ssh-client module: the mesh owns ~/.ssh, config from the hub (to-be 29)

Requires openssh; creates ~/.ssh (0700, owned by the operator account via
${machine:account}); writes every other node's Host block (HostName + User
<account>) into a marked region of ~/.ssh/config (home-scoped, into:block), so
`ssh <node>` reaches each peer as the right account and the operator's own
config is kept. Universal-tier: assigned wherever a person logs in; a node with
no account gets no config.

modules/amqp-email-forwarder/module.json

@@ -0,0 +1,56 @@
+{
+  "module": "amqp-email-forwarder",
+  "version": "1",
+  "slug": "emailfwd",
+  "capabilities": [
+    "container-runtime"
+  ],
+  "requires": [
+    "amqp"
+  ],
+  "contributes": {},
+  "binds": {
+    "amqp": "/var/lib/amqp-email-forwarder/amqp.json"
+  },
+  "secrets": {
+    "amqp": "/var/lib/amqp-email-forwarder/amqp.secret"
+  },
+  "own-secrets": {
+    "smtp-user": "/var/lib/amqp-email-forwarder/smtp-user.secret",
+    "smtp-password": "/var/lib/amqp-email-forwarder/smtp-password.secret"
+  },
+  "resources": [
+    {
+      "id": "state",
+      "type": "directory",
+      "path": "/var/lib/amqp-email-forwarder",
+      "mode": "0700"
+    },
+    {
+      "id": "app-env",
+      "type": "file",
+      "path": "/var/lib/amqp-email-forwarder/app.env",
+      "mode": "0600",
+      "content": "AMQP_HOST=${bound:amqp:at}\nAMQP_PORT=${bound:amqp:port}\nAMQP_USER=${bound:amqp:as}\nAMQP_VHOST=EMAILDELIVERY_T\nAMQP_EXCHANGE=News.TransactionalEmailing.Command\nAMQP_QUEUE=email-forwarder\nAMQP_URL=amqp://${bound:amqp:as}:${secret:amqp}@${bound:amqp:at}:${bound:amqp:port}/EMAILDELIVERY_T\nSMTP_HOST=mail.novox.be\nSMTP_PORT=587\nSMTP_USER=${secret:smtp-user}\nSMTP_PASSWORD=${secret:smtp-password}\n"
+    },
+    {
+      "id": "net",
+      "type": "network",
+      "name": "amqp-email-forwarder"
+    },
+    {
+      "id": "app",
+      "type": "container",
+      "name": "amqp-email-forwarder",
+      "image": "registry-api.novox.be/novox/amqp-email-forwarder@sha256:f76d34646d9d3b2098c72688a63f6ae656f1888ffcb2f90a9c8dd2a44ad7f8af",
+      "network": "amqp-email-forwarder",
+      "env-file": [
+        "/var/lib/amqp-email-forwarder/app.env"
+      ],
+      "restart-on": [
+        "app-env"
+      ],
+      "secrets-in-environment": "the application's own code reads AMQP_URL, SMTP_USER and SMTP_PASSWORD from the environment (amqp-email-forwarder app.js); converting is that repository's change"
+    }
+  ]
+}

modules/amqp-ping/Dockerfile

@@ -0,0 +1,31 @@
+# amqp-ping's runtime: the tool runtime, carrying this module's compiled code.
+#
+# **Built from this module's own directory and nothing else.** The sdk and the tool runtime are not
+# copied out of neighbouring checkouts — they are in the base image, which is published like any
+# other artifact. That is what makes this buildable by the mesh from a repository and a path
+# (novox/hq ADR 0069) rather than only on a workstation that happens to have the siblings.
+#
+# Two bases, named rather than pinned: the image this is COMPILED in, and the image it RUNS in.
+# They are different images on purpose — the first carries a compiler and the second must not, or
+# every running container would carry one it never invokes. The mesh answers both with the copies it
+# holds, because a fingerprint written here would name one particular copy and no other mesh has it
+# (novox/hq issue 044). Declared in module.json's `build.on`; deliberately no defaults, so a build
+# nobody told stops here and says which module to build first.
+ARG BUILD_BASE
+ARG RUNTIME_BASE
+
+FROM ${BUILD_BASE} AS build
+# Compiled under /app/modules, so resolving `@novox/mesh-sdk` walks up to the base's own
+# node_modules — the module is compiled against exactly the sdk it will run against.
+WORKDIR /app/modules/amqp-ping
+COPY . .
+# The compiler is invoked by its real path, not through node_modules/.bin. Those are symlinks to
+# a launcher that requires its library relatively, and the base image resolves them when copying —
+# leaving a launcher whose relative require no longer points at anything.
+RUN node /app/node_modules/typescript/bin/tsc client.ts index.ts \
+      --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist
+
+FROM ${RUNTIME_BASE}
+COPY --from=build /app/modules/amqp-ping/dist /app/modules/amqp-ping/dist
+# Declared rather than derived from which files happen to exist: the module knows what it serves.
+ENV MESH_TOOL_MODULES=/app/modules/amqp-ping/dist/index.js

modules/amqp-ping/client.ts

@@ -0,0 +1,191 @@
+// amqp-ping's AMQP client — the demo consumer's own code (novox/hq ADR 0039). It speaks AMQP 0-9-1
+// directly over a raw TCP socket (node:net), the way redis's client speaks RESP: the module carries
+// NO npm dependency beyond @novox/mesh-sdk — no amqplib, no CLI in the image. It does exactly one
+// thing, the round-trip that proves the grant works: connect, authenticate with PLAIN to the vhost
+// the mesh named, declare a queue, publish one message and get it back.
+//
+// This is the consumer half of the `amqp` interface. It connects as the login the mesh derived
+// (`${bound:amqp:as}`) with the password the mesh minted (`${secret:amqp}`) to a vhost of that SAME
+// name — the provider named the vhost after the login, so the consumer must too. Nothing here is
+// hardcoded: user AND vhost are both the bound login, and a wrong vhost is refused by the broker.
+
+import { createConnection, type Socket } from "node:net";
+import { readFileSync } from "node:fs";
+
+const FRAME_END = 0xce;
+const PROTOCOL_HEADER = Buffer.from([0x41, 0x4d, 0x51, 0x50, 0x00, 0x00, 0x09, 0x01]); // "AMQP" 0-9-1
+
+export interface AmqpConn {
+  readonly host: string;
+  readonly port: number;
+  readonly user: string;
+  readonly password: string;
+  readonly vhost: string;
+}
+
+/** Build the connection facts from the environment the mesh's env-file set (see the module manifest). */
+export function connFromEnv(env: NodeJS.ProcessEnv = process.env): AmqpConn {
+  const host = env.MESH_AMQP_HOST ?? "";
+  const port = Number(env.MESH_AMQP_PORT ?? "5672") || 5672;
+  const user = env.MESH_AMQP_USER ?? "";
+  const vhost = env.MESH_AMQP_VHOST ?? user; // the provider names the vhost after the login
+  const password = env.MESH_AMQP_PASSWORD ?? readMaybe(env.MESH_AMQP_PASSWORD_FILE);
+  if (!host || !user || !password) {
+    throw new Error(`amqp-ping: connection is not fully set yet (host=${host} user=${user} password=${password ? "set" : "unset"})`);
+  }
+  return { host, port, user, password, vhost };
+}
+
+// --- wire helpers ---------------------------------------------------------------------------------
+
+function shortstr(s: string): Buffer {
+  const b = Buffer.from(s, "utf8");
+  const o = Buffer.alloc(1 + b.length);
+  o.writeUInt8(b.length, 0);
+  b.copy(o, 1);
+  return o;
+}
+function longstr(s: Buffer | string): Buffer {
+  const b = Buffer.isBuffer(s) ? s : Buffer.from(s, "utf8");
+  const o = Buffer.alloc(4 + b.length);
+  o.writeUInt32BE(b.length, 0);
+  b.copy(o, 4);
+  return o;
+}
+function u16(n: number): Buffer {
+  const o = Buffer.alloc(2);
+  o.writeUInt16BE(n, 0);
+  return o;
+}
+function u32(n: number): Buffer {
+  const o = Buffer.alloc(4);
+  o.writeUInt32BE(n, 0);
+  return o;
+}
+function frame(type: number, channel: number, payload: Buffer): Buffer {
+  const o = Buffer.alloc(7 + payload.length + 1);
+  o.writeUInt8(type, 0);
+  o.writeUInt16BE(channel, 1);
+  o.writeUInt32BE(payload.length, 3);
+  payload.copy(o, 7);
+  o.writeUInt8(FRAME_END, 7 + payload.length);
+  return o;
+}
+function method(channel: number, classId: number, methodId: number, ...parts: Buffer[]): Buffer {
+  return frame(1, channel, Buffer.concat([u16(classId), u16(methodId), ...parts]));
+}
+
+interface MethodWaiter {
+  classId: number;
+  methodId: number;
+  resolve: (args: Buffer) => void;
+  reject: (e: Error) => void;
+}
+
+/**
+ * Connect, authenticate to the vhost, declare a queue, publish one message and get it back. Returns
+ * the body that came back — the caller checks it equals what went out. Throws on any protocol error,
+ * including the broker's `NOT_ALLOWED` refusal of a vhost the login has no permission on (the
+ * isolation the provider builds, seen from the consumer's side).
+ */
+export function roundTrip(conn: AmqpConn, queue = "amqp-ping", payload?: string): Promise<string> {
+  const body = Buffer.from(payload ?? `ping-${Date.now()}`);
+  return new Promise<string>((resolve, reject) => {
+    const sock: Socket = createConnection({ host: conn.host, port: conn.port });
+    let buf = Buffer.alloc(0);
+    const waiters: MethodWaiter[] = [];
+    let lastBody: Buffer | null = null;
+    let done = false;
+
+    const fail = (e: Error): void => {
+      if (done) return;
+      done = true;
+      sock.destroy();
+      reject(e);
+    };
+    const expect = (classId: number, methodId: number): Promise<Buffer> =>
+      new Promise((res, rej) => waiters.push({ classId, methodId, resolve: res, reject: rej }));
+
+    sock.on("error", (e) => fail(e));
+    sock.on("close", () => fail(new Error("amqp connection closed before the round-trip completed")));
+    sock.on("data", (chunk: Buffer) => {
+      buf = Buffer.concat([buf, chunk]);
+      for (;;) {
+        if (buf.length < 7) return;
+        const type = buf.readUInt8(0);
+        const size = buf.readUInt32BE(3);
+        if (buf.length < 7 + size + 1) return;
+        const framePayload = buf.subarray(7, 7 + size);
+        buf = buf.subarray(7 + size + 1);
+        if (type === 1) {
+          const classId = framePayload.readUInt16BE(0);
+          const methodId = framePayload.readUInt16BE(2);
+          const args = framePayload.subarray(4);
+          const w = waiters.shift();
+          if (!w) continue;
+          if (w.classId === classId && w.methodId === methodId) w.resolve(args);
+          else w.reject(new Error(`expected method ${w.classId}/${w.methodId}, got ${classId}/${methodId}: ${args.toString("utf8")}`));
+        } else if (type === 3) {
+          lastBody = framePayload; // a content body frame
+        }
+        // type 2 (content header) and type 8 (heartbeat) need no handling for this round-trip.
+      }
+    });
+
+    sock.on("connect", () => {
+      void (async () => {
+        try {
+          sock.write(PROTOCOL_HEADER);
+          await expect(10, 10); // Connection.Start
+          const response = Buffer.concat([
+            Buffer.from([0]), Buffer.from(conn.user, "utf8"), Buffer.from([0]), Buffer.from(conn.password, "utf8"),
+          ]);
+          // Connection.Start-Ok: empty client-properties table, PLAIN, the SASL response, locale.
+          sock.write(method(0, 10, 11, u32(0), shortstr("PLAIN"), longstr(response), shortstr("en_US")));
+          const tune = await expect(10, 30); // Connection.Tune
+          const frameMax = tune.readUInt32BE(2) || 131072;
+          sock.write(method(0, 10, 31, u16(tune.readUInt16BE(0)), u32(frameMax), u16(0))); // Tune-Ok, no heartbeat
+          sock.write(method(0, 10, 40, shortstr(conn.vhost), shortstr(""), Buffer.from([0]))); // Connection.Open
+          await expect(10, 41); // Open-Ok — authenticated and into the vhost
+
+          sock.write(method(1, 20, 10, shortstr(""))); // Channel.Open
+          await expect(20, 11);
+          // Queue.Declare: reserved, queue, bits(auto-delete=1), empty arguments table.
+          sock.write(method(1, 50, 10, u16(0), shortstr(queue), Buffer.from([0b00001000]), u32(0)));
+          await expect(50, 11);
+
+          // Basic.Publish to the default exchange, routing-key = queue; then content header + body.
+          sock.write(method(1, 60, 40, u16(0), shortstr(""), shortstr(queue), Buffer.from([0])));
+          const bodySize = Buffer.alloc(8);
+          bodySize.writeBigUInt64BE(BigInt(body.length), 0);
+          sock.write(frame(2, 1, Buffer.concat([u16(60), u16(0), bodySize, u16(0)]))); // content header, no properties
+          sock.write(frame(3, 1, body)); // content body
+
+          await new Promise((r) => setTimeout(r, 200));
+          lastBody = null;
+          sock.write(method(1, 60, 70, u16(0), shortstr(queue), Buffer.from([1]))); // Basic.Get, no-ack
+          await expect(60, 71); // Get-Ok (a Get-Empty would arrive as 60/72 and reject the expect)
+          await new Promise((r) => setTimeout(r, 200));
+          const received = lastBody ? (lastBody as Buffer).toString("utf8") : "";
+
+          sock.write(method(0, 10, 50, u16(200), shortstr("bye"), u16(0), u16(0))); // Connection.Close
+          await expect(10, 51).catch(() => undefined);
+          done = true;
+          sock.end();
+          resolve(received);
+        } catch (e) {
+          fail(e instanceof Error ? e : new Error(String(e)));
+        }
+      })();
+    });
+  });
+}
+
+function readMaybe(path: string | undefined): string {
+  if (!path) return "";
+  try {
+    return readFileSync(path, "utf8").replace(/\n$/, "");
+  } catch {
+    return "";
+  }
+}

modules/amqp-ping/index.ts

@@ -0,0 +1,53 @@
+// amqp-ping — a tiny demo consumer of the mesh `amqp` interface, run as a long-lived container by
+// `mesh-tools run` (it never returns, so the container stays up). It exists to PROVE the grant end to
+// end: the mesh gave it a scoped login and a vhost of that name on the lavinmq provider, and this
+// connects with exactly those and round-trips a message.
+//
+// The connection facts arrive the way every consumer's do — the mesh writes them into an env-file the
+// container reads (novox/hq ADR 0048): MESH_AMQP_HOST/PORT from the binding, MESH_AMQP_USER and
+// MESH_AMQP_VHOST both from `${bound:amqp:as}` (the provider named the vhost after the login, so the
+// consumer uses the login for both — the db-name lesson applied to AMQP), and MESH_AMQP_PASSWORD from
+// `${secret:amqp}`.
+//
+// It retries: on first boot the provider may not have provisioned this consumer yet (the reconcile is
+// asynchronous and cross-container), so a refused or unreachable connection is a "not yet", not a
+// failure — it waits and tries again until the round-trip succeeds, then holds the connection idle
+// and re-pings on a slow cadence so the container is a stable, running proof.
+
+import { connFromEnv, roundTrip } from "./client.js";
+
+async function sleep(ms: number): Promise<void> {
+  await new Promise((r) => setTimeout(r, ms));
+}
+
+async function pingOnce(): Promise<boolean> {
+  try {
+    const conn = connFromEnv();
+    const sent = `ping-${Date.now()}`;
+    const got = await roundTrip(conn, "amqp-ping", sent);
+    if (got === sent) {
+      console.log(`[amqp-ping] round-trip ok as ${conn.user} on vhost ${conn.vhost} (${conn.host}:${conn.port})`);
+      return true;
+    }
+    console.error(`[amqp-ping] round-trip mismatch: sent ${sent}, got ${got}`);
+    return false;
+  } catch (err) {
+    console.error(`[amqp-ping] not ready yet: ${err instanceof Error ? err.message : err}`);
+    return false;
+  }
+}
+
+// Wait for the first successful round-trip — the proof this consumer's grant works — then stay up.
+let first = false;
+for (let i = 0; !first; i++) {
+  first = await pingOnce();
+  if (!first) await sleep(3000);
+}
+console.log("[amqp-ping] connected and round-tripped; holding steady");
+for (;;) {
+  await sleep(30000);
+  await pingOnce();
+}
+// changed by the one-node test at build 66e54af151df
+// changed by the one-node test at build 4fb41636cffd
+// changed by the one-node test at build a69f083bf6a6

modules/amqp-ping/module.json

@@ -0,0 +1,89 @@
+{
+  "module": "amqp-ping",
+  "slug": "ping",
+  "version": "1",
+  "capabilities": [
+    "container-runtime"
+  ],
+  "requires": [
+    "amqp"
+  ],
+  "contributes": {},
+  "binds": {
+    "amqp": "/var/lib/amqp-ping/amqp.json"
+  },
+  "secrets": {
+    "amqp": "/var/lib/amqp-ping/amqp.secret"
+  },
+  "own-secrets": {
+    "broker": "/var/lib/mesh/amqp-ping/broker"
+  },
+  "resources": [
+    {
+      "id": "mesh-state",
+      "type": "directory",
+      "path": "/var/lib/mesh/amqp-ping",
+      "mode": "0700"
+    },
+    {
+      "id": "state",
+      "type": "directory",
+      "path": "/var/lib/amqp-ping",
+      "mode": "0700"
+    },
+    {
+      "id": "amqp-env",
+      "type": "file",
+      "path": "/var/lib/amqp-ping/amqp.env",
+      "mode": "0600",
+      "content": "MESH_AMQP_HOST=${bound:amqp:at}\nMESH_AMQP_PORT=${bound:amqp:port}\nMESH_AMQP_USER=${bound:amqp:as}\nMESH_AMQP_VHOST=${bound:amqp:as}\n"
+    },
+    {
+      "id": "net",
+      "type": "network",
+      "name": "amqp-ping"
+    },
+    {
+      "id": "runtime",
+      "type": "container",
+      "name": "amqp-ping",
+      "network": "amqp-ping",
+      "volumes": [
+        "/var/lib/mesh/amqp-ping/broker:/run/secrets/broker:ro",
+        "/var/lib/amqp-ping/amqp.secret:/run/secrets/amqp:ro"
+      ],
+      "env": {
+        "MESH_BROKER_FILE": "/run/secrets/broker",
+        "MESH_AMQP_PASSWORD_FILE": "/run/secrets/amqp"
+      },
+      "env-file": [
+        "/var/lib/amqp-ping/amqp.env"
+      ],
+      "restart-on": [
+        "amqp-env"
+      ],
+      "artifact": "runtime"
+    }
+  ],
+  "build": {
+    "on": [
+      {
+        "arg": "BUILD_BASE",
+        "module": "mesh-tools",
+        "artifact": "build"
+      },
+      {
+        "arg": "RUNTIME_BASE",
+        "module": "mesh-tools",
+        "artifact": "runtime"
+      }
+    ],
+    "artifacts": [
+      {
+        "name": "runtime",
+        "kind": "image",
+        "from": "Dockerfile"
+      }
+    ]
+  }
+}

modules/amqp-ping/package.json

@@ -0,0 +1,14 @@
+{
+  "name": "@novox/module-amqp-ping",
+  "version": "0.1.0",
+  "description": "amqp-ping — a demo consumer of the mesh amqp interface. Connects with its scoped grant and round-trips one message to prove the broker the mesh gave it (novox/hq ADR 0039).",
+  "type": "module",
+  "private": true,
+  "dependencies": {
+    "@novox/mesh-sdk": "^0.1.0"
+  },
+  "devDependencies": {
+    "@types/node": "^22.0.0",
+    "typescript": "^5.6.0"
+  }
+}

modules/amqp-ping/tsconfig.json

@@ -0,0 +1,12 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "NodeNext",
+    "moduleResolution": "NodeNext",
+    "strict": true,
+    "esModuleInterop": true,
+    "skipLibCheck": true,
+    "noEmit": true
+  },
+  "include": ["client.ts", "index.ts"]
+}

modules/anthropic-consumer/module.json

@@ -18,7 +18,7 @@
     "broker": "/var/lib/mesh/anthropic-consumer/broker"
   },
   "emits": [
-    "usage.session"
+    "module.anthropic-consumer.usage.session"
   ],
   "resources": [
     {

modules/anthropic-consumer/usage/index.ts

@@ -123,7 +123,7 @@ async function emitUsage(body: Record<string, unknown>): Promise<void> {
   await new Promise<void>((resolve) => {
     const child = spawn(
       process.execPath,
-      [main, "emit", "usage.session", JSON.stringify(body)],
+      [main, "emit", "module.anthropic-consumer.usage.session", JSON.stringify(body)],
       { stdio: "inherit" },
     );
     child.on("exit", () => resolve());

modules/anthropic-manager/module.json

@@ -18,7 +18,7 @@
     "broker": "/var/lib/mesh/anthropic-manager/broker"
   },
   "emits": [
-    "usage.read"
+    "module.anthropic-manager.usage.read"
   ],
   "resources": [
     {

modules/anthropic-manager/refresh/index.ts

@@ -143,7 +143,7 @@ async function emitUsage(body: Record<string, unknown>): Promise<void> {
   const main = process.env.MESH_TOOLS_MAIN ?? "/app/dist/main.js";
   const { spawn } = await import("node:child_process");
   await new Promise<void>((resolve) => {
-    const child = spawn(process.execPath, [main, "emit", "usage.read", JSON.stringify(body)], {
+    const child = spawn(process.execPath, [main, "emit", "module.anthropic-manager.usage.read", JSON.stringify(body)], {
       stdio: "inherit",
     });
     child.on("exit", () => resolve());

modules/audit-logger/module.json

@@ -3,7 +3,7 @@
   "version": "1",
   "slug": "audit",
   "consumes": [
-    "**"
+    "#"
   ],
   "own-secrets": {
     "broker": "/var/lib/audit-logger/broker"

modules/audit-logger/test/audit.test.ts

@@ -15,16 +15,16 @@ test("audit-logger records every event to the trail as one line each", async ()
   const path = join(dir, "audit.log");
 
