@celilo/cli 2.2.0 → 2.2.1

package/src/services/dns-provider-backfill.test.ts

@@ -6,6 +6,7 @@ import type { DnsRecordRequest, HookLogger } from '@celilo/capabilities';
 import { closeDb, getDb } from '../db/client';
 import { runMigrations } from '../db/migrate';
 import { capabilities, moduleConfigs, modules, webRoutes } from '../db/schema';
+import { resetTestDbPath } from '../test-utils/db-path';
 import { backfillWebRouteDns } from './dns-provider-backfill';
 
 const silentLogger: HookLogger = {
@@ -26,7 +27,7 @@ describe('backfillWebRouteDns (ISS-0029)', () => {
 
   afterEach(() => {
     closeDb();
-    process.env.CELILO_DB_PATH = undefined;
+    resetTestDbPath();
     try {
       rmSync(dir, { recursive: true, force: true });
     } catch {

package/src/services/dns-registrations.test.ts

@@ -14,6 +14,7 @@ import type { DnsRegistrarCapability } from '@celilo/capabilities';
 import { eq } from 'drizzle-orm';
 import { type DbClient, getDb } from '../db/client';
 import { modules } from '../db/schema';
+import { resetTestDbPath } from '../test-utils/db-path';
 import {
   listDnsRegistrations,
   recordDnsRegistration,
@@ -44,7 +45,7 @@ describe('dns_registrations ledger', () => {
 
   afterEach(() => {
     rmSync(tempDir, { recursive: true, force: true });
-    process.env.CELILO_DB_PATH = undefined;
+    resetTestDbPath();
   });
 
   test('record + list roundtrip; a re-assert is an upsert, not a second row', () => {

package/src/services/ensure-interview.test.ts

@@ -8,6 +8,7 @@ import { moduleConfigs, modules, secrets } from '../db/schema';
 import type { Ensure } from '../manifest/schema';
 import { decryptSecret } from '../secrets/encryption';
 import { getOrCreateMasterKey } from '../secrets/master-key';
+import { resetTestDbPath } from '../test-utils/db-path';
 import {
   findEnsureOnProvider,
   interviewForEnsureInputs,
@@ -56,7 +57,7 @@ describe('interviewForEnsureInputs', () => {
 
   afterEach(() => {
     rmSync(tempDir, { recursive: true, force: true });
-    process.env.CELILO_DB_PATH = undefined;
+    resetTestDbPath();
   });
 
   test('appends to array config and sets secret object key', async () => {
@@ -185,7 +186,7 @@ describe('findEnsureOnProvider', () => {
 
   afterEach(() => {
     rmSync(tempDir, { recursive: true, force: true });
-    process.env.CELILO_DB_PATH = undefined;
+    resetTestDbPath();
   });
 
   test('finds ensure by id on a registered provider', () => {

package/src/services/fleet-checks.test.ts

@@ -14,6 +14,7 @@ import {
 } from '../db/schema';
 import type { ModuleManifest } from '../manifest/schema';
 import { setupTestDatabaseAt } from '../test-utils/database';
+import { resetTestDbPath } from '../test-utils/db-path';
 import { ensureInboundSubscriber, ensureSweepSubscriber } from './alerting/monitors';
 import { ensureBackupSweepSubscriber } from './backup-sweep';
 import { getDaemonUnitPath } from './events-daemon';
@@ -269,7 +270,7 @@ describe('checkSubscribers + checkCapabilityProviders', () => {
   afterEach(() => {
     bus.close();
     db.$client.close();
-    process.env.CELILO_DB_PATH = undefined;
+    resetTestDbPath();
     process.env.EVENT_BUS_DB = undefined;
     try {
       rmSync(dir, { recursive: true, force: true });
@@ -978,7 +979,7 @@ describe('runFleetChecks includes host liveness (#728)', () => {
   afterEach(() => {
     bus.close();
     db.$client.close();
-    process.env.CELILO_DB_PATH = undefined;
+    resetTestDbPath();
     process.env.EVENT_BUS_DB = undefined;
     try {
       rmSync(dir, { recursive: true, force: true });

