(db, moduleId, {
           name: decl.name,
           hostname,
-          ipv4Address: machineRow.ipAddress,
+          ipv4Address: machineIdentity,
           // The machine's own zone, matching recordDeployedSystemForModule and
           // backfillModuleSystems. This is the THIRD place that decides a
           // deployed system's zone, and it ran last — so while the other two
@@ -430,7 +438,7 @@ async function assembleResolutionContext(
           // manifest's, and the control plane stayed recorded as `internal`.
           // `requires.system.zone` is the minimum used to SELECT a host; the
           // machine we selected is where the system actually is.
-          zone: machineRow.zone ?? zone,
+          zone: deployedZone,
           infraType: 'machine',
           machineId: infraSelection.machineId,
         });
@@ -585,16 +593,81 @@ async function assembleResolutionContext(
         }
       }
     }
-    const dnsInternal = capabilitiesMap.dns_internal as { server?: { ip?: unknown } } | undefined;
-    // The dns_internal capability advertises the provider's address, which may
-    // carry a CIDR suffix (technitium's server.ip resolves from target_ip,
-    // e.g. "192.168.0.151/24"). A nameserver must be a bare IP — strip it.
-    const rawInternalIp =
-      typeof dnsInternal?.server?.ip === 'string' ? dnsInternal.server.ip : undefined;
-    const internalIp = rawInternalIp ? rawInternalIp.split('/')[0] : undefined;
-    const nameservers = internalIp ? [internalIp, ...publicDns] : publicDns;
-    if (nameservers.length > 0) {
-      selfConfig.lxc_nameserver = nameservers.join(' ');
+    type ResolverEndpoint = {
+      server?: { ip?: unknown; internal_ip?: unknown };
+      /** Zones the provider's base-module aspect owns ongoing DNS for (D5d). */
+      aspect?: { covered_zones?: unknown };
+    };
+    const dnsInternal = capabilitiesMap.dns_internal as ResolverEndpoint | undefined;
+    const dnsSecondary = capabilitiesMap.dns_internal_secondary as ResolverEndpoint | undefined;
+
+    // A nameserver must be a bare IP. The advertised address may carry a CIDR
+    // suffix (technitium's server.ip resolves from target_ip, e.g.
+    // "192.168.0.151/24"), so strip it.
+    const bareIp = (value: unknown): string | undefined =>
+      typeof value === 'string' && value.length > 0 ? value.split('/')[0] : undefined;
+
+    const targetZone = module?.manifestData
+      ? getSingularSystemSpec(module.manifestData as ModuleManifest)?.zone
+      : undefined;
+
+    // `internal` cannot route into the resolvers' own (dmz) subnet, so it uses
+    // the ingress addresses the firewall DNATs. Every other zone reaches them
+    // directly.
+    const endpointFor = (resolver: ResolverEndpoint | undefined): string | undefined =>
+      targetZone === 'internal'
+        ? (bareIp(resolver?.server?.internal_ip) ?? bareIp(resolver?.server?.ip))
+        : bareIp(resolver?.server?.ip);
+
+    const primaryIp = endpointFor(dnsInternal);
+    const secondaryIp = endpointFor(dnsSecondary);
+
+    // Whether the DEPLOYED provider's base-module aspect covers this system's
+    // zone, which is what decides if the public entries may go (design D5d).
+    //
+    // The predicate is aspect COVERAGE, not routing. Routing is why a zone goes
+    // uncovered — `external` and the planned `quarantine` hold systems that
+    // cannot reach a resolver inside the perimeter. Coverage is why the birth
+    // list is PERMANENT: terraform injects
+    // `lifecycle { ignore_changes = [nameserver] }`, so it cannot correct the
+    // value afterwards even in principle, and a zone no aspect covers has no
+    // owner for ongoing DNS at all. Keying on coverage therefore handles a
+    // future excluded zone with no change here, and fails safe on an accidental
+    // omission — where keeping the public entries is the lesser harm until the
+    // array is fixed.
+    // The provider DECLARES its coverage in the capability data. Core could
+    // instead find the provider's module row and read
+    // `base_module_aspect.applicable_zones` off its manifest, which would be
+    // one source of truth rather than two — but that means core naming a
+    // capability in order to find its provider, which is the pattern the
+    // module-business gate exists to stop, and its advice is exactly this: let
+    // the provider declare the behaviour. A manifest test holds the declared
+    // list and the aspect's own `applicable_zones` together so they cannot
+    // drift.
+    const aspectZones = dnsInternal?.aspect?.covered_zones;
+    const zoneIsAspectCovered =
+      targetZone !== undefined && Array.isArray(aspectZones) && aspectZones.includes(targetZone);
+
+    // Both halves are required. A pair with no aspect covering this zone is the
+    // `external` case: two addresses it cannot route to and nothing else, which
+    // does not tighten anything, it takes DNS away. A primary with no secondary
+    // is D5a: removing the fallback and shipping a secondary are ONE decision,
+    // because otherwise every resolver redeploy blanks fleet DNS.
+    const dropPublicResolvers =
+      primaryIp !== undefined && secondaryIp !== undefined && zoneIsAspectCovered;
+
+    // The uncovered branch is main's composition unchanged: the primary, then
+    // the public resolvers. The secondary is deliberately NOT added to it — in
+    // a zone that cannot route to the resolvers, a second unreachable address
+    // buys nothing but another timeout before the public entries answer.
+    const nameservers = dropPublicResolvers
+      ? [primaryIp, secondaryIp]
+      : primaryIp
+        ? [primaryIp, ...publicDns]
+        : publicDns;
+    const unique = [...new Set(nameservers)];
+    if (unique.length > 0) {
+      selfConfig.lxc_nameserver = unique.join(' ');
     }
   }
 