   // The audit-logger's whole behaviour: consume everything, record it.
-  await on("**", async (event) => record(event, path));
+  await on("#", async (event) => record(event, path));
 
   process.env.MESH_MODULE = "umami";
   process.env.MESH_NODE = "anchor";
-  await emit("site.created", { domain: "my-app" });
+  await emit("module.umami.site.created", { domain: "my-app" });
   await emit("node.anchor.joined", { role: "worker" }); // a node event, not a module one
 
   const lines = (await readFile(path, "utf8")).trim().split("\n").map((l) => JSON.parse(l));
   assert.equal(lines.length, 2);
-  assert.deepEqual(lines.map((l) => l.type), ["umami.site.created", "node.anchor.joined"]);
+  assert.deepEqual(lines.map((l) => l.type), ["module.umami.site.created", "node.anchor.joined"]);
   assert.equal(lines[0].source, "umami");
   assert.equal(lines[0].node, "anchor");
   assert.equal(lines[0].body.domain, "my-app");

modules/baserow/module.json

@@ -14,7 +14,7 @@
     },
     "route": {
       "label": "baserow",
-      "endpoint": "web"
+      "port": 80
     }
   },
   "binds": {
@@ -30,7 +30,6 @@
   },
   "listens": [
     {
-      "name": "web",
       "port": 80,
       "protocol": "tcp",
       "from": "mesh",

modules/bazarr/index.ts

@@ -24,7 +24,7 @@ async function pollHistory(): Promise<void> {
   for (const entry of entries) {
     if (seen.has(entry.id)) continue;
     if (primed) {
-      await emit("subtitle.downloaded", {
+      await emit("module.bazarr.subtitle.downloaded", {
         kind: entry.kind,
         title: entry.title,
         language: entry.language,

modules/bazarr/module.json

@@ -5,7 +5,7 @@
     "container-runtime"
   ],
   "emits": [
-    "subtitle.downloaded"
+    "module.bazarr.subtitle.downloaded"
   ],
   "own-secrets": {
     "broker": "/var/lib/mesh/bazarr/broker",
@@ -13,7 +13,6 @@
   },
   "listens": [
     {
-      "name": "web",
       "port": 6767,
       "protocol": "tcp",
       "from": "mesh",
@@ -94,7 +93,7 @@
       ],
       "env": {
         "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_BAZARR_URL": "http://127.0.0.1:${port:6767}",
+        "MESH_BAZARR_URL": "http://127.0.0.1:6767",
         "MESH_BAZARR_API_KEY_FILE": "/run/secrets/api-key",
         "MESH_BAZARR_CONFIG_FILE": "/run/config/config.json",
         "MESH_BAZARR_CONFIG_DIR": "/var/lib/bazarr/config"
@@ -111,7 +110,7 @@
   "contributes": {
     "route": {
       "label": "subs",
-      "endpoint": "web"
+      "port": 6767
     }
   },
   "binds": {

modules/bookshelf/index.ts

@@ -45,12 +45,12 @@ async function pollQueue(bookshelf: BookshelfClient): Promise<void> {
   if (primed) {
     // Entered the queue since last look — Bookshelf grabbed a release.
     for (const [id, item] of now) {
-      if (!inQueue.has(id)) await emit("book.grabbed", { title: item.title, status: item.status });
+      if (!inQueue.has(id)) await emit("module.bookshelf.book.grabbed", { title: item.title, status: item.status });
     }
     // Left the queue — imported and done, unless it was last seen failing.
     for (const [id, item] of inQueue) {
       if (!now.has(id) && !FAILED_STATUSES.has(item.status)) {
-        await emit("download.completed", { title: item.title });
+        await emit("module.bookshelf.download.completed", { title: item.title });
       }
     }
   }

modules/bookshelf/module.json

@@ -6,8 +6,8 @@
     "container-runtime"
   ],
   "emits": [
-    "book.grabbed",
-    "download.completed"
+    "module.bookshelf.book.grabbed",
+    "module.bookshelf.download.completed"
   ],
   "consumes": [],
   "own-secrets": {
@@ -15,7 +15,6 @@
   },
   "listens": [
     {
-      "name": "web",
       "port": 8787,
       "protocol": "tcp",
       "from": "mesh",
@@ -76,7 +75,7 @@
       ],
       "env": {
         "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_BOOKSHELF_URL": "http://127.0.0.1:${port:8787}",
+        "MESH_BOOKSHELF_URL": "http://127.0.0.1:8787",
         "MESH_BOOKSHELF_CONFIG_DIR": "/var/lib/bookshelf/config"
       },
       "artifact": "runtime"
@@ -88,7 +87,7 @@
   "contributes": {
     "route": {
       "label": "books",
-      "endpoint": "web"
+      "port": 8787
     }
   },
   "binds": {

modules/builder/module.json

@@ -20,6 +20,9 @@
   "secrets": {
     "npm-package-registry": "/var/lib/mesh/builder/package-registry.secret"
   },
+  "emits": [
+    "module.builder.built"
+  ],
   "own-secrets": {
     "broker": "/var/lib/mesh/builder/broker"
   },
@@ -77,7 +80,7 @@
     "on": [
       {
         "arg": "GO_BASE",
-        "image": "golang@sha256:8ac98ca534ac3f51e1f420a1dd2c15e74c75cfa0f23f3ad27eb5d7236c349a0c"
+        "image": "golang@sha256:1ae0735f00daffa3aaf1363a5184c0d2dc55c78e3db4ec70241cdac97bf84b59"
       },
       {
         "arg": "ALPINE_BASE",

modules/ca-trust/module.json

@@ -1,56 +0,0 @@
-{
-  "module": "ca-trust",
-  "version": "1",
-  "slug": "catrust",
-  "capabilities": [
-    "service-manager"
-  ],
-  "requires": [
-    "internal-acme-ca"
-  ],
-  "seats": [
-    {
-      "name": "the-mesh-trust-anchor",
-      "scope": "node"
-    }
-  ],
-  "claims": [
-    {
-      "name": "the-mesh-trust-anchor",
-      "scope": "node"
-    }
-  ],
-  "resources": [
-    {
-      "id": "state",
-      "type": "directory",
-      "mode": "0700",
-      "place": "."
-    },
-    {
-      "id": "anchor",
-      "type": "file",
-      "path": "${dir:state}/anchor",
-      "mode": "0755",
-      "content": "#!/bin/sh\n# The mesh's internal certificate authority, trusted by this machine.\n#\n# Written by the mesh from the ca-trust module's manifest (novox/hq ADR 0147).\n# Editing it here lasts until the next apply.\n#\n# There is no prior trust to verify the fetch against \u2014 this is the thing that\n# establishes it \u2014 so it is made over the mesh's own private network, which is\n# what authenticates it (novox/hq ADR 0098, the same reasoning that lets the\n# route proxy fetch this root for itself). What comes back is checked here: a\n# body that is not a certificate is refused now, rather than believed and then\n# failed by whatever reads the trust store next.\nset -eu\n\nROOTS='https://${bound:internal-acme-ca:at}:${bound:internal-acme-ca:port}${bound:internal-acme-ca:roots}'\nANCHORS=/etc/ca-certificates/trust-source/anchors\nANCHOR=\"$ANCHORS/mesh-internal-ca.crt\"\n\n# Arch's layout, said out loud rather than assumed: a machine that keeps its\n# anchors elsewhere fails here, visibly, instead of writing a file nothing\n# reads. That failure is the signal that this belongs in the host, where one\n# operating system's difference lives (novox/hq ADR 0147, option 2).\n[ -d \"$ANCHORS\" ] || {\n\techo \"this machine keeps no trust anchors in $ANCHORS; ca-trust is written for that layout\" >&2\n\texit 1\n}\n\ncase \"${1:-}\" in\ninstall)\n\ttmp=$(mktemp)\n\ttrap 'rm -f \"$tmp\"' EXIT\n\t# The authority may still be starting, or this machine may have come up\n\t# before it: two minutes of asking, then an honest failure.\n\tn=0\n\twhile [ \"$n\" -lt 60 ]; do\n\t\tif curl --fail --silent --show-error --insecure --max-time 10 \\\n\t\t\t--output \"$tmp\" \"$ROOTS\" &&\n\t\t\tgrep -q 'BEGIN CERTIFICATE' \"$tmp\"; then\n\t\t\tinstall -m 0644 \"$tmp\" \"$ANCHOR\"\n\t\t\tupdate-ca-trust\n\t\t\texit 0\n\t\tfi\n\t\tn=$((n + 1))\n\t\tsleep 2\n\tdone\n\techo \"the authority at $ROOTS did not serve a certificate within two minutes\" >&2\n\texit 1\n\t;;\nremove)\n\t# What stopping the unit does, and therefore what being unassigned does.\n\trm -f \"$ANCHOR\"\n\tupdate-ca-trust\n\t;;\n*)\n\techo \"usage: $(basename \"$0\") install|remove\" >&2\n\texit 2\n\t;;\nesac\n"
-    },
-    {
-      "id": "unit",
-      "type": "file",
-      "path": "/etc/systemd/system/mesh-ca-trust.service",
-      "mode": "0644",
-      "content": "[Unit]\nDescription=The mesh's internal certificate authority, trusted by this machine\n# novox/hq ADR 0147. Starting this unit places the mesh's root among this\n# machine's trust anchors; stopping it takes the root away again, which is what\n# the host does when the module is no longer assigned here.\nWants=network-online.target\nAfter=network-online.target\n\n[Service]\nType=oneshot\nRemainAfterExit=yes\nExecStart=${dir:state}/anchor install\nExecStop=${dir:state}/anchor remove\n\n[Install]\nWantedBy=multi-user.target\n"
-    },
-    {
-      "id": "trust",
-      "type": "service",
-      "unit": "mesh-ca-trust.service",
-      "state": "running",
-      "boot": "enabled",
-      "restart-on": [
-        "anchor",
-        "unit"
-      ]
-    }
-  ]
-}

modules/cloudflare-dns/module.json

@@ -22,8 +22,8 @@
     "broker": "/var/lib/mesh/cloudflare-dns/broker"
   },
   "emits": [
-    "record.created",
-    "record.removed"
+    "module.cloudflare-dns.record.created",
+    "module.cloudflare-dns.record.removed"
   ],
   "resources": [
     {

modules/cloudflare-dns/provisioner/index.ts

@@ -20,7 +20,7 @@ runProvisioner("public-dns", {
   async create(p: Provision): Promise<void> {
     const fqdn = cloudflare.nameFor(p.as);
     await cloudflare.upsert(fqdn);
-    await announce("record.created", {
+    await announce("module.cloudflare-dns.record.created", {
       name: fqdn,
       target: cloudflare.ingress,
       consumer: p.consumer ?? "",
@@ -30,7 +30,7 @@ runProvisioner("public-dns", {
   async remove(p: { as: string }): Promise<void> {
     const fqdn = cloudflare.nameFor(p.as);
     await cloudflare.remove(fqdn);
-    await announce("record.removed", { name: fqdn, consumer: p.as });
+    await announce("module.cloudflare-dns.record.removed", { name: fqdn, consumer: p.as });
   },
 });
 

modules/de-spiegel/module.json

@@ -11,7 +11,7 @@
   "contributes": {
     "route": {
       "label": "de-spiegel",
-      "endpoint": "web"
+      "port": 35621
     }
   },
   "binds": {
@@ -23,7 +23,6 @@
   },
   "listens": [
     {
-      "name": "web",
       "port": 35621,
       "protocol": "tcp",
       "from": "mesh",

modules/distribution/index.ts

@@ -33,7 +33,7 @@ async function pollCatalog(): Promise<void> {
     for (const tag of tags) {
       const id = `${repo}:${tag}`;
       if (!seen.has(id)) {
-        if (primed) await emit("image.pushed", { repo, tag });
+        if (primed) await emit("module.registry.image.pushed", { repo, tag });
         seen.add(id);
       }
     }

modules/distribution/module.json

@@ -17,7 +17,7 @@
     "container-runtime"
   ],
   "emits": [
-    "image.pushed"
+    "module.registry.image.pushed"
   ],
   "own-secrets": {
     "broker": "/var/lib/mesh/registry/broker"
@@ -29,7 +29,6 @@
   },
   "listens": [
     {
-      "name": "registry",
       "port": 5000,
       "protocol": "tcp",
       "from": "mesh",

modules/dnsmasq/index.ts

@@ -20,10 +20,10 @@ async function poll(): Promise<void> {
   const now = new Map((await dnsmasq.answeredNames()).map((a) => [a.name, a.address]));
   if (primed) {
     for (const [name, address] of now) {
-      if (!known.has(name)) await emit("name.added", { name, address });
+      if (!known.has(name)) await emit("module.dnsmasq.name.added", { name, address });
     }
     for (const [name] of known) {
-      if (!now.has(name)) await emit("name.removed", { name });
+      if (!now.has(name)) await emit("module.dnsmasq.name.removed", { name });
     }
   }
   known.clear();

modules/dnsmasq/module.json

@@ -8,8 +8,8 @@
     "mesh-addressing"
   ],
   "emits": [
-    "name.added",
-    "name.removed"
+    "module.dnsmasq.name.added",
+    "module.dnsmasq.name.removed"
   ],
   "own-secrets": {
     "broker": "/var/lib/mesh/dnsmasq/broker"
@@ -22,20 +22,11 @@
   ],
   "listens": [
     {
-      "name": "dns-udp",
       "port": 53,
       "protocol": "udp",
       "from": "mesh",
       "why": "every name for this machine and what it runs \u2014 the mesh's own answered here, the rest forwarded",
       "fixed": true
-    },
-    {
-      "name": "dns-tcp",
-      "port": 53,
-      "protocol": "tcp",
-      "from": "mesh",
-      "why": "the same names over tcp, which a resolver answers on as well and is asked for whenever an answer will not fit in a datagram. Declared because the daemon serves it: a declaration that covers one of the two protocols its own service listens on leaves the other closed while everything reports success",
-      "fixed": true
     }
   ],
   "resources": [

modules/fail2ban/module.json

@@ -33,7 +33,7 @@
       "type": "file",
       "path": "/etc/fail2ban/jail.local",
       "mode": "0644",
-      "content": "[INCLUDES]\n\nbefore = paths-arch.conf\n\n[DEFAULT]\n\n# Never act on the machine itself or on a tunnel peer: the mesh's private range is\n# ${machine:mesh-range}, named here rather than written as a value the module cannot\n# know (novox/hq ADR 0112). Without this, fail2ban could ban the mesh's own nodes.\nignoreip = 127.0.0.1/8 ::1 ${machine:mesh-range}\n\nbantime  = 10m\nfindtime = 10m\nmaxretry = 5\n\n# Ban through iptables, not through a firewall front-end the machine may not have. ufw is\n# installed on two of this mesh's machines and absent on the other two, and fail2ban finds out\n# only at ban time: the service reports healthy, the jail counts the attempt, the ban command\n# exits 127, and nothing is blocked. Proven on 2026-09-28 -- 'ufw: command not found' on a\n# machine the mesh reported as protected.\n#\n# The action below is this module's own, already used by the recidive jail on every machine\n# here, and it bans in DOCKER-USER as well as INPUT, so a container's published port is\n# covered too.\nbanaction = iptables-allports-dualchain\nbanaction_allports = iptables-allports-dualchain\n\n[sshd]\nenabled = true\nport    = ssh\nlogpath = %(sshd_log)s\nbackend = %(sshd_backend)s\n"
+      "content": "[INCLUDES]\n\nbefore = paths-arch.conf\n\n[DEFAULT]\n\n# Never act on the machine itself or on a tunnel peer: the mesh's private range is\n# ${machine:mesh-range}, named here rather than written as a value the module cannot\n# know (novox/hq ADR 0112). Without this, fail2ban could ban the mesh's own nodes.\nignoreip = 127.0.0.1/8 ::1 ${machine:mesh-range}\n\nbantime  = 10m\nfindtime = 10m\nmaxretry = 5\n\nbanaction = ufw\nbanaction_allports = iptables-allports\n\n[sshd]\nenabled = true\nport    = ssh\nlogpath = %(sshd_log)s\nbackend = %(sshd_backend)s\n"
     },
     {
       "id": "jail-sshd",
@@ -42,14 +42,6 @@
       "mode": "0644",
       "content": "[sshd]\nenabled = true\nport    = ssh\nlogpath = %(sshd_log)s\nbackend = %(sshd_backend)s\nmaxretry = 5\n"
     },
-    {
-      "id": "log",
-      "type": "file",
-      "path": "/var/log/fail2ban.log",
-      "mode": "0640",
-      "create-once": true,
-      "content": ""
-    },
     {
       "id": "jail-recidive",
       "type": "file",

modules/gitea/client.ts

@@ -9,8 +9,6 @@ import { ConfiguredToken, MintedToken, type TokenSource } from "./token.js";
 /** A repository, trimmed to what the mesh cares about. */
 export interface GiteaRepo {
   full_name: string;
-  /** The URL a build clones — what a module records as its source. */
-  clone_url?: string;
   name: string;
   owner: string;
   private: boolean;
@@ -36,9 +34,6 @@ export interface GiteaPull {
   title: string;
   state: string;
   merged: boolean;
-  /** The commit the merge produced — what a build of the base branch is made from. */
-  merge_commit_sha?: string;
-  merged_at?: string;
   user?: string;
   head?: string;
   base?: string;
@@ -121,23 +116,9 @@ export class GiteaClient {
 
   // ---- Repositories ----
 
-  /** Every repository this token can see, one page. `/user/repos` is only what the token's own
-   *  user owns — for the mesh's administrator that is nothing, which is how the forge watched an
-   *  empty list and announced no merge (2026-09-28). The search endpoint is the forge's whole view. */
   async listRepos(page = 1, limit = 20): Promise<GiteaRepo[]> {
-    const found = await this.request<{ data?: any[] }>(`/repos/search?page=${page}&limit=${limit}`);
-    return (found?.data ?? []).map(GiteaClient.mapRepo);
-  }
-
-  /** Every repository, all pages. */
-  async listAllRepos(): Promise<GiteaRepo[]> {
-    const all: GiteaRepo[] = [];
-    for (let page = 1; page < 100; page++) {
-      const batch = await this.listRepos(page, 50);
-      all.push(...batch);
-      if (batch.length < 50) break;
-    }
-    return all;
+    const repos = await this.request<any[]>(`/user/repos?page=${page}&limit=${limit}`);
+    return (repos ?? []).map(GiteaClient.mapRepo);
   }
 
   async createRepo(data: {
@@ -229,17 +210,6 @@ export class GiteaClient {
     return GiteaClient.mapPull(await this.request<any>(`/repos/${owner}/${repo}/pulls/${index}`));
   }
 
-  /** The files a merged pull request changed, as paths from the repository's root.
-   *
-   *  `limit` is what is asked for, and a merge that changed more says so rather than being read
-   *  page by page: what the mesh does with a partial list is treat the whole repository as changed,
-   *  so more pages would buy nothing. */
-  async listPullFiles(owner: string, repo: string, index: number, limit = 100): Promise<{ paths: string[]; truncated: boolean }> {
-    const files = await this.request<any[]>(`/repos/${owner}/${repo}/pulls/${index}/files?limit=${limit}`);
-    const paths = (files ?? []).map((f) => String(f?.filename ?? "")).filter((p) => p !== "");
-    return { paths, truncated: paths.length >= limit };
-  }
-
   async createPullRequest(
     owner: string,
     repo: string,
@@ -262,7 +232,6 @@ export class GiteaClient {
   private static mapRepo(r: any): GiteaRepo {
     return {
       full_name: r.full_name,
-      clone_url: r.clone_url ?? undefined,
       name: r.name,
       owner: r.owner?.login ?? r.full_name?.split("/")[0] ?? "unknown",
       private: Boolean(r.private),
@@ -290,8 +259,6 @@ export class GiteaClient {
       title: p.title,
       state: p.state,
       merged: Boolean(p.merged),
-      merge_commit_sha: p.merge_commit_sha ?? undefined,
-      merged_at: p.merged_at ?? undefined,
       user: p.user?.login,
       head: p.head?.ref,
       base: p.base?.ref,

modules/gitea/index.ts

@@ -31,11 +31,11 @@ try {
 const seen = new Set<string>();
 let primed = false;
 async function pollRepos(client: GiteaClient): Promise<void> {
-  const repos = await client.listAllRepos();
+  const repos = await client.listRepos(1, 50);
   for (const repo of repos) {
     if (!seen.has(repo.full_name)) {
       if (primed) {
-        await emit("repo.created", {
+        await emit("module.gitea.repo.created", {
           full_name: repo.full_name,
           owner: repo.owner,
           name: repo.name,
@@ -49,83 +49,6 @@ async function pollRepos(client: GiteaClient): Promise<void> {
   primed = true;
 }
 
-// **A merge is announced whoever made it.** The merge tool below emits at the instant it acts; a
-// merge made in the forge's own pages or over its API would emit nothing, and the mesh would go on
-// believing every module current with its source (novox/hq 04-ISSUES/131). So merged pull requests
-// are watched the way repositories are: what the forge holds, asked for on a tick, announced once.
-// What has been announced is kept beside the module's state, so a restart does not announce the
-// whole history again — and the first tick on a machine with no record announces nothing, because
-// everything it sees then predates the watching.
-import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
-import { join } from "node:path";
-const mergedRecord = process.env.MESH_GITEA_STATE_DIR ? join(process.env.MESH_GITEA_STATE_DIR, "merged-announced.json") : null;
-const announced = new Set<string>();
-let primedMerges = false;
-// since is the moment the watching began: a merge made before it is history, whatever page of the
-// forge's listing it surfaces on. Without it, an old merge past the first page — pushed into view
-// as newer pull requests were updated — was announced as if it had just happened, and the mesh
-// rebuilt everything built from that repository, once per old merge (2026-09-28).
-let since = "";
-if (mergedRecord && existsSync(mergedRecord)) {
-  try {
-    const kept = JSON.parse(readFileSync(mergedRecord, "utf8")) as string[] | { announced: string[]; since: string };
-    const list = Array.isArray(kept) ? kept : kept.announced;
-    for (const sha of list) announced.add(sha);
-    since = Array.isArray(kept) ? new Date().toISOString() : kept.since;
-    primedMerges = true;
-  } catch {
-    // An unreadable record is treated as no record: prime again rather than re-announce history.
-  }
-}
-function keepAnnounced(): void {
-  if (!mergedRecord) return;
-  mkdirSync(join(mergedRecord, ".."), { recursive: true });
-  const tmp = mergedRecord + ".tmp";
-  writeFileSync(tmp, JSON.stringify({ announced: [...announced].slice(-2000), since }));
-  renameSync(tmp, mergedRecord);
-}
-async function pollMerged(client: GiteaClient): Promise<void> {
-  const repos = await client.listAllRepos();
-  let changed = false;
-  for (const repo of repos) {
-    const pulls = await client.listPullRequests(repo.owner, repo.name, { state: "closed", sort: "recentupdate", limit: "20" });
-    for (const pull of pulls) {
-      if (!pull.merged || !pull.merge_commit_sha || announced.has(pull.merge_commit_sha)) continue;
-      // Announced only if merged since the watching began; recorded either way, so it is looked
-      // at once.
-      const fresh = !!pull.merged_at && !!since && pull.merged_at > since;
-      if (primedMerges && fresh) {
-        // What it changed, asked for only now: a module is rebuilt because a file inside its own
-        // directory moved, and without this every module built from a repository is rebuilt for a
-        // change to any of them (novox/hq 04-ISSUES/131).
-        const changed = await client.listPullFiles(repo.owner, repo.name, pull.number);
-        await emit("pull.merged", {
-          owner: repo.owner,
-          repo: repo.name,
-          number: pull.number,
-          title: pull.title,
-          head: pull.head,
-          base: pull.base,
-          merge_commit_sha: pull.merge_commit_sha,
-          merged_at: pull.merged_at,
-          clone_url: repo.clone_url,
-          html_url: pull.html_url,
-          paths: changed.paths,
-          paths_truncated: changed.truncated,
-        });
-        // Said, because a trigger that fires silently is indistinguishable from one that did not
-        // fire (novox/hq 04-ISSUES/131) — this line is how an operator knows the mesh was told.
-        console.log(`[gitea] announced merge ${repo.full_name}#${pull.number} (${pull.merge_commit_sha.slice(0, 8)}) into ${pull.base}`);
-      }
-      announced.add(pull.merge_commit_sha);
-      changed = true;
-    }
-  }
-  if (!primedMerges) since = new Date().toISOString();
-  if (!primedMerges || changed) keepAnnounced();
-  primedMerges = true;
-}
-
 if (gitea) {
   const client = gitea;
   // A poll that fails says so once, not once a minute: the same reason repeating (the forge not up
@@ -147,6 +70,5 @@ if (gitea) {
     run();
   };
   tick(() => pollRepos(client), 60_000);
-  tick(() => pollMerged(client), 30_000);
-  console.log("[gitea] watching for new repositories and merged pull requests");
+  console.log("[gitea] watching for new repositories");
 }

modules/gitea/module.json

@@ -13,7 +13,7 @@
     "route": {
       "web": {
         "label": "git",
-        "endpoint": "web"
+        "port": 3000
       },
       "internal-api-refused": {
         "label": "git",
@@ -38,20 +38,18 @@
     "container-runtime"
   ],
   "emits": [
-    "repo.created",
-    "issue.opened",
-    "pull.merged"
+    "module.gitea.repo.created",
+    "module.gitea.issue.opened",
+    "module.gitea.pull.merged"
   ],
   "listens": [
     {
-      "name": "web",
       "port": 3000,
       "protocol": "tcp",
       "from": "mesh",
       "why": "the forge, over http"
     },
     {
-      "name": "ssh",
       "port": 22,
       "protocol": "tcp",
       "from": "mesh",

modules/gitea/tools/index.ts

@@ -124,7 +124,7 @@ export function getGiteaTools(gitea: GiteaClient): ToolDefinition[] {
           labels: labelIds,
         });
         // The mesh just opened an issue — announce it the moment it exists.
-        await emit("issue.opened", {
+        await emit("module.gitea.issue.opened", {
           owner,
           repo,
           number: issue.number,
@@ -231,24 +231,15 @@ export function getGiteaTools(gitea: GiteaClient): ToolDefinition[] {
         // Read the PR first, so the merged event carries a title and branches, not just a number.
         const pull = await gitea.getPullRequest(owner, repo, number);
         await gitea.mergePullRequest(owner, repo, number, method, deleteBranch);
-        // Read it again: the merge commit only exists now, and it is what a build is made from.
-        const merged = await gitea.getPullRequest(owner, repo, number);
-        // And what it changed, so the mesh rebuilds the modules whose own files moved rather than
-        // every module built from the repository (novox/hq 04-ISSUES/131).
-        const changed = await gitea.listPullFiles(owner, repo, number);
-        await emit("pull.merged", {
+        await emit("module.gitea.pull.merged", {
           owner,
           repo,
           number,
           title: pull.title,
           head: pull.head,
           base: pull.base,
-          merge_commit_sha: merged.merge_commit_sha,
-          merged_at: merged.merged_at,
           method,
           html_url: pull.html_url,
-          paths: changed.paths,
-          paths_truncated: changed.truncated,
         });
         return { merged: true, number, method, deleted_branch: deleteBranch };
       },

