@checkstack/healthcheck-backend 1.5.0 → 1.6.0

package/src/retention-job.ts

@@ -206,64 +206,103 @@ interface RollupParams {
 }
 
 /**
- * Rolls up hourly aggregates older than retention period into daily buckets
+ * The ON CONFLICT target for the daily-aggregate upsert. It MUST list exactly
+ * the columns of the `health_check_aggregates_bucket_unique` constraint
+ * (configurationId, systemId, environmentId, bucketStart, bucketSize, sourceId)
+ * - Postgres rejects an ON CONFLICT whose target does not match a real unique
+ * constraint with SQLSTATE 42P10. `retention-rollup.test.ts` asserts this stays
+ * in lock-step with the schema so the rollup can never throw 42P10 again.
  */
-async function rollupHourlyAggregates(params: RollupParams) {
-  const { db, systemId, configurationId, hourlyRetentionDays } = params;
-
-  const cutoffDate = new Date();
-  cutoffDate.setDate(cutoffDate.getDate() - hourlyRetentionDays);
-  cutoffDate.setHours(0, 0, 0, 0); // Round to day
-
-  // Get old hourly aggregates
-  const oldHourly = await db
-    .select()
-    .from(healthCheckAggregates)
-    .where(
-      and(
-        eq(healthCheckAggregates.systemId, systemId),
-        eq(healthCheckAggregates.configurationId, configurationId),
-        eq(healthCheckAggregates.bucketSize, "hourly"),
-        lt(healthCheckAggregates.bucketStart, cutoffDate),
-      ),
-    );
-
-  if (oldHourly.length === 0) return;
+export const DAILY_AGGREGATE_CONFLICT_TARGET = [
+  healthCheckAggregates.configurationId,
+  healthCheckAggregates.systemId,
+  healthCheckAggregates.environmentId,
+  healthCheckAggregates.bucketStart,
+  healthCheckAggregates.bucketSize,
+  healthCheckAggregates.sourceId,
+] as const;
+
+/** Truncate a timestamp to the start of its (local) day. */
+function dayStartOf(date: Date): Date {
+  const day = new Date(date);
+  day.setHours(0, 0, 0, 0);
+  return day;
+}
 
-  // Group by day
-  const dailyBuckets = new Map<
-    string,
-    {
-      bucketStart: Date;
-      aggregates: typeof oldHourly;
-    }
-  >();
+/** The subset of an hourly aggregate row the rollup math needs. */
+export interface HourlyAggregateRow {
+  bucketStart: Date;
+  environmentId: string | null;
+  sourceId: string | null;
+  sourceLabel: string | null;
+  runCount: number;
+  healthyCount: number;
+  degradedCount: number;
+  unhealthyCount: number;
+  latencySumMs: number | null;
+  avgLatencyMs: number | null;
+  minLatencyMs: number | null;
+  maxLatencyMs: number | null;
+  p95LatencyMs: number | null;
+}
 
-  for (const hourly of oldHourly) {
-    const dayStart = new Date(hourly.bucketStart);
-    dayStart.setHours(0, 0, 0, 0);
-    const key = dayStart.toISOString();
+/** A computed daily aggregate ready to upsert. */
+export interface DailyAggregateValues {
+  bucketStart: Date;
+  environmentId: string | null;
+  sourceId: string | null;
+  sourceLabel: string | null;
+  runCount: number;
+  healthyCount: number;
+  degradedCount: number;
+  unhealthyCount: number;
+  latencySumMs: number | undefined;
+  avgLatencyMs: number | undefined;
+  minLatencyMs: number | undefined;
+  maxLatencyMs: number | undefined;
+  p95LatencyMs: number | undefined;
+}
 
-    if (!dailyBuckets.has(key)) {
-      dailyBuckets.set(key, { bucketStart: dayStart, aggregates: [] });
+/**
+ * Fold hourly aggregates into daily ones. CRITICAL: rows are grouped by
+ * (day, environmentId, sourceId) - the same dimensions as the unique key - so
+ * distinct per-environment / per-source series stay separate instead of being
+ * collapsed into one `environmentId=null` daily row. Counts sum; latency sum
+ * folds (with avg*count fallback); min/max/p95 fold across the group.
+ */
+export function buildDailyAggregates(
+  oldHourly: HourlyAggregateRow[],
+): DailyAggregateValues[] {
+  const groups = new Map<string, HourlyAggregateRow[]>();
+
+  for (const row of oldHourly) {
+    const key = JSON.stringify([
+      dayStartOf(row.bucketStart).toISOString(),
+      row.environmentId,
+      row.sourceId,
+    ]);
+    const existing = groups.get(key);
+    if (existing) {
+      existing.push(row);
+    } else {
+      groups.set(key, [row]);
     }
-    dailyBuckets.get(key)!.aggregates.push(hourly);
   }
 
