ssh-client module: the mesh owns ~/.ssh, config from the hub (to-be 29)

Requires openssh; creates ~/.ssh (0700, owned by the operator account via
${machine:account}); writes every other node's Host block (HostName + User
<account>) into a marked region of ~/.ssh/config (home-scoped, into:block), so
`ssh <node>` reaches each peer as the right account and the operator's own
config is kept. Universal-tier: assigned wherever a person logs in; a node with
no account gets no config.

modules/amqp-email-forwarder/module.json

@@ -0,0 +1,56 @@
+{
+  "module": "amqp-email-forwarder",
+  "version": "1",
+  "slug": "emailfwd",
+  "capabilities": [
+    "container-runtime"
+  ],
+  "requires": [
+    "amqp"
+  ],
+  "contributes": {},
+  "binds": {
+    "amqp": "/var/lib/amqp-email-forwarder/amqp.json"
+  },
+  "secrets": {
+    "amqp": "/var/lib/amqp-email-forwarder/amqp.secret"
+  },
+  "own-secrets": {
+    "smtp-user": "/var/lib/amqp-email-forwarder/smtp-user.secret",
+    "smtp-password": "/var/lib/amqp-email-forwarder/smtp-password.secret"
+  },
+  "resources": [
+    {
+      "id": "state",
+      "type": "directory",
+      "path": "/var/lib/amqp-email-forwarder",
+      "mode": "0700"
+    },
+    {
+      "id": "app-env",
+      "type": "file",
+      "path": "/var/lib/amqp-email-forwarder/app.env",
+      "mode": "0600",
+      "content": "AMQP_HOST=${bound:amqp:at}\nAMQP_PORT=${bound:amqp:port}\nAMQP_USER=${bound:amqp:as}\nAMQP_VHOST=EMAILDELIVERY_T\nAMQP_EXCHANGE=News.TransactionalEmailing.Command\nAMQP_QUEUE=email-forwarder\nAMQP_URL=amqp://${bound:amqp:as}:${secret:amqp}@${bound:amqp:at}:${bound:amqp:port}/EMAILDELIVERY_T\nSMTP_HOST=mail.novox.be\nSMTP_PORT=587\nSMTP_USER=${secret:smtp-user}\nSMTP_PASSWORD=${secret:smtp-password}\n"
+    },
+    {
+      "id": "net",
+      "type": "network",
+      "name": "amqp-email-forwarder"
+    },
+    {
+      "id": "app",
+      "type": "container",
+      "name": "amqp-email-forwarder",
+      "image": "registry-api.novox.be/novox/amqp-email-forwarder@sha256:f76d34646d9d3b2098c72688a63f6ae656f1888ffcb2f90a9c8dd2a44ad7f8af",
+      "network": "amqp-email-forwarder",
+      "env-file": [
+        "/var/lib/amqp-email-forwarder/app.env"
+      ],
+      "restart-on": [
+        "app-env"
+      ],
+      "secrets-in-environment": "the application's own code reads AMQP_URL, SMTP_USER and SMTP_PASSWORD from the environment (amqp-email-forwarder app.js); converting is that repository's change"
+    }
+  ]
+}

modules/amqp-ping/Dockerfile

@@ -0,0 +1,31 @@
+# amqp-ping's runtime: the tool runtime, carrying this module's compiled code.
+#
+# **Built from this module's own directory and nothing else.** The sdk and the tool runtime are not
+# copied out of neighbouring checkouts — they are in the base image, which is published like any
+# other artifact. That is what makes this buildable by the mesh from a repository and a path
+# (novox/hq ADR 0069) rather than only on a workstation that happens to have the siblings.
+#
+# Two bases, named rather than pinned: the image this is COMPILED in, and the image it RUNS in.
+# They are different images on purpose — the first carries a compiler and the second must not, or
+# every running container would carry one it never invokes. The mesh answers both with the copies it
+# holds, because a fingerprint written here would name one particular copy and no other mesh has it
+# (novox/hq issue 044). Declared in module.json's `build.on`; deliberately no defaults, so a build
+# nobody told stops here and says which module to build first.
+ARG BUILD_BASE
+ARG RUNTIME_BASE
+
+FROM ${BUILD_BASE} AS build
+# Compiled under /app/modules, so resolving `@novox/mesh-sdk` walks up to the base's own
+# node_modules — the module is compiled against exactly the sdk it will run against.
+WORKDIR /app/modules/amqp-ping
+COPY . .
+# The compiler is invoked by its real path, not through node_modules/.bin. Those are symlinks to
+# a launcher that requires its library relatively, and the base image resolves them when copying —
+# leaving a launcher whose relative require no longer points at anything.
+RUN node /app/node_modules/typescript/bin/tsc client.ts index.ts \
+      --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist
+
+FROM ${RUNTIME_BASE}
+COPY --from=build /app/modules/amqp-ping/dist /app/modules/amqp-ping/dist
+# Declared rather than derived from which files happen to exist: the module knows what it serves.
+ENV MESH_TOOL_MODULES=/app/modules/amqp-ping/dist/index.js

modules/amqp-ping/client.ts

@@ -0,0 +1,191 @@
+// amqp-ping's AMQP client — the demo consumer's own code (novox/hq ADR 0039). It speaks AMQP 0-9-1
+// directly over a raw TCP socket (node:net), the way redis's client speaks RESP: the module carries
+// NO npm dependency beyond @novox/mesh-sdk — no amqplib, no CLI in the image. It does exactly one
+// thing, the round-trip that proves the grant works: connect, authenticate with PLAIN to the vhost
+// the mesh named, declare a queue, publish one message and get it back.
+//
+// This is the consumer half of the `amqp` interface. It connects as the login the mesh derived
+// (`${bound:amqp:as}`) with the password the mesh minted (`${secret:amqp}`) to a vhost of that SAME
+// name — the provider named the vhost after the login, so the consumer must too. Nothing here is
+// hardcoded: user AND vhost are both the bound login, and a wrong vhost is refused by the broker.
+
+import { createConnection, type Socket } from "node:net";
+import { readFileSync } from "node:fs";
+
+const FRAME_END = 0xce;
+const PROTOCOL_HEADER = Buffer.from([0x41, 0x4d, 0x51, 0x50, 0x00, 0x00, 0x09, 0x01]); // "AMQP" 0-9-1
+
+export interface AmqpConn {
+  readonly host: string;
+  readonly port: number;
+  readonly user: string;
+  readonly password: string;
+  readonly vhost: string;
+}
+
+/** Build the connection facts from the environment the mesh's env-file set (see the module manifest). */
+export function connFromEnv(env: NodeJS.ProcessEnv = process.env): AmqpConn {
+  const host = env.MESH_AMQP_HOST ?? "";
+  const port = Number(env.MESH_AMQP_PORT ?? "5672") || 5672;
+  const user = env.MESH_AMQP_USER ?? "";
+  const vhost = env.MESH_AMQP_VHOST ?? user; // the provider names the vhost after the login
+  const password = env.MESH_AMQP_PASSWORD ?? readMaybe(env.MESH_AMQP_PASSWORD_FILE);
+  if (!host || !user || !password) {
+    throw new Error(`amqp-ping: connection is not fully set yet (host=${host} user=${user} password=${password ? "set" : "unset"})`);
+  }
+  return { host, port, user, password, vhost };
+}
+
+// --- wire helpers ---------------------------------------------------------------------------------
+
+function shortstr(s: string): Buffer {
+  const b = Buffer.from(s, "utf8");
+  const o = Buffer.alloc(1 + b.length);
+  o.writeUInt8(b.length, 0);
+  b.copy(o, 1);
+  return o;
+}
+function longstr(s: Buffer | string): Buffer {
+  const b = Buffer.isBuffer(s) ? s : Buffer.from(s, "utf8");
+  const o = Buffer.alloc(4 + b.length);
+  o.writeUInt32BE(b.length, 0);
+  b.copy(o, 4);
+  return o;
+}
+function u16(n: number): Buffer {
+  const o = Buffer.alloc(2);
+  o.writeUInt16BE(n, 0);
+  return o;
+}
+function u32(n: number): Buffer {
+  const o = Buffer.alloc(4);
+  o.writeUInt32BE(n, 0);
+  return o;
+}
+function frame(type: number, channel: number, payload: Buffer): Buffer {
+  const o = Buffer.alloc(7 + payload.length + 1);
+  o.writeUInt8(type, 0);
+  o.writeUInt16BE(channel, 1);
+  o.writeUInt32BE(payload.length, 3);
+  payload.copy(o, 7);
+  o.writeUInt8(FRAME_END, 7 + payload.length);
+  return o;
+}
+function method(channel: number, classId: number, methodId: number, ...parts: Buffer[]): Buffer {
+  return frame(1, channel, Buffer.concat([u16(classId), u16(methodId), ...parts]));
+}
+
+interface MethodWaiter {
+  classId: number;
+  methodId: number;
+  resolve: (args: Buffer) => void;
+  reject: (e: Error) => void;
+}
+
+/**
+ * Connect, authenticate to the vhost, declare a queue, publish one message and get it back. Returns
+ * the body that came back — the caller checks it equals what went out. Throws on any protocol error,
+ * including the broker's `NOT_ALLOWED` refusal of a vhost the login has no permission on (the
+ * isolation the provider builds, seen from the consumer's side).
+ */
+export function roundTrip(conn: AmqpConn, queue = "amqp-ping", payload?: string): Promise<string> {
+  const body = Buffer.from(payload ?? `ping-${Date.now()}`);
+  return new Promise<string>((resolve, reject) => {
+    const sock: Socket = createConnection({ host: conn.host, port: conn.port });
+    let buf = Buffer.alloc(0);
+    const waiters: MethodWaiter[] = [];
+    let lastBody: Buffer | null = null;
+    let done = false;
+
+    const fail = (e: Error): void => {
+      if (done) return;
+      done = true;
+      sock.destroy();
+      reject(e);
+    };
+    const expect = (classId: number, methodId: number): Promise<Buffer> =>
+      new Promise((res, rej) => waiters.push({ classId, methodId, resolve: res, reject: rej }));
+
+    sock.on("error", (e) => fail(e));
+    sock.on("close", () => fail(new Error("amqp connection closed before the round-trip completed")));
+    sock.on("data", (chunk: Buffer) => {
+      buf = Buffer.concat([buf, chunk]);
+      for (;;) {
+        if (buf.length < 7) return;
+        const type = buf.readUInt8(0);
+        const size = buf.readUInt32BE(3);
+        if (buf.length < 7 + size + 1) return;
+        const framePayload = buf.subarray(7, 7 + size);
+        buf = buf.subarray(7 + size + 1);
+        if (type === 1) {
+          const classId = framePayload.readUInt16BE(0);
+          const methodId = framePayload.readUInt16BE(2);
+          const args = framePayload.subarray(4);
+          const w = waiters.shift();
+          if (!w) continue;
+          if (w.classId === classId && w.methodId === methodId) w.resolve(args);
+          else w.reject(new Error(`expected method ${w.classId}/${w.methodId}, got ${classId}/${methodId}: ${args.toString("utf8")}`));
+        } else if (type === 3) {
+          lastBody = framePayload; // a content body frame
+        }
+        // type 2 (content header) and type 8 (heartbeat) need no handling for this round-trip.
+      }
+    });
+
+    sock.on("connect", () => {
+      void (async () => {
+        try {
+          sock.write(PROTOCOL_HEADER);
+          await expect(10, 10); // Connection.Start
+          const response = Buffer.concat([
+            Buffer.from([0]), Buffer.from(conn.user, "utf8"), Buffer.from([0]), Buffer.from(conn.password, "utf8"),
+          ]);
+          // Connection.Start-Ok: empty client-properties table, PLAIN, the SASL response, locale.
+          sock.write(method(0, 10, 11, u32(0), shortstr("PLAIN"), longstr(response), shortstr("en_US")));
+          const tune = await expect(10, 30); // Connection.Tune
+          const frameMax = tune.readUInt32BE(2) || 131072;
+          sock.write(method(0, 10, 31, u16(tune.readUInt16BE(0)), u32(frameMax), u16(0))); // Tune-Ok, no heartbeat
+          sock.write(method(0, 10, 40, shortstr(conn.vhost), shortstr(""), Buffer.from([0]))); // Connection.Open
+          await expect(10, 41); // Open-Ok — authenticated and into the vhost
+
+          sock.write(method(1, 20, 10, shortstr(""))); // Channel.Open
+          await expect(20, 11);
+          // Queue.Declare: reserved, queue, bits(auto-delete=1), empty arguments table.
+          sock.write(method(1, 50, 10, u16(0), shortstr(queue), Buffer.from([0b00001000]), u32(0)));
+          await expect(50, 11);
+
+          // Basic.Publish to the default exchange, routing-key = queue; then content header + body.
+          sock.write(method(1, 60, 40, u16(0), shortstr(""), shortstr(queue), Buffer.from([0])));
+          const bodySize = Buffer.alloc(8);
+          bodySize.writeBigUInt64BE(BigInt(body.length), 0);
+          sock.write(frame(2, 1, Buffer.concat([u16(60), u16(0), bodySize, u16(0)]))); // content header, no properties
+          sock.write(frame(3, 1, body)); // content body
+
+          await new Promise((r) => setTimeout(r, 200));
+          lastBody = null;
+          sock.write(method(1, 60, 70, u16(0), shortstr(queue), Buffer.from([1]))); // Basic.Get, no-ack
+          await expect(60, 71); // Get-Ok (a Get-Empty would arrive as 60/72 and reject the expect)
+          await new Promise((r) => setTimeout(r, 200));
+          const received = lastBody ? (lastBody as Buffer).toString("utf8") : "";
+
+          sock.write(method(0, 10, 50, u16(200), shortstr("bye"), u16(0), u16(0))); // Connection.Close
+          await expect(10, 51).catch(() => undefined);
+          done = true;
+          sock.end();
+          resolve(received);
+        } catch (e) {
+          fail(e instanceof Error ? e : new Error(String(e)));
+        }
+      })();
+    });
+  });
+}
+
+function readMaybe(path: string | undefined): string {
+  if (!path) return "";
+  try {
+    return readFileSync(path, "utf8").replace(/\n$/, "");
+  } catch {
+    return "";
+  }
+}

modules/amqp-ping/index.ts

@@ -0,0 +1,53 @@
+// amqp-ping — a tiny demo consumer of the mesh `amqp` interface, run as a long-lived container by
+// `mesh-tools run` (it never returns, so the container stays up). It exists to PROVE the grant end to
+// end: the mesh gave it a scoped login and a vhost of that name on the lavinmq provider, and this
+// connects with exactly those and round-trips a message.
+//
+// The connection facts arrive the way every consumer's do — the mesh writes them into an env-file the
+// container reads (novox/hq ADR 0048): MESH_AMQP_HOST/PORT from the binding, MESH_AMQP_USER and
+// MESH_AMQP_VHOST both from `${bound:amqp:as}` (the provider named the vhost after the login, so the
+// consumer uses the login for both — the db-name lesson applied to AMQP), and MESH_AMQP_PASSWORD from
+// `${secret:amqp}`.
+//
+// It retries: on first boot the provider may not have provisioned this consumer yet (the reconcile is
+// asynchronous and cross-container), so a refused or unreachable connection is a "not yet", not a
+// failure — it waits and tries again until the round-trip succeeds, then holds the connection idle
+// and re-pings on a slow cadence so the container is a stable, running proof.
+
+import { connFromEnv, roundTrip } from "./client.js";
+
+async function sleep(ms: number): Promise<void> {
+  await new Promise((r) => setTimeout(r, ms));
+}
+
+async function pingOnce(): Promise<boolean> {
+  try {
+    const conn = connFromEnv();
+    const sent = `ping-${Date.now()}`;
+    const got = await roundTrip(conn, "amqp-ping", sent);
+    if (got === sent) {
+      console.log(`[amqp-ping] round-trip ok as ${conn.user} on vhost ${conn.vhost} (${conn.host}:${conn.port})`);
+      return true;
+    }
+    console.error(`[amqp-ping] round-trip mismatch: sent ${sent}, got ${got}`);
+    return false;
+  } catch (err) {
+    console.error(`[amqp-ping] not ready yet: ${err instanceof Error ? err.message : err}`);
+    return false;
+  }
+}
+
+// Wait for the first successful round-trip — the proof this consumer's grant works — then stay up.
+let first = false;
+for (let i = 0; !first; i++) {
+  first = await pingOnce();
+  if (!first) await sleep(3000);
+}
+console.log("[amqp-ping] connected and round-tripped; holding steady");
+for (;;) {
+  await sleep(30000);
+  await pingOnce();
+}
+// changed by the one-node test at build 66e54af151df
+// changed by the one-node test at build 4fb41636cffd
+// changed by the one-node test at build a69f083bf6a6

modules/amqp-ping/module.json

@@ -0,0 +1,89 @@
+{
+  "module": "amqp-ping",
+  "slug": "ping",
+  "version": "1",
+  "capabilities": [
+    "container-runtime"
+  ],
+  "requires": [
+    "amqp"
+  ],
+  "contributes": {},
+  "binds": {
+    "amqp": "/var/lib/amqp-ping/amqp.json"
+  },
+  "secrets": {
+    "amqp": "/var/lib/amqp-ping/amqp.secret"
+  },
+  "own-secrets": {
+    "broker": "/var/lib/mesh/amqp-ping/broker"
+  },
+  "resources": [
+    {
+      "id": "mesh-state",
+      "type": "directory",
+      "path": "/var/lib/mesh/amqp-ping",
+      "mode": "0700"
+    },
+    {
+      "id": "state",
+      "type": "directory",
+      "path": "/var/lib/amqp-ping",
+      "mode": "0700"
+    },
+    {
+      "id": "amqp-env",
+      "type": "file",
+      "path": "/var/lib/amqp-ping/amqp.env",
+      "mode": "0600",
+      "content": "MESH_AMQP_HOST=${bound:amqp:at}\nMESH_AMQP_PORT=${bound:amqp:port}\nMESH_AMQP_USER=${bound:amqp:as}\nMESH_AMQP_VHOST=${bound:amqp:as}\n"
+    },
+    {
+      "id": "net",
+      "type": "network",
+      "name": "amqp-ping"
+    },
+    {
+      "id": "runtime",
+      "type": "container",
+      "name": "amqp-ping",
+      "network": "amqp-ping",
+      "volumes": [
+        "/var/lib/mesh/amqp-ping/broker:/run/secrets/broker:ro",
+        "/var/lib/amqp-ping/amqp.secret:/run/secrets/amqp:ro"
+      ],
+      "env": {
+        "MESH_BROKER_FILE": "/run/secrets/broker",
+        "MESH_AMQP_PASSWORD_FILE": "/run/secrets/amqp"
+      },
+      "env-file": [
+        "/var/lib/amqp-ping/amqp.env"
+      ],
+      "restart-on": [
+        "amqp-env"
+      ],
+      "artifact": "runtime"
+    }
+  ],
+  "build": {
+    "on": [
+      {
+        "arg": "BUILD_BASE",
+        "module": "mesh-tools",
+        "artifact": "build"
+      },
+      {
+        "arg": "RUNTIME_BASE",
+        "module": "mesh-tools",
+        "artifact": "runtime"
+      }
+    ],
+    "artifacts": [
+      {
+        "name": "runtime",
+        "kind": "image",
+        "from": "Dockerfile"
+      }
+    ]
+  }
+}

modules/amqp-ping/package.json

@@ -0,0 +1,14 @@
+{
+  "name": "@novox/module-amqp-ping",
+  "version": "0.1.0",
+  "description": "amqp-ping — a demo consumer of the mesh amqp interface. Connects with its scoped grant and round-trips one message to prove the broker the mesh gave it (novox/hq ADR 0039).",
+  "type": "module",
+  "private": true,
+  "dependencies": {
+    "@novox/mesh-sdk": "^0.1.0"
+  },
+  "devDependencies": {
+    "@types/node": "^22.0.0",
+    "typescript": "^5.6.0"
+  }
+}

modules/amqp-ping/tsconfig.json

@@ -8,5 +8,5 @@
     "skipLibCheck": true,
     "noEmit": true
   },
-  "include": ["records.ts", "index.ts", "tools/index.ts"]
+  "include": ["client.ts", "index.ts"]
 }

modules/anthropic-consumer/module.json

@@ -18,7 +18,7 @@
     "broker": "/var/lib/mesh/anthropic-consumer/broker"
   },
   "emits": [
-    "usage.session"
+    "module.anthropic-consumer.usage.session"
   ],
   "resources": [
     {

modules/anthropic-consumer/usage/index.ts

@@ -123,7 +123,7 @@ async function emitUsage(body: Record<string, unknown>): Promise<void> {
   await new Promise<void>((resolve) => {
     const child = spawn(
       process.execPath,
-      [main, "emit", "usage.session", JSON.stringify(body)],
+      [main, "emit", "module.anthropic-consumer.usage.session", JSON.stringify(body)],
       { stdio: "inherit" },
     );
     child.on("exit", () => resolve());

modules/anthropic-manager/module.json

@@ -18,7 +18,7 @@
     "broker": "/var/lib/mesh/anthropic-manager/broker"
   },
   "emits": [
-    "usage.read"
+    "module.anthropic-manager.usage.read"
   ],
   "resources": [
     {

modules/anthropic-manager/refresh/index.ts

@@ -143,7 +143,7 @@ async function emitUsage(body: Record<string, unknown>): Promise<void> {
   const main = process.env.MESH_TOOLS_MAIN ?? "/app/dist/main.js";
   const { spawn } = await import("node:child_process");
   await new Promise<void>((resolve) => {
-    const child = spawn(process.execPath, [main, "emit", "usage.read", JSON.stringify(body)], {
+    const child = spawn(process.execPath, [main, "emit", "module.anthropic-manager.usage.read", JSON.stringify(body)], {
       stdio: "inherit",
     });
     child.on("exit", () => resolve());

modules/audit-logger/module.json

@@ -3,7 +3,7 @@
   "version": "1",
   "slug": "audit",
   "consumes": [
-    "**"
+    "#"
   ],
   "own-secrets": {
     "broker": "/var/lib/audit-logger/broker"

modules/audit-logger/test/audit.test.ts

@@ -15,16 +15,16 @@ test("audit-logger records every event to the trail as one line each", async ()
   const path = join(dir, "audit.log");
 