modules/grafana/index.ts

@@ -40,7 +40,7 @@ async function pollAlerts(client: GrafanaClient): Promise<void> {
     for (const key of now) {
       if (!firing.has(key)) {
         const a = byKey.get(key)!;
-        await emit("alert.firing", { name: a.name, labels: a.labels, activeAt: a.activeAt });
+        await emit("module.grafana.alert.firing", { name: a.name, labels: a.labels, activeAt: a.activeAt });
       }
     }
   }

modules/grafana/module.json

@@ -2,7 +2,7 @@
   "module": "grafana",
   "version": "1",
   "emits": [
-    "alert.firing"
+    "module.grafana.alert.firing"
   ],
   "own-secrets": {
     "admin": "/var/lib/grafana-module/admin.secret",
@@ -13,7 +13,6 @@
   ],
   "listens": [
     {
-      "name": "web",
       "port": 3000,
       "protocol": "tcp",
       "from": "mesh",
@@ -97,7 +96,7 @@
   "contributes": {
     "route": {
       "label": "grafana",
-      "endpoint": "web"
+      "port": 3000
     }
   },
   "binds": {

modules/hello-web/module.json

@@ -11,7 +11,7 @@
   "contributes": {
     "route": {
       "label": "hello",
-      "endpoint": "web"
+      "port": 8080
     }
   },
   "binds": {
@@ -19,7 +19,6 @@
   },
   "listens": [
     {
-      "name": "web",
       "port": 8080,
       "protocol": "tcp",
       "from": "mesh",

modules/home-assistant/index.ts

@@ -44,7 +44,7 @@ async function pollStates(): Promise<void> {
   for (const s of states) {
     const prev = lastState.get(s.entity_id);
     if (primed && prev !== undefined && prev !== s.state) {
-      await emit("state.changed", {
+      await emit("module.home-assistant.state.changed", {
         entity: s.entity_id,
         name: nameOf(s),
         from: prev,

modules/home-assistant/module.json

@@ -6,7 +6,7 @@
     "container-runtime"
   ],
   "emits": [
-    "state.changed"
+    "module.home-assistant.state.changed"
   ],
   "own-secrets": {
     "broker": "/var/lib/mesh/home-assistant/broker",
@@ -14,7 +14,6 @@
   },
   "listens": [
     {
-      "name": "web",
       "port": 8123,
       "protocol": "tcp",
       "from": "mesh",
@@ -86,7 +85,7 @@
   "contributes": {
     "route": {
       "label": "home-assistant",
-      "endpoint": "web"
+      "port": 8123
     }
   },
   "binds": {

modules/icecast/index.ts

@@ -23,7 +23,7 @@ async function pollMounts(): Promise<void> {
   if (primed) {
     for (const [mount, m] of now) {
       if (!live.has(mount)) {
-        await emit("stream.started", {
+        await emit("module.icecast.stream.started", {
           mount,
           name: m.name,
           description: m.description,
@@ -33,7 +33,7 @@ async function pollMounts(): Promise<void> {
     }
     for (const [mount, m] of live) {
       if (!now.has(mount)) {
-        await emit("stream.stopped", { mount, name: m.name });
+        await emit("module.icecast.stream.stopped", { mount, name: m.name });
       }
     }
   }

modules/icecast/module.json

@@ -5,15 +5,14 @@
     "container-runtime"
   ],
   "emits": [
-    "stream.started",
-    "stream.stopped"
+    "module.icecast.stream.started",
+    "module.icecast.stream.stopped"
   ],
   "own-secrets": {
     "broker": "/var/lib/mesh/icecast/broker"
   },
   "listens": [
     {
-      "name": "stream",
       "port": 8000,
       "protocol": "tcp",
       "from": "mesh",

modules/influxdb/module.json

@@ -9,7 +9,6 @@
   },
   "listens": [
     {
-      "name": "api",
       "port": 8086,
       "protocol": "tcp",
       "from": "mesh",

modules/invoicing/module.json

@@ -17,11 +17,11 @@
     "route": {
       "site": {
         "label": "invoicing",
-        "endpoint": "web"
+        "port": 80
       },
       "api": {
         "label": "invoicing-api",
-        "endpoint": "api"
+        "port": 9000
       }
     }
   },
@@ -36,14 +36,12 @@
   },
   "listens": [
     {
-      "name": "web",
       "port": 80,
       "protocol": "tcp",
       "from": "mesh",
       "why": "the invoicing web frontend; a public name is a route grant later"
     },
     {
-      "name": "api",
       "port": 9000,
       "protocol": "tcp",
       "from": "mesh",

modules/jackett/module.json

@@ -6,7 +6,6 @@
   ],
   "listens": [
     {
-      "name": "web",
       "port": 9117,
       "protocol": "tcp",
       "from": "mesh",
@@ -83,7 +82,7 @@
   "contributes": {
     "route": {
       "label": "indexers",
-      "endpoint": "web"
+      "port": 9117
     }
   },
   "binds": {

modules/keycloak/index.ts

@@ -28,17 +28,17 @@ async function announce(type: string, body: Record<string, unknown>): Promise<vo
 
 export const events = {
   userCreated: (realm: string, username: string, email?: string) =>
-    announce("user.created", { realm, username, ...(email ? { email } : {}) }),
+    announce("module.keycloak.user.created", { realm, username, ...(email ? { email } : {}) }),
   userDeleted: (realm: string, userId: string) =>
-    announce("user.deleted", { realm, userId }),
+    announce("module.keycloak.user.deleted", { realm, userId }),
   passwordReset: (realm: string, userId: string) =>
-    announce("password.reset", { realm, userId }),
+    announce("module.keycloak.password.reset", { realm, userId }),
   clientCreated: (realm: string, clientId: string, name?: string) =>
-    announce("client.created", { realm, clientId, ...(name ? { name } : {}) }),
+    announce("module.keycloak.client.created", { realm, clientId, ...(name ? { name } : {}) }),
   groupCreated: (realm: string, name: string) =>
-    announce("group.created", { realm, name }),
+    announce("module.keycloak.group.created", { realm, name }),
   roleCreated: (realm: string, name: string) =>
-    announce("role.created", { realm, name }),
+    announce("module.keycloak.role.created", { realm, name }),
 };
 
 console.log("[keycloak] event surface ready — identity, client, group and role changes are announced");

modules/keycloak/module.json

@@ -11,7 +11,7 @@
     },
     "route": {
       "label": "keycloak",
-      "endpoint": "web"
+      "port": 8080
     }
   },
   "binds": {
@@ -25,16 +25,15 @@
     "container-runtime"
   ],
   "emits": [
-    "user.created",
-    "user.deleted",
-    "password.reset",
-    "client.created",
-    "group.created",
-    "role.created"
+    "module.keycloak.user.created",
+    "module.keycloak.user.deleted",
+    "module.keycloak.password.reset",
+    "module.keycloak.client.created",
+    "module.keycloak.group.created",
+    "module.keycloak.role.created"
   ],
   "listens": [
     {
-      "name": "web",
       "port": 8080,
       "protocol": "tcp",
       "from": "mesh",

modules/lavinmq/Dockerfile

@@ -0,0 +1,42 @@
+# lavinmq's runtime: the tool runtime, carrying this module's compiled bootstrap, provisioner,
+# tools and event consumer.
+#
+# **Built from this module's own directory and nothing else.** The sdk is in the base image, so
+# nothing is copied out of a neighbouring checkout — which is what lets the mesh build this from a
+# repository and a path (novox/hq ADR 0069) rather than only on a workstation that happens to have
+# the siblings.
+#
+# Two bases, named rather than pinned: the image this is COMPILED in, and the image it RUNS in.
+# They are different images on purpose — the first carries a compiler and the second must not, or
+# every running container would carry one it never invokes. The mesh answers both with the copies it
+# holds, because a fingerprint written here would name one particular copy and no other mesh has it
+# (novox/hq issue 044). Declared in module.json's `build.on`; deliberately no defaults, so a build
+# nobody told stops here and says which module to build first.
+ARG BUILD_BASE
+ARG RUNTIME_BASE
+
+FROM ${BUILD_BASE} AS build
+# Compiled under /app/modules so `@novox/mesh-sdk` resolves upward into the base's own
+# node_modules — the module is compiled against exactly the sdk it will run against.
+WORKDIR /app/modules/lavinmq
+COPY . .
+# The compiler is invoked by its real path rather than through node_modules/.bin, whose entries are
+# symlinks to a launcher that requires its library relatively — resolved away when the base image
+# was assembled.
+#
+# Four entrypoints and a client, because this module is four things: a run-once bootstrap that
+# writes the broker's configuration before it first starts, a provisioner that grants consumers
+# their own vhost and user, a set of tools, and an event consumer.
+RUN node /app/node_modules/typescript/bin/tsc \
+      client.ts index.ts bootstrap/index.ts provisioner/index.ts tools/index.ts \
+      --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist
+
+FROM ${RUNTIME_BASE}
+COPY --from=build /app/modules/lavinmq/dist /app/modules/lavinmq/dist
+# What the runtime loads from this module in serve mode: its event consumer, its tools, and its
+# provisioner — all three in one process, so the provisioner's reconcile loop runs with the broker
+# connected (novox/hq issues 060/061; the provisioner used to be run as a separate container `args`
+# command, which meant it served no tools and, once, ran nowhere at all). The run-once bootstrap is
+# NOT listed here — it is named in its own container's `args`, because it runs to completion before
+# the broker starts rather than serving. One image, because they are one module and share a client.
+ENV MESH_TOOL_MODULES=/app/modules/lavinmq/dist/index.js,/app/modules/lavinmq/dist/tools/index.js,/app/modules/lavinmq/dist/provisioner/index.js

modules/lavinmq/bootstrap/index.ts

@@ -0,0 +1,45 @@
+// lavinmq's run-once bootstrap — lavinmq's own code (novox/hq ADR 0039), run once before the broker
+// first starts (ADR 0052). lavinmq's default admin is set at first boot from a config file's
+// `default_password_hash`, and that value is a HASH of the mesh-minted admin password, not the
+// password itself — a form the mesh's plain-secret delivery cannot produce and no `${secret:...}`
+// placeholder can compute. So this step computes it: it reads the admin password the mesh minted and
+// the host unsealed, hashes it the way lavinmq expects (see client.rabbitHash), and writes the config
+// file the broker container reads with `--config`. The host runs it to completion and only then
+// starts the broker the manifest places after it — so the broker's first boot finds a config with an
+// admin it can authenticate, and the provisioner (which reaches the management API as that admin)
+// can do its work.
+//
+// It runs in the module's own runtime image, under the module's own account, as `mesh-tools run`
+// imports it — no broker connection, because writing a config file is an offline operation and there
+// is no broker to reach yet.
+//
+// lavinmq consults `default_user`/`default_password_hash` only on a first boot with an empty data
+// dir; a later boot uses the persisted user database and ignores them. So this seeds the admin once,
+// and a rotation of the admin secret does not re-key an already-initialised broker — the same
+// first-boot-only shape the RabbitMQ-compatible default user has always had.
+
+import { writeFileSync } from "node:fs";
+import { readFileSync } from "node:fs";
+import { rabbitHash } from "../client.js";
+
+const adminUser = process.env.MESH_PROVISION_ADMIN_USER ?? process.env.MESH_LAVINMQ_ADMIN_USER ?? "mesh-admin";
+const passwordFile = process.env.MESH_PROVISION_PASSWORD_FILE ?? process.env.MESH_LAVINMQ_ADMIN_PASSWORD_FILE ?? "/run/secrets/default";
+const configOut = process.env.MESH_LAVINMQ_CONFIG_OUT ?? "/var/lib/lavinmq-module/lavinmq.ini";
+const dataDir = process.env.MESH_LAVINMQ_DATA_DIR ?? "/var/lib/lavinmq";
+
+const password = readFileSync(passwordFile, "utf8").replace(/\n$/, "");
+if (!password) {
+  throw new Error(`[lavinmq:bootstrap] admin password file ${passwordFile} is empty — cannot seed the admin`);
+}
+
+// The broker reads only what it needs to authenticate its admin on first boot; bind/ports come from
+// the container's entrypoint (`-b 0.0.0.0`), so this file names the admin and nothing else about the
+// network.
+const ini =
+  "[main]\n" +
+  `data_dir = ${dataDir}\n` +
+  `default_user = ${adminUser}\n` +
+  `default_password_hash = ${rabbitHash(password)}\n`;
+
+writeFileSync(configOut, ini, { mode: 0o600 });
+console.log(`[lavinmq:bootstrap] wrote ${configOut} with admin '${adminUser}' (password hashed for lavinmq)`);

modules/lavinmq/client.ts

@@ -0,0 +1,183 @@
+// lavinmq's admin client — lavinmq's own code, living in the module (novox/hq ADR 0039). Both this
+// module's tools and its provisioner import it, and nothing outside lavinmq does.
+//
+// It drives lavinmq through its HTTP management API (the RabbitMQ-compatible surface lavinmq serves
+// on 15672), not a hand-rolled AMQP admin stack: the module may take NO npm dependency beyond
+// @novox/mesh-sdk, and the management API is exactly the admin surface — create/remove a vhost, a
+// user, and its permissions — reached with `fetch` (global on node 22) and HTTP Basic auth. One
+// boundary, `api()`, and every method is built on it. This is the module's one impure seam, the way
+// postgres's is `psql` and redis's is a RESP socket.
+//
+// **The login and password are the mesh's, not the provisioner's (novox/hq ADR 0048).** The mesh
+// derives the login and hands it to both ends so they agree, and mints the password and delivers a
+// copy to each. lavinmq creates exactly that user with exactly that password on a vhost of the same
+// name — a name or password the provisioner invented is one the consumer could never present.
+
+import { createHash, randomBytes } from "node:crypto";
+import { readFileSync } from "node:fs";
+
+export interface LavinmqConn {
+  /** Base URL of the management API, e.g. http://lavinmq:15672 (no trailing /api). */
+  readonly base: string;
+  readonly adminUser: string;
+  readonly adminPassword: string;
+}
+
+export class LavinmqClient {
+  constructor(private readonly conn: LavinmqConn) {}
+
+  /**
+   * Build from the module's resolved environment. Reads MESH_LAVINMQ_* first (the documented
+   * names), falling back to the MESH_PROVISION_* keys the manifest already sets on the provisioner
+   * container so the module runs unchanged there. Throws if it cannot find a management endpoint and
+   * an admin password — the right failure, because without them nothing it does can work.
+   */
+  static fromEnv(env: NodeJS.ProcessEnv = process.env): LavinmqClient {
+    const base = (env.MESH_LAVINMQ_MANAGEMENT ?? env.MESH_PROVISION_LAVINMQ ?? "").replace(/\/+$/, "");
+    const adminUser = env.MESH_LAVINMQ_ADMIN_USER ?? env.MESH_PROVISION_ADMIN_USER ?? "mesh-admin";
+    const adminPassword = env.MESH_LAVINMQ_ADMIN_PASSWORD ?? readSecretFile(env.MESH_PROVISION_PASSWORD_FILE);
+    if (!base || !adminPassword) {
+      throw new Error("lavinmq management endpoint or admin password is not set — lavinmq's own code cannot reach the server");
+    }
+    return new LavinmqClient({ base, adminUser, adminPassword });
+  }
+
+  /** One request against the management API. A non-2xx reply rejects, carrying the body for the log. */
+  async api(method: string, path: string, body?: unknown): Promise<unknown> {
+    const headers: Record<string, string> = {
+      Authorization: "Basic " + Buffer.from(`${this.conn.adminUser}:${this.conn.adminPassword}`).toString("base64"),
+    };
+    if (body !== undefined) headers["Content-Type"] = "application/json";
+    const resp = await fetch(`${this.conn.base}/api${path}`, {
+      method,
+      headers,
+      body: body !== undefined ? JSON.stringify(body) : undefined,
+    });
+    if (!resp.ok) {
+      throw new Error(`lavinmq management API ${method} ${path} -> ${resp.status}: ${await resp.text()}`);
+    }
+    const text = await resp.text();
+    return text ? JSON.parse(text) : null;
+  }
+
+  /** True once the management API answers — the server has finished starting. */
+  async ready(): Promise<boolean> {
+    try {
+      await this.api("GET", "/overview");
+      return true;
+    } catch {
+      return false;
+    }
+  }
+
+  /** Block until the management API answers, or throw once the budget is spent. */
+  async waitReady(retries = 30, delayMs = 1000): Promise<void> {
+    for (let i = 0; i < retries; i++) {
+      if (await this.ready()) return;
+      await new Promise((r) => setTimeout(r, delayMs));
+    }
+    throw new Error("lavinmq management API did not become ready");
+  }
+
+  /**
+   * Create (or reset to a known state) one consumer's broker: a vhost and a user both named for the
+   * consumer's login, with the login owning full permissions on exactly that vhost. Idempotent — a
+   * PUT of a vhost or user that exists is a no-op or a password reset, so a reconcile can call it
+   * again without harm. The consumer connects as `<login>` to vhost `<login>` and can reach nothing
+   * else (novox/hq ADR 0048).
+   */
+  async createConsumer(login: string, password: string): Promise<void> {
+    const v = encodeURIComponent(login);
+    const u = encodeURIComponent(login);
+    await this.api("PUT", `/vhosts/${v}`);
+    await this.api("PUT", `/users/${u}`, { password, tags: "" });
+    await this.api("PUT", `/permissions/${v}/${u}`, { configure: ".*", write: ".*", read: ".*" });
+  }
+
+  /**
+   * Whether a consumer's user exists with exactly this password and full permissions on its own
+   * vhost. Read-only: the stored hash is salted SHA-256, the scheme `rabbitHash` writes, so the
+   * password is checked by hashing it with the stored salt rather than by logging in. `false` when
+   * the user or its permission is gone or the password differs; an unreachable API rejects
+   * (novox/hq issue 120).
+   */
+  async holdsConsumer(login: string, password: string): Promise<boolean> {
+    const v = encodeURIComponent(login);
+    const u = encodeURIComponent(login);
+    const user = await this.getOrNull<{ password_hash?: string; hashing_algorithm?: string }>(`/users/${u}`);
+    if (!user?.password_hash) return false;
+    if (user.hashing_algorithm && !/sha256/i.test(user.hashing_algorithm)) {
+      throw new Error(`lavinmq user ${login} is hashed with ${user.hashing_algorithm}, which this check cannot verify`);
+    }
+    const stored = Buffer.from(user.password_hash, "base64");
+    if (stored.length < 5 || rabbitHash(password, stored.subarray(0, 4)) !== user.password_hash) return false;
+    const perm = await this.getOrNull<{ configure?: string; write?: string; read?: string }>(`/permissions/${v}/${u}`);
+    return perm?.configure === ".*" && perm?.write === ".*" && perm?.read === ".*";
+  }
+
+  /** A GET that answers null for a 404 and rejects on anything else that is not 2xx. */
+  private async getOrNull<T>(path: string): Promise<T | null> {
+    const resp = await fetch(`${this.conn.base}/api${path}`, {
+      headers: {
+        Authorization: "Basic " + Buffer.from(`${this.conn.adminUser}:${this.conn.adminPassword}`).toString("base64"),
+      },
+    });
+    if (resp.status === 404) return null;
+    if (!resp.ok) throw new Error(`lavinmq management API GET ${path} -> ${resp.status}: ${await resp.text()}`);
+    return (await resp.json()) as T;
+  }
+
+  /** Remove a consumer's vhost and user, idempotently. A DELETE of what is already gone is tolerated. */
+  async removeConsumer(login: string): Promise<void> {
+    const v = encodeURIComponent(login);
+    const u = encodeURIComponent(login);
+    try {
+      await this.api("DELETE", `/vhosts/${v}`);
+    } catch (err) {
+      console.error(`[lavinmq] delete vhost ${login} failed (continuing): ${err}`);
+    }
+    try {
+      await this.api("DELETE", `/users/${u}`);
+    } catch (err) {
+      console.error(`[lavinmq] delete user ${login} failed (continuing): ${err}`);
+    }
+  }
+
+  /** The vhosts, for the amqp_list_vhosts tool. */
+  async listVhosts(): Promise<{ name: string; messages: number }[]> {
+    const vhosts = (await this.api("GET", "/vhosts")) as { name: string; messages?: number }[];
+    return vhosts.map((v) => ({ name: v.name, messages: v.messages ?? 0 }));
+  }
+
+  /** The queues on one vhost (default the root vhost), for the amqp_list_queues tool. */
+  async listQueues(vhost = "/"): Promise<{ name: string; messages: number; consumers: number }[]> {
+    const queues = (await this.api("GET", `/queues/${encodeURIComponent(vhost)}`)) as
+      { name: string; messages?: number; consumers?: number }[];
+    return queues.map((q) => ({ name: q.name, messages: q.messages ?? 0, consumers: q.consumers ?? 0 }));
+  }
+}
+
+/**
+ * The RabbitMQ-compatible SHA-256 password hash lavinmq's `default_password_hash` expects:
+ * base64( salt[4] || sha256( salt || utf8(password) ) ). The salt is any four bytes — random here,
+ * because a fixed salt buys nothing and a fresh one is free. Verified against `lavinmqctl
+ * hash_password`: a hash produced here is accepted by the server unchanged.
+ */
+export function rabbitHash(password: string, salt: Buffer = randomBytes(4)): string {
+  const digest = createHash("sha256").update(Buffer.concat([salt, Buffer.from(password, "utf8")])).digest();
+  return Buffer.concat([salt, digest]).toString("base64");
+}
+
+/** Generate a URL-safe password. */
+export function generatePassword(): string {
+  return randomBytes(24).toString("base64url");
+}
+
+function readSecretFile(path: string | undefined): string | undefined {
+  if (!path) return undefined;
+  try {
+    return readFileSync(path, "utf8").trim();
+  } catch {
+    return undefined;
+  }
+}

modules/lavinmq/index.ts

@@ -0,0 +1,25 @@
+// lavinmq's events entrypoint, loaded by the per-node tool host (the provisioner container runs
+// ./provisioner separately). The broker lifecycle events are EMITTED from the provisioner, where the
+// lifecycle actually happens (novox/hq ADR 0041/0042):
+//   module.lavinmq.amqp.provisioned    — a consumer's vhost + user was created
+//   module.lavinmq.amqp.deprovisioned  — that vhost + user was removed
+// Here in the tool host we react to them, keeping a lightweight audit trail of who was granted a
+// broker and who lost one — observability the provider itself is best placed to log.
+
+import { on } from "@novox/mesh-sdk/events";
+
+interface AmqpEvent {
+  consumer?: string;
+  user: string;
+  vhost?: string;
+}
+
+await on<AmqpEvent>("module.lavinmq.amqp.provisioned", async (e) => {
+  console.log(`[lavinmq] broker provisioned for ${e.body.consumer ?? "?"} (user ${e.body.user}, vhost ${e.body.vhost})`);
+});
+
+await on<AmqpEvent>("module.lavinmq.amqp.deprovisioned", async (e) => {
+  console.log(`[lavinmq] broker deprovisioned (user ${e.body.user})`);
+});
+
+console.log("[lavinmq] auditing broker lifecycle events");

