@celilo/cli 1.8.0 → 1.9.0

package/src/policy/module-business-baseline.ts

@@ -87,6 +87,42 @@ export interface ProviderLiteralRow {
 }
 
 export const CAPABILITY_NAME_BASELINE: readonly CapabilityNameRow[] = [
+  {
+    file: 'apps/celilo/src/hooks/capability-loader.ts',
+    capability: 'web_routes',
+    count: 2,
+    why: 'PERMANENT — a provider VIEW, not a module-provided capability. The name was registered so it stops being invisible to audits (celilo#1007); these references predate that and are framework plumbing, not core branching on a provider',
+  },
+  {
+    file: 'apps/celilo/src/hooks/capability-loader.ts',
+    capability: 'firewall_registry',
+    count: 4,
+    why: 'PERMANENT — a provider VIEW, not a module-provided capability. The name was registered so it stops being invisible to audits (celilo#1007); these references predate that and are framework plumbing, not core branching on a provider',
+  },
+  {
+    file: 'apps/celilo/src/db/schema.ts',
+    capability: 'web_routes',
+    count: 1,
+    why: 'PERMANENT — the TABLE named web_routes, which predates the capability name entirely; the collision is nominal',
+  },
+  {
+    file: 'packages/capabilities/src/public-web.ts',
+    capability: 'web_routes',
+    count: 1,
+    why: 'PERMANENT — the public_web implementation naming its own table; the capability package doing its job',
+  },
+  {
+    file: 'packages/capabilities/src/capability-contract.ts',
+    capability: 'web_routes',
+    count: 1,
+    why: 'PERMANENT — a contract declaration with no implementation; this is the package doing its job',
+  },
+  {
+    file: 'packages/capabilities/src/capability-contract.ts',
+    capability: 'firewall_registry',
+    count: 1,
+    why: 'PERMANENT — a contract declaration with no implementation; this is the package doing its job',
+  },
   {
     file: 'apps/celilo/src/capabilities/well-known.ts',
     capability: 'dhcp_server',

package/src/services/alerting/ack.test.ts

@@ -4,7 +4,7 @@ import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import type { DbClient } from '../../db/client';
 import { type Route, alerts, modules, monitors } from '../../db/schema';
-import { setupTestDatabase } from '../../test-utils/setup-test-db';
+import { setupTestDatabaseAt } from '../../test-utils/database';
 import { acknowledgeAlert, findLiveAlertByKey, resolveAlertManually, silenceAlert } from './ack';
 import { moduleCheckAlertKey } from './keys';
 import { createPerson, createRoute } from './people';
@@ -26,7 +26,7 @@ describe('ack / silence / resolve', () => {
     dir = mkdtempSync(join(tmpdir(), 'ack-'));
     const dbPath = join(dir, 'celilo.db');
     process.env.CELILO_DB_PATH = dbPath;
-    db = await setupTestDatabase(dbPath);
+    db = await setupTestDatabaseAt(dbPath);
 
     db.insert(modules)
       .values({

package/src/services/alerting/deferral.test.ts

@@ -5,7 +5,7 @@ import { join } from 'node:path';
 import { eq } from 'drizzle-orm';
 import type { DbClient } from '../../db/client';
 import { type Alert, type Route, alerts, modules, monitors } from '../../db/schema';
-import { setupTestDatabase } from '../../test-utils/setup-test-db';
+import { setupTestDatabaseAt } from '../../test-utils/database';
 import { moduleCheckAlertKey } from './keys';
 import { deliverDeferred } from './notifier';
 import { createPerson, createRoute } from './people';
@@ -35,7 +35,7 @@ describe('quiet-hours deferral', () => {
     dir = mkdtempSync(join(tmpdir(), 'deferral-'));
     const dbPath = join(dir, 'celilo.db');
     process.env.CELILO_DB_PATH = dbPath;
-    db = await setupTestDatabase(dbPath);
+    db = await setupTestDatabaseAt(dbPath);
     sent.length = 0;
 
     db.insert(modules)