   // The audit-logger's whole behaviour: consume everything, record it.
-  await on("**", async (event) => record(event, path));
+  await on("#", async (event) => record(event, path));
 
   process.env.MESH_MODULE = "umami";
   process.env.MESH_NODE = "anchor";
-  await emit("site.created", { domain: "my-app" });
+  await emit("module.umami.site.created", { domain: "my-app" });
   await emit("node.anchor.joined", { role: "worker" }); // a node event, not a module one
 
   const lines = (await readFile(path, "utf8")).trim().split("\n").map((l) => JSON.parse(l));
   assert.equal(lines.length, 2);
-  assert.deepEqual(lines.map((l) => l.type), ["umami.site.created", "node.anchor.joined"]);
+  assert.deepEqual(lines.map((l) => l.type), ["module.umami.site.created", "node.anchor.joined"]);
   assert.equal(lines[0].source, "umami");
   assert.equal(lines[0].node, "anchor");
   assert.equal(lines[0].body.domain, "my-app");

modules/baserow/client.ts

@@ -2,15 +2,12 @@
 // module's tools and anything else baserow-specific import it; nothing outside baserow does.
 //
 // Baserow authenticates a person with email + password, exchanged for a JWT at /api/user/token-auth/.
-// The standard image creates no admin from env, so the account is one a person made in Baserow: its
+// Those credentials are the mesh's own: a person signs up in Baserow (the standard image creates no
-// password is the module's `admin` secret, accepted from the operator, and its email and the public
+// admin from env), and the credential is placed in the runtime config file the mesh mounts. Until
-// host Baserow answers to reach the runtime config file the mesh mounts (the email from the
+// that happens fromEnv throws and the module simply exposes no tools — the same dormant-until-
-// assignment's settings). Until both are there fromEnv throws and the module exposes no tools — the
+// configured shape gitea uses for its token.
-// same dormant-until-configured shape gitea uses for its token.
 
 import { readFileSync } from "node:fs";
-import { request as httpRequest } from "node:http";
-import { request as httpsRequest } from "node:https";
 
 export interface BaserowApplication {
   id: number;
@@ -71,63 +68,35 @@ export class BaserowClient {
     return h;
   }
 
-  /**
+  /** Exchange email + password for a JWT, caching it for the client's lifetime. Handles both the
-   * One HTTP exchange. Not `fetch`: Node's fetch drops a caller's Host header and sends the URL's
-   * own, and Baserow answers only the host of its BASEROW_PUBLIC_URL — any other Host is looked up
-   * as a published builder site and gets 404, `/api/_health/` included. A co-located caller reaching
-   * it by container name must present the public host, so the request is made with node:http, which
-   * sends the Host it is given.
-   */
-  private send(path: string, method: string, headers: Record<string, string>, body?: string): Promise<{ status: number; text: string }> {
-    const url = new URL(`${this.baseUrl}${path}`);
-    const request = url.protocol === "https:" ? httpsRequest : httpRequest;
-    // A length, never chunked: Baserow's server reads a chunked body as empty.
-    const sent = body === undefined ? headers : { ...headers, "Content-Length": String(Buffer.byteLength(body)) };
-    return new Promise((resolve, reject) => {
-      const req = request(url, { method, headers: sent }, (res) => {
-        let text = "";
-        res.setEncoding("utf8");
-        res.on("data", (chunk: string) => (text += chunk));
-        res.on("end", () => resolve({ status: res.statusCode ?? 0, text }));
-        res.on("error", reject);
-      });
-      req.on("error", reject);
-      if (body !== undefined) req.write(body);
-      req.end();
-    });
-  }
-
-  /** Exchange email + password for a JWT, caching it until Baserow refuses it. Handles both the
    *  older `{ token }` and the newer `{ access_token }` response shapes. */
   async authenticate(): Promise<string> {
     if (this.token) return this.token;
-    const res = await this.send(
+    const res = await fetch(`${this.baseUrl}/api/user/token-auth/`, {
-      "/api/user/token-auth/",
+      method: "POST",
-      "POST",
+      headers: this.headers(),
-      this.headers(),
+      body: JSON.stringify({ email: this.email, password: this.password }),
-      JSON.stringify({ email: this.email, password: this.password }),
+    });
-    );
+    if (!res.ok) throw new Error(`baserow auth failed: ${res.status} ${await res.text()}`);
-    if (res.status < 200 || res.status >= 300) throw new Error(`baserow auth failed: ${res.status} ${res.text}`);
+    const data = (await res.json()) as { token?: string; access_token?: string };
-    const data = JSON.parse(res.text) as { token?: string; access_token?: string };
     const token = data.access_token ?? data.token;
     if (!token) throw new Error("baserow auth returned no token");
     this.token = token;
     return token;
   }
 
-  /** An authenticated GET. A refused token is dropped and the call made once more with a fresh one:
+  private async authed<T>(path: string, options: RequestInit = {}): Promise<T> {
-   *  Baserow's access tokens expire after minutes, and the runtime lives for weeks. */
-  private async authed<T>(path: string): Promise<T> {
-    for (let attempt = 0; ; attempt++) {
     const token = await this.authenticate();
-      const res = await this.send(path, "GET", this.headers({ Authorization: `JWT ${token}` }));
+    const res = await fetch(`${this.baseUrl}${path}`, {
-      if (res.status === 401 && attempt === 0) {
+      ...options,
-        this.token = null;
+      headers: this.headers({
-        continue;
+        Authorization: `JWT ${token}`,
-      }
+        ...(options.headers as Record<string, string> | undefined),
-      if (res.status < 200 || res.status >= 300) throw new Error(`baserow ${path}: ${res.status} ${res.text}`);
+      }),
-      return (res.text ? JSON.parse(res.text) : null) as T;
+    });
-    }
+    if (!res.ok) throw new Error(`baserow ${path}: ${res.status} ${await res.text()}`);
+    const text = await res.text();
+    return (text ? JSON.parse(text) : null) as T;
   }
 
   /** The applications (databases) the account can see, across all its workspaces. */

modules/baserow/module.json

@@ -14,27 +14,26 @@
     },
     "route": {
       "label": "baserow",
-      "endpoint": "web"
+      "port": 80
     }
   },
   "binds": {
-    "postgres-database": "${dir:state}/database.json",
+    "postgres-database": "/var/lib/baserow/database.json",
-    "route": "${dir:state}/route.json"
+    "route": "/var/lib/baserow/route.json"
   },
   "secrets": {
-    "postgres-database": "${dir:state}/database.secret"
+    "postgres-database": "/var/lib/baserow/database.secret"
   },
   "own-secrets": {
-    "admin": "${dir:state}/admin.secret",
+    "secret-key": "/var/lib/baserow/secret-key.secret",
     "broker": "/var/lib/mesh/baserow/broker"
   },
   "listens": [
     {
-      "name": "web",
       "port": 80,
       "protocol": "tcp",
       "from": "mesh",
-      "why": "the Baserow web UI and REST API, served by the image's own Caddy; a public name is the route's"
+      "why": "the Baserow web UI and REST API; a public name is a route grant later"
     }
   ],
   "resources": [
@@ -47,21 +46,22 @@
     {
       "id": "state",
       "type": "directory",
-      "mode": "0700",
+      "path": "/var/lib/baserow",
-      "place": "."
+      "mode": "0700"
     },
     {
       "id": "data",
       "type": "directory",
+      "path": "/services/baserow/data",
       "mode": "0755",
       "owner": "9999:9999"
     },
     {
       "id": "server-env",
       "type": "file",
-      "path": "${dir:state}/server.env",
+      "path": "/var/lib/baserow/server.env",
       "mode": "0600",
-      "content": "DATABASE_HOST=${bound:postgres-database:at}\nDATABASE_PORT=${bound:postgres-database:port}\nDATABASE_NAME=${bound:postgres-database:as}\nDATABASE_USER=${bound:postgres-database:as}\nDATABASE_PASSWORD_FILE=/run/secrets/database\nDISABLE_EMBEDDED_PSQL=true\nBASEROW_PUBLIC_URL=https://${bound:route:name}\n"
+      "content": "DATABASE_HOST=${bound:postgres-database:at}\nDATABASE_PORT=${bound:postgres-database:port}\nDATABASE_NAME=${bound:postgres-database:as}\nDATABASE_USER=${bound:postgres-database:as}\nDATABASE_PASSWORD=${secret:postgres-database}\nSECRET_KEY=${secret:secret-key}\nBASEROW_PUBLIC_URL=http://localhost\n"
     },
     {
       "id": "net",
@@ -72,25 +72,25 @@
       "id": "server",
       "type": "container",
       "name": "baserow",
-      "image": "baserow/baserow@sha256:263ea6c4b72c9eccabcd975ffe9fdebf23913a293a514bec6a3897a5e0a5a080",
+      "image": "baserow/baserow@sha256:834424a10413798567f76428f255dc259445b7f8dcec56598c05b4073bb2a124",
       "network": "baserow",
       "env-file": [
-        "${dir:state}/server.env"
+        "/var/lib/baserow/server.env"
       ],
       "ports": [
         "80"
       ],
       "volumes": [
-        "${dir:data}:/baserow/data",
+        "/services/baserow/data:/baserow/data"
-        "${dir:state}/database.secret:/run/secrets/database:ro"
+      ],
-      ]
+      "secrets-in-environment": "baserow reads DATABASE_PASSWORD and SECRET_KEY with os.getenv and has no _FILE twin (settings/base.py); not convertible"
     },
     {
       "id": "runtime-config",
       "type": "file",
       "path": "/var/lib/mesh/baserow/config.json",
       "mode": "0600",
-      "content": "{\n  \"password\": \"${secret:admin}\",\n  \"host\": \"${bound:route:name}\"\n}\n",
+      "content": "{}\n",
       "merge": "json"
     },
     {

modules/bazarr/index.ts

@@ -24,7 +24,7 @@ async function pollHistory(): Promise<void> {
   for (const entry of entries) {
     if (seen.has(entry.id)) continue;
     if (primed) {
-      await emit("subtitle.downloaded", {
+      await emit("module.bazarr.subtitle.downloaded", {
         kind: entry.kind,
         title: entry.title,
         language: entry.language,

modules/bazarr/module.json

@@ -5,7 +5,7 @@
     "container-runtime"
   ],
   "emits": [
-    "subtitle.downloaded"
+    "module.bazarr.subtitle.downloaded"
   ],
   "own-secrets": {
     "broker": "/var/lib/mesh/bazarr/broker",
@@ -13,7 +13,6 @@
   },
   "listens": [
     {
-      "name": "web",
       "port": 6767,
       "protocol": "tcp",
       "from": "mesh",
@@ -111,7 +110,7 @@
   "contributes": {
     "route": {
       "label": "subs",
-      "endpoint": "web"
+      "port": 6767
     }
   },
   "binds": {

modules/bookshelf/index.ts

@@ -45,12 +45,12 @@ async function pollQueue(bookshelf: BookshelfClient): Promise<void> {
   if (primed) {
     // Entered the queue since last look — Bookshelf grabbed a release.
     for (const [id, item] of now) {
-      if (!inQueue.has(id)) await emit("book.grabbed", { title: item.title, status: item.status });
+      if (!inQueue.has(id)) await emit("module.bookshelf.book.grabbed", { title: item.title, status: item.status });
     }
     // Left the queue — imported and done, unless it was last seen failing.
     for (const [id, item] of inQueue) {
       if (!now.has(id) && !FAILED_STATUSES.has(item.status)) {
-        await emit("download.completed", { title: item.title });
+        await emit("module.bookshelf.download.completed", { title: item.title });
       }
     }
   }

modules/bookshelf/module.json

@@ -6,8 +6,8 @@
     "container-runtime"
   ],
   "emits": [
-    "book.grabbed",
+    "module.bookshelf.book.grabbed",
-    "download.completed"
+    "module.bookshelf.download.completed"
   ],
   "consumes": [],
   "own-secrets": {
@@ -15,7 +15,6 @@
   },
   "listens": [
     {
-      "name": "web",
       "port": 8787,
       "protocol": "tcp",
       "from": "mesh",
@@ -88,7 +87,7 @@
   "contributes": {
     "route": {
       "label": "books",
-      "endpoint": "web"
+      "port": 8787
     }
   },
   "binds": {

modules/builder/module.json

@@ -20,6 +20,9 @@
   "secrets": {
     "npm-package-registry": "/var/lib/mesh/builder/package-registry.secret"
   },
+  "emits": [
+    "module.builder.built"
+  ],
   "own-secrets": {
     "broker": "/var/lib/mesh/builder/broker"
   },
@@ -69,8 +72,7 @@
         "kind": "image",
         "from": "Dockerfile",
         "context": {
-          "seat": "git",
+          "repository": "https://git.novox.be/novox/mesh-controller.git",
-          "repository": "novox/mesh-controller",
           "ref": "main"
         }
       }
@@ -78,7 +80,7 @@
     "on": [
       {
         "arg": "GO_BASE",
-        "image": "golang@sha256:8ac98ca534ac3f51e1f420a1dd2c15e74c75cfa0f23f3ad27eb5d7236c349a0c"
+        "image": "golang@sha256:1ae0735f00daffa3aaf1363a5184c0d2dc55c78e3db4ec70241cdac97bf84b59"
       },
       {
         "arg": "ALPINE_BASE",

modules/ca-trust/module.json

@@ -1,56 +0,0 @@
-{
-  "module": "ca-trust",
-  "version": "1",
-  "slug": "catrust",
-  "capabilities": [
-    "service-manager"
-  ],
-  "requires": [
-    "internal-acme-ca"
-  ],
-  "seats": [
-    {
-      "name": "the-mesh-trust-anchor",
-      "scope": "node"
-    }
-  ],
-  "claims": [
-    {
-      "name": "the-mesh-trust-anchor",
-      "scope": "node"
-    }
-  ],
-  "resources": [
-    {
-      "id": "state",
-      "type": "directory",
-      "mode": "0700",
-      "place": "."
-    },
-    {
-      "id": "anchor",
-      "type": "file",
-      "path": "${dir:state}/anchor",
-      "mode": "0755",
-      "content": "#!/bin/sh\n# The mesh's internal certificate authority, trusted by this machine.\n#\n# Written by the mesh from the ca-trust module's manifest (novox/hq ADR 0147).\n# Editing it here lasts until the next apply.\n#\n# There is no prior trust to verify the fetch against \u2014 this is the thing that\n# establishes it \u2014 so it is made over the mesh's own private network, which is\n# what authenticates it (novox/hq ADR 0098, the same reasoning that lets the\n# route proxy fetch this root for itself). What comes back is checked here: a\n# body that is not a certificate is refused now, rather than believed and then\n# failed by whatever reads the trust store next.\nset -eu\n\nROOTS='https://${bound:internal-acme-ca:at}:${bound:internal-acme-ca:port}${bound:internal-acme-ca:roots}'\nANCHORS=/etc/ca-certificates/trust-source/anchors\nANCHOR=\"$ANCHORS/mesh-internal-ca.crt\"\n\n# Arch's layout, said out loud rather than assumed: a machine that keeps its\n# anchors elsewhere fails here, visibly, instead of writing a file nothing\n# reads. That failure is the signal that this belongs in the host, where one\n# operating system's difference lives (novox/hq ADR 0147, option 2).\n[ -d \"$ANCHORS\" ] || {\n\techo \"this machine keeps no trust anchors in $ANCHORS; ca-trust is written for that layout\" >&2\n\texit 1\n}\n\ncase \"${1:-}\" in\ninstall)\n\ttmp=$(mktemp)\n\ttrap 'rm -f \"$tmp\"' EXIT\n\t# The authority may still be starting, or this machine may have come up\n\t# before it: two minutes of asking, then an honest failure.\n\tn=0\n\twhile [ \"$n\" -lt 60 ]; do\n\t\tif curl --fail --silent --show-error --insecure --max-time 10 \\\n\t\t\t--output \"$tmp\" \"$ROOTS\" &&\n\t\t\tgrep -q 'BEGIN CERTIFICATE' \"$tmp\"; then\n\t\t\tinstall -m 0644 \"$tmp\" \"$ANCHOR\"\n\t\t\tupdate-ca-trust\n\t\t\texit 0\n\t\tfi\n\t\tn=$((n + 1))\n\t\tsleep 2\n\tdone\n\techo \"the authority at $ROOTS did not serve a certificate within two minutes\" >&2\n\texit 1\n\t;;\nremove)\n\t# What stopping the unit does, and therefore what being unassigned does.\n\trm -f \"$ANCHOR\"\n\tupdate-ca-trust\n\t;;\n*)\n\techo \"usage: $(basename \"$0\") install|remove\" >&2\n\texit 2\n\t;;\nesac\n"
-    },
-    {
-      "id": "unit",
-      "type": "file",
-      "path": "/etc/systemd/system/mesh-ca-trust.service",
-      "mode": "0644",
-      "content": "[Unit]\nDescription=The mesh's internal certificate authority, trusted by this machine\n# novox/hq ADR 0147. Starting this unit places the mesh's root among this\n# machine's trust anchors; stopping it takes the root away again, which is what\n# the host does when the module is no longer assigned here.\nWants=network-online.target\nAfter=network-online.target\n\n[Service]\nType=oneshot\nRemainAfterExit=yes\nExecStart=${dir:state}/anchor install\nExecStop=${dir:state}/anchor remove\n\n[Install]\nWantedBy=multi-user.target\n"
-    },
-    {
-      "id": "trust",
-      "type": "service",
-      "unit": "mesh-ca-trust.service",
-      "state": "running",
-      "boot": "enabled",
-      "restart-on": [
-        "anchor",
-        "unit"
-      ]
-    }
-  ]
-}

modules/cloudflare-dns/module.json

@@ -22,8 +22,8 @@
     "broker": "/var/lib/mesh/cloudflare-dns/broker"
   },
   "emits": [
-    "record.created",
+    "module.cloudflare-dns.record.created",
-    "record.removed"
+    "module.cloudflare-dns.record.removed"
   ],
   "resources": [
     {