-  // Create daily aggregates
-  for (const [, bucket] of dailyBuckets) {
+  const result: DailyAggregateValues[] = [];
+  for (const rows of groups.values()) {
     let runCount = 0;
     let healthyCount = 0;
     let degradedCount = 0;
     let unhealthyCount = 0;
     let latencySumMs = 0;
 
-    for (const a of bucket.aggregates) {
+    for (const a of rows) {
       runCount += a.runCount;
       healthyCount += a.healthyCount;
       degradedCount += a.degradedCount;
       unhealthyCount += a.unhealthyCount;
-      // Use latencySumMs if available, fallback to avg*count approximation
+      // Use latencySumMs if available, fallback to avg*count approximation.
       if (a.latencySumMs !== null) {
         latencySumMs += a.latencySumMs;
       } else if (a.avgLatencyMs !== null) {
@@ -271,87 +310,122 @@ async function rollupHourlyAggregates(params: RollupParams) {
       }
     }
 
-    const avgLatencyMs =
-      runCount > 0 ? Math.round(latencySumMs / runCount) : undefined;
-
-    // Min/max across all hourly buckets
-    const minValues = bucket.aggregates
+    const minValues = rows
       .map((a) => a.minLatencyMs)
       .filter((v): v is number => v !== null);
-    const maxValues = bucket.aggregates
+    const maxValues = rows
       .map((a) => a.maxLatencyMs)
       .filter((v): v is number => v !== null);
-    const p95Values = bucket.aggregates
+    const p95Values = rows
       .map((a) => a.p95LatencyMs)
       .filter((v): v is number => v !== null);
-    const minLatencyMs =
-      minValues.length > 0 ? Math.min(...minValues) : undefined;
-    const maxLatencyMs =
-      maxValues.length > 0 ? Math.max(...maxValues) : undefined;
-    // Use max of hourly p95s as upper bound approximation
-    const p95LatencyMs =
-      p95Values.length > 0 ? Math.max(...p95Values) : undefined;
 