package/src/variables/declarative-derivation.test.ts

@@ -691,7 +691,7 @@ describe('applyDeclarativeDerivations', () => {
       expect(context.selfConfig.primary_domain).toBeUndefined();
     });
 
-    test('skips non-string types (handled by config interview instead)', () => {
+    test('derives scalar numeric values from capability data', () => {
       const manifest: ModuleManifest = {
         celilo_contract: '1.0',
         id: 'test-module',
@@ -703,10 +703,10 @@ describe('applyDeclarativeDerivations', () => {
           owns: [
             {
               name: 'port',
-              type: 'number',
+              type: 'integer',
               required: false,
-              source: 'user',
-              derive_from: '$system:port',
+              source: 'capability',
+              derive_from: '$capability:dns_internal.dns.knot_port',
             },
           ],
           imports: [],
@@ -716,16 +716,55 @@ describe('applyDeclarativeDerivations', () => {
       const context: ResolutionContext = {
         moduleId: 'test-module',
         selfConfig: {},
-        systemConfig: { port: '8080' },
+        systemConfig: {},
         systemSecrets: {},
         secrets: {},
-        capabilities: {},
+        capabilities: {
+          dns_internal: { dns: { knot_port: 5353 } },
+        },
+      };
+
+      applyDeclarativeDerivations(manifest, context);
+
+      expect(context.selfConfig.port).toBe('5353');
+    });
+
+    test('continues to skip structured derivations', () => {
+      const manifest: ModuleManifest = {
+        celilo_contract: '1.0',
+        id: 'test-module',
+        name: 'Test Module',
+        version: '1.0.0',
+        requires: { capabilities: [] },
+        provides: { capabilities: [] },
+        variables: {
+          owns: [
+            {
+              name: 'domains',
+              type: 'array',
+              required: false,
+              source: 'capability',
+              derive_from: '$capability:dns_internal.dns.managed_domains',
+            },
+          ],
+          imports: [],
+        },
+      };
+
+      const context: ResolutionContext = {
+        moduleId: 'test-module',
+        selfConfig: {},
+        systemConfig: {},
+        systemSecrets: {},
+        secrets: {},
+        capabilities: {
+          dns_internal: { dns: { managed_domains: ['home.arpa'] } },
+        },
       };
 
       applyDeclarativeDerivations(manifest, context);
 