modules/cloudflare-dns/provisioner/index.ts

@@ -20,7 +20,7 @@ runProvisioner("public-dns", {
   async create(p: Provision): Promise<void> {
     const fqdn = cloudflare.nameFor(p.as);
     await cloudflare.upsert(fqdn);
-    await announce("record.created", {
+    await announce("module.cloudflare-dns.record.created", {
       name: fqdn,
       target: cloudflare.ingress,
       consumer: p.consumer ?? "",
@@ -30,7 +30,7 @@ runProvisioner("public-dns", {
   async remove(p: { as: string }): Promise<void> {
     const fqdn = cloudflare.nameFor(p.as);
     await cloudflare.remove(fqdn);
-    await announce("record.removed", { name: fqdn, consumer: p.as });
+    await announce("module.cloudflare-dns.record.removed", { name: fqdn, consumer: p.as });
   },
 });
 

modules/de-spiegel/module.json

@@ -11,7 +11,7 @@
   "contributes": {
     "route": {
       "label": "de-spiegel",
-      "endpoint": "web"
+      "port": 35621
     }
   },
   "binds": {
@@ -23,11 +23,10 @@
   },
   "listens": [
     {
-      "name": "web",
       "port": 35621,
       "protocol": "tcp",
       "from": "mesh",
-      "why": "the de-spiegel site and its /contact endpoint over http; its public name is a route grant, and route-proxy reaches it on this published port"
+      "why": "the de-spiegel site and its /contact endpoint over http; the public name de-spiegel.novox.be is a route grant, and route-proxy reaches it on this published port"
     }
   ],
   "resources": [
@@ -61,10 +60,7 @@
       "ports": [
         "35621"
       ],
-      "secrets-in-environment": "the application's own code reads SMTP_AUTH_USER/PASS from the environment (de-spiegel server/index.js); converting is that repository's change",
+      "secrets-in-environment": "the application's own code reads SMTP_AUTH_USER/PASS from the environment (de-spiegel server/index.js); converting is that repository's change"
-      "names-on-purpose": {
-        "registry-api.novox.be": "built outside the mesh, from the application's own repository, and pulled from the registry that built it; moves when that repository is a build source on the git seat (novox/hq ADR 0155, issue 122)"
-      }
     }
   ]
 }

modules/distribution/index.ts

@@ -33,7 +33,7 @@ async function pollCatalog(): Promise<void> {
     for (const tag of tags) {
       const id = `${repo}:${tag}`;
       if (!seen.has(id)) {
-        if (primed) await emit("image.pushed", { repo, tag });
+        if (primed) await emit("module.registry.image.pushed", { repo, tag });
         seen.add(id);
       }
     }

modules/distribution/module.json

@@ -17,7 +17,7 @@
     "container-runtime"
   ],
   "emits": [
-    "image.pushed"
+    "module.registry.image.pushed"
   ],
   "own-secrets": {
     "broker": "/var/lib/mesh/registry/broker"
@@ -29,7 +29,6 @@
   },
   "listens": [
     {
-      "name": "registry",
       "port": 5000,
       "protocol": "tcp",
       "from": "mesh",

modules/dnsmasq/index.ts

@@ -20,10 +20,10 @@ async function poll(): Promise<void> {
   const now = new Map((await dnsmasq.answeredNames()).map((a) => [a.name, a.address]));
   if (primed) {
     for (const [name, address] of now) {
-      if (!known.has(name)) await emit("name.added", { name, address });
+      if (!known.has(name)) await emit("module.dnsmasq.name.added", { name, address });
     }
     for (const [name] of known) {
-      if (!now.has(name)) await emit("name.removed", { name });
+      if (!now.has(name)) await emit("module.dnsmasq.name.removed", { name });
     }
   }
   known.clear();

modules/fail2ban/module.json

@@ -33,7 +33,7 @@
       "type": "file",
       "path": "/etc/fail2ban/jail.local",
       "mode": "0644",
-      "content": "[INCLUDES]\n\nbefore = paths-arch.conf\n\n[DEFAULT]\n\n# Never act on the machine itself or on a tunnel peer: the mesh's private range is\n# ${machine:mesh-range}, named here rather than written as a value the module cannot\n# know (novox/hq ADR 0112). Without this, fail2ban could ban the mesh's own nodes.\nignoreip = 127.0.0.1/8 ::1 ${machine:mesh-range}\n\nbantime  = 10m\nfindtime = 10m\nmaxretry = 5\n\n# Ban through iptables, not through a firewall front-end the machine may not have. ufw is\n# installed on two of this mesh's machines and absent on the other two, and fail2ban finds out\n# only at ban time: the service reports healthy, the jail counts the attempt, the ban command\n# exits 127, and nothing is blocked. Proven on 2026-09-28 -- 'ufw: command not found' on a\n# machine the mesh reported as protected.\n#\n# The action below is this module's own, already used by the recidive jail on every machine\n# here, and it bans in DOCKER-USER as well as INPUT, so a container's published port is\n# covered too.\nbanaction = iptables-allports-dualchain\nbanaction_allports = iptables-allports-dualchain\n\n[sshd]\nenabled = true\nport    = ssh\nlogpath = %(sshd_log)s\nbackend = %(sshd_backend)s\n"
+      "content": "[INCLUDES]\n\nbefore = paths-arch.conf\n\n[DEFAULT]\n\n# Never act on the machine itself or on a tunnel peer: the mesh's private range is\n# ${machine:mesh-range}, named here rather than written as a value the module cannot\n# know (novox/hq ADR 0112). Without this, fail2ban could ban the mesh's own nodes.\nignoreip = 127.0.0.1/8 ::1 ${machine:mesh-range}\n\nbantime  = 10m\nfindtime = 10m\nmaxretry = 5\n\nbanaction = ufw\nbanaction_allports = iptables-allports\n\n[sshd]\nenabled = true\nport    = ssh\nlogpath = %(sshd_log)s\nbackend = %(sshd_backend)s\n"
     },
     {
       "id": "jail-sshd",
@@ -42,14 +42,6 @@
       "mode": "0644",
       "content": "[sshd]\nenabled = true\nport    = ssh\nlogpath = %(sshd_log)s\nbackend = %(sshd_backend)s\nmaxretry = 5\n"
     },
-    {
-      "id": "log",
-      "type": "file",
-      "path": "/var/log/fail2ban.log",
-      "mode": "0640",
-      "create-once": true,
-      "content": ""
-    },
     {
       "id": "jail-recidive",
       "type": "file",

modules/gitea/client.ts

@@ -9,8 +9,6 @@ import { ConfiguredToken, MintedToken, type TokenSource } from "./token.js";
 /** A repository, trimmed to what the mesh cares about. */
 export interface GiteaRepo {
   full_name: string;
-  /** The URL a build clones — what a module records as its source. */
-  clone_url?: string;
   name: string;
   owner: string;
   private: boolean;
@@ -36,9 +34,6 @@ export interface GiteaPull {
   title: string;
   state: string;
   merged: boolean;
-  /** The commit the merge produced — what a build of the base branch is made from. */
-  merge_commit_sha?: string;
-  merged_at?: string;
   user?: string;
   head?: string;
   base?: string;
@@ -95,13 +90,6 @@ export class GiteaClient {
     if (res.status === 401) {
       token = await this.tokens.renew(token);
       res = await this.send(path, options, token);
-    } else if (res.status === 403) {
-      // A kept token minted before a scope was added lacks it. The forge says so; the source
-      // re-mints with the whole list and the call is retried once. Any other 403 stays a 403.
-      const text = await res.text();
-      if (!MintedToken.lacksScope(res.status, text)) throw new Error(`Gitea API ${path}: 403 ${text}`);
-      token = await this.tokens.renew(token);
-      res = await this.send(path, options, token);
     }
     if (!res.ok) throw new Error(`Gitea API ${path}: ${res.status} ${await res.text()}`);
     if (res.status === 204) return null as T;
@@ -128,23 +116,9 @@ export class GiteaClient {
 
   // ---- Repositories ----
 
-  /** Every repository this token can see, one page. `/user/repos` is only what the token's own
-   *  user owns — for the mesh's administrator that is nothing, which is how the forge watched an
-   *  empty list and announced no merge (2026-09-28). The search endpoint is the forge's whole view. */
   async listRepos(page = 1, limit = 20): Promise<GiteaRepo[]> {
-    const found = await this.request<{ data?: any[] }>(`/repos/search?page=${page}&limit=${limit}`);
+    const repos = await this.request<any[]>(`/user/repos?page=${page}&limit=${limit}`);
-    return (found?.data ?? []).map(GiteaClient.mapRepo);
+    return (repos ?? []).map(GiteaClient.mapRepo);
-  }
-
-  /** Every repository, all pages. */
-  async listAllRepos(): Promise<GiteaRepo[]> {
-    const all: GiteaRepo[] = [];
-    for (let page = 1; page < 100; page++) {
-      const batch = await this.listRepos(page, 50);
-      all.push(...batch);
-      if (batch.length < 50) break;
-    }
-    return all;
   }
 
   async createRepo(data: {
@@ -236,17 +210,6 @@ export class GiteaClient {
     return GiteaClient.mapPull(await this.request<any>(`/repos/${owner}/${repo}/pulls/${index}`));
   }
 
-  /** The files a merged pull request changed, as paths from the repository's root.
-   *
-   *  `limit` is what is asked for, and a merge that changed more says so rather than being read
-   *  page by page: what the mesh does with a partial list is treat the whole repository as changed,
-   *  so more pages would buy nothing. */
-  async listPullFiles(owner: string, repo: string, index: number, limit = 100): Promise<{ paths: string[]; truncated: boolean }> {
-    const files = await this.request<any[]>(`/repos/${owner}/${repo}/pulls/${index}/files?limit=${limit}`);
-    const paths = (files ?? []).map((f) => String(f?.filename ?? "")).filter((p) => p !== "");
-    return { paths, truncated: paths.length >= limit };
-  }
-
   async createPullRequest(
     owner: string,
     repo: string,
@@ -269,7 +232,6 @@ export class GiteaClient {
   private static mapRepo(r: any): GiteaRepo {
     return {
       full_name: r.full_name,
-      clone_url: r.clone_url ?? undefined,
       name: r.name,
       owner: r.owner?.login ?? r.full_name?.split("/")[0] ?? "unknown",
       private: Boolean(r.private),
@@ -297,8 +259,6 @@ export class GiteaClient {
       title: p.title,
       state: p.state,
       merged: Boolean(p.merged),
-      merge_commit_sha: p.merge_commit_sha ?? undefined,
-      merged_at: p.merged_at ?? undefined,
       user: p.user?.login,
       head: p.head?.ref,
       base: p.base?.ref,

modules/gitea/index.ts

@@ -31,11 +31,11 @@ try {
 const seen = new Set<string>();
 let primed = false;
 async function pollRepos(client: GiteaClient): Promise<void> {
-  const repos = await client.listAllRepos();
+  const repos = await client.listRepos(1, 50);
   for (const repo of repos) {
     if (!seen.has(repo.full_name)) {
       if (primed) {
-        await emit("repo.created", {
+        await emit("module.gitea.repo.created", {
           full_name: repo.full_name,
           owner: repo.owner,
           name: repo.name,
@@ -49,83 +49,6 @@ async function pollRepos(client: GiteaClient): Promise<void> {
   primed = true;
 }
 
-// **A merge is announced whoever made it.** The merge tool below emits at the instant it acts; a
-// merge made in the forge's own pages or over its API would emit nothing, and the mesh would go on
-// believing every module current with its source (novox/hq 04-ISSUES/131). So merged pull requests
-// are watched the way repositories are: what the forge holds, asked for on a tick, announced once.
-// What has been announced is kept beside the module's state, so a restart does not announce the
-// whole history again — and the first tick on a machine with no record announces nothing, because
-// everything it sees then predates the watching.
-import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
-import { join } from "node:path";
-const mergedRecord = process.env.MESH_GITEA_STATE_DIR ? join(process.env.MESH_GITEA_STATE_DIR, "merged-announced.json") : null;
-const announced = new Set<string>();
-let primedMerges = false;
-// since is the moment the watching began: a merge made before it is history, whatever page of the
-// forge's listing it surfaces on. Without it, an old merge past the first page — pushed into view
-// as newer pull requests were updated — was announced as if it had just happened, and the mesh
-// rebuilt everything built from that repository, once per old merge (2026-09-28).
-let since = "";
-if (mergedRecord && existsSync(mergedRecord)) {
-  try {
-    const kept = JSON.parse(readFileSync(mergedRecord, "utf8")) as string[] | { announced: string[]; since: string };
-    const list = Array.isArray(kept) ? kept : kept.announced;
-    for (const sha of list) announced.add(sha);
-    since = Array.isArray(kept) ? new Date().toISOString() : kept.since;
-    primedMerges = true;
-  } catch {
-    // An unreadable record is treated as no record: prime again rather than re-announce history.
-  }
-}
-function keepAnnounced(): void {
-  if (!mergedRecord) return;
-  mkdirSync(join(mergedRecord, ".."), { recursive: true });
-  const tmp = mergedRecord + ".tmp";
-  writeFileSync(tmp, JSON.stringify({ announced: [...announced].slice(-2000), since }));
-  renameSync(tmp, mergedRecord);
-}
-async function pollMerged(client: GiteaClient): Promise<void> {
-  const repos = await client.listAllRepos();
-  let changed = false;
-  for (const repo of repos) {
-    const pulls = await client.listPullRequests(repo.owner, repo.name, { state: "closed", sort: "recentupdate", limit: "20" });
-    for (const pull of pulls) {
-      if (!pull.merged || !pull.merge_commit_sha || announced.has(pull.merge_commit_sha)) continue;
-      // Announced only if merged since the watching began; recorded either way, so it is looked
-      // at once.
-      const fresh = !!pull.merged_at && !!since && pull.merged_at > since;
-      if (primedMerges && fresh) {
-        // What it changed, asked for only now: a module is rebuilt because a file inside its own
-        // directory moved, and without this every module built from a repository is rebuilt for a
-        // change to any of them (novox/hq 04-ISSUES/131).
-        const changed = await client.listPullFiles(repo.owner, repo.name, pull.number);
-        await emit("pull.merged", {
-          owner: repo.owner,
-          repo: repo.name,
-          number: pull.number,
-          title: pull.title,
-          head: pull.head,
-          base: pull.base,
-          merge_commit_sha: pull.merge_commit_sha,
-          merged_at: pull.merged_at,
-          clone_url: repo.clone_url,
-          html_url: pull.html_url,
-          paths: changed.paths,
-          paths_truncated: changed.truncated,
-        });
-        // Said, because a trigger that fires silently is indistinguishable from one that did not
-        // fire (novox/hq 04-ISSUES/131) — this line is how an operator knows the mesh was told.
-        console.log(`[gitea] announced merge ${repo.full_name}#${pull.number} (${pull.merge_commit_sha.slice(0, 8)}) into ${pull.base}`);
-      }
-      announced.add(pull.merge_commit_sha);
-      changed = true;
-    }
-  }
-  if (!primedMerges) since = new Date().toISOString();
-  if (!primedMerges || changed) keepAnnounced();
-  primedMerges = true;
-}
-
 if (gitea) {
   const client = gitea;
   // A poll that fails says so once, not once a minute: the same reason repeating (the forge not up
@@ -147,6 +70,5 @@ if (gitea) {
     run();
   };
   tick(() => pollRepos(client), 60_000);
-  tick(() => pollMerged(client), 30_000);
+  console.log("[gitea] watching for new repositories");
-  console.log("[gitea] watching for new repositories and merged pull requests");
 }

modules/gitea/module.json

@@ -13,7 +13,7 @@
     "route": {
       "web": {
         "label": "git",
-        "endpoint": "web"
+        "port": 3000
       },
       "internal-api-refused": {
         "label": "git",
@@ -38,20 +38,18 @@
     "container-runtime"
   ],
   "emits": [
-    "repo.created",
+    "module.gitea.repo.created",
-    "issue.opened",
+    "module.gitea.issue.opened",
-    "pull.merged"
+    "module.gitea.pull.merged"
   ],
   "listens": [
     {
-      "name": "web",
       "port": 3000,
       "protocol": "tcp",
       "from": "mesh",
       "why": "the forge, over http"
     },
     {
-      "name": "ssh",
       "port": 22,
       "protocol": "tcp",
       "from": "mesh",

modules/gitea/test/token.test.ts

@@ -29,7 +29,6 @@ interface Forge {
   mints: number;
   lastScopes: string[] | null;
   tokens: Map<string, string>;
-  scopesOf: Map<string, string[]>;
   admins: Map<string, string>;
   close(): Promise<void>;
 }
@@ -86,20 +85,6 @@ function fakeForge(): Promise<Forge> {
       }
       return json(res, 405, { message: "method not allowed" });
     }
-    if (url.pathname === "/api/v1/repos/search") {
-      // The client lists through the search endpoint since 2026-09-28 (the forge's whole view);
-      // it sits under `repository`, which write:repository covers.
-      const h = req.headers.authorization ?? "";
-      const value = h.startsWith("token ") ? h.slice(6) : "";
-      if (![...forge.tokens.values()].includes(value)) return json(res, 401, { message: "token is required" });
-      if (!covers(forge.scopesOf.get(value) ?? [], "read:repository")) {
-        return json(res, 403, { message: `token does not have at least one of required scope(s), required=[read:repository]` });
-      }
-      return json(res, 200, {
-        ok: true,
-        data: [{ full_name: "novox/hq", name: "hq", owner: { login: "novox" }, private: true, html_url: "http://fake/novox/hq" }],
-      });
-    }
     if (url.pathname === "/api/v1/user/repos") {
       const h = req.headers.authorization ?? "";
       const value = h.startsWith("token ") ? h.slice(6) : "";
@@ -116,21 +101,6 @@ function fakeForge(): Promise<Forge> {
         { full_name: "novox/hq", name: "hq", owner: { login: "novox" }, private: true, html_url: "http://fake/novox/hq" },
       ]);
     }
-    const adminUser = url.pathname.match(/^\/api\/v1\/admin\/users\/([^/]+)$/);
-    if (adminUser && req.method === "PATCH") {
-      const h = req.headers.authorization ?? "";
-      const value = h.startsWith("token ") ? h.slice(6) : "";
-      if (![...forge.tokens.values()].includes(value)) return json(res, 401, { message: "token is required" });
-      if (!covers(forge.scopesOf.get(value) ?? [], "write:admin")) {
-        return json(res, 403, {
-          message: `token does not have at least one of required scope(s), required=[write:admin]`,
-        });
-      }
-      const login = decodeURIComponent(adminUser[1]);
-      if (login === "untouchable") return json(res, 403, { message: "user untouchable may not be edited" });
-      const patch = await body(req);
-      return json(res, 200, { login, is_admin: patch?.admin === true });
-    }
     return json(res, 404, { message: "no such route in the fake" });
   });
   return new Promise((resolve) => {
@@ -141,7 +111,6 @@ function fakeForge(): Promise<Forge> {
         get mints() { return forge.mints; },
         get lastScopes() { return forge.lastScopes; },
         tokens: forge.tokens,
-        scopesOf: forge.scopesOf,
         admins: forge.admins,
         close: () => new Promise((r) => server.close(() => r())),
       });
@@ -183,14 +152,14 @@ function minted(env: NodeJS.ProcessEnv, logs: string[]): GiteaClient {
 const forge = await fakeForge();
 after(() => forge.close());
 
-test("first start: mints with the admin account, keeps the token at 0600, asks for the tools' scopes only", async () => {
+test("first start: mints with the admin account, keeps the token at 0600, asks for two scopes only", async () => {
   const { env, file, logs } = await delivered(forge);
 
   const repos = await minted(env, logs).listRepos();
 
   assert.equal(repos[0]?.full_name, "novox/hq");
   assert.equal(forge.mints, 1);
-  assert.deepEqual(forge.lastScopes, ["write:repository", "write:issue", "read:user", "write:admin"]);
+  assert.deepEqual(forge.lastScopes, ["write:repository", "write:issue", "read:user"]);
   assert.deepEqual(forge.lastScopes, [...TOKEN_SCOPES]);
   const token = forge.tokens.get("mesh-tools")!;
   assert.equal(await readFile(file, "utf8"), token + "\n");
@@ -228,34 +197,6 @@ test("the forge rejects the kept token (its data was restored): minted afresh, o
   assert.ok(logs.some((l) => l.startsWith("the forge rejected the kept token")), logs.join("\n"));
 });
 