+    result.push({
+      bucketStart: dayStartOf(rows[0].bucketStart),
+      environmentId: rows[0].environmentId,
+      sourceId: rows[0].sourceId,
+      sourceLabel: rows[0].sourceLabel,
+      runCount,
+      healthyCount,
+      degradedCount,
+      unhealthyCount,
+      latencySumMs: latencySumMs > 0 ? latencySumMs : undefined,
+      avgLatencyMs:
+        runCount > 0 ? Math.round(latencySumMs / runCount) : undefined,
+      minLatencyMs: minValues.length > 0 ? Math.min(...minValues) : undefined,
+      maxLatencyMs: maxValues.length > 0 ? Math.max(...maxValues) : undefined,
+      // Use max of hourly p95s as an upper-bound approximation.
+      p95LatencyMs: p95Values.length > 0 ? Math.max(...p95Values) : undefined,
+    });
+  }
+
+  return result;
+}
+
+/**
+ * Rolls up hourly aggregates older than retention period into daily buckets
+ */
+async function rollupHourlyAggregates(params: RollupParams) {
+  const { db, systemId, configurationId, hourlyRetentionDays } = params;
+
+  const cutoffDate = new Date();
+  cutoffDate.setDate(cutoffDate.getDate() - hourlyRetentionDays);
+  cutoffDate.setHours(0, 0, 0, 0); // Round to day
+
+  // Get old hourly aggregates
+  const oldHourly = await db
+    .select()
+    .from(healthCheckAggregates)
+    .where(
+      and(
+        eq(healthCheckAggregates.systemId, systemId),
+        eq(healthCheckAggregates.configurationId, configurationId),
+        eq(healthCheckAggregates.bucketSize, "hourly"),
+        lt(healthCheckAggregates.bucketStart, cutoffDate),
+      ),
+    );
+
+  if (oldHourly.length === 0) return;
+
+  // Fold into daily aggregates, preserving (day, environmentId, sourceId) series.
+  for (const daily of buildDailyAggregates(oldHourly)) {
+    const newLatencySum = daily.latencySumMs;
     // Upsert the daily aggregate. A row may already exist for this
-    // (configurationId, systemId, day, daily, sourceId=null) tuple if a
-    // prior rollup ran and then late-arriving hourly buckets (e.g. from
-    // a satellite that was offline) were rolled up afterwards. Merge in
-    // that case rather than crashing — sums add, min/max/p95 fold.
-    const newLatencySum = latencySumMs > 0 ? latencySumMs : undefined;
+    // (configurationId, systemId, environmentId, day, daily, sourceId) tuple if
+    // a prior rollup ran and then late-arriving hourly buckets (e.g. from a
+    // satellite that was offline) were rolled up afterwards. Merge in that case
+    // rather than crashing — sums add, min/max/p95 fold.
     await db
       .insert(healthCheckAggregates)
       .values({
         configurationId,
         systemId,
-        bucketStart: bucket.bucketStart,
+        environmentId: daily.environmentId,
+        sourceId: daily.sourceId,
+        sourceLabel: daily.sourceLabel,
+        bucketStart: daily.bucketStart,
         bucketSize: "daily",
-        runCount,
-        healthyCount,
-        degradedCount,
-        unhealthyCount,
+        runCount: daily.runCount,
+        healthyCount: daily.healthyCount,
+        degradedCount: daily.degradedCount,
+        unhealthyCount: daily.unhealthyCount,
         latencySumMs: newLatencySum,
-        avgLatencyMs,
-        minLatencyMs,
-        maxLatencyMs,
-        p95LatencyMs,