package/src/services/fleet-key.test.ts

@@ -9,6 +9,7 @@ import { execFileSync } from 'node:child_process';
 import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
+import { resetTestDbPath } from '../test-utils/db-path';
 import { ensureFleetKey, findFleetPrivateKey, getFleetSshDir } from './fleet-key';
 
 describe('ensureFleetKey', () => {
@@ -20,7 +21,7 @@ describe('ensureFleetKey', () => {
   });
 
   afterEach(() => {
-    process.env.CELILO_DB_PATH = undefined;
+    resetTestDbPath();
     rmSync(dataDir, { recursive: true, force: true });
   });
 
@@ -61,7 +62,7 @@ describe('findFleetPrivateKey', () => {
   });
 
   afterEach(() => {
-    process.env.CELILO_DB_PATH = undefined;
+    resetTestDbPath();
     process.env.HOME = realHome;
     rmSync(dataDir, { recursive: true, force: true });
     rmSync(homeDir, { recursive: true, force: true });

package/src/services/infrastructure-selector.test.ts

@@ -10,6 +10,7 @@ import { closeDb, createDbClient } from '../db/client';
 import { runMigrations } from '../db/migrate';
 import { modules } from '../db/schema';
 import type { Module } from '../db/schema';
+import { resetTestDbPath } from '../test-utils/db-path';
 import { addContainerService } from './container-service';
 import { InfrastructureError, selectInfrastructure } from './infrastructure-selector';
 import { addMachine } from './machine-pool';
@@ -46,7 +47,7 @@ describe('infrastructure-selector', () => {
     }
 
     // Clear environment variables
-    process.env.CELILO_DB_PATH = undefined;
+    resetTestDbPath();
     process.env.CELILO_MASTER_KEY_PATH = undefined;
   });
 

package/src/services/infrastructure-variable-resolver.test.ts

@@ -11,6 +11,7 @@ import {
 } from '@/db/schema';
 import type { ModuleManifest } from '@/manifest/schema';
 import { and, eq } from 'drizzle-orm';
+import { resetTestDbPath } from '../test-utils/db-path';
 import { resolveInfrastructureVariables } from './infrastructure-variable-resolver';
 import { upsertModuleConfig } from './module-config';
 
@@ -38,7 +39,7 @@ beforeEach(() => {
 
 afterEach(async () => {
   db.$client.close();
-  process.env.CELILO_DB_PATH = undefined;
+  resetTestDbPath();
 
   // Clean up database files
   if (existsSync(TEST_DB_PATH)) {

package/src/services/machine-pool.test.ts

@@ -10,6 +10,7 @@ import { eq } from 'drizzle-orm';
 import { closeDb, createDbClient, getDb } from '../db/client';
 import { runMigrations } from '../db/migrate';
 import { machines, moduleInfrastructure, modules } from '../db/schema';
+import { resetTestDbPath } from '../test-utils/db-path';
 import {
   addMachine,
   getMachine,
@@ -52,7 +53,7 @@ describe('machine-pool', () => {
     }
 
     // Clear environment variables
-    process.env.CELILO_DB_PATH = undefined;
+    resetTestDbPath();
     process.env.CELILO_MASTER_KEY_PATH = undefined;
   });
 

package/src/services/module-config.test.ts

@@ -9,6 +9,7 @@ import { join } from 'node:path';
 import { closeDb, createDbClient } from '../db/client';
 import { runMigrations } from '../db/migrate';
 import { modules } from '../db/schema';
+import { resetTestDbPath } from '../test-utils/db-path';
 import {
   formatConfigValue,
   getAllModuleConfigValues,
@@ -59,7 +60,7 @@ describe('module-config service', () => {
   afterEach(() => {
     closeDb();
     // Clean up environment variable
-    process.env.CELILO_DB_PATH = undefined;
+    resetTestDbPath();
     // Clean up test database
     rmSync(testDir, { recursive: true, force: true });
   });