-test("a kept token from before write:admin: the forge refuses the admin route for the scope, the token is re-minted with the whole list, and the call goes through", async () => {
-  const { env, file, logs } = await delivered(forge);
-  const client = minted(env, logs);
-  await client.listRepos();
-  const before = forge.mints;
-  const old = forge.tokens.get("mesh-tools")!;
-  forge.scopesOf.set(old, ["write:repository", "write:issue", "read:user"]); // minted by the previous build
-
-  const user = await client.api<{ login: string; is_admin: boolean }>("/admin/users/mesh_novox_builder", {
-    method: "PATCH",
-    body: JSON.stringify({ admin: true }),
-  });
-
-  assert.equal(user.is_admin, true);
-  assert.equal(forge.mints, before + 1);
-  assert.deepEqual(forge.lastScopes, [...TOKEN_SCOPES]);
-  assert.notEqual(forge.tokens.get("mesh-tools"), old);
-  assert.equal(await readFile(file, "utf8"), forge.tokens.get("mesh-tools") + "\n");
-  assert.ok(logs.some((l) => l.startsWith("the forge rejected the kept token")), logs.join("\n"));
-  // A 403 that is not about scopes is the forge's answer, not a reason to mint.
-  const again = forge.mints;
-  await assert.rejects(
-    client.api("/admin/users/untouchable", { method: "PATCH", body: JSON.stringify({ admin: true }) }),
-    /403 .*untouchable/,
-  );
-  assert.equal(forge.mints, again);
-});
-
 test("the kept file is gone but the forge still holds a token by that name: replaced, not refused", async () => {
   const { env, file, logs } = await delivered(forge);
   await minted(env, logs).listRepos();

modules/gitea/token.ts

@@ -34,21 +34,15 @@ export const TOKEN_NAME = "mesh-tools";
  *                      It sits under the `user` category despite listing repositories, not `repository`
  *                      — confirmed against the running forge (1.27.3), which answered
  *                      `required=[read:user]` to a token carrying only the other two.
- *   write:admin      — /admin/users: the forge's own users are the mesh's to settle, such as making
+ * Nothing under /admin, /orgs or write:user — the escape-hatch tool reaches only what these three cover.
- *                      the builder's login a site admin so every repository the mesh may build is
- *                      clonable (novox/hq 229). Nothing under /orgs or write:user.
- *
- * A token kept from before a scope was added lacks it: the forge answers such a call with
- * `403 token does not have at least one of required scope(s)`, and the client treats that like a
- * 401 — the source re-mints by name, with the whole list, and the call is retried once.
  */
-export const TOKEN_SCOPES: readonly string[] = ["write:repository", "write:issue", "read:user", "write:admin"];
+export const TOKEN_SCOPES: readonly string[] = ["write:repository", "write:issue", "read:user"];
 
 /** Where a client's token comes from, and what to do when the forge says it is wrong. */
 export interface TokenSource {
   /** The token to authenticate with now; minted, read or configured. */
   current(): Promise<string>;
-  /** The forge answered 401 to `rejected`, or 403 for a scope it lacks. A fresh token, or a plain error when there is nothing to renew with. */
+  /** The forge answered 401 to `rejected`. A fresh token, or a plain error when there is nothing to renew with. */
   renew(rejected: string): Promise<string>;
 }
 
@@ -176,11 +170,6 @@ export class MintedToken implements TokenSource {
     return this.mint("the forge rejected the kept token — minting a fresh one");
   }
 
-  /** What the forge's scoped tokens say when a kept token predates a scope the tools now need. */
-  static lacksScope(status: number, body: string): boolean {
-    return status === 403 && /required scope/i.test(body);
-  }
-
   /** One mint at a time: concurrent first calls share it, rather than each minting its own. */
   private mint(why: string): Promise<string> {
     if (this.inflight === null) {

modules/gitea/tools/index.ts

@@ -124,7 +124,7 @@ export function getGiteaTools(gitea: GiteaClient): ToolDefinition[] {
           labels: labelIds,
         });
         // The mesh just opened an issue — announce it the moment it exists.
-        await emit("issue.opened", {
+        await emit("module.gitea.issue.opened", {
           owner,
           repo,
           number: issue.number,
@@ -231,24 +231,15 @@ export function getGiteaTools(gitea: GiteaClient): ToolDefinition[] {
         // Read the PR first, so the merged event carries a title and branches, not just a number.
         const pull = await gitea.getPullRequest(owner, repo, number);
         await gitea.mergePullRequest(owner, repo, number, method, deleteBranch);
-        // Read it again: the merge commit only exists now, and it is what a build is made from.
+        await emit("module.gitea.pull.merged", {
-        const merged = await gitea.getPullRequest(owner, repo, number);
-        // And what it changed, so the mesh rebuilds the modules whose own files moved rather than
-        // every module built from the repository (novox/hq 04-ISSUES/131).
-        const changed = await gitea.listPullFiles(owner, repo, number);
-        await emit("pull.merged", {
           owner,
           repo,
           number,
           title: pull.title,
           head: pull.head,
           base: pull.base,
-          merge_commit_sha: merged.merge_commit_sha,
-          merged_at: merged.merged_at,
           method,
           html_url: pull.html_url,
-          paths: changed.paths,
-          paths_truncated: changed.truncated,
         });
         return { merged: true, number, method, deleted_branch: deleteBranch };
       },

modules/grafana/index.ts

@@ -40,7 +40,7 @@ async function pollAlerts(client: GrafanaClient): Promise<void> {
     for (const key of now) {
       if (!firing.has(key)) {
         const a = byKey.get(key)!;
-        await emit("alert.firing", { name: a.name, labels: a.labels, activeAt: a.activeAt });
+        await emit("module.grafana.alert.firing", { name: a.name, labels: a.labels, activeAt: a.activeAt });
       }
     }
   }

modules/grafana/module.json

@@ -2,10 +2,10 @@
   "module": "grafana",
   "version": "1",
   "emits": [
-    "alert.firing"
+    "module.grafana.alert.firing"
   ],
   "own-secrets": {
-    "admin": "/var/lib/mesh/grafana/admin",
+    "admin": "/var/lib/grafana-module/admin.secret",
     "broker": "/var/lib/mesh/grafana/broker"
   },
   "capabilities": [
@@ -13,7 +13,6 @@
   ],
   "listens": [
     {
-      "name": "web",
       "port": 3000,
       "protocol": "tcp",
       "from": "mesh",
@@ -30,87 +29,45 @@
     {
       "id": "state",
       "type": "directory",
-      "mode": "0700",
+      "path": "/var/lib/grafana-module",
-      "place": "."
+      "mode": "0700"
     },
     {
       "id": "data",
       "type": "directory",
+      "path": "/services/grafana/data",
       "mode": "0700",
       "owner": "472:472"
     },
     {
-      "id": "admin-secret",
+      "id": "server-env",
       "type": "file",
-      "path": "${dir:state}/admin.secret",
+      "path": "/var/lib/grafana-module/server.env",
-      "mode": "0400",
+      "mode": "0600",
-      "owner": "472:472",
+      "content": "GF_SECURITY_ADMIN_PASSWORD=${secret:admin}\n"
-      "content": "${secret:admin}"
-    },
-    {
-      "id": "oidc-secret",
-      "type": "file",
-      "path": "${dir:state}/oidc-client.secret",
-      "mode": "0400",
-      "owner": "472:472",
-      "content": "${secret:oidc-client}"
-    },
-    {
-      "id": "oidc-env",
-      "type": "file",
-      "path": "${dir:state}/oidc.env",
-      "mode": "0644",
-      "content": "GF_SERVER_ROOT_URL=https://${bound:route:name}\nGF_AUTH_GENERIC_OAUTH_ENABLED=true\nGF_AUTH_GENERIC_OAUTH_NAME=Keycloak\nGF_AUTH_GENERIC_OAUTH_CLIENT_ID=${bound:oidc-client:as}\nGF_AUTH_GENERIC_OAUTH_CLIENT_SECRET__FILE=/run/secrets/oidc-client\nGF_AUTH_GENERIC_OAUTH_SCOPES=openid email profile roles\nGF_AUTH_GENERIC_OAUTH_AUTH_URL=${bound:oidc-client:issuer}${bound:oidc-client:authorization-path}\nGF_AUTH_GENERIC_OAUTH_TOKEN_URL=${bound:oidc-client:issuer}${bound:oidc-client:token-path}\nGF_AUTH_GENERIC_OAUTH_API_URL=${bound:oidc-client:issuer}${bound:oidc-client:userinfo-path}\nGF_AUTH_GENERIC_OAUTH_ROLE_ATTRIBUTE_PATH=contains(roles[*], 'admin') && 'Admin' || contains(realm_access.roles[*], 'admin') && 'Admin' || 'Viewer'\nGF_AUTH_GENERIC_OAUTH_USE_PKCE=true\nGF_AUTH_GENERIC_OAUTH_ALLOW_SIGN_UP=true\nGF_AUTH_GENERIC_OAUTH_ALLOW_ASSIGN_GRAFANA_ADMIN=true\n"
-    },
-    {
-      "id": "influxdb-secret",
-      "type": "file",
-      "path": "${dir:state}/influxdb-api.secret",
-      "mode": "0400",
-      "owner": "472:472",
-      "content": "${secret:influxdb-api}"
-    },
-    {
-      "id": "influxdb-datasource",
-      "type": "file",
-      "path": "${dir:state}/datasource-influxdb.yaml",
-      "mode": "0644",
-      "content": "apiVersion: 1\n# Written by the mesh from grafana's influxdb-api binding; grafana reads it at start. Its own name and\n# uid, so a data source somebody made in the UI is never overwritten, and read-only in the UI because\n# the mesh resets it. The password is read from the file the mesh delivers, never written here.\ndatasources:\n  - name: InfluxDB (mesh)\n    uid: mesh-influxdb-api\n    type: influxdb\n    access: proxy\n    url: ${bound:influxdb-api:scheme}://${bound:influxdb-api:at}:${bound:influxdb-api:port}\n    user: ${bound:influxdb-api:as}\n    isDefault: false\n    editable: false\n    jsonData:\n      dbName: ${bound:influxdb-api:bucket}\n      httpMode: POST\n    secureJsonData:\n      password: $__file{/run/secrets/influxdb-api}\n"
     },
     {
       "id": "server",
       "type": "container",
       "name": "grafana",
-      "image": "grafana/grafana@sha256:ac461fb352abc50da10a51c7d02462e9c05488f11f53f14b3ad79a8145f638a0",
+      "image": "grafana/grafana@sha256:f772d434e8fab0049deb2b1b30abd43342bcfca1537614aa8d36080232cf4283",
       "ports": [
         "3000"
       ],
       "volumes": [
-        "${dir:data}:/var/lib/grafana",
+        "/services/grafana/data:/var/lib/grafana"
-        "${dir:state}/admin.secret:/run/secrets/admin:ro",
-        "${dir:state}/oidc-client.secret:/run/secrets/oidc-client:ro",
-        "${dir:state}/influxdb-api.secret:/run/secrets/influxdb-api:ro",
-        "${dir:state}/datasource-influxdb.yaml:/etc/grafana/provisioning/datasources/mesh-influxdb.yaml:ro"
       ],
-      "env": {
-        "GF_SECURITY_ADMIN_PASSWORD__FILE": "/run/secrets/admin"
-      },
       "env-file": [
-        "${dir:state}/oidc.env"
+        "/var/lib/grafana-module/server.env"
       ],
-      "restart-on": [
+      "secrets-in-environment": "grafana honours GF_SECURITY_ADMIN_PASSWORD__FILE; convertible, awaiting a bed that exercises the admin password (assigned-grafana serves tools only)"
-        "oidc-env",
-        "oidc-secret",
-        "influxdb-datasource",
-        "influxdb-secret"
-      ]
     },
     {
       "id": "runtime-config",
       "type": "file",
       "path": "/var/lib/mesh/grafana/config.json",
       "mode": "0600",
-      "content": "{\n  \"user\": \"admin\",\n  \"password\": \"${secret:admin}\"\n}\n",
+      "content": "{}\n",
       "merge": "json"
     },
     {
@@ -124,7 +81,7 @@
       ],
       "env": {
         "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_GRAFANA_URL": "http://127.0.0.1:${port:3000}",
+        "MESH_GRAFANA_URL": "http://127.0.0.1:3000",
         "MESH_GRAFANA_CONFIG_FILE": "/run/config/config.json"
       },
       "restart-on": [
@@ -134,32 +91,16 @@
     }
   ],
   "requires": [
-    "route",
+    "route"
-    "oidc-client",
-    "influxdb-api"
   ],
   "contributes": {
     "route": {
       "label": "grafana",
-      "endpoint": "web"
+      "port": 3000
-    },
-    "oidc-client": {
-      "label": "grafana",
-      "endpoint": "web",
-      "callback": "/login/generic_oauth"
-    },
-    "influxdb-api": {
-      "access": "read"
     }
   },
   "binds": {
-    "route": "${dir:state}/route.json",
+    "route": "/var/lib/mesh/grafana/route.json"
-    "oidc-client": "${dir:state}/oidc.json",
-    "influxdb-api": "${dir:state}/influxdb.json"
-  },
-  "secrets": {
-    "oidc-client": "/var/lib/mesh/grafana/oidc-client",
-    "influxdb-api": "/var/lib/mesh/grafana/influxdb-api"
   },
   "build": {
     "on": [

modules/hello-web/module.json

@@ -11,7 +11,7 @@
   "contributes": {
     "route": {
       "label": "hello",
-      "endpoint": "web"
+      "port": 8080
     }
   },
   "binds": {
@@ -19,7 +19,6 @@
   },
   "listens": [
     {
-      "name": "web",
       "port": 8080,
       "protocol": "tcp",
       "from": "mesh",

modules/home-assistant/index.ts

@@ -44,7 +44,7 @@ async function pollStates(): Promise<void> {
   for (const s of states) {
     const prev = lastState.get(s.entity_id);
     if (primed && prev !== undefined && prev !== s.state) {
-      await emit("state.changed", {
+      await emit("module.home-assistant.state.changed", {
         entity: s.entity_id,
         name: nameOf(s),
         from: prev,

modules/home-assistant/module.json

@@ -6,7 +6,7 @@
     "container-runtime"
   ],
   "emits": [
-    "state.changed"
+    "module.home-assistant.state.changed"
   ],
   "own-secrets": {
     "broker": "/var/lib/mesh/home-assistant/broker",
@@ -14,7 +14,6 @@
   },
   "listens": [
     {
-      "name": "web",
       "port": 8123,
       "protocol": "tcp",
       "from": "mesh",
@@ -86,7 +85,7 @@
   "contributes": {
     "route": {
       "label": "home-assistant",
-      "endpoint": "web"
+      "port": 8123
     }
   },
   "binds": {

modules/icecast/index.ts

@@ -23,7 +23,7 @@ async function pollMounts(): Promise<void> {
   if (primed) {
     for (const [mount, m] of now) {
       if (!live.has(mount)) {
-        await emit("stream.started", {
+        await emit("module.icecast.stream.started", {
           mount,
           name: m.name,
           description: m.description,
@@ -33,7 +33,7 @@ async function pollMounts(): Promise<void> {
     }
     for (const [mount, m] of live) {
       if (!now.has(mount)) {
-        await emit("stream.stopped", { mount, name: m.name });
+        await emit("module.icecast.stream.stopped", { mount, name: m.name });
       }
     }
   }

modules/icecast/module.json

@@ -1,43 +1,22 @@
 {
   "module": "icecast",
   "version": "1",
-  "requires": [
-    "route",
-    "secret"
-  ],
-  "contributes": {
-    "route": {
-      "label": "icecast",
-      "endpoint": "stream"
-    }
-  },
-  "binds": {
-    "route": "${dir:state}/route.json"
-  },
-  "secrets": {
-    "secret": {
-      "source": "${dir:state}/source.secret",
-      "admin": "${dir:state}/admin.secret",
-      "relay": "${dir:state}/relay.secret"
-    }
-  },
   "capabilities": [
     "container-runtime"
   ],
   "emits": [
-    "stream.started",
+    "module.icecast.stream.started",
-    "stream.stopped"
+    "module.icecast.stream.stopped"
   ],
   "own-secrets": {
     "broker": "/var/lib/mesh/icecast/broker"
   },
   "listens": [
     {
-      "name": "stream",
       "port": 8000,
       "protocol": "tcp",
       "from": "mesh",
-      "why": "streams in from sources (HTTP PUT) and out to listeners, plus the status and admin pages; a public name is its route"
+      "why": "streams in from sources and out to listeners"
     }
   ],
   "resources": [
@@ -50,43 +29,28 @@
     {
       "id": "state",
       "type": "directory",
-      "mode": "0700",
+      "path": "/var/lib/icecast-module",
-      "place": "."
+      "mode": "0700"
     },
     {
-      "id": "logs",
+      "id": "server-env",
-      "type": "directory",
-      "mode": "0700",
-      "owner": "100:101"
-    },
-    {
-      "id": "server-conf",
       "type": "file",
-      "path": "${dir:state}/icecast.xml",
+      "path": "/var/lib/icecast-module/server.env",
       "mode": "0600",
-      "content": "<icecast>\n    <!-- Written by the mesh (modules/icecast). Passwords arrive as secrets rendered into this file,\n         never as environment: the image's entrypoint seds ICECAST_* variables into the file only\n         when they are set, and none are. -->\n    <location>Earth</location>\n    <admin>icemaster@localhost</admin>\n    <limits>\n        <clients>100</clients>\n        <sources>2</sources>\n        <queue-size>524288</queue-size>\n        <client-timeout>30</client-timeout>\n        <header-timeout>15</header-timeout>\n        <source-timeout>10</source-timeout>\n        <burst-on-connect>1</burst-on-connect>\n        <burst-size>65535</burst-size>\n    </limits>\n    <authentication>\n        <source-password>${secret:source}</source-password>\n        <relay-password>${secret:relay}</relay-password>\n        <admin-user>admin</admin-user>\n        <admin-password>${secret:admin}</admin-password>\n    </authentication>\n    <!-- The name icecast writes into playlists (.m3u/.xspf: http://<hostname>:<port>/<mount>) and\n         would announce to YP (none configured). A machine's own name belongs to its assignment, and\n         an assignment merges only into JSON; this XML cannot take it, so the neutral default stays. -->\n    <hostname>localhost</hostname>\n    <listen-socket>\n        <port>8000</port>\n    </listen-socket>\n    <http-headers>\n        <header name=\"Access-Control-Allow-Origin\" value=\"*\" />\n    </http-headers>\n    <fileserve>1</fileserve>\n    <paths>\n        <basedir>/usr/share/icecast</basedir>\n        <logdir>/var/log/icecast</logdir>\n        <webroot>/usr/share/icecast/web</webroot>\n        <adminroot>/usr/share/icecast/admin</adminroot>\n        <alias source=\"/\" destination=\"/status.xsl\"/>\n    </paths>\n    <logging>\n        <accesslog>access.log</accesslog>\n        <errorlog>error.log</errorlog>\n        <loglevel>3</loglevel>\n        <logsize>10000</logsize>\n    </logging>\n    <security>\n        <chroot>0</chroot>\n        <!-- Starts as root, reads this 0600 root-owned file, then drops to the image's icecast user\n             (uid 100, group icecast 101) before serving. -->\n        <changeowner>\n            <user>icecast</user>\n            <group>icecast</group>\n        </changeowner>\n    </security>\n</icecast>\n"
+      "content": "ICECAST_SOURCE_PASSWORD=${secret:source}\nICECAST_ADMIN_PASSWORD=${secret:admin}\nICECAST_RELAY_PASSWORD=${secret:relay}\nICECAST_ADMIN_USERNAME=admin\n"
-    },
-    {
-      "id": "net",
-      "type": "network",
-      "name": "icecast"
     },
     {
       "id": "server",
       "type": "container",
       "name": "icecast",
       "image": "infiniteproject/icecast@sha256:cd506cf3dfe31ce05fd37d7e672dbd1213e7255cc93d28ecf5a3b547af4e162c",
-      "network": "icecast",
+      "env-file": [
+        "/var/lib/icecast-module/server.env"
+      ],
       "ports": [
         "8000"
       ],
-      "volumes": [
+      "secrets-in-environment": "the image seds ICECAST_*_PASSWORD into icecast.xml and has no _FILE; convertible by mounting a generated icecast.xml, not yet done"
-        "${dir:state}/icecast.xml:/etc/icecast.xml:ro",
-        "${dir:logs}:/var/log/icecast"
-      ],
-      "restart-on": [
-        "server-conf"
-      ]
     },
     {
       "id": "runtime-config",
@@ -100,14 +64,14 @@
       "id": "runtime",
       "type": "container",
       "name": "mesh-icecast",
-      "network": "icecast",
+      "network": "host",
       "volumes": [
         "/var/lib/mesh/icecast/broker:/run/secrets/broker:ro",
         "/var/lib/mesh/icecast/config.json:/run/config/config.json:ro"
       ],
       "env": {
         "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_ICECAST_URL": "http://icecast:8000",
+        "MESH_ICECAST_URL": "http://127.0.0.1:8000",
         "MESH_ICECAST_CONFIG_FILE": "/run/config/config.json"
       },
       "restart-on": [
@@ -136,5 +100,15 @@
         "from": "Dockerfile"
       }
     ]
+  },
+  "requires": [
+    "secret"
+  ],
+  "secrets": {
+    "secret": {
+      "source": "/var/lib/icecast-module/source.secret",
+      "admin": "/var/lib/icecast-module/admin.secret",
+      "relay": "/var/lib/icecast-module/relay.secret"
+    }
   }
 }

modules/influxdb/Dockerfile

@@ -13,7 +13,7 @@ ARG RUNTIME_BASE
 FROM ${BUILD_BASE} AS build
 WORKDIR /app/modules/influxdb
 COPY . .
-RUN node /app/node_modules/typescript/bin/tsc client.ts grants.ts provisioner/index.ts tools/index.ts \
+RUN node /app/node_modules/typescript/bin/tsc client.ts tools/index.ts \
       --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist
 