+        avgLatencyMs: daily.avgLatencyMs,
+        minLatencyMs: daily.minLatencyMs,
+        maxLatencyMs: daily.maxLatencyMs,
+        p95LatencyMs: daily.p95LatencyMs,
         aggregatedResult: undefined, // Cannot combine result across hours
       })
       .onConflictDoUpdate({
-        target: [
-          healthCheckAggregates.configurationId,
-          healthCheckAggregates.systemId,
-          healthCheckAggregates.bucketStart,
-          healthCheckAggregates.bucketSize,
-          healthCheckAggregates.sourceId,
-        ],
+        target: [...DAILY_AGGREGATE_CONFLICT_TARGET],
         set: {
-          runCount: sql`${healthCheckAggregates.runCount} + ${runCount}`,
-          healthyCount: sql`${healthCheckAggregates.healthyCount} + ${healthyCount}`,
-          degradedCount: sql`${healthCheckAggregates.degradedCount} + ${degradedCount}`,
-          unhealthyCount: sql`${healthCheckAggregates.unhealthyCount} + ${unhealthyCount}`,
+          runCount: sql`${healthCheckAggregates.runCount} + ${daily.runCount}`,
+          healthyCount: sql`${healthCheckAggregates.healthyCount} + ${daily.healthyCount}`,
+          degradedCount: sql`${healthCheckAggregates.degradedCount} + ${daily.degradedCount}`,
+          unhealthyCount: sql`${healthCheckAggregates.unhealthyCount} + ${daily.unhealthyCount}`,
           latencySumMs: sql`COALESCE(${healthCheckAggregates.latencySumMs}, 0) + ${newLatencySum ?? 0}`,
-          avgLatencyMs: sql`CASE WHEN (${healthCheckAggregates.runCount} + ${runCount}) > 0 THEN (COALESCE(${healthCheckAggregates.latencySumMs}, 0) + ${newLatencySum ?? 0}) / (${healthCheckAggregates.runCount} + ${runCount}) ELSE ${healthCheckAggregates.avgLatencyMs} END`,
+          avgLatencyMs: sql`CASE WHEN (${healthCheckAggregates.runCount} + ${daily.runCount}) > 0 THEN (COALESCE(${healthCheckAggregates.latencySumMs}, 0) + ${newLatencySum ?? 0}) / (${healthCheckAggregates.runCount} + ${daily.runCount}) ELSE ${healthCheckAggregates.avgLatencyMs} END`,
           minLatencyMs:
-            minLatencyMs === undefined
+            daily.minLatencyMs === undefined
               ? sql`${healthCheckAggregates.minLatencyMs}`
-              : sql`LEAST(COALESCE(${healthCheckAggregates.minLatencyMs}, ${minLatencyMs}), ${minLatencyMs})`,
+              : sql`LEAST(COALESCE(${healthCheckAggregates.minLatencyMs}, ${daily.minLatencyMs}), ${daily.minLatencyMs})`,
           maxLatencyMs:
-            maxLatencyMs === undefined
+            daily.maxLatencyMs === undefined
               ? sql`${healthCheckAggregates.maxLatencyMs}`
-              : sql`GREATEST(COALESCE(${healthCheckAggregates.maxLatencyMs}, ${maxLatencyMs}), ${maxLatencyMs})`,
+              : sql`GREATEST(COALESCE(${healthCheckAggregates.maxLatencyMs}, ${daily.maxLatencyMs}), ${daily.maxLatencyMs})`,
           p95LatencyMs:
-            p95LatencyMs === undefined
+            daily.p95LatencyMs === undefined
               ? sql`${healthCheckAggregates.p95LatencyMs}`
-              : sql`GREATEST(COALESCE(${healthCheckAggregates.p95LatencyMs}, ${p95LatencyMs}), ${p95LatencyMs})`,
+              : sql`GREATEST(COALESCE(${healthCheckAggregates.p95LatencyMs}, ${daily.p95LatencyMs}), ${daily.p95LatencyMs})`,
         },
       });
+  }
 
