Merge pull request 'route-proxy README: the node that runs a proxy carries public-acme (hq #258)' (#208) from docs/route-proxy-carries-public-acme into main

The same split lost them the other way round: the merge base held both changes, each branch had reset
the other's files, and the three-way merge kept neither. Both halves of hq ADR 0161 are on main again
with this.

modules/anthropic-consumer/module.json

@@ -9,13 +9,13 @@
     "model-access"
   ],
   "binds": {
-    "model-access": "/var/lib/anthropic-consumer/model.json"
+    "model-access": "${dir:state}/model.json"
   },
   "secrets": {
-    "model-access": "/var/lib/anthropic-consumer/access-token"
+    "model-access": "${dir:state}/access-token"
   },
   "own-secrets": {
-    "broker": "/var/lib/mesh/anthropic-consumer/broker"
+    "broker": "${dir:mesh-state}/broker"
   },
   "emits": [
     "usage.session"
@@ -24,14 +24,14 @@
     {
       "id": "mesh-state",
       "type": "directory",
-      "path": "/var/lib/mesh/anthropic-consumer",
-      "mode": "0700"
+      "mode": "0700",
+      "place": "mesh"
     },
     {
       "id": "state",
       "type": "directory",
-      "path": "/var/lib/anthropic-consumer",
-      "mode": "0700"
+      "mode": "0700",
+      "place": "."
     },
     {
       "id": "claude-home",
@@ -42,7 +42,6 @@
     {
       "id": "out",
       "type": "directory",
-      "path": "/var/lib/anthropic-consumer/out",
       "mode": "0700"
     },
     {
@@ -56,7 +55,7 @@
         "/app/modules/anthropic-consumer/dist/apply/index.js"
       ],
       "volumes": [
-        "/var/lib/anthropic-consumer:/run/state"
+        "${dir:state}:/run/state"
       ],
       "env": {
         "MESH_MODEL_ACCESS_SECRET_FILE": "/run/state/access-token",
@@ -77,8 +76,8 @@
         "/app/modules/anthropic-consumer/dist/usage/index.js"
       ],
       "volumes": [
-        "/var/lib/mesh/anthropic-consumer/broker:/run/secrets/broker:ro",
-        "/var/lib/anthropic-consumer:/run/state"
+        "${dir:mesh-state}/broker:/run/secrets/broker:ro",
+        "${dir:state}:/run/state"
       ],
       "env": {
         "MESH_BROKER_FILE": "/run/secrets/broker",

modules/anthropic-manager/module.json

@@ -9,13 +9,13 @@
     "model-access"
   ],
   "binds": {
-    "model-access": "/var/lib/mesh/anthropic-manager/model.json"
+    "model-access": "${dir:mesh-state}/model.json"
   },
   "secrets": {
-    "model-access": "/var/lib/mesh/anthropic-manager/refresh-token"
+    "model-access": "${dir:mesh-state}/refresh-token"
   },
   "own-secrets": {
-    "broker": "/var/lib/mesh/anthropic-manager/broker"
+    "broker": "${dir:mesh-state}/broker"
   },
   "emits": [
     "usage.read"
@@ -24,13 +24,13 @@
     {
       "id": "mesh-state",
       "type": "directory",
-      "path": "/var/lib/mesh/anthropic-manager",
-      "mode": "0700"
+      "mode": "0700",
+      "place": "mesh"
     },
     {
       "id": "out",
       "type": "directory",
-      "path": "/var/lib/mesh/anthropic-manager/out",
+      "path": "${dir:mesh-state}/out",
       "mode": "0700"
     },
     {
@@ -45,8 +45,8 @@
         "/app/modules/anthropic-manager/dist/refresh/index.js"
       ],
       "volumes": [
-        "/var/lib/mesh/anthropic-manager/broker:/run/secrets/broker:ro",
-        "/var/lib/mesh/anthropic-manager:/run/state"
+        "${dir:mesh-state}/broker:/run/secrets/broker:ro",
+        "${dir:mesh-state}:/run/state"
       ],
       "env": {
         "MESH_BROKER_FILE": "/run/secrets/broker",

modules/audit-logger/module.json

@@ -6,7 +6,7 @@
     "**"
   ],
   "own-secrets": {
-    "broker": "/var/lib/audit-logger/broker"
+    "broker": "${dir:state}/broker"
   },
   "build": {
     "on": [
@@ -33,13 +33,12 @@
     {
       "id": "state",
       "type": "directory",
-      "path": "/var/lib/audit-logger",
-      "mode": "0700"
+      "mode": "0700",
+      "place": "."
     },
     {
       "id": "trail",
       "type": "directory",
-      "path": "/var/lib/audit-logger/trail",
       "mode": "0700"
     },
     {
@@ -48,8 +47,8 @@
       "name": "mesh-audit-logger",
       "network": "host",
       "volumes": [
-        "/var/lib/audit-logger/broker:/run/secrets/broker:ro",
-        "/var/lib/audit-logger/trail:/trail"
+        "${dir:state}/broker:/run/secrets/broker:ro",
+        "${dir:trail}:/trail"
       ],
       "env": {
         "MESH_BROKER_FILE": "/run/secrets/broker",

modules/baserow/module.json

@@ -26,7 +26,7 @@
   },
   "own-secrets": {
     "admin": "${dir:state}/admin.secret",
-    "broker": "/var/lib/mesh/baserow/broker"
+    "broker": "${dir:mesh-state}/broker"
   },
   "listens": [
     {
@@ -41,8 +41,8 @@
     {
       "id": "mesh-state",
       "type": "directory",
-      "path": "/var/lib/mesh/baserow",
-      "mode": "0700"
+      "mode": "0700",
+      "place": "mesh"
     },
     {
       "id": "state",
@@ -88,7 +88,7 @@
     {
       "id": "runtime-config",
       "type": "file",
-      "path": "/var/lib/mesh/baserow/config.json",
+      "path": "${dir:mesh-state}/config.json",
       "mode": "0600",
       "content": "{\n  \"password\": \"${secret:admin}\",\n  \"host\": \"${bound:route:name}\"\n}\n",
       "merge": "json"
@@ -99,8 +99,8 @@
       "name": "mesh-baserow",
       "network": "baserow",
       "volumes": [
-        "/var/lib/mesh/baserow/broker:/run/secrets/broker:ro",
-        "/var/lib/mesh/baserow/config.json:/run/config/config.json:ro"
+        "${dir:mesh-state}/broker:/run/secrets/broker:ro",
+        "${dir:mesh-state}/config.json:/run/config/config.json:ro"
       ],
       "env": {
         "MESH_BROKER_FILE": "/run/secrets/broker",

modules/bazarr/Dockerfile

@@ -1,24 +0,0 @@
-# bazarr's runtime: the tool runtime, carrying this module's compiled code.
-#
-# **Built from this module's own directory and nothing else.** The sdk and the tool runtime are in
-# the base images, published like any other artifact — which is what makes this buildable by the
-# mesh from a repository and a path (novox/hq ADR 0069) rather than only on a workstation that
-# happens to have the siblings.
-#
-# Two bases, named rather than pinned (novox/hq issue 044): the image this is COMPILED in and the
-# image it RUNS in — the second must not carry a compiler. Declared in module.json's `build.on`.
-ARG BUILD_BASE
-ARG RUNTIME_BASE
-
-FROM ${BUILD_BASE} AS build
-WORKDIR /app/modules/bazarr
-COPY . .
-RUN node /app/node_modules/typescript/bin/tsc client.ts index.ts tools/index.ts \
-      --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist
-
-FROM ${RUNTIME_BASE}
-COPY --from=build /app/modules/bazarr/dist /app/modules/bazarr/dist
-# Every serve-time entrypoint, loaded by the runtime in serve mode: tools and events serve, and a
-# provider's provisioner runs its reconcile loop in the same process, with the broker connected —
-# the convention novox/hq issues 060/061 settled.
-ENV MESH_TOOL_MODULES=/app/modules/bazarr/dist/index.js,/app/modules/bazarr/dist/tools/index.js

modules/bazarr/client.ts

@@ -1,173 +0,0 @@
-// The Bazarr API client — bazarr's own code, living in the module (novox/hq ADR 0039). Bazarr
-// manages subtitles for a Sonarr/Radarr library: it tracks which episodes and movies are still
-// missing subtitles, searches providers for them, and records what it downloaded. This client
-// talks its /api surface (keyed by an X-API-KEY header); bazarr's tools and events import it.
-
-import { readFileSync } from "node:fs";
-
-export interface WantedSubtitle {
-  kind: "episode" | "movie";
-  title: string; // series + episode, or movie title
-  path?: string;
-  seriesId?: number; // sonarr series id (episodes)
-  episodeId?: number; // sonarr episode id (episodes)
-  radarrId?: number; // radarr movie id (movies)
-  missing: string[]; // language names still missing
-}
-
-export interface ProviderSubtitle {
-  provider: string;
-  language: string;
-  hearingImpaired: boolean;
-  forced: boolean;
-  score?: number;
-  release?: string;
-  subtitle: string; // the opaque token Bazarr uses to download this exact result
-}
-
-export interface HistoryEntry {
-  kind: "episode" | "movie";
-  id: string; // stable dedup key across polls
-  title: string;
-  language?: string;
-  provider?: string;
-  path?: string;
-  timestamp?: string;
-  description?: string;
-}
-
-/** The settings-merged config the mesh delivers (novox/hq ADR 0046): { url, apiKey, token, password, user, ... }. */
-function meshConfig(file?: string): Record<string, string> {
-  if (!file) return {};
-  try { return JSON.parse(readFileSync(file, "utf8")) as Record<string, string>; }
-  catch { return {}; }
-}
-
-/** Read a secret the mesh mounted at a file path (an own-secret delivered by `secret accept`);
- *  absent or unreadable yields undefined so callers fall back rather than crash. */
-function readSecret(file?: string): string | undefined {
-  if (!file) return undefined;
-  try { return readFileSync(file, "utf8").trim(); }
-  catch { return undefined; }
-}
-
-export class BazarrClient {
-  readonly baseUrl: string;
-
-  constructor(
-    url: string,
-    private readonly apiKey: string,
-  ) {
-    this.baseUrl = url.replace(/\/$/, "");
-  }
-
-  /** Build from the module's resolved environment. Bazarr's API is keyed; without URL and key
-   *  there is nothing to talk to, so this throws rather than run half-configured. */
-  static fromEnv(env: NodeJS.ProcessEnv = process.env): BazarrClient {
-    const cfg = meshConfig(env.MESH_BAZARR_CONFIG_FILE);
-    const url = cfg.url ?? env.MESH_BAZARR_URL;
-    const apiKey = cfg.apiKey ?? readSecret(env.MESH_BAZARR_API_KEY_FILE) ?? env.MESH_BAZARR_API_KEY;
-    if (!url) throw new Error("no Bazarr URL — set MESH_BAZARR_URL");
-    if (!apiKey) throw new Error("no Bazarr API key — set MESH_BAZARR_API_KEY");
-    return new BazarrClient(url, apiKey);
-  }
-
-  private async request(method: string, path: string, params: Record<string, string> = {}): Promise<any> {
-    const url = new URL(`${this.baseUrl}/api${path}`);
-    for (const [k, v] of Object.entries(params)) url.searchParams.set(k, v);
-    const res = await fetch(url.toString(), { method, headers: { "X-API-KEY": this.apiKey, Accept: "application/json" } });
-    if (!res.ok) throw new Error(`Bazarr API ${method} ${path}: ${res.status} ${await res.text()}`);
-    // Downloads/patches return an empty body; only GETs carry JSON.
-    const text = await res.text();
-    return text ? JSON.parse(text) : {};
-  }
-
-  private get(path: string, params?: Record<string, string>): Promise<any> {
-    return this.request("GET", path, params);
-  }
-
-  private languageNames(missing: any[]): string[] {
-    return (missing ?? []).map((m: any) => m?.name ?? m?.code2 ?? m?.code3).filter(Boolean);
-  }
-
-  /** Episodes and movies still missing subtitles — Bazarr's core "what's left to do" list. */
-  async getWanted(limit = 50): Promise<WantedSubtitle[]> {
-    const [eps, movies] = await Promise.all([
-      this.get("/episodes/wanted", { start: "0", length: String(limit) }),
-      this.get("/movies/wanted", { start: "0", length: String(limit) }),
-    ]);
-    const episodes: WantedSubtitle[] = (eps?.data ?? []).map((e: any) => ({
-      kind: "episode" as const,
-      title: `${e.seriesTitle ?? e.series ?? "Unknown"} — ${e.episodeTitle ?? e.episode_title ?? ""}`.trim(),
-      path: e.path,
-      seriesId: e.sonarrSeriesId,
-      episodeId: e.sonarrEpisodeId,
-      missing: this.languageNames(e.missing_subtitles),
-    }));
-    const films: WantedSubtitle[] = (movies?.data ?? []).map((m: any) => ({
-      kind: "movie" as const,
-      title: m.title ?? "Unknown",
-      path: m.path,
-      radarrId: m.radarrId,
-      missing: this.languageNames(m.missing_subtitles),
-    }));
-    return [...episodes, ...films];
-  }
-
-  /** Ask providers what subtitles are available for one wanted episode — a manual search. */
-  async searchEpisode(episodeId: number): Promise<ProviderSubtitle[]> {
-    const raw = await this.get("/providers/episodes", { episodeid: String(episodeId) });
-    return this.mapProviderResults(raw);
-  }
-
-  /** Ask providers what subtitles are available for one movie — a manual search. */
-  async searchMovie(radarrId: number): Promise<ProviderSubtitle[]> {
-    const raw = await this.get("/providers/movies", { radarrid: String(radarrId) });
-    return this.mapProviderResults(raw);
-  }
-
-  private mapProviderResults(raw: any): ProviderSubtitle[] {
-    const list = Array.isArray(raw) ? raw : (raw?.data ?? []);
-    return list.map((r: any) => ({
-      provider: r.provider,
-      language: r.language?.name ?? r.language ?? "unknown",
-      hearingImpaired: Boolean(r.hearing_impaired ?? r.hi),
-      forced: Boolean(r.forced),
-      score: r.score,
-      release: r.release_info?.[0] ?? r.release_info,
-      subtitle: r.subtitle,
-    }));
-  }
-
-  /** Recent subtitle-download history, episodes and movies together, newest first. Each entry
-   *  carries a stable id so the events poller can tell a fresh download from one already seen. */
-  async getHistory(limit = 40): Promise<HistoryEntry[]> {
-    const [eps, movies] = await Promise.all([
-      this.get("/episodes/history", { start: "0", length: String(limit) }),
-      this.get("/movies/history", { start: "0", length: String(limit) }),
-    ]);
-    const key = (kind: string, r: any): string =>
-      `${kind}:${r.timestamp ?? r.parsed_timestamp ?? ""}:${r.subtitles_path ?? r.path ?? ""}:${r.language?.code3 ?? r.language ?? ""}`;
-    const episodes: HistoryEntry[] = (eps?.data ?? []).map((r: any) => ({
-      kind: "episode" as const,
-      id: key("episode", r),
-      title: `${r.seriesTitle ?? "Unknown"} — ${r.episodeTitle ?? ""}`.trim(),
-      language: r.language?.name ?? r.language,
-      provider: r.provider,
-      path: r.subtitles_path,
-      timestamp: r.timestamp,
-      description: r.description,
-    }));
-    const films: HistoryEntry[] = (movies?.data ?? []).map((r: any) => ({
-      kind: "movie" as const,
-      id: key("movie", r),
-      title: r.title ?? "Unknown",
-      language: r.language?.name ?? r.language,
-      provider: r.provider,
-      path: r.subtitles_path,
-      timestamp: r.timestamp,
-      description: r.description,
-    }));
-    return [...episodes, ...films];
-  }
-}

modules/bazarr/index.ts

@@ -1,47 +0,0 @@
-// bazarr's events. The tool runtime imports this once the broker is bound. Bazarr's one genuinely
-// observable thing is a subtitle arriving: it works away in the background, searching providers for
-// the missing-subtitle list, and when it succeeds a subtitle appears in its history. That is worth
-// announcing to the mesh.
-//
-// Emits (novox/hq ADR 0041/0042):
-//   module.bazarr.subtitle.downloaded   — a subtitle was fetched for an episode or movie
-//
-// Bazarr has nothing on the mesh it usefully reacts to (a download completing is Sonarr/Radarr's
-// business, and they trigger Bazarr directly), so it consumes nothing — a pure emitter.
-//
-// The event is observation-based: poll history and diff. Primed silently on the first look, or a
-// restart would re-announce the whole recent history as freshly downloaded.
-
-import { emit } from "@novox/mesh-sdk/events";
-import { BazarrClient } from "./client.js";
-
-const bazarr = BazarrClient.fromEnv();
-
-const seen = new Set<string>();
-let primed = false;
-async function pollHistory(): Promise<void> {
-  const entries = await bazarr.getHistory(40);
-  for (const entry of entries) {
-    if (seen.has(entry.id)) continue;
-    if (primed) {
-      await emit("subtitle.downloaded", {
-        kind: entry.kind,
-        title: entry.title,
-        language: entry.language,
-        provider: entry.provider,
-        path: entry.path,
-      });
-    }
-    seen.add(entry.id);
-  }
-  primed = true;
-}
-
-const tick = (fn: () => Promise<void>, everyMs: number): void => {
-  const run = (): void => void fn().catch((err) => console.error(`[bazarr] ${err}`));
-  setInterval(run, everyMs);
-  run();
-};
-tick(pollHistory, 60_000);
-
-console.log("[bazarr] watching subtitle-download history");

modules/bazarr/module.json

@@ -1,141 +0,0 @@
-{
-  "module": "bazarr",
-  "version": "1",
-  "capabilities": [
-    "container-runtime"
-  ],
-  "emits": [
-    "subtitle.downloaded"
-  ],
-  "own-secrets": {
-    "broker": "/var/lib/mesh/bazarr/broker",
-    "api-key": "/var/lib/mesh/bazarr/api-key"
-  },
-  "listens": [
-    {
-      "name": "web",
-      "port": 6767,
-      "protocol": "tcp",
-      "from": "mesh",
-      "why": "managing subtitles"
-    }
-  ],
-  "accesses": [
-    {
-      "path": "/services/media/movies",
-      "mode": "read-write"
-    },
-    {
-      "path": "/services/media/series",
-      "mode": "read-write"
-    },
-    {
-      "path": "/services/media/anime",
-      "mode": "read-write"
-    },
-    {
-      "path": "/services/media/downloads",
-      "mode": "read"
-    }
-  ],
-  "resources": [
-    {
-      "id": "mesh-state",
-      "type": "directory",
-      "path": "/var/lib/mesh/bazarr",
-      "mode": "0700"
-    },
-    {
-      "id": "config",
-      "type": "directory",
-      "path": "/services/bazarr/config",
-      "mode": "0700",
-      "owner": "1000:1000"
-    },
-    {
-      "id": "server",
-      "type": "container",
-      "name": "bazarr",
-      "image": "lscr.io/linuxserver/bazarr@sha256:3a820372f19fcb2981ea19fe4b5382934d67414afaba974bce831ddda0a64a02",
-      "env": {
-        "PUID": "1000",
-        "PGID": "1000",
-        "TZ": "Etc/UTC"
-      },
-      "ports": [
-        "6767"
-      ],
-      "volumes": [
-        "/services/bazarr/config:/config",
-        "/services/media/movies:/movies",
-        "/services/media/series:/series",
-        "/services/media/anime:/anime",
-        "/services/media/downloads:/downloads"
-      ]
-    },
-    {
-      "id": "runtime-config",
-      "type": "file",
-      "path": "/var/lib/mesh/bazarr/config.json",
-      "mode": "0600",
-      "content": "{}\n",
-      "merge": "json"
-    },
-    {
-      "id": "runtime",
-      "type": "container",
-      "name": "mesh-bazarr",
-      "network": "host",
-      "volumes": [
-        "/var/lib/mesh/bazarr/broker:/run/secrets/broker:ro",
-        "/var/lib/mesh/bazarr/api-key:/run/secrets/api-key:ro",
-        "/var/lib/mesh/bazarr/config.json:/run/config/config.json:ro",
-        "/services/bazarr/config:/var/lib/bazarr/config:ro"
-      ],
-      "env": {
-        "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_BAZARR_URL": "http://127.0.0.1:6767",
-        "MESH_BAZARR_API_KEY_FILE": "/run/secrets/api-key",
-        "MESH_BAZARR_CONFIG_FILE": "/run/config/config.json",
-        "MESH_BAZARR_CONFIG_DIR": "/var/lib/bazarr/config"
-      },
-      "restart-on": [
-        "runtime-config"
-      ],
-      "artifact": "runtime"
-    }
-  ],
-  "requires": [
-    "route"
-  ],
-  "contributes": {
-    "route": {
-      "label": "subs",
-      "endpoint": "web"
-    }
-  },
-  "binds": {
-    "route": "/var/lib/mesh/bazarr/route.json"
-  },
-  "build": {
-    "on": [
-      {
-        "arg": "BUILD_BASE",
-        "module": "mesh-tools",
-        "artifact": "build"
-      },
-      {
-        "arg": "RUNTIME_BASE",
-        "module": "mesh-tools",
-        "artifact": "runtime"
-      }
-    ],
-    "artifacts": [
-      {
-        "name": "runtime",
-        "kind": "image",
-        "from": "Dockerfile"
-      }
-    ]
-  }
-}

modules/bazarr/package.json

@@ -1,14 +0,0 @@
-{
-  "name": "@novox/module-bazarr",
-  "version": "0.1.0",
-  "description": "bazarr — subtitle management. Its API client, tools and events live here (novox/hq ADR 0039).",
-  "type": "module",
-  "private": true,
-  "dependencies": {
-    "@novox/mesh-sdk": "^0.1.0"
-  },
-  "devDependencies": {
-    "@types/node": "^22.0.0",
-    "typescript": "^5.6.0"
-  }
-}

modules/bazarr/tools/index.ts

@@ -1,57 +0,0 @@
-// bazarr's tools — its own code (novox/hq ADR 0039), importing bazarr's client. They return
-// structured data; the mesh serves them through the sdk's tool harness.
-
-import { registerModuleTools, type ToolDefinition } from "@novox/mesh-sdk/tools";
-import { BazarrClient } from "../client.js";
-
-export function getBazarrTools(bazarr: BazarrClient): ToolDefinition[] {
-  return [
-    {
-      name: "bazarr_wanted",
-      description: "Episodes and movies still missing subtitles, with the languages each still needs.",
-      input: { limit: { type: "number", description: "max items per kind (default 50)" } },
-      run: async (args) => {
-        const wanted = await bazarr.getWanted(args.limit ? Number(args.limit) : 50);
-        return { count: wanted.length, wanted };
-      },
-    },
-    {
-      name: "bazarr_search_subtitles",
-      description: "Manually search subtitle providers for one wanted item — pass an episodeId or a radarrId.",
-      input: {
-        episodeId: { type: "number", description: "a Sonarr episode id (from bazarr_wanted)" },
-        radarrId: { type: "number", description: "a Radarr movie id (from bazarr_wanted)" },
-      },
-      run: async (args) => {
-        if (args.episodeId !== undefined) {
-          const results = await bazarr.searchEpisode(Number(args.episodeId));
-          return { kind: "episode", episodeId: Number(args.episodeId), count: results.length, results };
-        }
-        if (args.radarrId !== undefined) {
-          const results = await bazarr.searchMovie(Number(args.radarrId));
-          return { kind: "movie", radarrId: Number(args.radarrId), count: results.length, results };
-        }
-        throw new Error("pass either episodeId or radarrId");
-      },
-    },
-    {
-      name: "bazarr_history",
-      description: "Recent subtitle-download history — what was downloaded, for which title, from which provider.",
-      input: { limit: { type: "number", description: "max entries per kind (default 40)" } },
-      run: async (args) => {
-        const history = await bazarr.getHistory(args.limit ? Number(args.limit) : 40);
-        return { count: history.length, history };
-      },
-    },
-  ];
-}
-
-// Exposed only when Bazarr is configured; otherwise bazarr contributes no tools rather than
-// failing the whole runtime.
-registerModuleTools("bazarr", (env) => {
-  try {
-    return getBazarrTools(BazarrClient.fromEnv(env));
-  } catch {
-    return [];
-  }
-});

modules/bazarr/tsconfig.json

@@ -1,12 +0,0 @@
-{
-  "compilerOptions": {
-    "target": "ES2022",
-    "module": "NodeNext",
-    "moduleResolution": "NodeNext",
-    "strict": true,
-    "esModuleInterop": true,
-    "skipLibCheck": true,
-    "noEmit": true
-  },
-  "include": ["client.ts", "index.ts", "tools/index.ts"]
-}

modules/bookshelf/Dockerfile

@@ -1,24 +0,0 @@
-# bookshelf's runtime: the tool runtime, carrying this module's compiled code.
-#
-# **Built from this module's own directory and nothing else.** The sdk and the tool runtime are in
-# the base images, published like any other artifact — which is what makes this buildable by the
-# mesh from a repository and a path (novox/hq ADR 0069) rather than only on a workstation that
-# happens to have the siblings.
-#
-# Two bases, named rather than pinned (novox/hq issue 044): the image this is COMPILED in and the
-# image it RUNS in — the second must not carry a compiler. Declared in module.json's `build.on`.
-ARG BUILD_BASE
-ARG RUNTIME_BASE
-
-FROM ${BUILD_BASE} AS build
-WORKDIR /app/modules/bookshelf
-COPY . .
-RUN node /app/node_modules/typescript/bin/tsc client.ts index.ts tools/index.ts \
-      --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist
-
-FROM ${RUNTIME_BASE}
-COPY --from=build /app/modules/bookshelf/dist /app/modules/bookshelf/dist
-# Every serve-time entrypoint, loaded by the runtime in serve mode: tools and events serve, and a
-# provider's provisioner runs its reconcile loop in the same process, with the broker connected —
-# the convention novox/hq issues 060/061 settled.
-ENV MESH_TOOL_MODULES=/app/modules/bookshelf/dist/index.js,/app/modules/bookshelf/dist/tools/index.js

modules/bookshelf/client.ts

@@ -1,136 +0,0 @@
-// The Bookshelf API client — bookshelf's own code, living in the module (novox/hq ADR 0039).
-// Ported from the shared hal `arr` client, but self-contained: in nox each Servarr app owns its own
-// copy, so a change to Bookshelf's API rebuilds only bookshelf and nothing else. Both this module's
-// tools and its events entrypoint import it, and nothing outside bookshelf does.
-//
-// Bookshelf is a Readarr fork (ghcr.io/pennydreadful/bookshelf). It speaks the Servarr v1 API; its
-// content is "book". Unlike Sonarr/Radarr it exposes no calendar endpoint, so there is no calendar
-// tool here — matching hal, which excluded bookshelf from its calendar-capable apps.
-
-import { existsSync, readFileSync } from "node:fs";
-import { join } from "node:path";
-
-// Bookshelf speaks the v1 API; its content is "book".
-const API_VERSION = "v1";
-const CONTENT_ENDPOINT = "book";
-const APP_NAME = "Bookshelf";
-
-export interface BookshelfQueueItem {
-  /** The queue record id — stable while the item is in the queue, so events can diff on it. */
-  id: number;
-  title: string;
-  status: string;
-  size: string;
-  sizeleft: string;
-  timeleft?: string;
-}
-
-export interface BookshelfContentItem {
-  title: string;
-  author?: string;
-  year?: number;
-  status?: string;
-  monitored: boolean;
-}
-
-export class BookshelfClient {
-  readonly baseUrl: string;
-
-  constructor(
-    url: string,
-    private readonly apiKey: string,
-  ) {
-    this.baseUrl = url.replace(/\/$/, "");
-  }
-
-  /**
-   * Build from the module's resolved environment. The URL defaults to the server on this node (the
-   * runtime shares its network), and the API key is read from MESH_BOOKSHELF_API_KEY or, failing
-   * that, discovered from the server's own config.xml under MESH_BOOKSHELF_CONFIG_DIR — the same
-   * file Bookshelf writes it to, so a running server needs nothing configured by hand. Throws when
-   * no key can be found, so the tools/events simply do not load (the harness treats the throw as
-   * "exposes nothing").
-   */
-  static fromEnv(env: NodeJS.ProcessEnv = process.env): BookshelfClient {
-    const url = env.MESH_BOOKSHELF_URL ?? `http://127.0.0.1:${env.MESH_BOOKSHELF_PORT ?? "8787"}`;
-    const configDir = env.MESH_BOOKSHELF_CONFIG_DIR ?? "/config";
-    const apiKey = env.MESH_BOOKSHELF_API_KEY ?? BookshelfClient.detectApiKey(configDir);
-    if (!apiKey) {
-      throw new Error("Bookshelf not configured — set MESH_BOOKSHELF_API_KEY or make the config dir readable");
-    }
-    return new BookshelfClient(url, apiKey);
-  }
-
-  /** Discover the API key from the server's config.xml, falling back to null. Every Servarr app
-   *  writes <ApiKey> into config.xml at the root of its config directory. */
-  static detectApiKey(configDir: string): string | null {
-    const config = join(configDir, "config.xml");
-    if (existsSync(config)) {
-      const match = readFileSync(config, "utf8").match(/<ApiKey>([^<]+)<\/ApiKey>/);
-      if (match) return match[1];
-    }
-    return null;
-  }
-
-  private async get(endpoint: string, params?: Record<string, string>): Promise<unknown> {
-    const url = new URL(`${this.baseUrl}/api/${API_VERSION}/${endpoint}`);
-    if (params) {
-      for (const [k, v] of Object.entries(params)) url.searchParams.set(k, v);
-    }
-    const res = await fetch(url.toString(), { headers: { "X-Api-Key": this.apiKey } });
-    if (!res.ok) throw new Error(`${APP_NAME} API /${endpoint}: ${res.status} ${await res.text()}`);
-    return res.json();
-  }
-
-  async getStatus(): Promise<{ appName: string; version: string }> {
-    const data = (await this.get("system/status")) as { appName?: string; version?: string };
-    return { appName: data.appName || APP_NAME, version: data.version ?? "unknown" };
-  }
-
-  async getContent(limit?: number): Promise<BookshelfContentItem[]> {
-    const data = await this.get(CONTENT_ENDPOINT);
-    const items: any[] = Array.isArray(data) ? data : ((data as any)?.records ?? []);
-    const mapped = items.map((item) => ({
-      title: item.title ?? "Unknown",
-      author: item.author?.authorName ?? item.authorName,
-      year: item.releaseDate ? new Date(item.releaseDate).getFullYear() : item.year,
-      status: item.status,
-      monitored: item.monitored ?? true,
-    }));
-    return limit ? mapped.slice(0, limit) : mapped;
-  }
-
-  /** Library search is a filter over existing content, not an indexer lookup — same as hal's. */
-  async searchContent(term: string): Promise<BookshelfContentItem[]> {
-    const all = await this.getContent();
-    const lower = term.toLowerCase();
-    return all.filter(
-      (item) =>
-        item.title.toLowerCase().includes(lower) ||
-        (item.author?.toLowerCase().includes(lower) ?? false),
-    );
-  }
-
-  async getQueue(): Promise<{ totalRecords: number; items: BookshelfQueueItem[] }> {
-    const data = (await this.get("queue", { pageSize: "50" })) as { totalRecords?: number; records?: any[] };
-    const records = data.records ?? [];
-    return {
-      totalRecords: data.totalRecords ?? records.length,
-      items: records.map((r) => ({
-        id: r.id,
-        title: r.title ?? r.book?.title ?? r.author?.authorName ?? "Unknown",
-        status: r.status ?? "unknown",
-        size: formatBytes(r.size ?? 0),
-        sizeleft: formatBytes(r.sizeleft ?? 0),
-        timeleft: r.timeleft,
-      })),
-    };
-  }
-}
-
-function formatBytes(bytes: number): string {
-  if (bytes === 0) return "0 B";
-  const units = ["B", "KB", "MB", "GB", "TB"];
-  const i = Math.floor(Math.log(bytes) / Math.log(1024));
-  return `${(bytes / Math.pow(1024, i)).toFixed(1)} ${units[i]}`;
-}