-      // Non-string variable is skipped — port remains unset
-      expect(context.selfConfig.port).toBeUndefined();
+      expect(context.selfConfig.domains).toBeUndefined();
     });
   });
 

package/src/variables/declarative-derivation.ts

@@ -186,10 +186,12 @@ export function applyDeclarativeDerivations(
       continue;
     }
 
-    // Declarative derivation only resolves string template expressions.
-    // Non-string types (arrays, objects) with derive_from are handled by
-    // the config interview system instead.
-    if (variable.type !== 'string') {
+    // Declarative derivation resolves scalar template expressions. Numeric and
+    // boolean values flow through this resolution context as their string form
+    // and recover their declared type at the module-config / inventory boundary.
+    // Structured arrays and objects still belong to the typed config path: a
+    // template substitution would collapse them to a lossy string.
+    if (variable.type === 'array' || variable.type === 'object') {
       continue;
     }
 

package/src/variables/lxc-nameserver.test.ts

@@ -1,6 +1,7 @@
 import { afterEach, beforeEach, describe, expect, test } from 'bun:test';
 import { existsSync } from 'node:fs';
 import { rm } from 'node:fs/promises';
+import { eq } from 'drizzle-orm';
 import { type DbClient, createDbClient } from '../db/client';
 import { capabilities, moduleConfigs, modules, systemConfig } from '../db/schema';
 import { buildResolutionContext } from './context';
@@ -67,6 +68,71 @@ describe('lxc_nameserver composition', () => {
       .run();
   }
 