package/src/services/module-deploy.dns-repoint.test.ts

@@ -9,6 +9,7 @@ import { eq } from 'drizzle-orm';
 import { type DbClient, closeDb, getDb } from '../db/client';
 import { runMigrations } from '../db/migrate';
 import { capabilities, moduleSystems, modules, systemConfig } from '../db/schema';
+import { resetTestDbPath } from '../test-utils/db-path';
 import { InterviewUnansweredError } from './interview-errors';
 import { planDnsRepoint, repointDnsPrimaryForProvider } from './module-deploy';
 
@@ -49,7 +50,7 @@ describe('repointDnsPrimaryForProvider (module-orchestrator-primitives slice 3)'
 
   afterEach(() => {
     closeDb();
-    process.env.CELILO_DB_PATH = undefined;
+    resetTestDbPath();
     try {
       rmSync(dir, { recursive: true, force: true });
     } catch {

package/src/services/module-deploy.ts

@@ -4,6 +4,7 @@
  * Coordinates full module deployment workflow across all phases
  */
 
+import { rmSync } from 'node:fs';
 import { join } from 'node:path';
 import { ProgressDisplay } from '@celilo/cli-display';
 import { and, eq } from 'drizzle-orm';
@@ -104,6 +105,17 @@ export interface DeployOptions {
    * this mode — that requires a real hook run.
    */
   stopAfterInterview?: boolean;
+  /**
+   * D4 (control-plane-stops-building-modules): retain the generated project
+   * after a successful deploy instead of deleting it. The tree is ephemeral
+   * by design — rendered for this deploy from the signed payload plus live
+   * config, used, then removed — because a persisted generated tree cannot be
+   * validated (only its verbatim role assets have a meaningful digest, the
+   * rest is rendered and SUPPOSED to differ), it holds rendered secrets, and
+   * it is what the next deploy would ship. This flag keeps it for deliberate
+   * inspection. It is always kept when the deploy fails.
+   */
+  keepGeneratedProject?: boolean;
 }
 
 /**
@@ -368,6 +380,26 @@ export async function deployModule(
   closeDeployWindows(db, moduleId, new Date());
 
   if (result.success) {
+    // D4 (control-plane-stops-building-modules): the generated project is
+    // ephemeral. It was rendered for THIS deploy from the signed payload plus
+    // live config; a persisted copy is a tree nothing can validate, it holds
+    // rendered secrets, and it is what a later deploy would ship. Now that
+    // the deploy that needed it is done — ansible, hooks, DNS backfill and
+    // aspects all ran inside the impl — it goes. Kept on failure (the impl's
+    // early returns) and under --keep.
+    if (!options.keepGeneratedProject) {
+      const deployed = db.select().from(modules).where(eq(modules.id, moduleId)).get();
+      if (deployed) {
+        const generatedPath = `${deployed.sourcePath}/generated`;
+        try {
+          rmSync(generatedPath, { recursive: true, force: true });
+          log.info(`Removed generated/ for '${moduleId}' (ephemeral by design; --keep retains it)`);
+        } catch (cleanupError) {
+          const msg = cleanupError instanceof Error ? cleanupError.message : String(cleanupError);
+          log.warn(`Failed to remove generated/ for '${moduleId}': ${msg}`);
+        }
+      }
+    }
     // A module that declares a suggested interval starts being watched on its
     // first successful deploy — watching is the default, not a thing to
     // remember.
@@ -792,26 +824,10 @@ async function deployModuleImpl(
 
     log.success('Templates generated');
 