modules/bookshelf/index.ts

@@ -1,74 +0,0 @@
-// bookshelf's events. The tool runtime imports this once the broker is bound. It watches the
-// download queue and turns its comings and goings into mesh events — the same mechanism radarr uses,
-// applied to a Servarr book manager.
-//
-// Emits (novox/hq ADR 0041/0042):
-//   module.bookshelf.book.grabbed        — a release entered the queue (Bookshelf grabbed it)
-//   module.bookshelf.download.completed  — a release left the queue, imported. This routing key is
-//                                          what the plex module consumes (module.*.download.completed)
-//                                          to rescan, so a new audiobook becomes a visible item.
-// Consumes: none.
-//
-// NOTE: the hal bookshelf module emitted no events (its hooks only did install-time provisioning).
-// This queue watcher is new in nox, modelled exactly on radarr's — bookshelf is a Servarr app with
-// the same queue semantics, so the diff-and-emit pattern carries over unchanged.
-//
-// The queue is polled and diffed, primed silently on the first look (like plex's index.ts) so a
-// restart mid-download does not re-announce everything already in flight as freshly grabbed.
-
-import { emit } from "@novox/mesh-sdk/events";
-import { BookshelfClient, type BookshelfQueueItem } from "./client.js";
-
-// Building the client throws when Bookshelf has no URL/key yet. Like the tools (see tools/index.ts),
-// the events entrypoint must not crash the runtime for that — it stays idle until configured.
-function buildClient(): BookshelfClient | null {
-  try {
-    return BookshelfClient.fromEnv();
-  } catch {
-    return null;
-  }
-}
-
-const bookshelf = buildClient();
-
-// Bookshelf removes an item from the queue once it has been imported; a "warning"/"failed" status is
-// how a stuck or broken grab shows itself, so we do not call those a completion when they vanish.
-const FAILED_STATUSES = new Set(["failed", "warning"]);
-
-const inQueue = new Map<number, BookshelfQueueItem>();
-let primed = false;
-
-async function pollQueue(bookshelf: BookshelfClient): Promise<void> {
-  const { items } = await bookshelf.getQueue();
-  const now = new Map(items.map((i) => [i.id, i]));
-
-  if (primed) {
-    // Entered the queue since last look — Bookshelf grabbed a release.
-    for (const [id, item] of now) {
-      if (!inQueue.has(id)) await emit("book.grabbed", { title: item.title, status: item.status });
-    }
-    // Left the queue — imported and done, unless it was last seen failing.
-    for (const [id, item] of inQueue) {
-      if (!now.has(id) && !FAILED_STATUSES.has(item.status)) {
-        await emit("download.completed", { title: item.title });
-      }
-    }
-  }
-
-  inQueue.clear();
-  for (const [id, item] of now) inQueue.set(id, item);
-  primed = true;
-}
-
-const tick = (fn: () => Promise<void>, everyMs: number): void => {
-  const run = (): void => void fn().catch((err) => console.error(`[bookshelf] ${err}`));
-  setInterval(run, everyMs);
-  run();
-};
-
-if (bookshelf) {
-  tick(() => pollQueue(bookshelf), 30_000);
-  console.log("[bookshelf] watching the download queue, emitting grabs and completions");
-} else {
-  console.log("[bookshelf] not configured — events idle until an API key is available");
-}

modules/bookshelf/module.json

@@ -1,118 +0,0 @@
-{
-  "module": "bookshelf",
-  "version": "1",
-  "slug": "books",
-  "capabilities": [
-    "container-runtime"
-  ],
-  "emits": [
-    "book.grabbed",
-    "download.completed"
-  ],
-  "consumes": [],
-  "own-secrets": {
-    "broker": "/var/lib/mesh/bookshelf/broker"
-  },
-  "listens": [
-    {
-      "name": "web",
-      "port": 8787,
-      "protocol": "tcp",
-      "from": "mesh",
-      "why": "managing the ebook/audiobook library"
-    }
-  ],
-  "accesses": [
-    {
-      "path": "/services/media/books",
-      "mode": "read-write"
-    },
-    {
-      "path": "/services/media/downloads",
-      "mode": "read-write"
-    }
-  ],
-  "resources": [
-    {
-      "id": "mesh-state",
-      "type": "directory",
-      "path": "/var/lib/mesh/bookshelf",
-      "mode": "0700"
-    },
-    {
-      "id": "config",
-      "type": "directory",
-      "path": "/services/bookshelf/config",
-      "mode": "0700",
-      "owner": "1000:1000"
-    },
-    {
-      "id": "server",
-      "type": "container",
-      "name": "bookshelf",
-      "image": "ghcr.io/pennydreadful/bookshelf@sha256:388eecc94362580eae31ee0a454be6af516f8a311f8432a521c202fb475f4359",
-      "env": {
-        "PUID": "1000",
-        "PGID": "1000",
-        "TZ": "Etc/UTC"
-      },
-      "ports": [
-        "8787"
-      ],
-      "volumes": [
-        "/services/bookshelf/config:/config",
-        "/services/media/books:/books",
-        "/services/media/downloads:/downloads"
-      ]
-    },
-    {
-      "id": "runtime",
-      "type": "container",
-      "name": "mesh-bookshelf",
-      "network": "host",
-      "volumes": [
-        "/var/lib/mesh/bookshelf/broker:/run/secrets/broker:ro",
-        "/services/bookshelf/config:/var/lib/bookshelf/config:ro"
-      ],
-      "env": {
-        "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_BOOKSHELF_URL": "http://127.0.0.1:8787",
-        "MESH_BOOKSHELF_CONFIG_DIR": "/var/lib/bookshelf/config"
-      },
-      "artifact": "runtime"
-    }
-  ],
-  "requires": [
-    "route"
-  ],
-  "contributes": {
-    "route": {
-      "label": "books",
-      "endpoint": "web"
-    }
-  },
-  "binds": {
-    "route": "/var/lib/mesh/bookshelf/route.json"
-  },
-  "build": {
-    "on": [
-      {
-        "arg": "BUILD_BASE",
-        "module": "mesh-tools",
-        "artifact": "build"
-      },
-      {
-        "arg": "RUNTIME_BASE",
-        "module": "mesh-tools",
-        "artifact": "runtime"
-      }
-    ],
-    "artifacts": [
-      {
-        "name": "runtime",
-        "kind": "image",
-        "from": "Dockerfile"
-      }
-    ]
-  }
-}

modules/bookshelf/package.json

@@ -1,14 +0,0 @@
-{
-  "name": "@novox/module-bookshelf",
-  "version": "0.1.0",
-  "description": "bookshelf — ebook/audiobook management (Readarr fork). Its API client, tools and events live here (novox/hq ADR 0039).",
-  "type": "module",
-  "private": true,
-  "dependencies": {
-    "@novox/mesh-sdk": "^0.1.0"
-  },
-  "devDependencies": {
-    "@types/node": "^22.0.0",
-    "typescript": "^5.6.0"
-  }
-}

modules/bookshelf/tools/index.ts

@@ -1,69 +0,0 @@
-// bookshelf's tools — ported from the shared hal `arr` sdk (novox/hq ADR 0039), importing
-// bookshelf's own client. They return structured data (not the pre-formatted text hal returned); the
-// mesh serves them through the sdk's tool harness. Bookshelf has no calendar endpoint, so there is
-// no calendar tool — matching hal, which excluded it from its calendar-capable apps.
-
-import { registerModuleTools, type ToolDefinition } from "@novox/mesh-sdk/tools";
-import { BookshelfClient } from "../client.js";
-
-export function getBookshelfTools(bookshelf: BookshelfClient): ToolDefinition[] {
-  return [
-    {
-      name: "bookshelf_status",
-      description: "Bookshelf status overview: version, book count, monitored count, queue size.",
-      input: {},
-      run: async () => {
-        const [status, content, queue] = await Promise.all([
-          bookshelf.getStatus(),
-          bookshelf.getContent(),
-          bookshelf.getQueue(),
-        ]);
-        return {
-          app: status.appName,
-          version: status.version,
-          books: content.length,
-          monitored: content.filter((c) => c.monitored).length,
-          queue: queue.totalRecords,
-        };
-      },
-    },
-    {
-      name: "bookshelf_library",
-      description: "List books from the Bookshelf library.",
-      input: { limit: { type: "number", description: "max items to return (default 50)" } },
-      run: async (args) => {
-        const items = await bookshelf.getContent(args.limit ? Number(args.limit) : 50);
-        return { count: items.length, books: items };
-      },
-    },
-    {
-      name: "bookshelf_search",
-      description:
-        "Search the Bookshelf library for books by title or author (filters existing content, not indexers).",
-      input: { query: { type: "string", description: "the search term" } },
-      run: async (args) => {
-        const query = String(args.query);
-        return { query, results: await bookshelf.searchContent(query) };
-      },
-    },
-    {
-      name: "bookshelf_queue",
-      description: "Show the Bookshelf download queue — what is downloading and how far along.",
-      input: {},
-      run: async () => {
-        const queue = await bookshelf.getQueue();
-        return { count: queue.totalRecords, items: queue.items };
-      },
-    },
-  ];
-}
-
-// The tools exist only when Bookshelf is configured; without a URL and key, bookshelf contributes
-// none rather than failing the whole runtime.
-registerModuleTools("bookshelf", (env) => {
-  try {
-    return getBookshelfTools(BookshelfClient.fromEnv(env));
-  } catch {
-    return [];
-  }
-});

modules/bookshelf/tsconfig.json

@@ -1,12 +0,0 @@
-{
-  "compilerOptions": {
-    "target": "ES2022",
-    "module": "NodeNext",
-    "moduleResolution": "NodeNext",
-    "strict": true,
-    "esModuleInterop": true,
-    "skipLibCheck": true,
-    "noEmit": true
-  },
-  "include": ["client.ts", "index.ts", "tools/index.ts"]
-}

modules/builder/module.json

@@ -15,33 +15,32 @@
     "npm-package-registry"
   ],
   "binds": {
-    "npm-package-registry": "/var/lib/mesh/builder/package-registry.json"
+    "npm-package-registry": "${dir:mesh-state}/package-registry.json"
   },
   "secrets": {
-    "npm-package-registry": "/var/lib/mesh/builder/package-registry.secret"
+    "npm-package-registry": "${dir:mesh-state}/package-registry.secret"
   },
   "own-secrets": {
-    "broker": "/var/lib/mesh/builder/broker"
+    "broker": "${dir:mesh-state}/broker"
   },
   "resources": [
     {
       "id": "mesh-state",
       "type": "directory",
-      "path": "/var/lib/mesh/builder",
-      "mode": "0700"
+      "mode": "0700",
+      "place": "mesh"
     },
     {
       "id": "workspace",
       "type": "directory",
-      "path": "/var/lib/builder/workspace",
       "mode": "0700"
     },
     {
       "id": "builder-env",
       "type": "file",
-      "path": "/var/lib/mesh/builder/builder.env",
+      "path": "${dir:mesh-state}/builder.env",
       "mode": "0600",
-      "content": "MESH_BROKER_FILE=/run/mesh/broker\nMESH_NODE=${machine:name}\nMESH_REGISTRY=${bound:artifact-store:at}:${bound:artifact-store:port}\nMESH_PACKAGE_BINDING=/run/mesh/package-registry.json\nMESH_NPM_TOKEN_FILE=/run/mesh/package-registry.secret\nMESH_WORKSPACE=/var/lib/builder/workspace\n"
+      "content": "MESH_BROKER_FILE=/run/mesh/broker\nMESH_NODE=${machine:name}\nMESH_REGISTRY=${bound:artifact-store:at}:${bound:artifact-store:port}\nMESH_PACKAGE_BINDING=/run/mesh/package-registry.json\nMESH_NPM_TOKEN_FILE=/run/mesh/package-registry.secret\nMESH_WORKSPACE=${dir:workspace}\n"
     },
     {
       "id": "server",
@@ -49,11 +48,11 @@
       "name": "mesh-builder",
       "artifact": "server",
       "env-file": [
-        "/var/lib/mesh/builder/builder.env"
+        "${dir:mesh-state}/builder.env"
       ],
       "volumes": [
-        "/var/lib/mesh/builder:/run/mesh:ro",
-        "/var/lib/builder/workspace:/var/lib/builder/workspace",
+        "${dir:mesh-state}:/run/mesh:ro",
+        "${dir:workspace}:${dir:workspace}",
         "/var/run/docker.sock:/var/run/docker.sock"
       ],
       "restart-on": [

modules/cloudflare-dns/module.json

@@ -12,14 +12,14 @@
     "public-dns": {}
   },
   "grants": {
-    "public-dns": "/var/lib/cloudflare-dns/grants"
+    "public-dns": "${dir:grants}"
   },
   "receives": {
-    "public-dns": "/var/lib/cloudflare-dns/grants/mesh.json"
+    "public-dns": "${dir:grants}/mesh.json"
   },
   "own-secrets": {
-    "token": "/var/lib/cloudflare-dns/token",
-    "broker": "/var/lib/mesh/cloudflare-dns/broker"
+    "token": "${dir:state}/token",
+    "broker": "${dir:mesh-state}/broker"
   },
   "emits": [
     "record.created",
@@ -29,25 +29,24 @@
     {
       "id": "mesh-state",
       "type": "directory",
-      "path": "/var/lib/mesh/cloudflare-dns",
-      "mode": "0700"
+      "mode": "0700",
+      "place": "mesh"
     },
     {
       "id": "state",
       "type": "directory",
-      "path": "/var/lib/cloudflare-dns",
-      "mode": "0700"
+      "mode": "0700",
+      "place": "."
     },
     {
       "id": "grants",
       "type": "directory",
-      "path": "/var/lib/cloudflare-dns/grants",
       "mode": "0700"
     },
     {
       "id": "config",
       "type": "file",
-      "path": "/var/lib/cloudflare-dns/config.json",
+      "path": "${dir:state}/config.json",
       "merge": "json",
       "content": "{}",
       "mode": "0600"
@@ -58,10 +57,10 @@
       "name": "mesh-cloudflare-dns",
       "network": "host",
       "volumes": [
-        "/var/lib/cloudflare-dns/config.json:/run/config/config.json:ro",
-        "/var/lib/cloudflare-dns/grants:/grants",
-        "/var/lib/cloudflare-dns/token:/run/secrets/token:ro",
-        "/var/lib/mesh/cloudflare-dns/broker:/run/secrets/broker:ro"
+        "${dir:state}/config.json:/run/config/config.json:ro",
+        "${dir:grants}:/grants",
+        "${dir:state}/token:/run/secrets/token:ro",
+        "${dir:mesh-state}/broker:/run/secrets/broker:ro"
       ],
       "env": {
         "MESH_CLOUDFLARE_TOKEN_FILE": "/run/secrets/token",

modules/confluence/module.json

@@ -3,26 +3,26 @@
   "version": "1",
   "slug": "confl",
   "own-secrets": {
-    "token": "/var/lib/confluence/token",
-    "broker": "/var/lib/mesh/confluence/broker"
+    "token": "${dir:state}/token",
+    "broker": "${dir:mesh-state}/broker"
   },
   "resources": [
     {
       "id": "mesh-state",
       "type": "directory",
-      "path": "/var/lib/mesh/confluence",
-      "mode": "0700"
+      "mode": "0700",
+      "place": "mesh"
     },
     {
       "id": "state",
       "type": "directory",
-      "path": "/var/lib/confluence",
-      "mode": "0700"
+      "mode": "0700",
+      "place": "."
     },
     {
       "id": "config",
       "type": "file",
-      "path": "/var/lib/confluence/config.json",
+      "path": "${dir:state}/config.json",
       "merge": "json",
       "content": "{}",
       "mode": "0600"
@@ -33,9 +33,9 @@
       "name": "mesh-runtime-confluence",
       "network": "host",
       "volumes": [
-        "/var/lib/confluence/config.json:/run/config/config.json:ro",
-        "/var/lib/confluence/token:/run/secrets/token:ro",
-        "/var/lib/mesh/confluence/broker:/run/secrets/broker:ro"
+        "${dir:state}/config.json:/run/config/config.json:ro",
+        "${dir:state}/token:/run/secrets/token:ro",
+        "${dir:mesh-state}/broker:/run/secrets/broker:ro"
       ],
       "env": {
         "MESH_CONFLUENCE_TOKEN_FILE": "/run/secrets/token",

modules/de-spiegel/module.json

@@ -15,11 +15,11 @@
     }
   },
   "binds": {
-    "route": "/var/lib/de-spiegel/route.json"
+    "route": "${dir:state}/route.json"
   },
   "own-secrets": {
-    "smtp-user": "/var/lib/de-spiegel/smtp-user.secret",
-    "smtp-pass": "/var/lib/de-spiegel/smtp-pass.secret"
+    "smtp-user": "${dir:state}/smtp-user.secret",
+    "smtp-pass": "${dir:state}/smtp-pass.secret"
   },
   "listens": [
     {
@@ -34,13 +34,13 @@
     {
       "id": "state",
       "type": "directory",
-      "path": "/var/lib/de-spiegel",
-      "mode": "0700"
+      "mode": "0700",
+      "place": "."
     },
     {
       "id": "server-env",
       "type": "file",
-      "path": "/var/lib/de-spiegel/server.env",
+      "path": "${dir:state}/server.env",
       "mode": "0600",
       "content": "SMTP_AUTH_USER=${secret:smtp-user}\nSMTP_AUTH_PASS=${secret:smtp-pass}\n"
     },
@@ -56,7 +56,7 @@
       "image": "registry-api.novox.be/novox/de-spiegel@sha256:e144b72ce9c145870470d765343549f2c60211728cd118b9ff0e4029f36342ba",
       "network": "de-spiegel",
       "env-file": [
-        "/var/lib/de-spiegel/server.env"
+        "${dir:state}/server.env"
       ],
       "ports": [
         "35621"

modules/dhcpcd/module.json

@@ -3,7 +3,8 @@
   "version": "1",
   "capabilities": [
     "package-manager",
-    "service-manager"
+    "service-manager",
+    "uplink-dhcpcd"
   ],
   "claims": [
     {

modules/distribution/module.json

@@ -9,7 +9,7 @@
   ],
   "claims": [
     {
-      "name": "the-artifact-store",
+      "name": "mesh-artifact-store",
       "scope": "mesh"
     }
   ],

modules/dnsmasq/module.json

@@ -12,7 +12,7 @@
     "name.removed"
   ],
   "own-secrets": {
-    "broker": "/var/lib/mesh/dnsmasq/broker"
+    "broker": "${dir:mesh-state}/broker"
   },
   "claims": [
     {
@@ -42,8 +42,8 @@
     {
       "id": "mesh-state",
       "type": "directory",
-      "path": "/var/lib/mesh/dnsmasq",
-      "mode": "0700"
+      "mode": "0700",
+      "place": "mesh"
     },
     {
       "id": "package",

modules/gitea/client.ts

@@ -45,6 +45,14 @@ export interface GiteaPull {
   html_url: string;
 }
 
+export interface GiteaComment {
+  id: number;
+  user?: string;
+  body: string;
+  created_at?: string;
+  html_url: string;
+}
+
 export interface GiteaLabel {
   id: number;
   name: string;
@@ -95,6 +103,13 @@ export class GiteaClient {
     if (res.status === 401) {
       token = await this.tokens.renew(token);
       res = await this.send(path, options, token);
+    } else if (res.status === 403) {
+      // A kept token minted before a scope was added lacks it. The forge says so; the source
+      // re-mints with the whole list and the call is retried once. Any other 403 stays a 403.
+      const text = await res.text();
+      if (!MintedToken.lacksScope(res.status, text)) throw new Error(`Gitea API ${path}: 403 ${text}`);
+      token = await this.tokens.renew(token);
+      res = await this.send(path, options, token);
     }
     if (!res.ok) throw new Error(`Gitea API ${path}: ${res.status} ${await res.text()}`);
     if (res.status === 204) return null as T;
@@ -250,6 +265,64 @@ export class GiteaClient {
     );
   }
 
+  /** Close or reopen a pull request without merging it. A pull request is an issue to the forge's
+   *  state machine, and the pulls endpoint takes the same `state`. */
+  async setPullState(owner: string, repo: string, index: number, state: "open" | "closed"): Promise<GiteaPull> {
+    return GiteaClient.mapPull(
+      await this.request<any>(`/repos/${owner}/${repo}/pulls/${index}`, { method: "PATCH", body: JSON.stringify({ state }) }),
+    );
+  }
+
+  /** Change a pull request's title or body; a field left undefined is left alone. */
+  async updatePullRequest(owner: string, repo: string, index: number, data: { title?: string; body?: string }): Promise<GiteaPull> {
+    return GiteaClient.mapPull(
+      await this.request<any>(`/repos/${owner}/${repo}/pulls/${index}`, { method: "PATCH", body: JSON.stringify(data) }),
+    );
+  }
+
+  /** The unified diff of a pull request, as text. */
+  async pullDiff(owner: string, repo: string, index: number): Promise<string> {
+    return this.requestText(`/repos/${owner}/${repo}/pulls/${index}.diff`);
+  }
+
+  /** Every comment on an issue or pull request, oldest first. */
+  async listComments(owner: string, repo: string, index: number): Promise<GiteaComment[]> {
+    const raw = await this.request<any[]>(`/repos/${owner}/${repo}/issues/${index}/comments`);
+    return (raw ?? []).map((c) => ({
+      id: Number(c?.id ?? 0),
+      user: c?.user?.login,
+      body: String(c?.body ?? ""),
+      created_at: c?.created_at,
+      html_url: String(c?.html_url ?? ""),
+    }));
+  }
+
+  /** One file's contents at a ref (default the repository's default branch), decoded. */
+  async getFile(owner: string, repo: string, path: string, ref?: string): Promise<{ path: string; ref?: string; sha: string; size: number; content: string }> {
+    const qs = ref ? `?ref=${encodeURIComponent(ref)}` : "";
+    const f = await this.request<any>(`/repos/${owner}/${repo}/contents/${path.split("/").map(encodeURIComponent).join("/")}${qs}`);
+    if (!f || f.type !== "file") throw new Error(`Gitea API: ${path} is not a file`);
+    const content = f.encoding === "base64" ? Buffer.from(String(f.content ?? ""), "base64").toString("utf8") : String(f.content ?? "");
+    return { path, ref, sha: String(f.sha ?? ""), size: Number(f.size ?? content.length), content };
+  }
+
+  async listBranches(owner: string, repo: string): Promise<{ name: string; commit: string; protected: boolean }[]> {
+    const raw = await this.request<any[]>(`/repos/${owner}/${repo}/branches?limit=100`);
+    return (raw ?? []).map((b) => ({ name: String(b?.name ?? ""), commit: String(b?.commit?.id ?? ""), protected: Boolean(b?.protected) }));
+  }
+
+  async deleteBranch(owner: string, repo: string, branch: string): Promise<void> {
+    await this.request(`/repos/${owner}/${repo}/branches/${encodeURIComponent(branch)}`, { method: "DELETE" });
+  }
+
+  /** A request whose answer is text, not JSON — a diff. Same token handling as request(). */
+  private async requestText(path: string): Promise<string> {
+    const token = await this.tokens.current();
+    const res = await this.send(path, { headers: { Accept: "text/plain" } }, token);
+    if (!res.ok) throw new Error(`Gitea API ${path}: ${res.status} ${await res.text()}`);
+    return res.text();
+  }
+
   async mergePullRequest(owner: string, repo: string, index: number, method = "merge", deleteBranch = false): Promise<void> {
     await this.request(`/repos/${owner}/${repo}/pulls/${index}/merge`, {
       method: "POST",

modules/gitea/module.json

@@ -86,19 +86,19 @@
     }
   ],
   "own-secrets": {
-    "broker": "/var/lib/mesh/gitea/broker"
+    "broker": "${dir:mesh-state}/broker"
   },
   "resources": [
     {
       "id": "mesh-state",
       "type": "directory",
-      "path": "/var/lib/mesh/gitea",
-      "mode": "0700"
+      "mode": "0700",
+      "place": "mesh"
     },
     {
       "id": "runtime-state",
       "type": "directory",
-      "path": "/var/lib/mesh/gitea/state",
+      "path": "${dir:mesh-state}/state",
       "mode": "0700"
     },
     {
@@ -175,7 +175,7 @@
     {
       "id": "runtime-config",
       "type": "file",
-      "path": "/var/lib/mesh/gitea/config.json",
+      "path": "${dir:mesh-state}/config.json",
       "mode": "0600",
       "content": "{}\n",
       "merge": "json"
@@ -186,11 +186,11 @@
       "name": "mesh-gitea",
       "network": "host",
       "volumes": [
-        "/var/lib/mesh/gitea/broker:/run/secrets/broker:ro",
-        "/var/lib/mesh/gitea/config.json:/run/config/config.json:ro",
+        "${dir:mesh-state}/broker:/run/secrets/broker:ro",
+        "${dir:mesh-state}/config.json:/run/config/config.json:ro",
         "${dir:grants}:${dir:grants}:ro",
         "${dir:state}/admin.secret:/run/secrets/admin:ro",
-        "/var/lib/mesh/gitea/state:/run/state"
+        "${dir:runtime-state}:/run/state"
       ],
       "env": {
         "MESH_BROKER_FILE": "/run/secrets/broker",

modules/gitea/test/token.test.ts

@@ -29,7 +29,11 @@ interface Forge {
   mints: number;
   lastScopes: string[] | null;
   tokens: Map<string, string>;
+  scopesOf: Map<string, string[]>;
   admins: Map<string, string>;
+  pullState: string;
+  pullTitle: string;
+  branchDeleted: boolean;
   close(): Promise<void>;
 }
 
@@ -40,6 +44,9 @@ function fakeForge(): Promise<Forge> {
     tokens: new Map<string, string>(), // name -> value
     scopesOf: new Map<string, string[]>(), // value -> scopes, so a route can enforce them like gitea does
     admins: new Map([[ADMIN, PASSWORD]]),
+    pullState: "open",
+    pullTitle: "The console shipped",
+    branchDeleted: false,
   };
   // write:X implies read:X — gitea's own rule (models/auth/access_token_scope.go).
   const covers = (scopes: string[], required: string): boolean =>
@@ -85,6 +92,51 @@ function fakeForge(): Promise<Forge> {
       }
       return json(res, 405, { message: "method not allowed" });
     }
+    const tokenOf = (): string => {
+      const h = req.headers.authorization ?? "";
+      return h.startsWith("token ") ? h.slice(6) : "";
+    };
+    const pull = url.pathname.match(/^\/api\/v1\/repos\/novox\/hq\/pulls\/(\d+)(\.diff)?$/);
+    if (pull) {
+      if (![...forge.tokens.values()].includes(tokenOf())) return json(res, 401, { message: "token is required" });
+      if (pull[2]) {
+        res.writeHead(200, { "Content-Type": "text/plain" });
+        return res.end("diff --git a/x b/x\n--- a/x\n+++ b/x\n@@ -1 +1 @@\n-old\n+new\n");
+      }
+      if (req.method === "PATCH") {
+        const patch = await body(req);
+        forge.pullState = patch?.state ?? forge.pullState;
+        forge.pullTitle = patch?.title ?? forge.pullTitle;
+      }
+      return json(res, 200, { number: Number(pull[1]), title: forge.pullTitle, state: forge.pullState, merged: false,
+        user: { login: "mesh-admin" }, head: { ref: "feat/x" }, base: { ref: "main" }, html_url: "http://fake/novox/hq/pulls/" + pull[1] });
+    }
+    if (url.pathname === "/api/v1/repos/novox/hq/issues/223/comments") {
+      return json(res, 200, [{ id: 1, user: { login: "jochen" }, body: "landed elsewhere", created_at: "2026-10-01T00:00:00Z", html_url: "http://fake/c/1" }]);
+    }
+    if (url.pathname === "/api/v1/repos/novox/hq/contents/README.md") {
+      return json(res, 200, { type: "file", encoding: "base64", sha: "abc", size: 5, content: Buffer.from("hello").toString("base64") });
+    }
+    if (url.pathname === "/api/v1/repos/novox/hq/branches") {
+      return json(res, 200, [{ name: "main", protected: true, commit: { id: "aaaa" } }, { name: "feat/x", protected: false, commit: { id: "bbbb" } }]);
+    }
+    if (url.pathname === "/api/v1/repos/novox/hq/branches/feat%2Fx" || url.pathname === "/api/v1/repos/novox/hq/branches/feat/x") {
+      if (req.method === "DELETE") { forge.branchDeleted = true; return json(res, 204, null); }
+    }
+    if (url.pathname === "/api/v1/repos/search") {
+      // The client lists through the search endpoint since 2026-09-28 (the forge's whole view);
+      // it sits under `repository`, which write:repository covers.
+      const h = req.headers.authorization ?? "";
+      const value = h.startsWith("token ") ? h.slice(6) : "";
+      if (![...forge.tokens.values()].includes(value)) return json(res, 401, { message: "token is required" });
+      if (!covers(forge.scopesOf.get(value) ?? [], "read:repository")) {
+        return json(res, 403, { message: `token does not have at least one of required scope(s), required=[read:repository]` });
+      }
+      return json(res, 200, {
+        ok: true,
+        data: [{ full_name: "novox/hq", name: "hq", owner: { login: "novox" }, private: true, html_url: "http://fake/novox/hq" }],
+      });
+    }
     if (url.pathname === "/api/v1/user/repos") {
       const h = req.headers.authorization ?? "";
       const value = h.startsWith("token ") ? h.slice(6) : "";
@@ -101,6 +153,21 @@ function fakeForge(): Promise<Forge> {
         { full_name: "novox/hq", name: "hq", owner: { login: "novox" }, private: true, html_url: "http://fake/novox/hq" },
       ]);
     }
+    const adminUser = url.pathname.match(/^\/api\/v1\/admin\/users\/([^/]+)$/);
+    if (adminUser && req.method === "PATCH") {
+      const h = req.headers.authorization ?? "";
+      const value = h.startsWith("token ") ? h.slice(6) : "";
+      if (![...forge.tokens.values()].includes(value)) return json(res, 401, { message: "token is required" });
+      if (!covers(forge.scopesOf.get(value) ?? [], "write:admin")) {
+        return json(res, 403, {
+          message: `token does not have at least one of required scope(s), required=[write:admin]`,
+        });
+      }
+      const login = decodeURIComponent(adminUser[1]);
+      if (login === "untouchable") return json(res, 403, { message: "user untouchable may not be edited" });
+      const patch = await body(req);
+      return json(res, 200, { login, is_admin: patch?.admin === true });
+    }
     return json(res, 404, { message: "no such route in the fake" });
   });
   return new Promise((resolve) => {
@@ -110,7 +177,11 @@ function fakeForge(): Promise<Forge> {
         url: `http://127.0.0.1:${port}`,
         get mints() { return forge.mints; },
         get lastScopes() { return forge.lastScopes; },
+        get pullState() { return forge.pullState; },
+        get pullTitle() { return forge.pullTitle; },
+        get branchDeleted() { return forge.branchDeleted; },
         tokens: forge.tokens,
+        scopesOf: forge.scopesOf,
         admins: forge.admins,
         close: () => new Promise((r) => server.close(() => r())),
       });
@@ -152,14 +223,14 @@ function minted(env: NodeJS.ProcessEnv, logs: string[]): GiteaClient {
 const forge = await fakeForge();
 after(() => forge.close());
 
-test("first start: mints with the admin account, keeps the token at 0600, asks for two scopes only", async () => {
+test("first start: mints with the admin account, keeps the token at 0600, asks for the tools' scopes only", async () => {
   const { env, file, logs } = await delivered(forge);
 
   const repos = await minted(env, logs).listRepos();
 
   assert.equal(repos[0]?.full_name, "novox/hq");
   assert.equal(forge.mints, 1);
-  assert.deepEqual(forge.lastScopes, ["write:repository", "write:issue", "read:user"]);
+  assert.deepEqual(forge.lastScopes, ["write:repository", "write:issue", "read:user", "write:admin"]);
   assert.deepEqual(forge.lastScopes, [...TOKEN_SCOPES]);
   const token = forge.tokens.get("mesh-tools")!;
   assert.equal(await readFile(file, "utf8"), token + "\n");
@@ -197,6 +268,34 @@ test("the forge rejects the kept token (its data was restored): minted afresh, o
   assert.ok(logs.some((l) => l.startsWith("the forge rejected the kept token")), logs.join("\n"));
 });
 