+  /** Put the consumer in `zone` instead of the default `app`. */
+  function placeConsumerIn(zone: string): void {
+    db.update(modules)
+      .set({ manifestData: { requires: { system: { zone } } } })
+      .where(eq(modules.id, 'consumer'))
+      .run();
+  }
+
+  /**
+   * A dns_internal provider that advertises a zone-routable endpoint AND
+   * declares a base-module aspect, the way `knot-unbound-internal` does. The
+   * aspect's `applicable_zones` is what decides whether a system's ongoing DNS
+   * has an owner at all (design D5d).
+   */
+  function registerManagedPrimary(opts: {
+    ip: string;
+    internalIp?: string;
+    aspectZones: string[];
+  }): void {
+    db.insert(modules)
+      .values({
+        id: 'dns-provider',
+        name: 'dns-provider',
+        version: '1.0.0',
+        manifestData: {},
+        sourcePath: '/tmp/dns',
+      })
+      .run();
+    db.insert(capabilities)
+      .values({
+        moduleId: 'dns-provider',
+        capabilityName: 'dns_internal',
+        version: '1.0.0',
+        data: {
+          server: { ip: opts.ip, internal_ip: opts.internalIp },
+          // The provider DECLARES what its aspect covers, rather than core
+          // finding the module row and reading its manifest. A manifest test
+          // holds this list and `base_module_aspect.applicable_zones` together.
+          aspect: { covered_zones: opts.aspectZones },
+        },
+      })
+      .run();
+  }
+
+  /** The secondary publishes its OWN capability, never a field on the primary's. */
+  function registerSecondary(opts: { ip: string; internalIp?: string }): void {
+    db.insert(modules)
+      .values({
+        id: 'dns-secondary',
+        name: 'dns-secondary',
+        version: '1.0.0',
+        manifestData: {},
+        sourcePath: '/tmp/dns2',
+      })
+      .run();
+    db.insert(capabilities)
+      .values({
+        moduleId: 'dns-secondary',
+        capabilityName: 'dns_internal_secondary',
+        version: '1.0.0',
+        data: { server: { ip: opts.ip, internal_ip: opts.internalIp } },
+      })
+      .run();
+  }
+
   test('internal resolver first (CIDR stripped) + public fallback', async () => {
     registerInternalDns('192.168.0.151/24');
     const ctx = await buildResolutionContext('consumer', db);
@@ -83,4 +149,82 @@ describe('lxc_nameserver composition', () => {
     const ctx = await buildResolutionContext('consumer', db);
     expect(ctx.selfConfig.lxc_nameserver).toBe('10.0.20.30 1.1.1.1 1.0.0.1 8.8.8.8');
   });
+
+  /**
+   * Terraform injects `lifecycle { ignore_changes = [nameserver] }` into every
+   * `proxmox_lxc`, so it cannot correct the birth value afterwards even in
+   * principle. `lxc-dns-at-birth` splits ownership accordingly: terraform owns
+   * birth DNS, the base-module aspect owns ongoing DNS. A zone the aspect does
+   * not cover therefore has NO owner for ongoing DNS — not a late one, none —
+   * and the birth list is that system's permanent configuration.
+   *
+   * That is why dropping the public resolvers is a TIGHTENING in an
+   * aspect-covered zone and an OUTRIGHT BREAK outside one, from the same edit
+   * (design D5d). These assert on the composed CONFIGURATION rather than on a
+   * lookup result, deliberately: a resolution assertion passes whenever the
+   * internal resolver happens to be up, which is nearly always, so it would
+   * flake in the direction that reads as harness noise. The production symptom
+   * is a correct-looking answer from the wrong view, and this string is the