-    // Pre-flight: refuse before contacting any system if the generated project
-    // does not match the module tree it was generated from (D6).
-    //
-    // This is the check that would have turned celilo#925 from a silent success
-    // into a refusal at the point of the fault. A verbatim role asset that
-    // failed to refresh is invisible downstream: `cp` reports no error, Ansible
-    // copies the stale bytes and reports `ok`, unchanged, and the module's
-    // version advances past code that never shipped. Local, milliseconds, no
-    // SSH. It deliberately does NOT verify after the deploy — Ansible's
-    // `changed` is truthful about what Ansible did, and the lie is upstream of
-    // Ansible.
-    const { refuseIfGeneratedIsStale } = await import('../module/packaging/generated-plane');
-    const staleGenerated = await refuseIfGeneratedIsStale(
-      moduleId,
-      module.sourcePath,
-      generatedPath,
-    );
-    if (staleGenerated) {
-      return { success: false, error: staleGenerated, phases };
-    }
+    // The generated-tree staleness pre-flight (D6 of module-integrity-rigor)
+    // retired here (D5 of control-plane-stops-building-modules): the tree is
+    // rendered for THIS deploy and deleted when it succeeds, so nothing
+    // persists that could be stale relative to what ships.
 
     // Run validate_config hook if defined (e.g., credential validation via Playwright)
     if (manifest.hooks?.validate_config) {

package/src/services/module-operations.test.ts

@@ -5,6 +5,7 @@ import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { closeDb } from '../db/client';
 import { runMigrations } from '../db/migrate';
+import { resetTestDbPath } from '../test-utils/db-path';
 import {
   InFlightError,
   OPERATIONS_SWEEP_PATTERN,
@@ -30,7 +31,7 @@ describe('module-operations', () => {
 
   afterEach(() => {
     closeDb();
-    process.env.CELILO_DB_PATH = undefined;
+    resetTestDbPath();
     try {
       rmSync(dir, { recursive: true, force: true });
     } catch {

package/src/services/module-subscriptions.test.ts

@@ -10,6 +10,7 @@ import { ModuleManifestSchema } from '../manifest/schema';
 import { ModuleSubscriptionSchema } from '../manifest/schema';
 import type { ModuleManifest } from '../manifest/schema';
 import { setupTestDatabaseAt as migrateDbFile } from '../test-utils/database';
+import { resetTestDbPath } from '../test-utils/db-path';
 import {
   registerModuleSubscriptions,
   resolveSubscription,
@@ -341,7 +342,7 @@ describe('resyncAllSubscriptions (ISS-0088)', () => {
   });
   afterEach(() => {
     closeDb();
-    process.env.CELILO_DB_PATH = undefined;
+    resetTestDbPath();
     process.env.EVENT_BUS_DB = undefined;
     try {
       rmSync(dir, { recursive: true, force: true });

package/src/services/port-forwards.test.ts

@@ -7,6 +7,7 @@ import { eq } from 'drizzle-orm';
 import type { DbClient } from '../db/client';
 import { portForwards } from '../db/schema';
 import { setupTestDatabaseAt } from '../test-utils/database';
+import { resetTestDbPath } from '../test-utils/db-path';
 import { deleteClaimedRows } from './capability-table-rows';
 import { buildPortForwardStore } from './port-forwards';
 
@@ -27,7 +28,7 @@ describe('port-forward store', () => {
   });
   afterEach(() => {
     db.$client.close();
-    process.env.CELILO_DB_PATH = undefined;
+    resetTestDbPath();
     try {
       rmSync(dir, { recursive: true, force: true });
     } catch {

package/src/services/programmatic-responder.aspect.test.ts

@@ -17,6 +17,7 @@ import { join } from 'node:path';
 import { defineEvents, openBus } from '@celilo/event-bus';
 import { closeDb, getDb } from '../db/client';
 import { runMigrations } from '../db/migrate';
+import { resetTestDbPath } from '../test-utils/db-path';
 import { type AspectRequiredPayload, EVENT_TYPES } from './bus-interview';
 import { startProgrammaticResponder } from './programmatic-responder';
 