+test("a kept token from before write:admin: the forge refuses the admin route for the scope, the token is re-minted with the whole list, and the call goes through", async () => {
+  const { env, file, logs } = await delivered(forge);
+  const client = minted(env, logs);
+  await client.listRepos();
+  const before = forge.mints;
+  const old = forge.tokens.get("mesh-tools")!;
+  forge.scopesOf.set(old, ["write:repository", "write:issue", "read:user"]); // minted by the previous build
+
+  const user = await client.api<{ login: string; is_admin: boolean }>("/admin/users/mesh_novox_builder", {
+    method: "PATCH",
+    body: JSON.stringify({ admin: true }),
+  });
+
+  assert.equal(user.is_admin, true);
+  assert.equal(forge.mints, before + 1);
+  assert.deepEqual(forge.lastScopes, [...TOKEN_SCOPES]);
+  assert.notEqual(forge.tokens.get("mesh-tools"), old);
+  assert.equal(await readFile(file, "utf8"), forge.tokens.get("mesh-tools") + "\n");
+  assert.ok(logs.some((l) => l.startsWith("the forge rejected the kept token")), logs.join("\n"));
+  // A 403 that is not about scopes is the forge's answer, not a reason to mint.
+  const again = forge.mints;
+  await assert.rejects(
+    client.api("/admin/users/untouchable", { method: "PATCH", body: JSON.stringify({ admin: true }) }),
+    /403 .*untouchable/,
+  );
+  assert.equal(forge.mints, again);
+});
+
 test("the kept file is gone but the forge still holds a token by that name: replaced, not refused", async () => {
   const { env, file, logs } = await delivered(forge);
   await minted(env, logs).listRepos();
@@ -301,6 +400,16 @@ test("the tools register once there is a way to a token, and the first call mint
       "gitea_list_repos", "gitea_create_repo", "gitea_delete_repo",
       "gitea_list_issues", "gitea_get_issue", "gitea_create_issue", "gitea_close_issue", "gitea_add_comment",
       "gitea_list_pull_requests", "gitea_get_pull_request", "gitea_create_pull_request", "gitea_merge_pull_request",
+      "gitea_close_pull_request",
+      "gitea_reopen_pull_request",
+      "gitea_update_pull_request",
+      "gitea_pull_request_files",
+      "gitea_pull_request_diff",
+      "gitea_list_comments",
+      "gitea_reopen_issue",
+      "gitea_get_file",
+      "gitea_list_branches",
+      "gitea_delete_branch",
       "gitea_list_labels", "gitea_create_label",
       "gitea_api",
     ],
@@ -311,3 +420,32 @@ test("the tools register once there is a way to a token, and the first call mint
   assert.equal(result.repos.length, 1);
   assert.equal(forge.mints, before + 1);
 });
+
+// The forge's tools reach every action a review needs without a checkout and without the API
+// escape hatch: close a pull request whose work landed elsewhere, read its diff, its comments, a
+// file, the branches, and delete the branch left behind. Against the fake forge, through the
+// compiled tools, the way the console calls them.
+test("a pull request can be closed, read and cleaned up through the tools", async () => {
+  const { env } = await delivered(forge);
+  const tools = collectTools(env).find((c) => c.module === "gitea")!.tools;
+  const tool = (name: string) => tools.find((t) => t.name === name)!;
+  for (const name of ["gitea_close_pull_request", "gitea_reopen_pull_request", "gitea_update_pull_request", "gitea_pull_request_files",
+    "gitea_pull_request_diff", "gitea_list_comments", "gitea_reopen_issue", "gitea_get_file", "gitea_list_branches", "gitea_delete_branch"]) {
+    assert.ok(tool(name), `${name} is not a tool`);
+  }
+  const closed = (await tool("gitea_close_pull_request").run({ owner: "novox", repo: "hq", number: 223 })) as { pull: { state: string } };
+  assert.equal(closed.pull.state, "closed");
+  assert.equal(forge.pullState, "closed");
+  const renamed = (await tool("gitea_update_pull_request").run({ owner: "novox", repo: "hq", number: 223, title: "Superseded" })) as { pull: { title: string } };
+  assert.equal(renamed.pull.title, "Superseded");
+  const diff = (await tool("gitea_pull_request_diff").run({ owner: "novox", repo: "hq", number: 223 })) as { diff: string };
+  assert.match(diff.diff, /^diff --git/);
+  const comments = (await tool("gitea_list_comments").run({ owner: "novox", repo: "hq", number: 223 })) as { comments: { body: string }[] };
+  assert.equal(comments.comments[0].body, "landed elsewhere");
+  const file = (await tool("gitea_get_file").run({ owner: "novox", repo: "hq", path: "README.md" })) as { file: { content: string } };
+  assert.equal(file.file.content, "hello");
+  const branches = (await tool("gitea_list_branches").run({ owner: "novox", repo: "hq" })) as { branches: { name: string }[] };
+  assert.deepEqual(branches.branches.map((b) => b.name), ["main", "feat/x"]);
+  await tool("gitea_delete_branch").run({ owner: "novox", repo: "hq", branch: "feat/x" });
+  assert.equal(forge.branchDeleted, true);
+});

modules/gitea/token.ts

@@ -34,15 +34,21 @@ export const TOKEN_NAME = "mesh-tools";
  *                      It sits under the `user` category despite listing repositories, not `repository`
  *                      — confirmed against the running forge (1.27.3), which answered
  *                      `required=[read:user]` to a token carrying only the other two.
- * Nothing under /admin, /orgs or write:user — the escape-hatch tool reaches only what these three cover.
+ *   write:admin      — /admin/users: the forge's own users are the mesh's to settle, such as making
+ *                      the builder's login a site admin so every repository the mesh may build is
+ *                      clonable (novox/hq 229). Nothing under /orgs or write:user.
+ *
+ * A token kept from before a scope was added lacks it: the forge answers such a call with
+ * `403 token does not have at least one of required scope(s)`, and the client treats that like a
+ * 401 — the source re-mints by name, with the whole list, and the call is retried once.
  */
-export const TOKEN_SCOPES: readonly string[] = ["write:repository", "write:issue", "read:user"];
+export const TOKEN_SCOPES: readonly string[] = ["write:repository", "write:issue", "read:user", "write:admin"];
 
 /** Where a client's token comes from, and what to do when the forge says it is wrong. */
 export interface TokenSource {
   /** The token to authenticate with now; minted, read or configured. */
   current(): Promise<string>;
-  /** The forge answered 401 to `rejected`. A fresh token, or a plain error when there is nothing to renew with. */
+  /** The forge answered 401 to `rejected`, or 403 for a scope it lacks. A fresh token, or a plain error when there is nothing to renew with. */
   renew(rejected: string): Promise<string>;
 }
 
@@ -170,6 +176,11 @@ export class MintedToken implements TokenSource {
     return this.mint("the forge rejected the kept token — minting a fresh one");
   }
 
+  /** What the forge's scoped tokens say when a kept token predates a scope the tools now need. */
+  static lacksScope(status: number, body: string): boolean {
+    return status === 403 && /required scope/i.test(body);
+  }
+
   /** One mint at a time: concurrent first calls share it, rather than each minting its own. */
   private mint(why: string): Promise<string> {
     if (this.inflight === null) {

modules/gitea/tools/index.ts

@@ -254,6 +254,131 @@ export function getGiteaTools(gitea: GiteaClient): ToolDefinition[] {
       },
     },
 
+    {
+      name: "gitea_close_pull_request",
+      description: "Close a pull request without merging it — one whose work landed elsewhere, or was abandoned.",
+      input: {
+        owner: { type: "string", description: "the repository owner" },
+        repo: { type: "string", description: "the repository name" },
+        number: { type: "number", description: "the PR number" },
+      },
+      run: async (args) => ({
+        pull: await gitea.setPullState(String(args.owner), String(args.repo), Number(args.number), "closed"),
+      }),
+    },
+    {
+      name: "gitea_reopen_pull_request",
+      description: "Reopen a closed, unmerged pull request.",
+      input: {
+        owner: { type: "string", description: "the repository owner" },
+        repo: { type: "string", description: "the repository name" },
+        number: { type: "number", description: "the PR number" },
+      },
+      run: async (args) => ({
+        pull: await gitea.setPullState(String(args.owner), String(args.repo), Number(args.number), "open"),
+      }),
+    },
+    {
+      name: "gitea_update_pull_request",
+      description: "Change a pull request's title or body; a field not given is left as it is.",
+      input: {
+        owner: { type: "string", description: "the repository owner" },
+        repo: { type: "string", description: "the repository name" },
+        number: { type: "number", description: "the PR number" },
+        title: { type: "string", description: "the new title (optional)" },
+        body: { type: "string", description: "the new body, markdown (optional)" },
+      },
+      run: async (args) => ({
+        pull: await gitea.updatePullRequest(String(args.owner), String(args.repo), Number(args.number), {
+          title: args.title === undefined ? undefined : String(args.title),
+          body: args.body === undefined ? undefined : String(args.body),
+        }),
+      }),
+    },
+    {
+      name: "gitea_pull_request_files",
+      description: "The files a pull request changes, as paths from the repository's root (up to 100; says when there are more).",
+      input: {
+        owner: { type: "string", description: "the repository owner" },
+        repo: { type: "string", description: "the repository name" },
+        number: { type: "number", description: "the PR number" },
+      },
+      run: async (args) => gitea.listPullFiles(String(args.owner), String(args.repo), Number(args.number)),
+    },
+    {
+      name: "gitea_pull_request_diff",
+      description: "A pull request's unified diff, as text — for reviewing it without a checkout.",
+      input: {
+        owner: { type: "string", description: "the repository owner" },
+        repo: { type: "string", description: "the repository name" },
+        number: { type: "number", description: "the PR number" },
+      },
+      run: async (args) => ({
+        diff: await gitea.pullDiff(String(args.owner), String(args.repo), Number(args.number)),
+      }),
+    },
+    {
+      name: "gitea_list_comments",
+      description: "Every comment on an issue or pull request, oldest first.",
+      input: {
+        owner: { type: "string", description: "the repository owner" },
+        repo: { type: "string", description: "the repository name" },
+        number: { type: "number", description: "the issue or PR number" },
+      },
+      run: async (args) => ({
+        comments: await gitea.listComments(String(args.owner), String(args.repo), Number(args.number)),
+      }),
+    },
+    {
+      name: "gitea_reopen_issue",
+      description: "Reopen a closed issue.",
+      input: {
+        owner: { type: "string", description: "the repository owner" },
+        repo: { type: "string", description: "the repository name" },
+        number: { type: "number", description: "the issue number" },
+      },
+      run: async (args) => ({
+        issue: await gitea.setIssueState(String(args.owner), String(args.repo), Number(args.number), "open"),
+      }),
+    },
+
+    // ---- Contents and branches ----
+    {
+      name: "gitea_get_file",
+      description: "One file's contents from a repository, decoded, at a branch, tag or commit (default the repository's default branch).",
+      input: {
+        owner: { type: "string", description: "the repository owner" },
+        repo: { type: "string", description: "the repository name" },
+        path: { type: "string", description: "the file's path from the repository's root" },
+        ref: { type: "string", description: "branch, tag or commit (optional)" },
+      },
+      run: async (args) => ({
+        file: await gitea.getFile(String(args.owner), String(args.repo), String(args.path), args.ref ? String(args.ref) : undefined),
+      }),
+    },
+    {
+      name: "gitea_list_branches",
+      description: "Every branch of a repository with the commit it points at.",
+      input: {
+        owner: { type: "string", description: "the repository owner" },
+        repo: { type: "string", description: "the repository name" },
+      },
+      run: async (args) => ({ branches: await gitea.listBranches(String(args.owner), String(args.repo)) }),
+    },
+    {
+      name: "gitea_delete_branch",
+      description: "Delete a branch — a feature branch whose pull request was closed rather than merged. Refused by the forge for a protected branch.",
+      input: {
+        owner: { type: "string", description: "the repository owner" },
+        repo: { type: "string", description: "the repository name" },
+        branch: { type: "string", description: "the branch name" },
+      },
+      run: async (args) => {
+        await gitea.deleteBranch(String(args.owner), String(args.repo), String(args.branch));
+        return { deleted: true, branch: String(args.branch) };
+      },
+    },
+
     // ---- Labels ----
     {
       name: "gitea_list_labels",

modules/gitlab/module.json

@@ -2,26 +2,26 @@
   "module": "gitlab",
   "version": "1",
   "own-secrets": {
-    "token": "/var/lib/gitlab/token",
-    "broker": "/var/lib/mesh/gitlab/broker"
+    "token": "${dir:state}/token",
+    "broker": "${dir:mesh-state}/broker"
   },
   "resources": [
     {
       "id": "mesh-state",
       "type": "directory",
-      "path": "/var/lib/mesh/gitlab",
-      "mode": "0700"
+      "mode": "0700",
+      "place": "mesh"
     },
     {
       "id": "state",
       "type": "directory",
-      "path": "/var/lib/gitlab",
-      "mode": "0700"
+      "mode": "0700",
+      "place": "."
     },
     {
       "id": "config",
       "type": "file",
-      "path": "/var/lib/gitlab/config.json",
+      "path": "${dir:state}/config.json",
       "merge": "json",
       "content": "{}",
       "mode": "0600"
@@ -32,9 +32,9 @@
       "name": "mesh-runtime-gitlab",
       "network": "host",
       "volumes": [
-        "/var/lib/gitlab/config.json:/run/config/config.json:ro",
-        "/var/lib/gitlab/token:/run/secrets/token:ro",
-        "/var/lib/mesh/gitlab/broker:/run/secrets/broker:ro"
+        "${dir:state}/config.json:/run/config/config.json:ro",
+        "${dir:state}/token:/run/secrets/token:ro",
+        "${dir:mesh-state}/broker:/run/secrets/broker:ro"
       ],
       "env": {
         "MESH_GITLAB_TOKEN_FILE": "/run/secrets/token",

modules/grafana/module.json

@@ -5,8 +5,8 @@
     "alert.firing"
   ],
   "own-secrets": {
-    "admin": "/var/lib/mesh/grafana/admin",
-    "broker": "/var/lib/mesh/grafana/broker"
+    "admin": "${dir:mesh-state}/admin",
+    "broker": "${dir:mesh-state}/broker"
   },
   "capabilities": [
     "container-runtime"
@@ -24,8 +24,8 @@
     {
       "id": "mesh-state",
       "type": "directory",
-      "path": "/var/lib/mesh/grafana",
-      "mode": "0700"
+      "mode": "0700",
+      "place": "mesh"
     },
     {
       "id": "state",
@@ -108,7 +108,7 @@
     {
       "id": "runtime-config",
       "type": "file",
-      "path": "/var/lib/mesh/grafana/config.json",
+      "path": "${dir:mesh-state}/config.json",
       "mode": "0600",
       "content": "{\n  \"user\": \"admin\",\n  \"password\": \"${secret:admin}\"\n}\n",
       "merge": "json"
@@ -119,8 +119,8 @@
       "name": "mesh-grafana",
       "network": "host",
       "volumes": [
-        "/var/lib/mesh/grafana/broker:/run/secrets/broker:ro",
-        "/var/lib/mesh/grafana/config.json:/run/config/config.json:ro"
+        "${dir:mesh-state}/broker:/run/secrets/broker:ro",
+        "${dir:mesh-state}/config.json:/run/config/config.json:ro"
       ],
       "env": {
         "MESH_BROKER_FILE": "/run/secrets/broker",
@@ -158,8 +158,8 @@
     "influxdb-api": "${dir:state}/influxdb.json"
   },
   "secrets": {
-    "oidc-client": "/var/lib/mesh/grafana/oidc-client",
-    "influxdb-api": "/var/lib/mesh/grafana/influxdb-api"
+    "oidc-client": "${dir:mesh-state}/oidc-client",
+    "influxdb-api": "${dir:mesh-state}/influxdb-api"
   },
   "build": {
     "on": [

modules/hello-web/module.json

@@ -15,7 +15,7 @@
     }
   },
   "binds": {
-    "route": "/var/lib/hello-web/route.json"
+    "route": "${dir:state}/route.json"
   },
   "listens": [
     {
@@ -30,13 +30,13 @@
     {
       "id": "state",
       "type": "directory",
-      "path": "/var/lib/hello-web",
-      "mode": "0700"
+      "mode": "0700",
+      "place": "."
     },
     {
       "id": "page",
       "type": "file",
-      "path": "/var/lib/hello-web/index.html",
+      "path": "${dir:state}/index.html",
       "mode": "0644",
       "content": "hello from hello-web, routed by the mesh\n"
     },
@@ -54,7 +54,7 @@
         "8080"
       ],
       "volumes": [
-        "/var/lib/hello-web/index.html:/www/index.html:ro"
+        "${dir:state}/index.html:/www/index.html:ro"
       ],
       "args": [
         "sh",

modules/home-assistant/Dockerfile

@@ -13,7 +13,7 @@ ARG RUNTIME_BASE
 FROM ${BUILD_BASE} AS build
 WORKDIR /app/modules/home-assistant
 COPY . .
-RUN node /app/node_modules/typescript/bin/tsc client.ts index.ts tools/index.ts \
+RUN node /app/node_modules/typescript/bin/tsc client.ts index.ts tools/index.ts provisions/hass.ts provisions/probe.ts provisions/connections.ts provisions/mesh.ts provisions/index.ts \
       --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist
 
 FROM ${RUNTIME_BASE}
@@ -22,3 +22,6 @@ COPY --from=build /app/modules/home-assistant/dist /app/modules/home-assistant/d
 # provider's provisioner runs its reconcile loop in the same process, with the broker connected —
 # the convention novox/hq issues 060/061 settled.
 ENV MESH_TOOL_MODULES=/app/modules/home-assistant/dist/index.js,/app/modules/home-assistant/dist/tools/index.js
+# NOT dist/provisions/index.js: that is a step the host runs to completion, named by the
+# `provisions` container's args as `mesh-tools run …` (novox/hq ADR 0052). Listed here it would run
+# inside the serving sidecar too, and exit it.

modules/home-assistant/module.json

@@ -9,8 +9,8 @@
     "state.changed"
   ],
   "own-secrets": {
-    "broker": "/var/lib/mesh/home-assistant/broker",
-    "token": "/var/lib/mesh/home-assistant/token"
+    "broker": "${dir:mesh-state}/broker",
+    "token": "${dir:mesh-state}/token"
   },
   "listens": [
     {
@@ -18,40 +18,63 @@
       "port": 8123,
       "protocol": "tcp",
       "from": "mesh",
-      "why": "the dashboard and the API"
+      "why": "the dashboard, the API and the companion apps"
+    },
+    {
+      "name": "sonos-events",
+      "port": 1400,
+      "protocol": "tcp",
+      "from": "mesh",
+      "why": "the Sonos integration's event callback: speakers push their state changes here"
+    },
+    {
+      "name": "webrtc",
+      "port": 18555,
+      "protocol": "tcp",
+      "from": "mesh",
+      "why": "the bundled go2rtc's WebRTC port, which camera streams to a browser use"
     }
   ],
   "resources": [
     {
       "id": "mesh-state",
       "type": "directory",
-      "path": "/var/lib/mesh/home-assistant",
-      "mode": "0700"
+      "mode": "0700",
+      "place": "mesh"
+    },
+    {
+      "id": "state",
+      "type": "directory",
+      "mode": "0700",
+      "place": "."
     },
     {
       "id": "config",
       "type": "directory",
-      "path": "/services/home-assistant/config",
-      "mode": "0700",
-      "owner": "1000:1000"
+      "mode": "0700"
+    },
+    {
+      "id": "written",
+      "type": "directory",
+      "mode": "0700"
     },
     {
       "id": "server",
       "type": "container",
       "name": "home-assistant",
-      "image": "ghcr.io/home-assistant/home-assistant@sha256:14931c6b13756317849f46da1d01b45937a1150db66c081cfe529d48215943fe",
+      "image": "ghcr.io/home-assistant/home-assistant@sha256:d8922685169707fd91e8b9729902d975f06157d005e422874d201e0261dda196",
       "network": "host",
       "env": {
         "TZ": "Etc/UTC"
       },
       "volumes": [
-        "/services/home-assistant/config:/config"
+        "${dir:config}:/config"
       ]
     },
     {
       "id": "runtime-config",
       "type": "file",
-      "path": "/var/lib/mesh/home-assistant/config.json",
+      "path": "${dir:mesh-state}/config.json",
       "mode": "0600",
       "content": "{}\n",
       "merge": "json"
@@ -62,35 +85,92 @@
       "name": "mesh-home-assistant",
       "network": "host",
       "volumes": [
-        "/var/lib/mesh/home-assistant/broker:/run/secrets/broker:ro",
-        "/var/lib/mesh/home-assistant/token:/run/secrets/token:ro",
-        "/var/lib/mesh/home-assistant/config.json:/run/config/config.json:ro",
-        "/services/home-assistant/config:/var/lib/home-assistant/config:ro"
+        "${dir:mesh-state}/broker:/run/secrets/broker:ro",
+        "${dir:mesh-state}/token:/run/secrets/token:ro",
+        "${dir:mesh-state}/config.json:/run/config/config.json:ro"
       ],
       "env": {
         "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_HOMEASSISTANT_URL": "http://127.0.0.1:8123",
+        "MESH_HOMEASSISTANT_URL": "http://127.0.0.1:${port:8123}",
         "MESH_HOMEASSISTANT_TOKEN_FILE": "/run/secrets/token",
-        "MESH_HOMEASSISTANT_CONFIG_FILE": "/run/config/config.json",
-        "MESH_HOMEASSISTANT_CONFIG_DIR": "/var/lib/home-assistant/config"
+        "MESH_HOMEASSISTANT_CONFIG_FILE": "/run/config/config.json"
       },
       "restart-on": [
         "runtime-config"
       ],
       "artifact": "runtime"
+    },
+    {
+      "id": "provisions",
+      "type": "container",
+      "name": "mesh-home-assistant-provisions",
+      "network": "host",
+      "run-once": true,
+      "volumes": [
+        "${dir:mesh-state}/token:/run/secrets/token:ro",
+        "${dir:written}:/var/lib/home-assistant-provisions",
+        "${dir:state}/mqtt-topic.json:/run/provisions/mqtt-topic.json:ro",
+        "${dir:state}/mqtt-topic.secret:/run/provisions/mqtt-topic.secret:ro",
+        "${dir:state}/sonarr-api.json:/run/provisions/sonarr-api.json:ro",
+        "${dir:state}/sonarr-api.secret:/run/provisions/sonarr-api.secret:ro",
+        "${dir:state}/radarr-api.json:/run/provisions/radarr-api.json:ro",
+        "${dir:state}/radarr-api.secret:/run/provisions/radarr-api.secret:ro",
+        "${dir:state}/lidarr-api.json:/run/provisions/lidarr-api.json:ro",
+        "${dir:state}/lidarr-api.secret:/run/provisions/lidarr-api.secret:ro"
+      ],
+      "env": {
+        "MESH_HOMEASSISTANT_URL": "http://127.0.0.1:${port:8123}",
+        "MESH_HOMEASSISTANT_TOKEN_FILE": "/run/secrets/token",
+        "MESH_PROVISIONS_DIR": "/run/provisions",
+        "MESH_WRITTEN_DIR": "/var/lib/home-assistant-provisions"
+      },
+      "args": [
+        "run",
+        "/app/modules/home-assistant/dist/provisions/index.js"
+      ],
+      "restart-on": [
+        "bound-mqtt-topic",
+        "secret-mqtt-topic",
+        "bound-sonarr-api",
+        "secret-sonarr-api",
+        "bound-radarr-api",
+        "secret-radarr-api",
+        "bound-lidarr-api",
+        "secret-lidarr-api"
+      ],
+      "artifact": "runtime"
     }
   ],
   "requires": [
-    "route"
+    "lidarr-api",
+    "mqtt-topic",
+    "radarr-api",
+    "route",
+    "sonarr-api"
   ],
   "contributes": {
+    "mqtt-topic": {
+      "topics": [
+        "#"
+      ]
+    },
     "route": {
       "label": "home-assistant",
       "endpoint": "web"
     }
   },
   "binds": {
-    "route": "/var/lib/mesh/home-assistant/route.json"
+    "route": "${dir:state}/route.json",
+    "mqtt-topic": "${dir:state}/mqtt-topic.json",
+    "sonarr-api": "${dir:state}/sonarr-api.json",
+    "radarr-api": "${dir:state}/radarr-api.json",
+    "lidarr-api": "${dir:state}/lidarr-api.json"
+  },
+  "secrets": {
+    "mqtt-topic": "${dir:state}/mqtt-topic.secret",
+    "sonarr-api": "${dir:state}/sonarr-api.secret",
+    "radarr-api": "${dir:state}/radarr-api.secret",
+    "lidarr-api": "${dir:state}/lidarr-api.secret"
   },
   "build": {
     "on": [

modules/home-assistant/package.json

@@ -1,9 +1,14 @@
 {
   "name": "@novox/module-home-assistant",
   "version": "0.1.0",
-  "description": "home-assistant — home automation platform. Its API client, tools and events live here (novox/hq ADR 0039).",
+  "description": "home-assistant \u2014 home automation platform. Its API client, tools and events live here (novox/hq ADR 0039).",
   "type": "module",
   "private": true,
+  "scripts": {
+    "build": "tsc client.ts index.ts tools/index.ts provisions/hass.ts provisions/probe.ts provisions/connections.ts provisions/mesh.ts provisions/index.ts --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist",
+    "typecheck": "tsc -p tsconfig.json",
+    "test": "node --test --experimental-strip-types 'test/*.test.ts'"
+  },
   "dependencies": {
     "@novox/mesh-sdk": "^0.1.0"
   },