modules/lavinmq/module.json

@@ -0,0 +1,151 @@
+{
+  "module": "lavinmq",
+  "version": "1",
+  "provides": [
+    {
+      "name": "amqp",
+      "scope": "mesh"
+    }
+  ],
+  "claims": [
+    {
+      "name": "mesh-broker",
+      "scope": "mesh"
+    }
+  ],
+  "capabilities": [
+    "container-runtime"
+  ],
+  "emits": [
+    "module.lavinmq.amqp.provisioned",
+    "module.lavinmq.amqp.deprovisioned"
+  ],
+  "consumes": [
+    "module.lavinmq.amqp.provisioned",
+    "module.lavinmq.amqp.deprovisioned"
+  ],
+  "serves": {
+    "amqp": {
+      "port": 5672
+    }
+  },
+  "receives": {
+    "amqp": "/var/lib/lavinmq-module/grants/mesh.json"
+  },
+  "grants": {
+    "amqp": "/var/lib/lavinmq-module/grants"
+  },
+  "own-secrets": {
+    "admin": "/var/lib/lavinmq-module/admin.secret",
+    "broker": "/var/lib/mesh/lavinmq/broker"
+  },
+  "listens": [
+    {
+      "port": 5671,
+      "protocol": "tcp",
+      "from": "mesh",
+      "why": "the mesh bus \u2014 amqps, every module's events and the control plane, reached over the overlay"
+    },
+    {
+      "port": 5672,
+      "protocol": "tcp",
+      "from": "mesh",
+      "why": "modules on any machine that were granted a queue"
+    }
+  ],
+  "guards": [
+    15672
+  ],
+  "resources": [
+    {
+      "id": "mesh-state",
+      "type": "directory",
+      "path": "/var/lib/mesh/lavinmq",
+      "mode": "0700"
+    },
+    {
+      "id": "state",
+      "type": "directory",
+      "path": "/var/lib/lavinmq-module",
+      "mode": "0700"
+    },
+    {
+      "id": "grants-dir",
+      "type": "directory",
+      "path": "/var/lib/lavinmq-module/grants",
+      "mode": "0700"
+    },
+    {
+      "id": "broker-data",
+      "type": "directory",
+      "path": "/var/lib/mesh-broker",
+      "mode": "0700"
+    },
+    {
+      "id": "server",
+      "type": "container",
+      "name": "mesh-broker",
+      "image": "cloudamqp/lavinmq@sha256:3eb54c12916d700a978c2ea86e6362cd4974b0e3189508718006d4e6d341246b",
+      "ports": [
+        "5671:5671",
+        "5672:5672",
+        "127.0.0.1:15672:15672"
+      ],
+      "volumes": [
+        "/var/lib/mesh-broker:/var/lib/lavinmq",
+        "/var/lib/mesh-broker-tls:/tls:ro"
+      ],
+      "args": [
+        "--amqps-port=5671",
+        "--cert=/tls/tls.crt",
+        "--key=/tls/tls.key"
+      ]
+    },
+    {
+      "id": "runtime",
+      "type": "container",
+      "name": "mesh-lavinmq",
+      "artifact": "runtime",
+      "network": "host",
+      "volumes": [
+        "/var/lib/mesh/lavinmq/broker:/run/secrets/broker:ro",
+        "/var/lib/lavinmq-module/grants:/var/lib/lavinmq-module/grants:ro",
+        "/var/lib/lavinmq-module/admin.secret:/run/secrets/admin:ro"
+      ],
+      "env": {
+        "MESH_BROKER_FILE": "/run/secrets/broker",
+        "MESH_RECEIVES": "/var/lib/lavinmq-module/grants/mesh.json",
+        "MESH_PROVISION_LAVINMQ": "http://127.0.0.1:15672",
+        "MESH_PROVISION_ADMIN_USER": "guest",
+        "MESH_PROVISION_PASSWORD_FILE": "/run/secrets/admin"
+      }
+    }
+  ],
+  "build": {
+    "on": [
+      {
+        "arg": "BUILD_BASE",
+        "module": "mesh-tools",
+        "artifact": "build"
+      },
+      {
+        "arg": "RUNTIME_BASE",
+        "module": "mesh-tools",
+        "artifact": "runtime"
+      }
+    ],
+    "artifacts": [
+      {
+        "name": "runtime",
+        "kind": "image",
+        "from": "Dockerfile"
+      }
+    ]
+  },
+  "accesses": [
+    {
+      "path": "/var/lib/mesh-broker-tls",
+      "mode": "read"
+    }
+  ]
+}

modules/lavinmq/package.json

@@ -0,0 +1,14 @@
+{
+  "name": "@novox/module-lavinmq",
+  "version": "0.1.0",
+  "description": "lavinmq — provides the mesh amqp interface (a per-consumer AMQP message broker). Its management client, provisioner, run-once bootstrap, tools and events live here (novox/hq ADR 0039).",
+  "type": "module",
+  "private": true,
+  "dependencies": {
+    "@novox/mesh-sdk": "^0.1.1"
+  },
+  "devDependencies": {
+    "@types/node": "^22.0.0",
+    "typescript": "^5.6.0"
+  }
+}

modules/lavinmq/provisioner/index.ts

@@ -0,0 +1,56 @@
+// lavinmq's provisioner — the adapter that makes lavinmq a provider of the mesh `amqp` interface.
+// The reconcile loop, the contributions file, and reading the mesh's minted password are the sdk
+// harness's; this writes only the per-service half: how lavinmq creates and removes a consumer's own
+// broker (novox/hq ADR 0039/0040/0048).
+//
+// The `amqp` interface: a consumer connects as `as` with the password the mesh minted, to a vhost
+// named for that same login — its own message broker, isolated from every other consumer's by the
+// vhost boundary. It is a broker of its own, not a shared account on the mesh's control-plane broker.
+//
+// **The login and password are the mesh's, not the provisioner's (novox/hq ADR 0048).** The mesh
+// derives the login and hands it to both ends so they agree, and mints the password and delivers a
+// copy to each. lavinmq creates exactly that user with exactly that password — a name or password the
+// provisioner invented is one the consumer could never present.
+//
+// Vhost-per-login is the isolation model, the exact analog of postgres's database-per-login: the
+// consumer owns one vhost, named for its login, and a user with full rights on that vhost and no
+// rights anywhere else. lavinmq enforces it — a user with no permission on `/` is refused the moment
+// it opens that vhost (`NOT_ALLOWED`), so a login is a broker the consumer alone can reach.
+
+import { runProvisioner, type Provision } from "@novox/mesh-sdk/provisioner";
+import { emit } from "@novox/mesh-sdk/events";
+import { LavinmqClient } from "../client.js";
+
+const lavinmq = LavinmqClient.fromEnv();
+
+/** Emit a lifecycle event without letting a broker hiccup fail the provisioning itself. */
+async function announce(type: string, body: Record<string, string>): Promise<void> {
+  try {
+    await emit(type, body);
+  } catch (err) {
+    console.error(`[provisioner:amqp] emit ${type} failed: ${err}`);
+  }
+}
+
+runProvisioner("amqp", {
+  async create(p: Provision): Promise<void> {
+    // The vhost and the user share the consumer's login, so one cannot reach another's broker.
+    await lavinmq.waitReady();
+    await lavinmq.createConsumer(p.as, p.password);
+    await announce("module.lavinmq.amqp.provisioned", {
+      consumer: p.consumer ?? "",
+      user: p.as,
+      vhost: p.as,
+    });
+  },
+
+  async remove(p: { as: string }): Promise<void> {
+    await lavinmq.removeConsumer(p.as);
+    await announce("module.lavinmq.amqp.deprovisioned", { user: p.as, vhost: p.as });
+  },
+  // Asked every minute by the harness: whether the backend still holds this consumer exactly as
+  // the mesh gave it, so a login lost behind the provisioner's back is made again (novox/hq issue 120).
+  async holds(p: Provision): Promise<boolean> {
+    return lavinmq.holdsConsumer(p.as, p.password);
+  },
+});

modules/lavinmq/tools/index.ts

@@ -0,0 +1,32 @@
+// lavinmq's tools — lavinmq's own code (novox/hq ADR 0039), importing lavinmq's own management
+// client. They return structured data; the mesh serves them through the sdk's tool harness.
+
+import { registerModuleTools, type ToolDefinition } from "@novox/mesh-sdk/tools";
+import { LavinmqClient } from "../client.js";
+
+export function getLavinmqTools(lavinmq: LavinmqClient): ToolDefinition[] {
+  return [
+    {
+      name: "amqp_list_vhosts",
+      description: "List the lavinmq virtual hosts — one per consumer that was granted a broker.",
+      input: {},
+      run: async () => ({ vhosts: await lavinmq.listVhosts() }),
+    },
+    {
+      name: "amqp_list_queues",
+      description: "List the queues on a vhost with message and consumer counts. Omit vhost for the root '/'.",
+      input: { vhost: { type: "string", description: "the vhost to list, e.g. a consumer's login; defaults to '/'" } },
+      run: async (args) => ({ queues: await lavinmq.listQueues(args.vhost ? String(args.vhost) : undefined) }),
+    },
+  ];
+}
+
+// The tools exist only when the server can be reached from the environment; without it, lavinmq
+// contributes none rather than failing the whole tool runtime.
+registerModuleTools("lavinmq", (env) => {
+  try {
+    return getLavinmqTools(LavinmqClient.fromEnv(env));
+  } catch {
+    return [];
+  }
+});

modules/lavinmq/tsconfig.json

@@ -0,0 +1,12 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "NodeNext",
+    "moduleResolution": "NodeNext",
+    "strict": true,
+    "esModuleInterop": true,
+    "skipLibCheck": true,
+    "noEmit": true
+  },
+  "include": ["client.ts", "index.ts", "provisioner/index.ts", "tools/index.ts", "bootstrap/index.ts"]
+}

modules/letta/module.json

@@ -24,7 +24,6 @@
   },
   "listens": [
     {
-      "name": "web",
       "port": 8283,
       "protocol": "tcp",
       "from": "mesh",

modules/lidarr/Dockerfile

@@ -13,7 +13,7 @@ ARG RUNTIME_BASE
 FROM ${BUILD_BASE} AS build
 WORKDIR /app/modules/lidarr
 COPY . .
-RUN node /app/node_modules/typescript/bin/tsc client.ts index.ts tools/index.ts downloads/settings.ts downloads/index.ts \
+RUN node /app/node_modules/typescript/bin/tsc client.ts index.ts tools/index.ts \
       --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist
 
 FROM ${RUNTIME_BASE}
@@ -22,6 +22,3 @@ COPY --from=build /app/modules/lidarr/dist /app/modules/lidarr/dist
 # provider's provisioner runs its reconcile loop in the same process, with the broker connected —
 # the convention novox/hq issues 060/061 settled.
 ENV MESH_TOOL_MODULES=/app/modules/lidarr/dist/index.js,/app/modules/lidarr/dist/tools/index.js
-# NOT dist/downloads/index.js: that is a step the host runs to completion, named by the `downloads`
-# container's args as `mesh-tools run …` (novox/hq ADR 0052). Listed here it would run inside the
-# serving sidecar too, and exit it.

modules/lidarr/downloads/index.ts

@@ -1,188 +0,0 @@
-// The downloads step — run once by the host after the app's server starts, and again whenever a
-// binding, a pair credential or the step's settings change (the container's `restart-on`,
-// novox/hq ADR 0099). Byte-identical in sonarr, radarr, lidarr and bookshelf; see settings.ts.
-//
-// **A step, not a loop**: everything it does is a function of files the mesh writes, and the host
-// already knows when they change. It connects to no broker.
-//
-// Exits non-zero when anything could not be put right — a refused credential, an unreachable
-// provider, an entry the app would not save — so the node reports the step failed and the host
-// runs it again on the next apply. Declared last in the manifest, so its failing gates nothing
-// else of the module's (novox/hq ADR 0136).
-//
-// Reads, in MESH_DOWNLOADS_DIR, `<provision>.json` (the binding), `<provision>.secret` (the pair
-// credential) and the settings file; remembers in MESH_DOWNLOADS_MEMORY the jackett hosts it has
-// pointed feeds at, so a jackett that moves takes its feeds with it. Never prints a credential.
-
-import { mkdir, rename, writeFile } from "node:fs/promises";
-import { dirname, join } from "node:path";
-
-import {
-  CLIENTS,
-  JACKETT,
-  acceptRemedy,
-  appConfig,
-  appReady,
-  listEntries,
-  providerTakes,
-  readIfThere,
-  readJson,
-  reconcileClient,
-  reconcileIndexers,
-  scrub,
-  stepSettings,
-  wanted,
-  type App,
-  type Binding,
-  type Http,
-  type Entry,
-  type Outcome,
-  type Took,
-} from "./settings.js";
-
-const module = process.env.MESH_DOWNLOADS_APP ?? "app";
-const dir = process.env.MESH_DOWNLOADS_DIR ?? "/run/downloads";
-const settingsFile = process.env.MESH_DOWNLOADS_SETTINGS ?? join(dir, "downloads.json");
-const memoryFile = process.env.MESH_DOWNLOADS_MEMORY ?? "/var/lib/downloads/memory.json";
-const waitSeconds = Number(process.env.MESH_DOWNLOADS_WAIT_SECONDS ?? "180");
-const tag = `[${module}-downloads]`;
-
-const http: Http = { fetch: (u, init) => fetch(u, init) };
-const secrets: string[] = [];
-const say = (line: string) => console.log(scrub(`${tag} ${line}`, secrets));
-const fail = (line: string) => console.error(scrub(`${tag} ${line}`, secrets));
-
-const config = appConfig((await readIfThere(process.env.MESH_DOWNLOADS_APP_CONFIG)) ?? "");
-if (!config.apiKey) {
-  fail(`no API key in ${module}'s config.xml yet — ${module} writes it on its first start; the step runs again on the next apply`);
-  process.exit(1);
-}
-secrets.push(config.apiKey);
-const app: App = {
-  module,
-  url: `${(process.env.MESH_DOWNLOADS_APP_URL ?? "http://127.0.0.1").replace(/\/$/, "")}${config.urlBase}`,
-  apiKey: config.apiKey,
-  api: process.env.MESH_DOWNLOADS_API ?? "v3",
-};
-const settings = stepSettings(await readJson(settingsFile));
-
-if (!(await appReady(http, app, waitSeconds * 1000))) {
-  fail(`${module} did not answer at ${app.url} within ${waitSeconds}s`);
-  process.exit(1);
-}
-
-const outcomes: Outcome[] = [];
-
-// The download clients.
-let clients: Entry[];
-try {
-  clients = await listEntries(http, app, "downloadclient");
-} catch (err) {
-  fail(err instanceof Error ? err.message : String(err));
-  process.exit(1);
-}
-for (const kind of CLIENTS) {
-  const credential = await readIfThere(join(dir, `${kind.provision}.secret`));
-  if (credential) secrets.push(credential.trim());
-  const w = wanted(kind.provision, (await readJson(join(dir, `${kind.provision}.json`))) as Binding | undefined, credential, true);
-  // `in`, not `!w.ok`: the Dockerfile compiles without strict, where a boolean discriminant does not
-  // narrow.
-  if ("problem" in w) {
-    outcomes.push({ what: kind.provision, result: "refused", problem: w.problem });
-    continue;
-  }
-  const ep = w.endpoint;
-  try {
-    if (!(await providerTakes(http, kind.provision, ep)).took) {
-      outcomes.push({
-        what: kind.provision,
-        result: "refused",
-        problem: acceptRemedy(app, settings.node, kind.provision, kind.provider, kind.secretName, ep.from),
-      });
-      continue;
-    }
-  } catch (err) {
-    outcomes.push({
-      what: kind.provision,
-      result: "refused",
-      problem: `${kind.provider} could not be asked whether it takes the credential at ${ep.host}:${ep.port}: ${err instanceof Error ? err.message : String(err)}`,
-    });
-    continue;
-  }
-  outcomes.push(...(await reconcileClient(http, app, kind, settings.names[kind.provision], ep, clients)));
-}
-
-// The indexers, through jackett.
-{
-  const credential = await readIfThere(join(dir, `${JACKETT}.secret`));
-  if (credential) secrets.push(credential.trim());
-  const w = wanted(JACKETT, (await readJson(join(dir, `${JACKETT}.json`))) as Binding | undefined, credential, false);
-  if ("problem" in w) {
-    outcomes.push({ what: JACKETT, result: "refused", problem: w.problem });
-  } else {
-    const ep = w.endpoint;
-    let took: Took | undefined;
-    try {
-      took = await providerTakes(http, JACKETT, ep);
-    } catch (err) {
-      outcomes.push({
-        what: JACKETT,
-        result: "refused",
-        problem: `jackett could not be asked whether it takes the key at ${ep.host}:${ep.port}: ${err instanceof Error ? err.message : String(err)}`,
-      });
-    }
-    if (took && !took.took) {
-      outcomes.push({ what: JACKETT, result: "refused", problem: acceptRemedy(app, settings.node, JACKETT, "jackett", "API key", ep.from) });
-    } else if (took) {
-      const memory = ((await readJson(memoryFile)) ?? {}) as Record<string, { hosts?: string[] } | undefined>;
-      const remembered = Array.isArray(memory[JACKETT]?.hosts) ? (memory[JACKETT]?.hosts as string[]) : [];
-      try {
-        const indexers = await listEntries(http, app, "indexer");
-        outcomes.push(
-          ...(await reconcileIndexers(http, app, ep, took.configured ?? new Map(), settings.indexers, remembered, indexers)),
-        );
-      } catch (err) {
-        outcomes.push({ what: JACKETT, result: "refused", problem: err instanceof Error ? err.message : String(err) });
-      }
-      // Remember where the feeds now point, so they are still recognised as the mesh's if jackett
-      // moves. Written whole and renamed, so a crash leaves the old memory, never half of one.
-      const hosts = [...new Set([...remembered, ep.host.toLowerCase()])].sort();
-      if (hosts.join() !== [...remembered].sort().join()) {
-        try {
-          await mkdir(dirname(memoryFile), { recursive: true });
-          await writeFile(`${memoryFile}.tmp`, JSON.stringify({ ...memory, [JACKETT]: { hosts } }, null, 2) + "\n", { mode: 0o600 });
-          await rename(`${memoryFile}.tmp`, memoryFile);
-        } catch (err) {
-          outcomes.push({
-            what: JACKETT,
-            result: "notice",
-            note: `could not remember ${ep.host} as a jackett host (${err instanceof Error ? err.message : String(err)}); if jackett moves, list it in downloads.jackett-api.adopt-hosts`,
-          });
-        }
-      }
-    }
-  }
-}
-
-let failed = 0;
-for (const o of outcomes) {
-  switch (o.result) {
-    case "unchanged":
-      say(`${o.what}: already as the mesh says${o.untested ? "" : "; connection tested"}`);
-      break;
-    case "written":
-      say(`${o.what}: wrote ${o.fields.join(", ")}${o.untested ? "" : "; connection tested"}`);
-      break;
-    case "created":
-      say(`${o.what}: registered; connection tested`);
-      break;
-    case "notice":
-      say(`${o.what}: ${o.note}`);
-      break;
-    case "refused":
-      failed++;
-      fail(`${o.what}: ${o.problem}`);
-      break;
-  }
-}
-process.exitCode = failed > 0 ? 1 : 0;