-    // Delete processed hourly aggregates
-    for (const hourly of bucket.aggregates) {
-      await db
-        .delete(healthCheckAggregates)
-        .where(eq(healthCheckAggregates.id, hourly.id));
-    }
+  // Delete the processed hourly aggregates (all were folded into daily rows).
+  for (const hourly of oldHourly) {
+    await db
+      .delete(healthCheckAggregates)
+      .where(eq(healthCheckAggregates.id, hourly.id));
   }
 }
 

package/src/retention-rollup.test.ts

@@ -0,0 +1,118 @@
+import { describe, it, expect } from "bun:test";
+import { getTableConfig } from "drizzle-orm/pg-core";
+import { healthCheckAggregates } from "./schema";
+import {
+  buildDailyAggregates,
+  DAILY_AGGREGATE_CONFLICT_TARGET,
+  type HourlyAggregateRow,
+} from "./retention-job";
+
+function hourly(overrides: Partial<HourlyAggregateRow>): HourlyAggregateRow {
+  return {
+    bucketStart: new Date("2026-01-01T03:00:00.000Z"),
+    environmentId: null,
+    sourceId: null,
+    sourceLabel: null,
+    runCount: 1,
+    healthyCount: 1,
+    degradedCount: 0,
+    unhealthyCount: 0,
+    latencySumMs: 100,
+    avgLatencyMs: 100,
+    minLatencyMs: 100,
+    maxLatencyMs: 100,
+    p95LatencyMs: 100,
+    ...overrides,
+  };
+}
+
+describe("buildDailyAggregates", () => {
+  it("keeps per-environment series separate within the same day", () => {
+    // Two hourly buckets on the same day but for different environments must NOT
+    // collapse into one daily row (they are distinct rows under the unique key).
+    const daily = buildDailyAggregates([
+      hourly({
+        bucketStart: new Date("2026-01-01T03:00:00.000Z"),
+        environmentId: "prod",
+      }),
+      hourly({
+        bucketStart: new Date("2026-01-01T09:00:00.000Z"),
+        environmentId: "staging",
+      }),
+    ]);
+
+    expect(daily).toHaveLength(2);
+    const envs = daily.map((d) => d.environmentId).sort();
+    expect(envs).toEqual(["prod", "staging"]);
+    // Both fall on the same UTC day start.
+    for (const d of daily) {
+      expect(d.bucketStart.toISOString()).toBe("2026-01-01T00:00:00.000Z");
+    }
+  });
+
+  it("keeps per-source series separate within the same day+environment", () => {
+    const daily = buildDailyAggregates([
+      hourly({ environmentId: "prod", sourceId: null }),
+      hourly({ environmentId: "prod", sourceId: "satellite-eu" }),
+    ]);
+    expect(daily).toHaveLength(2);
+    expect(new Set(daily.map((d) => d.sourceId))).toEqual(
+      new Set<string | null>(["satellite-eu", null]),
+    );
+  });
+
+  it("sums counts and folds latency stats within a group", () => {
+    const daily = buildDailyAggregates([
+      hourly({
+        bucketStart: new Date("2026-01-01T01:00:00.000Z"),
+        environmentId: "prod",
+        runCount: 2,
+        healthyCount: 1,
+        degradedCount: 1,
+        unhealthyCount: 0,
+        latencySumMs: 300,
+        minLatencyMs: 50,
+        maxLatencyMs: 250,
+        p95LatencyMs: 240,
+      }),
+      hourly({
+        bucketStart: new Date("2026-01-01T05:00:00.000Z"),
+        environmentId: "prod",
+        runCount: 3,
+        healthyCount: 3,
+        degradedCount: 0,
+        unhealthyCount: 0,
+        latencySumMs: 300,
+        minLatencyMs: 80,
+        maxLatencyMs: 120,
+        p95LatencyMs: 110,
+      }),
+    ]);
+
+    expect(daily).toHaveLength(1);
+    const d = daily[0];
+    expect(d.runCount).toBe(5);
+    expect(d.healthyCount).toBe(4);
+    expect(d.degradedCount).toBe(1);
+    expect(d.latencySumMs).toBe(600);
+    expect(d.avgLatencyMs).toBe(120); // 600 / 5
+    expect(d.minLatencyMs).toBe(50);
+    expect(d.maxLatencyMs).toBe(250);
+    expect(d.p95LatencyMs).toBe(240);
+  });
+});
+
+describe("DAILY_AGGREGATE_CONFLICT_TARGET", () => {
+  it("matches the health_check_aggregates unique constraint exactly", () => {
+    // Postgres rejects an ON CONFLICT target that does not match a real unique
+    // constraint (SQLSTATE 42P10). Keep the rollup's upsert target in lock-step
+    // with the schema's unique constraint so the rollup can never throw 42P10.
+    const { uniqueConstraints } = getTableConfig(healthCheckAggregates);
+    expect(uniqueConstraints).toHaveLength(1);
+    const constraintCols = uniqueConstraints[0].columns
+      .map((c) => c.name)
+      .sort();
+    const targetCols = DAILY_AGGREGATE_CONFLICT_TARGET.map((c) => c.name).sort();
+    expect(targetCols).toEqual(constraintCols);
+  });
+});