modules/home-assistant/provisions/connections.ts

@@ -0,0 +1,486 @@
+// How home-assistant's provisions step brings Home Assistant's integrations in line with what the
+// mesh bound: the MQTT integration to `mqtt-topic`, the Sonarr, Radarr and Lidarr integrations to
+// `sonarr-api`, `radarr-api` and `lidarr-api`. Pure logic over two seams — Home Assistant's config
+// flows (hass.ts) and the broker/apps — so it is tested against fakes (test/provisions.test.ts).
+//
+// The half that reads files and talks HTTP lives beside it (mesh.ts, hass.ts, probe.ts, index.ts).
+
+import { createHash } from "node:crypto";
+
+import type { Hass, SchemaField } from "./hass.js";
+import type { Probe } from "./probe.js";
+
+/** What the mesh wrote at `binds.<provision>` (the controller's binding document). */
+export interface Binding {
+  provision?: string;
+  from?: string;
+  at?: string;
+  as?: string;
+  serves?: Record<string, unknown>;
+}
+
+/** How one provision came out. Never carries a credential. */
+export type Outcome =
+  | { what: string; result: "unchanged"; note?: string }
+  | { what: string; result: "written"; fields: string[]; note?: string }
+  | { what: string; result: "equivalent"; note: string }
+  | { what: string; result: "refused"; problem: string };
+
+/** A port the binding serves, or undefined when it names none usable. */
+export function portOf(serves: Record<string, unknown> | undefined): number | undefined {
+  const port = Number(serves?.port);
+  return Number.isInteger(port) && port > 0 && port <= 65535 ? port : undefined;
+}
+
+/** A host as it goes into a URL: an IPv6 literal bracketed. */
+export function urlHost(host: string): string {
+  return host.includes(":") && !host.startsWith("[") ? `[${host}]` : host;
+}
+
+/**
+ * What this step last wrote, per target, as a digest: the only way to know "already as the mesh
+ * says" for a credential Home Assistant will not show back. A sha256 over the target and the values,
+ * never the values; kept in the module's own placed directory.
+ */
+export interface Marks {
+  get(name: string): Promise<string | undefined>;
+  set(name: string, digest: string): Promise<void>;
+}
+
+export function digest(...parts: (string | number)[]): string {
+  return createHash("sha256").update(parts.map(String).join("\u0000")).digest("hex");
+}
+
+/** An error as text with the credential taken out, raw and URL-encoded. */
+export function scrub(err: unknown, ...secrets: (string | undefined)[]): string {
+  let text = err instanceof Error ? err.message : String(err);
+  for (const s of secrets) {
+    if (!s) continue;
+    for (const form of new Set([s, encodeURIComponent(s)])) text = text.split(form).join("***");
+  }
+  return text;
+}
+
+/**
+ * What a form would submit if a person pressed "submit" without touching it: each field's
+ * suggested value (what Home Assistant pre-fills from the entry), else its default; a section's
+ * fields nested under its name. The step lays only the connection fields over this, so every other
+ * choice the entry carries is sent back exactly as Home Assistant showed it.
+ */
+export function formValues(schema: readonly SchemaField[] | null | undefined): Record<string, unknown> {
+  const out: Record<string, unknown> = {};
+  for (const field of schema ?? []) {
+    if (Array.isArray(field.schema)) {
+      out[field.name] = formValues(field.schema);
+      continue;
+    }
+    const suggested = field.description?.suggested_value;
+    if (suggested !== undefined && suggested !== null) out[field.name] = suggested;
+    else if (field.default !== undefined) out[field.name] = field.default;
+  }
+  return out;
+}
+
+/** Whether a form has a field of this name at its top level. */
+export function hasField(schema: readonly SchemaField[] | null | undefined, name: string): boolean {
+  return (schema ?? []).some((f) => f.name === name);
+}
+
+// ---- MQTT ----
+
+// Home Assistant's MQTT integration, pointed at the broker the mesh bound — `mqtt-topic`.
+//
+// **Why a step.** Home Assistant keeps its broker, login and password in its MQTT config entry
+// (`.storage/core.config_entries`), not in a file the mesh could fill with `${bound:mqtt-topic:at}`.
+// So this reads the binding and the pair credential and makes the entry say the same thing, through
+// the MQTT integration's own reconfigure flow — the flow its "Reconfigure" button runs, which tests
+// the connection itself and saves nothing it could not connect with.
+//
+// **Only the connection, and only when it differs.** Broker, port, username, password. The protocol
+// version, client id, keepalive, TLS choices and discovery options the entry holds are sent back
+// exactly as Home Assistant pre-filled them. Whether the password already matches cannot be read
+// back (Home Assistant never shows a stored password), so the step keeps a digest of what it last
+// wrote: equal broker/port/username and an equal digest is "already as the mesh says".
+//
+// **Nothing loses its connection without someone seeing it.** Before Home Assistant is touched the
+// broker itself is asked whether it takes the delivered login (the provisioner creates it within
+// seconds of the grant): if not, nothing is written and the step fails saying why, and Home
+// Assistant keeps the login it has — the carried `luffy` on ace, which mosquitto keeps. If Home
+// Assistant's own connection test refuses the new settings, the flow saves nothing, and the step
+// fails with Home Assistant's reason. A login that may not subscribe to the discovery topics is said
+// as a warning: discovery would find nothing.
+
+export const MQTT_PROVISION = "mqtt-topic";
+/** Home Assistant's discovery prefix, subscribed to whenever discovery is on (the default). */
+export const DISCOVERY_FILTER = "homeassistant/#";
+
+export interface MqttWanted {
+  host: string;
+  port: number;
+  username: string;
+  password: string;
+}
+
+export type Wanted = { ok: true; want: MqttWanted } | { ok: false; problem: string };
+
+/** The broker, port and login the mesh says Home Assistant uses. */
+export function wantedMqtt(binding: Binding | undefined, credential: string | undefined): Wanted {
+  if (!binding) return { ok: false, problem: `no binding for ${MQTT_PROVISION} was delivered — the mesh writes it before this step runs` };
+  const host = typeof binding.at === "string" ? binding.at.trim() : "";
+  if (!host) return { ok: false, problem: `the ${MQTT_PROVISION} binding names no host (at)` };
+  const port = portOf(binding.serves);
+  if (port === undefined) return { ok: false, problem: `the ${MQTT_PROVISION} binding serves no usable port (${String(binding.serves?.port)})` };
+  const scheme = binding.serves?.scheme;
+  if (scheme !== undefined && scheme !== "mqtt") {
+    return { ok: false, problem: `the ${MQTT_PROVISION} binding serves scheme ${String(scheme)}; this step writes plain MQTT` };
+  }
+  const username = typeof binding.as === "string" ? binding.as.trim() : "";
+  if (!username) return { ok: false, problem: `the ${MQTT_PROVISION} binding names no login (as)` };
+  const password = (credential ?? "").replace(/\n$/, "");
+  if (!password) return { ok: false, problem: `the ${MQTT_PROVISION} credential is empty or was not delivered` };
+  return { ok: true, want: { host, port, username, password } };
+}
+
+export interface MqttDeps {
+  hass: Hass;
+  probe: Probe;
+  marks: Marks;
+}
+
+const markFor = (entryId: string, w: MqttWanted): string => digest("mqtt", entryId, w.host, w.port, w.username, w.password);
+
+/** Bring Home Assistant's MQTT entry in line with the mesh. Never throws: every failure is an outcome. */
+export async function reconcileMqtt(deps: MqttDeps, binding: Binding | undefined, credential: string | undefined): Promise<Outcome> {
+  const what = "mqtt";
+  const w = wantedMqtt(binding, credential);
+  if ("problem" in w) return { what, result: "refused", problem: w.problem };
+  const want = w.want;
+
+  // The broker first: a login it does not take is never written into Home Assistant.
+  let note: string | undefined;
+  try {
+    const probe = await deps.probe(want.host, want.port, want.username, want.password, DISCOVERY_FILTER);
+    if (probe.connack === 4 || probe.connack === 5) {
+      return {
+        what,
+        result: "refused",
+        problem:
+          `the broker at ${want.host}:${want.port} does not (yet) take the login ${want.username} with the delivered ` +
+          `password (CONNACK ${probe.connack}); mosquitto's provisioner creates it from the grant — nothing was ` +
+          `written, and Home Assistant keeps the broker login it has`,
+      };
+    }
+    if (probe.connack !== 0) {
+      return { what, result: "refused", problem: `the broker at ${want.host}:${want.port} answered CONNACK ${probe.connack}; nothing was written` };
+    }
+    if (probe.suback === 0x80) {
+      note =
+        `warning: ${want.username} may not subscribe to ${DISCOVERY_FILTER} — MQTT discovery will find nothing; ` +
+        `grant it with the mqtt-topic contribution's \`topics\``;
+    }
+  } catch (err) {
+    return {
+      what,
+      result: "refused",
+      problem: `the broker at ${want.host}:${want.port} could not be asked: ${scrub(err, want.password)}; nothing was written`,
+    };
+  }
+
+  try {
+    const entries = (await deps.hass.entries("mqtt")).filter((e) => e.domain === "mqtt");
+    if (entries.length > 1) {
+      return { what, result: "refused", problem: `Home Assistant has ${entries.length} MQTT entries; which one the mesh owns is not guessed` };
+    }
+    if (entries.length === 0) return await createEntry(deps, want, note);
+
+    const entry = entries[0];
+    const flow = await deps.hass.startFlow("mqtt", entry.entry_id);
+    if (flow.type !== "form" || !flow.flow_id || !flow.data_schema) {
+      if (flow.flow_id) await deps.hass.abortFlow(flow.flow_id);
+      return { what, result: "refused", problem: `Home Assistant's MQTT reconfigure flow answered ${flow.type}${flow.reason ? ` (${flow.reason})` : ""}` };
+    }
+    const current = formValues(flow.data_schema);
+    const fields: string[] = [];
+    if (String(current.broker ?? "") !== want.host) fields.push("broker");
+    if (Number(current.port ?? 0) !== want.port) fields.push("port");
+    if (String(current.username ?? "") !== want.username) fields.push("username");
+    if ((await deps.marks.get("mqtt")) !== markFor(entry.entry_id, want)) fields.push("password");
+    if (fields.length === 0) {
+      await deps.hass.abortFlow(flow.flow_id);
+      return note ? { what, result: "unchanged", note } : { what, result: "unchanged" };
+    }
+
+    const saved = await deps.hass.stepFlow(flow.flow_id, {
+      ...current,
+      broker: want.host,
+      port: want.port,
+      username: want.username,
+      password: want.password,
+    });
+    if (saved.type === "abort" && saved.reason === "reconfigure_successful") {
+      await deps.marks.set("mqtt", markFor(entry.entry_id, want));
+      return { what, result: "written", fields, ...(note ? { note } : {}) };
+    }
+    if (saved.flow_id) await deps.hass.abortFlow(saved.flow_id);
+    return {
+      what,
+      result: "refused",
+      problem:
+        `Home Assistant's own connection test refused ${want.username}@${want.host}:${want.port} ` +
+        `(${describe(saved)}); its MQTT entry is unchanged`,
+    };
+  } catch (err) {
+    return { what, result: "refused", problem: scrub(err, want.password) };
+  }
+}
+
+/** A fresh Home Assistant has no MQTT entry: made through the integration's user flow. */
+async function createEntry(deps: MqttDeps, want: MqttWanted, note?: string): Promise<Outcome> {
+  const what = "mqtt";
+  let flow = await deps.hass.startFlow("mqtt");
+  if (flow.type === "form" && flow.step_id !== "broker" && flow.flow_id) {
+    // Anything before the broker form (none outside the Supervisor) is not this step's to answer.
+    await deps.hass.abortFlow(flow.flow_id);
+    return { what, result: "refused", problem: `Home Assistant's MQTT user flow asked ${flow.step_id} before the broker` };
+  }
+  if (flow.type !== "form" || !flow.flow_id) {
+    return { what, result: "refused", problem: `Home Assistant's MQTT user flow answered ${describe(flow)}` };
+  }
+  const shown = formValues(flow.data_schema);
+  // A new entry's form has no value for its two certificate choices (a reconfigure pre-fills them
+  // from the entry): plain MQTT, so neither a CA nor a client certificate.
+  const other = (shown.other_settings ?? {}) as Record<string, unknown>;
+  if (flow.data_schema?.some((f) => f.name === "other_settings")) {
+    shown.other_settings = { set_ca_cert: "off", set_client_cert: false, ...other };
+  }
+  flow = await deps.hass.stepFlow(flow.flow_id, {
+    ...shown,
+    broker: want.host,
+    port: want.port,
+    username: want.username,
+    password: want.password,
+  });
+  if (flow.type === "create_entry") {
+    const id = (flow.result as { entry_id?: string } | undefined)?.entry_id;
+    if (id) await deps.marks.set("mqtt", markFor(id, want));
+    return { what, result: "written", fields: ["entry"], ...(note ? { note } : {}) };
+  }
+  if (flow.flow_id) await deps.hass.abortFlow(flow.flow_id);
+  return { what, result: "refused", problem: `Home Assistant refused a new MQTT entry for ${want.host}:${want.port} (${describe(flow)})` };
+}
+
+export function describe(r: { type: string; reason?: string; errors?: Record<string, string> | null }): string {
+  const errors = r.errors ? Object.entries(r.errors).map(([k, v]) => `${k}: ${v}`).join(", ") : "";
+  return [r.type, r.reason, errors].filter(Boolean).join(" — ");
+}
+
+// ---- Sonarr, Radarr, Lidarr ----
+
+// Home Assistant's Sonarr, Radarr and Lidarr integrations, pointed at the apps the mesh bound —
+// `sonarr-api`, `radarr-api`, `lidarr-api` (their providers: mesh-catalog #156).
+//
+// **What Home Assistant lets anyone change, and what it does not.** Each integration keeps a URL and
+// an API key in its config entry. None of the three has a reconfigure flow: Home Assistant changes
+// them only through the flow its UI runs —
+//   - a **user flow** makes a new entry (validated against the app);
+//   - a **reauth flow**, which Home Assistant starts by itself when the app refuses the key it holds,
+//     takes a new key (Sonarr) or a new URL and key (Radarr, Lidarr);
+//   - anything else — the URL of a working entry — only by removing the integration and adding it
+//     again, which throws away its entities' names, areas and history links. **This step never
+//     removes an entry.**
+// So, per app:
+//   1. The bound key is tried against the bound app first. Refused, nothing is written: until the
+//      operator accepts the app's own key for this pair, the mesh delivers a value it minted, which
+//      no Servarr app takes (novox/hq ADR 0092) — the failure names the `secret accept` that fixes it.
+//   2. No entry: one is made through the user flow.
+//   3. A reauth flow Home Assistant started for the entry: finished with the bound key (and URL,
+//      where the integration's reauth asks for one).
+//   4. An entry whose URL (read from the device the integration registered, `configuration_url`)
+//      is the bound one and which is loaded: already as the mesh says. The key needs no digest here:
+//      a Servarr app has one key, so an entry loaded against the app holds the key the app took.
+//   5. A working entry at a different URL that reaches **the same app** — the same process, by the
+//      app's own status (start time, data folder, version) — is left as it is and said: ace's entries
+//      say `127.0.0.1:<port>` and the binding says `ace.internal:<port>`, one Sonarr either way.
+//   6. Anything else is refused, loudly, with what the operator can do; nothing is removed.
+
+
+export interface ServarrApp {
+  /** The integration's domain, also the app. */
+  domain: "sonarr" | "radarr" | "lidarr";
+  /** The provision it is required as: the `requires`, `binds` and `secrets` key. */
+  provision: string;
+  /** The app's status endpoint: answers 401 to a wrong key, and says which process answered. */
+  statusPath: string;
+}
+
+export const APPS: readonly ServarrApp[] = [
+  { domain: "sonarr", provision: "sonarr-api", statusPath: "/api/v3/system/status" },
+  { domain: "radarr", provision: "radarr-api", statusPath: "/api/v3/system/status" },
+  { domain: "lidarr", provision: "lidarr-api", statusPath: "/api/v1/system/status" },
+];
+
+/** The HTTP the step needs toward the apps, so a test can stand fakes in. */
+export interface Http {
+  fetch(url: string, init?: { method?: string; headers?: Record<string, string> }): Promise<{ status: number; text(): Promise<string> }>;
+}
+
+export type AppWanted = { ok: true; url: string; key: string; from: string } | { ok: false; problem: string };
+
+/** The URL and key the mesh says Home Assistant uses for this app. */
+export function wantedApp(spec: ServarrApp, binding: Binding | undefined, credential: string | undefined): AppWanted {
+  if (!binding) return { ok: false, problem: `no binding for ${spec.provision} was delivered — the mesh writes it before this step runs` };
+  const at = typeof binding.at === "string" ? binding.at.trim() : "";
+  if (!at) return { ok: false, problem: `the ${spec.provision} binding names no host (at)` };
+  const port = portOf(binding.serves);
+  if (port === undefined) return { ok: false, problem: `the ${spec.provision} binding serves no usable port (${String(binding.serves?.port)})` };
+  const scheme = typeof binding.serves?.scheme === "string" && binding.serves.scheme ? binding.serves.scheme : "http";
+  if (scheme !== "http" && scheme !== "https") return { ok: false, problem: `the ${spec.provision} binding serves scheme ${scheme}` };
+  const base = typeof binding.serves?.["url-base"] === "string" ? String(binding.serves["url-base"]).trim().replace(/^\/+|\/+$/g, "") : "";
+  const key = (credential ?? "").trim();
+  if (!key) return { ok: false, problem: `the ${spec.provision} credential is empty or was not delivered` };
+  return {
+    ok: true,
+    url: `${scheme}://${urlHost(at)}:${port}${base ? `/${base}` : ""}`,
+    key,
+    from: typeof binding.from === "string" ? binding.from : "",
+  };
+}
+
+/** Two URLs naming the same place: scheme, host, port (explicit or default) and base path. */
+export function sameUrl(a: string | null | undefined, b: string): boolean {
+  if (!a) return false;
+  try {
+    const x = new URL(a);
+    const y = new URL(b);
+    const port = (u: URL) => u.port || (u.protocol === "https:" ? "443" : "80");
+    const path = (u: URL) => u.pathname.replace(/\/+$/, "");
+    return x.protocol === y.protocol && x.hostname.toLowerCase() === y.hostname.toLowerCase() && port(x) === port(y) && path(x) === path(y);
+  } catch {
+    return false;
+  }
+}
+
+type Status = { taken: true; status: Record<string, unknown> } | { taken: false };
+
+/** The app's status with this key: `taken: false` when it refuses the key; throws when it cannot be asked. */
+export async function appStatus(http: Http, spec: ServarrApp, url: string, key: string): Promise<Status> {
+  const res = await http.fetch(`${url.replace(/\/+$/, "")}${spec.statusPath}`, {
+    method: "GET",
+    headers: { "X-Api-Key": key, Accept: "application/json" },
+  });
+  if (res.status === 401 || res.status === 403) return { taken: false };
+  if (res.status < 200 || res.status >= 300) throw new Error(`${spec.domain} answered ${res.status} at ${spec.statusPath}`);
+  return { taken: true, status: JSON.parse(await res.text()) as Record<string, unknown> };
+}
+
+/** Whether two status answers came from one running app. */
+export function sameInstance(a: Record<string, unknown>, b: Record<string, unknown>): boolean {
+  const facts = ["startTime", "appData", "version"];
+  return facts.every((k) => a[k] !== undefined && a[k] !== null && a[k] === b[k]);
+}
+
+/** The remedy for a refused key, in the controller's words (ADR 0092). */
+export function acceptRemedy(spec: ServarrApp, from: string): string {
+  return (
+    `${spec.domain} refuses the ${spec.provision} credential the mesh delivered, so nothing was written into ` +
+    `Home Assistant. A Servarr app has one API key and the mesh cannot make it: accept ${spec.domain}'s own key ` +
+    `for this pair — \`secret accept <this node> home-assistant ${spec.provision} --provider ${from || "<its node>"} ` +
+    `--from <file holding ${spec.domain}'s ApiKey>\``
+  );
+}
+
+export interface ServarrDeps {
+  hass: Hass;
+  http: Http;
+}
+
+/** The input a Servarr form takes: what it shows, with the URL (where asked) and the key laid over. */
+function servarrInput(schema: readonly SchemaField[] | null | undefined, url: string, key: string): Record<string, unknown> {
+  const input = formValues(schema);
+  if (hasField(schema, "url")) input.url = url;
+  if (hasField(schema, "api_key")) input.api_key = key;
+  return input;
+}
+
+/** Bring Home Assistant's entry for one app in line with the mesh. Never throws. */
+export async function reconcileApp(deps: ServarrDeps, spec: ServarrApp, binding: Binding | undefined, credential: string | undefined): Promise<Outcome> {
+  const what = spec.domain;
+  const w = wantedApp(spec, binding, credential);
+  if ("problem" in w) return { what, result: "refused", problem: w.problem };
+
+  let bound: Status;
+  try {
+    bound = await appStatus(deps.http, spec, w.url, w.key);
+  } catch (err) {
+    return { what, result: "refused", problem: `${spec.domain} could not be asked at ${w.url}: ${scrub(err, w.key)}` };
+  }
+  if (!bound.taken) return { what, result: "refused", problem: acceptRemedy(spec, w.from) };
+
+  try {
+    const entries = (await deps.hass.entries(spec.domain)).filter((e) => e.domain === spec.domain);
+    if (entries.length > 1) {
+      return { what, result: "refused", problem: `Home Assistant has ${entries.length} ${spec.domain} entries; which one the mesh owns is not guessed` };
+    }
+
+    // No entry: made, through the integration's own user flow, which validates the key itself.
+    if (entries.length === 0) {
+      const flow = await deps.hass.startFlow(spec.domain);
+      if (flow.type !== "form" || !flow.flow_id) return { what, result: "refused", problem: `Home Assistant's ${spec.domain} user flow answered ${describe(flow)}` };
+      const made = await deps.hass.stepFlow(flow.flow_id, servarrInput(flow.data_schema, w.url, w.key));
+      if (made.type === "create_entry") return { what, result: "written", fields: ["entry"] };
+      if (made.flow_id) await deps.hass.abortFlow(made.flow_id);
+      return { what, result: "refused", problem: `Home Assistant refused a new ${spec.domain} entry at ${w.url} (${describe(made)})` };
+    }
+
+    const entry = entries[0];
+    if (entry.disabled_by) return { what, result: "unchanged", note: `the ${spec.domain} entry is disabled (by ${entry.disabled_by}); left alone` };
+
+    // A reauth Home Assistant started because the app refused its key: finished with the bound one.
+    const reauth = (await deps.hass.flowsInProgress()).find(
+      (f) => f.handler === spec.domain && f.context?.source === "reauth" && f.context?.entry_id === entry.entry_id,
+    );
+    if (reauth) {
+      let step = await deps.hass.stepFlow(reauth.flow_id, {}); // reauth_confirm: a confirmation, no fields
+      if (step.type === "form" && step.flow_id && step.step_id !== "reauth_confirm") {
+        const input = servarrInput(step.data_schema, w.url, w.key);
+        const fields = ["api_key", ...(hasField(step.data_schema, "url") ? ["url"] : [])];
+        step = await deps.hass.stepFlow(step.flow_id, input);
+        if (step.type === "abort" && step.reason === "reauth_successful") return { what, result: "written", fields };
+      }
+      return { what, result: "refused", problem: `Home Assistant's ${spec.domain} reauth did not take the bound key and URL (${describe(step)})` };
+    }
+
+    const device = (await deps.hass.devices()).find((d) => d.config_entries?.includes(entry.entry_id) && d.configuration_url);
+    const current = device?.configuration_url ?? undefined;
+    if (entry.state === "loaded" && sameUrl(current, w.url)) return { what, result: "unchanged" };
+
+    if (entry.state === "loaded" && current) {
+      let there: Status | undefined;
+      try {
+        there = await appStatus(deps.http, spec, current, w.key);
+      } catch {
+        there = undefined;
+      }
+      if (there?.taken && sameInstance(there.status, bound.status)) {
+        return {
+          what,
+          result: "equivalent",
+          note:
+            `Home Assistant reaches ${spec.domain} at ${current}, the same running app the mesh bound at ${w.url}; ` +
+            `Home Assistant has no way to change a working ${spec.domain} entry's URL short of removing it, so it is left as it is`,
+        };
+      }
+    }
+    return {
+      what,
+      result: "refused",
+      problem:
+        `Home Assistant's ${spec.domain} entry (${entry.state ?? "unknown state"}) points at ${current ?? "an unknown URL"}, ` +
+        `not the ${spec.domain} the mesh bound at ${w.url}. Home Assistant only lets a working entry's URL change by ` +
+        `removing and re-adding the integration, which this step never does: remove it in Home Assistant ` +
+        `(Settings → Devices & services → ${spec.domain}) and the next run adds it at the bound URL`,
+    };
+  } catch (err) {
+    return { what, result: "refused", problem: scrub(err, w.key) };
+  }
+}

modules/home-assistant/provisions/hass.ts

@@ -0,0 +1,160 @@
+// Home Assistant's own configuration API, as the provisions step uses it — the supported way to
+// change an integration's connection. Home Assistant keeps every integration in
+// `.storage/core.config_entries`, a file it owns and rewrites; the mesh may not write it, and it is
+// not a file the mesh could merge into. What Home Assistant offers instead is the same thing its UI
+// uses: **config flows** over REST (`/api/config/config_entries/flow`) — a user flow creates an
+// entry, a reconfigure flow changes one, a reauth flow (which Home Assistant starts itself when a
+// credential stops working) replaces its credential — each validated by the integration's own
+// connection test before anything is saved. The two things REST does not answer (which flows Home
+// Assistant has started, which device an entry made) come over its WebSocket API.
+//
+// Nothing here reads `.storage`. Authenticated with the module's accepted long-lived access token.
+
+/** A config entry as `GET /api/config/config_entries/entry` lists it — no data, no credentials. */
+export interface ConfigEntry {
+  entry_id: string;
+  domain: string;
+  title?: string;
+  source?: string;
+  state?: string;
+  disabled_by?: string | null;
+}
+
+/** One field of a flow's form, as Home Assistant serializes a voluptuous schema. */
+export interface SchemaField {
+  name: string;
+  type?: string;
+  required?: boolean;
+  optional?: boolean;
+  default?: unknown;
+  description?: { suggested_value?: unknown } | null;
+  /** A section (`type: "expandable"`) carries its own fields. */
+  schema?: SchemaField[];
+}
+
+/** What a flow answered: another form, an entry made, or the flow ended (abort). */
+export interface FlowResult {
+  type: string;
+  flow_id?: string;
+  handler?: string;
+  step_id?: string;
+  data_schema?: SchemaField[] | null;
+  errors?: Record<string, string> | null;
+  reason?: string;
+  result?: { entry_id?: string } | unknown;
+}
+
+/** A flow in progress that Home Assistant started itself (a reauth, a discovery). */
+export interface FlowProgress {
+  flow_id: string;
+  handler: string;
+  step_id?: string;
+  context?: { source?: string; entry_id?: string };
+}
+
+/** A device from the device registry; an integration names where its app is as configuration_url. */
+export interface DeviceEntry {
+  id: string;
+  config_entries?: string[];
+  configuration_url?: string | null;
+}
+
+export interface Hass {
+  entries(domain: string): Promise<ConfigEntry[]>;
+  /** A user flow for `handler`, or — given an entry — a reconfigure flow for it. */
+  startFlow(handler: string, entryId?: string): Promise<FlowResult>;
+  stepFlow(flowId: string, input: Record<string, unknown>): Promise<FlowResult>;
+  abortFlow(flowId: string): Promise<void>;
+  flowsInProgress(): Promise<FlowProgress[]>;
+  devices(): Promise<DeviceEntry[]>;
+}
+
+/** Home Assistant over HTTP: REST for entries and flows, one short WebSocket session per question. */
+export class HassApi implements Hass {
+  private readonly base: string;
+
+  constructor(url: string, private readonly token: string) {
+    this.base = url.replace(/\/$/, "");
+  }
+
+  private async rest(method: string, path: string, body?: unknown): Promise<unknown> {
+    const res = await fetch(`${this.base}${path}`, {
+      method,
+      headers: {
+        Authorization: `Bearer ${this.token}`,
+        Accept: "application/json",
+        ...(body !== undefined ? { "Content-Type": "application/json" } : {}),
+      },
+      body: body !== undefined ? JSON.stringify(body) : undefined,
+    });
+    const text = await res.text();
+    if (!res.ok) {
+      // Home Assistant's error text names fields, never echoes their values.
+      throw new Error(`Home Assistant ${method} ${path} answered ${res.status}${text ? `: ${text.slice(0, 200)}` : ""}`);
+    }
+    return text ? (JSON.parse(text) as unknown) : undefined;
+  }
+
+  async entries(domain: string): Promise<ConfigEntry[]> {
+    return ((await this.rest("GET", `/api/config/config_entries/entry?domain=${encodeURIComponent(domain)}`)) ??
+      []) as ConfigEntry[];
+  }
+
+  async startFlow(handler: string, entryId?: string): Promise<FlowResult> {
+    return (await this.rest("POST", "/api/config/config_entries/flow", {
+      handler,
+      show_advanced_options: true,
+      ...(entryId ? { entry_id: entryId } : {}),
+    })) as FlowResult;
+  }
+
+  async stepFlow(flowId: string, input: Record<string, unknown>): Promise<FlowResult> {
+    return (await this.rest("POST", `/api/config/config_entries/flow/${encodeURIComponent(flowId)}`, input)) as FlowResult;
+  }
+
+  async abortFlow(flowId: string): Promise<void> {
+    await this.rest("DELETE", `/api/config/config_entries/flow/${encodeURIComponent(flowId)}`).catch(() => undefined);
+  }
+
+  async flowsInProgress(): Promise<FlowProgress[]> {
+    return (await this.ws("config_entries/flow/progress")) as FlowProgress[];
+  }
+
+  async devices(): Promise<DeviceEntry[]> {
+    return (await this.ws("config/device_registry/list")) as DeviceEntry[];
+  }
+
+  /** One WebSocket command: connect, authenticate, ask, close. */
+  private ws(type: string): Promise<unknown> {
+    const url = `${this.base.replace(/^http/, "ws")}/api/websocket`;
+    return new Promise((resolve, reject) => {
+      const socket = new WebSocket(url);
+      const timer = setTimeout(() => {
+        socket.close();
+        reject(new Error(`Home Assistant's WebSocket did not answer ${type} within 30s`));
+      }, 30_000);
+      const done = (fn: () => void): void => {
+        clearTimeout(timer);
+        socket.close();
+        fn();
+      };
+      socket.onerror = () => done(() => reject(new Error(`Home Assistant's WebSocket at ${url} failed`)));
+      socket.onmessage = (event: { data: unknown }) => {
+        const msg = JSON.parse(String(event.data)) as {
+          type: string;
+          id?: number;
+          success?: boolean;
+          result?: unknown;
+          error?: { message?: string };
+        };
+        if (msg.type === "auth_required") socket.send(JSON.stringify({ type: "auth", access_token: this.token }));
+        else if (msg.type === "auth_invalid") done(() => reject(new Error("Home Assistant refused the token")));
+        else if (msg.type === "auth_ok") socket.send(JSON.stringify({ id: 1, type }));
+        else if (msg.type === "result" && msg.id === 1) {
+          if (msg.success) done(() => resolve(msg.result));
+          else done(() => reject(new Error(`Home Assistant ${type}: ${msg.error?.message ?? "failed"}`)));
+        }
+      };
+    });
+  }
+}

modules/home-assistant/provisions/index.ts

@@ -0,0 +1,84 @@
+// home-assistant's provisions step — run once by the host after Home Assistant starts, and again
+// whenever a binding or pair credential it reads changes (the container's `restart-on`, novox/hq
+// ADR 0099). It points Home Assistant's MQTT integration at the `mqtt-topic` broker and its Sonarr,
+// Radarr and Lidarr integrations at the `sonarr-api`, `radarr-api` and `lidarr-api` apps, through
+// Home Assistant's own config flows (connections.ts). It connects to no mesh broker.
+//
+// Exits non-zero when anything could not be put right, so the node reports the step failed and the
+// host runs it again on the next apply. Declared last in the manifest, so its failing gates nothing
+// else of home-assistant's (novox/hq ADR 0136). Never prints a key or password.
+
+import { join } from "node:path";
+
+import { APPS, MQTT_PROVISION, reconcileApp, reconcileMqtt, type Outcome } from "./connections.js";
+import { HassApi } from "./hass.js";
+import { marksIn, readBinding, readIfThere } from "./mesh.js";
+import { probeBroker } from "./probe.js";
+
+const dir = process.env.MESH_PROVISIONS_DIR ?? "/run/provisions";
+const url = process.env.MESH_HOMEASSISTANT_URL ?? "http://127.0.0.1:8123";
+const token = (await readIfThere(process.env.MESH_HOMEASSISTANT_TOKEN_FILE))?.trim() ?? "";
+const marks = marksIn(process.env.MESH_WRITTEN_DIR ?? "/var/lib/home-assistant-provisions");
+const waitSeconds = Number(process.env.MESH_HOMEASSISTANT_WAIT_SECONDS ?? "300");
+
+if (!token) {
+  console.error("[hass-provisions] no Home Assistant token — home-assistant's own `token` secret has not been accepted");
+  process.exit(1);
+}
+
+/** Home Assistant answers /api/ with 200 once it is up and the token is good. */
+async function ready(): Promise<boolean> {
+  const until = Date.now() + waitSeconds * 1000;
+  for (;;) {
+    try {
+      const res = await fetch(`${url.replace(/\/$/, "")}/api/`, { headers: { Authorization: `Bearer ${token}` } });
+      if (res.status === 200) return true;
+      if (res.status === 401 || res.status === 403) {
+        console.error("[hass-provisions] Home Assistant refuses the token — accept a long-lived access token it issued");
+        return false;
+      }
+    } catch {
+      // not listening yet
+    }
+    if (Date.now() >= until) return false;
+    await new Promise((r) => setTimeout(r, 3000));
+  }
+}
+
+if (!(await ready())) {
+  console.error(`[hass-provisions] Home Assistant did not answer at ${url} within ${waitSeconds}s`);
+  process.exit(1);
+}
+
+const hass = new HassApi(url, token);
+const read = async (p: string) => [await readBinding(join(dir, `${p}.json`)), await readIfThere(join(dir, `${p}.secret`))] as const;
+
+const outcomes: Outcome[] = [];
+{
+  const [binding, secret] = await read(MQTT_PROVISION);
+  outcomes.push(await reconcileMqtt({ hass, probe: probeBroker, marks }, binding, secret));
+}
+for (const spec of APPS) {
+  const [binding, secret] = await read(spec.provision);
+  outcomes.push(await reconcileApp({ hass, http: { fetch: (u, init) => fetch(u, init) } }, spec, binding, secret));
+}
+
+let failed = 0;
+for (const o of outcomes) {
+  switch (o.result) {
+    case "unchanged":
+      console.log(`[hass-provisions] ${o.what}: already as the mesh says${o.note ? ` — ${o.note}` : ""}`);
+      break;
+    case "written":
+      console.log(`[hass-provisions] ${o.what}: wrote ${o.fields.join(", ")}; Home Assistant's own test passed${o.note ? ` — ${o.note}` : ""}`);
+      break;
+    case "equivalent":
+      console.log(`[hass-provisions] ${o.what}: ${o.note}`);
+      break;
+    case "refused":
+      failed++;
+      console.error(`[hass-provisions] ${o.what}: ${o.problem}`);
+      break;
+  }
+}
+process.exitCode = failed > 0 ? 1 : 0;

modules/home-assistant/provisions/mesh.ts

@@ -0,0 +1,42 @@
+// What the mesh delivered to home-assistant's provisions step, and the step's own small memory.
+//
+// Per provision it requires, the mesh writes two files beside each other (the manifest's `binds` and
+// `secrets`): `<provision>.json`, the binding — where the provider is (`at`), what it serves (`port`,
+// `scheme`, …) and the login this module presents (`as`) — and `<provision>.secret`, the pair
+// credential. Nothing here guesses a host, a port or a key.
+
+import { mkdir, readFile, rename, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+
+import type { Binding, Marks } from "./connections.js";
+
+/** A file the mesh wrote, or undefined when it is not there. */
+export async function readIfThere(path: string | undefined): Promise<string | undefined> {
+  if (!path) return undefined;
+  return readFile(path, "utf8").catch(() => undefined);
+}
+
+/** A binding file parsed, or undefined when absent or not JSON. */
+export async function readBinding(path: string): Promise<Binding | undefined> {
+  const raw = await readIfThere(path);
+  if (raw === undefined) return undefined;
+  try {
+    return JSON.parse(raw) as Binding;
+  } catch {
+    return undefined;
+  }
+}
+
+export function marksIn(dir: string): Marks {
+  return {
+    async get(name) {
+      return (await readIfThere(join(dir, `${name}.digest`)))?.trim() || undefined;
+    },
+    async set(name, value) {
+      await mkdir(dir, { recursive: true, mode: 0o700 });
+      const path = join(dir, `${name}.digest`);
+      await writeFile(`${path}.tmp`, `${value}\n`, { mode: 0o600 });
+      await rename(`${path}.tmp`, path);
+    },
+  };
+}

modules/home-assistant/provisions/probe.ts

@@ -0,0 +1,117 @@
+// Ask the broker, before Home Assistant is told anything, whether it takes the login and password
+// the mesh delivered — and whether that login may subscribe to Home Assistant's discovery topics.
+//
+// One MQTT 3.1.1 session: CONNECT (clean, a throwaway client id, so Home Assistant's own session is
+// never taken over), read the CONNACK, optionally SUBSCRIBE once and read the SUBACK, DISCONNECT.
+// No dependency: the handful of bytes MQTT needs for this are written here.
+
+import { randomBytes } from "node:crypto";
+import { connect } from "node:net";
+
+export interface ProbeResult {
+  /** 0 accepted; 4 bad username or password; 5 not authorised. */
+  connack: number;
+  /** The SUBACK return code for the filter asked about: 0–2 granted, 0x80 refused. */
+  suback?: number;
+}
+
+export type Probe = (host: string, port: number, username: string, password: string, subscribe?: string) => Promise<ProbeResult>;
+
+function str(v: string): Buffer {
+  const b = Buffer.from(v, "utf8");
+  const len = Buffer.alloc(2);
+  len.writeUInt16BE(b.length);
+  return Buffer.concat([len, b]);
+}
+
+function packet(type: number, body: Buffer): Buffer {
+  let remaining = body.length;
+  const lenBytes: number[] = [];
+  do {
+    let byte = remaining % 128;
+    remaining = Math.floor(remaining / 128);
+    if (remaining > 0) byte |= 0x80;
+    lenBytes.push(byte);
+  } while (remaining > 0);
+  return Buffer.concat([Buffer.from([type, ...lenBytes]), body]);
+}
+
+/** The first complete packet in `buf`: its type byte, its body, and how many bytes it took. */
+export function firstPacket(buf: Buffer): { type: number; body: Buffer; used: number } | undefined {
+  if (buf.length < 2) return undefined;
+  let length = 0;
+  let multiplier = 1;
+  let i = 1;
+  for (;;) {
+    if (i >= buf.length) return undefined;
+    const byte = buf[i++];
+    length += (byte & 0x7f) * multiplier;
+    if ((byte & 0x80) === 0) break;
+    multiplier *= 128;
+    if (i > 4) throw new Error("malformed MQTT remaining length");
+  }
+  if (buf.length < i + length) return undefined;
+  return { type: buf[0], body: buf.subarray(i, i + length), used: i + length };
+}
+
+export const probeBroker: Probe = (host, port, username, password, subscribe) => {
+  const connectBody = Buffer.concat([
+    str("MQTT"),
+    Buffer.from([4, 0xc2, 0, 10]), // level 4 (3.1.1); username + password + clean session; keepalive 10s
+    str(`mesh-probe-${randomBytes(6).toString("hex")}`),
+    str(username),
+    str(password),
+  ]);
+  return new Promise((resolve, reject) => {
+    const socket = connect({ host, port });
+    let buf = Buffer.alloc(0);
+    const result: ProbeResult = { connack: -1 };
+    const timer = setTimeout(() => {
+      socket.destroy();
+      reject(new Error(`no answer from the broker at ${host}:${port} within 10s`));
+    }, 10_000);
+    const finish = (): void => {
+      clearTimeout(timer);
+      if (result.connack === 0) socket.end(Buffer.from([0xe0, 0]));
+      else socket.destroy();
+      resolve(result);
+    };
+    socket.on("connect", () => socket.write(packet(0x10, connectBody)));
+    socket.on("data", (chunk) => {
+      buf = Buffer.concat([buf, chunk]);
+      for (;;) {
+        let p;
+        try {
+          p = firstPacket(buf);
+        } catch (err) {
+          clearTimeout(timer);
+          socket.destroy();
+          reject(err);
+          return;
+        }
+        if (!p) return;
+        buf = buf.subarray(p.used);
+        const kind = p.type >> 4;
+        if (kind === 2) {
+          result.connack = p.body[1] ?? -1;
+          if (result.connack !== 0 || !subscribe) return finish();
+          // SUBSCRIBE, packet id 1, one filter at QoS 0.
+          socket.write(packet(0x82, Buffer.concat([Buffer.from([0, 1]), str(subscribe), Buffer.from([0])])));
+        } else if (kind === 9) {
+          result.suback = p.body[2];
+          return finish();
+        }
+      }
+    });
+    socket.on("error", (err) => {
+      clearTimeout(timer);
+      reject(err);
+    });
+    socket.on("close", () => {
+      if (result.connack === -1) {
+        clearTimeout(timer);
+        reject(new Error(`the broker at ${host}:${port} closed the connection without answering`));
+      }
+    });
+  });
+};