+   * only place that is ever visible.
+   */
+  describe('a managed primary/secondary pair (design D5, D5d, D5e)', () => {
+    /**
+     * Both resolvers are reached the SAME way, and that is a consequence of
+     * placement rather than a convenience. Design D5e puts the secondary in
+     * `dmz` alongside the primary, so from dmz/app/secure both answer at their
+     * own zone addresses, and from `internal` — which cannot route into the dmz
+     * subnet — both answer at an internal-subnet address the firewall DNATs.
+     *
+     * This is worth stating because the symmetry is exactly what a reader
+     * should check rather than assume. Jeremy's version placed the secondary in
+     * `internal` and therefore selected its endpoints the other way round
+     * (native address for internal clients, a dmz ingress for everyone else).
+     * Under that placement this symmetric selection would be WRONG, and these
+     * tests would still pass, because the same premise would be in the test and
+     * in the code. If the secondary ever moves out of `dmz`, this block is what
+     * has to change first.
+     */
+    test('an aspect-covered zone drops the public resolvers', async () => {
+      registerManagedPrimary({ ip: '10.0.10.5', aspectZones: ['dmz', 'app', 'secure'] });
+      registerSecondary({ ip: '10.0.10.6' });
+      const ctx = await buildResolutionContext('consumer', db);
+      expect(ctx.selfConfig.lxc_nameserver).toBe('10.0.10.5 10.0.10.6');
+    });
+
+    test('a zone NO aspect covers keeps them, because nothing will ever rewrite it', async () => {
+      placeConsumerIn('external');
+      registerManagedPrimary({ ip: '10.0.10.5', aspectZones: ['dmz', 'app', 'secure'] });
+      registerSecondary({ ip: '10.0.10.6' });
+      const ctx = await buildResolutionContext('consumer', db);
+      // An `external` VPS sits outside the perimeter with no route to a
+      // dmz-resident resolver. Handing it two unreachable addresses and nothing
+      // else does not tighten anything; it takes DNS away. So the list stays
+      // what it has always been here — the primary, then the public resolvers
+      // that are the only ones it can actually reach. The secondary is not
+      // added either: a second unreachable address costs another timeout.
+      expect(ctx.selfConfig.lxc_nameserver).toBe('10.0.10.5 1.1.1.1 1.0.0.1 8.8.8.8');
+    });
+
+    test('an internal-zone system takes the zone-routable endpoints', async () => {
+      placeConsumerIn('internal');
+      registerManagedPrimary({
+        ip: '10.0.10.5',
+        internalIp: '192.168.0.5',
+        aspectZones: ['dmz', 'app', 'secure', 'internal'],
+      });
+      registerSecondary({ ip: '10.0.10.6', internalIp: '192.168.0.6' });
+      const ctx = await buildResolutionContext('consumer', db);
+      // `internal` cannot route into the dmz subnet, so it uses the ingress
+      // addresses the firewall DNATs — not the resolvers' own zone addresses.
+      expect(ctx.selfConfig.lxc_nameserver).toBe('192.168.0.5 192.168.0.6');
+    });
+
+    test('a primary with no secondary keeps the public fallback', async () => {
+      registerManagedPrimary({ ip: '10.0.10.5', aspectZones: ['dmz', 'app', 'secure'] });
+      const ctx = await buildResolutionContext('consumer', db);
+      // Removing the fallback and shipping a secondary are ONE decision (D5a).
+      // Without a secondary, a resolver redeploy would blank fleet DNS.
+      expect(ctx.selfConfig.lxc_nameserver).toBe('10.0.10.5 1.1.1.1 1.0.0.1 8.8.8.8');
+    });
+  });
 });