 FROM ${RUNTIME_BASE}
@@ -21,4 +21,4 @@ COPY --from=build /app/modules/influxdb/dist /app/modules/influxdb/dist
 # Every serve-time entrypoint, loaded by the runtime in serve mode: tools and events serve, and a
 # provider's provisioner runs its reconcile loop in the same process, with the broker connected —
 # the convention novox/hq issues 060/061 settled.
-ENV MESH_TOOL_MODULES=/app/modules/influxdb/dist/tools/index.js,/app/modules/influxdb/dist/provisioner/index.js
+ENV MESH_TOOL_MODULES=/app/modules/influxdb/dist/tools/index.js

modules/influxdb/client.ts

@@ -17,25 +17,6 @@ export interface InfluxBucket {
   retentionSeconds?: number;
 }
 
-/** One permission of an authorization, as InfluxDB represents it: an action on a resource type,
- *  in one org, optionally narrowed to one resource by id (no id = every resource of that type). */
-export interface InfluxPermission {
-  action: "read" | "write";
-  resource: { type: string; orgID?: string; id?: string; name?: string; org?: string };
-}
-
-/** A v1-compatibility ("legacy") authorization: a username (InfluxDB calls it `token`) and a
- *  password the caller chooses, scoped by permissions. The one credential InfluxDB 2.x lets a
- *  caller set to a value it did not generate — which is what a mesh-minted password needs. */
-export interface LegacyAuthorization {
-  id: string;
-  token: string;
-  orgID: string;
-  status?: "active" | "inactive";
-  description?: string;
-  permissions: InfluxPermission[];
-}
-
 /** The settings-merged config the mesh delivers (novox/hq ADR 0046): { url, apiKey, token, password, user, ... }. */
 function meshConfig(file?: string): Record<string, string> {
   if (!file) return {};
@@ -43,20 +24,13 @@ function meshConfig(file?: string): Record<string, string> {
   catch { return {}; }
 }
 
-/** A secret delivered as a file, trimmed; undefined when there is none, so the caller can fall back. */
-function tokenFromFile(file?: string): string | undefined {
-  if (!file) return undefined;
-  try { return readFileSync(file, "utf8").trim() || undefined; }
-  catch { return undefined; }
-}
-
 export class InfluxDBClient {
   readonly baseUrl: string;
 
   constructor(
     url: string,
     private readonly token: string,
-    readonly org: string,
+    private readonly org: string,
   ) {
     this.baseUrl = url.replace(/\/$/, "");
   }
@@ -69,10 +43,8 @@ export class InfluxDBClient {
   static fromEnv(env: NodeJS.ProcessEnv = process.env): InfluxDBClient {
     const cfg = meshConfig(env.MESH_INFLUXDB_CONFIG_FILE);
     const url = cfg.url ?? env.MESH_INFLUXDB_URL ?? `http://127.0.0.1:${env.INFLUXDB_PORT ?? "8086"}`;
-    // The token reaches the process as a file (novox/hq ADR 0086); the environment variable stays
+    const token = cfg.token ?? env.MESH_INFLUXDB_TOKEN;
-    // only for a workstation running the tools by hand.
+    if (!token) throw new Error("no InfluxDB token — set MESH_INFLUXDB_TOKEN");
-    const token = cfg.token ?? tokenFromFile(env.MESH_INFLUXDB_TOKEN_FILE) ?? env.MESH_INFLUXDB_TOKEN;
-    if (!token) throw new Error("no InfluxDB token — set MESH_INFLUXDB_TOKEN_FILE");
     const org = cfg.org ?? env.MESH_INFLUXDB_ORG ?? "mesh";
     return new InfluxDBClient(url, token, org);
   }
@@ -89,93 +61,6 @@ export class InfluxDBClient {
     return res;
   }
 
-  /** Like request, but the answer is returned whatever its status, for the caller to read. */
-  private async raw(path: string, init?: RequestInit): Promise<Response> {
-    return fetch(`${this.baseUrl}${path}`, {
-      ...init,
-      headers: { Authorization: `Token ${this.token}`, ...(init?.headers ?? {}) },
-    });
-  }
-
-  private async send(path: string, method: string, body?: unknown): Promise<Response> {
-    return this.request(path, {
-      method,
-      headers: { "Content-Type": "application/json" },
-      body: body === undefined ? undefined : JSON.stringify(body),
-    });
-  }
-
-  /** The id of the org of this name, or undefined when there is none. */
-  async orgID(name: string): Promise<string | undefined> {
-    const res = await this.raw(`/api/v2/orgs?org=${encodeURIComponent(name)}`);
-    if (res.status === 404) return undefined;
-    if (!res.ok) throw new Error(`InfluxDB API /api/v2/orgs: ${res.status} ${await res.text()}`);
-    const body = (await res.json()) as { orgs?: { id: string; name: string }[] };
-    return body.orgs?.find((o) => o.name === name)?.id;
-  }
-
-  /** The bucket of exactly this name in the org, or undefined. */
-  async findBucket(orgID: string, name: string): Promise<InfluxBucket | undefined> {
-    const res = await this.raw(`/api/v2/buckets?orgID=${encodeURIComponent(orgID)}&name=${encodeURIComponent(name)}`);
-    if (res.status === 404) return undefined;
-    if (!res.ok) throw new Error(`InfluxDB API /api/v2/buckets: ${res.status} ${await res.text()}`);
-    const body = (await res.json()) as { buckets?: { id: string; name: string; orgID?: string }[] };
-    const b = body.buckets?.find((x) => x.name === name);
-    return b ? { id: b.id, name: b.name, orgID: b.orgID } : undefined;
-  }
-
-  /** Create a bucket that keeps its data for ever — retention is the operator's choice, never the mesh's. */
-  async createBucket(orgID: string, name: string, description: string): Promise<InfluxBucket> {
-    const b = (await (await this.send("/api/v2/buckets", "POST", {
-      orgID, name, description, retentionRules: [],
-    })).json()) as { id: string; name: string; orgID?: string };
-    return { id: b.id, name: b.name, orgID: b.orgID };
-  }
-
-  /** The v1 authorization whose username is exactly this, or undefined. */
-  async findLegacy(username: string): Promise<LegacyAuthorization | undefined> {
-    const path = `/private/legacy/authorizations?token=${encodeURIComponent(username)}`;
-    const res = await this.raw(path);
-    // InfluxDB answers a filter matching nothing with 404, not an empty list.
-    if (res.status === 404) return undefined;
-    if (!res.ok) throw new Error(`InfluxDB API ${path}: ${res.status} ${await res.text()}`);
-    const body = (await res.json()) as { authorizations?: LegacyAuthorization[] };
-    return body.authorizations?.find((a) => a.token === username);
-  }
-
-  async createLegacy(a: Omit<LegacyAuthorization, "id">): Promise<LegacyAuthorization> {
-    return (await (await this.send("/private/legacy/authorizations", "POST", a)).json()) as LegacyAuthorization;
-  }
-
-  /** Set a v1 authorization's password. InfluxDB keeps only a hash of it, so it can be set, never read. */
-  async setLegacyPassword(id: string, password: string): Promise<void> {
-    await this.send(`/private/legacy/authorizations/${encodeURIComponent(id)}/password`, "POST", { password });
-  }
-
-  async updateLegacy(id: string, patch: { status?: "active" | "inactive"; description?: string }): Promise<void> {
-    await this.send(`/private/legacy/authorizations/${encodeURIComponent(id)}`, "PATCH", patch);
-  }
-
-  async deleteLegacy(id: string): Promise<void> {
-    await this.send(`/private/legacy/authorizations/${encodeURIComponent(id)}`, "DELETE");
-  }
-
-  /**
-   * Whether this username and password sign in on the v1 API — the consumer's own view. Asked with
-   * a statement that reads nothing (`SHOW DATABASES` lists only what the credential may read), sent
-   * with Basic auth so the password is never in a URL. 401 is a wrong password or no such user;
-   * anything else that is not a server error means InfluxDB knew who was asking.
-   */
-  async legacySignsIn(username: string, password: string): Promise<boolean> {
-    const res = await fetch(`${this.baseUrl}/query?q=${encodeURIComponent("SHOW DATABASES")}`, {
-      headers: { Authorization: `Basic ${Buffer.from(`${username}:${password}`).toString("base64")}` },
-    });
-    await res.arrayBuffer();
-    if (res.status === 401) return false;
-    if (res.status >= 500) throw new Error(`InfluxDB v1 /query: ${res.status}`);
-    return true;
-  }
-
   /** Server health — the one endpoint that needs no token, but we send it anyway. */
   async health(): Promise<InfluxHealth> {
     return (await (await this.request("/health")).json()) as InfluxHealth;

modules/influxdb/grants.ts

@@ -1,186 +0,0 @@
-// What the `influxdb-api` provision means in InfluxDB: one v1-compatibility authorization per
-// consumer, in the org this module serves, under the username and password the mesh gave both ends,
-// allowed exactly the access the consumer contributed. The provisioner (provisioner/index.ts) is the
-// sdk harness calling these; they are here, apart from it, so they can be exercised against a fake
-// InfluxDB without a broker or a contributions file.
-//
-// **Why a v1 authorization and not a v2 API token.** The mesh mints the consumer's password and
-// hands it to both ends (novox/hq ADR 0048); the provider sets it, and never hands one back. An
-// InfluxDB 2.x API token is generated by the server — `POST /api/v2/authorizations` ignores a token
-// the caller sends — so a token could only ever be the operator's to accept, one per pair, by hand.
-// A v1 authorization is a username and a password the caller chooses (8–72 characters; the mesh
-// mints 40), stored hashed, and it reads and writes through InfluxQL (`/query`) and line protocol
-// (`/write`), which every bucket answers under its own name as a database (InfluxDB maps each
-// bucket to a database of the same name by itself). That is what grafana's InfluxDB data source
-// speaks, and what Node-RED's influxdb nodes speak in their 1.x mode — so the mesh can make every
-// consumer's credential, rotate it and withdraw it, with no person in the loop.
-//
-// **What a consumer contributes.** `access`: "read" (the default), "write" or "read-write".
-// `buckets`: the buckets it may use, by name. A reader that names none may read every bucket of the
-// org — a dashboard is pointed at data, it does not own it. A writer must name its buckets: writing
-// everywhere, the org's system buckets included, is never what a consumer means. A named bucket
-// that does not exist is created, keeping its data for ever; the mesh never deletes a bucket.
-//
-// **Only what the mesh made is touched.** An authorization this module creates is named with the
-// mesh's identity prefix and its description starts with MARK. One with the same username that
-// lacks the mark is somebody else's: it is refused, never adopted, never updated, never deleted.
-// Every other authorization, token, user and bucket in the instance is left exactly as it was.
-
-import type { InfluxDBClient, InfluxPermission, LegacyAuthorization } from "./client.js";
-
-/** How a description marks an authorization as the mesh's own work. */
-export const MARK = "[mesh]";
-
-/** The prefix the mesh gives every consumer identity (novox/hq ADR 0049). */
-const IDENTITY_PREFIX = "mesh_";
-
-/** One consumer, as the harness hands it over. */
-export interface ApiGrant {
-  readonly as: string;
-  readonly password: string;
-  readonly values: Readonly<Record<string, unknown>>;
-  readonly consumer?: string;
-}
-
-export type Access = "read" | "write" | "read-write";
-
-/** What a contribution asks for, checked. Refused when it cannot be served as asked. */
-export function askedFor(values: Readonly<Record<string, unknown>>): { access: Access; buckets: string[] } {
-  const access = values.access ?? "read";
-  if (access !== "read" && access !== "write" && access !== "read-write") {
-    throw new Error(`contributes an access of ${JSON.stringify(access)} — it is "read", "write" or "read-write"`);
-  }
-  const raw = values.buckets ?? [];
-  if (!Array.isArray(raw) || raw.some((b) => typeof b !== "string" || b.trim() === "")) {
-    throw new Error(`contributes buckets of ${JSON.stringify(raw)} — a list of bucket names`);
-  }
-  const buckets = [...new Set((raw as string[]).map((b) => b.trim()))].sort();
-  if (access !== "read" && buckets.length === 0) {
-    throw new Error(`asks to write and names no bucket (\`buckets\`) — a writer names what it writes to`);
-  }
-  if (buckets.some((b) => b.startsWith("_"))) {
-    throw new Error(`names a system bucket (${buckets.filter((b) => b.startsWith("_")).join(", ")}) — those are InfluxDB's own`);
-  }
-  return { access: access as Access, buckets };
-}
-
-/** The permissions a grant resolves to, given each named bucket's id. */
-export function permissionsFor(orgID: string, access: Access, bucketIDs: string[]): InfluxPermission[] {
-  const actions: ("read" | "write")[] = access === "read-write" ? ["read", "write"] : [access];
-  const out: InfluxPermission[] = [];
-  for (const action of actions) {
-    if (bucketIDs.length === 0) {
-      out.push({ action, resource: { type: "buckets", orgID } });
-      continue;
-    }
-    for (const id of bucketIDs) out.push({ action, resource: { type: "buckets", orgID, id } });
-  }
-  return out;
-}
-
-/** A permission as a comparable string: what InfluxDB answers carries names and links besides. */
-function key(p: InfluxPermission): string {
-  return `${p.action}:${p.resource.type}:${p.resource.orgID ?? ""}:${p.resource.id ?? "*"}`;
-}
-
-function samePermissions(a: readonly InfluxPermission[], b: readonly InfluxPermission[]): boolean {
-  const x = a.map(key).sort();
-  const y = b.map(key).sort();
-  return x.length === y.length && x.every((v, i) => v === y[i]);
-}
-
-export function marked(a: Pick<LegacyAuthorization, "token" | "description">): boolean {
-  return a.token.startsWith(IDENTITY_PREFIX) && (a.description ?? "").startsWith(MARK);
-}
-
-function describe(g: ApiGrant): string {
-  return `${MARK} made by the mesh for ${g.consumer ? `a module on ${g.consumer}` : "a consumer"} — do not edit; it is reset`;
-}
-
-export class ApiGrants {
-  constructor(private readonly influx: InfluxDBClient, readonly org: string) {}
-
-  private async orgID(): Promise<string> {
-    const id = await this.influx.orgID(this.org);
-    if (!id) throw new Error(`InfluxDB has no org ${JSON.stringify(this.org)} — the org this module serves must exist`);
-    return id;
-  }
-
-  /** The ids of the named buckets, creating any that are missing when `create` says so. Undefined
-   *  when one is missing and may not be created (a read-only question). */
-  private async bucketIDs(orgID: string, names: string[], create: ApiGrant | undefined): Promise<string[] | undefined> {
-    const ids: string[] = [];
-    for (const name of names) {
-      let b = await this.influx.findBucket(orgID, name);
-      if (!b) {
-        if (!create) return undefined;
-        b = await this.influx.createBucket(orgID, name, `${MARK} made by the mesh for ${create.as}; the mesh never deletes it`);
-      }
-      ids.push(b.id);
-    }
-    return ids.sort();
-  }
-
-  /** Create the consumer's authorization, or bring the mesh's existing one back to what the grant
-   *  says. Idempotent: a second apply of the same grant changes nothing beyond re-asserting the
-   *  password, which InfluxDB can be told but never asked. */
-  async ensure(g: ApiGrant): Promise<"created" | "updated" | "unchanged"> {
-    if (!g.as.startsWith(IDENTITY_PREFIX)) {
-      throw new Error(`${g.as} is not a mesh identity — the mesh names every consumer ${IDENTITY_PREFIX}<node>_<module>`);
-    }
-    const { access, buckets } = askedFor(g.values);
-    const orgID = await this.orgID();
-    const found = await this.influx.findLegacy(g.as);
-    if (found && !marked(found)) {
-      throw new Error(
-        `InfluxDB already has a v1 authorization ${g.as} the mesh did not make — left alone; ` +
-          `delete it if the mesh should own that name`);
-    }
-    const want = permissionsFor(orgID, access, (await this.bucketIDs(orgID, buckets, g))!);
-
-    if (found && found.orgID === orgID && samePermissions(found.permissions, want)) {
-      // Only what differs is written. The password cannot be read back, so it is tried instead.
-      let changed = false;
-      if (found.status === "inactive") {
-        await this.influx.updateLegacy(found.id, { status: "active" });
-        changed = true;
-      }
-      if (!(await this.influx.legacySignsIn(g.as, g.password))) {
-        await this.influx.setLegacyPassword(found.id, g.password);
-        changed = true;
-      }
-      return changed ? "updated" : "unchanged";
-    }
-    // InfluxDB cannot change an authorization's permissions in place, so the mesh's own is made
-    // again. Only ever one the mesh made: a foreign one was refused above.
-    if (found) await this.influx.deleteLegacy(found.id);
-    const made = await this.influx.createLegacy({
-      token: g.as, orgID, status: "active", description: describe(g), permissions: want,
-    });
-    await this.influx.setLegacyPassword(made.id, g.password);
-    return found ? "updated" : "created";
-  }
-
-  /** Whether InfluxDB still holds this consumer's authorization exactly as the grant says: present,
-   *  the mesh's, active, allowed what was asked and nothing more, and signing in with the mesh's
-   *  password. Reads only — a missing bucket is "not held", never created here. */
-  async holds(g: ApiGrant): Promise<boolean> {
-    const { access, buckets } = askedFor(g.values);
-    const orgID = await this.influx.orgID(this.org);
-    if (!orgID) return false;
-    const found = await this.influx.findLegacy(g.as);
-    if (!found || !marked(found) || found.status === "inactive" || found.orgID !== orgID) return false;
-    const ids = await this.bucketIDs(orgID, buckets, undefined);
-    if (!ids || !samePermissions(found.permissions, permissionsFor(orgID, access, ids))) return false;
-    return this.influx.legacySignsIn(g.as, g.password);
-  }
-
-  /** Withdraw a consumer's authorization — only one the mesh made. Its buckets and their data stay. */
-  async remove(as: string): Promise<"removed" | "absent" | "not ours"> {
-    const found = await this.influx.findLegacy(as);
-    if (!found) return "absent";
-    if (!marked(found)) return "not ours";
-    await this.influx.deleteLegacy(found.id);
-    return "removed";
-  }
-}