modules/home-assistant/test/provisions.test.ts

@@ -0,0 +1,293 @@
+// What holds home-assistant's provisions step (provisions/*.ts): Home Assistant's MQTT entry is
+// made to use the broker, port and login the mesh bound — only after the broker takes that login,
+// through the reconfigure flow, keeping every other setting as Home Assistant pre-filled it, and not
+// again once it already says so; its Sonarr/Radarr/Lidarr entries are made, finished (reauth), left
+// alone when they already reach the bound app, and never removed; a key the app refuses (the mesh's
+// minted value before the operator accepts the app's) is never written.
+//
+// Home Assistant and the apps are fakes answering as the real ones do (flow shapes checked against
+// ghcr.io/home-assistant/home-assistant 2026.9.3, the build ace runs).
+
+import { test } from "node:test";
+import assert from "node:assert/strict";
+
+import type { ConfigEntry, DeviceEntry, FlowProgress, FlowResult, Hass, SchemaField } from "../provisions/hass.ts";
+
+import type { Binding, Marks } from "../provisions/connections.ts";
+import { APPS, formValues, reconcileApp, reconcileMqtt, sameUrl, type Http, type ServarrApp } from "../provisions/connections.ts";
+import type { Probe } from "../provisions/probe.ts";
+
+const PWD_NOT_CHANGED = "__**password_not_changed**__";
+const MINTED = "mesh-minted-password";
+
+function mqttBinding(): Binding {
+  return { provision: "mqtt-topic", from: "ace", at: "ace.internal", as: "mesh_ace_hass", serves: { scheme: "mqtt", port: 1883 } };
+}
+
+/** The MQTT reconfigure form as Home Assistant serializes it, pre-filled from an entry. */
+function brokerForm(data: Record<string, unknown>): SchemaField[] {
+  return [
+    { name: "broker", type: "string", required: true, description: { suggested_value: data.broker } },
+    { name: "port", type: "integer", required: true, default: 1883, description: { suggested_value: data.port } },
+    { name: "protocol", type: "select", required: true, default: "3.1.1", description: { suggested_value: data.protocol } },
+    { name: "username", type: "string", optional: true, description: { suggested_value: data.username } },
+    { name: "password", type: "string", optional: true, description: { suggested_value: data.password ? PWD_NOT_CHANGED : undefined } },
+    {
+      name: "other_settings",
+      type: "expandable",
+      required: true,
+      schema: [
+        { name: "keepalive", type: "integer", optional: true, description: { suggested_value: 60 } },
+        { name: "transport", type: "select", required: true, default: "tcp", description: { suggested_value: "tcp" } },
+        { name: "set_ca_cert", type: "select", required: true, description: { suggested_value: "off" } },
+        { name: "set_client_cert", type: "boolean", required: true, description: { suggested_value: false } },
+      ],
+    },
+  ];
+}
+
+interface FakeOpts {
+  entries?: Record<string, (ConfigEntry & { data: Record<string, unknown> })[]>;
+  /** What Home Assistant's own connection test accepts. */
+  accepts?: (data: Record<string, unknown>) => boolean;
+  reauth?: FlowProgress[];
+  devices?: DeviceEntry[];
+}
+
+function fakeHass(opts: FakeOpts = {}) {
+  const entries = opts.entries ?? {};
+  const calls: string[] = [];
+  const submitted: Record<string, unknown>[] = [];
+  const flows = new Map<string, { handler: string; entryId?: string; step: string; reauth?: boolean }>();
+  let n = 0;
+  const accepts = opts.accepts ?? (() => true);
+  const form = (id: string, step: string, schema: SchemaField[], errors?: Record<string, string>): FlowResult => ({
+    type: "form", flow_id: id, step_id: step, data_schema: schema, errors: errors ?? null,
+  });
+  const servarrUser: SchemaField[] = [
+    { name: "url", type: "string", required: true },
+    { name: "api_key", type: "string", required: true },
+    { name: "more_options", type: "expandable", required: true, schema: [{ name: "verify_ssl", type: "boolean", optional: true, default: false }] },
+  ];
+  const hass: Hass = {
+    async entries(domain) {
+      calls.push(`entries ${domain}`);
+      return (entries[domain] ?? []).map(({ data: _d, ...e }) => e);
+    },
+    async startFlow(handler, entryId) {
+      calls.push(`start ${handler}${entryId ? ` ${entryId}` : ""}`);
+      const id = `f${++n}`;
+      if (handler === "mqtt") {
+        const entry = entryId ? entries.mqtt.find((e) => e.entry_id === entryId) : undefined;
+        if (entryId && !entry) return { type: "abort", reason: "not_found" };
+        flows.set(id, { handler, entryId, step: "broker" });
+        return form(id, "broker", brokerForm(entry?.data ?? {}));
+      }
+      if (entryId) return { type: "abort", reason: "not_implemented" }; // no reconfigure for Servarr
+      flows.set(id, { handler, step: "user" });
+      return form(id, "user", servarrUser);
+    },
+    async stepFlow(flowId, input) {
+      calls.push(`step ${flowId}`);
+      const flow = flows.get(flowId);
+      if (!flow) throw new Error(`Home Assistant POST flow/${flowId} answered 404`);
+      if (flow.step === "reauth_confirm") {
+        flow.step = "user";
+        return form(flowId, "user", [
+          { name: "url", type: "string", required: true, default: "http://old:1" },
+          { name: "api_key", type: "string", optional: true },
+          { name: "verify_ssl", type: "boolean", optional: true, default: false },
+        ]);
+      }
+      submitted.push(input);
+      if (flow.handler === "mqtt") {
+        const entry = entries.mqtt?.find((e) => e.entry_id === flow.entryId);
+        const data = { ...input, ...(input.password === PWD_NOT_CHANGED ? { password: entry?.data.password } : {}) };
+        if (!accepts(data)) return form(flowId, "broker", brokerForm(data), { base: "cannot_connect" });
+        flows.delete(flowId);
+        if (entry) {
+          entry.data = data;
+          return { type: "abort", reason: "reconfigure_successful" };
+        }
+        (entries.mqtt ??= []).push({ entry_id: "new-mqtt", domain: "mqtt", state: "loaded", data });
+        return { type: "create_entry", result: { entry_id: "new-mqtt" } };
+      }
+      if (!accepts(input)) return form(flowId, "user", servarrUser, { base: "invalid_auth" });
+      flows.delete(flowId);
+      if (flow.reauth) return { type: "abort", reason: "reauth_successful" };
+      (entries[flow.handler] ??= []).push({ entry_id: `new-${flow.handler}`, domain: flow.handler, state: "loaded", data: input });
+      return { type: "create_entry", result: { entry_id: `new-${flow.handler}` } };
+    },
+    async abortFlow(flowId) {
+      calls.push(`abort ${flowId}`);
+      flows.delete(flowId);
+    },
+    async flowsInProgress() {
+      for (const f of opts.reauth ?? []) flows.set(f.flow_id, { handler: f.handler, entryId: f.context?.entry_id, step: "reauth_confirm", reauth: true });
+      return opts.reauth ?? [];
+    },
+    async devices() {
+      return opts.devices ?? [];
+    },
+  };
+  return { hass, calls, submitted, entries };
+}
+
+function memoryMarks(): Marks & { store: Map<string, string> } {
+  const store = new Map<string, string>();
+  return { store, get: async (k) => store.get(k), set: async (k, v) => void store.set(k, v) };
+}
+
+const takes = (suback = 0): Probe => async (_h, _p, user, pass) => ({ connack: user === "mesh_ace_hass" && pass === MINTED ? 0 : 5, suback });
+
+const aceMqttEntry = () => ({
+  entry_id: "7d1e", domain: "mqtt", state: "loaded",
+  data: { broker: "127.0.0.1", port: 1883, protocol: "5", username: "luffy", password: "luffys-password" },
+});
+
+test("mqtt: the broker is asked first; a login it does not take is never written", async () => {
+  const f = fakeHass({ entries: { mqtt: [aceMqttEntry()] } });
+  const out = await reconcileMqtt({ hass: f.hass, probe: async () => ({ connack: 5 }), marks: memoryMarks() }, mqttBinding(), MINTED);
+  assert.equal(out.result, "refused");
+  assert.match((out as { problem: string }).problem, /does not \(yet\) take the login mesh_ace_hass/);
+  assert.deepEqual(f.calls, []); // Home Assistant not even asked
+  assert.equal(f.entries.mqtt[0].data.username, "luffy");
+});
+
+test("mqtt: ace's entry (127.0.0.1, luffy) is moved to the bound broker and login, every other setting kept", async () => {
+  const f = fakeHass({ entries: { mqtt: [aceMqttEntry()] } });
+  const marks = memoryMarks();
+  const out = await reconcileMqtt({ hass: f.hass, probe: takes(), marks }, mqttBinding(), `${MINTED}\n`);
+  assert.deepEqual(out, { what: "mqtt", result: "written", fields: ["broker", "username", "password"] });
+  assert.deepEqual(f.entries.mqtt[0].data, {
+    broker: "ace.internal", port: 1883, protocol: "5", username: "mesh_ace_hass", password: MINTED,
+    other_settings: { keepalive: 60, transport: "tcp", set_ca_cert: "off", set_client_cert: false },
+  });
+  assert.ok(marks.store.get("mqtt"));
+  assert.ok(![...marks.store.values()].some((v) => v.includes(MINTED)));
+
+  // Run again: nothing differs, the flow is opened to read and closed without submitting.
+  const before = f.submitted.length;
+  const again = await reconcileMqtt({ hass: f.hass, probe: takes(), marks }, mqttBinding(), MINTED);
+  assert.deepEqual(again, { what: "mqtt", result: "unchanged" });
+  assert.equal(f.submitted.length, before);
+  assert.match(f.calls.at(-1) ?? "", /^abort /);
+});
+
+test("mqtt: a new password alone is written (the digest tells)", async () => {
+  const f = fakeHass({ entries: { mqtt: [aceMqttEntry()] } });
+  const marks = memoryMarks();
+  await reconcileMqtt({ hass: f.hass, probe: takes(), marks }, mqttBinding(), MINTED);
+  const rotated: Probe = async () => ({ connack: 0, suback: 0 });
+  const out = await reconcileMqtt({ hass: f.hass, probe: rotated, marks }, mqttBinding(), "rotated");
+  assert.deepEqual(out, { what: "mqtt", result: "written", fields: ["password"] });
+  assert.equal(f.entries.mqtt[0].data.password, "rotated");
+});
+
+test("mqtt: Home Assistant's own connection test refusing saves nothing and fails loudly", async () => {
+  const f = fakeHass({ entries: { mqtt: [aceMqttEntry()] }, accepts: () => false });
+  const marks = memoryMarks();
+  const out = await reconcileMqtt({ hass: f.hass, probe: takes(), marks }, mqttBinding(), MINTED);
+  assert.equal(out.result, "refused");
+  assert.match((out as { problem: string }).problem, /cannot_connect.*unchanged/);
+  assert.equal(f.entries.mqtt[0].data.username, "luffy");
+  assert.equal(marks.store.size, 0);
+});
+
+test("mqtt: a fresh Home Assistant gets an entry; a grant without the discovery topics is warned about", async () => {
+  const f = fakeHass();
+  const out = await reconcileMqtt({ hass: f.hass, probe: takes(0x80), marks: memoryMarks() }, mqttBinding(), MINTED);
+  assert.equal(out.result, "written");
+  assert.match((out as { note?: string }).note ?? "", /may not subscribe to homeassistant\/#/);
+  assert.equal(f.entries.mqtt[0].data.broker, "ace.internal");
+});
+
+test("mqtt: two entries, or a binding without a port, are refused rather than guessed", async () => {
+  const f = fakeHass({ entries: { mqtt: [aceMqttEntry(), { ...aceMqttEntry(), entry_id: "other" }] } });
+  assert.equal((await reconcileMqtt({ hass: f.hass, probe: takes(), marks: memoryMarks() }, mqttBinding(), MINTED)).result, "refused");
+  const noPort = { ...mqttBinding(), serves: {} };
+  assert.match(((await reconcileMqtt({ hass: f.hass, probe: takes(), marks: memoryMarks() }, noPort, MINTED)) as { problem: string }).problem, /no usable port/);
+});
+
+// ---- Servarr ----
+
+const SONARR = APPS.find((a) => a.domain === "sonarr") as ServarrApp;
+const RADARR = APPS.find((a) => a.domain === "radarr") as ServarrApp;
+const KEY = "the-apps-own-key";
+const servarrBinding = (port: number, at = "ace.internal"): Binding => ({ provision: "sonarr-api", from: "ace", at, as: "mesh_ace_hass", serves: { scheme: "http", port, "url-base": "" } });
+
+/** One running Sonarr, answering on several addresses (127.0.0.1 and ace.internal are one host). */
+function apps(instances: Record<string, { startTime: string }>): Http & { asked: string[] } {
+  const asked: string[] = [];
+  return {
+    asked,
+    async fetch(url, init) {
+      asked.push(url);
+      const u = new URL(url);
+      const inst = instances[`${u.hostname}:${u.port}`];
+      if (!inst) throw new Error("connect ECONNREFUSED");
+      if (init?.headers?.["X-Api-Key"] !== KEY) return { status: 401, text: async () => "" };
+      return { status: 200, text: async () => JSON.stringify({ version: "4.0.15", appData: "/config", startTime: inst.startTime }) };
+    },
+  };
+}
+const oneSonarr = () => apps({ "ace.internal:8989": { startTime: "t1" }, "127.0.0.1:8989": { startTime: "t1" } });
+const sonarrEntry = (state = "loaded") => ({ entry_id: "5a1d", domain: "sonarr", state, data: { url: "http://127.0.0.1:8989", api_key: KEY } });
+
+test("servarr: the mesh's minted key is never written; the remedy names the accept", async () => {
+  const f = fakeHass({ entries: { sonarr: [sonarrEntry()] } });
+  const out = await reconcileApp({ hass: f.hass, http: oneSonarr() }, SONARR, servarrBinding(8989), "minted-by-the-mesh");
+  assert.equal(out.result, "refused");
+  assert.match((out as { problem: string }).problem, /secret accept <this node> home-assistant sonarr-api --provider ace/);
+  assert.deepEqual(f.calls, []);
+});
+
+test("servarr: ace's entry at 127.0.0.1 reaches the same Sonarr the mesh bound at ace.internal — left, and said", async () => {
+  const f = fakeHass({ entries: { sonarr: [sonarrEntry()] }, devices: [{ id: "d", config_entries: ["5a1d"], configuration_url: "http://127.0.0.1:8989" }] });
+  const out = await reconcileApp({ hass: f.hass, http: oneSonarr() }, SONARR, servarrBinding(8989), KEY);
+  assert.equal(out.result, "equivalent");
+  assert.equal(f.submitted.length, 0);
+});
+
+test("servarr: an entry already at the bound URL is unchanged", async () => {
+  const f = fakeHass({ entries: { sonarr: [sonarrEntry()] }, devices: [{ id: "d", config_entries: ["5a1d"], configuration_url: "http://ace.internal:8989" }] });
+  assert.deepEqual(await reconcileApp({ hass: f.hass, http: oneSonarr() }, SONARR, servarrBinding(8989), KEY), { what: "sonarr", result: "unchanged" });
+});
+
+test("servarr: a working entry that reaches a different app is refused, and nothing is removed", async () => {
+  const f = fakeHass({ entries: { sonarr: [sonarrEntry()] }, devices: [{ id: "d", config_entries: ["5a1d"], configuration_url: "http://127.0.0.1:8989" }] });
+  const two = apps({ "ace.internal:8989": { startTime: "t1" }, "127.0.0.1:8989": { startTime: "another" } });
+  const out = await reconcileApp({ hass: f.hass, http: two }, SONARR, servarrBinding(8989), KEY);
+  assert.equal(out.result, "refused");
+  assert.match((out as { problem: string }).problem, /never does/);
+  assert.equal(f.entries.sonarr.length, 1);
+});
+
+test("servarr: no entry — one is made at the bound URL through the user flow", async () => {
+  const f = fakeHass({ entries: {} });
+  const out = await reconcileApp({ hass: f.hass, http: oneSonarr() }, SONARR, servarrBinding(8989), KEY);
+  assert.deepEqual(out, { what: "sonarr", result: "written", fields: ["entry"] });
+  assert.deepEqual(f.submitted[0], { url: "http://ace.internal:8989", api_key: KEY, more_options: { verify_ssl: false } });
+});
+
+test("servarr: a reauth Home Assistant started is finished with the bound URL and key", async () => {
+  const entry = { ...sonarrEntry("setup_error"), domain: "radarr", entry_id: "1955" };
+  const f = fakeHass({
+    entries: { radarr: [entry] },
+    reauth: [{ flow_id: "r1", handler: "radarr", step_id: "reauth_confirm", context: { source: "reauth", entry_id: "1955" } }],
+  });
+  const radarr = apps({ "ace.internal:7878": { startTime: "t" } });
+  const out = await reconcileApp({ hass: f.hass, http: radarr }, RADARR, { ...servarrBinding(7878), provision: "radarr-api" }, KEY);
+  assert.deepEqual(out, { what: "radarr", result: "written", fields: ["api_key", "url"] });
+  assert.deepEqual(f.submitted[0], { url: "http://ace.internal:7878", api_key: KEY, verify_ssl: false });
+});
+
+test("form values: suggested first, then default, sections nested", () => {
+  assert.deepEqual(formValues(brokerForm({ broker: "b", port: 1, protocol: "5", username: "u", password: "p" })), {
+    broker: "b", port: 1, protocol: "5", username: "u", password: PWD_NOT_CHANGED,
+    other_settings: { keepalive: 60, transport: "tcp", set_ca_cert: "off", set_client_cert: false },
+  });
+  assert.ok(sameUrl("http://ace.internal:8989/", "http://ace.internal:8989"));
+  assert.ok(sameUrl("http://ACE.internal", "http://ace.internal:80"));
+  assert.ok(!sameUrl("http://127.0.0.1:8989", "http://ace.internal:8989"));
+});

modules/home-assistant/tsconfig.json

@@ -8,5 +8,14 @@
     "skipLibCheck": true,
     "noEmit": true
   },
-  "include": ["client.ts", "index.ts", "tools/index.ts"]
+  "include": [
+    "client.ts",
+    "index.ts",
+    "tools/index.ts",
+    "provisions/hass.ts",
+    "provisions/probe.ts",
+    "provisions/connections.ts",
+    "provisions/mesh.ts",
+    "provisions/index.ts"
+  ]
 }

modules/icecast/module.json

@@ -29,7 +29,7 @@
     "stream.stopped"
   ],
   "own-secrets": {
-    "broker": "/var/lib/mesh/icecast/broker"
+    "broker": "${dir:mesh-state}/broker"
   },
   "listens": [
     {
@@ -44,8 +44,8 @@
     {
       "id": "mesh-state",
       "type": "directory",
-      "path": "/var/lib/mesh/icecast",
-      "mode": "0700"
+      "mode": "0700",
+      "place": "mesh"
     },
     {
       "id": "state",
@@ -91,7 +91,7 @@
     {
       "id": "runtime-config",
       "type": "file",
-      "path": "/var/lib/mesh/icecast/config.json",
+      "path": "${dir:mesh-state}/config.json",
       "mode": "0600",
       "content": "{}\n",
       "merge": "json"
@@ -102,8 +102,8 @@
       "name": "mesh-icecast",
       "network": "icecast",
       "volumes": [
-        "/var/lib/mesh/icecast/broker:/run/secrets/broker:ro",
-        "/var/lib/mesh/icecast/config.json:/run/config/config.json:ro"
+        "${dir:mesh-state}/broker:/run/secrets/broker:ro",
+        "${dir:mesh-state}/config.json:/run/config/config.json:ro"
       ],
       "env": {
         "MESH_BROKER_FILE": "/run/secrets/broker",

modules/influxdb/module.json

@@ -11,7 +11,7 @@
     "container-runtime"
   ],
   "own-secrets": {
-    "broker": "/var/lib/mesh/influxdb/broker",
+    "broker": "${dir:mesh-state}/broker",
     "admin": "${dir:state}/admin.secret",
     "admin-token": "${dir:state}/admin-token.secret"
   },
@@ -42,8 +42,8 @@
     {
       "id": "mesh-state",
       "type": "directory",
-      "path": "/var/lib/mesh/influxdb",
-      "mode": "0700"
+      "mode": "0700",
+      "place": "mesh"
     },
     {
       "id": "state",
@@ -96,7 +96,7 @@
     {
       "id": "runtime-config",
       "type": "file",
-      "path": "/var/lib/mesh/influxdb/config.json",
+      "path": "${dir:mesh-state}/config.json",
       "mode": "0600",
       "content": "{}\n",
       "merge": "json"
@@ -107,8 +107,8 @@
       "name": "mesh-influxdb",
       "network": "host",
       "volumes": [
-        "/var/lib/mesh/influxdb/broker:/run/secrets/broker:ro",
-        "/var/lib/mesh/influxdb/config.json:/run/config/config.json:ro",
+        "${dir:mesh-state}/broker:/run/secrets/broker:ro",
+        "${dir:mesh-state}/config.json:/run/config/config.json:ro",
         "${dir:state}/admin-token.secret:/run/secrets/admin-token:ro",
         "${dir:grants}:${dir:grants}:ro"
       ],

modules/invoicing/module.json

@@ -26,13 +26,13 @@
     }
   },
   "binds": {
-    "mongodb-database": "/var/lib/invoicing/database.json",
-    "s3-bucket": "/var/lib/invoicing/store.json",
-    "route": "/var/lib/invoicing/route.json"
+    "mongodb-database": "${dir:state}/database.json",
+    "s3-bucket": "${dir:state}/store.json",
+    "route": "${dir:state}/route.json"
   },
   "secrets": {
-    "mongodb-database": "/var/lib/invoicing/database.secret",
-    "s3-bucket": "/var/lib/invoicing/store.secret"
+    "mongodb-database": "${dir:state}/database.secret",
+    "s3-bucket": "${dir:state}/store.secret"
   },
   "listens": [
     {
@@ -54,19 +54,19 @@
     {
       "id": "mesh-state",
       "type": "directory",
-      "path": "/var/lib/mesh/invoicing",
-      "mode": "0700"
+      "mode": "0700",
+      "place": "mesh"
     },
     {
       "id": "state",
       "type": "directory",
-      "path": "/var/lib/invoicing",
-      "mode": "0700"
+      "mode": "0700",
+      "place": "."
     },
     {
       "id": "api-env",
       "type": "file",
-      "path": "/var/lib/invoicing/api.env",
+      "path": "${dir:state}/api.env",
       "mode": "0600",
       "content": "NODE_ENV=production\nPORT=9000\nMONGO_URL=mongodb://${bound:mongodb-database:as}:${secret:mongodb-database}@${bound:mongodb-database:at}:${bound:mongodb-database:port}/${bound:mongodb-database:as}?authSource=${bound:mongodb-database:as}\nMONGO_DB=${bound:mongodb-database:as}\nMINIO_BUCKET=mesh-novox-invoice\nMINIO_ENDPOINT=${bound:s3-bucket:at}\nMINIO_PORT=${bound:s3-bucket:port}\nMINIO_ACCESSKEY=${bound:s3-bucket:as}\nMINIO_SECRET=${secret:s3-bucket}\n"
     },
@@ -103,7 +103,7 @@
         "GID": "2201"
       },
       "env-file": [
-        "/var/lib/invoicing/api.env"
+        "${dir:state}/api.env"
       ],
       "ports": [
         "9000"

modules/jackett/Dockerfile

@@ -1,24 +0,0 @@
-# jackett's runtime: the tool runtime, carrying this module's compiled code.
-#
-# **Built from this module's own directory and nothing else.** The sdk and the tool runtime are in
-# the base images, published like any other artifact — which is what makes this buildable by the
-# mesh from a repository and a path (novox/hq ADR 0069) rather than only on a workstation that
-# happens to have the siblings.
-#
-# Two bases, named rather than pinned (novox/hq issue 044): the image this is COMPILED in and the
-# image it RUNS in — the second must not carry a compiler. Declared in module.json's `build.on`.
-ARG BUILD_BASE
-ARG RUNTIME_BASE
-
-FROM ${BUILD_BASE} AS build
-WORKDIR /app/modules/jackett
-COPY . .
-RUN node /app/node_modules/typescript/bin/tsc client.ts tools/index.ts \
-      --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist
-
-FROM ${RUNTIME_BASE}
-COPY --from=build /app/modules/jackett/dist /app/modules/jackett/dist
-# Every serve-time entrypoint, loaded by the runtime in serve mode: tools and events serve, and a
-# provider's provisioner runs its reconcile loop in the same process, with the broker connected —
-# the convention novox/hq issues 060/061 settled.
-ENV MESH_TOOL_MODULES=/app/modules/jackett/dist/tools/index.js

modules/jackett/client.ts

@@ -1,136 +0,0 @@
-// The Jackett API client — jackett's own code, living in the module (novox/hq ADR 0039). Jackett is
-// an indexer proxy: it normalises many torrent trackers behind one Torznab surface. This client
-// talks its /api/v2.0 REST API, and only jackett's tools import it.
-
-import { existsSync, readFileSync } from "node:fs";
-import { join } from "node:path";
-
-export interface JackettIndexer {
-  id: string;
-  name: string;
-  type: string; // "public" | "private" | "semi-public"
-  configured: boolean;
-  siteLink?: string;
-  lastError?: string;
-}
-
-export interface JackettResult {
-  title: string;
-  tracker: string;
-  category?: string;
-  size: number;
-  seeders?: number;
-  peers?: number;
-  publishDate?: string;
-  link?: string;
-}
-
-/** The settings-merged config the mesh delivers (novox/hq ADR 0046): { url, apiKey, token, password, user, ... }. */
-function meshConfig(file?: string): Record<string, string> {
-  if (!file) return {};
-  try { return JSON.parse(readFileSync(file, "utf8")) as Record<string, string>; }
-  catch { return {}; }
-}
-
-export class JackettClient {
-  readonly baseUrl: string;
-
-  constructor(
-    url: string,
-    private readonly apiKey: string,
-  ) {
-    this.baseUrl = url.replace(/\/$/, "");
-  }
-
-  /**
-   * Build from the module's resolved environment. Jackett's REST API is keyed, so both the URL and
-   * the key must be present. The key is read from the settings-merged config or MESH_JACKETT_API_KEY,
-   * or, failing those, discovered from Jackett's own ServerConfig.json under MESH_JACKETT_CONFIG_DIR
-   * — the file Jackett writes it to, as sonarr/radarr read theirs from config.xml — so a running
-   * server needs no key configured by hand and no secret has to be put in an assignment. Without a
-   * URL or key there is nothing to talk to, so this throws and the module contributes no tools
-   * rather than failing half-configured.
-   */
-  static fromEnv(env: NodeJS.ProcessEnv = process.env): JackettClient {
-    const cfg = meshConfig(env.MESH_JACKETT_CONFIG_FILE);
-    const url = cfg.url ?? env.MESH_JACKETT_URL;
-    const apiKey = cfg.apiKey ?? env.MESH_JACKETT_API_KEY
-      ?? JackettClient.detectApiKey(env.MESH_JACKETT_CONFIG_DIR ?? "/config");
-    if (!url) throw new Error("no Jackett URL — set MESH_JACKETT_URL");
-    if (!apiKey) throw new Error("no Jackett API key — set MESH_JACKETT_API_KEY or make the config dir readable");
-    return new JackettClient(url, apiKey);
-  }
-
-  /** Discover the API key from Jackett's ServerConfig.json (the linuxserver image keeps it at
-   *  <config>/Jackett/ServerConfig.json), falling back to null. */
-  static detectApiKey(configDir: string): string | null {
-    for (const file of [join(configDir, "Jackett", "ServerConfig.json"), join(configDir, "ServerConfig.json")]) {
-      if (!existsSync(file)) continue;
-      try {
-        const key = (JSON.parse(readFileSync(file, "utf8")) as { APIKey?: unknown }).APIKey;
-        if (typeof key === "string" && key) return key;
-      } catch { /* unreadable or mid-write: try the next, then give up */ }
-    }
-    return null;
-  }
-
-  private async get(path: string, params: Record<string, string> = {}): Promise<any> {
-    const url = new URL(`${this.baseUrl}${path}`);
-    url.searchParams.set("apikey", this.apiKey);
-    for (const [k, v] of Object.entries(params)) url.searchParams.set(k, v);
-    const res = await fetch(url.toString(), { headers: { Accept: "application/json" } });
-    if (!res.ok) throw new Error(`Jackett API ${path}: ${res.status} ${await res.text()}`);
-    return res.json();
-  }
-
-  /**
-   * The configured indexers Jackett proxies. `configured=false` also lists the ones not set up.
-   * Read from the Torznab `t=indexers` feed, not /api/v2.0/indexers: that one is the web UI's and
-   * wants a login cookie (it answers an API-key request with a redirect), while the Torznab feed is
-   * what the key is for. The feed carries no last error, so `lastError` stays unset.
-   */
-  async getIndexers(configuredOnly = true): Promise<JackettIndexer[]> {
-    const url = new URL(`${this.baseUrl}/api/v2.0/indexers/all/results/torznab/api`);
-    url.searchParams.set("apikey", this.apiKey);
-    url.searchParams.set("t", "indexers");
-    url.searchParams.set("configured", configuredOnly ? "true" : "false");
-    const res = await fetch(url.toString(), { headers: { Accept: "application/xml" } });
-    if (!res.ok) throw new Error(`Jackett API torznab t=indexers: ${res.status} ${await res.text()}`);
-    const xml = await res.text();
-    // Torznab reports failures (a wrong key among them) as 200 with an <error> body.
-    const err = xml.match(/<error code="(\d+)" description="([^"]*)"/);
-    if (err) throw new Error(`Jackett API torznab t=indexers: error ${err[1]} ${err[2]}`);
-    const text = (block: string, tag: string) =>
-      block.match(new RegExp(`<${tag}>([^<]*)</${tag}>`))?.[1];
-    const out: JackettIndexer[] = [];
-    for (const m of xml.matchAll(/<indexer id="([^"]+)" configured="([^"]+)">([\s\S]*?)<\/indexer>/g)) {
-      out.push({
-        id: m[1],
-        name: text(m[3], "title") ?? m[1],
-        type: text(m[3], "type") ?? "unknown",
-        configured: m[2] === "true",
-        siteLink: text(m[3], "link"),
-      });
-    }
-    return out;
-  }
-
-  /**
-   * A Torznab search across one indexer, or the "all" aggregate. Jackett returns a normalised JSON
-   * result set regardless of the underlying tracker, which is the whole point of the proxy.
-   */
-  async search(query: string, indexer = "all", limit = 25): Promise<JackettResult[]> {
-    const raw = await this.get(`/api/v2.0/indexers/${encodeURIComponent(indexer)}/results`, { Query: query });
-    const results = Array.isArray(raw?.Results) ? raw.Results : [];
-    return results.slice(0, limit).map((r: any) => ({
-      title: r.Title,
-      tracker: r.Tracker ?? r.TrackerId ?? "unknown",
-      category: Array.isArray(r.CategoryDesc) ? r.CategoryDesc.join(", ") : r.CategoryDesc,
-      size: r.Size ?? 0,
-      seeders: r.Seeders,
-      peers: r.Peers,
-      publishDate: r.PublishDate,
-      link: r.Link ?? r.Details,
-    }));
-  }
-}

modules/jackett/module.json

@@ -1,131 +0,0 @@
-{
-  "module": "jackett",
-  "version": "1",
-  "provides": [
-    {
-      "name": "jackett-api",
-      "scope": "mesh"
-    }
-  ],
-  "serves": {
-    "jackett-api": {
-      "scheme": "http",
-      "port": 9117,
-      "url-base": ""
-    }
-  },
-  "capabilities": [
-    "container-runtime"
-  ],
-  "listens": [
-    {
-      "name": "web",
-      "port": 9117,
-      "protocol": "tcp",
-      "from": "mesh",
-      "why": "the indexer proxy: its web UI, and the Torznab feeds the *arr apps search through, which other modules reach as jackett-api"
-    }
-  ],
-  "resources": [
-    {
-      "id": "mesh-state",
-      "type": "directory",
-      "path": "/var/lib/mesh/jackett",
-      "mode": "0700"
-    },
-    {
-      "id": "state",
-      "type": "directory",
-      "mode": "0700",
-      "place": "."
-    },
-    {
-      "id": "config",
-      "type": "directory",
-      "mode": "0700",
-      "owner": "1000:1000"
-    },
-    {
-      "id": "server",
-      "type": "container",
-      "name": "jackett",
-      "image": "lscr.io/linuxserver/jackett@sha256:7b19f4f6ac33d855ca9226600ecbd096ee678f66da28b13a7c09980b035ff583",
-      "env": {
-        "PUID": "1000",
-        "PGID": "1000",
-        "TZ": "Etc/UTC"
-      },
-      "ports": [
-        "9117"
-      ],
-      "volumes": [
-        "${dir:config}:/config"
-      ]
-    },
-    {
-      "id": "runtime-config",
-      "type": "file",
-      "path": "${dir:state}/config.json",
-      "mode": "0600",
-      "content": "{}\n",
-      "merge": "json"
-    },
-    {
-      "id": "runtime",
-      "type": "container",
-      "name": "mesh-jackett",
-      "network": "host",
-      "volumes": [
-        "/var/lib/mesh/jackett/broker:/run/secrets/broker:ro",
-        "${dir:state}/config.json:/run/config/config.json:ro",
-        "${dir:config}:/var/lib/jackett/config:ro"
-      ],
-      "env": {
-        "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_JACKETT_URL": "http://127.0.0.1:${port:9117}",
-        "MESH_JACKETT_CONFIG_FILE": "/run/config/config.json",
-        "MESH_JACKETT_CONFIG_DIR": "/var/lib/jackett/config"
-      },
-      "restart-on": [
-        "runtime-config"
-      ],
-      "artifact": "runtime"
-    }
-  ],
-  "own-secrets": {
-    "broker": "/var/lib/mesh/jackett/broker"
-  },
-  "requires": [
-    "route"
-  ],
-  "contributes": {
-    "route": {
-      "label": "indexers",
-      "endpoint": "web"
-    }
-  },
-  "binds": {
-    "route": "${dir:state}/route.json"
-  },
-  "build": {
-    "on": [
-      {
-        "arg": "BUILD_BASE",
-        "module": "mesh-tools",
-        "artifact": "build"
-      },
-      {
-        "arg": "RUNTIME_BASE",
-        "module": "mesh-tools",
-        "artifact": "runtime"
-      }
-    ],
-    "artifacts": [
-      {
-        "name": "runtime",
-        "kind": "image",
-        "from": "Dockerfile"
-      }
-    ]
-  }
-}