package/src/services/public-web-republish.test.ts

@@ -1,189 +0,0 @@
-import { afterEach, beforeEach, describe, expect, test } from 'bun:test';
-import { mkdtempSync, rmSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import type { DbClient } from '../db/client';
-import { modules, webRoutes } from '../db/schema';
-import type { ModuleManifest } from '../manifest/schema';
-import { setupTestDatabase } from '../test-utils/setup-test-db';
-import { providesPublicWeb, republishStaticWebConsumers } from './public-web-republish';
-
-const caddyManifest = {
-  provides: { capabilities: [{ name: 'public_web', version: '3.0.0' }] },
-} as unknown as ModuleManifest;
-
-const plainManifest = { provides: { capabilities: [] } } as unknown as ModuleManifest;
-
-describe('republishStaticWebConsumers', () => {
-  let dir: string;
-  let db: DbClient;
-
-  function seedModule(id: string) {
-    db.insert(modules)
-      .values({ id, name: id, version: '1.0.0', manifestData: {}, sourcePath: `/tmp/${id}` })
-      .run();
-  }
-
-  function seedRoute(
-    moduleId: string,
-    slug: string,
-    path: string,
-    type: 'static' | 'reverse_proxy',
-  ) {
-    db.insert(webRoutes)
-      .values({
-        slug,
-        moduleId,
-        type,
-        path,
-        hostname: 'iamtheinternet.org',
-        targetHost: type === 'reverse_proxy' ? '10.0.20.5' : null,
-        targetPort: type === 'reverse_proxy' ? 8080 : null,
-      })
-      .run();
-  }
-
-  function recordingHook(failFor: string[] = []) {
-    const calls: string[] = [];
-    const runHook = (async (moduleId: string) => {
-      calls.push(moduleId);
-      return failFor.includes(moduleId)
-        ? { success: false, outputs: {}, error: 'boom', duration: 1 }
-        : { success: true, outputs: {}, duration: 1 };
-    }) as unknown as Parameters<typeof republishStaticWebConsumers>[0]['runHook'];
-    return { runHook, calls };
-  }
-
-  beforeEach(async () => {
-    dir = mkdtempSync(join(tmpdir(), 'pwr-'));
-    const dbPath = join(dir, 'celilo.db');
-    process.env.CELILO_DB_PATH = dbPath;
-    db = await setupTestDatabase(dbPath);
-  });
-
-  afterEach(() => {
-    db.$client.close();
-    process.env.CELILO_DB_PATH = undefined;
-    try {
-      rmSync(dir, { recursive: true, force: true });
-    } catch {
-      /* ignore */
-    }
-  });
-
-  test('providesPublicWeb reads the manifest', () => {
-    expect(providesPublicWeb(caddyManifest)).toBe(true);
-    expect(providesPublicWeb(plainManifest)).toBe(false);
-  });
-
-  test('does not run for a module that is not a public_web provider', async () => {
-    seedModule('hello-foo');
-    seedRoute('hello-foo', 'foo', '/foo', 'static');
-    const { runHook, calls } = recordingHook();
-
-    const result = await republishStaticWebConsumers({
-      providerModuleId: 'namecheap',
-      manifest: plainManifest,
-      db,
-      runHook,
-    });
-
-    expect(result).toEqual({ ran: false, republished: [], failures: [] });
-    expect(calls).toEqual([]);
-  });
-
-  test('re-runs on_install for every static consumer', async () => {
-    seedModule('caddy');
-    seedModule('hello-foo');
-    seedModule('hello-bar');
-    seedModule('celilo-website');
-    seedRoute('hello-foo', 'foo', '/foo', 'static');
-    seedRoute('hello-bar', 'bar', '/bar', 'static');
-    seedRoute('celilo-website', 'celilo-website', '/', 'static');
-    const { runHook, calls } = recordingHook();
-
-    const result = await republishStaticWebConsumers({
-      providerModuleId: 'caddy',
-      manifest: caddyManifest,
-      db,
-      runHook,
-    });
-
-    expect(result.ran).toBe(true);
-    expect(calls.sort()).toEqual(['celilo-website', 'hello-bar', 'hello-foo']);
-    expect(result.republished.sort()).toEqual(['celilo-website', 'hello-bar', 'hello-foo']);
-    expect(result.failures).toEqual([]);
-  });
-
-  test('skips reverse-proxy-only consumers (no assets on the provider host)', async () => {
-    seedModule('caddy');
-    seedModule('forgejo');
-    seedModule('hello-foo');
-    seedRoute('forgejo', 'git', '/git', 'reverse_proxy');
-    seedRoute('hello-foo', 'foo', '/foo', 'static');
-    const { runHook, calls } = recordingHook();
-
-    await republishStaticWebConsumers({
-      providerModuleId: 'caddy',
-      manifest: caddyManifest,
-      db,
-      runHook,
-    });
-
-    expect(calls).toEqual(['hello-foo']);
-  });
-
-  test('never re-runs the provider itself', async () => {
-    seedModule('caddy');
-    // A provider that also owns a static route (a landing page of its own).
-    seedRoute('caddy', 'caddy', '/', 'static');
-    const { runHook, calls } = recordingHook();
-
-    const result = await republishStaticWebConsumers({
-      providerModuleId: 'caddy',
-      manifest: caddyManifest,
-      db,
-      runHook,
-    });
-
-    expect(calls).toEqual([]);
-    expect(result.republished).toEqual([]);
-  });
-
-  test('de-duplicates a consumer that owns several static routes', async () => {
-    seedModule('caddy');
-    seedModule('hello-foo');
-    seedRoute('hello-foo', 'foo', '/foo', 'static');
-    seedRoute('hello-foo', 'foo-docs', '/foo/docs', 'static');
-    const { runHook, calls } = recordingHook();
-
-    await republishStaticWebConsumers({
-      providerModuleId: 'caddy',
-      manifest: caddyManifest,
-      db,
-      runHook,
-    });
-
-    expect(calls).toEqual(['hello-foo']);
-  });
-
-  test('one consumer failing does not stop the others', async () => {
-    seedModule('caddy');
-    seedModule('hello-foo');
-    seedModule('hello-bar');
-    seedRoute('hello-foo', 'foo', '/foo', 'static');
-    seedRoute('hello-bar', 'bar', '/bar', 'static');
-    const { runHook, calls } = recordingHook(['hello-foo']);
-
-    const result = await republishStaticWebConsumers({
-      providerModuleId: 'caddy',
-      manifest: caddyManifest,
-      db,
-      runHook,
-    });
-
-    expect(calls.sort()).toEqual(['hello-bar', 'hello-foo']);
-    expect(result.republished).toEqual(['hello-bar']);
-    expect(result.failures).toEqual([{ moduleId: 'hello-foo', error: 'boom' }]);
-  });
-});

