registry, verdaccio, portainer: full nox modules (ADR 0044/0046)

registry (docker v2): catalog/tags/delete tools, emits image.pushed (a build's
image is now pullable). verdaccio (npm): list/info tools, emits
package.published. portainer: endpoints/stacks/containers tools — tools-only,
since its only events are the underlying containers' lifecycle, which the host
owns. Typecheck; manifests parse.

modules/portainer/client.ts

@@ -0,0 +1,97 @@
+// The Portainer API client — portainer's own code, living in the module (novox/hq ADR 0044).
+// portainer is tools-only: its "events" would really be the underlying containers' lifecycle,
+// which the host owns and emits — so this module reads Portainer's own resources (endpoints,
+// stacks, containers) and exposes them, and stops there.
+
+export interface PortainerEndpoint {
+  id: number;
+  name: string;
+  type: number;
+  url: string;
+  status: number;
+}
+
+export interface PortainerStack {
+  id: number;
+  name: string;
+  type: number;
+  endpointId: number;
+  status: number;
+}
+
+export interface PortainerContainer {
+  id: string;
+  names: string[];
+  image: string;
+  state: string;
+  status: string;
+}
+
+export class PortainerClient {
+  readonly baseUrl: string;
+
+  constructor(
+    url: string,
+    private readonly token: string,
+  ) {
+    this.baseUrl = url.replace(/\/+$/, "");
+  }
+
+  /**
+   * Build from the module's resolved environment. The URL is MESH_PORTAINER_URL (or the local
+   * dashboard port) and the API token is MESH_PORTAINER_TOKEN — an access token minted in
+   * Portainer, sent as X-API-Key. Throws when no token is configured, so a misconfigured module
+   * exposes nothing rather than calling Portainer unauthenticated.
+   */
+  static fromEnv(env: NodeJS.ProcessEnv = process.env): PortainerClient {
+    const url = env.MESH_PORTAINER_URL ?? `https://127.0.0.1:${env.PORTAINER_PORT ?? "9443"}`;
+    const token = env.MESH_PORTAINER_TOKEN;
+    if (!token) throw new Error("no Portainer token — set MESH_PORTAINER_TOKEN");
+    return new PortainerClient(url, token);
+  }
+
+  private async get<T>(path: string): Promise<T> {
+    const res = await fetch(`${this.baseUrl}${path}`, { headers: { "X-API-Key": this.token } });
+    if (!res.ok) throw new Error(`Portainer ${path}: ${res.status} ${await res.text()}`);
+    return res.json() as Promise<T>;
+  }
+
+  /** The environments (endpoints) Portainer manages — each a Docker host or cluster it talks to. */
+  async listEndpoints(): Promise<PortainerEndpoint[]> {
+    const raw = await this.get<any[]>("/api/endpoints");
+    return (raw ?? []).map((e) => ({
+      id: e.Id,
+      name: e.Name,
+      type: e.Type,
+      url: e.URL,
+      status: e.Status,
+    }));
+  }
+
+  /** The stacks (compose/swarm deployments) Portainer knows about. */
+  async listStacks(): Promise<PortainerStack[]> {
+    const raw = await this.get<any[]>("/api/stacks");
+    return (raw ?? []).map((s) => ({
+      id: s.Id,
+      name: s.Name,
+      type: s.Type,
+      endpointId: s.EndpointId,
+      status: s.Status,
+    }));
+  }
+
+  /**
+   * The containers on one endpoint, read through Portainer's Docker API proxy. Includes stopped
+   * containers, so the caller sees the whole picture rather than only what is running.
+   */
+  async listContainers(endpointId: number): Promise<PortainerContainer[]> {
+    const raw = await this.get<any[]>(`/api/endpoints/${endpointId}/docker/containers/json?all=1`);
+    return (raw ?? []).map((c) => ({
+      id: c.Id,
+      names: c.Names ?? [],
+      image: c.Image,
+      state: c.State,
+      status: c.Status,
+    }));
+  }
+}

modules/portainer/package.json

@@ -0,0 +1,14 @@
+{
+  "name": "@novox/module-portainer",
+  "version": "0.1.0",
+  "description": "portainer — container management UI. Its API client and tools live here (novox/hq ADR 0044).",
+  "type": "module",
+  "private": true,
+  "dependencies": {
+    "@novox/mesh-sdk": "^0.1.0"
+  },
+  "devDependencies": {
+    "@types/node": "^22.0.0",
+    "typescript": "^5.6.0"
+  }
+}

modules/portainer/tools/index.ts

@@ -0,0 +1,50 @@
+// portainer's tools — its own code (novox/hq ADR 0044), importing portainer's own client. They
+// return structured data; the mesh serves them through the sdk's tool harness. portainer is
+// tools-only (no events entrypoint): a container starting or stopping is the host's signal to emit,
+// not Portainer's to re-announce.
+
+import { registerModuleTools, type ToolDefinition } from "@novox/mesh-sdk/tools";
+import { PortainerClient } from "../client.js";
+
+export function getPortainerTools(portainer: PortainerClient): ToolDefinition[] {
+  return [
+    {
+      name: "portainer_endpoints",
+      description: "List the environments (endpoints) Portainer manages — each a Docker host or cluster.",
+      input: {},
+      run: async () => {
+        const endpoints = await portainer.listEndpoints();
+        return { count: endpoints.length, endpoints };
+      },
+    },
+    {
+      name: "portainer_stacks",
+      description: "List the stacks (compose/swarm deployments) Portainer knows about.",
+      input: {},
+      run: async () => {
+        const stacks = await portainer.listStacks();
+        return { count: stacks.length, stacks };
+      },
+    },
+    {
+      name: "portainer_containers",
+      description: "List the containers on one Portainer endpoint, including stopped ones.",
+      input: { endpoint: { type: "number", description: "the endpoint id (see portainer_endpoints)" } },
+      run: async (args) => {
+        const endpointId = Number(args.endpoint);
+        const containers = await portainer.listContainers(endpointId);
+        return { endpointId, count: containers.length, containers };
+      },
+    },
+  ];
+}
+
+// The tools exist only when a token is configured; without one, portainer contributes none rather
+// than failing the whole runtime.
+registerModuleTools("portainer", (env) => {
+  try {
+    return getPortainerTools(PortainerClient.fromEnv(env));
+  } catch {
+    return [];
+  }
+});

modules/portainer/tsconfig.json

@@ -0,0 +1,12 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "NodeNext",
+    "moduleResolution": "NodeNext",
+    "strict": true,
+    "esModuleInterop": true,
+    "skipLibCheck": true,
+    "noEmit": true
+  },
+  "include": ["client.ts", "tools/index.ts"]
+}