modules/jackett/package.json

@@ -1,14 +0,0 @@
-{
-  "name": "@novox/module-jackett",
-  "version": "0.1.0",
-  "description": "jackett — indexer proxy. Its API client and tools live here (novox/hq ADR 0039).",
-  "type": "module",
-  "private": true,
-  "dependencies": {
-    "@novox/mesh-sdk": "^0.1.0"
-  },
-  "devDependencies": {
-    "@types/node": "^22.0.0",
-    "typescript": "^5.6.0"
-  }
-}

modules/jackett/tools/index.ts

@@ -1,48 +0,0 @@
-// jackett's tools — its own code (novox/hq ADR 0039), importing jackett's client. Jackett has
-// nothing worth watching (an indexer proxy answers queries; it has no timeline of its own), so it
-// is a tools-only module: no events entrypoint, no broker. What is useful is asking it things.
-
-import { registerModuleTools, type ToolDefinition } from "@novox/mesh-sdk/tools";
-import { JackettClient } from "../client.js";
-
-export function getJackettTools(jackett: JackettClient): ToolDefinition[] {
-  return [
-    {
-      name: "jackett_indexers",
-      description: "List the indexers Jackett proxies, with their type and site.",
-      input: { all: { type: "boolean", description: "include indexers not yet configured (default false)" } },
-      run: async (args) => {
-        const indexers = await jackett.getIndexers(!args.all);
-        return { count: indexers.length, indexers };
-      },
-    },
-    {
-      name: "jackett_search",
-      description: "Torznab search across Jackett's indexers, returning normalised torrent results.",
-      input: {
-        query: { type: "string", description: "the search query" },
-        indexer: { type: "string", description: 'an indexer id, or "all" to aggregate (default "all")' },
-        limit: { type: "number", description: "max results (default 25)" },
-      },
-      run: async (args) => {
-        const query = String(args.query);
-        const results = await jackett.search(
-          query,
-          args.indexer ? String(args.indexer) : "all",
-          args.limit ? Number(args.limit) : 25,
-        );
-        return { query, count: results.length, results };
-      },
-    },
-  ];
-}
-
-// Only exposed when Jackett is configured; otherwise jackett contributes no tools rather than
-// failing the whole runtime.
-registerModuleTools("jackett", (env) => {
-  try {
-    return getJackettTools(JackettClient.fromEnv(env));
-  } catch {
-    return [];
-  }
-});

modules/jackett/tsconfig.json

@@ -1,12 +0,0 @@
-{
-  "compilerOptions": {
-    "target": "ES2022",
-    "module": "NodeNext",
-    "moduleResolution": "NodeNext",
-    "strict": true,
-    "esModuleInterop": true,
-    "skipLibCheck": true,
-    "noEmit": true
-  },
-  "include": ["client.ts", "tools/index.ts"]
-}

modules/jira/module.json

@@ -2,26 +2,26 @@
   "module": "jira",
   "version": "1",
   "own-secrets": {
-    "token": "/var/lib/jira/token",
-    "broker": "/var/lib/mesh/jira/broker"
+    "token": "${dir:state}/token",
+    "broker": "${dir:mesh-state}/broker"
   },
   "resources": [
     {
       "id": "mesh-state",
       "type": "directory",
-      "path": "/var/lib/mesh/jira",
-      "mode": "0700"
+      "mode": "0700",
+      "place": "mesh"
     },
     {
       "id": "state",
       "type": "directory",
-      "path": "/var/lib/jira",
-      "mode": "0700"
+      "mode": "0700",
+      "place": "."
     },
     {
       "id": "config",
       "type": "file",
-      "path": "/var/lib/jira/config.json",
+      "path": "${dir:state}/config.json",
       "merge": "json",
       "content": "{}",
       "mode": "0600"
@@ -32,9 +32,9 @@
       "name": "mesh-runtime-jira",
       "network": "host",
       "volumes": [
-        "/var/lib/jira/config.json:/run/config/config.json:ro",
-        "/var/lib/jira/token:/run/secrets/token:ro",
-        "/var/lib/mesh/jira/broker:/run/secrets/broker:ro"
+        "${dir:state}/config.json:/run/config/config.json:ro",
+        "${dir:state}/token:/run/secrets/token:ro",
+        "${dir:mesh-state}/broker:/run/secrets/broker:ro"
       ],
       "env": {
         "MESH_JIRA_TOKEN_FILE": "/run/secrets/token",

modules/keycloak/module.json

@@ -21,11 +21,11 @@
     }
   },
   "binds": {
-    "postgres-database": "/var/lib/keycloak/database.json",
-    "route": "/var/lib/keycloak/route.json"
+    "postgres-database": "${dir:state}/database.json",
+    "route": "${dir:state}/route.json"
   },
   "secrets": {
-    "postgres-database": "/var/lib/keycloak/database.secret"
+    "postgres-database": "${dir:state}/database.secret"
   },
   "capabilities": [
     "container-runtime"
@@ -51,49 +51,49 @@
     "oidc-client": {
       "authorization-path": "/protocol/openid-connect/auth",
       "token-path": "/protocol/openid-connect/token",
-      "userinfo-path": "/protocol/openid-connect/userinfo"
+      "userinfo-path": "/protocol/openid-connect/userinfo",
+      "issuer": "${setting:issuer}"
     }
   },
   "receives": {
-    "oidc-client": "/var/lib/keycloak/grants/mesh.json"
+    "oidc-client": "${dir:grants}/mesh.json"
   },
   "grants": {
-    "oidc-client": "/var/lib/keycloak/grants"
+    "oidc-client": "${dir:grants}"
   },
   "own-secrets": {
-    "admin": "/var/lib/keycloak/admin.secret",
-    "broker": "/var/lib/mesh/keycloak/broker"
+    "admin": "${dir:state}/admin.secret",
+    "broker": "${dir:mesh-state}/broker"
   },
   "resources": [
     {
       "id": "mesh-state",
       "type": "directory",
-      "path": "/var/lib/mesh/keycloak",
-      "mode": "0700"
+      "mode": "0700",
+      "place": "mesh"
     },
     {
       "id": "state",
       "type": "directory",
-      "path": "/var/lib/keycloak",
-      "mode": "0700"
+      "mode": "0700",
+      "place": "."
     },
     {
       "id": "grants",
       "type": "directory",
-      "path": "/var/lib/keycloak/grants",
       "mode": "0700"
     },
     {
       "id": "admin-env",
       "type": "file",
-      "path": "/var/lib/keycloak/admin.env",
+      "path": "${dir:state}/admin.env",
       "mode": "0600",
       "content": "KEYCLOAK_ADMIN=admin\nKEYCLOAK_ADMIN_PASSWORD=${secret:admin}\n"
     },
     {
       "id": "database-env",
       "type": "file",
-      "path": "/var/lib/keycloak/database.env",
+      "path": "${dir:state}/database.env",
       "mode": "0600",
       "content": "KC_DB_URL=jdbc:postgresql://${bound:postgres-database:at}:${bound:postgres-database:port}/${bound:postgres-database:as}\nKC_DB_USERNAME=${bound:postgres-database:as}\nKC_DB_PASSWORD=${secret:postgres-database}\n"
     },
@@ -105,7 +105,7 @@
     {
       "id": "hostname",
       "type": "file",
-      "path": "/var/lib/keycloak/hostname.env",
+      "path": "${dir:state}/hostname.env",
       "mode": "0644",
       "content": "KC_HOSTNAME=https://${bound:route:name}\n"
     },
@@ -125,9 +125,9 @@
         "KC_PROXY_HEADERS": "xforwarded"
       },
       "env-file": [
-        "/var/lib/keycloak/admin.env",
-        "/var/lib/keycloak/database.env",
-        "/var/lib/keycloak/hostname.env"
+        "${dir:state}/admin.env",
+        "${dir:state}/database.env",
+        "${dir:state}/hostname.env"
       ],
       "ports": [
         "8080"
@@ -140,7 +140,7 @@
     {
       "id": "runtime-config",
       "type": "file",
-      "path": "/var/lib/mesh/keycloak/config.json",
+      "path": "${dir:mesh-state}/config.json",
       "mode": "0600",
       "content": "{}\n",
       "merge": "json"
@@ -151,17 +151,17 @@
       "name": "mesh-keycloak",
       "network": "host",
       "volumes": [
-        "/var/lib/mesh/keycloak/broker:/run/secrets/broker:ro",
-        "/var/lib/mesh/keycloak/config.json:/run/config/config.json:ro",
-        "/var/lib/keycloak/admin.secret:/run/secrets/admin:ro",
-        "/var/lib/keycloak/grants:/var/lib/keycloak/grants:ro"
+        "${dir:mesh-state}/broker:/run/secrets/broker:ro",
+        "${dir:mesh-state}/config.json:/run/config/config.json:ro",
+        "${dir:state}/admin.secret:/run/secrets/admin:ro",
+        "${dir:grants}:${dir:grants}:ro"
       ],
       "env": {
         "MESH_BROKER_FILE": "/run/secrets/broker",
         "MESH_KEYCLOAK_URL": "http://127.0.0.1:${port:8080}",
         "MESH_KEYCLOAK_CONFIG_FILE": "/run/config/config.json",
         "MESH_KEYCLOAK_PASSWORD_FILE": "/run/secrets/admin",
-        "MESH_RECEIVES": "/var/lib/keycloak/grants/mesh.json"
+        "MESH_RECEIVES": "${dir:grants}/mesh.json"
       },
       "restart-on": [
         "runtime-config"

modules/letta/module.json

@@ -27,7 +27,7 @@
   "own-secrets": {
     "server-password": "${dir:state}/server-password.secret",
     "openai-api-key": "${dir:state}/openai-api-key.secret",
-    "broker": "/var/lib/mesh/letta/broker"
+    "broker": "${dir:mesh-state}/broker"
   },
   "listens": [
     {
@@ -42,8 +42,8 @@
     {
       "id": "mesh-state",
       "type": "directory",
-      "path": "/var/lib/mesh/letta",
-      "mode": "0700"
+      "mode": "0700",
+      "place": "mesh"
     },
     {
       "id": "state",
@@ -80,7 +80,7 @@
     {
       "id": "runtime-config",
       "type": "file",
-      "path": "/var/lib/mesh/letta/config.json",
+      "path": "${dir:mesh-state}/config.json",
       "mode": "0600",
       "content": "{\n  \"password\": \"${secret:server-password}\"\n}\n",
       "merge": "json"
@@ -91,8 +91,8 @@
       "name": "mesh-letta",
       "network": "letta",
       "volumes": [
-        "/var/lib/mesh/letta/broker:/run/secrets/broker:ro",
-        "/var/lib/mesh/letta/config.json:/run/config/config.json:ro"
+        "${dir:mesh-state}/broker:/run/secrets/broker:ro",
+        "${dir:mesh-state}/config.json:/run/config/config.json:ro"
       ],
       "env": {
         "MESH_BROKER_FILE": "/run/secrets/broker",

modules/lidarr/Dockerfile

@@ -1,24 +0,0 @@
-# lidarr's runtime: the tool runtime, carrying this module's compiled code.
-#
-# **Built from this module's own directory and nothing else.** The sdk and the tool runtime are in
-# the base images, published like any other artifact — which is what makes this buildable by the
-# mesh from a repository and a path (novox/hq ADR 0069) rather than only on a workstation that
-# happens to have the siblings.
-#
-# Two bases, named rather than pinned (novox/hq issue 044): the image this is COMPILED in and the
-# image it RUNS in — the second must not carry a compiler. Declared in module.json's `build.on`.
-ARG BUILD_BASE
-ARG RUNTIME_BASE
-
-FROM ${BUILD_BASE} AS build
-WORKDIR /app/modules/lidarr
-COPY . .
-RUN node /app/node_modules/typescript/bin/tsc client.ts index.ts tools/index.ts \
-      --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist
-
-FROM ${RUNTIME_BASE}
-COPY --from=build /app/modules/lidarr/dist /app/modules/lidarr/dist
-# Every serve-time entrypoint, loaded by the runtime in serve mode: tools and events serve, and a
-# provider's provisioner runs its reconcile loop in the same process, with the broker connected —
-# the convention novox/hq issues 060/061 settled.
-ENV MESH_TOOL_MODULES=/app/modules/lidarr/dist/index.js,/app/modules/lidarr/dist/tools/index.js

modules/lidarr/client.ts

@@ -1,144 +0,0 @@
-// The Lidarr API client — lidarr's own code, living in the module (novox/hq ADR 0039). Ported from
-// the shared hal `arr` client, but self-contained: in nox each Servarr app owns its own copy, so a
-// change to Lidarr's API rebuilds only lidarr and nothing else. Both this module's tools and its
-// events entrypoint import it, and nothing outside lidarr does.
-
-import { existsSync, readFileSync } from "node:fs";
-import { join } from "node:path";
-
-// Lidarr speaks the v1 API (Radarr/Sonarr are v3); its content is the "artist".
-const API_VERSION = "v1";
-const CONTENT_ENDPOINT = "artist";
-const APP_NAME = "Lidarr";
-
-export interface LidarrQueueItem {
-  /** The queue record id — stable while the item is in the queue, so events can diff on it. */
-  id: number;
-  title: string;
-  status: string;
-  size: string;
-  sizeleft: string;
-  timeleft?: string;
-}
-
-export interface LidarrCalendarItem {
-  title: string;
-  date: string;
-  overview?: string;
-}
-
-export interface LidarrContentItem {
-  title: string;
-  status?: string;
-  monitored: boolean;
-}
-
-export class LidarrClient {
-  readonly baseUrl: string;
-
-  constructor(
-    url: string,
-    private readonly apiKey: string,
-  ) {
-    this.baseUrl = url.replace(/\/$/, "");
-  }
-
-  /**
-   * Build from the module's resolved environment. The URL defaults to the server on this node (the
-   * runtime shares its network), and the API key is read from MESH_LIDARR_API_KEY or, failing that,
-   * discovered from the server's own config.xml under MESH_LIDARR_CONFIG_DIR — the same file Lidarr
-   * writes it to, so a running server needs nothing configured by hand. Throws when no key can be
-   * found, so the tools/events simply do not load (the harness treats the throw as "exposes
-   * nothing").
-   */
-  static fromEnv(env: NodeJS.ProcessEnv = process.env): LidarrClient {
-    const url = env.MESH_LIDARR_URL ?? `http://127.0.0.1:${env.MESH_LIDARR_PORT ?? "8686"}`;
-    const configDir = env.MESH_LIDARR_CONFIG_DIR ?? "/config";
-    const apiKey = env.MESH_LIDARR_API_KEY ?? LidarrClient.detectApiKey(configDir);
-    if (!apiKey) {
-      throw new Error("Lidarr not configured — set MESH_LIDARR_API_KEY or make the config dir readable");
-    }
-    return new LidarrClient(url, apiKey);
-  }
-
-  /** Discover the API key from the server's config.xml, falling back to null. Every Servarr app
-   *  writes <ApiKey> into config.xml at the root of its config directory. */
-  static detectApiKey(configDir: string): string | null {
-    const config = join(configDir, "config.xml");
-    if (existsSync(config)) {
-      const match = readFileSync(config, "utf8").match(/<ApiKey>([^<]+)<\/ApiKey>/);
-      if (match) return match[1];
-    }
-    return null;
-  }
-
-  private async get(endpoint: string, params?: Record<string, string>): Promise<unknown> {
-    const url = new URL(`${this.baseUrl}/api/${API_VERSION}/${endpoint}`);
-    if (params) {
-      for (const [k, v] of Object.entries(params)) url.searchParams.set(k, v);
-    }
-    const res = await fetch(url.toString(), { headers: { "X-Api-Key": this.apiKey } });
-    if (!res.ok) throw new Error(`${APP_NAME} API /${endpoint}: ${res.status} ${await res.text()}`);
-    return res.json();
-  }
-
-  async getStatus(): Promise<{ appName: string; version: string }> {
-    const data = (await this.get("system/status")) as { appName?: string; version?: string };
-    return { appName: data.appName || APP_NAME, version: data.version ?? "unknown" };
-  }
-
-  async getContent(limit?: number): Promise<LidarrContentItem[]> {
-    const data = await this.get(CONTENT_ENDPOINT);
-    const items: any[] = Array.isArray(data) ? data : ((data as any)?.records ?? []);
-    const mapped = items.map((item) => ({
-      // Lidarr's content is an artist; its display name is artistName, not title.
-      title: item.artistName ?? item.title ?? "Unknown",
-      status: item.status,
-      monitored: item.monitored ?? true,
-    }));
-    return limit ? mapped.slice(0, limit) : mapped;
-  }
-
-  /** Library search is a filter over existing content, not an indexer lookup — same as hal's. */
-  async searchContent(term: string): Promise<LidarrContentItem[]> {
-    const all = await this.getContent();
-    const lower = term.toLowerCase();
-    return all.filter((item) => item.title.toLowerCase().includes(lower));
-  }
-
-  async getQueue(): Promise<{ totalRecords: number; items: LidarrQueueItem[] }> {
-    const data = (await this.get("queue", { pageSize: "50" })) as { totalRecords?: number; records?: any[] };
-    const records = data.records ?? [];
-    return {
-      totalRecords: data.totalRecords ?? records.length,
-      items: records.map((r) => ({
-        id: r.id,
-        title: r.title ?? r.artist?.artistName ?? r.album?.title ?? "Unknown",
-        status: r.status ?? "unknown",
-        size: formatBytes(r.size ?? 0),
-        sizeleft: formatBytes(r.sizeleft ?? 0),
-        timeleft: r.timeleft,
-      })),
-    };
-  }
-
-  async getCalendar(days = 7): Promise<LidarrCalendarItem[]> {
-    const start = new Date().toISOString().split("T")[0];
-    const end = new Date(Date.now() + days * 86400000).toISOString().split("T")[0];
-    const data = await this.get("calendar", { start, end });
-    const items: any[] = Array.isArray(data) ? data : [];
-    return items.map((item) => ({
-      // A Lidarr calendar entry is an album release.
-      title: item.title ?? item.artist?.artistName ?? "Unknown",
-      date: item.releaseDate ?? "",
-      overview: item.overview?.slice(0, 150),
-    }));
-  }
-}
-
-function formatBytes(bytes: number): string {
-  if (bytes === 0) return "0 B";
-  const units = ["B", "KB", "MB", "GB", "TB"];
-  const i = Math.floor(Math.log(bytes) / Math.log(1024));
-  return `${(bytes / Math.pow(1024, i)).toFixed(1)} ${units[i]}`;
-}

modules/lidarr/index.ts

@@ -1,69 +0,0 @@
-// lidarr's events. The tool runtime imports this once the broker is bound. It watches the download
-// queue and turns its comings and goings into mesh events.
-//
-// Emits (novox/hq ADR 0041/0042):
-//   module.lidarr.album.grabbed        — a release entered the queue (Lidarr grabbed it)
-//   module.lidarr.download.completed   — a release left the queue, imported. The download.completed
-//                                        routing key matches what a media consumer subscribes to
-//                                        (module.*.download.completed) to rescan its library.
-// Consumes: none.
-//
-// The queue is polled and diffed, primed silently on the first look (like plex's index.ts) so a
-// restart mid-download does not re-announce everything already in flight as freshly grabbed.
-
-import { emit } from "@novox/mesh-sdk/events";
-import { LidarrClient, type LidarrQueueItem } from "./client.js";
-
-// Building the client throws when Lidarr has no URL/key yet. Like the tools (see tools/index.ts),
-// the events entrypoint must not crash the runtime for that — it stays idle until configured.
-function buildClient(): LidarrClient | null {
-  try {
-    return LidarrClient.fromEnv();
-  } catch {
-    return null;
-  }
-}
-
-const lidarr = buildClient();
-
-// Lidarr removes an item from the queue once it has been imported; a "warning"/"failed" status is
-// how a stuck or broken grab shows itself, so we do not call those a completion when they vanish.
-const FAILED_STATUSES = new Set(["failed", "warning"]);
-
-const inQueue = new Map<number, LidarrQueueItem>();
-let primed = false;
-
-async function pollQueue(lidarr: LidarrClient): Promise<void> {
-  const { items } = await lidarr.getQueue();
-  const now = new Map(items.map((i) => [i.id, i]));
-
-  if (primed) {
-    // Entered the queue since last look — Lidarr grabbed a release.
-    for (const [id, item] of now) {
-      if (!inQueue.has(id)) await emit("album.grabbed", { title: item.title, status: item.status });
-    }
-    // Left the queue — imported and done, unless it was last seen failing.
-    for (const [id, item] of inQueue) {
-      if (!now.has(id) && !FAILED_STATUSES.has(item.status)) {
-        await emit("download.completed", { title: item.title });
-      }
-    }
-  }
-
-  inQueue.clear();
-  for (const [id, item] of now) inQueue.set(id, item);
-  primed = true;
-}
-
-const tick = (fn: () => Promise<void>, everyMs: number): void => {
-  const run = (): void => void fn().catch((err) => console.error(`[lidarr] ${err}`));
-  setInterval(run, everyMs);
-  run();
-};
-
-if (lidarr) {
-  tick(() => pollQueue(lidarr), 30_000);
-  console.log("[lidarr] watching the download queue, emitting grabs and completions");
-} else {
-  console.log("[lidarr] not configured — events idle until an API key is available");
-}

modules/lidarr/module.json

@@ -1,117 +0,0 @@
-{
-  "module": "lidarr",
-  "version": "1",
-  "capabilities": [
-    "container-runtime"
-  ],
-  "emits": [
-    "album.grabbed",
-    "download.completed"
-  ],
-  "consumes": [],
-  "own-secrets": {
-    "broker": "/var/lib/mesh/lidarr/broker"
-  },
-  "listens": [
-    {
-      "name": "web",
-      "port": 8686,
-      "protocol": "tcp",
-      "from": "mesh",
-      "why": "managing music"
-    }
-  ],
-  "accesses": [
-    {
-      "path": "/services/media/music",
-      "mode": "read-write"
-    },
-    {
-      "path": "/services/media/downloads",
-      "mode": "read-write"
-    }
-  ],
-  "resources": [
-    {
-      "id": "mesh-state",
-      "type": "directory",
-      "path": "/var/lib/mesh/lidarr",
-      "mode": "0700"
-    },
-    {
-      "id": "config",
-      "type": "directory",
-      "path": "/services/lidarr/config",
-      "mode": "0700",
-      "owner": "1000:1000"
-    },
-    {
-      "id": "server",
-      "type": "container",
-      "name": "lidarr",
-      "image": "lscr.io/linuxserver/lidarr@sha256:6b38dd330b0c653351c2e23c8b962ea51c95683dd7acace9d106c922baf85f75",
-      "env": {
-        "PUID": "1000",
-        "PGID": "1000",
-        "TZ": "Etc/UTC"
-      },
-      "ports": [
-        "8686"
-      ],
-      "volumes": [
-        "/services/lidarr/config:/config",
-        "/services/media/music:/music",
-        "/services/media/downloads:/downloads"
-      ]
-    },
-    {
-      "id": "runtime",
-      "type": "container",
-      "name": "mesh-lidarr",
-      "network": "host",
-      "volumes": [
-        "/var/lib/mesh/lidarr/broker:/run/secrets/broker:ro",
-        "/services/lidarr/config:/var/lib/lidarr/config:ro"
-      ],
-      "env": {
-        "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_LIDARR_URL": "http://127.0.0.1:8686",
-        "MESH_LIDARR_CONFIG_DIR": "/var/lib/lidarr/config"
-      },
-      "artifact": "runtime"
-    }
-  ],
-  "requires": [
-    "route"
-  ],
-  "contributes": {
-    "route": {
-      "label": "lidarr",
-      "endpoint": "web"
-    }
-  },
-  "binds": {
-    "route": "/var/lib/mesh/lidarr/route.json"
-  },
-  "build": {
-    "on": [
-      {
-        "arg": "BUILD_BASE",
-        "module": "mesh-tools",
-        "artifact": "build"
-      },
-      {
-        "arg": "RUNTIME_BASE",
-        "module": "mesh-tools",
-        "artifact": "runtime"
-      }
-    ],
-    "artifacts": [
-      {
-        "name": "runtime",
-        "kind": "image",
-        "from": "Dockerfile"
-      }
-    ]
-  }
-}

modules/lidarr/package.json

@@ -1,14 +0,0 @@
-{
-  "name": "@novox/module-lidarr",
-  "version": "0.1.0",
-  "description": "lidarr — music management. Its API client, tools and events live here (novox/hq ADR 0039).",
-  "type": "module",
-  "private": true,
-  "dependencies": {
-    "@novox/mesh-sdk": "^0.1.0"
-  },
-  "devDependencies": {
-    "@types/node": "^22.0.0",
-    "typescript": "^5.6.0"
-  }
-}

modules/lidarr/tools/index.ts

@@ -1,78 +0,0 @@
-// lidarr's tools — ported from the shared hal sdk (novox/hq ADR 0039), importing lidarr's own
-// client. They return structured data (not pre-formatted text as hal did); the mesh serves them
-// through the sdk's tool harness.
-
-import { registerModuleTools, type ToolDefinition } from "@novox/mesh-sdk/tools";
-import { LidarrClient } from "../client.js";
-
-export function getLidarrTools(lidarr: LidarrClient): ToolDefinition[] {
-  return [
-    {
-      name: "lidarr_status",
-      description: "Lidarr status overview: version, artist count, monitored count, queue size.",
-      input: {},
-      run: async () => {
-        const [status, content, queue] = await Promise.all([
-          lidarr.getStatus(),
-          lidarr.getContent(),
-          lidarr.getQueue(),
-        ]);
-        return {
-          app: status.appName,
-          version: status.version,
-          artists: content.length,
-          monitored: content.filter((c) => c.monitored).length,
-          queue: queue.totalRecords,
-        };
-      },
-    },
-    {
-      name: "lidarr_library",
-      description: "List artists from the Lidarr library.",
-      input: { limit: { type: "number", description: "max items to return (default 50)" } },
-      run: async (args) => {
-        const items = await lidarr.getContent(args.limit ? Number(args.limit) : 50);
-        return { count: items.length, artists: items };
-      },
-    },
-    {
-      name: "lidarr_search",
-      description: "Search the Lidarr library for artists by name (filters existing content, not indexers).",
-      input: { query: { type: "string", description: "the search term" } },
-      run: async (args) => {
-        const query = String(args.query);
-        return { query, results: await lidarr.searchContent(query) };
-      },
-    },
-    {
-      name: "lidarr_queue",
-      description: "Show the Lidarr download queue — what is downloading and how far along.",
-      input: {},
-      run: async () => {
-        const queue = await lidarr.getQueue();
-        return { count: queue.totalRecords, items: queue.items };
-      },
-    },
-    {
-      name: "lidarr_calendar",
-      description: "Upcoming album releases from the Lidarr calendar.",
-      input: { days: { type: "number", description: "how many days to look ahead (default 7)" } },
-      run: async (args) => {
-        const days = args.days ? Number(args.days) : 7;
-        const items = await lidarr.getCalendar(days);
-        items.sort((a, b) => a.date.localeCompare(b.date));
-        return { days, count: items.length, items };
-      },
-    },
-  ];
-}
-
-// The tools exist only when Lidarr is configured; without a URL and key, lidarr contributes none
-// rather than failing the whole runtime.
-registerModuleTools("lidarr", (env) => {
-  try {
-    return getLidarrTools(LidarrClient.fromEnv(env));
-  } catch {
-    return [];
-  }
-});

modules/lidarr/tsconfig.json

@@ -1,12 +0,0 @@
-{
-  "compilerOptions": {
-    "target": "ES2022",
-    "module": "NodeNext",
-    "moduleResolution": "NodeNext",
-    "strict": true,
-    "esModuleInterop": true,
-    "skipLibCheck": true,
-    "noEmit": true
-  },
-  "include": ["client.ts", "index.ts", "tools/index.ts"]
-}

modules/local-model-consumer/module.json

@@ -6,25 +6,24 @@
     "model-access"
   ],
   "binds": {
-    "model-access": "/var/lib/local-model-consumer/model.json"
+    "model-access": "${dir:state}/model.json"
   },
   "resources": [
     {
       "id": "state",
       "type": "directory",
-      "path": "/var/lib/local-model-consumer",
-      "mode": "0700"
+      "mode": "0700",
+      "place": "."
     },
     {
       "id": "config",
       "type": "directory",
-      "path": "/var/lib/local-model-consumer/config",
       "mode": "0700"
     },
     {
       "id": "openai-env",
       "type": "file",
-      "path": "/var/lib/local-model-consumer/config/openai.env",
+      "path": "${dir:config}/openai.env",
       "mode": "0600",
       "content": "OPENAI_BASE_URL=http://${bound:model-access:at}:${bound:model-access:port}/v1\nOPENAI_MODEL=${bound:model-access:model}\nOPENAI_API_KEY=local\n"
     }

modules/mailu/module.json

@@ -138,14 +138,14 @@
     }
   ],
   "own-secrets": {
-    "broker": "/var/lib/mesh/mailu/broker"
+    "broker": "${dir:mesh-state}/broker"
   },
   "resources": [
     {
       "id": "mesh-state",
       "type": "directory",
-      "path": "/var/lib/mesh/mailu",
-      "mode": "0700"
+      "mode": "0700",
+      "place": "mesh"
     },
     {
       "id": "state",
@@ -467,7 +467,7 @@
     {
       "id": "runtime-config",
       "type": "file",
-      "path": "/var/lib/mesh/mailu/config.json",
+      "path": "${dir:mesh-state}/config.json",
       "mode": "0600",
       "content": "{}\n",
       "merge": "json"
@@ -478,10 +478,10 @@
       "name": "mesh-mailu",
       "network": "mailu",
       "volumes": [
-        "/var/lib/mesh/mailu/broker:/run/secrets/broker:ro",
+        "${dir:mesh-state}/broker:/run/secrets/broker:ro",
         "${dir:state}/api-token.secret:/run/secrets/api-token:ro",
         "${dir:grants}:${dir:grants}:ro",
-        "/var/lib/mesh/mailu/config.json:/run/config/config.json:ro",
+        "${dir:mesh-state}/config.json:/run/config/config.json:ro",
         "/var/run/docker.sock:/var/run/docker.sock"
       ],
       "env": {
@@ -552,7 +552,8 @@
   ],
   "serves": {
     "smtp": {
-      "port": 587
+      "port": 587,
+      "domain": "${setting:domain}"
     }
   },
   "receives": {

modules/marrytts/module.json

@@ -17,8 +17,8 @@
     {
       "id": "mesh-state",
       "type": "directory",
-      "path": "/var/lib/mesh/marrytts",
-      "mode": "0700"
+      "mode": "0700",
+      "place": "mesh"
     },
     {
       "id": "server",

modules/mesh-catalog/module.json

@@ -20,13 +20,13 @@
     }
   },
   "binds": {
-    "postgres-database": "/var/lib/mesh-catalog/database.json"
+    "postgres-database": "${dir:state}/database.json"
   },
   "secrets": {
-    "postgres-database": "/var/lib/mesh-catalog/database.secret"
+    "postgres-database": "${dir:state}/database.secret"
   },
   "own-secrets": {
-    "broker": "/var/lib/mesh/mesh-catalog/broker"
+    "broker": "${dir:mesh-state}/broker"
   },
   "consumes": [
     "mesh-build-machine.built",
@@ -43,19 +43,19 @@
     {
       "id": "mesh-state",
       "type": "directory",
-      "path": "/var/lib/mesh/mesh-catalog",
-      "mode": "0700"
+      "mode": "0700",
+      "place": "mesh"
     },
     {
       "id": "state",
       "type": "directory",
-      "path": "/var/lib/mesh-catalog",
-      "mode": "0700"
+      "mode": "0700",
+      "place": "."
     },
     {
       "id": "database-url",
       "type": "file",
-      "path": "/var/lib/mesh-catalog/database.url",
+      "path": "${dir:state}/database.url",
       "mode": "0600",
       "content": "postgresql://${bound:postgres-database:as}:${secret:postgres-database}@${bound:postgres-database:at}:${bound:postgres-database:port}/${bound:postgres-database:as}\n"
     },
@@ -65,9 +65,9 @@
       "name": "mesh-catalog",
       "network": "host",
       "volumes": [
-        "/var/lib/mesh/mesh-catalog/broker:/run/secrets/broker:ro",
-        "/var/lib/mesh-catalog:/run/state",
-        "/var/lib/mesh-catalog/database.url:/run/secrets/database-url:ro"
+        "${dir:mesh-state}/broker:/run/secrets/broker:ro",
+        "${dir:state}:/run/state",
+        "${dir:state}/database.url:/run/secrets/database-url:ro"
       ],
       "env": {
         "MESH_BROKER_FILE": "/run/secrets/broker",

modules/mesh-console/module.json

@@ -9,7 +9,7 @@
     "*"
   ],
   "own-secrets": {
-    "broker": "/var/lib/mesh/mesh-console/broker"
+    "broker": "${dir:mesh-state}/broker"
   },
   "listens": [
     {
@@ -24,8 +24,8 @@
     {
       "id": "mesh-state",
       "type": "directory",
-      "path": "/var/lib/mesh/mesh-console",
-      "mode": "0700"
+      "mode": "0700",
+      "place": "mesh"
     },
     {
       "id": "server",
@@ -40,7 +40,7 @@
         "MESH_CONSOLE_LISTEN": "127.0.0.1:${port:4270}"
       },
       "volumes": [
-        "/var/lib/mesh/mesh-console/broker:/run/secrets/broker:ro"
+        "${dir:mesh-state}/broker:/run/secrets/broker:ro"
       ],
       "artifact": "runtime"
     }

modules/mesh-vault/index.ts

@@ -1,9 +1,9 @@
 // mesh-vault's events entrypoint, loaded by the per-node tool host (the provisioner runs in the same
 // process — ADR 0052). The lifecycle events are EMITTED from the provisioner, where custody
 // actually changes (novox/hq ADR 0041/0042):
-//   module.mesh-vault.secret.provisioned    — a consumer was granted a secret
-//   module.mesh-vault.secret.rotated        — that consumer's value changed (`rotate secret`)
-//   module.mesh-vault.secret.deprovisioned  — the consumer went away and its secret was withdrawn
+//   mesh-vault.provisioned    — a consumer was granted a secret
+//   mesh-vault.rotated        — that consumer's value changed (`rotate secret`)
+//   mesh-vault.deprovisioned  — the consumer went away and its secret was withdrawn
 // Here the vault reacts to them, keeping a lightweight audit line of who holds what and when it
 // moved — the audit an owner of secrets is best placed to log. Fingerprints, never values.
 