modules/influxdb/module.json

@@ -1,43 +1,20 @@
 {
   "module": "influxdb",
   "version": "1",
-  "provides": [
-    {
-      "name": "influxdb-api",
-      "scope": "mesh"
-    }
-  ],
   "capabilities": [
     "container-runtime"
   ],
   "own-secrets": {
-    "broker": "/var/lib/mesh/influxdb/broker",
+    "broker": "/var/lib/mesh/influxdb/broker"
-    "admin": "${dir:state}/admin.secret",
-    "admin-token": "${dir:state}/admin-token.secret"
   },
   "listens": [
     {
-      "name": "api",
       "port": 8086,
       "protocol": "tcp",
       "from": "mesh",
-      "why": "queries, writes and the web UI, over http; consumers granted influxdb-api sign in with the mesh's credential, and a name is a route grant"
+      "why": "queries and writes, over http"
     }
   ],
-  "serves": {
-    "influxdb-api": {
-      "scheme": "http",
-      "port": 8086,
-      "org": "mesh",
-      "bucket": "default"
-    }
-  },
-  "receives": {
-    "influxdb-api": "${dir:grants}/mesh.json"
-  },
-  "grants": {
-    "influxdb-api": "${dir:grants}"
-  },
   "resources": [
     {
       "id": "mesh-state",
@@ -48,50 +25,46 @@
     {
       "id": "state",
       "type": "directory",
-      "mode": "0700",
+      "path": "/var/lib/influxdb-module",
-      "place": "."
+      "mode": "0700"
+    },
+    {
+      "id": "server-env",
+      "type": "file",
+      "path": "/var/lib/influxdb-module/server.env",
+      "mode": "0600",
+      "content": "DOCKER_INFLUXDB_INIT_MODE=setup\nDOCKER_INFLUXDB_INIT_USERNAME=admin\nDOCKER_INFLUXDB_INIT_PASSWORD=${secret:admin}\nDOCKER_INFLUXDB_INIT_ADMIN_TOKEN=${secret:admin-token}\nDOCKER_INFLUXDB_INIT_ORG=mesh\nDOCKER_INFLUXDB_INIT_BUCKET=default\n"
     },
     {
       "id": "data",
       "type": "directory",
+      "path": "/services/influxdb/data",
       "mode": "0700",
       "owner": "1000:1000"
     },
     {
       "id": "config",
       "type": "directory",
+      "path": "/services/influxdb/config",
       "mode": "0700",
       "owner": "1000:1000"
     },
-    {
-      "id": "grants",
-      "type": "directory",
-      "mode": "0700"
-    },
-    {
-      "id": "server-env",
-      "type": "file",
-      "path": "${dir:state}/server.env",
-      "mode": "0600",
-      "content": "DOCKER_INFLUXDB_INIT_MODE=setup\nDOCKER_INFLUXDB_INIT_USERNAME=admin\nDOCKER_INFLUXDB_INIT_PASSWORD_FILE=/run/secrets/admin\nDOCKER_INFLUXDB_INIT_ADMIN_TOKEN_FILE=/run/secrets/admin-token\nDOCKER_INFLUXDB_INIT_ORG=mesh\nDOCKER_INFLUXDB_INIT_BUCKET=default\n"
-    },
     {
       "id": "server",
       "type": "container",
       "name": "influxdb",
       "image": "influxdb@sha256:f75e48af0598e8aec7986e991a848d19a119101a7d563a2e5db1dfaac9c45daa",
       "env-file": [
-        "${dir:state}/server.env"
+        "/var/lib/influxdb-module/server.env"
       ],
       "ports": [
         "8086"
       ],
       "volumes": [
-        "${dir:data}:/var/lib/influxdb2",
+        "/services/influxdb/data:/var/lib/influxdb2",
-        "${dir:config}:/etc/influxdb2",
+        "/services/influxdb/config:/etc/influxdb2"
-        "${dir:state}/admin.secret:/run/secrets/admin:ro",
+      ],
-        "${dir:state}/admin-token.secret:/run/secrets/admin-token:ro"
+      "secrets-in-environment": "the image honours DOCKER_INFLUXDB_INIT_PASSWORD_FILE and _ADMIN_TOKEN_FILE; convertible, awaiting a bed that proves it"
-      ]
     },
     {
       "id": "runtime-config",
@@ -109,15 +82,13 @@
       "volumes": [
         "/var/lib/mesh/influxdb/broker:/run/secrets/broker:ro",
         "/var/lib/mesh/influxdb/config.json:/run/config/config.json:ro",
-        "${dir:state}/admin-token.secret:/run/secrets/admin-token:ro",
+        "/services/influxdb/config:/var/lib/influxdb/config:ro"
-        "${dir:grants}:${dir:grants}:ro"
       ],
       "env": {
         "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_INFLUXDB_URL": "http://127.0.0.1:${port:8086}",
+        "MESH_INFLUXDB_URL": "http://127.0.0.1:8086",
         "MESH_INFLUXDB_CONFIG_FILE": "/run/config/config.json",
-        "MESH_INFLUXDB_TOKEN_FILE": "/run/secrets/admin-token",
+        "MESH_INFLUXDB_CONFIG_DIR": "/var/lib/influxdb/config"
-        "MESH_RECEIVES": "${dir:grants}/mesh.json"
       },
       "restart-on": [
         "runtime-config"
@@ -125,15 +96,6 @@
       "artifact": "runtime"
     }
   ],
-  "requires": [
-    "route"
-  ],
-  "contributes": {
-    "route": {
-      "label": "influxdb",
-      "endpoint": "api"
-    }
-  },
   "build": {
     "on": [
       {
@@ -154,5 +116,14 @@
         "from": "Dockerfile"
       }
     ]
+  },
+  "requires": [
+    "secret"
+  ],
+  "secrets": {
+    "secret": {
+      "admin": "/var/lib/influxdb-module/admin.secret",
+      "admin-token": "/var/lib/influxdb-module/admin-token.secret"
+    }
   }
 }

modules/influxdb/package.json

@@ -1,14 +1,9 @@
 {
   "name": "@novox/module-influxdb",
   "version": "0.1.0",
-  "description": "influxdb — time-series database; provides the mesh influxdb-api interface. Its API client, provisioner and tools live here (novox/hq ADR 0039).",
+  "description": "influxdb — time-series database. Its API client and tools live here (novox/hq ADR 0039).",
   "type": "module",
   "private": true,
-  "scripts": {
-    "build": "tsc client.ts grants.ts provisioner/index.ts tools/index.ts --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist",
-    "typecheck": "tsc -p tsconfig.json",
-    "test": "npm run build && node --test --experimental-strip-types 'test/*.test.ts'"
-  },
   "dependencies": {
     "@novox/mesh-sdk": "^0.1.0"
   },

modules/influxdb/provisioner/index.ts

@@ -1,54 +0,0 @@
-// influxdb's provisioner — the adapter that makes influxdb a provider of the mesh `influxdb-api`
-// interface. The reconcile loop, the contributions file and reading the mesh's minted secret are the
-// sdk harness's; this writes only the per-service half: how InfluxDB creates, checks and removes a
-// consumer's credential (novox/hq ADR 0039/0040/0048). What that credential is, and why it is a v1
-// authorization, is in ../grants.ts.
-//
-// The `influxdb-api` interface: a consumer reaches `${bound:influxdb-api:scheme}://…:at:…:port`,
-// signs in as `${bound:influxdb-api:as}` with the password the mesh minted for the pair, and reads
-// or writes the org's buckets as databases of the same name — `${bound:influxdb-api:bucket}` being
-// the one this instance serves by default. The org and the default bucket are the assignment's
-// settings, which reach both what is served and this module's config.json, so the org a consumer is
-// told and the org its credential is made in cannot disagree.
-
-import { runProvisioner, type Provision } from "@novox/mesh-sdk/provisioner";
-import { InfluxDBClient } from "../client.js";
-import { ApiGrants } from "../grants.js";
-
-let grants: ApiGrants | undefined;
-try {
-  const influx = InfluxDBClient.fromEnv();
-  grants = new ApiGrants(influx, influx.org);
-} catch (err) {
-  // No admin token: nothing can be provisioned, and the tools loaded beside this must still serve.
-  console.error(`[provisioner:influxdb-api] not started: ${err instanceof Error ? err.message : err}`);
-}
-
-if (grants) serve(grants);
-
-function serve(grants: ApiGrants): void {
-  runProvisioner("influxdb-api", {
-    async create(p: Provision): Promise<void> {
-      const done = await grants.ensure(p);
-      if (done !== "unchanged") {
-        console.log(`[provisioner:influxdb-api] ${done} v1 authorization ${p.as} in org ${grants.org}`);
-      }
-    },
-
-    async remove(p: { as: string }): Promise<void> {
-      const done = await grants.remove(p.as);
-      if (done === "not ours") {
-        console.error(`[provisioner:influxdb-api] ${p.as}: an authorization of that name exists that the mesh did not make — left alone`);
-      } else if (done === "removed") {
-        console.log(`[provisioner:influxdb-api] removed v1 authorization ${p.as}; its buckets and their data stay`);
-      }
-    },
-
-    // Asked every minute by the harness: whether InfluxDB still holds this consumer's authorization
-    // exactly as the mesh gave it, so one deleted, disabled or re-passworded behind the mesh's back is
-    // made whole again (hq issue 120).
-    async holds(p: Provision): Promise<boolean> {
-      return grants.holds(p);
-    },
-  });
-}

modules/influxdb/test/grants.test.ts

@@ -1,246 +0,0 @@
-// What holds influxdb to the `influxdb-api` provision (grants.ts): one v1 authorization per consumer,
-// under the username and password the mesh gave, allowed only what the consumer contributed; made
-// once and brought back on every apply; buckets created when missing and never deleted; and an
-// authorization the mesh did not make — same name or not — never adopted, changed or deleted.
-//
-// InfluxDB is a fake: the routes the module touches, answering with the status codes and shapes
-// InfluxDB 2.9 gives (a filter matching nothing is a 404, a password outside 8–72 characters a 400,
-// an inactive authorization or a wrong password a 401 on /query). Run against the compiled module
-// (npm test builds first), the way the runtime loads it.
-
-import { test, after, beforeEach } from "node:test";
-import assert from "node:assert/strict";
-import { createServer, type IncomingMessage, type ServerResponse } from "node:http";
-
-import { InfluxDBClient } from "../dist/client.js";
-import { ApiGrants, MARK, askedFor, marked } from "../dist/grants.js";
-
-type Rec = Record<string, any>;
-
-const ADMIN = "operator-token";
-const orgs = new Map<string, string>([["zurag", "org1"]]);
-let buckets: Rec[] = [];
-let auths: Rec[] = [];
-let calls: string[] = [];
-let seq = 0;
-
-function body(req: IncomingMessage): Promise<any> {
-  return new Promise((resolve) => {
-    let raw = "";
-    req.on("data", (c) => (raw += c));
-    req.on("end", () => resolve(raw ? JSON.parse(raw) : undefined));
-  });
-}
-
-function send(res: ServerResponse, status: number, value?: unknown): void {
-  res.writeHead(status, { "Content-Type": "application/json" });
-  res.end(value === undefined ? "" : JSON.stringify(value));
-}
-
-const server = createServer(async (req, res) => {
-  const url = new URL(req.url!, "http://fake");
-  const p = url.pathname;
-  calls.push(`${req.method} ${p}`);
-  if (p === "/query") {
-    const basic = (req.headers.authorization ?? "").replace(/^Basic /, "");
-    const [u, pw] = Buffer.from(basic, "base64").toString().split(":");
-    const a = auths.find((x) => x.token === u);
-    if (!a || a.status !== "active" || a.password === undefined || a.password !== pw) {
-      return send(res, 401, { code: "unauthorized", message: "Unauthorized" });
-    }
-    return send(res, 200, { results: [{ statement_id: 0 }] });
-  }
-  if (req.headers.authorization !== `Token ${ADMIN}`) return send(res, 401, { code: "unauthorized" });
-  if (p === "/api/v2/orgs") {
-    const id = orgs.get(url.searchParams.get("org") ?? "");
-    if (!id) return send(res, 404, { code: "not found", message: "organization name not found" });
-    return send(res, 200, { orgs: [{ id, name: url.searchParams.get("org") }] });
-  }
-  if (p === "/api/v2/buckets" && req.method === "GET") {
-    const found = buckets.filter((b) => b.orgID === url.searchParams.get("orgID") && b.name === url.searchParams.get("name"));
-    if (found.length === 0) return send(res, 404, { code: "not found", message: "bucket not found" });
-    return send(res, 200, { buckets: found });
-  }
-  if (p === "/api/v2/buckets" && req.method === "POST") {
-    const b = { ...(await body(req)), id: `b${++seq}` };
-    buckets.push(b);
-    return send(res, 201, b);
-  }
-  if (p === "/private/legacy/authorizations" && req.method === "GET") {
-    const found = auths.filter((a) => a.token === url.searchParams.get("token"));
-    if (found.length === 0) return send(res, 404, { code: "not found", message: "authorization not found" });
-    // Never answers with the password: InfluxDB keeps only its hash.
-    return send(res, 200, { authorizations: found.map(({ password, ...a }) => ({ ...a, links: {} })) });
-  }
-  if (p === "/private/legacy/authorizations" && req.method === "POST") {
-    const a = await body(req);
-    if (auths.some((x) => x.token === a.token)) return send(res, 409, { code: "conflict", message: "token already exists" });
-    const made = { ...a, id: `a${++seq}`, status: a.status ?? "active" };
-    auths.push(made);
-    return send(res, 201, made);
-  }
-  const m = /^\/private\/legacy\/authorizations\/([^/]+)(\/password)?$/.exec(p);
-  const a = m && auths.find((x) => x.id === m[1]);
-  if (!a) return send(res, 404, { code: "not found" });
-  if (m![2] && req.method === "POST") {
-    const { password } = await body(req);
-    if (typeof password !== "string" || password.length < 8 || password.length > 72) {
-      return send(res, 400, { code: "invalid", message: "passwords must be between 8 and 72 characters long" });
-    }
-    a.password = password;
-    return send(res, 204);
-  }
-  if (req.method === "PATCH") {
-    Object.assign(a, await body(req));
-    return send(res, 200, a);
-  }
-  if (req.method === "DELETE") {
-    auths = auths.filter((x) => x !== a);
-    return send(res, 204);
-  }
-  send(res, 405);
-});
-await new Promise<void>((r) => server.listen(0, "127.0.0.1", r));
-after(() => server.close());
-const port = (server.address() as { port: number }).port;
-
-const grants = new ApiGrants(new InfluxDBClient(`http://127.0.0.1:${port}`, ADMIN, "zurag"), "zurag");
-
-const PW = "mesh-minted-password-of-forty-characters";
-
-/** Grafana on ace, as the mesh hands it to the provisioner. */
-function grafana(password = PW, values: Record<string, unknown> = { access: "read" }) {
-  return { as: "mesh_ace_grafana", password, consumer: "ace", values };
-}
-/** Node-RED on ace: writes one bucket. */
-function nodered(password = PW, values: Record<string, unknown> = { access: "write", buckets: ["zurag"] }) {
-  return { as: "mesh_ace_nodered", password, consumer: "ace", values };
-}
-
-function only(token: string): Rec {
-  const found = auths.filter((a) => a.token === token);
-  assert.equal(found.length, 1, `exactly one authorization ${token}, found ${found.length}`);
-  return found[0];
-}
-
-function perms(a: Rec): string[] {
-  return a.permissions.map((p: Rec) => `${p.action}:${p.resource.type}:${p.resource.id ?? "*"}`).sort();
-}
-
-beforeEach(() => {
-  buckets = [{ id: "zb", orgID: "org1", name: "zurag" }];
-  auths = [];
-  calls = [];
-});
-
-test("what a contribution may ask for, and what is refused", () => {
-  assert.deepEqual(askedFor({}), { access: "read", buckets: [] });
-  assert.deepEqual(askedFor({ access: "read-write", buckets: ["b", "a", "a"] }), { access: "read-write", buckets: ["a", "b"] });
-  assert.throws(() => askedFor({ access: "admin" }), /access/);
-  assert.throws(() => askedFor({ access: "write" }), /names no bucket/);
-  assert.throws(() => askedFor({ buckets: "zurag" }), /list of bucket names/);
-  assert.throws(() => askedFor({ access: "write", buckets: ["_monitoring"] }), /system bucket/);
-});
-
-test("a reader is given one authorization, reading every bucket of the org, under the mesh's password", async () => {
-  assert.equal(await grants.ensure(grafana()), "created");
-  const a = only("mesh_ace_grafana");
-  assert.equal(a.orgID, "org1");
-  assert.equal(a.status, "active");
-  assert.ok(a.description.startsWith(MARK));
-  assert.deepEqual(perms(a), ["read:buckets:*"]);
-  assert.equal(a.password, PW);
-  assert.equal(await grants.holds(grafana()), true);
-});
-
-test("a writer is allowed its own buckets only, and a missing one is made — never deleted", async () => {
-  assert.equal(await grants.ensure(nodered(PW, { access: "write", buckets: ["zurag", "printer"] })), "created");
-  const made = buckets.find((b) => b.name === "printer");
-  assert.ok(made, "the missing bucket was created");
-  assert.deepEqual(made!.retentionRules, [], "kept for ever: retention is the operator's choice");
-  assert.deepEqual(perms(only("mesh_ace_nodered")), [`write:buckets:${made!.id}`, "write:buckets:zb"]);
-  assert.equal(await grants.remove("mesh_ace_nodered"), "removed");
-  assert.equal(buckets.length, 2, "withdrawing the consumer leaves every bucket and its data");
-});
-
-test("applying the same grant again writes nothing", async () => {
-  await grants.ensure(grafana());
-  calls = [];
-  assert.equal(await grants.ensure(grafana()), "unchanged");
-  assert.ok(calls.every((c) => c.startsWith("GET")), `only reads: ${calls.join(", ")}`);
-  only("mesh_ace_grafana");
-});
-
-test("a rotated password is set in place; a changed access remakes only the mesh's own", async () => {
-  await grants.ensure(nodered());
-  const id = only("mesh_ace_nodered").id;
-  assert.equal(await grants.holds(nodered("rotated-password-0123456789")), false);
-  assert.equal(await grants.ensure(nodered("rotated-password-0123456789")), "updated");
-  assert.equal(only("mesh_ace_nodered").id, id, "updated, not replaced");
-  assert.equal(await grants.holds(nodered("rotated-password-0123456789")), true);
-
-  await grants.ensure(nodered(PW, { access: "read-write", buckets: ["zurag"] }));
-  assert.deepEqual(perms(only("mesh_ace_nodered")), ["read:buckets:zb", "write:buckets:zb"]);
-  assert.equal(await grants.holds(nodered(PW, { access: "read-write", buckets: ["zurag"] })), true);
-});
-
-test("an authorization disabled, re-passworded or deleted behind the mesh's back is not held, and is made whole", async () => {
-  await grants.ensure(grafana());
-  only("mesh_ace_grafana").status = "inactive";
-  assert.equal(await grants.holds(grafana()), false);
-  assert.equal(await grants.ensure(grafana()), "updated");
-  assert.equal(await grants.holds(grafana()), true);
-
-  only("mesh_ace_grafana").password = "somebody-else-set-this";
-  assert.equal(await grants.holds(grafana()), false);
-  await grants.ensure(grafana());
-  assert.equal(await grants.holds(grafana()), true);
-
-  auths = [];
-  assert.equal(await grants.holds(grafana()), false);
-  assert.equal(await grants.ensure(grafana()), "created");
-});
-
-test("holds only reads, and a bucket gone missing is not held rather than made", async () => {
-  await grants.ensure(nodered());
-  buckets = [];
-  calls = [];
-  assert.equal(await grants.holds(nodered()), false);
-  assert.ok(calls.every((c) => c.startsWith("GET")), `only reads: ${calls.join(", ")}`);
-  assert.equal(buckets.length, 0);
-});
-
-test("an authorization of the same name the mesh did not make is refused, and left exactly as it was", async () => {
-  auths = [{ id: "theirs", token: "mesh_ace_grafana", orgID: "org1", status: "active", description: "hand-made",
-    permissions: [{ action: "write", resource: { type: "buckets", orgID: "org1" } }], password: "their-password" }];
-  const before = JSON.stringify(auths);
-  await assert.rejects(grants.ensure(grafana()), /did not make/);
-  assert.equal(JSON.stringify(auths), before);
-  assert.ok(calls.every((c) => c.startsWith("GET")), `only reads: ${calls.join(", ")}`);
-  assert.equal(await grants.holds(grafana()), false);
-  assert.equal(await grants.remove("mesh_ace_grafana"), "not ours");
-  assert.equal(auths.length, 1, "never deleted");
-});
-
-test("the predecessor's own v1 users and tokens are never touched", async () => {
-  auths = [{ id: "hal", token: "grafana", orgID: "org1", status: "active", description: "",
-    permissions: [{ action: "read", resource: { type: "buckets", orgID: "org1" } }], password: "old-password" }];
-  await grants.ensure(grafana());
-  assert.equal(auths.find((a) => a.id === "hal")!.password, "old-password");
-  assert.equal(await grants.remove("grafana"), "not ours");
-  assert.equal(marked({ token: "grafana", description: `${MARK} x` }), false, "the mark needs the mesh's name too");
-});
-
-test("an org the instance does not have, or a non-mesh name, makes nothing", async () => {
-  const elsewhere = new ApiGrants(new InfluxDBClient(`http://127.0.0.1:${port}`, ADMIN, "nope"), "nope");
-  await assert.rejects(elsewhere.ensure(grafana()), /no org "nope"/);
-  await assert.rejects(grants.ensure({ ...grafana(), as: "grafana" }), /not a mesh identity/);
-  assert.equal(auths.length, 0);
-});
-
-test("a withdrawn consumer's authorization is removed, and an absent one is not an error", async () => {
-  await grants.ensure(grafana());
-  assert.equal(await grants.remove("mesh_ace_grafana"), "removed");
-  assert.equal(auths.length, 0);
-  assert.equal(await grants.remove("mesh_ace_grafana"), "absent");
-});