modules/lidarr/downloads/settings.ts

@@ -1,778 +0,0 @@
-// Where a Servarr app reaches its download clients and its indexer proxy — decided by the mesh,
-// written into the app by the app's own API.
-//
-// **One file, four copies.** sonarr, radarr, lidarr and bookshelf (a Readarr fork) keep their
-// download clients and indexers behind the same API — `/api/v3/…` for the first two, `/api/v1/…`
-// for the others — so this step is the same code in each. Each module builds from its own
-// directory (novox/hq ADR 0069), so each carries a byte-identical copy under `downloads/`;
-// `test/downloads.test.ts` checks the copies agree wherever the siblings are checked out beside
-// it. Change all four together.
-//
-// **Why this exists.** The app keeps its connection to nzbget, qBittorrent and jackett in its own
-// database, not in a file, so the mesh has nowhere to write `${bound:nzbget-api:at}` for it. The
-// module requires `nzbget-api`, `qbittorrent-api` and `jackett-api`; the mesh delivers, for each,
-// a binding (where the provider is — `at` — and what it serves: `port`, `scheme`, `url-base`, and
-// for a download client the `username`) and a pair credential (nzbget's ControlPassword,
-// qBittorrent's WebUI password, jackett's API key — each the provider's one and only, accepted by
-// the operator per pair; the mesh cannot mint them). This step reads those files and makes the
-// app's entries say the same thing.
-//
-// **Which entries are the mesh's.** Never a guess from what an entry looks like:
-//   - a download client is the mesh's when its name is the one the module's settings give for
-//     that provision (`downloads.<provision>.name`) and its kind is that provider's. On a fresh
-//     machine the step registers it under that name; on a migrated one the assignment names the
-//     entry the migration adopts ("NZBGet" on ace).
-//   - a Torznab indexer is the mesh's when it reads a jackett feed
-//     (`…/api/v2.0/indexers/<id>/results/torznab`) on a host the mesh put there — the bound `at`,
-//     one it bound before (remembered by the step), or one the settings adopt
-//     (`downloads.jackett-api.adopt-hosts`, which is how a migration names the entries that pointed
-//     at the old container). `downloads.jackett-api.indexers` lists the jackett indexers the app
-//     should have; one missing is registered.
-// Everything else — every entry a person made, an nzbget elsewhere, a seedbox's jackett, a Newznab
-// indexer — is left exactly as it is. **Nothing is ever deleted.**
-//
-// **Only the connection, and only when it differs.** Host, port, TLS, base path, user name and
-// the credential. Categories, priorities, "enabled", seed criteria and every other choice made in
-// the app are left alone. The stored credential cannot be read back (the app masks it), so the
-// step asks the app to test the entry with the mesh's host and port and the credential it already
-// holds: passing, the credential is already the provider's one and only; failing, the delivered
-// credential is written.
-//
-// **A credential the provider refuses is never written.** Until the operator accepts the
-// provider's secret for this pair, the mesh delivers a value it minted itself, which no provider
-// will ever accept (novox/hq ADR 0092). Writing it would replace a working password with a dead
-// one. So it is tried against the provider first; refused, nothing of that provision is written
-// and the step fails naming the `secret accept` that fixes it.
-//
-// Pure logic and a small HTTP seam, so it is tested against fake servers (test/downloads.test.ts).
-// Never prints a credential, an API key, or a URL carrying one.
-
-import { readFile } from "node:fs/promises";
-
-/** A download-client provision and the shape of its entry in the app. */
-export interface ClientKind {
-  provision: "nzbget-api" | "qbittorrent-api";
-  /** The app's `implementation` for it. */
-  implementation: "Nzbget" | "QBittorrent";
-  /** The provider, as a person calls it. */
-  provider: string;
-  /** What the pair credential is, in the provider's words. */
-  secretName: string;
-}
-
-export const CLIENTS: readonly ClientKind[] = [
-  { provision: "nzbget-api", implementation: "Nzbget", provider: "nzbget", secretName: "ControlPassword" },
-  { provision: "qbittorrent-api", implementation: "QBittorrent", provider: "qBittorrent", secretName: "WebUI password" },
-];
-
-export const JACKETT = "jackett-api";
-
-/** What the mesh wrote at `binds.<provision>`: the binding document. */
-export interface Binding {
-  provision?: string;
-  from?: string;
-  at?: string;
-  as?: string;
-  serves?: Record<string, unknown>;
-}
-
-/** Where a provider is, as the mesh bound it, and the credential for it. */
-export interface Endpoint {
-  scheme: "http" | "https";
-  host: string;
-  port: number;
-  /** "" at the root, otherwise "/base" — one leading slash, none trailing. */
-  urlBase: string;
-  /** The user a download client logs in as; "" for jackett, which takes a key. */
-  username: string;
-  credential: string;
-  /** The provider's node, for the `secret accept` remedy. */
-  from: string;
-}
-
-export type Wanted = { ok: true; endpoint: Endpoint } | { ok: false; problem: string };
-
-/**
- * The endpoint the mesh says to use, from a binding and its pair credential.
- *
- * Refused rather than guessed when the binding cannot be dialled from the app's own container: a
- * loopback `at` — what the mesh hands a machine that is not on the private network — is the app's
- * container itself.
- */
-export function wanted(
-  provision: string,
-  binding: Binding | undefined,
-  credential: string | undefined,
-  needsUser: boolean,
-): Wanted {
-  if (!binding) {
-    return { ok: false, problem: `no binding for ${provision} was delivered — the mesh writes it before this step runs` };
-  }
-  const host = typeof binding.at === "string" ? binding.at.trim() : "";
-  const serves = binding.serves ?? {};
-  const port = Number(serves.port);
-  if (!host) return { ok: false, problem: `the ${provision} binding names no host (at)` };
-  if (isLoopback(host)) {
-    return {
-      ok: false,
-      problem:
-        `the ${provision} binding says the provider is at ${host}, which from the app's own container is the ` +
-        `app itself. The mesh hands loopback to a machine that is not on the private network; put it on the ` +
-        `private network so the provider has an address the app can dial`,
-    };
-  }
-  if (!Number.isInteger(port) || port <= 0 || port > 65535) {
-    return { ok: false, problem: `the ${provision} binding serves no usable port (${String(serves.port)})` };
-  }
-  const scheme = typeof serves.scheme === "string" && serves.scheme ? serves.scheme : "http";
-  if (scheme !== "http" && scheme !== "https") {
-    return { ok: false, problem: `the ${provision} binding serves scheme ${scheme}, which the app cannot dial` };
-  }
-  const username = typeof serves.username === "string" ? serves.username.trim() : "";
-  if (needsUser && !username) {
-    return { ok: false, problem: `the ${provision} binding serves no username for the app to log in as` };
-  }
-  const key = (credential ?? "").trim();
-  if (!key) return { ok: false, problem: `the ${provision} credential is empty or was not delivered` };
-  return {
-    ok: true,
-    endpoint: {
-      scheme,
-      host,
-      port,
-      urlBase: normBase(serves["url-base"]),
-      username,
-      credential: key,
-      from: typeof binding.from === "string" ? binding.from : "",
-    },
-  };
-}
-
-/** A URL base as "" or "/x/y": slashes trimmed, one put back in front. */
-export function normBase(v: unknown): string {
-  const s = typeof v === "string" ? v.trim().replace(/^\/+|\/+$/g, "") : "";
-  return s === "" ? "" : `/${s}`;
-}
-
-function isLoopback(host: string): boolean {
-  const h = host.toLowerCase();
-  return h === "localhost" || h === "::1" || h === "[::1]" || /^127\./.test(h);
-}
-
-function hostForUrl(host: string): string {
-  return host.includes(":") && !host.startsWith("[") ? `[${host}]` : host;
-}
-
-/** The provider's base URL, as the step dials it and as the app is given it. */
-export function baseUrl(ep: Endpoint): string {
-  return `${ep.scheme}://${hostForUrl(ep.host)}:${ep.port}${ep.urlBase}`;
-}
-
-// ---------------------------------------------------------------------------------------------
-// HTTP
-
-/** The HTTP the step needs, so a test can stand fakes in for the app and the providers. */
-export interface Http {
-  fetch(
-    url: string,
-    init?: { method?: string; headers?: Record<string, string>; body?: string },
-  ): Promise<{ status: number; text(): Promise<string> }>;
-}
-
-/** The app, as the step reaches it from the host. */
-export interface App {
-  /** The module, for messages and the remedy: sonarr, radarr, lidarr, bookshelf. */
-  module: string;
-  /** Its own URL, base path included. */
-  url: string;
-  apiKey: string;
-  /** v3 (sonarr, radarr) or v1 (lidarr, bookshelf). */
-  api: string;
-}
-
-interface Answer {
-  status: number;
-  body: unknown;
-}
-
-async function appCall(http: Http, app: App, method: string, path: string, body?: unknown): Promise<Answer> {
-  const res = await http.fetch(`${app.url.replace(/\/$/, "")}/api/${app.api}${path}`, {
-    method,
-    headers: {
-      "X-Api-Key": app.apiKey,
-      Accept: "application/json",
-      ...(body !== undefined ? { "Content-Type": "application/json" } : {}),
-    },
-    body: body !== undefined ? JSON.stringify(body) : undefined,
-  });
-  const text = await res.text();
-  let parsed: unknown = undefined;
-  if (text) {
-    try {
-      parsed = JSON.parse(text) as unknown;
-    } catch {
-      parsed = text;
-    }
-  }
-  return { status: res.status, body: parsed };
-}
-
-async function appGet(http: Http, app: App, path: string): Promise<unknown> {
-  const a = await appCall(http, app, "GET", path);
-  if (a.status < 200 || a.status >= 300) throw new Error(`${app.module} GET ${path} answered ${a.status}`);
-  return a.body;
-}
-
-/** One of the app's validation failures: the only parts of an answer the step ever prints. */
-interface Failure {
-  property: string;
-  message: string;
-  warning: boolean;
-}
-
-function failuresOf(body: unknown): Failure[] {
-  const list = Array.isArray(body) ? body : [];
-  return list.map((f) => {
-    const o = (f ?? {}) as Record<string, unknown>;
-    return {
-      property: String(o.propertyName ?? ""),
-      message: String(o.errorMessage ?? ""),
-      warning: o.isWarning === true,
-    };
-  });
-}
-
-/**
- * One shape rather than a union on `ok`: the Dockerfile compiles without strict, where a boolean
- * discriminant does not narrow.
- */
-interface Verdict {
-  ok: boolean;
-  /** Warnings the app raised on a pass; errors (and any warnings) on a failure. */
-  failures: Failure[];
-  status: number;
-  saved?: Entry;
-}
-
-function verdict(a: Answer): Verdict {
-  if (a.status >= 200 && a.status < 300) return { ok: true, failures: [], status: a.status };
-  const failures = failuresOf(a.body);
-  if (a.status === 400 && failures.length > 0 && failures.every((f) => f.warning)) return { ok: true, failures, status: a.status };
-  return { ok: false, failures, status: a.status };
-}
-
-/** The app's own test of an entry, from the app's own container. */
-async function appTest(http: Http, app: App, resource: string, entry: Entry): Promise<Verdict> {
-  return verdict(await appCall(http, app, "POST", `/${resource}/test`, entry));
-}
-
-/**
- * Save an entry. The app tests an enabled entry before saving it; a test that passes with only
- * warnings ("a category is recommended") is saved with `forceSave`, the same as pressing "save
- * anyway" in its screen. An error is never forced.
- */
-async function appSave(http: Http, app: App, resource: string, entry: Entry, create: boolean): Promise<Verdict> {
-  const path = create ? `/${resource}` : `/${resource}/${entry.id}`;
-  const method = create ? "POST" : "PUT";
-  let a = await appCall(http, app, method, path, entry);
-  let v = verdict(a);
-  if (v.ok && (a.status < 200 || a.status >= 300)) {
-    a = await appCall(http, app, method, `${path}?forceSave=true`, entry);
-    v = verdict(a);
-    if (v.ok && (a.status < 200 || a.status >= 300)) {
-      return { ok: false, failures: failuresOf(a.body), status: a.status };
-    }
-  }
-  if (!v.ok) return v;
-  return { ...v, saved: (a.body ?? undefined) as Entry | undefined };
-}
-
-// ---------------------------------------------------------------------------------------------
-// Entries
-
-/** An entry as the app's API gives it: a download client or an indexer. */
-export interface Entry {
-  id?: number;
-  name?: string;
-  implementation?: string;
-  enable?: boolean;
-  enableRss?: boolean;
-  enableAutomaticSearch?: boolean;
-  enableInteractiveSearch?: boolean;
-  supportsRss?: boolean;
-  supportsSearch?: boolean;
-  fields?: { name: string; value?: unknown; [k: string]: unknown }[];
-  [k: string]: unknown;
-}
-
-export function field(e: Entry, name: string): unknown {
-  return e.fields?.find((f) => f.name === name)?.value;
-}
-
-/** The entry with these fields' values replaced — added when the app's shape lacks one. */
-export function withFields(e: Entry, values: Record<string, unknown>): Entry {
-  const fields = (e.fields ?? []).map((f) => (f.name in values ? { ...f, value: values[f.name] } : { ...f }));
-  for (const [name, value] of Object.entries(values)) {
-    if (!fields.some((f) => f.name === name)) fields.push({ name, value });
-  }
-  return { ...e, fields };
-}
-
-function enabled(e: Entry): boolean {
-  return e.enable === true || e.enableRss === true || e.enableAutomaticSearch === true || e.enableInteractiveSearch === true;
-}
-
-/** What one provision, or one entry of it, came to. */
-export type Outcome =
-  | { what: string; result: "unchanged"; untested?: boolean }
-  | { what: string; result: "written"; fields: string[]; untested?: boolean }
-  | { what: string; result: "created"; fields: string[] }
-  | { what: string; result: "notice"; note: string }
-  | { what: string; result: "refused"; problem: string };
-
-function said(fs: Failure[]): string {
-  return fs.length === 0 ? "no reason given" : fs.map((f) => (f.property ? `${f.property}: ${f.message}` : f.message)).join("; ");
-}
-
-/**
- * Bring one of the mesh's entries in line: `connection` is the non-secret fields as the mesh says
- * them, `differs` which of them the entry does not already say, `secretField` where the credential
- * goes. Never throws: every failure is an outcome with a reason.
- */
-export async function reconcileEntry(
-  http: Http,
-  app: App,
-  resource: "downloadclient" | "indexer",
-  what: string,
-  current: Entry,
-  connection: Record<string, unknown>,
-  differs: string[],
-  secretField: string,
-  credential: string,
-  testable = true,
-): Promise<Outcome> {
-  try {
-    const base = withFields(current, connection); // the credential as the app holds it — masked
-    if (!testable) {
-      // Nothing to test against (jackett no longer has the indexer it names): the connection is
-      // still the mesh's to state, and the key goes with it when the address changes.
-      if (differs.length === 0) return { what, result: "unchanged", untested: true };
-      const s = await appSave(http, app, resource, withFields(base, { [secretField]: credential }), false);
-      if (!s.ok) return { what, result: "refused", problem: `${app.module} would not save it: ${said(s.failures)}` };
-      return { what, result: "written", fields: [...differs, secretField], untested: true };
-    }
-    const first = await appTest(http, app, resource, base);
-    if (first.ok) {
-      // The credential the app holds already works against the provider at the mesh's address —
-      // and the provider has exactly one, so it is the delivered one.
-      if (differs.length === 0) return { what, result: "unchanged" };
-      const s = await appSave(http, app, resource, base, false);
-      if (!s.ok) return { what, result: "refused", problem: `${app.module} would not save it: ${said(s.failures)}` };
-      return { what, result: "written", fields: differs };
-    }
-    // The app's test failed with what it holds. The delivered credential was already checked
-    // against the provider, so writing it is safe; the app tests an enabled entry again on save.
-    const s = await appSave(http, app, resource, withFields(base, { [secretField]: credential }), false);
-    if (!s.ok) {
-      return {
-        what,
-        result: "refused",
-        problem: `${app.module} tested it at the mesh's address and would not save it (nothing was written): ${said(s.failures)}`,
-      };
-    }
-    const stored = (await appGet(http, app, `/${resource}/${current.id}`)) as Entry;
-    const second = await appTest(http, app, resource, stored);
-    const fields = [...differs, secretField];
-    if (second.ok) return { what, result: "written", fields };
-    const why = `written (${fields.join(", ")}), and ${app.module}'s own test still fails: ${said(second.failures)}`;
-    return enabled(stored) ? { what, result: "refused", problem: why } : { what, result: "notice", note: `${why} — it is disabled, so nothing uses it` };
-  } catch (err) {
-    return { what, result: "refused", problem: message(err) };
-  }
-}
-
-/**
- * Register a new entry from the app's own template for that kind: its defaults, the name, the
- * connection and the credential. A category the provider does not have (nzbget refuses one it was
- * not told about) is left empty rather than failing the registration, and said.
- */
-export async function createEntry(
-  http: Http,
-  app: App,
-  resource: "downloadclient" | "indexer",
-  what: string,
-  implementation: string,
-  name: string,
-  values: Record<string, unknown>,
-): Promise<Outcome> {
-  try {
-    const schema = (await appGet(http, app, `/${resource}/schema`)) as Entry[];
-    const template = (schema ?? []).find((s) => s.implementation === implementation);
-    if (!template) return { what, result: "refused", problem: `${app.module} has no ${implementation} to register` };
-    let entry: Entry = withFields({ ...template, id: undefined, name }, values);
-    if (resource === "downloadclient") entry.enable = true;
-    else {
-      entry.enableRss = template.supportsRss !== false;
-      entry.enableAutomaticSearch = template.supportsSearch !== false;
-      entry.enableInteractiveSearch = template.supportsSearch !== false;
-    }
-    let s = await appSave(http, app, resource, entry, true);
-    let note = "";
-    if (!s.ok && s.failures.length > 0 && s.failures.every((f) => /category/i.test(f.property))) {
-      const emptied: Record<string, unknown> = {};
-      for (const f of entry.fields ?? []) if (/category$/i.test(f.name) && !/imported/i.test(f.name)) emptied[f.name] = "";
-      entry = withFields(entry, emptied);
-      s = await appSave(http, app, resource, entry, true);
-      note = " with its category left empty — the provider has none by the app's default name; set one in both";
-    }
-    if (!s.ok) return { what, result: "refused", problem: `${app.module} would not register it: ${said(s.failures)}` };
-    const created = s.saved;
-    if (created?.id !== undefined) {
-      const t = await appTest(http, app, resource, (await appGet(http, app, `/${resource}/${created.id}`)) as Entry);
-      if (!t.ok) {
-        return { what, result: "refused", problem: `registered as "${name}"${note}, and ${app.module}'s own test fails: ${said(t.failures)}` };
-      }
-    }
-    return note
-      ? { what, result: "notice", note: `registered as "${name}"${note}` }
-      : { what, result: "created", fields: Object.keys(values) };
-  } catch (err) {
-    return { what, result: "refused", problem: message(err) };
-  }
-}
-
-// ---------------------------------------------------------------------------------------------
-// Providers: does it take the credential?
-
-/**
- * Does the provider take this credential? `took` it does (for jackett, with the ids of the indexers
- * it has configured); `refused` it said no; a thrown error when it could not be asked.
- */
-export interface Took {
-  took: boolean;
-  configured?: Map<string, string>;
-}
-
-export async function providerTakes(http: Http, provision: string, ep: Endpoint): Promise<Took> {
-  const base = baseUrl(ep);
-  if (provision === "nzbget-api") {
-    const auth = Buffer.from(`${ep.username}:${ep.credential}`).toString("base64");
-    const res = await http.fetch(`${base}/jsonrpc/version`, { method: "GET", headers: { Authorization: `Basic ${auth}` } });
-    await res.text();
-    if (res.status === 401 || res.status === 403) return { took: false };
-    if (res.status >= 200 && res.status < 300) return { took: true };
-    throw new Error(`nzbget answered ${res.status}`);
-  }
-  if (provision === "qbittorrent-api") {
-    const form = `username=${encodeURIComponent(ep.username)}&password=${encodeURIComponent(ep.credential)}`;
-    const res = await http.fetch(`${base}/api/v2/auth/login`, {
-      method: "POST",
-      headers: { "Content-Type": "application/x-www-form-urlencoded" },
-      body: form,
-    });
-    const text = (await res.text()).trim();
-    if (res.status === 401 || /^fails\.?$/i.test(text)) return { took: false };
-    if (res.status === 403) {
-      throw new Error(
-        "qBittorrent answered 403: it has banned this address after failed logins (WebUI\\BanDuration); it lifts by itself",
-      );
-    }
-    if (res.status >= 200 && res.status < 300) return { took: true };
-    throw new Error(`qBittorrent answered ${res.status}`);
-  }
-  if (provision === JACKETT) {
-    const url = `${base}/api/v2.0/indexers/all/results/torznab/api?t=indexers&configured=true&apikey=${encodeURIComponent(ep.credential)}`;
-    const res = await http.fetch(url, { method: "GET" });
-    const text = await res.text();
-    if (res.status === 401 || res.status === 403) return { took: false };
-    if (res.status < 200 || res.status >= 300) throw new Error(`jackett answered ${res.status}`);
-    // jackett answers a wrong key 200 with an error document: code 100, "Invalid API Key".
-    if (/<error\b[^>]*\bcode="100"/i.test(text)) return { took: false };
-    if (/<error\b/i.test(text)) throw new Error("jackett answered with an error document");
-    return { took: true, configured: configuredIndexers(text) };
-  }
-  throw new Error(`no check for ${provision}`);
-}
-
-/** jackett's configured indexers, id → title, from its `t=indexers` feed. */
-export function configuredIndexers(xml: string): Map<string, string> {
-  const out = new Map<string, string>();
-  const re = /<indexer\b[^>]*\bid="([^"]+)"[^>]*>([\s\S]*?)<\/indexer>/g;
-  for (let m = re.exec(xml); m; m = re.exec(xml)) {
-    const title = /<title>([\s\S]*?)<\/title>/.exec(m[2])?.[1]?.trim() ?? m[1];
-    out.set(m[1], decodeXml(title));
-  }
-  return out;
-}
-
-function decodeXml(s: string): string {
-  return s.replace(/&lt;/g, "<").replace(/&gt;/g, ">").replace(/&quot;/g, '"').replace(/&apos;/g, "'").replace(/&amp;/g, "&");
-}
-
-/** The remedy for a refused credential, in the controller's own words (ADR 0092). */
-export function acceptRemedy(app: App, node: string, provision: string, provider: string, secretName: string, from: string): string {
-  return (
-    `${provider} refuses the ${provision} credential the mesh delivered, so nothing of ${provision} was written ` +
-    `into ${app.module}. ${provider} has one ${secretName} and the mesh cannot make it: accept it for this pair — ` +
-    `\`secret accept ${node || "<this node>"} ${app.module} ${provision} --provider ${from || "<its node>"} ` +
-    `--from <file holding ${provider}'s ${secretName}>\``
-  );
-}
-
-// ---------------------------------------------------------------------------------------------
-// Download clients
-
-/** The non-secret fields of a download client as the mesh says them. */
-export function clientConnection(ep: Endpoint): Record<string, unknown> {
-  return { host: ep.host, port: ep.port, useSsl: ep.scheme === "https", urlBase: ep.urlBase === "" ? null : ep.urlBase, username: ep.username };
-}
-
-/** Which of them the entry does not already say. Names only. */
-export function clientDiffers(e: Entry, ep: Endpoint): string[] {
-  const out: string[] = [];
-  if (String(field(e, "host") ?? "").toLowerCase() !== ep.host.toLowerCase()) out.push("host");
-  if (Number(field(e, "port") ?? 0) !== ep.port) out.push("port");
-  if (Boolean(field(e, "useSsl")) !== (ep.scheme === "https")) out.push("useSsl");
-  if (normBase(field(e, "urlBase")) !== ep.urlBase) out.push("urlBase");
-  if (String(field(e, "username") ?? "") !== ep.username) out.push("username");
-  return out;
-}
-
-/**
- * Bring the app's download client for one provision in line: the entry by that name and kind is
- * the mesh's and is updated; none, it is registered. An entry by that name of another kind, or by
- * that name in another case, is somebody else's and is refused rather than touched.
- */
-export async function reconcileClient(
-  http: Http,
-  app: App,
-  kind: ClientKind,
-  name: string,
-  ep: Endpoint,
-  entries: Entry[],
-): Promise<Outcome[]> {
-  const what = `${kind.provision} ("${name}")`;
-  const exact = entries.filter((e) => e.name === name);
-  const alike = entries.filter((e) => e.name !== name && String(e.name ?? "").toLowerCase() === name.toLowerCase());
-  if (exact.length > 0 && exact[0].implementation !== kind.implementation) {
-    return [{
-      what,
-      result: "refused",
-      problem: `the download client named "${name}" is a ${exact[0].implementation}, not ${kind.implementation}; it is not the mesh's and was left alone. Name the mesh's entry otherwise in downloads.${kind.provision}.name`,
-    }];
-  }
-  if (exact.length === 0 && alike.length > 0) {
-    return [{
-      what,
-      result: "refused",
-      problem: `${app.module} already has "${alike[0].name}", which is not the mesh's name ("${name}") and was left alone. To have the mesh manage it, set downloads.${kind.provision}.name to "${alike[0].name}"`,
-    }];
-  }
-  const outcomes: Outcome[] = [];
-  const others = entries.filter((e) => e.implementation === kind.implementation && e.name !== name);
-  if (others.length > 0) {
-    outcomes.push({
-      what,
-      result: "notice",
-      note: `also present and not the mesh's, left alone: ${others.map((o) => `"${o.name}"`).join(", ")}`,
-    });
-  }
-  if (exact.length === 0) {
-    outcomes.push(
-      await createEntry(http, app, "downloadclient", what, kind.implementation, name, {
-        ...clientConnection(ep),
-        password: ep.credential,
-      }),
-    );
-    return outcomes;
-  }
-  outcomes.push(
-    await reconcileEntry(http, app, "downloadclient", what, exact[0], clientConnection(ep), clientDiffers(exact[0], ep), "password", ep.credential),
-  );
-  return outcomes;
-}
-
-// ---------------------------------------------------------------------------------------------
-// Indexers
-
-const FEED = /\/api\/v2\.0\/indexers\/([^/]+)\/results\/torznab\/?$/;
-
-/** A Torznab entry reading a jackett feed: the host it points at and the jackett indexer's id. */
-export function jackettFeed(e: Entry): { host: string; id: string } | undefined {
-  if (e.implementation !== "Torznab") return undefined;
-  const raw = String(field(e, "baseUrl") ?? "").trim();
-  if (!raw) return undefined;
-  let u: URL;
-  try {
-    u = new URL(raw);
-  } catch {
-    return undefined;
-  }
-  const path = `${u.pathname.replace(/\/+$/, "")}/${String(field(e, "apiPath") ?? "").replace(/^\/+/, "")}`;
-  const m = FEED.exec(path);
-  if (!m) return undefined;
-  return { host: u.hostname.replace(/^\[|\]$/g, "").toLowerCase(), id: decodeURIComponent(m[1]) };
-}
-
-/** The feed's two fields as the mesh says them. */
-export function feedConnection(ep: Endpoint, id: string): Record<string, unknown> {
-  return { baseUrl: baseUrl(ep), apiPath: `/api/v2.0/indexers/${id}/results/torznab/` };
-}
-
-function sameUrl(a: string, b: string): boolean {
-  try {
-    const x = new URL(a);
-    const y = new URL(b);
-    const port = (u: URL) => u.port || (u.protocol === "https:" ? "443" : "80");
-    return (
-      x.protocol === y.protocol &&
-      x.hostname.toLowerCase() === y.hostname.toLowerCase() &&
-      port(x) === port(y) &&
-      x.pathname.replace(/\/+$/, "") === y.pathname.replace(/\/+$/, "")
-    );
-  } catch {
-    return false;
-  }
-}
-
-export function feedDiffers(e: Entry, ep: Endpoint, id: string): string[] {
-  const want = feedConnection(ep, id);
-  const out: string[] = [];
-  if (!sameUrl(String(field(e, "baseUrl") ?? ""), String(want.baseUrl))) out.push("baseUrl");
-  const path = (v: unknown) => `/${String(v ?? "").replace(/^\/+|\/+$/g, "")}`;
-  if (path(field(e, "apiPath")) !== path(want.apiPath)) out.push("apiPath");
-  return out;
-}
-
-export interface IndexerSettings {
-  /** Hosts whose jackett feeds the mesh takes over — a migration's old names. */
-  adoptHosts: string[];
-  /** jackett indexer ids the app should have. */
-  indexers: string[];
-}
-
-/**
- * Bring the app's jackett feeds in line: every one the mesh manages is pointed at the bound jackett
- * with its key, and every listed jackett indexer the app lacks is registered.
- */
-export async function reconcileIndexers(
-  http: Http,
-  app: App,
-  ep: Endpoint,
-  configured: Map<string, string>,
-  settings: IndexerSettings,
-  remembered: string[],
-  entries: Entry[],
-): Promise<Outcome[]> {
-  const ours = new Set([ep.host, ...settings.adoptHosts, ...remembered].map((h) => h.trim().toLowerCase()).filter(Boolean));
-  const outcomes: Outcome[] = [];
-  const managed = new Set<string>();
-  for (const e of entries) {
-    const feed = jackettFeed(e);
-    if (!feed || !ours.has(feed.host)) continue;
-    managed.add(feed.id);
-    const what = `jackett-api ("${e.name}", jackett indexer ${feed.id})`;
-    const known = feed.id === "all" || configured.has(feed.id);
-    const outcome = await reconcileEntry(
-      http, app, "indexer", what, e, feedConnection(ep, feed.id), feedDiffers(e, ep, feed.id), "apiKey", ep.credential, known,
-    );
-    outcomes.push(outcome);
-    if (!known && outcome.result !== "refused") {
-      outcomes.push({ what, result: "notice", note: `jackett has no indexer "${feed.id}" configured, so it was not tested; configure it in jackett or remove the entry in ${app.module}` });
-    }
-  }
-  for (const id of settings.indexers) {
-    if (managed.has(id)) continue;
-    const what = `jackett-api (jackett indexer ${id})`;
-    if (id !== "all" && !configured.has(id)) {
-      outcomes.push({ what, result: "refused", problem: `downloads.jackett-api.indexers lists "${id}", and jackett has no indexer by that id configured` });
-      continue;
-    }
-    const name = `Jackett - ${id === "all" ? "all" : configured.get(id)}`;
-    outcomes.push(await createEntry(http, app, "indexer", what, "Torznab", name, { ...feedConnection(ep, id), apiKey: ep.credential }));
-  }
-  if (outcomes.length === 0) {
-    outcomes.push({ what: "jackett-api", result: "notice", note: `${app.module} has no jackett feed the mesh manages, and downloads.jackett-api.indexers lists none to register` });
-  }
-  return outcomes;
-}
-
-// ---------------------------------------------------------------------------------------------
-// Files
-
-/** The module's settings for this step, from its merged `downloads.json`. */
-export interface StepSettings {
-  node: string;
-  names: Record<string, string>;
-  indexers: IndexerSettings;
-}
-
-export function stepSettings(raw: unknown): StepSettings {
-  const doc = (raw ?? {}) as Record<string, unknown>;
-  const d = (doc.downloads ?? {}) as Record<string, Record<string, unknown> | undefined>;
-  const names: Record<string, string> = {};
-  for (const k of CLIENTS) {
-    const n = d[k.provision]?.name;
-    names[k.provision] = typeof n === "string" && n.trim() ? n.trim() : k.provision.replace(/-api$/, "");
-  }
-  const j = d[JACKETT] ?? {};
-  const strings = (v: unknown) => (Array.isArray(v) ? v.filter((x): x is string => typeof x === "string" && x.trim() !== "").map((x) => x.trim()) : []);
-  return {
-    node: typeof doc.node === "string" ? doc.node : "",
-    names,
-    indexers: { adoptHosts: strings(j["adopt-hosts"]), indexers: strings(j.indexers) },
-  };
-}
-
-/** The app's own key and base path, from its config.xml. */
-export function appConfig(xml: string): { apiKey: string; urlBase: string } {
-  const tag = (t: string) => new RegExp(`<${t}>([^<]*)</${t}>`).exec(xml)?.[1]?.trim() ?? "";
-  return { apiKey: tag("ApiKey"), urlBase: normBase(tag("UrlBase")) };
-}
-
-/** A file the mesh wrote, or undefined when it is not there. */
-export async function readIfThere(path: string | undefined): Promise<string | undefined> {
-  if (!path) return undefined;
-  return readFile(path, "utf8").catch(() => undefined);
-}
-
-/** A JSON file parsed, or undefined when absent or not JSON. */
-export async function readJson(path: string | undefined): Promise<unknown> {
-  const raw = await readIfThere(path);
-  if (raw === undefined) return undefined;
-  try {
-    return JSON.parse(raw) as unknown;
-  } catch {
-    return undefined;
-  }
-}
-
-/** Wait for the app to answer, because the step runs right after its container starts. */
-export async function appReady(http: Http, app: App, waitMs: number, pauseMs = 2000): Promise<boolean> {
-  const until = Date.now() + waitMs;
-  for (;;) {
-    try {
-      const a = await appCall(http, app, "GET", "/system/status");
-      if (a.status === 200) return true;
-    } catch {
-      // not listening yet
-    }
-    if (Date.now() >= until) return false;
-    await new Promise((r) => setTimeout(r, pauseMs));
-  }
-}
-
-export async function listEntries(http: Http, app: App, resource: "downloadclient" | "indexer"): Promise<Entry[]> {
-  return ((await appGet(http, app, `/${resource}`)) as Entry[]) ?? [];
-}
-
-/** Anything printed goes through this: the credentials the step holds never reach a log. */
-export function scrub(text: string, secrets: string[]): string {
-  let out = text;
-  for (const s of secrets) if (s && s.length >= 4) out = out.split(s).join("<redacted>");
-  return out;
-}
-
-function message(err: unknown): string {
-  return err instanceof Error ? err.message : String(err);
-}