@@ -16,15 +16,15 @@ interface SecretEvent {
   rotations?: number;
 }
 
-await on<SecretEvent>("secret.provisioned", async (e) => {
+await on<SecretEvent>("provisioned", async (e) => {
   console.log(`[mesh-vault] secret provisioned for ${e.body.as} on ${e.body.consumer} (${e.body.fingerprint})`);
 });
 
-await on<SecretEvent>("secret.rotated", async (e) => {
+await on<SecretEvent>("rotated", async (e) => {
   console.log(`[mesh-vault] secret rotated for ${e.body.as} — rotation ${e.body.rotations} (${e.body.fingerprint})`);
 });
 
-await on<SecretEvent>("secret.deprovisioned", async (e) => {
+await on<SecretEvent>("deprovisioned", async (e) => {
   console.log(`[mesh-vault] secret withdrawn from ${e.body.as}`);
 });
 

modules/mesh-vault/module.json

@@ -11,54 +11,51 @@
     "container-runtime"
   ],
   "emits": [
-    "secret.provisioned",
-    "secret.rotated",
-    "secret.deprovisioned"
+    "provisioned",
+    "rotated",
+    "deprovisioned"
   ],
   "consumes": [
-    "mesh-vault.secret.provisioned",
-    "mesh-vault.secret.rotated",
-    "mesh-vault.secret.deprovisioned"
+    "mesh-vault.provisioned",
+    "mesh-vault.rotated",
+    "mesh-vault.deprovisioned"
   ],
   "receives": {
-    "secret": "/var/lib/mesh-vault/grants/mesh.json"
+    "secret": "${dir:grants}/mesh.json"
   },
   "grants": {
-    "secret": "/var/lib/mesh-vault/grants"
+    "secret": "${dir:grants}"
   },
   "keeps": "/var/lib/mesh-vault/root",
   "own-secrets": {
-    "broker": "/var/lib/mesh/mesh-vault/broker"
+    "broker": "${dir:mesh-state}/broker"
   },
   "resources": [
     {
       "id": "mesh-state",
       "type": "directory",
-      "path": "/var/lib/mesh/mesh-vault",
-      "mode": "0700"
+      "mode": "0700",
+      "place": "mesh"
     },
     {
       "id": "state",
       "type": "directory",
-      "path": "/var/lib/mesh-vault",
-      "mode": "0700"
+      "mode": "0700",
+      "place": "."
     },
     {
       "id": "grants",
       "type": "directory",
-      "path": "/var/lib/mesh-vault/grants",
       "mode": "0700"
     },
     {
       "id": "ledger",
       "type": "directory",
-      "path": "/var/lib/mesh-vault/ledger",
       "mode": "0700"
     },
     {
       "id": "root",
       "type": "directory",
-      "path": "/var/lib/mesh-vault/root",
       "mode": "0700"
     },
     {
@@ -67,16 +64,16 @@
       "name": "mesh-vault",
       "network": "host",
       "volumes": [
-        "/var/lib/mesh/mesh-vault/broker:/run/secrets/broker:ro",
-        "/var/lib/mesh-vault/grants:/var/lib/mesh-vault/grants:ro",
-        "/var/lib/mesh-vault/ledger:/var/lib/mesh-vault/ledger",
-        "/var/lib/mesh-vault/root:/var/lib/mesh-vault/root:ro"
+        "${dir:mesh-state}/broker:/run/secrets/broker:ro",
+        "${dir:grants}:${dir:grants}:ro",
+        "${dir:ledger}:${dir:ledger}",
+        "${dir:root}:${dir:root}:ro"
       ],
       "env": {
         "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_RECEIVES": "/var/lib/mesh-vault/grants/mesh.json",
-        "MESH_VAULT_LEDGER": "/var/lib/mesh-vault/ledger",
-        "MESH_VAULT_ROOT": "/var/lib/mesh-vault/root"
+        "MESH_RECEIVES": "${dir:grants}/mesh.json",
+        "MESH_VAULT_LEDGER": "${dir:ledger}",
+        "MESH_VAULT_ROOT": "${dir:root}"
       },
       "artifact": "runtime"
     }
@@ -101,5 +98,11 @@
         "from": "Dockerfile"
       }
     ]
-  }
+  },
+  "claims": [
+    {
+      "name": "mesh-vault",
+      "scope": "mesh"
+    }
+  ]
 }

modules/mesh-vault/provisioner/index.ts

@@ -43,6 +43,6 @@ runProvisioner("secret", {
   async remove(p: { as: string }): Promise<void> {
     if (!ledger.withdraw(p.as)) return;
     console.log(`[mesh-vault] withdrawn: ${p.as}`);
-    await announce("secret.deprovisioned", { as: p.as });
+    await announce("deprovisioned", { as: p.as });
   },
 });

modules/minio/module.json

@@ -53,38 +53,37 @@
     }
   },
   "receives": {
-    "s3-bucket": "/var/lib/minio/grants/mesh.json"
+    "s3-bucket": "${dir:grants}/mesh.json"
   },
   "grants": {
-    "s3-bucket": "/var/lib/minio/grants"
+    "s3-bucket": "${dir:grants}"
   },
   "own-secrets": {
-    "root": "/var/lib/minio/root.secret",
-    "broker": "/var/lib/mesh/minio/broker"
+    "root": "${dir:state}/root.secret",
+    "broker": "${dir:mesh-state}/broker"
   },
   "resources": [
     {
       "id": "mesh-state",
       "type": "directory",
-      "path": "/var/lib/mesh/minio",
-      "mode": "0700"
+      "mode": "0700",
+      "place": "mesh"
     },
     {
       "id": "state",
       "type": "directory",
-      "path": "/var/lib/minio",
-      "mode": "0700"
+      "mode": "0700",
+      "place": "."
     },
     {
       "id": "grants",
       "type": "directory",
-      "path": "/var/lib/minio/grants",
       "mode": "0700"
     },
     {
       "id": "root-env",
       "type": "file",
-      "path": "/var/lib/minio/root.env",
+      "path": "${dir:state}/root.env",
       "mode": "0600",
       "content": "MINIO_ROOT_USER=meshroot\nMINIO_BROWSER_REDIRECT_URL=https://${bound:route:name-console}\n"
     },
@@ -112,7 +111,7 @@
         ":9001"
       ],
       "env-file": [
-        "/var/lib/minio/root.env"
+        "${dir:state}/root.env"
       ],
       "ports": [
         "9000",
@@ -120,7 +119,7 @@
       ],
       "volumes": [
         "/var/lib/minio-store:/data",
-        "/var/lib/minio/root.secret:/run/secrets/root:ro"
+        "${dir:state}/root.secret:/run/secrets/root:ro"
       ],
       "env": {
         "MINIO_ROOT_PASSWORD_FILE": "/run/secrets/root",
@@ -133,9 +132,9 @@
       "name": "mesh-minio",
       "network": "minio-net",
       "volumes": [
-        "/var/lib/mesh/minio/broker:/run/secrets/broker:ro",
-        "/var/lib/minio/grants:/var/lib/minio/grants:ro",
-        "/var/lib/minio/root.secret:/run/secrets/root:ro"
+        "${dir:mesh-state}/broker:/run/secrets/broker:ro",
+        "${dir:grants}:${dir:grants}:ro",
+        "${dir:state}/root.secret:/run/secrets/root:ro"
       ],
       "env": {
         "MESH_MINIO_ENDPOINT": "http://minio:9000",
@@ -143,7 +142,7 @@
         "MESH_MINIO_ROOT_PASSWORD_FILE": "/run/secrets/root",
         "MESH_MINIO_REGION": "eu-west",
         "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_RECEIVES": "/var/lib/minio/grants/mesh.json"
+        "MESH_RECEIVES": "${dir:grants}/mesh.json"
       },
       "artifact": "runtime"
     }

modules/model-usage/module.json

@@ -14,34 +14,34 @@
     }
   },
   "binds": {
-    "postgres-database": "/var/lib/model-usage/database.json"
+    "postgres-database": "${dir:state}/database.json"
   },
   "secrets": {
-    "postgres-database": "/var/lib/model-usage/database.secret"
+    "postgres-database": "${dir:state}/database.secret"
   },
   "consumes": [
     "*.usage.*"
   ],
   "own-secrets": {
-    "broker": "/var/lib/mesh/model-usage/broker"
+    "broker": "${dir:mesh-state}/broker"
   },
   "resources": [
     {
       "id": "mesh-state",
       "type": "directory",
-      "path": "/var/lib/mesh/model-usage",
-      "mode": "0700"
+      "mode": "0700",
+      "place": "mesh"
     },
     {
       "id": "state",
       "type": "directory",
-      "path": "/var/lib/model-usage",
-      "mode": "0700"
+      "mode": "0700",
+      "place": "."
     },
     {
       "id": "database-url",
       "type": "file",
-      "path": "/var/lib/model-usage/database.url",
+      "path": "${dir:state}/database.url",
       "mode": "0600",
       "content": "postgresql://${bound:postgres-database:as}:${secret:postgres-database}@${bound:postgres-database:at}:${bound:postgres-database:port}/${bound:postgres-database:as}\n"
     },
@@ -52,9 +52,9 @@
       "image": "mesh-runtime-model-usage@sha256:0000000000000000000000000000000000000000000000000000000000000000",
       "network": "host",
       "volumes": [
-        "/var/lib/mesh/model-usage/broker:/run/secrets/broker:ro",
-        "/var/lib/model-usage:/run/state",
-        "/var/lib/model-usage/database.url:/run/secrets/database-url:ro"
+        "${dir:mesh-state}/broker:/run/secrets/broker:ro",
+        "${dir:state}:/run/state",
+        "${dir:state}/database.url:/run/secrets/database-url:ro"
       ],
       "env": {
         "MESH_BROKER_FILE": "/run/secrets/broker",

modules/mongodb/module.json

@@ -40,15 +40,15 @@
   },
   "own-secrets": {
     "root": "${dir:state}/root.secret",
-    "broker": "/var/lib/mesh/mongodb/broker"
+    "broker": "${dir:mesh-state}/broker"
   },
   "secrets-owner": "999:999",
   "resources": [
     {
       "id": "mesh-state",
       "type": "directory",
-      "path": "/var/lib/mesh/mongodb",
-      "mode": "0700"
+      "mode": "0700",
+      "place": "mesh"
     },
     {
       "id": "state",
@@ -95,7 +95,7 @@
       "name": "mesh-mongodb",
       "network": "mongodb",
       "volumes": [
-        "/var/lib/mesh/mongodb/broker:/run/secrets/broker:ro",
+        "${dir:mesh-state}/broker:/run/secrets/broker:ro",
         "${dir:grants}:${dir:grants}:ro",
         "${dir:state}/root.secret:/run/secrets/root:ro"
       ],

modules/mosquitto/module.json

@@ -32,8 +32,8 @@
     "mqtt-topic": "${dir:grants}"
   },
   "own-secrets": {
-    "admin": "/var/lib/mesh/mosquitto/admin",
-    "broker": "/var/lib/mesh/mosquitto/broker"
+    "admin": "${dir:mesh-state}/admin",
+    "broker": "${dir:mesh-state}/broker"
   },
   "listens": [
     {
@@ -55,8 +55,8 @@
     {
       "id": "mesh-state",
       "type": "directory",
-      "path": "/var/lib/mesh/mosquitto",
-      "mode": "0700"
+      "mode": "0700",
+      "place": "mesh"
     },
     {
       "id": "state",
@@ -95,7 +95,7 @@
       "run-once": true,
       "volumes": [
         "${dir:data}:/mosquitto/data",
-        "/var/lib/mesh/mosquitto/admin:/run/secrets/admin:ro"
+        "${dir:mesh-state}/admin:/run/secrets/admin:ro"
       ],
       "env": {
         "MESH_PROVISION_MQTT": "mosquitto:1883",
@@ -130,9 +130,9 @@
       "name": "mesh-mosquitto",
       "network": "mosquitto",
       "volumes": [
-        "/var/lib/mesh/mosquitto/broker:/run/secrets/broker:ro",
+        "${dir:mesh-state}/broker:/run/secrets/broker:ro",
         "${dir:grants}:${dir:grants}:ro",
-        "/var/lib/mesh/mosquitto/admin:/run/secrets/admin:ro"
+        "${dir:mesh-state}/admin:/run/secrets/admin:ro"
       ],
       "env": {
         "MESH_BROKER_FILE": "/run/secrets/broker",

modules/mssql/module.json

@@ -38,14 +38,14 @@
   },
   "own-secrets": {
     "sa": "${dir:state}/sa.secret",
-    "broker": "/var/lib/mesh/mssql/broker"
+    "broker": "${dir:mesh-state}/broker"
   },
   "resources": [
     {
       "id": "mesh-state",
       "type": "directory",
-      "path": "/var/lib/mesh/mssql",
-      "mode": "0700"
+      "mode": "0700",
+      "place": "mesh"
     },
     {
       "id": "state",
@@ -99,7 +99,7 @@
       "name": "mesh-mssql",
       "network": "mssql",
       "volumes": [
-        "/var/lib/mesh/mssql/broker:/run/secrets/broker:ro",
+        "${dir:mesh-state}/broker:/run/secrets/broker:ro",
         "${dir:grants}:/var/lib/mssql/grants:ro",
         "${dir:state}/sa.secret:/run/secrets/sa:ro"
       ],

modules/n8n/Dockerfile

@@ -0,0 +1,20 @@
+# n8n with what its workflows reach for beyond the upstream image.
+#
+# The base is named, not pinned here (novox/hq issue 044): module.json's `build.on` declares N8N_BASE
+# as the upstream image by digest, and the mesh hands the build its own copy (ADR 0097).
+ARG N8N_BASE
+FROM ${N8N_BASE}
+
+USER root
+# - `media` (GID 2000), with `node` in it: the shared media library is group-writable by the
+#   operator's media group, and a workflow files downloads into it. A container resource cannot add
+#   a supplementary group, so the image's own /etc/group carries it. 2000 is the operator's media
+#   group today; novox/hq 153 proposes reading it from the accessed data (${access:<id>:gid}).
+# - uuid, pinned to the version the workflows were written against: Code nodes require() it
+#   (NODE_FUNCTION_ALLOW_EXTERNAL=*), and a Code node can only require what is installed.
+RUN apk add --no-cache shadow \
+ && groupadd -g 2000 media \
+ && usermod -aG media node \
+ && npm install -g uuid@14.0.1
+
+USER node

modules/n8n/module.json

@@ -18,44 +18,60 @@
     }
   },
   "binds": {
-    "postgres-database": "/var/lib/n8n/database.json",
-    "route": "/var/lib/n8n/route.json"
+    "postgres-database": "${dir:state}/database.json",
+    "route": "${dir:state}/route.json"
   },
   "secrets": {
-    "postgres-database": "/var/lib/n8n/database.secret"
-  },
-  "own-secrets": {
-    "basic-auth": "/var/lib/n8n/basic-auth.secret"
+    "postgres-database": "${dir:state}/database.secret"
   },
+  "accesses": [
+    {
+      "id": "media",
+      "mode": "read-write"
+    }
+  ],
   "listens": [
     {
       "name": "web",
-      "port": 5682,
+      "port": 5678,
       "protocol": "tcp",
       "from": "mesh",
-      "why": "the n8n editor and webhook endpoints over http; its public name is a route grant, and route-proxy reaches it on this published port"
+      "why": "the n8n editor, its REST API and the webhook endpoints workflows are triggered through; a public name is the route's"
     }
   ],
   "resources": [
     {
       "id": "state",
       "type": "directory",
-      "path": "/var/lib/n8n",
-      "mode": "0700"
+      "mode": "0700",
+      "place": "."
     },
     {
       "id": "data",
       "type": "directory",
-      "path": "/services/n8n/n8n-data",
       "mode": "0700",
       "owner": "1000:1000"
     },
+    {
+      "id": "cache",
+      "type": "directory",
+      "mode": "0700",
+      "owner": "999:999"
+    },
+    {
+      "id": "database-secret",
+      "type": "file",
+      "path": "${dir:state}/n8n-database.secret",
+      "mode": "0400",
+      "owner": "1000:1000",
+      "content": "${secret:postgres-database}"
+    },
     {
       "id": "server-env",
       "type": "file",
-      "path": "/var/lib/n8n/server.env",
+      "path": "${dir:state}/server.env",
       "mode": "0600",
-      "content": "N8N_HOST=${bound:route:name}\nN8N_PORT=5678\nN8N_PROTOCOL=https\nWEBHOOK_URL=https://${bound:route:name}/\nN8N_BASIC_AUTH_ACTIVE=true\nN8N_BASIC_AUTH_USER=admin\nN8N_BASIC_AUTH_PASSWORD=${secret:basic-auth}\nNODE_FUNCTION_ALLOW_BUILTIN=*\nNODE_FUNCTION_ALLOW_EXTERNAL=*\nDB_TYPE=postgresdb\nDB_POSTGRESDB_HOST=${bound:postgres-database:at}\nDB_POSTGRESDB_PORT=${bound:postgres-database:port}\nDB_POSTGRESDB_DATABASE=${bound:postgres-database:as}\nDB_POSTGRESDB_USER=${bound:postgres-database:as}\nDB_POSTGRESDB_PASSWORD=${secret:postgres-database}\n"
+      "content": "N8N_HOST=${bound:route:name}\nN8N_PORT=5678\nN8N_PROTOCOL=https\nWEBHOOK_URL=https://${bound:route:name}/\nNODE_FUNCTION_ALLOW_BUILTIN=*\nNODE_FUNCTION_ALLOW_EXTERNAL=*\nDB_TYPE=postgresdb\nDB_POSTGRESDB_HOST=${bound:postgres-database:at}\nDB_POSTGRESDB_PORT=${bound:postgres-database:port}\nDB_POSTGRESDB_DATABASE=${bound:postgres-database:as}\nDB_POSTGRESDB_USER=${bound:postgres-database:as}\nDB_POSTGRESDB_PASSWORD_FILE=/run/secrets/database\n"
     },
     {
       "id": "net",
@@ -66,18 +82,61 @@
       "id": "server",
       "type": "container",
       "name": "n8n",
-      "image": "n8nio/n8n@sha256:4846eb2f4b874ab04cde7fc1e249d2ddaec66e9aea64439beb2972cfea88e3c0",
+      "artifact": "server",
       "network": "n8n",
       "env-file": [
-        "/var/lib/n8n/server.env"
+        "${dir:state}/server.env"
       ],
       "ports": [
         "5678"
       ],
       "volumes": [
-        "/services/n8n/n8n-data:/home/node/.n8n"
+        "${dir:data}:/home/node/.n8n",
+        "${dir:state}/n8n-database.secret:/run/secrets/database:ro",
+        "${access:media}:/media-library"
+      ]
+    },
+    {
+      "id": "cache-server",
+      "type": "container",
+      "name": "n8n-redis",
+      "image": "redis@sha256:8a1efc5f479551822b47424ccae982026b633f28818eab0387348120a61e10e2",
+      "network": "n8n",
+      "args": [
+        "redis-server",
+        "--appendonly",
+        "yes"
       ],
-      "secrets-in-environment": "n8n's loader honours <VAR>_FILE for every setting; convertible, awaiting a bed that proves it (N8N_BASIC_AUTH_* was removed in n8n 1.0 and is likely dead)"
+      "volumes": [
+        "${dir:cache}:/data"
+      ]
+    },
+    {
+      "id": "browser",
+      "type": "container",
+      "name": "n8n-selenium",
+      "image": "selenium/standalone-chrome@sha256:9ae1c78e9b2ca9fe4b22e57873b5ee34aeb8e814e3122293eef4c3abe4c5f448",
+      "network": "n8n",
+      "env": {
+        "SE_ENABLE_TRACING": "false",
+        "SE_NODE_MAX_SESSIONS": "5",
+        "SE_NODE_OVERRIDE_MAX_SESSIONS": "true"
+      }
     }
-  ]
+  ],
+  "build": {
+    "on": [
+      {
+        "arg": "N8N_BASE",
+        "image": "n8nio/n8n@sha256:4846eb2f4b874ab04cde7fc1e249d2ddaec66e9aea64439beb2972cfea88e3c0"
+      }
+    ],
+    "artifacts": [
+      {
+        "name": "server",
+        "kind": "image",
+        "from": "Dockerfile"
+      }
+    ]
+  }
 }

modules/nats/module.json

@@ -62,13 +62,14 @@
       "volumes": [
         "/var/lib/mesh-broker-nats:/data",
         "/var/lib/nats-module/conf:/etc/nats:ro",
-        "/var/lib/mesh-broker-tls:/tls:ro"
+        "${access:tls}:/tls:ro"
       ],
       "artifact": "server"
     }
   ],
   "accesses": [
     {
+      "id": "tls",
       "path": "/var/lib/mesh-broker-tls",
       "mode": "read"
     }

modules/networkmanager/module.json

@@ -3,7 +3,8 @@
   "version": "1",
   "capabilities": [
     "package-manager",
-    "service-manager"
+    "service-manager",
+    "uplink-networkmanager"
   ],
   "claims": [
     {

modules/nextcloud/module.json

@@ -31,7 +31,7 @@
   ],
   "own-secrets": {
     "admin": "${dir:state}/admin.secret",
-    "broker": "/var/lib/mesh/nextcloud/broker"
+    "broker": "${dir:mesh-state}/broker"
   },
   "capabilities": [
     "container-runtime"
@@ -49,8 +49,8 @@
     {
       "id": "mesh-state",
       "type": "directory",
-      "path": "/var/lib/mesh/nextcloud",
-      "mode": "0700"
+      "mode": "0700",
+      "place": "mesh"
     },
     {
       "id": "state",
@@ -90,7 +90,7 @@
     {
       "id": "runtime-config",
       "type": "file",
-      "path": "/var/lib/mesh/nextcloud/config.json",
+      "path": "${dir:mesh-state}/config.json",
       "mode": "0600",
       "content": "{}\n",
       "merge": "json"
@@ -101,8 +101,8 @@
       "name": "mesh-nextcloud",
       "network": "host",
       "volumes": [
-        "/var/lib/mesh/nextcloud/broker:/run/secrets/broker:ro",
-        "/var/lib/mesh/nextcloud/config.json:/run/config/config.json:ro",
+        "${dir:mesh-state}/broker:/run/secrets/broker:ro",
+        "${dir:mesh-state}/config.json:/run/config/config.json:ro",
         "${dir:state}/admin.secret:/run/secrets/admin:ro",
         "/var/run/docker.sock:/var/run/docker.sock"
       ],

modules/nodered/module.json

@@ -5,9 +5,15 @@
     "flows.deployed"
   ],
   "own-secrets": {
-    "admin": "/var/lib/mesh/nodered/admin",
-    "api-token": "/var/lib/mesh/nodered/api-token",
-    "broker": "/var/lib/mesh/nodered/broker"
+    "admin": {
+      "path": "${dir:mesh-state}/admin",
+      "taken": "at-start"
+    },
+    "api-token": {
+      "path": "${dir:mesh-state}/api-token",
+      "taken": "at-start"
+    },
+    "broker": "${dir:mesh-state}/broker"
   },
   "capabilities": [
     "container-runtime"
@@ -25,8 +31,8 @@
     {
       "id": "mesh-state",
       "type": "directory",
-      "path": "/var/lib/mesh/nodered",
-      "mode": "0700"
+      "mode": "0700",
+      "place": "mesh"
     },
     {
       "id": "state",
@@ -90,7 +96,7 @@
     {
       "id": "runtime-config",
       "type": "file",
-      "path": "/var/lib/mesh/nodered/config.json",
+      "path": "${dir:mesh-state}/config.json",
       "mode": "0600",
       "content": "{\n  \"token\": \"${secret:api-token}\"\n}\n"
     },
@@ -100,8 +106,8 @@
       "name": "mesh-nodered",
       "network": "host",
       "volumes": [
-        "/var/lib/mesh/nodered/broker:/run/secrets/broker:ro",
-        "/var/lib/mesh/nodered/config.json:/run/config/config.json:ro"
+        "${dir:mesh-state}/broker:/run/secrets/broker:ro",
+        "${dir:mesh-state}/config.json:/run/config/config.json:ro"
       ],
       "env": {
         "MESH_BROKER_FILE": "/run/secrets/broker",
@@ -120,7 +126,7 @@
       "network": "host",
       "run-once": true,
       "volumes": [
-        "/var/lib/mesh/nodered/config.json:/run/config/config.json:ro",
+        "${dir:mesh-state}/config.json:/run/config/config.json:ro",
         "${dir:written}:/var/lib/nodered-provisions",
         "${dir:state}/mqtt-topic.json:/run/provisions/mqtt-topic.json:ro",
         "${dir:state}/mqtt-topic.secret:/run/provisions/mqtt-topic.secret:ro",

modules/nzbget/Dockerfile

@@ -1,24 +0,0 @@
-# nzbget's runtime: the tool runtime, carrying this module's compiled code.
-#
-# **Built from this module's own directory and nothing else.** The sdk and the tool runtime are in
-# the base images, published like any other artifact — which is what makes this buildable by the
-# mesh from a repository and a path (novox/hq ADR 0069) rather than only on a workstation that
-# happens to have the siblings.
-#
-# Two bases, named rather than pinned (novox/hq issue 044): the image this is COMPILED in and the
-# image it RUNS in — the second must not carry a compiler. Declared in module.json's `build.on`.
-ARG BUILD_BASE
-ARG RUNTIME_BASE
-
-FROM ${BUILD_BASE} AS build
-WORKDIR /app/modules/nzbget
-COPY . .
-RUN node /app/node_modules/typescript/bin/tsc client.ts index.ts tools/index.ts \
-      --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist
-
-FROM ${RUNTIME_BASE}
-COPY --from=build /app/modules/nzbget/dist /app/modules/nzbget/dist
-# Every serve-time entrypoint, loaded by the runtime in serve mode: tools and events serve, and a
-# provider's provisioner runs its reconcile loop in the same process, with the broker connected —
-# the convention novox/hq issues 060/061 settled.
-ENV MESH_TOOL_MODULES=/app/modules/nzbget/dist/index.js,/app/modules/nzbget/dist/tools/index.js

modules/nzbget/client.ts

@@ -1,178 +0,0 @@
-// The NZBGet API client — nzbget's own code, living in the module (novox/hq ADR 0039). Ported from
-// hal's shared nzbget tools, but self-contained: a change to NZBGet's JSON-RPC now rebuilds only
-// nzbget and nothing else. Both this module's tools and its events entrypoint import it, and
-// nothing outside nzbget does. NZBGet speaks JSON-RPC at /jsonrpc, behind HTTP Basic auth.
-
-import { readFileSync } from "node:fs";
-
-export interface NzbgetStatus {
-  /** Bytes/sec — NZBGet reports it split across two 32-bit halves, rejoined here. */
-  speedBytesPerSec: number;
-  remainingMB: number;
-  downloadedTodayMB: number;
-  downloadedMonthMB: number;
-  freeDiskMB: number;
-  paused: boolean;
-  postJobs: number;
-  uptimeSec: number;
-}
-
-export interface NzbgetQueueItem {
-  /** The NZBID — stable while the item is queued, so events can diff on it. */
-  id: number;
-  name: string;
-  status: string;
-  category: string;
-  sizeMB: number;
-  remainingMB: number;
-  percent: number;
-}
-
-export interface NzbgetHistoryItem {
-  /** The NZBID — the same id the item carried in the queue. */
-  id: number;
-  name: string;
-  /** NZBGet's own status string, e.g. "SUCCESS/ALL", "FAILURE/PAR", "DELETED/MANUAL". */
-  status: string;
-  category: string;
-  sizeMB: number;
-  /** A genuine completion (status starts "SUCCESS") vs a failed or deleted entry — the difference
-   *  between something to announce as done and something that merely left the queue. */
-  success: boolean;
-}
-
-/** The settings-merged config the mesh delivers (novox/hq ADR 0046): { url, apiKey, token, password, user, ... }. */
-function meshConfig(file?: string): Record<string, string> {
-  if (!file) return {};
-  try { return JSON.parse(readFileSync(file, "utf8")) as Record<string, string>; }
-  catch { return {}; }
-}
-
-/** Read a secret the mesh mounted at a file path (an own-secret delivered by `secret accept`);
- *  absent or unreadable yields undefined so callers fall back rather than crash. */
-function readSecret(file?: string): string | undefined {
-  if (!file) return undefined;
-  try { return readFileSync(file, "utf8").trim(); }
-  catch { return undefined; }
-}
-
-export class NzbgetClient {
-  readonly rpcUrl: string;
-  private readonly auth: string;
-
-  constructor(url: string, user: string, password: string) {
-    this.rpcUrl = `${url.replace(/\/$/, "")}/jsonrpc`;
-    this.auth = Buffer.from(`${user}:${password}`).toString("base64");
-  }
-
-  /**
-   * Build from the module's resolved environment. URL and password are read from MESH_NZBGET_URL
-   * and MESH_NZBGET_PASSWORD; both must be present — an unconfigured NZBGet throws rather than
-   * pretend to be reachable, so the tools/events simply do not load (the harness treats the throw
-   * as "exposes nothing"). The control username defaults to "nzbget", NZBGet's own default.
-   */
-  static fromEnv(env: NodeJS.ProcessEnv = process.env): NzbgetClient {
-    const cfg = meshConfig(env.MESH_NZBGET_CONFIG_FILE);
-    const url = cfg.url ?? env.MESH_NZBGET_URL;
-    const password = cfg.password ?? readSecret(env.MESH_NZBGET_PASSWORD_FILE) ?? env.MESH_NZBGET_PASSWORD;
-    if (!url || !password) {
-      throw new Error("NZBGet not configured — set MESH_NZBGET_URL and MESH_NZBGET_PASSWORD");
-    }
-    const user = cfg.user ?? env.MESH_NZBGET_USER ?? "nzbget";
-    return new NzbgetClient(url, user, password);
-  }
-
-  private async rpc<T>(method: string, params: unknown[] = []): Promise<T> {
-    const res = await fetch(this.rpcUrl, {
-      method: "POST",
-      headers: { "Content-Type": "application/json", Authorization: `Basic ${this.auth}` },
-      body: JSON.stringify({ method, params, id: 1 }),
-    });
-    if (!res.ok) throw new Error(`NZBGet API ${method}: ${res.status} ${await res.text()}`);
-    const data = (await res.json()) as { result?: T; error?: unknown };
-    if (data.error) throw new Error(`NZBGet RPC ${method}: ${JSON.stringify(data.error)}`);
-    return data.result as T;
-  }
-
-  async getVersion(): Promise<string> {
-    return this.rpc<string>("version");
-  }
-
-  async getStatus(): Promise<NzbgetStatus> {
-    const s = await this.rpc<Record<string, number | boolean>>("status");
-    const lo = Number(s.DownloadRateLo ?? 0);
-    const hi = Number(s.DownloadRateHi ?? 0);
-    return {
-      speedBytesPerSec: lo + hi * 4294967296,
-      remainingMB: Number(s.RemainingSizeMB ?? 0),
-      downloadedTodayMB: Number(s.DaySizeMB ?? 0),
-      downloadedMonthMB: Number(s.MonthSizeMB ?? 0),
-      freeDiskMB: Number(s.FreeDiskSpaceMB ?? 0),
-      paused: Boolean(s.DownloadPaused),
-      postJobs: Number(s.PostJobCount ?? 0),
-      uptimeSec: Number(s.UpTimeSec ?? 0),
-    };
-  }
-
-  async getQueue(): Promise<NzbgetQueueItem[]> {
-    const groups = await this.rpc<Record<string, any>[]>("listgroups", [0]);
-    return groups.map((g) => {
-      const size = Number(g.FileSizeMB ?? 0);
-      const remaining = Number(g.RemainingSizeMB ?? 0);
-      return {
-        id: Number(g.NZBID),
-        name: String(g.NZBName ?? "Unknown"),
-        status: String(g.Status ?? "unknown"),
-        category: String(g.Category ?? ""),
-        sizeMB: size,
-        remainingMB: remaining,
-        percent: size > 0 ? Math.round(((size - remaining) / size) * 100) : 0,
-      };
-    });
-  }
-
-  async getHistory(limit = 20): Promise<NzbgetHistoryItem[]> {
-    const history = await this.rpc<Record<string, any>[]>("history", [false]);
-    return history.slice(0, limit).map((h) => {
-      const status = String(h.Status ?? "");
-      return {
-        id: Number(h.NZBID),
-        name: String(h.Name ?? "Unknown"),
-        status,
-        category: String(h.Category ?? ""),
-        sizeMB: Number(h.FileSizeMB ?? 0),
-        success: status.startsWith("SUCCESS"),
-      };
-    });
-  }
-
-  /** Queue an NZB by URL. Returns the new NZBID; a non-positive id means NZBGet refused it. */
-  async add(url: string, category = "", priority = 0, paused = false): Promise<number> {
-    const id = await this.rpc<number>("append", [
-      "", url, category, priority, false, paused, "", 0, "SCORE", false, [],
-    ]);
-    if (!id || id <= 0) throw new Error("NZBGet refused the NZB (append returned 0)");
-    return id;
-  }
-
-  async pauseAll(): Promise<void> {
-    await this.rpc("pausedownload");
-  }
-
-  async resumeAll(): Promise<void> {
-    await this.rpc("resumedownload");
-  }
-
-  async pauseItem(id: number): Promise<void> {
-    await this.rpc("editqueue", ["GroupPause", "", [id]]);
-  }
-
-  async resumeItem(id: number): Promise<void> {
-    await this.rpc("editqueue", ["GroupResume", "", [id]]);
-  }
-
-  /** Delete an item from the queue or from history. */
-  async delete(id: number, from: "queue" | "history" = "queue"): Promise<void> {
-    await this.rpc("editqueue", [from === "history" ? "HistoryDelete" : "GroupDelete", "", [id]]);
-  }
-}