modules/influxdb/tsconfig.json

@@ -8,10 +8,5 @@
     "skipLibCheck": true,
     "noEmit": true
   },
-  "include": [
+  "include": ["client.ts", "tools/index.ts"]
-    "client.ts",
-    "grants.ts",
-    "provisioner/index.ts",
-    "tools/index.ts"
-  ]
 }

modules/invoicing/module.json

@@ -17,11 +17,11 @@
     "route": {
       "site": {
         "label": "invoicing",
-        "endpoint": "web"
+        "port": 80
       },
       "api": {
         "label": "invoicing-api",
-        "endpoint": "api"
+        "port": 9000
       }
     }
   },
@@ -36,14 +36,12 @@
   },
   "listens": [
     {
-      "name": "web",
       "port": 80,
       "protocol": "tcp",
       "from": "mesh",
       "why": "the invoicing web frontend; a public name is a route grant later"
     },
     {
-      "name": "api",
       "port": 9000,
       "protocol": "tcp",
       "from": "mesh",
@@ -87,10 +85,7 @@
       },
       "ports": [
         "80"
-      ],
+      ]
-      "names-on-purpose": {
-        "registry-api.novox.be": "built outside the mesh, from the application's own repository, and pulled from the registry that built it; moves when that repository is a build source on the git seat (novox/hq ADR 0155, issue 122)"
-      }
     },
     {
       "id": "api",
@@ -108,10 +103,7 @@
       "ports": [
         "9000"
       ],
-      "secrets-in-environment": "the application's own code reads MONGO_URL and MINIO_SECRET from the environment (invoicing-app server/src/config.js); converting is that repository's change",
+      "secrets-in-environment": "the application's own code reads MONGO_URL and MINIO_SECRET from the environment (invoicing-app server/src/config.js); converting is that repository's change"
-      "names-on-purpose": {
-        "registry-api.novox.be": "built outside the mesh, from the application's own repository, and pulled from the registry that built it; moves when that repository is a build source on the git seat (novox/hq ADR 0155, issue 122)"
-      }
     }
   ]
 }

modules/jackett/client.ts

@@ -2,8 +2,7 @@
 // an indexer proxy: it normalises many torrent trackers behind one Torznab surface. This client
 // talks its /api/v2.0 REST API, and only jackett's tools import it.
 
-import { existsSync, readFileSync } from "node:fs";
+import { readFileSync } from "node:fs";
-import { join } from "node:path";
 
 export interface JackettIndexer {
   id: string;
@@ -44,36 +43,18 @@ export class JackettClient {
 
   /**
    * Build from the module's resolved environment. Jackett's REST API is keyed, so both the URL and
-   * the key must be present. The key is read from the settings-merged config or MESH_JACKETT_API_KEY,
+   * the key must be present — without them there is nothing to talk to, so this throws and the
-   * or, failing those, discovered from Jackett's own ServerConfig.json under MESH_JACKETT_CONFIG_DIR
+   * module contributes no tools rather than failing half-configured.
-   * — the file Jackett writes it to, as sonarr/radarr read theirs from config.xml — so a running
-   * server needs no key configured by hand and no secret has to be put in an assignment. Without a
-   * URL or key there is nothing to talk to, so this throws and the module contributes no tools
-   * rather than failing half-configured.
    */
   static fromEnv(env: NodeJS.ProcessEnv = process.env): JackettClient {
     const cfg = meshConfig(env.MESH_JACKETT_CONFIG_FILE);
     const url = cfg.url ?? env.MESH_JACKETT_URL;
-    const apiKey = cfg.apiKey ?? env.MESH_JACKETT_API_KEY
+    const apiKey = cfg.apiKey ?? env.MESH_JACKETT_API_KEY;
-      ?? JackettClient.detectApiKey(env.MESH_JACKETT_CONFIG_DIR ?? "/config");
     if (!url) throw new Error("no Jackett URL — set MESH_JACKETT_URL");
-    if (!apiKey) throw new Error("no Jackett API key — set MESH_JACKETT_API_KEY or make the config dir readable");
+    if (!apiKey) throw new Error("no Jackett API key — set MESH_JACKETT_API_KEY");
     return new JackettClient(url, apiKey);
   }
 
-  /** Discover the API key from Jackett's ServerConfig.json (the linuxserver image keeps it at
-   *  <config>/Jackett/ServerConfig.json), falling back to null. */
-  static detectApiKey(configDir: string): string | null {
-    for (const file of [join(configDir, "Jackett", "ServerConfig.json"), join(configDir, "ServerConfig.json")]) {
-      if (!existsSync(file)) continue;
-      try {
-        const key = (JSON.parse(readFileSync(file, "utf8")) as { APIKey?: unknown }).APIKey;
-        if (typeof key === "string" && key) return key;
-      } catch { /* unreadable or mid-write: try the next, then give up */ }
-    }
-    return null;
-  }
-
   private async get(path: string, params: Record<string, string> = {}): Promise<any> {
     const url = new URL(`${this.baseUrl}${path}`);
     url.searchParams.set("apikey", this.apiKey);
@@ -83,36 +64,18 @@ export class JackettClient {
     return res.json();
   }
 
-  /**
+  /** The configured indexers Jackett proxies. `configured=false` also lists the ones not set up. */
-   * The configured indexers Jackett proxies. `configured=false` also lists the ones not set up.
-   * Read from the Torznab `t=indexers` feed, not /api/v2.0/indexers: that one is the web UI's and
-   * wants a login cookie (it answers an API-key request with a redirect), while the Torznab feed is
-   * what the key is for. The feed carries no last error, so `lastError` stays unset.
-   */
   async getIndexers(configuredOnly = true): Promise<JackettIndexer[]> {
-    const url = new URL(`${this.baseUrl}/api/v2.0/indexers/all/results/torznab/api`);
+    const raw = await this.get("/api/v2.0/indexers", { configured: configuredOnly ? "true" : "false" });
-    url.searchParams.set("apikey", this.apiKey);
+    const list = Array.isArray(raw) ? raw : [];
-    url.searchParams.set("t", "indexers");
+    return list.map((i: any) => ({
-    url.searchParams.set("configured", configuredOnly ? "true" : "false");
+      id: i.id,
-    const res = await fetch(url.toString(), { headers: { Accept: "application/xml" } });
+      name: i.name,
-    if (!res.ok) throw new Error(`Jackett API torznab t=indexers: ${res.status} ${await res.text()}`);
+      type: i.type,
-    const xml = await res.text();
+      configured: i.configured ?? false,
-    // Torznab reports failures (a wrong key among them) as 200 with an <error> body.
+      siteLink: i.site_link,
-    const err = xml.match(/<error code="(\d+)" description="([^"]*)"/);
+      lastError: i.last_error || undefined,
-    if (err) throw new Error(`Jackett API torznab t=indexers: error ${err[1]} ${err[2]}`);
+    }));
-    const text = (block: string, tag: string) =>
-      block.match(new RegExp(`<${tag}>([^<]*)</${tag}>`))?.[1];
-    const out: JackettIndexer[] = [];
-    for (const m of xml.matchAll(/<indexer id="([^"]+)" configured="([^"]+)">([\s\S]*?)<\/indexer>/g)) {
-      out.push({
-        id: m[1],
-        name: text(m[3], "title") ?? m[1],
-        type: text(m[3], "type") ?? "unknown",
-        configured: m[2] === "true",
-        siteLink: text(m[3], "link"),
-      });
-    }
-    return out;
   }
 
   /**

modules/jackett/module.json

@@ -1,29 +1,15 @@
 {
   "module": "jackett",
   "version": "1",
-  "provides": [
-    {
-      "name": "jackett-api",
-      "scope": "mesh"
-    }
-  ],
-  "serves": {
-    "jackett-api": {
-      "scheme": "http",
-      "port": 9117,
-      "url-base": ""
-    }
-  },
   "capabilities": [
     "container-runtime"
   ],
   "listens": [
     {
-      "name": "web",
       "port": 9117,
       "protocol": "tcp",
       "from": "mesh",
-      "why": "the indexer proxy: its web UI, and the Torznab feeds the *arr apps search through, which other modules reach as jackett-api"
+      "why": "the indexer proxy"
     }
   ],
   "resources": [
@@ -33,15 +19,10 @@
       "path": "/var/lib/mesh/jackett",
       "mode": "0700"
     },
-    {
-      "id": "state",
-      "type": "directory",
-      "mode": "0700",
-      "place": "."
-    },
     {
       "id": "config",
       "type": "directory",
+      "path": "/services/jackett/config",
       "mode": "0700",
       "owner": "1000:1000"
     },
@@ -49,7 +30,7 @@
       "id": "server",
       "type": "container",
       "name": "jackett",
-      "image": "lscr.io/linuxserver/jackett@sha256:7b19f4f6ac33d855ca9226600ecbd096ee678f66da28b13a7c09980b035ff583",
+      "image": "lscr.io/linuxserver/jackett@sha256:fd72d42b731ebf750b5de9711127251cf3b3f609419c32083ea8b3b3ee840b77",
       "env": {
         "PUID": "1000",
         "PGID": "1000",
@@ -59,13 +40,13 @@
         "9117"
       ],
       "volumes": [
-        "${dir:config}:/config"
+        "/services/jackett/config:/config"
       ]
     },
     {
       "id": "runtime-config",
       "type": "file",
-      "path": "${dir:state}/config.json",
+      "path": "/var/lib/mesh/jackett/config.json",
       "mode": "0600",
       "content": "{}\n",
       "merge": "json"
@@ -77,12 +58,12 @@
       "network": "host",
       "volumes": [
         "/var/lib/mesh/jackett/broker:/run/secrets/broker:ro",
-        "${dir:state}/config.json:/run/config/config.json:ro",
+        "/var/lib/mesh/jackett/config.json:/run/config/config.json:ro",
-        "${dir:config}:/var/lib/jackett/config:ro"
+        "/services/jackett/config:/var/lib/jackett/config:ro"
       ],
       "env": {
         "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_JACKETT_URL": "http://127.0.0.1:${port:9117}",
+        "MESH_JACKETT_URL": "http://127.0.0.1:9117",
         "MESH_JACKETT_CONFIG_FILE": "/run/config/config.json",
         "MESH_JACKETT_CONFIG_DIR": "/var/lib/jackett/config"
       },
@@ -101,11 +82,11 @@
   "contributes": {
     "route": {
       "label": "indexers",
-      "endpoint": "web"
+      "port": 9117
     }
   },
   "binds": {
-    "route": "${dir:state}/route.json"
+    "route": "/var/lib/mesh/jackett/route.json"
   },
   "build": {
     "on": [

modules/jackett/tools/index.ts

@@ -9,7 +9,7 @@ export function getJackettTools(jackett: JackettClient): ToolDefinition[] {
   return [
     {
       name: "jackett_indexers",
-      description: "List the indexers Jackett proxies, with their type and site.",
+      description: "List the indexers Jackett proxies, with their type and any last error.",
       input: { all: { type: "boolean", description: "include indexers not yet configured (default false)" } },
       run: async (args) => {
         const indexers = await jackett.getIndexers(!args.all);

modules/keycloak/Dockerfile

@@ -17,7 +17,7 @@ FROM ${BUILD_BASE} AS build
 # resolved away.
 WORKDIR /app/modules/keycloak
 COPY . .
-RUN node /app/node_modules/typescript/bin/tsc client.ts oidc.ts index.ts provisioner/index.ts tools/index.ts \
+RUN node /app/node_modules/typescript/bin/tsc client.ts index.ts tools/index.ts \
       --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist
 
 FROM ${RUNTIME_BASE}
@@ -27,4 +27,4 @@ COPY --from=build /app/modules/keycloak/dist /app/modules/keycloak/dist
 # the convention novox/hq issues 060/061 settled. A container that instead ran only its
 # provisioner (`run`) served no tools and emitted no events; a container that named no command
 # ran no provisioner at all.
-ENV MESH_TOOL_MODULES=/app/modules/keycloak/dist/index.js,/app/modules/keycloak/dist/tools/index.js,/app/modules/keycloak/dist/provisioner/index.js
+ENV MESH_TOOL_MODULES=/app/modules/keycloak/dist/index.js,/app/modules/keycloak/dist/tools/index.js

modules/keycloak/client.ts

@@ -12,45 +12,6 @@ function meshConfig(file?: string): Record<string, string> {
   catch { return {}; }
 }
 
-/** A secret file's value, trailing newline trimmed; undefined when unset or unreadable. */
-function secretFile(file?: string): string | undefined {
-  if (!file) return undefined;
-  try { return readFileSync(file, "utf8").replace(/\n$/, "") || undefined; }
-  catch { return undefined; }
-}
-
-/** A client as the admin API represents it — only the fields this module reads or writes are typed;
- *  the rest travel through untouched, so an update never drops what somebody else set. */
-export interface ClientRepresentation {
-  id?: string;
-  clientId: string;
-  name?: string;
-  enabled?: boolean;
-  protocol?: string;
-  publicClient?: boolean;
-  clientAuthenticatorType?: string;
-  secret?: string;
-  rootUrl?: string;
-  baseUrl?: string;
-  redirectUris?: string[];
-  webOrigins?: string[];
-  standardFlowEnabled?: boolean;
-  implicitFlowEnabled?: boolean;
-  directAccessGrantsEnabled?: boolean;
-  serviceAccountsEnabled?: boolean;
-  attributes?: Record<string, string>;
-  protocolMappers?: ProtocolMapperRepresentation[];
-  [other: string]: unknown;
-}
-
-export interface ProtocolMapperRepresentation {
-  id?: string;
-  name: string;
-  protocol: string;
-  protocolMapper: string;
-  config: Record<string, string>;
-}
-
 export class KeycloakClient {
   readonly baseUrl: string;
   readonly defaultRealm: string;
@@ -79,13 +40,8 @@ export class KeycloakClient {
     const cfg = meshConfig(env.MESH_KEYCLOAK_CONFIG_FILE);
     const url = cfg.url ?? env.MESH_KEYCLOAK_URL ?? `http://127.0.0.1:${env.KEYCLOAK_PORT ?? "8080"}`;
     const adminUser = cfg.user ?? env.MESH_KEYCLOAK_ADMIN ?? env.KEYCLOAK_ADMIN ?? "admin";
-    // The admin password reaches the runtime as a file (novox/hq ADR 0086): the module's own `admin`
+    const adminPass = cfg.password ?? env.MESH_KEYCLOAK_PASSWORD ?? env.KEYCLOAK_ADMIN_PASSWORD;
-    // secret, mounted read-only. The environment forms stay for a co-located server that has them.
+    if (!adminPass) throw new Error("no Keycloak admin password — set MESH_KEYCLOAK_PASSWORD");
-    const adminPass = cfg.password ?? secretFile(env.MESH_KEYCLOAK_PASSWORD_FILE)
-      ?? env.MESH_KEYCLOAK_PASSWORD ?? env.KEYCLOAK_ADMIN_PASSWORD;
-    if (!adminPass) {
-      throw new Error("no Keycloak admin password — set MESH_KEYCLOAK_PASSWORD_FILE (or MESH_KEYCLOAK_PASSWORD)");
-    }
     const realm = cfg.realm ?? env.MESH_KEYCLOAK_REALM ?? "master";
     return new KeycloakClient(url, adminUser, adminPass, realm);
   }
@@ -203,50 +159,6 @@ export class KeycloakClient {
     return client.id as string;
   }
 