package/src/services/alerting/delivery-loop.test.ts

@@ -20,7 +20,7 @@ import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import type { DbClient } from '../../db/client';
 import { type Alert, type Route, modules } from '../../db/schema';
-import { setupTestDatabase } from '../../test-utils/setup-test-db';
+import { setupTestDatabaseAt } from '../../test-utils/database';
 import type { EscalationStep, RouteForEscalation } from './escalation';
 import { interpretInbound } from './inbound';
 import {
@@ -217,7 +217,7 @@ describe('delivery loop against the signal-cli simulator', () => {
     dir = mkdtempSync(join(tmpdir(), 'delivery-'));
     const dbPath = join(dir, 'celilo.db');
     process.env.CELILO_DB_PATH = dbPath;
-    db = await setupTestDatabase(dbPath);
+    db = await setupTestDatabaseAt(dbPath);
     await control('reset');
 
     db.insert(modules)

package/src/services/alerting/deploy-hooks.test.ts

@@ -4,7 +4,7 @@ import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import type { DbClient } from '../../db/client';
 import { modules, monitors } from '../../db/schema';
-import { setupTestDatabase } from '../../test-utils/setup-test-db';
+import { setupTestDatabaseAt } from '../../test-utils/database';
 import {
   closeDeployWindows,
   ensureMonitorOnDeploy,
@@ -29,7 +29,7 @@ describe('deploy hooks', () => {
     dir = mkdtempSync(join(tmpdir(), 'deploy-hooks-'));
     const dbPath = join(dir, 'celilo.db');
     process.env.CELILO_DB_PATH = dbPath;
-    db = await setupTestDatabase(dbPath);
+    db = await setupTestDatabaseAt(dbPath);
   });
 
   afterEach(() => {

package/src/services/alerting/inbound-poller.test.ts

@@ -6,7 +6,7 @@ import type { InboundMessage } from '@celilo/capabilities';
 import { eq } from 'drizzle-orm';
 import type { DbClient } from '../../db/client';
 import { type Route, alerts, modules, monitors, notificationDeliveries } from '../../db/schema';
-import { setupTestDatabase } from '../../test-utils/setup-test-db';
+import { setupTestDatabaseAt } from '../../test-utils/database';
 import {
   type InboundPollDeps,
   type TransportReadRecord,
@@ -53,7 +53,7 @@ describe('pollInbound', () => {
     dir = mkdtempSync(join(tmpdir(), 'inbound-poll-'));
     const dbPath = join(dir, 'celilo.db');
     process.env.CELILO_DB_PATH = dbPath;
-    db = await setupTestDatabase(dbPath);
+    db = await setupTestDatabaseAt(dbPath);
     cursors.clear();
 
     db.insert(modules)

package/src/services/alerting/inbound.test.ts

@@ -4,7 +4,7 @@ import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import type { DbClient } from '../../db/client';
 import { type NotificationDelivery, modules, people, routes } from '../../db/schema';
-import { setupTestDatabase } from '../../test-utils/setup-test-db';
+import { setupTestDatabaseAt } from '../../test-utils/database';
 import { interpretInbound, parseInbound } from './inbound';
 import { mintDelivery } from './tokens';
 
@@ -83,7 +83,7 @@ describe('interpretInbound', () => {
     dir = mkdtempSync(join(tmpdir(), 'inbound-'));
     const dbPath = join(dir, 'celilo.db');
     process.env.CELILO_DB_PATH = dbPath;
-    db = await setupTestDatabase(dbPath);
+    db = await setupTestDatabaseAt(dbPath);
     outstanding.length = 0;
 
     db.insert(modules)

package/src/services/alerting/notification-responder.test.ts

@@ -5,7 +5,7 @@ import { join } from 'node:path';
 import { defineEvents, openBus } from '@celilo/event-bus';
 import type { DbClient } from '../../db/client';
 import { type Route, modules } from '../../db/schema';
-import { setupTestDatabase } from '../../test-utils/setup-test-db';
+import { setupTestDatabaseAt } from '../../test-utils/database';
 import {
   type NotificationResponderHandle,
   startNotificationResponder,
@@ -60,7 +60,7 @@ describe('notification responder', () => {
     const dbPath = join(dir, 'celilo.db');
     busPath = join(dir, 'events.db');
     process.env.CELILO_DB_PATH = dbPath;
-    db = await setupTestDatabase(dbPath);
+    db = await setupTestDatabaseAt(dbPath);
     sent = [];
     declined = [];
     sendFailures = [];