modules/lidarr/index.ts

@@ -40,12 +40,12 @@ async function pollQueue(lidarr: LidarrClient): Promise<void> {
   if (primed) {
     // Entered the queue since last look — Lidarr grabbed a release.
     for (const [id, item] of now) {
-      if (!inQueue.has(id)) await emit("album.grabbed", { title: item.title, status: item.status });
+      if (!inQueue.has(id)) await emit("module.lidarr.album.grabbed", { title: item.title, status: item.status });
     }
     // Left the queue — imported and done, unless it was last seen failing.
     for (const [id, item] of inQueue) {
       if (!now.has(id) && !FAILED_STATUSES.has(item.status)) {
-        await emit("download.completed", { title: item.title });
+        await emit("module.lidarr.download.completed", { title: item.title });
       }
     }
   }

modules/lidarr/module.json

@@ -1,25 +1,12 @@
 {
   "module": "lidarr",
   "version": "1",
-  "provides": [
-    {
-      "name": "lidarr-api",
-      "scope": "mesh"
-    }
-  ],
-  "serves": {
-    "lidarr-api": {
-      "scheme": "http",
-      "port": 8686,
-      "url-base": ""
-    }
-  },
   "capabilities": [
     "container-runtime"
   ],
   "emits": [
-    "album.grabbed",
-    "download.completed"
+    "module.lidarr.album.grabbed",
+    "module.lidarr.download.completed"
   ],
   "consumes": [],
   "own-secrets": {
@@ -27,7 +14,6 @@
   },
   "listens": [
     {
-      "name": "web",
       "port": 8686,
       "protocol": "tcp",
       "from": "mesh",
@@ -51,33 +37,18 @@
       "path": "/var/lib/mesh/lidarr",
       "mode": "0700"
     },
-    {
-      "id": "state",
-      "type": "directory",
-      "mode": "0700",
-      "place": "."
-    },
     {
       "id": "config",
       "type": "directory",
+      "path": "/services/lidarr/config",
       "mode": "0700",
       "owner": "1000:1000"
     },
-    {
-      "id": "custom-cont-init",
-      "type": "directory",
-      "mode": "0755"
-    },
-    {
-      "id": "custom-services",
-      "type": "directory",
-      "mode": "0755"
-    },
     {
       "id": "server",
       "type": "container",
       "name": "lidarr",
-      "image": "lscr.io/linuxserver/lidarr@sha256:8ab0fd370b604ae034d9a9c261a9d8d873bece33d9736852e7ce4f3566e4a35d",
+      "image": "lscr.io/linuxserver/lidarr@sha256:6b38dd330b0c653351c2e23c8b962ea51c95683dd7acace9d106c922baf85f75",
       "env": {
         "PUID": "1000",
         "PGID": "1000",
@@ -87,9 +58,7 @@
         "8686"
       ],
       "volumes": [
-        "${dir:config}:/config",
-        "${dir:custom-cont-init}:/custom-cont-init.d",
-        "${dir:custom-services}:/custom-services.d",
+        "/services/lidarr/config:/config",
         "/services/media/music:/music",
         "/services/media/downloads:/downloads"
       ]
@@ -101,92 +70,27 @@
       "network": "host",
       "volumes": [
         "/var/lib/mesh/lidarr/broker:/run/secrets/broker:ro",
-        "${dir:config}:/var/lib/lidarr/config:ro"
+        "/services/lidarr/config:/var/lib/lidarr/config:ro"
       ],
       "env": {
         "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_LIDARR_URL": "http://127.0.0.1:${port:8686}",
+        "MESH_LIDARR_URL": "http://127.0.0.1:8686",
         "MESH_LIDARR_CONFIG_DIR": "/var/lib/lidarr/config"
       },
       "artifact": "runtime"
-    },
-    {
-      "id": "downloads-config",
-      "type": "file",
-      "path": "${dir:state}/downloads.json",
-      "mode": "0600",
-      "content": "{\n  \"node\": \"${machine:name}\",\n  \"downloads\": {\n    \"nzbget-api\": {\n      \"name\": \"nzbget\"\n    },\n    \"qbittorrent-api\": {\n      \"name\": \"qbittorrent\"\n    },\n    \"jackett-api\": {\n      \"adopt-hosts\": [],\n      \"indexers\": []\n    }\n  }\n}\n",
-      "merge": "json"
-    },
-    {
-      "id": "downloads-memory",
-      "type": "directory",
-      "mode": "0700"
-    },
-    {
-      "id": "downloads",
-      "type": "container",
-      "name": "mesh-lidarr-downloads",
-      "network": "host",
-      "run-once": true,
-      "volumes": [
-        "${dir:state}/downloads.json:/run/downloads/downloads.json:ro",
-        "${dir:state}/nzbget-api.json:/run/downloads/nzbget-api.json:ro",
-        "${dir:state}/nzbget-api.secret:/run/downloads/nzbget-api.secret:ro",
-        "${dir:state}/qbittorrent-api.json:/run/downloads/qbittorrent-api.json:ro",
-        "${dir:state}/qbittorrent-api.secret:/run/downloads/qbittorrent-api.secret:ro",
-        "${dir:state}/jackett-api.json:/run/downloads/jackett-api.json:ro",
-        "${dir:state}/jackett-api.secret:/run/downloads/jackett-api.secret:ro",
-        "${dir:config}:/var/lib/lidarr/config:ro",
-        "${dir:downloads-memory}:/var/lib/downloads"
-      ],
-      "env": {
-        "MESH_DOWNLOADS_APP": "lidarr",
-        "MESH_DOWNLOADS_API": "v1",
-        "MESH_DOWNLOADS_APP_URL": "http://127.0.0.1:${port:8686}",
-        "MESH_DOWNLOADS_APP_CONFIG": "/var/lib/lidarr/config/config.xml",
-        "MESH_DOWNLOADS_DIR": "/run/downloads",
-        "MESH_DOWNLOADS_SETTINGS": "/run/downloads/downloads.json",
-        "MESH_DOWNLOADS_MEMORY": "/var/lib/downloads/memory.json"
-      },
-      "args": [
-        "run",
-        "/app/modules/lidarr/dist/downloads/index.js"
-      ],
-      "restart-on": [
-        "downloads-config",
-        "bound-nzbget-api",
-        "secret-nzbget-api",
-        "bound-qbittorrent-api",
-        "secret-qbittorrent-api",
-        "bound-jackett-api",
-        "secret-jackett-api"
-      ],
-      "artifact": "runtime"
     }
   ],
   "requires": [
-    "jackett-api",
-    "nzbget-api",
-    "qbittorrent-api",
     "route"
   ],
   "contributes": {
     "route": {
       "label": "lidarr",
-      "endpoint": "web"
+      "port": 8686
     }
   },
   "binds": {
-    "route": "${dir:state}/route.json",
-    "nzbget-api": "${dir:state}/nzbget-api.json",
-    "qbittorrent-api": "${dir:state}/qbittorrent-api.json",
-    "jackett-api": "${dir:state}/jackett-api.json"
-  },
-  "secrets": {
-    "nzbget-api": "${dir:state}/nzbget-api.secret",
-    "qbittorrent-api": "${dir:state}/qbittorrent-api.secret",
-    "jackett-api": "${dir:state}/jackett-api.secret"
+    "route": "/var/lib/mesh/lidarr/route.json"
   },
   "build": {
     "on": [

modules/lidarr/package.json

@@ -4,11 +4,6 @@
   "description": "lidarr — music management. Its API client, tools and events live here (novox/hq ADR 0039).",
   "type": "module",
   "private": true,
-  "scripts": {
-    "build": "tsc client.ts index.ts tools/index.ts downloads/settings.ts downloads/index.ts --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist",
-    "typecheck": "tsc -p tsconfig.json",
-    "test": "node --test --experimental-strip-types 'test/*.test.ts'"
-  },
   "dependencies": {
     "@novox/mesh-sdk": "^0.1.0"
   },

modules/lidarr/test/downloads.test.ts

@@ -1,365 +0,0 @@
-// What holds the downloads step (downloads/settings.ts): the app's download clients and jackett
-// feeds are made to say what the mesh bound — host, port, TLS, base path, user, credential — and
-// nothing else they keep is touched; only the mesh's entries are touched, and nothing is ever
-// deleted; nothing is written when nothing differs; a missing one is registered; and a credential
-// the provider refuses (the mesh's own minted value, before the operator accepts the provider's)
-// is never written, with the `secret accept` that fixes it named.
-//
-// The app and the providers are fakes: the routes the step touches, answering as the real ones do
-// (checked against the catalogue's pinned sonarr, radarr, lidarr, bookshelf, nzbget, qBittorrent
-// and jackett): the app masks a stored password as "********", tests an enabled entry before
-// saving it, refuses a warning unless forceSave, and jackett answers a wrong key 200 with an error.
-
-import { test } from "node:test";
-import assert from "node:assert/strict";
-import { existsSync, readFileSync } from "node:fs";
-import { dirname, join } from "node:path";
-import { fileURLToPath } from "node:url";
-
-import {
-  CLIENTS,
-  acceptRemedy,
-  jackettFeed,
-  providerTakes,
-  reconcileClient,
-  reconcileIndexers,
-  stepSettings,
-  wanted,
-  type App,
-  type Binding,
-  type Endpoint,
-  type Entry,
-  type Http,
-} from "../downloads/settings.ts";
-
-const NZBGET = CLIENTS.find((c) => c.provision === "nzbget-api")!;
-const QBIT = CLIENTS.find((c) => c.provision === "qbittorrent-api")!;
-const APP: App = { module: "sonarr", url: "http://127.0.0.1:8989", apiKey: "app-key", api: "v3" };
-const MASK = "********";
-
-interface Provider {
-  host: string;
-  port: number;
-  user?: string;
-  secret: string;
-  configured?: Record<string, string>;
-}
-
-const nzbget: Provider = { host: "ace.internal", port: 20201, user: "luffy", secret: "nzb-real" };
-const qbit: Provider = { host: "ace.internal", port: 8112, user: "luffy", secret: "qbt-real" };
-const jackett: Provider = { host: "ace.internal", port: 20204, secret: "jackett-real", configured: { rutracker: "RuTracker", torrent9: "Torrent9" } };
-
-function binding(p: Provider, provision: string, extra: Record<string, unknown> = {}): Binding {
-  return {
-    provision,
-    from: "ace",
-    at: p.host,
-    as: "mesh_ace_sonarr",
-    serves: { scheme: "http", port: p.port, "url-base": "", ...(p.user ? { username: p.user } : {}), ...extra },
-  };
-}
-
-function endpoint(p: Provider, provision: string, credential = p.secret): Endpoint {
-  const w = wanted(provision, binding(p, provision), credential, provision !== "jackett-api");
-  if (!w.ok) throw new Error(w.problem);
-  return w.endpoint;
-}
-
-const f = (name: string, value: unknown) => ({ name, value });
-
-function client(id: number, name: string, implementation: string, host: string, port: number, password: string, extra: Record<string, unknown> = {}): Entry {
-  return {
-    id, name, implementation, enable: true, priority: 1, tags: [],
-    fields: [f("host", host), f("port", port), f("useSsl", false), f("urlBase", null), f("username", "luffy"), f("password", password), f("tvCategory", "Series"), ...Object.entries(extra).map(([k, v]) => f(k, v))],
-  };
-}
-
-function feed(id: number, name: string, baseUrl: string, jid: string, key: string, on = true): Entry {
-  return {
-    id, name, implementation: "Torznab", enableRss: on, enableAutomaticSearch: on, enableInteractiveSearch: on, priority: 25,
-    fields: [f("baseUrl", baseUrl), f("apiPath", `/api/v2.0/indexers/${jid}/results/torznab/`), f("apiKey", key), f("categories", [5000])],
-  };
-}
-
-interface Call {
-  method: string;
-  url: string;
-  body?: unknown;
-}
-
-/** A Servarr app and the three providers behind one fetch. */
-function fakes(start: { clients?: Entry[]; indexers?: Entry[] }) {
-  const calls: Call[] = [];
-  const store: Record<string, Entry[]> = {
-    downloadclient: structuredClone(start.clients ?? []),
-    indexer: structuredClone(start.indexers ?? []),
-  };
-  let next = 100;
-  const secretOf: Record<string, string> = { downloadclient: "password", indexer: "apiKey" };
-  const masked = (e: Entry): Entry => ({ ...e, fields: e.fields!.map((x) => (x.name === "password" || x.name === "apiKey") && x.value ? { ...x, value: MASK } : { ...x }) });
-  const val = (e: Entry, n: string) => e.fields?.find((x) => x.name === n)?.value;
-
-  /** What the app's own test says: dialled from its container, with its stored secret for a mask. */
-  const appTest = (kind: string, e: Entry): { propertyName: string; errorMessage: string; isWarning: boolean }[] => {
-    let secret = val(e, secretOf[kind]);
-    if (secret === MASK) secret = val(store[kind].find((s) => s.id === e.id) ?? {}, secretOf[kind]);
-    if (kind === "downloadclient") {
-      const p = e.implementation === "Nzbget" ? nzbget : qbit;
-      if (val(e, "host") !== p.host || val(e, "port") !== p.port) return [{ propertyName: "Host", errorMessage: "Unable to connect", isWarning: false }];
-      if (secret !== p.secret || val(e, "username") !== p.user) return [{ propertyName: "Username", errorMessage: "Authentication Failure", isWarning: false }];
-      if (val(e, "tvCategory") === "") return [{ propertyName: "TvCategory", errorMessage: "A category is recommended", isWarning: true }];
-      if (e.implementation === "Nzbget" && val(e, "tvCategory") === "tv") return [{ propertyName: "TvCategory", errorMessage: "Category does not exist", isWarning: false }];
-      return [];
-    }
-    const u = new URL(String(val(e, "baseUrl")));
-    if (u.hostname !== jackett.host || Number(u.port) !== jackett.port) return [{ propertyName: "BaseUrl", errorMessage: "Unable to connect", isWarning: false }];
-    if (secret !== jackett.secret) return [{ propertyName: "ApiKey", errorMessage: "Invalid API Key", isWarning: false }];
-    const id = /indexers\/([^/]+)\//.exec(String(val(e, "apiPath")))?.[1] ?? "";
-    if (!(id in jackett.configured!)) return [{ propertyName: "", errorMessage: "Unknown indexer", isWarning: false }];
-    return [];
-  };
-
-  const http: Http = {
-    async fetch(url, init) {
-      const method = init?.method ?? "GET";
-      const body = init?.body && init.headers?.["Content-Type"] === "application/json" ? (JSON.parse(init.body) as Entry) : init?.body;
-      calls.push({ method, url, body });
-      const reply = (status: number, value?: unknown) => ({ status, text: async () => (value === undefined ? "" : typeof value === "string" ? value : JSON.stringify(value)) });
-      const u = new URL(url);
-      // Providers.
-      if (u.pathname === "/jsonrpc/version") {
-        const want = "Basic " + Buffer.from(`${nzbget.user}:${nzbget.secret}`).toString("base64");
-        return init?.headers?.Authorization === want ? reply(200, { result: "26.0" }) : reply(401);
-      }
-      if (u.pathname === "/api/v2/auth/login") {
-        const form = new URLSearchParams(String(init?.body ?? ""));
-        return form.get("username") === qbit.user && form.get("password") === qbit.secret ? reply(204) : reply(401, "Unauthorized");
-      }
-      if (u.pathname.endsWith("/torznab/api")) {
-        if (u.searchParams.get("apikey") !== jackett.secret) return reply(200, '<?xml version="1.0"?><error code="100" description="Invalid API Key" />');
-        const items = Object.entries(jackett.configured!).map(([id, t]) => `<indexer id="${id}" configured="true"><title>${t}</title></indexer>`).join("");
-        return reply(200, `<?xml version="1.0"?><indexers>${items}</indexers>`);
-      }
-      // The app.
-      if (init?.headers?.["X-Api-Key"] !== APP.apiKey) return reply(401);
-      const m = /^\/api\/v3\/(downloadclient|indexer)(?:\/(schema|test|\d+))?$/.exec(u.pathname);
-      if (!m) return reply(404);
-      const [, kind, sub] = m;
-      const force = u.searchParams.get("forceSave") === "true";
-      if (method === "GET" && !sub) return reply(200, store[kind].map(masked));
-      if (method === "GET" && sub === "schema") {
-        return reply(200, kind === "downloadclient"
-          ? [client(0, "", "Nzbget", "localhost", 6789, MASK, {}), client(0, "", "QBittorrent", "localhost", 8080, "", {})].map((e) => ({ ...e, fields: e.fields!.map((x) => x.name === "tvCategory" ? { ...x, value: e.implementation === "Nzbget" ? "tv" : "tv-sonarr" } : x.name === "username" ? { ...x, value: null } : x) }))
-          : [{ ...feed(0, "", "", "x", "", false), supportsRss: true, supportsSearch: true, fields: [f("baseUrl", null), f("apiPath", "/api"), f("apiKey", null), f("categories", [5030, 5040])] }]);
-      }
-      if (method === "GET") {
-        const e = store[kind].find((s) => s.id === Number(sub));
-        return e ? reply(200, masked(e)) : reply(404);
-      }
-      if (method === "POST" && sub === "test") {
-        const fails = appTest(kind, body as Entry);
-        return fails.length ? reply(400, fails) : reply(200);
-      }
-      // Save: tested when enabled; a mask keeps what is stored.
-      const e = body as Entry;
-      const on = e.enable === true || e.enableRss === true || e.enableAutomaticSearch === true;
-      if (on) {
-        const fails = appTest(kind, e);
-        if (fails.some((x) => !x.isWarning) || (fails.length && !force)) return reply(400, fails);
-      }
-      if (method === "POST" && !sub) {
-        if (store[kind].some((s) => String(s.name).toLowerCase() === String(e.name).toLowerCase())) {
-          return reply(400, [{ propertyName: "Name", errorMessage: "Should be unique", isWarning: false }]);
-        }
-        const created = { ...e, id: next++ };
-        store[kind].push(created);
-        return reply(201, masked(created));
-      }
-      if (method === "PUT") {
-        const i = store[kind].findIndex((s) => s.id === Number(sub));
-        if (i < 0) return reply(404);
-        const was = store[kind][i];
-        store[kind][i] = { ...e, fields: e.fields!.map((x) => x.value === MASK ? { ...x, value: val(was, x.name) } : x) };
-        return reply(202, masked(store[kind][i]));
-      }
-      return reply(405);
-    },
-  };
-  const saves = () => calls.filter((c) => (c.method === "PUT" || (c.method === "POST" && !c.url.endsWith("/test"))) && c.url.includes("/api/v3/"));
-  return { http, calls, store, saves };
-}
-
-const aceClients = () => [
-  client(1, "NZBGet", "Nzbget", "nzbget", 6789, "nzb-real"),
-  client(2, "qBitTorrent", "QBittorrent", "qbittorrent", 8112, "qbt-real"),
-];
-
-test("the migration's download client is repointed, its category and everything else kept", async () => {
-  const f = fakes({ clients: aceClients() });
-  const out = await reconcileClient(f.http, APP, NZBGET, "NZBGet", endpoint(nzbget, "nzbget-api"), f.store.downloadclient.map((e) => ({ ...e })));
-  assert.deepEqual(out, [{ what: 'nzbget-api ("NZBGet")', result: "written", fields: ["host", "port"] }]);
-  const saved = f.store.downloadclient.find((e) => e.id === 1)!;
-  const v = (n: string) => saved.fields!.find((x) => x.name === n)?.value;
-  assert.equal(v("host"), "ace.internal");
-  assert.equal(v("port"), 20201);
-  assert.equal(v("tvCategory"), "Series");
-  assert.equal(v("password"), "nzb-real", "the password it held works, so it was kept, not rewritten");
-  assert.equal(saved.priority, 1);
-});
-
-test("rerun: already as the mesh says, nothing saved", async () => {
-  const f = fakes({ clients: [client(1, "NZBGet", "Nzbget", "ace.internal", 20201, "nzb-real")] });
-  const out = await reconcileClient(f.http, APP, NZBGET, "NZBGet", endpoint(nzbget, "nzbget-api"), f.store.downloadclient);
-  assert.deepEqual(out, [{ what: 'nzbget-api ("NZBGet")', result: "unchanged" }]);
-  assert.equal(f.saves().length, 0);
-});
-
-test("a stale password is replaced by the delivered one, which the provider took first", async () => {
-  const f = fakes({ clients: [client(2, "qBitTorrent", "QBittorrent", "ace.internal", 8112, "old-pass")] });
-  const out = await reconcileClient(f.http, APP, QBIT, "qBitTorrent", endpoint(qbit, "qbittorrent-api"), f.store.downloadclient);
-  assert.deepEqual(out, [{ what: 'qbittorrent-api ("qBitTorrent")', result: "written", fields: ["password"] }]);
-  assert.equal(f.store.downloadclient[0].fields!.find((x) => x.name === "password")?.value, "qbt-real");
-});
-
-test("a minted credential is refused by the provider: nothing written, the accept named", async () => {
-  const f = fakes({ clients: aceClients() });
-  const ep = endpoint(nzbget, "nzbget-api", "a-value-the-mesh-minted");
-  assert.deepEqual(await providerTakes(f.http, "nzbget-api", ep), { took: false });
-  const remedy = acceptRemedy(APP, "ace", "nzbget-api", "nzbget", "ControlPassword", ep.from);
-  assert.match(remedy, /`secret accept ace sonarr nzbget-api --provider ace --from <file holding nzbget's ControlPassword>`/);
-  assert.doesNotMatch(remedy, /minted/);
-  assert.equal(f.calls.some((c) => c.url.includes("/api/v3/")), false, "the app was not even asked");
-  const q = endpoint(qbit, "qbittorrent-api", "minted");
-  assert.deepEqual(await providerTakes(f.http, "qbittorrent-api", q), { took: false });
-  const j = endpoint(jackett, "jackett-api", "minted");
-  assert.deepEqual(await providerTakes(f.http, "jackett-api", j), { took: false });
-  assert.equal(f.calls.find((c) => c.url.includes("apikey="))?.url.includes("jackett-real"), false);
-});
-
-test("a fresh app gets the mesh's client registered, under the mesh's name", async () => {
-  const f = fakes({});
-  const out = await reconcileClient(f.http, APP, QBIT, "qbittorrent", endpoint(qbit, "qbittorrent-api"), []);
-  assert.equal(out[0].result, "created");
-  const e = f.store.downloadclient[0];
-  assert.equal(e.name, "qbittorrent");
-  assert.equal(e.enable, true);
-  assert.equal(e.fields!.find((x) => x.name === "tvCategory")?.value, "tv-sonarr", "the app's own default category");
-});
-
-test("nzbget without the app's default category: registered with none, and said", async () => {
-  const f = fakes({});
-  const out = await reconcileClient(f.http, APP, NZBGET, "nzbget", endpoint(nzbget, "nzbget-api"), []);
-  assert.equal(out[0].result, "notice");
-  assert.match((out[0] as { note: string }).note, /category left empty/);
-  assert.equal(f.store.downloadclient[0].fields!.find((x) => x.name === "tvCategory")?.value, "");
-});
-
-test("somebody else's entries are never touched: another name of the same kind, and a clash of names", async () => {
-  const mine = client(7, "My seedbox", "QBittorrent", "seedbox.example", 443, "theirs");
-  const f = fakes({ clients: [mine] });
-  const out = await reconcileClient(f.http, APP, QBIT, "qbittorrent", endpoint(qbit, "qbittorrent-api"), f.store.downloadclient);
-  assert.equal(out[0].result, "notice");
-  assert.deepEqual(f.store.downloadclient.find((e) => e.id === 7), mine);
-  // Same name in another case: refused, and the setting that adopts it named.
-  const g = fakes({ clients: aceClients() });
-  const clash = await reconcileClient(g.http, APP, NZBGET, "nzbget", endpoint(nzbget, "nzbget-api"), g.store.downloadclient);
-  assert.equal(clash[0].result, "refused");
-  assert.match((clash[0] as { problem: string }).problem, /downloads\.nzbget-api\.name to "NZBGet"/);
-  assert.equal(g.saves().length, 0);
-});
-
-test("jackett feeds: the migration's are repointed, a person's is left, a listed one is registered", async () => {
-  const personal = feed(9, "Seedbox jackett", "https://jackett.seedbox.example", "rutracker", "their-key");
-  const f = fakes({
-    indexers: [
-      feed(5, "Torznab - RuTracker", "https://indexers.zurag.be", "rutracker-ru", "jackett-real", false),
-      feed(6, "Torznab - Torrent9", "https://indexers.zurag.be", "torrent9", "jackett-real", false),
-      feed(4, "Jackett - RARBG", "http://jackett:9117", "therarbg", "old", false),
-      personal,
-    ],
-  });
-  const configured = new Map(Object.entries(jackett.configured!));
-  const out = await reconcileIndexers(
-    f.http, APP, endpoint(jackett, "jackett-api"), configured,
-    { adoptHosts: ["indexers.zurag.be", "jackett"], indexers: ["rutracker"] }, [], f.store.indexer,
-  );
-  const byWhat = Object.fromEntries(out.map((o) => [o.what + ":" + o.result, o]));
-  // torrent9: jackett has it; repointed, key already right, tested.
-  assert.ok(byWhat['jackett-api ("Torznab - Torrent9", jackett indexer torrent9):written']);
-  // rutracker-ru and therarbg: jackett has neither — repointed with the key, untested, and said.
-  assert.ok(byWhat['jackett-api ("Jackett - RARBG", jackett indexer therarbg):written']);
-  assert.ok(byWhat['jackett-api ("Jackett - RARBG", jackett indexer therarbg):notice']);
-  // rutracker is listed and nothing of the mesh's reads it: registered.
-  assert.ok(byWhat["jackett-api (jackett indexer rutracker):created"]);
-  assert.deepEqual(f.store.indexer.find((e) => e.id === 9), personal, "a person's jackett is not the mesh's");
-  const t9 = f.store.indexer.find((e) => e.id === 6)!;
-  assert.equal(t9.fields!.find((x) => x.name === "baseUrl")?.value, "http://ace.internal:20204");
-  assert.equal(t9.enableRss, false, "disabled stays disabled");
-  const created = f.store.indexer.find((e) => e.name === "Jackett - RuTracker")!;
-  assert.equal(created.enableRss, true);
-  assert.equal(f.calls.some((c) => c.method === "DELETE"), false, "nothing is ever deleted");
-});
-
-test("jackett feeds rerun: nothing saved, and a remembered host keeps a moved jackett's feeds", async () => {
-  const f = fakes({ indexers: [feed(6, "Torznab - Torrent9", "http://ace.internal:20204", "torrent9", "jackett-real")] });
-  const configured = new Map(Object.entries(jackett.configured!));
-  const out = await reconcileIndexers(f.http, APP, endpoint(jackett, "jackett-api"), configured, { adoptHosts: [], indexers: ["torrent9"] }, [], f.store.indexer);
-  assert.deepEqual(out.map((o) => o.result), ["unchanged"]);
-  assert.equal(f.saves().length, 0);
-  // jackett moved to novox: the feed on ace.internal is still the mesh's because it was remembered.
-  const moved = { ...jackett, host: "novox.internal" };
-  const g = fakes({ indexers: [feed(6, "Torznab - Torrent9", "http://ace.internal:20204", "torrent9", "jackett-real")] });
-  const saved = jackett.host;
-  jackett.host = moved.host;
-  try {
-    const again = await reconcileIndexers(g.http, APP, endpoint(moved, "jackett-api"), configured, { adoptHosts: [], indexers: [] }, ["ace.internal"], g.store.indexer);
-    assert.equal(again[0].result, "written");
-    assert.equal(g.store.indexer[0].fields!.find((x) => x.name === "baseUrl")?.value, "http://novox.internal:20204");
-  } finally {
-    jackett.host = saved;
-  }
-});
-
-test("an enabled entry the app cannot test at the mesh's address is not saved", async () => {
-  const f = fakes({ clients: [client(1, "NZBGet", "Nzbget", "nzbget", 6789, "nzb-real")] });
-  const elsewhere = { ...nzbget, port: 1 };
-  const out = await reconcileClient(f.http, APP, NZBGET, "NZBGet", endpoint(elsewhere, "nzbget-api"), f.store.downloadclient);
-  assert.equal(out[0].result, "refused");
-  assert.equal(f.store.downloadclient[0].fields!.find((x) => x.name === "host")?.value, "nzbget", "left as it was");
-});
-
-test("bindings: loopback, no user, no credential are refused; the base path is normalised", () => {
-  assert.equal(wanted("nzbget-api", { ...binding(nzbget, "nzbget-api"), at: "127.0.0.1" }, "x", true).ok, false);
-  assert.equal(wanted("nzbget-api", binding({ ...nzbget, user: undefined }, "nzbget-api"), "x", true).ok, false);
-  assert.equal(wanted("nzbget-api", binding(nzbget, "nzbget-api"), "  \n", true).ok, false);
-  const w = wanted("jackett-api", binding(jackett, "jackett-api", { "url-base": "jackett/" }), "k", false);
-  assert.equal(w.ok && w.endpoint.urlBase, "/jackett");
-});
-
-test("a feed is read whole: base path in the base URL or in the API path", () => {
-  const e = feed(1, "x", "http://ace.internal:9117/jackett", "rutracker", "k");
-  assert.deepEqual(jackettFeed(e), { host: "ace.internal", id: "rutracker" });
-  assert.equal(jackettFeed({ ...e, implementation: "Newznab" }), undefined);
-  assert.equal(jackettFeed({ ...e, fields: [f("baseUrl", "https://api.nzbgeek.info"), f("apiPath", "/api")] }), undefined);
-});
-
-test("settings: names default to the provider's, adoption and registration read from the merged file", () => {
-  assert.deepEqual(stepSettings({ node: "ace" }), { node: "ace", names: { "nzbget-api": "nzbget", "qbittorrent-api": "qbittorrent" }, indexers: { adoptHosts: [], indexers: [] } });
-  const s = stepSettings({ node: "ace", downloads: { "nzbget-api": { name: "NZBGet" }, "jackett-api": { "adopt-hosts": ["jackett"], indexers: ["torrent9", 3] } } });
-  assert.equal(s.names["nzbget-api"], "NZBGet");
-  assert.deepEqual(s.indexers, { adoptHosts: ["jackett"], indexers: ["torrent9"] });
-});
-
-// The four copies are one step. Where the siblings are checked out beside this module, they must
-// be byte-identical — a fix made in one and not the others is a bug in three apps.
-test("the step is the same in sonarr, radarr, lidarr and bookshelf", () => {
-  const here = dirname(dirname(fileURLToPath(import.meta.url)));
-  const modules = dirname(here);
-  for (const file of ["downloads/settings.ts", "downloads/index.ts", "test/downloads.test.ts"]) {
-    const mine = readFileSync(join(here, file), "utf8");
-    for (const sibling of ["sonarr", "radarr", "lidarr", "bookshelf"]) {
-      const theirs = join(modules, sibling, file);
-      if (existsSync(theirs)) assert.equal(readFileSync(theirs, "utf8"), mine, `${sibling}/${file} differs`);
-    }
-  }
-});