package/src/services/public-web-republish.ts

@@ -1,84 +0,0 @@
-/**
- * Restore consumer content after a public_web provider redeploy.
- *
- * A provider redeploy destroys the provider's host and rebuilds it, taking
- * `/srv/www` with it. The consumers' `web_routes` rows survive — they belong to
- * the consumer modules, not the provider — so the rebuilt provider renders
- * `root * /srv/www/<slug>` for directories that no longer exist and every
- * static site 404s. Nothing re-uploaded the assets; an operator had to redeploy
- * each consumer by hand and there was no signal telling them to.
- *
- * The fix is to do exactly what that operator did: after a provider deploy
- * lands, re-run `on_install` for every module holding a STATIC route.
- * `publishStaticSite` is idempotent (it upserts the route and re-tars the
- * source dir), so the re-run re-registers the route and refills the fresh
- * `/srv/www/<slug>`.
- *
- * Reverse-proxy consumers are skipped: they keep no state on the provider host,
- * so re-running them buys nothing and only widens the blast radius.
- *
- * ponytail: re-runs every static consumer unconditionally rather than probing
- * which /srv/www/<slug> directories are actually missing — O(static consumers)
- * per provider deploy, currently a handful. If a large fleet makes provider
- * deploys slow, probe the provider host first and re-run only the misses.
- */
-
-import { eq } from 'drizzle-orm';
-import type { DbClient } from '../db/client';
-import { webRoutes } from '../db/schema';
-import { createConsoleLogger } from '../hooks/logger';
-import { runNamedHook } from '../hooks/run-named-hook';
-import type { ModuleManifest } from '../manifest/schema';
-
-export interface RepublishFailure {
-  moduleId: string;
-  error: string;
-}
-
-export interface RepublishResult {
-  /** False when the deployed module isn't a public_web provider. */
-  ran: boolean;
-  /** Consumer modules whose on_install was re-run successfully. */
-  republished: string[];
-  failures: RepublishFailure[];
-}
-
-export function providesPublicWeb(manifest: ModuleManifest): boolean {
-  return (manifest.provides?.capabilities ?? []).some((c) => c.name === 'public_web');
-}
-
-export interface RepublishDeps {
-  providerModuleId: string;
-  manifest: ModuleManifest;
-  db: DbClient;
-  /** Injectable for tests. */
-  runHook?: typeof runNamedHook;
-}
-
-export async function republishStaticWebConsumers(deps: RepublishDeps): Promise<RepublishResult> {
-  const { providerModuleId, manifest, db, runHook = runNamedHook } = deps;
-
-  if (!providesPublicWeb(manifest)) {
-    return { ran: false, republished: [], failures: [] };
-  }
-
-  const staticRoutes = db.select().from(webRoutes).where(eq(webRoutes.type, 'static')).all();
-  const consumerIds = [
-    ...new Set(staticRoutes.map((r) => r.moduleId).filter((id) => id !== providerModuleId)),
-  ];
-
-  const republished: string[] = [];
-  const failures: RepublishFailure[] = [];
-
-  for (const moduleId of consumerIds) {
-    const logger = createConsoleLogger(moduleId, 'on_install');
-    const result = await runHook(moduleId, 'on_install', db, logger, {});
-    if (result.success) {
-      republished.push(moduleId);
-    } else {
-      failures.push({ moduleId, error: result.error ?? 'unknown error' });
-    }
-  }
-
-  return { ran: true, republished, failures };
-}