@@ -72,7 +73,7 @@ describe('programmatic responder — aspect.required consent (#262)', () => {
   afterEach(() => {
     closeDb();
     rmSync(dir, { recursive: true, force: true });
-    process.env.CELILO_DB_PATH = undefined;
+    resetTestDbPath();
   });
 
   it('approves (consented=true) when the policy approves the module', async () => {

package/src/services/proxmox-reconcile.test.ts

@@ -27,6 +27,7 @@ import {
   modules,
 } from '../db/schema';
 import type { BaseModuleAspect } from '../manifest/schema';
+import { resetTestDbPath } from '../test-utils/db-path';
 import { upsertModuleConfig } from './module-config';
 import { executeProxmoxReconcile, planProxmoxReconcile } from './proxmox-reconcile';
 
@@ -153,7 +154,7 @@ describe('proxmox-reconcile', () => {
 
   afterEach(() => {
     closeDb();
-    process.env.CELILO_DB_PATH = undefined;
+    resetTestDbPath();
     try {
       rmSync(dir, { recursive: true, force: true });
     } catch {

package/src/services/restore-from-file.test.ts

@@ -23,6 +23,7 @@ import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { closeDb } from '../db/client';
 import { runMigrations } from '../db/migrate';
+import { resetTestDbPath } from '../test-utils/db-path';
 import { applyStagedSystemFiles, restoreFromArtifactFile } from './restore-from-file';
 
 describe('applyStagedSystemFiles', () => {
@@ -44,7 +45,7 @@ describe('applyStagedSystemFiles', () => {
 
   afterEach(() => {
     closeDb();
-    process.env.CELILO_DB_PATH = undefined;
+    resetTestDbPath();
     process.env.CELILO_MASTER_KEY_PATH = undefined;
     process.env.CELILO_DATA_DIR = undefined;
     try {
@@ -205,7 +206,7 @@ describe('restoreFromArtifactFile error paths', () => {
 
   afterEach(() => {
     closeDb();
-    process.env.CELILO_DB_PATH = undefined;
+    resetTestDbPath();
     process.env.CELILO_DATA_DIR = undefined;
     process.env.CELILO_MASTER_KEY_PATH = undefined;
     try {

package/src/services/restore-preflight.test.ts

@@ -5,6 +5,7 @@ import { join } from 'node:path';
 import { closeDb, getDb } from '../db/client';
 import { runMigrations } from '../db/migrate';
 import { modules } from '../db/schema';
+import { resetTestDbPath } from '../test-utils/db-path';
 import {
   NonEmptyRestoreTargetError,
   assertRestoreTargetEmpty,
@@ -23,7 +24,7 @@ describe('restore pre-flight', () => {
 
   afterEach(() => {
     closeDb();
-    process.env.CELILO_DB_PATH = undefined;
+    resetTestDbPath();
     process.env.CELILO_DATA_DIR = undefined;
     try {
       rmSync(dir, { recursive: true, force: true });

package/src/services/secret-schema-loader.test.ts

@@ -4,6 +4,7 @@ import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { type DbClient, getDb } from '../db/client';
 import { modules } from '../db/schema';
+import { resetTestDbPath } from '../test-utils/db-path';
 import {
   type SecretsSchema,
   getAllSecretMetadata,
@@ -40,7 +41,7 @@ describe('secret-schema-loader', () => {
   afterEach(() => {
     // Clean up temp directory
     rmSync(tempDir, { recursive: true, force: true });
-    process.env.CELILO_DB_PATH = undefined;
+    resetTestDbPath();
   });
 
   describe('loadSecretsSchema', () => {

package/src/services/ssh-key-manager.test.ts

@@ -8,6 +8,7 @@ import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { closeDb } from '../db/client';
 import { runMigrations } from '../db/migrate';
+import { resetTestDbPath } from '../test-utils/db-path';
 import { addMachine } from './machine-pool';
 import {
   LOCAL_MACHINE_IP,
@@ -97,7 +98,7 @@ describe('ssh-key-manager', () => {
     }
 