modules/lidarr/tsconfig.json

@@ -8,5 +8,5 @@
     "skipLibCheck": true,
     "noEmit": true
   },
-  "include": ["client.ts", "index.ts", "tools/index.ts", "downloads/settings.ts", "downloads/index.ts"]
+  "include": ["client.ts", "index.ts", "tools/index.ts"]
 }

modules/mailu/index.ts

@@ -36,8 +36,8 @@ function watcher(created: string, deleted: string): (keys: string[]) => Promise<
   };
 }
 
-const watchUsers = watcher("user.created", "user.deleted");
-const watchAliases = watcher("alias.created", "alias.deleted");
+const watchUsers = watcher("module.mailu.user.created", "module.mailu.user.deleted");
+const watchAliases = watcher("module.mailu.alias.created", "module.mailu.alias.deleted");
 
 async function pollUsers(): Promise<void> {
   await watchUsers((await mailu.listUsers()).map((u) => u.email));

modules/mailu/module.json

@@ -16,27 +16,27 @@
     "route": {
       "web": {
         "label": "mail",
-        "endpoint": "web-tls",
+        "port": 7443,
         "scheme": "https",
         "insecure": true
       },
       "acme": {
         "label": "mail",
         "path": "/.well-known/acme-challenge",
-        "endpoint": "web",
+        "port": 7080,
         "priority": 100
       },
       "autoconfig": {
         "label": "autoconfig",
-        "endpoint": "autoconfig"
+        "port": 4243
       },
       "autodiscover": {
         "label": "autodiscover",
-        "endpoint": "autoconfig"
+        "port": 4243
       },
       "automx": {
         "label": "automx",
-        "endpoint": "autoconfig"
+        "port": 4243
       }
     }
   },
@@ -53,14 +53,13 @@
     }
   },
   "emits": [
-    "user.created",
-    "user.deleted",
-    "alias.created",
-    "alias.deleted"
+    "module.mailu.user.created",
+    "module.mailu.user.deleted",
+    "module.mailu.alias.created",
+    "module.mailu.alias.deleted"
   ],
   "listens": [
     {
-      "name": "smtp",
       "port": 25,
       "protocol": "tcp",
       "from": "anywhere",
@@ -68,7 +67,6 @@
       "fixed": true
     },
     {
-      "name": "pop3",
       "port": 110,
       "protocol": "tcp",
       "from": "anywhere",
@@ -76,7 +74,6 @@
       "fixed": true
     },
     {
-      "name": "imap",
       "port": 143,
       "protocol": "tcp",
       "from": "anywhere",
@@ -84,7 +81,6 @@
       "fixed": true
     },
     {
-      "name": "smtps",
       "port": 465,
       "protocol": "tcp",
       "from": "anywhere",
@@ -92,7 +88,6 @@
       "fixed": true
     },
     {
-      "name": "submission",
       "port": 587,
       "protocol": "tcp",
       "from": "anywhere",
@@ -100,7 +95,6 @@
       "fixed": true
     },
     {
-      "name": "imaps",
       "port": 993,
       "protocol": "tcp",
       "from": "anywhere",
@@ -108,7 +102,6 @@
       "fixed": true
     },
     {
-      "name": "pop3s",
       "port": 995,
       "protocol": "tcp",
       "from": "anywhere",
@@ -116,21 +109,18 @@
       "fixed": true
     },
     {
-      "name": "web",
       "port": 7080,
       "protocol": "tcp",
       "from": "mesh",
       "why": "the web front over http; only the ACME HTTP-01 passthrough is routed here \u2014 everything else 301s to https and would loop a proxy"
     },
     {
-      "name": "web-tls",
       "port": 7443,
       "protocol": "tcp",
       "from": "mesh",
       "why": "the web front over its own TLS (admin, webmail, API); the public name mail.novox.be is a route grant reaching it here"
     },
     {
-      "name": "autoconfig",
       "port": 4243,
       "protocol": "tcp",
       "from": "mesh",

modules/marrytts/module.json

@@ -6,7 +6,6 @@
   ],
   "listens": [
     {
-      "name": "api",
       "port": 59125,
       "protocol": "tcp",
       "from": "mesh",

modules/mesh-catalog/Dockerfile

@@ -22,7 +22,7 @@ COPY . .
 # The compiler is invoked by its real path rather than through node_modules/.bin, whose entries are
 # symlinks to a launcher that requires its library relatively — resolved away when the base image
 # was assembled.
-RUN node /app/node_modules/typescript/bin/tsc pg.d.ts store.ts index.ts tools/index.ts prepare/index.ts \
+RUN node /app/node_modules/typescript/bin/tsc pg.d.ts store.ts index.ts tools/index.ts \
       --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist
 
 # **A module may need something the base image does not carry.** The base holds what every module
@@ -48,8 +48,3 @@ COPY --from=build /deps/node_modules /app/modules/mesh-catalog/node_modules
 # to listen for what the builder announces. Serve binds the broker first, then imports these, so
 # `on()` has something to subscribe to.
 ENV MESH_TOOL_MODULES=/app/modules/mesh-catalog/dist/index.js,/app/modules/mesh-catalog/dist/tools/index.js
-
-# And what prepares this module's state, for the runtime's `prepare` mode (novox/hq ADR 0135). Named
-# here, beside the entrypoints above, because the module knows which of its files prepares its state
-# and nothing else could: the mesh asks one word and this says what answers it.
-ENV MESH_PREPARE=/app/modules/mesh-catalog/dist/prepare/index.js

modules/mesh-catalog/index.ts

@@ -1,6 +1,6 @@
 // mesh-catalog's entrypoint — the module graph's consumer (novox/hq ADR 0070, ADR 0072).
 //
-// The build-machine role announces what it built; this places it in the graph and announces what that means.
+// The builder announces what it built; this places it in the graph and announces what that means.
 // The control plane hooks the *meaning* — a module was upgraded — rather than the build output, so
 // it never has to interpret an artifact or ask this module anything.
 //
@@ -14,12 +14,10 @@ import { Graph, type Made } from "./store.js";
 
 const graph = Graph.fromEnv();
 
-// The schema is not brought up here. The mesh prepares this module's state before it starts this
-// version, and does not start it if that failed (novox/hq ADR 0135) — see prepare/index.ts. Doing it
-// at start made a schema that could not be reached a crash loop instead of a stop, with the graph
-// keeping a gap and nothing saying so. The reason it used to be here — that a step blocking the apply
-// would block the very apply that brings the overlay up — stopped being true when a step's failure
-// became this module's business and not the machine's (ADR 0136).
+// Before subscribing, and idempotent. The runtime is restarted until its store is reachable, which
+// is the same arrangement model-usage uses: a schema step that had to reach the provider over the
+// overlay would block the very apply that brings the overlay up.
+await graph.migrate();
 
 /** What the builder says when it has built something. */
 interface Built {
@@ -49,15 +47,7 @@ interface Built {
   replay?: boolean;
 }
 
-/**
- * What a build means for the graph, wherever it came from.
- *
- * Two emitters say the same thing and neither is a mistake: the build machine says it as it happens,
- * and the control plane says what it already held when this module asks what it missed
- * (novox/hq ADR 0134). A replay is marked as one in its body, so nothing acts on a module that moved
- * months ago — see `replay` above.
- */
-const placeTheBuild = async (event: { body: unknown }): Promise<void> => {
+await on("module.builder.built", async (event) => {
   const body = event.body as Built;
   if (!body.module || !body.commit) {
     // Said rather than dropped: a build that announced itself without saying what it built is a
@@ -79,7 +69,7 @@ const placeTheBuild = async (event: { body: unknown }): Promise<void> => {
   // it was missing, and the mesh is told nothing happened, because nothing did.
   if (body.replay) return;
 
-  await emit("registered", {
+  await emit("module.mesh-catalog.registered", {
     module: body.module, commit: body.commit, upgraded,
   });
 
@@ -87,23 +77,19 @@ const placeTheBuild = async (event: { body: unknown }): Promise<void> => {
   // through modules that did not change, forever (ADR 0072).
   if (!upgraded) return;
 
-  await emit("upgraded", {
+  await emit("module.mesh-catalog.upgraded", {
     module: body.module, commit: body.commit, previous,
   });
 
   // What can be built now — stale, and waiting on nothing that is itself stale.
   for (const next of await graph.buildable()) {
-    await emit("rebuild-needed", {
+    await emit("module.mesh-catalog.rebuild-needed", {
       module: next.module,
       builtAt: next.commit,
       because: next.because,
     });
   }
-};
-
-// As it happens, and what the mesh already held when this module asked what it missed.
-await on("mesh-build-machine.built", placeTheBuild);
-await on("mesh-controller.built-before", placeTheBuild);
+});
 
 // **And ask for what was built before this catalogue existed** (novox/hq 04-ISSUES/050).
 //
@@ -115,4 +101,4 @@ await on("mesh-controller.built-before", placeTheBuild);
 // Asked on every start, not only the first. A catalogue cannot tell whether it has a gap, and the
 // answer is idempotent: registering a build already held changes nothing and announces nothing.
 // Asked AFTER subscribing, so a build arriving during the replay is not lost between the two.
-await emit("catching-up", {});
+await emit("module.mesh-catalog.catching-up", {});

modules/mesh-catalog/module.json

@@ -29,16 +29,13 @@
     "broker": "/var/lib/mesh/mesh-catalog/broker"
   },
   "consumes": [
-    "mesh-build-machine.built",
-    "mesh-controller.built-before"
+    "module.builder.built"
   ],
   "emits": [
-    "registered",
-    "upgraded",
-    "rebuild-needed",
-    "catching-up"
+    "module.mesh-catalog.registered",
+    "module.mesh-catalog.upgraded",
+    "module.mesh-catalog.rebuild-needed"
   ],
-  "prepares": true,
   "resources": [
     {
       "id": "mesh-state",

modules/mesh-catalog/prepare/index.ts

@@ -1,17 +0,0 @@
-// The catalogue's state, brought to the shape this version needs (novox/hq ADR 0135).
-//
-// **The mesh runs this before the version that needs it, and does not start that version if it
-// fails** — and the refusal reaches this module and nothing else on the machine
-// (novox/hq ADR 0136). That is the whole difference from where this used to happen: at start, inside
-// the runtime, a schema that could not be brought up was a crash loop, the graph kept a gap, and
-// nothing anywhere said so.
-//
-// Nothing here connects to the broker. Preparation runs before the version that would use it, so
-// there is nothing yet to talk to; the runtime's `prepare` mode imports this and awaits it, and this
-// process exiting non-zero is how the host knows not to start the runtime.
-import { Graph } from "../store.js";
-
-const graph = Graph.fromEnv();
-await graph.migrate();
-console.log("[mesh-catalog] the module graph's schema is what this version needs");
-await graph.close();

modules/mesh-catalog/tsconfig.json

@@ -12,7 +12,6 @@
     "pg.d.ts",
     "store.ts",
     "index.ts",
-    "tools/index.ts",
-    "prepare/index.ts"
+    "tools/index.ts"
   ]
 }

modules/mesh-vault/index.ts

@@ -16,15 +16,15 @@ interface SecretEvent {
   rotations?: number;
 }
 
-await on<SecretEvent>("secret.provisioned", async (e) => {
+await on<SecretEvent>("module.mesh-vault.secret.provisioned", async (e) => {
   console.log(`[mesh-vault] secret provisioned for ${e.body.as} on ${e.body.consumer} (${e.body.fingerprint})`);
 });
 
-await on<SecretEvent>("secret.rotated", async (e) => {
+await on<SecretEvent>("module.mesh-vault.secret.rotated", async (e) => {
   console.log(`[mesh-vault] secret rotated for ${e.body.as} — rotation ${e.body.rotations} (${e.body.fingerprint})`);
 });
 
-await on<SecretEvent>("secret.deprovisioned", async (e) => {
+await on<SecretEvent>("module.mesh-vault.secret.deprovisioned", async (e) => {
   console.log(`[mesh-vault] secret withdrawn from ${e.body.as}`);
 });
 

modules/mesh-vault/module.json

@@ -11,14 +11,14 @@
     "container-runtime"
   ],
   "emits": [
-    "secret.provisioned",
-    "secret.rotated",
-    "secret.deprovisioned"
+    "module.mesh-vault.secret.provisioned",
+    "module.mesh-vault.secret.rotated",
+    "module.mesh-vault.secret.deprovisioned"
   ],
   "consumes": [
-    "mesh-vault.secret.provisioned",
-    "mesh-vault.secret.rotated",
-    "mesh-vault.secret.deprovisioned"
+    "module.mesh-vault.secret.provisioned",
+    "module.mesh-vault.secret.rotated",
+    "module.mesh-vault.secret.deprovisioned"
   ],
   "receives": {
     "secret": "/var/lib/mesh-vault/grants/mesh.json"

modules/mesh-vault/provisioner/index.ts

@@ -43,6 +43,6 @@ runProvisioner("secret", {
   async remove(p: { as: string }): Promise<void> {
     if (!ledger.withdraw(p.as)) return;
     console.log(`[mesh-vault] withdrawn: ${p.as}`);
-    await announce("secret.deprovisioned", { as: p.as });
+    await announce("module.mesh-vault.secret.deprovisioned", { as: p.as });
   },
 });

modules/minio/module.json

@@ -14,11 +14,11 @@
     "route": {
       "api": {
         "label": "files-api",
-        "endpoint": "s3"
+        "port": 9000
       },
       "console": {
         "label": "files",
-        "endpoint": "console"
+        "port": 9001
       }
     }
   },
@@ -26,19 +26,17 @@
     "container-runtime"
   ],
   "emits": [
-    "bucket.created",
-    "bucket.removed"
+    "module.minio.bucket.created",
+    "module.minio.bucket.removed"
   ],
   "listens": [
     {
-      "name": "s3",
       "port": 9000,
       "protocol": "tcp",
       "from": "mesh",
       "why": "the S3 endpoint"
     },
     {
-      "name": "console",
       "port": 9001,
       "protocol": "tcp",
       "from": "mesh",

modules/minio/provisioner/index.ts

@@ -30,7 +30,7 @@ runProvisioner("s3-bucket", {
     try { await minio.removeAccessKey(accessKeyId); } catch { /* none yet — first provision */ }
     await minio.createAccessKey(bucket, accessKeyId, p.password);
 
-    await announce("bucket.created", {
+    await announce("module.minio.bucket.created", {
       bucket,
       consumer: p.consumer ?? "",
       accessKey: accessKeyId,
@@ -51,7 +51,7 @@ runProvisioner("s3-bucket", {
       console.error(`[minio] bucket ${bucket} not removed (likely non-empty), access revoked: ${err}`);
     }
 
-    await announce("bucket.removed", { bucket, accessKey: p.as });
+    await announce("module.minio.bucket.removed", { bucket, accessKey: p.as });
   },
 
   // Asked every minute by the harness: whether the backend still holds this consumer exactly as

modules/model-usage/index.ts

@@ -22,7 +22,7 @@ const store = UsageStore.fromEnv();
 // to reach the provider over the overlay would block the very apply that brings the overlay up.
 await store.migrate();
 