package/src/router.test.ts

@@ -1,6 +1,6 @@
 import { describe, it, expect, mock } from "bun:test";
 import { createHealthCheckRouter } from "./router";
-import { createMockRpcContext } from "@checkstack/backend-api";
+import { createMockRpcContext, Versioned } from "@checkstack/backend-api";
 import { call } from "@orpc/server";
 import { z } from "zod";
 import type { HealthCheckCache } from "./cache";
@@ -209,6 +209,125 @@ describe("HealthCheck Router", () => {
     expect(result).toHaveLength(0);
   });
 
+  describe("validateConfiguration", () => {
+    // A strategy whose config requires a URL-typed `url` field. The schema is
+    // strict-validated through the migrate-then-validate path, so a wrong type
+    // or an unknown key is rejected even though the key may be present.
+    const strategyConfigSchema = z.object({ url: z.string().url() });
+    const collectorConfigSchema = z.object({ path: z.string().min(1) });
+
+    const registeredStrategy = {
+      strategy: {
+        id: "http",
+        displayName: "HTTP",
+        config: new Versioned({ version: 1, schema: strategyConfigSchema }),
+        aggregatedResult: { schema: z.object({}) },
+      },
+      qualifiedId: "healthcheck-http.http",
+      ownerPluginId: "healthcheck-http",
+    };
+    const registeredCollector = {
+      qualifiedId: "collector-file.file",
+      collector: {
+        displayName: "File",
+        config: new Versioned({ version: 1, schema: collectorConfigSchema }),
+        result: { schema: z.object({}) },
+        supportedPlugins: [{ pluginId: "healthcheck-http" }],
+      },
+      ownerPlugin: { id: "collector-file" },
+    };
+
+    const validateContext = () =>
+      createMockRpcContext({
+        user: mockUser,
+        healthCheckRegistry: {
+          getStrategiesWithMeta: mock().mockReturnValue([registeredStrategy]),
+          getStrategy: mock().mockReturnValue(registeredStrategy.strategy),
+          getStrategies: mock().mockReturnValue([]),
+        } as never,
+        collectorRegistry: {
+          getCollectors: mock().mockReturnValue([registeredCollector]),
+          getCollector: mock().mockReturnValue(registeredCollector),
+          getCollectorsForPlugin: mock().mockReturnValue([registeredCollector]),
+          register: mock(),
+        } as never,
+      });
+
+    it("returns valid for a well-formed configuration without persisting", async () => {
+      const result = await call(
+        router.validateConfiguration,
+        {
+          name: "ok",
+          strategyId: "healthcheck-http.http",
+          config: { url: "https://example.test" },
+          intervalSeconds: 60,
+          collectors: [
+            {
+              id: "c1",
+              collectorId: "collector-file.file",
+              config: { path: "/tmp/x" },
+            },
+          ],
+        },
+        { context: validateContext() },
+      );
+      expect(result.valid).toBe(true);
+      expect(result.errors).toEqual([]);
+      // No DB insert ran (the insert mock returns []), proving non-persistence.
+    });
+
+    it("rejects an unknown strategy", async () => {
+      const result = await call(
+        router.validateConfiguration,
+        {
+          name: "x",
+          strategyId: "healthcheck-http.ghost",
+          config: { url: "https://example.test" },
+          intervalSeconds: 60,
+        },
+        { context: validateContext() },
+      );
+      expect(result.valid).toBe(false);
+      expect(result.errors[0].path).toEqual(["strategyId"]);
+    });
+
+    // Deep-vs-lightweight: `url` IS present (the old presence check passes),
+    // but holds the wrong TYPE. Only the strict migrate-then-validate path
+    // rejects it.
+    it("rejects a deep field/type error a presence check would miss", async () => {
+      const result = await call(
+        router.validateConfiguration,
+        {
+          name: "x",
+          strategyId: "healthcheck-http.http",
+          config: { url: 12345 },
+          intervalSeconds: 60,
+        },
+        { context: validateContext() },
+      );
+      expect(result.valid).toBe(false);
+      expect(result.errors[0].path[0]).toBe("config");
+    });
+
+    it("rejects an unknown collector", async () => {
+      const result = await call(
+        router.validateConfiguration,
+        {
+          name: "x",
+          strategyId: "healthcheck-http.http",
+          config: { url: "https://example.test" },
+          intervalSeconds: 60,
+          collectors: [
+            { id: "c1", collectorId: "collector-file.ghost", config: {} },
+          ],
+        },
+        { context: validateContext() },
+      );
+      expect(result.valid).toBe(false);
+      expect(result.errors[0].path).toEqual(["collectors", 0, "collectorId"]);
+    });
+  });
+
   describe("GitOps Provenance Enforcement", () => {
     it("allows deleteConfiguration when GitOps lock is not present", async () => {
       mockGitOpsClient.getProvenance.mockResolvedValueOnce(null);

package/src/router.ts

@@ -16,6 +16,7 @@ import {
   resolveScriptPackagesDir,
 } from "@checkstack/script-packages-backend";
 import { HealthCheckService } from "./service";
+import { collectConfigurationIssues } from "./validate-configuration";
 import { runCollectorScriptTest } from "./collector-script-test";
 import { healthCheckHooks } from "./hooks";
 import * as schema from "./schema";
@@ -166,6 +167,24 @@ export const createHealthCheckRouter = (opts: {
       return created;
     }),
 
+    validateConfiguration: os.validateConfiguration.handler(
+      async ({ input, context }) => {
+        // Deep validation WITHOUT persisting: resolve the strategy/collectors
+        // against the live registries and run the same migrate-then-validate-
+        // strict logic the create / gitops-apply path uses, so propose-time
+        // errors match apply-time errors. Strategy/collector config (typed
+        // `z.record(z.unknown())` on the input) is validated against each
+        // registered schema, surfacing wrong types, missing required fields,
+        // and unknown keys - not just missing-field presence.
+        const errors = await collectConfigurationIssues({
+          input,
+          registry: context.healthCheckRegistry,
+          collectorRegistry: context.collectorRegistry,
+        });
+        return { valid: errors.length === 0, errors };
+      },
+    ),
+
     updateConfiguration: os.updateConfiguration.handler(async ({ input }) => {
       await enforceNotGitOpsLocked("Healthcheck", input.id);
       const config = await service.updateConfiguration(input.id, input.body);
@@ -217,6 +236,7 @@ export const createHealthCheckRouter = (opts: {
         enabled: input.body.enabled,
         stateThresholds: input.body.stateThresholds,
         satelliteIds: input.body.satelliteIds,
+        environmentIds: input.body.environmentIds,
         includeLocal: input.body.includeLocal,
       });
       await cache.invalidateSystem(input.systemId);