package/src/services/alerting/run-monitor.test.ts

@@ -5,7 +5,7 @@ import { join } from 'node:path';
 import { eq } from 'drizzle-orm';
 import type { DbClient } from '../../db/client';
 import { type Monitor, alerts, monitorRuns, monitors } from '../../db/schema';
-import { setupTestDatabase } from '../../test-utils/setup-test-db';
+import { setupTestDatabaseAt } from '../../test-utils/database';
 import type { HealthCheckResult } from '../health-runner';
 import { moduleAlertKey, moduleCheckAlertKey } from './keys';
 import { type MonitorRunDeps, runOneMonitor } from './run-monitor';
@@ -54,7 +54,7 @@ describe('runOneMonitor', () => {
     dir = mkdtempSync(join(tmpdir(), 'run-monitor-'));
     const dbPath = join(dir, 'celilo.db');
     process.env.CELILO_DB_PATH = dbPath;
-    db = await setupTestDatabase(dbPath);
+    db = await setupTestDatabaseAt(dbPath);
     db.insert(monitors)
       .values({
         id: 'mon-1',

package/src/services/alerting/store.test.ts

@@ -5,7 +5,7 @@ import { join } from 'node:path';
 import { eq } from 'drizzle-orm';
 import type { DbClient } from '../../db/client';
 import { alerts, monitors } from '../../db/schema';
-import { setupTestDatabase } from '../../test-utils/setup-test-db';
+import { setupTestDatabaseAt } from '../../test-utils/database';
 import { moduleAlertKey, moduleCheckAlertKey } from './keys';
 import type { ReconcileAction } from './reconcile';
 import {
@@ -41,7 +41,7 @@ describe('alert store', () => {
     dir = mkdtempSync(join(tmpdir(), 'alert-store-'));
     const dbPath = join(dir, 'celilo.db');
     process.env.CELILO_DB_PATH = dbPath;
-    db = await setupTestDatabase(dbPath);
+    db = await setupTestDatabaseAt(dbPath);
     db.insert(monitors)
       .values({
         id: MONITOR,

package/src/services/alerting/sweep-runner.test.ts

@@ -5,7 +5,7 @@ import { join } from 'node:path';
 import { eq } from 'drizzle-orm';
 import type { DbClient } from '../../db/client';
 import { type Alert, type Monitor, alerts, modules, monitors } from '../../db/schema';
-import { setupTestDatabase } from '../../test-utils/setup-test-db';
+import { setupTestDatabaseAt } from '../../test-utils/database';
 import type { HealthCheckResult } from '../health-runner';
 import { deleteModuleConfig, upsertModuleConfig } from '../module-config';
 import { HEALTH_CHECK_INTERVAL_CONFIG_KEY, reconcileModuleWatchState } from './health-cadence';
@@ -68,7 +68,7 @@ describe('runSweep', () => {
     dir = mkdtempSync(join(tmpdir(), 'sweep-'));
     const dbPath = join(dir, 'celilo.db');
     process.env.CELILO_DB_PATH = dbPath;
-    db = await setupTestDatabase(dbPath);
+    db = await setupTestDatabaseAt(dbPath);
     // The module row is load-bearing now: a `module_hook` monitor's cadence
     // resolves from the module's manifest and config, not from its own row.
     db.insert(modules)

package/src/services/alerting/tokens.test.ts

@@ -4,7 +4,7 @@ import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import type { DbClient } from '../../db/client';
 import { modules, people, routes } from '../../db/schema';
-import { setupTestDatabase } from '../../test-utils/setup-test-db';
+import { setupTestDatabaseAt } from '../../test-utils/database';
 import {
   consumeDelivery,
   deliveriesForAlert,
@@ -56,7 +56,7 @@ describe('delivery records', () => {
     dir = mkdtempSync(join(tmpdir(), 'tokens-'));
     const dbPath = join(dir, 'celilo.db');
     process.env.CELILO_DB_PATH = dbPath;
-    db = await setupTestDatabase(dbPath);
+    db = await setupTestDatabaseAt(dbPath);
 