-await on("*.usage.*", async (event) => {
+await on("module.*.usage.*", async (event) => {
   const body = event.body as { rows?: UsageRow[]; raw?: unknown };
   for (const row of body.rows ?? []) {
     try {

modules/model-usage/module.json

@@ -20,7 +20,7 @@
     "postgres-database": "/var/lib/model-usage/database.secret"
   },
   "consumes": [
-    "*.usage.*"
+    "module.*.usage.*"
   ],
   "own-secrets": {
     "broker": "/var/lib/mesh/model-usage/broker"

modules/mongodb/index.ts

@@ -14,11 +14,11 @@ interface DatabaseEvent {
   user?: string;
 }
 
-await on<DatabaseEvent>("database.provisioned", async (e) => {
+await on<DatabaseEvent>("module.mongodb.database.provisioned", async (e) => {
   console.log(`[mongodb] database provisioned for ${e.body.consumer} (db ${e.body.database})`);
 });
 
-await on<DatabaseEvent>("database.deprovisioned", async (e) => {
+await on<DatabaseEvent>("module.mongodb.database.deprovisioned", async (e) => {
   console.log(`[mongodb] database deprovisioned for ${e.body.consumer} (db ${e.body.database})`);
 });
 

modules/mongodb/module.json

@@ -11,16 +11,15 @@
     "container-runtime"
   ],
   "emits": [
-    "database.provisioned",
-    "database.deprovisioned"
+    "module.mongodb.database.provisioned",
+    "module.mongodb.database.deprovisioned"
   ],
   "consumes": [
-    "mongodb.database.provisioned",
-    "mongodb.database.deprovisioned"
+    "module.mongodb.database.provisioned",
+    "module.mongodb.database.deprovisioned"
   ],
   "listens": [
     {
-      "name": "database",
       "port": 27017,
       "protocol": "tcp",
       "from": "mesh",

modules/mongodb/provisioner/index.ts

@@ -34,7 +34,7 @@ runProvisioner("mongodb-database", {
     // Database and owning user share the consumer's login, so the consumer owns exactly its own.
     const database = p.as;
     await mongo.createDatabaseAndUser(database, p.as, p.password);
-    await announce("database.provisioned", {
+    await announce("module.mongodb.database.provisioned", {
       consumer: p.consumer ?? "",
       database,
       user: p.as,
@@ -43,7 +43,7 @@ runProvisioner("mongodb-database", {
 
   async remove(p: { as: string }): Promise<void> {
     await mongo.dropDatabaseAndUser(p.as, p.as);
-    await announce("database.deprovisioned", { database: p.as });
+    await announce("module.mongodb.database.deprovisioned", { database: p.as });
   },
   // Asked every minute by the harness: whether the backend still holds this consumer exactly as
   // the mesh gave it, so a login lost behind the provisioner's back is made again (novox/hq issue 120).

modules/mosquitto/index.ts

@@ -14,11 +14,11 @@ interface TopicEvent {
   topicPrefix?: string;
 }
 
-await on<TopicEvent>("topic.provisioned", async (e) => {
+await on<TopicEvent>("module.mosquitto.topic.provisioned", async (e) => {
   console.log(`[mosquitto] topic provisioned for ${e.body.consumer} (client ${e.body.username})`);
 });
 
-await on<TopicEvent>("topic.deprovisioned", async (e) => {
+await on<TopicEvent>("module.mosquitto.topic.deprovisioned", async (e) => {
   console.log(`[mosquitto] topic deprovisioned for ${e.body.consumer} (client ${e.body.username})`);
 });
 

modules/mosquitto/module.json

@@ -12,12 +12,12 @@
     "container-runtime"
   ],
   "emits": [
-    "topic.provisioned",
-    "topic.deprovisioned"
+    "module.mosquitto.topic.provisioned",
+    "module.mosquitto.topic.deprovisioned"
   ],
   "consumes": [
-    "mosquitto.topic.provisioned",
-    "mosquitto.topic.deprovisioned"
+    "module.mosquitto.topic.provisioned",
+    "module.mosquitto.topic.deprovisioned"
   ],
   "serves": {
     "mqtt-topic": {}
@@ -34,14 +34,12 @@
   },
   "listens": [
     {
-      "name": "mqtt",
       "port": 1883,
       "protocol": "tcp",
       "from": "mesh",
       "why": "modules on any machine that were granted a topic namespace"
     },
     {
-      "name": "mqtt-websockets",
       "port": 8081,
       "protocol": "tcp",
       "from": "mesh",

modules/mosquitto/provisioner/index.ts

@@ -32,7 +32,7 @@ runProvisioner("mqtt-topic", {
     // The topic subtree is scoped to the consumer's own login, so one cannot read another's topics.
     const topicPrefix = p.as;
     await mosquitto.createScopedClient(p.as, p.password, topicPrefix);
-    await announce("topic.provisioned", {
+    await announce("module.mosquitto.topic.provisioned", {
       consumer: p.consumer ?? "",
       username: p.as,
       topicPrefix,
@@ -41,7 +41,7 @@ runProvisioner("mqtt-topic", {
 
   async remove(p: { as: string }): Promise<void> {
     await mosquitto.deleteScopedClient(p.as);
-    await announce("topic.deprovisioned", { username: p.as });
+    await announce("module.mosquitto.topic.deprovisioned", { username: p.as });
   },
   // Asked every minute by the harness: whether the backend still holds this consumer exactly as
   // the mesh gave it, so a login lost behind the provisioner's back is made again (novox/hq issue 120).

modules/mssql/index.ts

@@ -14,11 +14,11 @@ interface DatabaseEvent {
   user?: string;
 }
 
-await on<DatabaseEvent>("database.provisioned", async (e) => {
+await on<DatabaseEvent>("module.mssql.database.provisioned", async (e) => {
   console.log(`[mssql] database provisioned for ${e.body.consumer} (db ${e.body.database})`);
 });
 
-await on<DatabaseEvent>("database.deprovisioned", async (e) => {
+await on<DatabaseEvent>("module.mssql.database.deprovisioned", async (e) => {
   console.log(`[mssql] database deprovisioned for ${e.body.consumer} (db ${e.body.database})`);
 });
 

modules/mssql/module.json

@@ -11,16 +11,15 @@
     "container-runtime"
   ],
   "emits": [
-    "database.provisioned",
-    "database.deprovisioned"
+    "module.mssql.database.provisioned",
+    "module.mssql.database.deprovisioned"
   ],
   "consumes": [
-    "mssql.database.provisioned",
-    "mssql.database.deprovisioned"
+    "module.mssql.database.provisioned",
+    "module.mssql.database.deprovisioned"
   ],
   "listens": [
     {
-      "name": "database",
       "port": 4848,
       "protocol": "tcp",
       "from": "mesh",

modules/mssql/provisioner/index.ts

@@ -33,7 +33,7 @@ runProvisioner("mssql-database", {
     // Database, login and user share the consumer's name, so the consumer owns exactly its own.
     const database = p.as;
     await mssql.createDatabaseAndLogin(database, p.as, p.password);
-    await announce("database.provisioned", {
+    await announce("module.mssql.database.provisioned", {
       consumer: p.consumer ?? "",
       database,
       user: p.as,
@@ -42,7 +42,7 @@ runProvisioner("mssql-database", {
 
   async remove(p: { as: string }): Promise<void> {
     await mssql.dropDatabaseAndLogin(p.as, p.as);
-    await announce("database.deprovisioned", { database: p.as });
+    await announce("module.mssql.database.deprovisioned", { database: p.as });
   },
   // Asked every minute by the harness: whether the backend still holds this consumer exactly as
   // the mesh gave it, so a login lost behind the provisioner's back is made again (novox/hq issue 120).

modules/n8n/module.json

@@ -14,7 +14,7 @@
     },
     "route": {
       "label": "n8n",
-      "endpoint": "web"
+      "port": 5682
     }
   },
   "binds": {
@@ -29,7 +29,6 @@
   },
   "listens": [
     {
-      "name": "web",
       "port": 5682,
       "protocol": "tcp",
       "from": "mesh",

modules/nats/Dockerfile

@@ -1,21 +0,0 @@
-# nats's server image: the upstream server, plus an entrypoint that reloads it in place when the
-# mesh rewrites its configuration. See entrypoint.sh for why that belongs here and not in the host.
-#
-# **Pinned to the multi-architecture index digest, not a platform's.** `docker manifest inspect`
-# reports a platform manifest per architecture and the index that lists them; pinning a platform's
-# digest builds on this workstation and fails on any node of another architecture, with an error
-# that names a manifest rather than the mistake. This is the index — `docker pull` reports the same
-# one, and `RepoDigests` confirms it.
-#
-# Unlike every other module's Dockerfile, this builds no TypeScript and uses no mesh base image:
-# the module's code is the server, which upstream already built. There is no BUILD_BASE here on
-# purpose — nothing is compiled. The upstream image is declared in the manifest under build.on and
-# arrives as NATS_BASE, like every other base the mesh copies into its own store before a build
-# (novox/hq ADR 0097); the digest above is the index one for the reason given.
-ARG NATS_BASE
-FROM ${NATS_BASE}
-
-COPY entrypoint.sh /usr/local/bin/mesh-nats-entrypoint
-RUN chmod 0755 /usr/local/bin/mesh-nats-entrypoint
-
-ENTRYPOINT ["/usr/local/bin/mesh-nats-entrypoint"]

modules/nats/entrypoint.sh

@@ -1,69 +0,0 @@
-#!/bin/sh
-# nats's entrypoint: run the server, and reload it in place when the mesh rewrites its
-# configuration.
-#
-# **Why this exists inside the module** (novox/hq design 25 §5). The controller composes every
-# account and permission into one file, and that file changes whenever a module is added,
-# reassigned, or a person's access is granted or revoked — which is often, and on the one server
-# everything else depends on. The host has no way to say "reload this container": a
-# container resource has `restart-on` and nothing else, and a container's `restart-on` means
-# *recreate* — every connection dropped and every in-flight JetStream ack lost, mid-flight, for a
-# permission change. `reload-on` is real but it is a *service* field, not a container's.
-#
-# nats-server already reloads its own configuration on SIGHUP — accounts, permissions, everything
-# the mesh composes — without dropping a connection. That is the server's own documented
-# capability, not something built for the mesh. So the configuration is mounted as a directory
-# (a directory's contents are not digest-tracked the way a directly-mounted file's are, novox/hq
-# issue 103), and this watches the one file inside it and signals the server itself. The host's
-# only job is what it already does for any directory: keep the file's content current. Nothing
-# here is declared `restart-on` or `reload-on`.
-set -eu
-
-# **Two files, and only one of them is the mesh's** (novox/hq design 25 §4, task 1.7). CONF is this
-# module's own — ports, TLS, JetStream — declared in its manifest, because those are properties of
-# the container this module raises. USERS is every account and permission, composed by the
-# controller, and CONF includes it. So what is watched here is the mesh's half: the module's own
-# does not change without a new declaration, and that recreates the container anyway.
-CONF="${MESH_NATS_CONF:-/etc/nats/nats.conf}"
-USERS="${MESH_NATS_USERS:-/etc/nats/accounts.conf}"
-POLL="${MESH_NATS_CONF_POLL_SECONDS:-5}"
-
-# Both are written as part of the same declaration that creates this container, but none of the
-# three are ordered against each other. Waiting is correct and starting without them is not:
-# nats-server given a configuration whose include is missing refuses to start, and one given no
-# configuration at all comes up with its compiled-in defaults — no TLS, no accounts, every subject
-# open to anyone who can reach the port. A bus that is briefly open to everything is not a bus that
-# is briefly wrong; it is an open bus.
-for needed in "$CONF" "$USERS"; do
-  while [ ! -s "$needed" ]; do
-    echo "[nats] waiting for the mesh to write $needed"
-    sleep 1
-  done
-done
-
-digest() { sha256sum "$USERS" 2>/dev/null | cut -d' ' -f1; }
-
-nats-server --config "$CONF" "$@" &
-server=$!
-
-# Forward a stop to the server and let it drain, rather than dying and leaving it orphaned as
-# PID 1's child.
-stop() { kill -TERM "$server" 2>/dev/null || true; }
-trap stop TERM INT
-
-last=$(digest)
-while kill -0 "$server" 2>/dev/null; do
-  sleep "$POLL"
-  now=$(digest)
-  # An empty digest means the file is mid-write or briefly gone. Reloading on that would hand the
-  # server a truncated configuration; the next tick sees the finished one.
-  [ -n "$now" ] || continue
-  if [ "$now" != "$last" ]; then
-    last=$now
-    echo "[nats] the mesh's user list changed; reloading in place"
-    kill -HUP "$server" || true
-  fi
-done
-
-# `wait` on an already-exited child still yields its status, which becomes this container's.
-wait "$server"

modules/nats/module.json

@@ -1,91 +0,0 @@
-{
-  "module": "nats",
-  "version": "1",
-  "provides": [
-    {
-      "name": "mesh-bus",
-      "scope": "mesh"
-    }
-  ],
-  "claims": [
-    {
-      "name": "mesh-broker",
-      "scope": "mesh"
-    }
-  ],
-  "bus-users": "/var/lib/nats-module/conf/accounts.conf",
-  "capabilities": [
-    "container-runtime"
-  ],
-  "emits": [],
-  "consumes": [],
-  "listens": [
-    {
-      "name": "bus",
-      "port": 4222,
-      "protocol": "tcp",
-      "from": "mesh",
-      "why": "the mesh bus \u2014 every link the mesh has, over TLS, reached across the overlay"
-    }
-  ],
-  "guards": [
-    8222
-  ],
-  "resources": [
-    {
-      "id": "jetstream-data",
-      "type": "directory",
-      "path": "/var/lib/mesh-broker-nats",
-      "mode": "0700"
-    },
-    {
-      "id": "conf-dir",
-      "type": "directory",
-      "path": "/var/lib/nats-module/conf",
-      "mode": "0700"
-    },
-    {
-      "id": "server-conf",
-      "type": "file",
-      "path": "/var/lib/nats-module/conf/nats.conf",
-      "content": "# The nats module's own server settings. Declared by the module, because a port, a TLS path\n# and a store directory are properties of the container this module raises: they live in its\n# image and its mounts and change when it does.\n#\n# The mesh writes accounts.conf beside this one and nothing else. A controller that wrote the\n# whole file would have to be kept in step with a Dockerfile it never sees.\n\nport: 4222\nhttp: 127.0.0.1:8222\n\n# The mesh's own broker certificate \u2014 the one every machine already pins by fingerprint and the\n# controller already trusts (MESH_BROKER_CERTIFICATE). Serving the new bus with it means no\n# machine's pin changes when it moves, and no second certificate exists to be wrong about.\ntls {\n  cert_file: \"/tls/tls.crt\"\n  key_file: \"/tls/tls.key\"\n}\n\n# **No `verify`, deliberately, and it was `verify: true` until a probe ran this image.** That\n# setting makes the server demand a *client* certificate, and nothing in the mesh presents one: a\n# host pins this server's exact certificate and authenticates with the password the mesh minted\n# (novox/hq ADR 0004, design 25 \u00a74), and so does a module's runtime. With it on, every connection\n# in the mesh is refused at the TLS handshake, before any password is looked at \u2014 and the error is\n# \"client didn't provide a certificate\", which reads as a client fault.\n#\n# TLS is still required: a tls block is what makes it required, and verify only decides whether\n# client certificates are checked. What is given up is a second factor the mesh has no machinery\n# to issue or rotate \u2014 a certificate per module per node \u2014 and what is kept is stronger than a\n# name check in both directions: an exact pin outward, a per-user password inward.\n\njetstream {\n  store_dir: \"/data\"\n}\n\n# Every user of the mesh, composed by the controller and rewritten whenever a module is\n# assigned, a node enrols or a person's access changes.\n#\n# **Relative, and in this same directory, because it has to be.** An absolute include path is\n# resolved relative to the including file's directory, not from the root: nats-server given\n# `include /etc/nats/accounts.conf` from /etc/nats-server/nats.conf looks for\n# /etc/nats-server/etc/nats/accounts.conf and refuses to start. Verified against the server.\ninclude accounts.conf\n",
-      "mode": "0644"
-    },
-    {
-      "id": "server",
-      "type": "container",
-      "name": "mesh-broker-nats",
-      "ports": [
-        "4222:4222",
-        "127.0.0.1:8222:8222"
-      ],
-      "volumes": [
-        "/var/lib/mesh-broker-nats:/data",
-        "/var/lib/nats-module/conf:/etc/nats:ro",
-        "/var/lib/mesh-broker-tls:/tls:ro"
-      ],
-      "artifact": "server"
-    }
-  ],
-  "accesses": [
-    {
-      "path": "/var/lib/mesh-broker-tls",
-      "mode": "read"
-    }
-  ],
-  "build": {
-    "on": [
-      {
-        "arg": "NATS_BASE",
-        "image": "nats@sha256:b83efabe3e7def1e0a4a31ec6e078999bb17c80363f881df35edc70fcb6bb927"
-      }
-    ],
-    "artifacts": [
-      {
-        "name": "server",
-        "kind": "image",
-        "from": "Dockerfile"
-      }
-    ]
-  }
-}

modules/nextcloud/index.ts

@@ -26,7 +26,7 @@ async function pollUsers(client: NextcloudClient): Promise<void> {
   const users = client.listUsers();
   for (const u of users) {
     if (knownUsers.has(u.uid)) continue;
-    if (usersPrimed) await emit("user.created", { uid: u.uid, displayName: u.displayName });
+    if (usersPrimed) await emit("module.nextcloud.user.created", { uid: u.uid, displayName: u.displayName });
     knownUsers.add(u.uid);
   }
   usersPrimed = true;
@@ -38,7 +38,7 @@ async function pollShares(client: NextcloudClient): Promise<void> {
   const shares = await client.listShares();
   for (const s of shares) {
     if (knownShares.has(s.id)) continue;
-    if (sharesPrimed) await emit("share.created", { id: s.id, path: s.path, shareType: s.shareType, shareWith: s.shareWith, owner: s.owner });
+    if (sharesPrimed) await emit("module.nextcloud.share.created", { id: s.id, path: s.path, shareType: s.shareType, shareWith: s.shareWith, owner: s.owner });
     knownShares.add(s.id);
   }
   sharesPrimed = true;

modules/nextcloud/module.json

@@ -13,7 +13,7 @@
     },
     "route": {
       "label": "drive",
-      "endpoint": "web"
+      "port": 80
     }
   },
   "binds": {
@@ -26,8 +26,8 @@
     "s3-bucket": "${dir:state}/store.secret"
   },
   "emits": [
-    "user.created",
-    "share.created"
+    "module.nextcloud.user.created",
+    "module.nextcloud.share.created"
   ],
   "own-secrets": {
     "admin": "${dir:state}/admin.secret",
@@ -38,7 +38,6 @@
   ],
   "listens": [
     {
-      "name": "web",
       "port": 80,
       "protocol": "tcp",
       "from": "mesh",

modules/nodered/module.json

@@ -2,7 +2,7 @@
   "module": "nodered",
   "version": "1",
   "emits": [
-    "flows.deployed"
+    "module.nodered.flows.deployed"
   ],
   "own-secrets": {
     "broker": "/var/lib/mesh/nodered/broker"
@@ -12,7 +12,6 @@
   ],
   "listens": [
     {
-      "name": "web",
       "port": 1880,
       "protocol": "tcp",
       "from": "mesh",
@@ -82,7 +81,7 @@
   "contributes": {
     "route": {
       "label": "nodered",
-      "endpoint": "web"
+      "port": 1880
     }
   },
   "binds": {

modules/nodered/tools/index.ts

@@ -43,7 +43,7 @@ export function getNodeRedTools(nodered: NodeRedClient): ToolDefinition[] {
         const result = await nodered.deployFlows(flows, type);
         // Best-effort announcement — a deploy must not fail because the broker is unbound here.
         try {
-          await emit("flows.deployed", { rev: result.rev, nodeCount: result.nodeCount, type });
+          await emit("module.nodered.flows.deployed", { rev: result.rev, nodeCount: result.nodeCount, type });
         } catch (err) {
           console.error(`[nodered] deployed but could not emit: ${err}`);
         }

modules/novox.be/module.json

@@ -10,7 +10,7 @@
   "contributes": {
     "route": {
       "label": "@",
-      "endpoint": "web"
+      "port": 4000
     }
   },
   "binds": {
@@ -18,7 +18,6 @@
   },
   "listens": [
     {
-      "name": "web",
       "port": 4000,
       "protocol": "tcp",
       "from": "mesh",

modules/nzbget/index.ts

@@ -27,7 +27,7 @@ async function pollQueue(): Promise<void> {
   if (queuePrimed) {
     for (const item of items) {
       if (!inQueue.has(item.id)) {
-        await emit("download.added", { name: item.name, category: item.category, sizeMB: item.sizeMB });
+        await emit("module.nzbget.download.added", { name: item.name, category: item.category, sizeMB: item.sizeMB });
       }
     }
   }
@@ -45,7 +45,7 @@ async function pollHistory(): Promise<void> {
       // A newly-appeared history entry is a completion only if it actually succeeded; a failure or
       // a manual delete lands in history too, and neither is a "download.completed".
       if (historyPrimed && item.success) {
-        await emit("download.completed", { name: item.name, category: item.category, sizeMB: item.sizeMB });
+        await emit("module.nzbget.download.completed", { name: item.name, category: item.category, sizeMB: item.sizeMB });
       }
       seenHistory.add(item.id);
     }

modules/nzbget/module.json

@@ -5,8 +5,8 @@
     "container-runtime"
   ],
   "emits": [
-    "download.added",
-    "download.completed"
+    "module.nzbget.download.added",
+    "module.nzbget.download.completed"
   ],
   "consumes": [],
   "own-secrets": {
@@ -15,7 +15,6 @@
   },
   "listens": [
     {
-      "name": "web",
       "port": 6789,
       "protocol": "tcp",
       "from": "mesh",
@@ -81,7 +80,7 @@
       ],
       "env": {
         "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_NZBGET_URL": "http://127.0.0.1:${port:6789}",
+        "MESH_NZBGET_URL": "http://127.0.0.1:6789",
         "MESH_NZBGET_PASSWORD_FILE": "/run/secrets/password",
         "MESH_NZBGET_CONFIG_FILE": "/run/config/config.json",
         "MESH_NZBGET_CONFIG_DIR": "/var/lib/nzbget/config"

modules/ollama/module.json

@@ -12,7 +12,6 @@
   ],
   "listens": [
     {
-      "name": "api",
       "port": 11434,
       "protocol": "tcp",
       "from": "machine",

modules/ombi/Dockerfile

@@ -13,7 +13,7 @@ ARG RUNTIME_BASE
 FROM ${BUILD_BASE} AS build
 WORKDIR /app/modules/ombi
 COPY . .
-RUN node /app/node_modules/typescript/bin/tsc client.ts index.ts tools/index.ts servarr/settings.ts servarr/index.ts \
+RUN node /app/node_modules/typescript/bin/tsc client.ts index.ts tools/index.ts \
       --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist
 
 FROM ${RUNTIME_BASE}
@@ -22,6 +22,3 @@ COPY --from=build /app/modules/ombi/dist /app/modules/ombi/dist
 # provider's provisioner runs its reconcile loop in the same process, with the broker connected —
 # the convention novox/hq issues 060/061 settled.
 ENV MESH_TOOL_MODULES=/app/modules/ombi/dist/index.js,/app/modules/ombi/dist/tools/index.js
-# NOT dist/servarr/index.js: that is a step the host runs to completion, named by the `servarr`
-# container's args as `mesh-tools run …` (novox/hq ADR 0052). Listed here it would run inside the
-# serving sidecar too, and exit it.

modules/ombi/index.ts

@@ -31,7 +31,7 @@ async function pollRequests(): Promise<void> {
     const key = keyOf(r);
     const known = approvedState.has(key);
     if (primed && !known) {
-      await emit("request.created", {
+      await emit("module.ombi.request.created", {
         kind: r.kind,
         id: r.id,
         title: r.title,
@@ -41,7 +41,7 @@ async function pollRequests(): Promise<void> {
     }
     // Approval: the flag went from false to true for a request we already knew about.
     if (primed && known && r.approved && approvedState.get(key) === false) {
-      await emit("request.approved", { kind: r.kind, id: r.id, title: r.title, tmdbId: r.tmdbId });
+      await emit("module.ombi.request.approved", { kind: r.kind, id: r.id, title: r.title, tmdbId: r.tmdbId });
     }
     approvedState.set(key, r.approved);
   }