     // Clear environment variables
-    process.env.CELILO_DB_PATH = undefined;
+    resetTestDbPath();
     process.env.CELILO_DATA_DIR = undefined;
     process.env.CELILO_MASTER_KEY_PATH = undefined;
   });

package/src/services/static-content-converge.test.ts

@@ -14,6 +14,7 @@ import { eq } from 'drizzle-orm';
 import type { DbClient } from '../db/client';
 import { moduleConfigs, modules, webRoutes } from '../db/schema';
 import { setupTestDatabaseAt } from '../test-utils/database';
+import { resetTestDbPath } from '../test-utils/db-path';
 import {
   ansibleTreeMentions,
   buildStaticContentPlan,
@@ -64,7 +65,7 @@ describe('planStaticContent — the declared release set (D10 task 4.1)', () =>
 
   afterEach(() => {
     db.$client.close();
-    process.env.CELILO_DB_PATH = undefined;
+    resetTestDbPath();
     try {
       rmSync(dir, { recursive: true, force: true });
     } catch {
@@ -177,7 +178,7 @@ describe('resolveStaticContentRetention — operator config with a default', ()
 
   afterEach(() => {
     db.$client.close();
-    process.env.CELILO_DB_PATH = undefined;
+    resetTestDbPath();
     try {
       rmSync(dir, { recursive: true, force: true });
     } catch {
@@ -279,7 +280,7 @@ describe('the state web overlay (celilo#1265)', () => {
 
   afterEach(() => {
     db.$client.close();
-    process.env.CELILO_DB_PATH = undefined;
+    resetTestDbPath();
     try {
       rmSync(dir, { recursive: true, force: true });
     } catch {
@@ -359,7 +360,7 @@ describe('writeStaticContentVars — lands in the generated inventory', () => {
 
   afterEach(() => {
     db.$client.close();
-    process.env.CELILO_DB_PATH = undefined;
+    resetTestDbPath();
     try {
       rmSync(dir, { recursive: true, force: true });
     } catch {

package/src/services/static-content-converge.ts

@@ -23,7 +23,7 @@
  * `module verify` (celilo#1018, deliberately left to that thread).
  */
 
-import { existsSync, readFileSync, readdirSync } from 'node:fs';
+import { existsSync, readFileSync, readdirSync, rmSync } from 'node:fs';
 import { mkdir, writeFile } from 'node:fs/promises';
 import { join } from 'node:path';
 import { and, eq, isNotNull } from 'drizzle-orm';
@@ -237,9 +237,10 @@ export function staticContentVarsYaml(plan: StaticContentPlan): string {
  *
  * The shared half of both converge triggers: the capability's callback adds
  * `executeAnsible` after this, and the provider's own deploy already runs it.
- * Writing happens AFTER the deploy's staleness check (`refuseIfGeneratedIsStale`
- * only inspects verbatim role assets), so an injected vars file never reads as
- * a stale generation.
+ * Nothing inspects verbatim role assets any more — the staleness pre-flight
+ * retired with the ephemeral generated tree (D5 of
+ * control-plane-stops-building-modules), so an injected vars file cannot read
+ * as a stale generation because nothing reads staleness.
  */
 export async function writeStaticContentVars(
   db: DbClient,
@@ -308,13 +309,31 @@ export async function convergeStaticContent(
     return { success: false, error: `Provider module '${providerModuleId}' is not installed` };
   }
   const generatedPath = join(module.sourcePath, 'generated');
+  // D4 (control-plane-stops-building-modules): the generated project is
+  // ephemeral, so a successful provider deploy deletes it and nothing is
+  // persisted for this converge to read. Render it here, on demand, from the
+  // signed payload plus resolved config — generation is fast and local. A
+  // render failure fails loudly with the deploy-once remedy, same as the old
+  // missing-project refusal did; a tree that predates the converge support is
+  // still refused by the static_releases check below.
   if (!existsSync(generatedPath)) {
-    return {
-      success: false,
-      error:
-        `public_web provider '${providerModuleId}' has no generated deploy project at ${generatedPath}. ` +
-        `Run \`celilo module deploy ${providerModuleId}\` once, then retry the publish.`,
-    };
+    const { generateTemplates } = await import('../templates/generator');
+    const rendered = await generateTemplates({
+      moduleId: providerModuleId,
+      modulePath: module.sourcePath,
+      outputPath: generatedPath,
+      db,
+      skipVariableValidation: false,
+    });
+    if (!rendered.success) {
+      return {
+        success: false,
+        error:
+          `public_web provider '${providerModuleId}' has no generated deploy project at ${generatedPath} ` +
+          `and rendering one failed: ${rendered.error ?? 'unknown error'}. ` +
+          `Run \`celilo module deploy ${providerModuleId}\` once, then retry the publish.`,
+      };
+    }
   }
 