     db.insert(modules)
       .values({

package/src/services/capability-bindings.test.ts

@@ -0,0 +1,104 @@
+import { beforeEach, describe, expect, test } from 'bun:test';
+import type { DbClient } from '../db/client';
+import { cleanupTestDatabase, setupTestDatabase } from '../test-utils/database';
+import {
+  listCapabilityBindings,
+  recordCapabilityBinding,
+  withBindingRecord,
+} from './capability-bindings';
+
+describe('withBindingRecord', () => {
+  test('reports once however many times the consumer calls', () => {
+    let calls = 0;
+    const iface = withBindingRecord({ a: () => 1, b: () => 2 }, () => {
+      calls++;
+    });
+
+    iface.a();
+    iface.a();
+    iface.b();
+
+    expect(calls).toBe(1);
+  });
+
+  test('reports nothing when no method is called', () => {
+    let calls = 0;
+    withBindingRecord({ publishStaticSite: () => 1 }, () => {
+      calls++;
+    });
+
+    expect(calls).toBe(0);
+  });
+
+  test('passes arguments and the return value through untouched', () => {
+    const iface = withBindingRecord({ add: (a: number, b: number) => a + b }, () => {});
+    expect(iface.add(2, 3)).toBe(5);
+  });
+
+  test('leaves a synchronous method synchronous', () => {
+    // Unlike `wrapWithLogging`, which awaits and therefore makes every method
+    // async. A capability's calling convention must not change because celilo
+    // decided to watch it.
+    const iface = withBindingRecord({ now: () => 'value' }, () => {});
+    expect(iface.now()).toBe('value');
+  });
+
+  test('passes non-function properties through, including the provider stamp', () => {
+    const iface = withBindingRecord({ providerModuleId: 'caddy', go: () => 1 }, () => {});
+    expect(iface.providerModuleId).toBe('caddy');
+  });
+});
+
+describe('recordCapabilityBinding', () => {
+  let db: DbClient;
+
+  beforeEach(async () => {
+    if (db) await cleanupTestDatabase(db);
+    db = await setupTestDatabase();
+    db.$client.run(
+      `INSERT INTO modules (id, name, version, source_path, manifest_data) VALUES ('consumer', 'consumer', '1.0.0', '/tmp/consumer', '{}')`,
+    );
+  });
+
+  test('re-asserting the same binding keeps one row', () => {
+    recordCapabilityBinding(db, 'consumer', 'external_web', 'cpanel-host');
+    recordCapabilityBinding(db, 'consumer', 'external_web', 'cpanel-host');
+
+    expect(listCapabilityBindings(db, 'consumer')).toHaveLength(1);
+  });
+
+  test('a provider swap rewrites the row in place', () => {
+    recordCapabilityBinding(db, 'consumer', 'public_web', 'caddy');
+    recordCapabilityBinding(db, 'consumer', 'public_web', 'caddy-internal');
+
+    const bindings = listCapabilityBindings(db, 'consumer');
+    expect(bindings).toHaveLength(1);
+    expect(bindings[0].providerModuleId).toBe('caddy-internal');
+  });
+
+  test('boundAt is last-seen, not first-seen', () => {
+    // A binding last exercised forty deploys ago has to be a queryable fact
+    // rather than a silent lie, so the timestamp moves on every invocation.
+    recordCapabilityBinding(db, 'consumer', 'idp', 'authentik');
+    db.$client.run(
+      `UPDATE capability_bindings SET bound_at = 1000 WHERE consumer_module_id = 'consumer'`,
+    );
+
+    recordCapabilityBinding(db, 'consumer', 'idp', 'authentik');
+
+    expect(listCapabilityBindings(db, 'consumer')[0].boundAt.getTime()).toBeGreaterThan(
+      1000 * 1000,
+    );
+  });
+
+  test('bindings are scoped to the consumer that made them', () => {
+    db.$client.run(
+      `INSERT INTO modules (id, name, version, source_path, manifest_data) VALUES ('other', 'other', '1.0.0', '/tmp/other', '{}')`,
+    );
+    recordCapabilityBinding(db, 'consumer', 'source_forge', 'forgejo');
+    recordCapabilityBinding(db, 'other', 'source_forge', 'forgejo');
+
+    expect(listCapabilityBindings(db, 'consumer')).toHaveLength(1);
+    expect(listCapabilityBindings(db, 'other')).toHaveLength(1);
+  });
+});