modules/nzbget/index.ts

@@ -1,64 +0,0 @@
-// nzbget's events. The tool runtime imports this once the broker is bound. It watches the download
-// queue and the history and turns their comings and goings into mesh events.
-//
-// Emits (novox/hq ADR 0041/0042):
-//   module.nzbget.download.added       — an NZB entered the queue
-//   module.nzbget.download.completed   — an NZB finished successfully (left the queue, landed in
-//                                        history as SUCCESS). This exact routing key is what the
-//                                        plex module consumes (module.*.download.completed) to
-//                                        rescan, so the new file becomes a visible item.
-// Consumes: none.
-//
-// Two diffs, each primed silently on the first look (like plex's and sonarr's index.ts) so a
-// restart mid-download does not re-announce everything already in flight or already finished. The
-// queue tells us what was grabbed; history — not the queue's disappearance — tells us what actually
-// succeeded, since a failed or deleted download also leaves the queue.
-
-import { emit } from "@novox/mesh-sdk/events";
-import { NzbgetClient } from "./client.js";
-
-const nzbget = NzbgetClient.fromEnv();
-
-const inQueue = new Set<number>();
-let queuePrimed = false;
-async function pollQueue(): Promise<void> {
-  const items = await nzbget.getQueue();
-  const now = new Set(items.map((i) => i.id));
-  if (queuePrimed) {
-    for (const item of items) {
-      if (!inQueue.has(item.id)) {
-        await emit("download.added", { name: item.name, category: item.category, sizeMB: item.sizeMB });
-      }
-    }
-  }
-  inQueue.clear();
-  for (const id of now) inQueue.add(id);
-  queuePrimed = true;
-}
-
-const seenHistory = new Set<number>();
-let historyPrimed = false;
-async function pollHistory(): Promise<void> {
-  const items = await nzbget.getHistory(50);
-  for (const item of items) {
-    if (!seenHistory.has(item.id)) {
-      // A newly-appeared history entry is a completion only if it actually succeeded; a failure or
-      // a manual delete lands in history too, and neither is a "download.completed".
-      if (historyPrimed && item.success) {
-        await emit("download.completed", { name: item.name, category: item.category, sizeMB: item.sizeMB });
-      }
-      seenHistory.add(item.id);
-    }
-  }
-  historyPrimed = true;
-}
-
-const tick = (fn: () => Promise<void>, everyMs: number): void => {
-  const run = (): void => void fn().catch((err) => console.error(`[nzbget] ${err}`));
-  setInterval(run, everyMs);
-  run();
-};
-tick(pollQueue, 20_000);
-tick(pollHistory, 30_000);
-
-console.log("[nzbget] watching the queue and history, emitting adds and completions");

modules/nzbget/module.json

@@ -1,116 +0,0 @@
-{
-  "module": "nzbget",
-  "version": "1",
-  "capabilities": [
-    "container-runtime"
-  ],
-  "emits": [
-    "download.added",
-    "download.completed"
-  ],
-  "consumes": [],
-  "own-secrets": {
-    "broker": "/var/lib/mesh/nzbget/broker",
-    "password": "/var/lib/mesh/nzbget/password"
-  },
-  "listens": [
-    {
-      "name": "web",
-      "port": 6789,
-      "protocol": "tcp",
-      "from": "mesh",
-      "why": "the download client's pages"
-    }
-  ],
-  "accesses": [
-    {
-      "path": "/services/media/downloads",
-      "mode": "read-write"
-    }
-  ],
-  "resources": [
-    {
-      "id": "mesh-state",
-      "type": "directory",
-      "path": "/var/lib/mesh/nzbget",
-      "mode": "0700"
-    },
-    {
-      "id": "config",
-      "type": "directory",
-      "path": "/services/nzbget/config",
-      "mode": "0700",
-      "owner": "1000:1000"
-    },
-    {
-      "id": "server",
-      "type": "container",
-      "name": "nzbget",
-      "image": "lscr.io/linuxserver/nzbget@sha256:5f3d3fa71029004156eff2cbf4ef4455ce4ce59517cf13fa7d1d7c8a4cd2c8a4",
-      "env": {
-        "PUID": "1000",
-        "PGID": "1000",
-        "TZ": "Etc/UTC"
-      },
-      "ports": [
-        "6789"
-      ],
-      "volumes": [
-        "/services/nzbget/config:/config",
-        "/services/media/downloads:/downloads"
-      ]
-    },
-    {
-      "id": "runtime-config",
-      "type": "file",
-      "path": "/var/lib/mesh/nzbget/config.json",
-      "mode": "0600",
-      "content": "{}\n",
-      "merge": "json"
-    },
-    {
-      "id": "runtime",
-      "type": "container",
-      "name": "mesh-nzbget",
-      "network": "host",
-      "volumes": [
-        "/var/lib/mesh/nzbget/broker:/run/secrets/broker:ro",
-        "/var/lib/mesh/nzbget/password:/run/secrets/password:ro",
-        "/var/lib/mesh/nzbget/config.json:/run/config/config.json:ro",
-        "/services/nzbget/config:/var/lib/nzbget/config:ro"
-      ],
-      "env": {
-        "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_NZBGET_URL": "http://127.0.0.1:6789",
-        "MESH_NZBGET_PASSWORD_FILE": "/run/secrets/password",
-        "MESH_NZBGET_CONFIG_FILE": "/run/config/config.json",
-        "MESH_NZBGET_CONFIG_DIR": "/var/lib/nzbget/config"
-      },
-      "restart-on": [
-        "runtime-config"
-      ],
-      "artifact": "runtime"
-    }
-  ],
-  "build": {
-    "on": [
-      {
-        "arg": "BUILD_BASE",
-        "module": "mesh-tools",
-        "artifact": "build"
-      },
-      {
-        "arg": "RUNTIME_BASE",
-        "module": "mesh-tools",
-        "artifact": "runtime"
-      }
-    ],
-    "artifacts": [
-      {
-        "name": "runtime",
-        "kind": "image",
-        "from": "Dockerfile"
-      }
-    ]
-  }
-}

modules/nzbget/package.json

@@ -1,14 +0,0 @@
-{
-  "name": "@novox/module-nzbget",
-  "version": "0.1.0",
-  "description": "nzbget — Usenet download client. Its API client, tools and events live here (novox/hq ADR 0039).",
-  "type": "module",
-  "private": true,
-  "dependencies": {
-    "@novox/mesh-sdk": "^0.1.0"
-  },
-  "devDependencies": {
-    "@types/node": "^22.0.0",
-    "typescript": "^5.6.0"
-  }
-}

modules/nzbget/tools/index.ts

@@ -1,88 +0,0 @@
-// nzbget's tools — ported from the shared hal sdk (novox/hq ADR 0039), importing nzbget's own
-// client. They return structured data (not the pre-formatted text hal returned); the mesh serves
-// them through the sdk's tool harness.
-
-import { registerModuleTools, type ToolDefinition } from "@novox/mesh-sdk/tools";
-import { NzbgetClient } from "../client.js";
-
-export function getNzbgetTools(nzbget: NzbgetClient): ToolDefinition[] {
-  return [
-    {
-      name: "nzbget_status",
-      description: "NZBGet server status: download speed, queue remaining, disk free, paused state.",
-      input: {},
-      run: async () => nzbget.getStatus(),
-    },
-    {
-      name: "nzbget_queue",
-      description: "List the current NZBGet download queue — what is downloading and how far along.",
-      input: {},
-      run: async () => {
-        const items = await nzbget.getQueue();
-        return { count: items.length, items };
-      },
-    },
-    {
-      name: "nzbget_history",
-      description: "Recent NZBGet download history, newest first — completed, failed and deleted items.",
-      input: { limit: { type: "number", description: "how many entries (default 20)" } },
-      run: async (args) => {
-        const items = await nzbget.getHistory(args.limit ? Number(args.limit) : 20);
-        return { count: items.length, items };
-      },
-    },
-    {
-      name: "nzbget_add",
-      description: "Queue an NZB download by URL, optionally into a category.",
-      input: {
-        url: { type: "string", description: "URL to the NZB file" },
-        category: { type: "string", description: "category name (determines download directory)" },
-        priority: { type: "number", description: "-100 very low … 0 normal … 100 very high (default 0)" },
-        paused: { type: "boolean", description: "add in paused state (default false)" },
-      },
-      run: async (args) => {
-        const id = await nzbget.add(
-          String(args.url),
-          args.category ? String(args.category) : "",
-          args.priority ? Number(args.priority) : 0,
-          args.paused === true || args.paused === "true",
-        );
-        return { added: id, category: args.category ? String(args.category) : null };
-      },
-    },
-    {
-      name: "nzbget_pause",
-      description: "Pause or resume all NZBGet downloads.",
-      input: { resume: { type: "boolean", description: "true to resume, false to pause (default false)" } },
-      run: async (args) => {
-        const resume = args.resume === true || args.resume === "true";
-        if (resume) await nzbget.resumeAll();
-        else await nzbget.pauseAll();
-        return { paused: !resume };
-      },
-    },
-    {
-      name: "nzbget_delete",
-      description: "Delete an NZB from the queue or from history by its NZBID.",
-      input: {
-        id: { type: "number", description: "the NZBID to delete" },
-        from: { type: "string", description: "'queue' (default) or 'history'" },
-      },
-      run: async (args) => {
-        const from = args.from === "history" ? "history" : "queue";
-        await nzbget.delete(Number(args.id), from);
-        return { deleted: Number(args.id), from };
-      },
-    },
-  ];
-}
-
-// The tools exist only when NZBGet is configured; without a URL and password, nzbget contributes
-// none rather than failing the whole runtime.
-registerModuleTools("nzbget", (env) => {
-  try {
-    return getNzbgetTools(NzbgetClient.fromEnv(env));
-  } catch {
-    return [];
-  }
-});

modules/nzbget/tsconfig.json

@@ -1,12 +0,0 @@
-{
-  "compilerOptions": {
-    "target": "ES2022",
-    "module": "NodeNext",
-    "moduleResolution": "NodeNext",
-    "strict": true,
-    "esModuleInterop": true,
-    "skipLibCheck": true,
-    "noEmit": true
-  },
-  "include": ["client.ts", "index.ts", "tools/index.ts"]
-}

modules/ombi/Dockerfile

@@ -1,24 +0,0 @@
-# ombi's runtime: the tool runtime, carrying this module's compiled code.
-#
-# **Built from this module's own directory and nothing else.** The sdk and the tool runtime are in
-# the base images, published like any other artifact — which is what makes this buildable by the
-# mesh from a repository and a path (novox/hq ADR 0069) rather than only on a workstation that
-# happens to have the siblings.
-#
-# Two bases, named rather than pinned (novox/hq issue 044): the image this is COMPILED in and the
-# image it RUNS in — the second must not carry a compiler. Declared in module.json's `build.on`.
-ARG BUILD_BASE
-ARG RUNTIME_BASE
-
-FROM ${BUILD_BASE} AS build
-WORKDIR /app/modules/ombi
-COPY . .
-RUN node /app/node_modules/typescript/bin/tsc client.ts index.ts tools/index.ts \
-      --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist
-
-FROM ${RUNTIME_BASE}
-COPY --from=build /app/modules/ombi/dist /app/modules/ombi/dist
-# Every serve-time entrypoint, loaded by the runtime in serve mode: tools and events serve, and a
-# provider's provisioner runs its reconcile loop in the same process, with the broker connected —
-# the convention novox/hq issues 060/061 settled.
-ENV MESH_TOOL_MODULES=/app/modules/ombi/dist/index.js,/app/modules/ombi/dist/tools/index.js

modules/ombi/client.ts

@@ -1,122 +0,0 @@
-// The Ombi API client — ombi's own code, living in the module (novox/hq ADR 0039). Ombi is the
-// request front-end: viewers ask for movies and shows, and an operator approves them. This client
-// talks its /api/v1 REST API (keyed by an ApiKey header); ombi's tools and events import it.
-
-import { readFileSync } from "node:fs";
-
-export interface OmbiRequest {
-  kind: "movie" | "tv";
-  id: number;
-  title: string;
-  requestedBy?: string;
-  requestedDate?: string;
-  approved: boolean;
-  available: boolean;
-  denied: boolean;
-  tmdbId?: number;
-}
-
-export interface RequestCounts {
-  pending: number;
-  approved: number;
-  available: number;
-}
-
-/** The settings-merged config the mesh delivers (novox/hq ADR 0046): { url, apiKey, token, password, user, ... }. */
-function meshConfig(file?: string): Record<string, string> {
-  if (!file) return {};
-  try { return JSON.parse(readFileSync(file, "utf8")) as Record<string, string>; }
-  catch { return {}; }
-}
-
-/** Read a secret the mesh mounted at a file path (an own-secret delivered by `secret accept`);
- *  absent or unreadable yields undefined so callers fall back rather than crash. */
-function readSecret(file?: string): string | undefined {
-  if (!file) return undefined;
-  try { return readFileSync(file, "utf8").trim(); }
-  catch { return undefined; }
-}
-
-export class OmbiClient {
-  readonly baseUrl: string;
-
-  constructor(
-    url: string,
-    private readonly apiKey: string,
-  ) {
-    this.baseUrl = url.replace(/\/$/, "");
-  }
-
-  /** Build from the module's resolved environment. Ombi's API is keyed; without URL and key there
-   *  is nothing to talk to, so this throws rather than run half-configured. */
-  static fromEnv(env: NodeJS.ProcessEnv = process.env): OmbiClient {
-    const cfg = meshConfig(env.MESH_OMBI_CONFIG_FILE);
-    const url = cfg.url ?? env.MESH_OMBI_URL;
-    const apiKey = cfg.apiKey ?? readSecret(env.MESH_OMBI_API_KEY_FILE) ?? env.MESH_OMBI_API_KEY;
-    if (!url) throw new Error("no Ombi URL — set MESH_OMBI_URL");
-    if (!apiKey) throw new Error("no Ombi API key — set MESH_OMBI_API_KEY");
-    return new OmbiClient(url, apiKey);
-  }
-
-  private async request(method: string, path: string, body?: unknown): Promise<any> {
-    const res = await fetch(`${this.baseUrl}/api/v1${path}`, {
-      method,
-      headers: {
-        ApiKey: this.apiKey,
-        Accept: "application/json",
-        ...(body !== undefined ? { "Content-Type": "application/json" } : {}),
-      },
-      body: body !== undefined ? JSON.stringify(body) : undefined,
-    });
-    if (!res.ok) throw new Error(`Ombi API ${method} ${path}: ${res.status} ${await res.text()}`);
-    const text = await res.text();
-    return text ? JSON.parse(text) : {};
-  }
-
-  /** All requests, movies and TV together — who asked for what, and where each stands. */
-  async getRequests(): Promise<OmbiRequest[]> {
-    const [movies, tv] = await Promise.all([
-      this.request("GET", "/Request/movie"),
-      this.request("GET", "/Request/tv"),
-    ]);
-    const films: OmbiRequest[] = (Array.isArray(movies) ? movies : []).map((r: any) => ({
-      kind: "movie" as const,
-      id: r.id,
-      title: r.title ?? "Unknown",
-      requestedBy: r.requestedUser?.userName ?? r.requestedUser?.userAlias,
-      requestedDate: r.requestedDate,
-      approved: Boolean(r.approved),
-      available: Boolean(r.available),
-      denied: Boolean(r.denied),
-      tmdbId: r.theMovieDbId,
-    }));
-    // TV requests carry per-season child requests; the top-level record is approved when all its
-    // children are, which is the grain an operator acts on.
-    const shows: OmbiRequest[] = (Array.isArray(tv) ? tv : []).map((r: any) => {
-      const children: any[] = r.childRequests ?? [];
-      return {
-        kind: "tv" as const,
-        id: r.id,
-        title: r.title ?? "Unknown",
-        requestedBy: children[0]?.requestedUser?.userName,
-        requestedDate: children[0]?.requestedDate,
-        approved: children.length > 0 && children.every((c) => c.approved),
-        available: children.length > 0 && children.every((c) => c.available),
-        denied: children.some((c) => c.denied),
-        tmdbId: r.theMovieDbId,
-      };
-    });
-    return [...films, ...shows];
-  }
-
-  /** Live pending/approved/available counts — a one-line health read without listing everything. */
-  async getCounts(): Promise<RequestCounts> {
-    const c = await this.request("GET", "/Request/count");
-    return { pending: c.pending ?? 0, approved: c.approved ?? 0, available: c.available ?? 0 };
-  }
-
-  /** Approve a request. TV approval fans out to the request's child (per-season) requests. */
-  async approve(kind: "movie" | "tv", id: number): Promise<void> {
-    await this.request("POST", `/Request/${kind}/approve`, { id });
-  }
-}

modules/ombi/index.ts

@@ -1,58 +0,0 @@
-// ombi's events. The tool runtime imports this once the broker is bound. Ombi's timeline is the
-// request lifecycle: a viewer files a request, and later an operator approves it. Both transitions
-// are worth announcing — the mesh can notify on a new request, and act on an approval (that is when
-// a downloader should start looking).
-//
-// Emits (novox/hq ADR 0041/0042):
-//   module.ombi.request.created    — a viewer filed a new request
-//   module.ombi.request.approved   — a request was approved
-//
-// Ombi is the origin of these decisions, not a reactor to the mesh, so it consumes nothing.
-//
-// Both events are observation-based: poll the request list and diff. Creation is diffed on the set
-// of request ids; approval on each request's approved flag flipping true. Primed silently on the
-// first look, or a restart would re-announce every existing request and approval.
-
-import { emit } from "@novox/mesh-sdk/events";
-import { OmbiClient, type OmbiRequest } from "./client.js";
-
-const ombi = OmbiClient.fromEnv();
-
-// Remember each seen request and whether it was approved last time, keyed by kind+id (ids are only
-// unique within a kind).
-const approvedState = new Map<string, boolean>();
-let primed = false;
-
-const keyOf = (r: OmbiRequest): string => `${r.kind}:${r.id}`;
-
-async function pollRequests(): Promise<void> {
-  const requests = await ombi.getRequests();
-  for (const r of requests) {
-    const key = keyOf(r);
-    const known = approvedState.has(key);
-    if (primed && !known) {
-      await emit("request.created", {
-        kind: r.kind,
-        id: r.id,
-        title: r.title,
-        requestedBy: r.requestedBy,
-        tmdbId: r.tmdbId,
-      });
-    }
-    // Approval: the flag went from false to true for a request we already knew about.
-    if (primed && known && r.approved && approvedState.get(key) === false) {
-      await emit("request.approved", { kind: r.kind, id: r.id, title: r.title, tmdbId: r.tmdbId });
-    }
-    approvedState.set(key, r.approved);
-  }
-  primed = true;
-}
-
-const tick = (fn: () => Promise<void>, everyMs: number): void => {
-  const run = (): void => void fn().catch((err) => console.error(`[ombi] ${err}`));
-  setInterval(run, everyMs);
-  run();
-};
-tick(pollRequests, 30_000);
-
-console.log("[ombi] watching requests for new filings and approvals");

modules/ombi/module.json

@@ -1,120 +0,0 @@
-{
-  "module": "ombi",
-  "version": "1",
-  "capabilities": [
-    "container-runtime"
-  ],
-  "emits": [
-    "request.created",
-    "request.approved"
-  ],
-  "own-secrets": {
-    "broker": "/var/lib/mesh/ombi/broker",
-    "api-key": "/var/lib/mesh/ombi/api-key"
-  },
-  "listens": [
-    {
-      "name": "web",
-      "port": 3579,
-      "protocol": "tcp",
-      "from": "mesh",
-      "why": "requests from viewers"
-    }
-  ],
-  "resources": [
-    {
-      "id": "mesh-state",
-      "type": "directory",
-      "path": "/var/lib/mesh/ombi",
-      "mode": "0700"
-    },
-    {
-      "id": "config",
-      "type": "directory",
-      "path": "/services/ombi/config",
-      "mode": "0700",
-      "owner": "1000:1000"
-    },
-    {
-      "id": "server",
-      "type": "container",
-      "name": "ombi",
-      "image": "lscr.io/linuxserver/ombi@sha256:a6f76ac521ba01eee2e9f0c23a3fed22e56630d97a04d5eeaeaa36c1e681640d",
-      "env": {
-        "PUID": "1000",
-        "PGID": "1000",
-        "TZ": "Etc/UTC"
-      },
-      "ports": [
-        "3579"
-      ],
-      "volumes": [
-        "/services/ombi/config:/config"
-      ]
-    },
-    {
-      "id": "runtime-config",
-      "type": "file",
-      "path": "/var/lib/mesh/ombi/config.json",
-      "mode": "0600",
-      "content": "{}\n",
-      "merge": "json"
-    },
-    {
-      "id": "runtime",
-      "type": "container",
-      "name": "mesh-ombi",
-      "network": "host",
-      "volumes": [
-        "/var/lib/mesh/ombi/broker:/run/secrets/broker:ro",
-        "/var/lib/mesh/ombi/api-key:/run/secrets/api-key:ro",
-        "/var/lib/mesh/ombi/config.json:/run/config/config.json:ro",
-        "/services/ombi/config:/var/lib/ombi/config:ro"
-      ],
-      "env": {
-        "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_OMBI_URL": "http://127.0.0.1:3579",
-        "MESH_OMBI_API_KEY_FILE": "/run/secrets/api-key",
-        "MESH_OMBI_CONFIG_FILE": "/run/config/config.json",
-        "MESH_OMBI_CONFIG_DIR": "/var/lib/ombi/config"
-      },
-      "restart-on": [
-        "runtime-config"
-      ],
-      "artifact": "runtime"
-    }
-  ],
-  "requires": [
-    "route"
-  ],
-  "contributes": {
-    "route": {
-      "label": "ombi",
-      "endpoint": "web"
-    }
-  },
-  "binds": {
-    "route": "/var/lib/mesh/ombi/route.json"
-  },
-  "build": {
-    "on": [
-      {
-        "arg": "BUILD_BASE",
-        "module": "mesh-tools",
-        "artifact": "build"
-      },
-      {
-        "arg": "RUNTIME_BASE",
-        "module": "mesh-tools",
-        "artifact": "runtime"
-      }
-    ],
-    "artifacts": [
-      {
-        "name": "runtime",
-        "kind": "image",
-        "from": "Dockerfile"
-      }
-    ]
-  }
-}

modules/ombi/package.json

@@ -1,14 +0,0 @@
-{
-  "name": "@novox/module-ombi",
-  "version": "0.1.0",
-  "description": "ombi — media requests. Its API client, tools and events live here (novox/hq ADR 0039).",
-  "type": "module",
-  "private": true,
-  "dependencies": {
-    "@novox/mesh-sdk": "^0.1.0"
-  },
-  "devDependencies": {
-    "@types/node": "^22.0.0",
-    "typescript": "^5.6.0"
-  }
-}

modules/ombi/tools/index.ts

@@ -1,46 +0,0 @@
-// ombi's tools — its own code (novox/hq ADR 0039), importing ombi's client. They return structured
-// data; the mesh serves them through the sdk's tool harness.
-
-import { registerModuleTools, type ToolDefinition } from "@novox/mesh-sdk/tools";
-import { OmbiClient } from "../client.js";
-
-export function getOmbiTools(ombi: OmbiClient): ToolDefinition[] {
-  return [
-    {
-      name: "ombi_requests",
-      description: "List media requests — movies and shows — with who asked and whether each is approved or available.",
-      input: { pending: { type: "boolean", description: "only requests not yet approved (default false)" } },
-      run: async (args) => {
-        let requests = await ombi.getRequests();
-        if (args.pending) requests = requests.filter((r) => !r.approved && !r.denied);
-        const counts = await ombi.getCounts();
-        return { counts, count: requests.length, requests };
-      },
-    },
-    {
-      name: "ombi_approve",
-      description: "Approve a media request by its kind and id (from ombi_requests).",
-      input: {
-        kind: { type: "string", description: '"movie" or "tv"' },
-        id: { type: "number", description: "the request id" },
-      },
-      run: async (args) => {
-        const kind = String(args.kind);
-        if (kind !== "movie" && kind !== "tv") throw new Error('kind must be "movie" or "tv"');
-        const id = Number(args.id);
-        await ombi.approve(kind, id);
-        return { approved: { kind, id } };
-      },
-    },
-  ];
-}
-
-// Exposed only when Ombi is configured; otherwise ombi contributes no tools rather than failing the
-// whole runtime.
-registerModuleTools("ombi", (env) => {
-  try {
-    return getOmbiTools(OmbiClient.fromEnv(env));
-  } catch {
-    return [];
-  }
-});

modules/ombi/tsconfig.json

@@ -1,12 +0,0 @@
-{
-  "compilerOptions": {
-    "target": "ES2022",
-    "module": "NodeNext",
-    "moduleResolution": "NodeNext",
-    "strict": true,
-    "esModuleInterop": true,
-    "skipLibCheck": true,
-    "noEmit": true
-  },
-  "include": ["client.ts", "index.ts", "tools/index.ts"]
-}

modules/openai-consumer/module.json

@@ -9,22 +9,21 @@
     "model-access"
   ],
   "binds": {
-    "model-access": "/var/lib/openai-consumer/model.json"
+    "model-access": "${dir:state}/model.json"
   },
   "secrets": {
-    "model-access": "/var/lib/openai-consumer/api-key"
+    "model-access": "${dir:state}/api-key"
   },
   "resources": [
     {
       "id": "state",
       "type": "directory",
-      "path": "/var/lib/openai-consumer",
-      "mode": "0700"
+      "mode": "0700",
+      "place": "."
     },
     {
       "id": "config",
       "type": "directory",
-      "path": "/var/lib/openai-consumer/config",
       "mode": "0700"
     },
     {
@@ -38,7 +37,7 @@
         "/app/modules/openai-consumer/dist/apply/index.js"
       ],
       "volumes": [
-        "/var/lib/openai-consumer:/run/state"
+        "${dir:state}:/run/state"
       ],
       "env": {
         "MESH_MODEL_ACCESS_SECRET_FILE": "/run/state/api-key",

modules/photos-eef/module.json

@@ -15,7 +15,7 @@
     }
   },
   "binds": {
-    "route": "/var/lib/photos-eef/route.json"
+    "route": "${dir:state}/route.json"
   },
   "listens": [
     {
@@ -30,8 +30,8 @@
     {
       "id": "state",
       "type": "directory",
-      "path": "/var/lib/photos-eef",
-      "mode": "0700"
+      "mode": "0700",
+      "place": "."
     },
     {
       "id": "net",

modules/photos-filip/module.json

@@ -15,7 +15,7 @@
     }
   },
   "binds": {
-    "route": "/var/lib/photos-filip/route.json"
+    "route": "${dir:state}/route.json"
   },
   "listens": [
     {
@@ -30,8 +30,8 @@
     {
       "id": "state",
       "type": "directory",
-      "path": "/var/lib/photos-filip",
-      "mode": "0700"
+      "mode": "0700",
+      "place": "."
     },
     {
       "id": "net",

modules/photos/module.json

@@ -22,13 +22,13 @@
     }
   },
   "binds": {
-    "s3-bucket": "/var/lib/photos/store.json",
-    "mongodb-database": "/var/lib/photos/database.json",
-    "route": "/var/lib/photos/route.json"
+    "s3-bucket": "${dir:state}/store.json",
+    "mongodb-database": "${dir:state}/database.json",
+    "route": "${dir:state}/route.json"
   },
   "secrets": {
-    "s3-bucket": "/var/lib/photos/store.secret",
-    "mongodb-database": "/var/lib/photos/database.secret"
+    "s3-bucket": "${dir:state}/store.secret",
+    "mongodb-database": "${dir:state}/database.secret"
   },
   "listens": [
     {
@@ -50,13 +50,13 @@
     {
       "id": "state",
       "type": "directory",
-      "path": "/var/lib/photos",
-      "mode": "0700"
+      "mode": "0700",
+      "place": "."
     },
     {
       "id": "server-env",
       "type": "file",
-      "path": "/var/lib/photos/server.env",
+      "path": "${dir:state}/server.env",
       "mode": "0600",
       "content": "NODE_ENV=production\nPORT=9000\nMONGO_URL=mongodb://${bound:mongodb-database:as}:${secret:mongodb-database}@${bound:mongodb-database:at}:${bound:mongodb-database:port}/${bound:mongodb-database:as}?authSource=admin\nMONGO_DB=${bound:mongodb-database:as}\nMINIO_ENDPOINT=${bound:s3-bucket:at}\nMINIO_PORT=${bound:s3-bucket:port}\nMINIO_BUCKET=mesh-novox-photos\nMINIO_ACCESSKEY=${bound:s3-bucket:as}\nMINIO_SECRET=${secret:s3-bucket}\nMINIO_USE_SSL=false\n"
     },
@@ -72,7 +72,7 @@
       "image": "registry-api.novox.be/novox/photos-server@sha256:3f165acbbd1fd731b12fe798c95879c081a44b00e2c569ef7f47165f6a527201",
       "network": "photos",
       "env-file": [
-        "/var/lib/photos/server.env"
+        "${dir:state}/server.env"
       ],
       "ports": [
         "9000"

modules/plex/Dockerfile

@@ -1,24 +0,0 @@
-# plex's runtime: the tool runtime, carrying this module's compiled code.
-#
-# **Built from this module's own directory and nothing else.** The sdk and the tool runtime are in
-# the base images, published like any other artifact — which is what makes this buildable by the
-# mesh from a repository and a path (novox/hq ADR 0069) rather than only on a workstation that
-# happens to have the siblings.
-#
-# Two bases, named rather than pinned (novox/hq issue 044): the image this is COMPILED in and the
-# image it RUNS in — the second must not carry a compiler. Declared in module.json's `build.on`.
-ARG BUILD_BASE
-ARG RUNTIME_BASE
-
-FROM ${BUILD_BASE} AS build
-WORKDIR /app/modules/plex
-COPY . .
-RUN node /app/node_modules/typescript/bin/tsc client.ts index.ts tools/index.ts \
-      --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist
-
-FROM ${RUNTIME_BASE}
-COPY --from=build /app/modules/plex/dist /app/modules/plex/dist
-# Every serve-time entrypoint, loaded by the runtime in serve mode: tools and events serve, and a
-# provider's provisioner runs its reconcile loop in the same process, with the broker connected —
-# the convention novox/hq issues 060/061 settled.
-ENV MESH_TOOL_MODULES=/app/modules/plex/dist/index.js,/app/modules/plex/dist/tools/index.js