   const written = await writeStaticContentVars(db, providerModuleId, generatedPath);
@@ -342,5 +361,9 @@ export async function convergeStaticContent(
       varsPath: written.varsPath,
     };
   }
+  // D4: the converge rendered the tree, used it, and is done with it. The same
+  // no-secrets-at-rest rule the deploy follows applies here; on the failure
+  // paths above the tree stays for inspection.
+  rmSync(generatedPath, { recursive: true, force: true });
   return { success: true, varsPath: written.varsPath };
 }

package/src/services/system-state-stage.test.ts

@@ -13,6 +13,7 @@ import { afterEach, beforeEach, describe, expect, it } from 'bun:test';
 import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
+import { resetTestDbPath } from '../test-utils/db-path';
 import { snapshotDatabase, stageSystemState } from './system-state-stage';
 
 describe('stageSystemState', () => {
@@ -38,7 +39,7 @@ describe('stageSystemState', () => {
 
   afterEach(() => {
     process.env.CELILO_DATA_DIR = undefined;
-    process.env.CELILO_DB_PATH = undefined;
+    resetTestDbPath();
     process.env.CELILO_MASTER_KEY_PATH = undefined;
     rmSync(dataDir, { recursive: true, force: true });
   });

package/src/services/trusted-sources.test.ts

@@ -6,6 +6,7 @@ import type { DbClient } from '../db/client';
 import { systemConfig } from '../db/schema';
 import { loadTrustedSubnets } from '../hooks/capability-loader';
 import { setupTestDatabaseAt } from '../test-utils/database';
+import { resetTestDbPath } from '../test-utils/db-path';
 import {
   buildTrustedSourceStore,
   composeTrustedSubnets,
@@ -30,7 +31,7 @@ describe('trusted-source store', () => {
   });
   afterEach(() => {
     db.$client.close();
-    process.env.CELILO_DB_PATH = undefined;
+    resetTestDbPath();
     try {
       rmSync(dir, { recursive: true, force: true });
     } catch {
@@ -147,7 +148,7 @@ describe('the render input excludes registrations; the reporting view includes t
   });
   afterEach(() => {
     db.$client.close();
-    process.env.CELILO_DB_PATH = undefined;
+    resetTestDbPath();
     try {
       rmSync(dir, { recursive: true, force: true });
     } catch {

package/src/services/zone-detector.test.ts

@@ -9,6 +9,7 @@ import { join } from 'node:path';
 import { closeDb, createDbClient } from '../db/client';
 import { runMigrations } from '../db/migrate';
 import { systemConfig } from '../db/schema';
+import { resetTestDbPath } from '../test-utils/db-path';
 import { detectZoneFromIp, isValidIp } from './zone-detector';
 
 describe('zone-detector', () => {
@@ -46,7 +47,7 @@ describe('zone-detector', () => {
     }
 
     // Clear environment variables
-    process.env.CELILO_DB_PATH = undefined;
+    resetTestDbPath();
   });
 
   describe('detectZoneFromIp', () => {