package/src/services/capability-bindings.ts

@@ -0,0 +1,107 @@
+/**
+ * Which provider a consumer actually resolved to (celilo#1072).
+ *
+ * `capabilities` is provider-side only, so celilo could answer "who could
+ * provide this" and never "who does this module actually use". Callers that
+ * needed the second question rebuilt the same approximation — the consumer's
+ * `requires` + `optional` crossed with `capabilities` — which names every
+ * provider a module MIGHT have bound to. `tango-nexus` declares four optional
+ * capabilities and is deployed against one host, so that approximation carries
+ * three edges that do not exist and nothing distinguishes them.
+ *
+ * The binding is the CALL, not the resolution. `loadCapabilityFunctions`
+ * injects every capability that has a registered provider, deliberately, and
+ * never reads the consumer's manifest — so what it resolves is a superset of
+ * even the permissive set. A consumer's hook invoking a method is the one event
+ * that separates the optional it uses from the three it does not.
+ *
+ * This runs BESIDE the permissive set, it does not replace it.
+ * `planConsumerCleanup` must still notify every provider that might hold minted
+ * state, including providers this table has no row for.
+ */
+
+import { desc, eq, sql } from 'drizzle-orm';
+import type { DbClient } from '../db/client';
+import { capabilityBindings } from '../db/schema';
+
+export interface CapabilityBinding {
+  capabilityName: string;
+  providerModuleId: string;
+  /** Last time the consumer called into this provider. */
+  boundAt: Date;
+}
+
+/**
+ * Record that `consumer` called into `provider` for `capability`.
+ *
+ * Upsert on (consumer, capability): a redeploy re-asserts the row rather than
+ * duplicating it, and a provider swap rewrites the provider in place. `boundAt`
+ * carries last-seen semantics — it moves on every invocation, so a binding last
+ * exercised forty deploys ago is a queryable fact rather than a silent lie.
+ */
+export function recordCapabilityBinding(
+  db: DbClient,
+  consumerModuleId: string,
+  capabilityName: string,
+  providerModuleId: string,
+): void {
+  db.insert(capabilityBindings)
+    .values({ consumerModuleId, capabilityName, providerModuleId })
+    .onConflictDoUpdate({
+      target: [capabilityBindings.consumerModuleId, capabilityBindings.capabilityName],
+      set: { providerModuleId, boundAt: sql`(unixepoch())` },
+    })
+    .run();
+}
+
+/** Every provider this consumer has actually called into, most recent first. */
+export function listCapabilityBindings(
+  db: DbClient,
+  consumerModuleId: string,
+): CapabilityBinding[] {
+  return db
+    .select()
+    .from(capabilityBindings)
+    .where(eq(capabilityBindings.consumerModuleId, consumerModuleId))
+    .orderBy(desc(capabilityBindings.boundAt))
+    .all()
+    .map((row) => ({
+      capabilityName: row.capabilityName,
+      providerModuleId: row.providerModuleId,
+      boundAt: row.boundAt,
+    }));
+}
+
+/**
+ * Wrap a capability interface so the first method call reports the binding.
+ *
+ * Modelled on `wrapWithLogging`: a new object over the same prototype, every
+ * function replaced, everything else passed through. Unlike that wrapper this
+ * one does NOT make the method async — it records and then returns the original
+ * call untouched, so a synchronous capability method stays synchronous.
+ *
+ * `onUse` fires once per wrapped interface. A hook that calls a capability
+ * twenty times writes one row.
+ */
+export function withBindingRecord<T extends object>(iface: T, onUse: () => void): T {
+  let reported = false;
+  const wrapped = Object.create(Object.getPrototypeOf(iface));
+
+  for (const key of Reflect.ownKeys(iface)) {
+    const value = (iface as Record<string | symbol, unknown>)[key];
+    if (typeof value !== 'function') {
+      wrapped[key] = value;
+      continue;
+    }
+    const original = value as (...args: unknown[]) => unknown;
+    wrapped[key] = function (this: unknown, ...args: unknown[]): unknown {
+      if (!reported) {
+        reported = true;
+        onUse();
+      }
+      return original.apply(this, args);
+    };
+  }
+
+  return wrapped as T;
+}

package/src/services/capability-table-rows.test.ts

@@ -19,7 +19,7 @@ import { join } from 'node:path';
 import { allDeclaredTables } from '@celilo/capabilities';
 import type { DbClient } from '../db/client';
 import { dnsInternalRecords, modules, portForwards, trustedSources, webRoutes } from '../db/schema';
-import { setupTestDatabase } from '../test-utils/setup-test-db';
+import { setupTestDatabaseAt } from '../test-utils/database';
 import { deleteClaimedRows, planClaimedRowDeletion } from './capability-table-rows';
 
 const FW = '192.168.0.254';
@@ -56,7 +56,7 @@ describe('deleteClaimedRows', () => {
     dir = mkdtempSync(join(tmpdir(), 'claimed-'));
     const dbPath = join(dir, 'celilo.db');
     process.env.CELILO_DB_PATH = dbPath;
-    db = await setupTestDatabase(dbPath);
+    db = await setupTestDatabaseAt(dbPath);
 
     for (const id of ['caddy', 'forgejo', 'technitium']) {
       db.insert(modules)

package/src/services/consumer-cleanup.test.ts

@@ -4,7 +4,7 @@ import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import type { DbClient } from '../db/client';
 import type { ModuleManifest } from '../manifest/schema';
-import { setupTestDatabase } from '../test-utils/setup-test-db';
+import { setupTestDatabaseAt } from '../test-utils/database';
 import {
   type CleanupTarget,
   type ProviderRow,
@@ -167,6 +167,43 @@ describe('planConsumerCleanup', () => {
   });
 });
 
+describe('planConsumerCleanup stays permissive after celilo#1072', () => {
+  it('notifies a provider the consumer has no recorded binding to', () => {
+    // celilo#1072 added `capability_bindings`, which records the provider a
+    // consumer actually CALLED. That set is precise and it is deliberately not
+    // this one. Cleanup must reach every provider that MIGHT hold minted state,
+    // including one a hook resolved, minted against, and never called again —
+    // and including one whose binding row was never written because the state
+    // was minted by an older celilo. Narrowing this to the recorded set would
+    // leave a site block in caddy or a DNAT rule in a ruleset with nothing left
+    // in the registry to reconcile it away, which is the exact failure
+    // `consumer-cleanup.ts` exists to prevent.
+    //
+    // The inputs here are manifest + provider rows and NOTHING ELSE. That is
+    // the assertion: no binding table is consulted, so no binding table can
+    // shrink the result.
+    const plan = planConsumerCleanup(
+      'tango-nexus',
+      manifest({ optional: ['external_web', 'public_web', 'source_forge', 'registry_publish'] }),
+      provides(
+        ['cpanel-host', 'external_web'],
+        ['caddy', 'public_web'],
+        ['forgejo', 'source_forge'],
+        ['celilo-registry', 'registry_publish'],
+      ),
+      deployed('cpanel-host', 'caddy', 'forgejo', 'celilo-registry'),
+    );
+
+    expect(plan.map((t) => t.providerId)).toEqual([
+      'caddy',
+      'celilo-registry',
+      'cpanel-host',
+      'forgejo',
+    ]);
+    expect(plan.every((t) => t.skip === undefined)).toBe(true);
+  });
+});
+
 describe('runConsumerCleanup — the paused skip is reported, not silent', () => {
   let dir: string;
   let db: DbClient;
@@ -175,7 +212,7 @@ describe('runConsumerCleanup — the paused skip is reported, not silent', () =>
     dir = mkdtempSync(join(tmpdir(), 'cc-'));
     const dbPath = join(dir, 'celilo.db');
     process.env.CELILO_DB_PATH = dbPath;
-    db = await setupTestDatabase(dbPath);
+    db = await setupTestDatabaseAt(dbPath);
   });
   afterEach(() => {
     db.$client.close();
@@ -244,7 +281,7 @@ describe('runConsumerCleanup — dispatch', () => {
     dir = mkdtempSync(join(tmpdir(), 'ccd-'));
     const dbPath = join(dir, 'celilo.db');
     process.env.CELILO_DB_PATH = dbPath;
-    db = await setupTestDatabase(dbPath);
+    db = await setupTestDatabaseAt(dbPath);
   });
   afterEach(() => {
     db.$client.close();

package/src/services/dns-internal-records.test.ts

@@ -7,7 +7,7 @@ import type { ViewOverride } from '@celilo/capabilities';
 import { eq } from 'drizzle-orm';
 import type { DbClient } from '../db/client';
 import { dnsInternalRecords, modules } from '../db/schema';
-import { setupTestDatabase } from '../test-utils/setup-test-db';
+import { setupTestDatabaseAt } from '../test-utils/database';
 import {
   listDnsInternalRecords,
   listViewOverrides,
@@ -25,7 +25,7 @@ describe('dns-internal-records ledger', () => {
     dir = mkdtempSync(join(tmpdir(), 'dns-int-'));
     dbPath = join(dir, 'celilo.db');
     process.env.CELILO_DB_PATH = dbPath;
-    db = await setupTestDatabase(dbPath);
+    db = await setupTestDatabaseAt(dbPath);
     // FK targets: provider + consumer modules.
     for (const id of ['technitium', 'forgejo']) {
       db.insert(modules)
@@ -222,7 +222,7 @@ describe('provider cascade (celilo#1010)', () => {
     dir = mkdtempSync(join(tmpdir(), 'dns-cascade-'));
     const dbPath = join(dir, 'celilo.db');
     process.env.CELILO_DB_PATH = dbPath;
-    db = await setupTestDatabase(dbPath);
+    db = await setupTestDatabaseAt(dbPath);
     for (const id of ['technitium', 'knot-unbound-internal', 'caddy']) {
       db.insert(modules)
         .values({

package/src/services/fleet-checks.test.ts

@@ -13,7 +13,7 @@ import {
   systemConfig,
 } from '../db/schema';
 import type { ModuleManifest } from '../manifest/schema';
-import { setupTestDatabase } from '../test-utils/setup-test-db';
+import { setupTestDatabaseAt } from '../test-utils/database';
 import { ensureInboundSubscriber, ensureSweepSubscriber } from './alerting/monitors';
 import { ensureBackupSweepSubscriber } from './backup-sweep';
 import { getDaemonUnitPath } from './events-daemon';
@@ -263,7 +263,7 @@ describe('checkSubscribers + checkCapabilityProviders', () => {
     busPath = join(dir, 'events.db');
     process.env.CELILO_DB_PATH = dbPath;
     process.env.EVENT_BUS_DB = busPath;
-    db = await setupTestDatabase(dbPath);
+    db = await setupTestDatabaseAt(dbPath);
     bus = openBus({ dbPath: busPath, events: defineEvents({}) });
   });
   afterEach(() => {
@@ -737,7 +737,7 @@ describe('checkControlPlaneNetwork', () => {
 
   beforeEach(async () => {
     cpDir = mkdtempSync(join(tmpdir(), 'fleet-cpn-'));
-    db = await setupTestDatabase(join(cpDir, 'celilo.db'));
+    db = await setupTestDatabaseAt(join(cpDir, 'celilo.db'));
   });
 
   afterEach(() => {
@@ -971,7 +971,7 @@ describe('runFleetChecks includes host liveness (#728)', () => {
     dir = mkdtempSync(join(tmpdir(), 'fleet-liveness-'));
     process.env.CELILO_DB_PATH = join(dir, 'celilo.db');
     process.env.EVENT_BUS_DB = join(dir, 'events.db');
-    db = await setupTestDatabase(join(dir, 'celilo.db'));
+    db = await setupTestDatabaseAt(join(dir, 'celilo.db'));
     bus = openBus({ dbPath: join(dir, 'events.db'), events: defineEvents({}) });
   });