-  /** The one client with exactly this clientId, or undefined. The admin API's `clientId` filter is an
-   *  exact match unless `search=true` is asked for. */
-  async findClient(realm: string, clientId: string): Promise<ClientRepresentation | undefined> {
-    const found = await this.request<ClientRepresentation[]>(
-      `/${realm}/clients?clientId=${encodeURIComponent(clientId)}`);
-    return found.find((c) => c.clientId === clientId);
-  }
-
-  async createClientFrom(realm: string, rep: ClientRepresentation): Promise<void> {
-    await this.request(`/${realm}/clients`, { method: "POST", body: JSON.stringify(rep) });
-  }
-
-  /** Replace a client's representation, addressed by its internal id. */
-  async updateClient(realm: string, id: string, rep: ClientRepresentation): Promise<void> {
-    await this.request(`/${realm}/clients/${id}`, { method: "PUT", body: JSON.stringify(rep) });
-  }
-
-  async deleteClientById(realm: string, id: string): Promise<void> {
-    await this.request(`/${realm}/clients/${id}`, { method: "DELETE" });
-  }
-
-  async clientSecretById(realm: string, id: string): Promise<string | undefined> {
-    const result = await this.request<{ value?: string }>(`/${realm}/clients/${id}/client-secret`);
-    return result.value;
-  }
-
-  async listClientMappers(realm: string, id: string): Promise<ProtocolMapperRepresentation[]> {
-    return this.request(`/${realm}/clients/${id}/protocol-mappers/models`);
-  }
-
-  async addClientMapper(realm: string, id: string, mapper: ProtocolMapperRepresentation): Promise<void> {
-    await this.request(`/${realm}/clients/${id}/protocol-mappers/models`, {
-      method: "POST",
-      body: JSON.stringify(mapper),
-    });
-  }
-
-  async updateClientMapper(realm: string, id: string, mapper: ProtocolMapperRepresentation): Promise<void> {
-    await this.request(`/${realm}/clients/${id}/protocol-mappers/models/${mapper.id}`, {
-      method: "PUT",
-      body: JSON.stringify(mapper),
-    });
-  }
-
   async deleteClient(realm: string, clientId: string): Promise<void> {
     await this.request(`/${realm}/clients/${await this.resolveClientId(realm, clientId)}`, { method: "DELETE" });
   }

modules/keycloak/index.ts

@@ -28,17 +28,17 @@ async function announce(type: string, body: Record<string, unknown>): Promise<vo
 
 export const events = {
   userCreated: (realm: string, username: string, email?: string) =>
-    announce("user.created", { realm, username, ...(email ? { email } : {}) }),
+    announce("module.keycloak.user.created", { realm, username, ...(email ? { email } : {}) }),
   userDeleted: (realm: string, userId: string) =>
-    announce("user.deleted", { realm, userId }),
+    announce("module.keycloak.user.deleted", { realm, userId }),
   passwordReset: (realm: string, userId: string) =>
-    announce("password.reset", { realm, userId }),
+    announce("module.keycloak.password.reset", { realm, userId }),
   clientCreated: (realm: string, clientId: string, name?: string) =>
-    announce("client.created", { realm, clientId, ...(name ? { name } : {}) }),
+    announce("module.keycloak.client.created", { realm, clientId, ...(name ? { name } : {}) }),
   groupCreated: (realm: string, name: string) =>
-    announce("group.created", { realm, name }),
+    announce("module.keycloak.group.created", { realm, name }),
   roleCreated: (realm: string, name: string) =>
-    announce("role.created", { realm, name }),
+    announce("module.keycloak.role.created", { realm, name }),
 };
 
 console.log("[keycloak] event surface ready — identity, client, group and role changes are announced");

modules/keycloak/module.json

@@ -1,12 +1,6 @@
 {
   "module": "keycloak",
   "version": "1",
-  "provides": [
-    {
-      "name": "oidc-client",
-      "scope": "mesh"
-    }
-  ],
   "requires": [
     "postgres-database",
     "route"
@@ -17,7 +11,7 @@
     },
     "route": {
       "label": "keycloak",
-      "endpoint": "web"
+      "port": 8080
     }
   },
   "binds": {
@@ -31,35 +25,21 @@
     "container-runtime"
   ],
   "emits": [
-    "user.created",
+    "module.keycloak.user.created",
-    "user.deleted",
+    "module.keycloak.user.deleted",
-    "password.reset",
+    "module.keycloak.password.reset",
-    "client.created",
+    "module.keycloak.client.created",
-    "group.created",
+    "module.keycloak.group.created",
-    "role.created"
+    "module.keycloak.role.created"
   ],
   "listens": [
     {
-      "name": "web",
       "port": 8080,
       "protocol": "tcp",
       "from": "mesh",
       "why": "anything the mesh runs that authenticates a person"
     }
   ],
-  "serves": {
-    "oidc-client": {
-      "authorization-path": "/protocol/openid-connect/auth",
-      "token-path": "/protocol/openid-connect/token",
-      "userinfo-path": "/protocol/openid-connect/userinfo"
-    }
-  },
-  "receives": {
-    "oidc-client": "/var/lib/keycloak/grants/mesh.json"
-  },
-  "grants": {
-    "oidc-client": "/var/lib/keycloak/grants"
-  },
   "own-secrets": {
     "admin": "/var/lib/keycloak/admin.secret",
     "broker": "/var/lib/mesh/keycloak/broker"
@@ -77,12 +57,6 @@
       "path": "/var/lib/keycloak",
       "mode": "0700"
     },
-    {
-      "id": "grants",
-      "type": "directory",
-      "path": "/var/lib/keycloak/grants",
-      "mode": "0700"
-    },
     {
       "id": "admin-env",
       "type": "file",
@@ -102,13 +76,6 @@
       "type": "network",
       "name": "keycloak"
     },
-    {
-      "id": "hostname",
-      "type": "file",
-      "path": "/var/lib/keycloak/hostname.env",
-      "mode": "0644",
-      "content": "KC_HOSTNAME=https://${bound:route:name}\n"
-    },
     {
       "id": "server",
       "type": "container",
@@ -122,20 +89,17 @@
         "KC_DB": "postgres",
         "KC_HTTP_ENABLED": "true",
         "KC_HEALTH_ENABLED": "true",
+        "KC_HOSTNAME": "https://keycloak.novox.be",
         "KC_PROXY_HEADERS": "xforwarded"
       },
       "env-file": [
         "/var/lib/keycloak/admin.env",
-        "/var/lib/keycloak/database.env",
+        "/var/lib/keycloak/database.env"
-        "/var/lib/keycloak/hostname.env"
       ],
       "ports": [
         "8080"
       ],
-      "secrets-in-environment": "KC_DB_PASSWORD is convertible through a generated keycloak.conf (db-password=); KEYCLOAK_ADMIN_PASSWORD is env-only before Keycloak 26; not yet converted",
+      "secrets-in-environment": "KC_DB_PASSWORD is convertible through a generated keycloak.conf (db-password=); KEYCLOAK_ADMIN_PASSWORD is env-only before Keycloak 26; not yet converted"
-      "restart-on": [
-        "hostname"
-      ]
     },
     {
       "id": "runtime-config",
@@ -152,16 +116,12 @@
       "network": "host",
       "volumes": [
         "/var/lib/mesh/keycloak/broker:/run/secrets/broker:ro",
-        "/var/lib/mesh/keycloak/config.json:/run/config/config.json:ro",
+        "/var/lib/mesh/keycloak/config.json:/run/config/config.json:ro"
-        "/var/lib/keycloak/admin.secret:/run/secrets/admin:ro",
-        "/var/lib/keycloak/grants:/var/lib/keycloak/grants:ro"
       ],
       "env": {
         "MESH_BROKER_FILE": "/run/secrets/broker",
         "MESH_KEYCLOAK_URL": "http://127.0.0.1:${port:8080}",
-        "MESH_KEYCLOAK_CONFIG_FILE": "/run/config/config.json",
+        "MESH_KEYCLOAK_CONFIG_FILE": "/run/config/config.json"
-        "MESH_KEYCLOAK_PASSWORD_FILE": "/run/secrets/admin",
-        "MESH_RECEIVES": "/var/lib/keycloak/grants/mesh.json"
       },
       "restart-on": [
         "runtime-config"

modules/keycloak/oidc.ts

@@ -1,185 +0,0 @@
-// What the `oidc-client` provision means in Keycloak: one confidential OpenID Connect client per
-// consumer, in the realm this module serves, under the name and secret the mesh gave both ends.
-// The provisioner (provisioner/index.ts) is the sdk harness calling these; they are here, apart from
-// it, so they can be exercised against a fake admin API without a broker or a contributions file.
-//
-// **The client id and the secret are the mesh's, not Keycloak's (novox/hq ADR 0048).** The mesh
-// derives the consumer's identity (`as`, e.g. `mesh_ace_grafana`) and hands it to both ends — the
-// consumer names it as its client id through `${bound:oidc-client:as}` — and mints the secret, which
-// this sets as the client's secret. Keycloak generates neither.
-//
-// **Where the consumer's browser comes back to is the consumer's to say.** Its contribution carries
-// `callback` (a path, e.g. `/login/generic_oauth`) and the `label`/`endpoint` of the endpoint it is
-// reached on; the mesh composes that endpoint's names into `name` (public) and `internal-name`
-// (private network) exactly as it does for a route (novox/hq ADR 0056, 0138), so the redirect URI
-// registered here is built from the same names the proxy serves the consumer under.
-//
-// **Only what the mesh made is touched.** A client this module creates carries the attribute
-// `mesh.provisioned=true`, and its id starts with the mesh's own prefix. A client with the same id
-// that lacks the mark is somebody else's: it is refused, never adopted, never updated, never deleted.
-
-import type { ClientRepresentation, KeycloakClient, ProtocolMapperRepresentation } from "./client.js";
-
-/** The attribute marking a client as the mesh's own work. */
-export const MARK = "mesh.provisioned";
-
-/** The mapper every mesh client carries: realm roles as a flat `roles` claim in the id token, the
- *  access token and userinfo — what a consumer maps its own roles from (grafana's role path reads
- *  `roles[*]`), and what the predecessor added to its hand-made clients by hand. */
-export const ROLES_MAPPER: ProtocolMapperRepresentation = {
-  name: "realm roles",
-  protocol: "openid-connect",
-  protocolMapper: "oidc-usermodel-realm-role-mapper",
-  config: {
-    "claim.name": "roles",
-    "jsonType.label": "String",
-    multivalued: "true",
-    "id.token.claim": "true",
-    "access.token.claim": "true",
-    "userinfo.token.claim": "true",
-  },
-};
-
-/** One consumer, as the harness hands it over. */
-export interface OidcGrant {
-  readonly as: string;
-  readonly password: string;
-  readonly values: Readonly<Record<string, unknown>>;
-  readonly consumer?: string;
-}
-
-/** The realm named by an issuer URL — `https://id.example/realms/Novox` is realm `Novox`. The issuer is
- *  the one value an assignment sets (it is also what consumers are served), so the realm is read
- *  out of it rather than set a second time where the two could disagree. */
-export function realmOf(issuer: string): string {
-  let path: string;
-  try {
-    path = new URL(issuer).pathname;
-  } catch {
-    throw new Error(`the issuer ${JSON.stringify(issuer)} is not a URL`);
-  }
-  const m = /\/realms\/([^/]+)\/?$/.exec(path);
-  if (!m) throw new Error(`the issuer ${JSON.stringify(issuer)} does not end in /realms/<realm>`);
-  return decodeURIComponent(m[1]);
-}
-
-/** The redirect URIs a consumer's contribution asks for: its callback under each name the mesh
- *  composed for its endpoint. Refused when there is nothing to register — a client that accepts no
- *  redirect is a client nobody can log in through, and one that accepts any is worse. */
-export function redirectsOf(values: Readonly<Record<string, unknown>>): { root: string; redirects: string[] } {
-  const callback = values.callback;
-  if (typeof callback !== "string" || !callback.startsWith("/")) {
-    throw new Error(`contributes no callback path (\`callback\`, starting with "/"): ${JSON.stringify(callback)}`);
-  }
-  const names: string[] = [];
-  for (const key of ["name", "internal-name"]) {
-    const n = values[key];
-    if (typeof n === "string" && n.trim() !== "" && !names.includes(n.trim())) names.push(n.trim());
-  }
-  if (names.length === 0) {
-    throw new Error("has no name the mesh composed (`name` / `internal-name`) — contribute a `label` and the `endpoint` it is reached on");
-  }
-  return { root: `https://${names[0]}`, redirects: names.map((n) => `https://${n}${callback}`) };
-}
-
-/** The fields the mesh owns on a client it made. Everything else on the client is left as found. */
-function wanted(g: OidcGrant): ClientRepresentation {
-  const { root, redirects } = redirectsOf(g.values);
-  return {
-    clientId: g.as,
-    name: g.as,
-    description: `made by the mesh for ${g.consumer ? `a module on ${g.consumer}` : "a consumer"} — do not edit; it is reset`,
-    enabled: true,
-    protocol: "openid-connect",
-    publicClient: false,
-    clientAuthenticatorType: "client-secret",
-    secret: g.password,
-    rootUrl: root,
-    baseUrl: root,
-    redirectUris: redirects,
-    standardFlowEnabled: true,
-    implicitFlowEnabled: false,
-    directAccessGrantsEnabled: false,
-    serviceAccountsEnabled: false,
-  };
-}
-
-function sameSet(a: readonly string[] | undefined, b: readonly string[]): boolean {
-  const x = [...(a ?? [])].sort();
-  const y = [...b].sort();
-  return x.length === y.length && x.every((v, i) => v === y[i]);
-}
-
-function marked(c: ClientRepresentation): boolean {
-  return c.attributes?.[MARK] === "true";
-}
-
-export class OidcClients {
-  constructor(private readonly kc: KeycloakClient, readonly realm: string) {}
-
-  /** Create the consumer's client, or bring the mesh's existing one back to what the grant says.
-   *  Returns whether it was newly created. Idempotent: applying the same grant twice changes nothing
-   *  the second time beyond re-asserting it. */
-  async ensure(g: OidcGrant): Promise<"created" | "updated"> {
-    const want = wanted(g);
-    const found = await this.kc.findClient(this.realm, g.as);
-    if (found && !marked(found)) {
-      throw new Error(
-        `realm ${this.realm} already has a client ${g.as} the mesh did not make — left alone; ` +
-          `delete or rename it if the mesh should own that id`);
-    }
-    if (!found) {
-      await this.kc.createClientFrom(this.realm, {
-        ...want,
-        attributes: { [MARK]: "true" },
-        protocolMappers: [ROLES_MAPPER],
-      });
-      return "created";
-    }
-    // Overlay what the mesh owns on what is there, so a field Keycloak added or an operator set on a
-    // field the mesh does not own survives the update.
-    await this.kc.updateClient(this.realm, found.id!, {
-      ...found,
-      ...want,
-      attributes: { ...(found.attributes ?? {}), [MARK]: "true" },
-    });
-    await this.ensureMapper(found.id!);
-    return "updated";
-  }
-
-  private async ensureMapper(id: string): Promise<void> {
-    const mappers = await this.kc.listClientMappers(this.realm, id);
-    const have = mappers.find((m) => m.name === ROLES_MAPPER.name);
-    if (!have) {
-      await this.kc.addClientMapper(this.realm, id, ROLES_MAPPER);
-      return;
-    }
-    const drifted =
-      have.protocolMapper !== ROLES_MAPPER.protocolMapper ||
-      Object.entries(ROLES_MAPPER.config).some(([k, v]) => have.config?.[k] !== v);
-    if (drifted) {
-      await this.kc.updateClientMapper(this.realm, id, { ...ROLES_MAPPER, id: have.id });
-    }
-  }
-
-  /** Whether Keycloak still holds this consumer's client exactly as the grant says: present, the
-   *  mesh's, enabled, confidential, with the mesh's secret and the redirects asked for. Reads only. */
-  async holds(g: OidcGrant): Promise<boolean> {
-    const want = wanted(g);
-    const found = await this.kc.findClient(this.realm, g.as);
-    if (!found || !marked(found) || found.enabled === false || found.publicClient) return false;
-    if (!sameSet(found.redirectUris, want.redirectUris!)) return false;
-    const mappers = await this.kc.listClientMappers(this.realm, found.id!);
-    if (!mappers.some((m) => m.name === ROLES_MAPPER.name)) return false;
-    return (await this.kc.clientSecretById(this.realm, found.id!)) === g.password;
-  }
-
-  /** Withdraw a consumer's client — only one the mesh made. Returns what happened, for the log. */
-  async remove(as: string): Promise<"removed" | "absent" | "not ours"> {
-    const found = await this.kc.findClient(this.realm, as);
-    if (!found) return "absent";
-    if (!marked(found)) return "not ours";
-    await this.kc.deleteClientById(this.realm, found.id!);
-    return "removed";
-  }
-}

modules/keycloak/package.json

@@ -1,15 +1,11 @@
 {
   "name": "@novox/module-keycloak",
   "version": "0.1.0",
-  "description": "keycloak — identity and access; provides the mesh oidc-client interface. Its admin API client, provisioner, tools and events live here (novox/hq ADR 0039).",
+  "description": "keycloak — identity and access. Its admin API client, tools and events live here (novox/hq ADR 0039).",
   "type": "module",
   "private": true,
-  "scripts": {
-    "build": "tsc client.ts oidc.ts index.ts provisioner/index.ts tools/index.ts --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist",
-    "test": "npm run build && node --test --experimental-strip-types 'test/*.test.ts'"
-  },
   "dependencies": {
-    "@novox/mesh-sdk": "^0.1.1"
+    "@novox/mesh-sdk": "^0.1.0"
   },
   "devDependencies": {
     "@types/node": "^22.0.0",

modules/keycloak/provisioner/index.ts

@@ -1,73 +0,0 @@
-// keycloak's provisioner — the adapter that makes keycloak a provider of the mesh `oidc-client`
-// interface. The reconcile loop, the contributions file and reading the mesh's minted secret are the
-// sdk harness's; this writes only the per-service half: how Keycloak creates, checks and removes a
-// consumer's client (novox/hq ADR 0039/0040/0048). What a client is, and which ones are the mesh's,
-// is in ../oidc.ts.
-//
-// The `oidc-client` interface: a consumer logs people in through the realm this module serves, as
-// the confidential client `as` with the secret the mesh minted, and is redirected back to the
-// callback it contributed under the names the mesh composed for its endpoint. What it is served —
-// the issuer and the endpoint paths under it — is in the manifest's `serves`, settled with the
-// assignment's settings.
-//
-// **The realm is read out of the issuer**, the one value an assignment sets (settings reach both the
-// served facts and this module's config.json): a realm set in one place and an issuer in another
-// would let the consumer be told one realm while its client is made in another.
-
-import { runProvisioner, type Provision } from "@novox/mesh-sdk/provisioner";
-import { emit } from "@novox/mesh-sdk/events";
-import { readFileSync } from "node:fs";
-import { KeycloakClient } from "../client.js";
-import { OidcClients, realmOf } from "../oidc.js";
-
-/** The issuer this assignment serves, from the settings-merged config the mesh delivers. */
-function issuer(): string {
-  const file = process.env.MESH_KEYCLOAK_CONFIG_FILE;
-  let cfg: Record<string, unknown> = {};
-  if (file) {
-    try {
-      cfg = JSON.parse(readFileSync(file, "utf8")) as Record<string, unknown>;
-    } catch {
-      // Absent or unreadable: fall through to the environment, and refuse below if that is empty too.
-    }
-  }
-  const said = typeof cfg.issuer === "string" ? cfg.issuer : process.env.MESH_KEYCLOAK_ISSUER;
-  if (!said) throw new Error("no issuer — the module's config.json carries none and MESH_KEYCLOAK_ISSUER is unset");
-  return said;
-}
-
-const clients = new OidcClients(KeycloakClient.fromEnv(), realmOf(issuer()));
-
-/** Emit a lifecycle event without letting a broker hiccup fail the provisioning itself. */
-async function announce(type: string, body: Record<string, string>): Promise<void> {
-  try {
-    await emit(type, body);
-  } catch (err) {
-    console.error(`[provisioner:oidc-client] emit ${type} failed: ${err}`);
-  }
-}
-
-runProvisioner("oidc-client", {
-  async create(p: Provision): Promise<void> {
-    const done = await clients.ensure(p);
-    if (done === "created") {
-      console.log(`[provisioner:oidc-client] created client ${p.as} in realm ${clients.realm}`);
-      await announce("client.created", { realm: clients.realm, clientId: p.as, consumer: p.consumer ?? "" });
-    }
-  },
-
-  async remove(p: { as: string }): Promise<void> {
-    const done = await clients.remove(p.as);
-    if (done === "not ours") {
-      console.error(`[provisioner:oidc-client] ${p.as}: a client of that id exists that the mesh did not make — left alone`);
-    } else if (done === "removed") {
-      console.log(`[provisioner:oidc-client] removed client ${p.as} from realm ${clients.realm}`);
-    }
-  },
-
-  // Asked every minute by the harness: whether Keycloak still holds this consumer's client exactly as
-  // the mesh gave it, so a client deleted or edited behind the mesh's back is made again (hq issue 120).
-  async holds(p: Provision): Promise<boolean> {
-    return clients.holds(p);
-  },
-});

modules/keycloak/test/oidc.test.ts

@@ -1,239 +0,0 @@
-// What holds keycloak to the `oidc-client` provision (oidc.ts): one confidential client per consumer,
-// under the id and secret the mesh gave, redirecting only to the consumer's own callback under the
-// names the mesh composed; made once and brought back on every apply; and a client the mesh did not
-// make — same id or not — never adopted, changed or deleted.
-//
-// Keycloak is a fake: the admin routes the module touches, answering with the status codes and the
-// shapes Keycloak gives. Run against the compiled module (npm test builds first), the way the runtime
-// loads it.
-
-import { test, after } from "node:test";
-import assert from "node:assert/strict";
-import { createServer, type IncomingMessage, type ServerResponse } from "node:http";
-import { randomUUID } from "node:crypto";
-
-import { KeycloakClient } from "../dist/client.js";
-import { MARK, OidcClients, ROLES_MAPPER, realmOf, redirectsOf } from "../dist/oidc.js";
-
-type Client = Record<string, any>;
-
-/** The realm's clients, by internal id, and what the fake was asked. */
-const realm = "Novox";
-const clients = new Map<string, Client>();
-const calls: string[] = [];
-
-function body(req: IncomingMessage): Promise<any> {
-  return new Promise((resolve) => {
-    let raw = "";
-    req.on("data", (c) => (raw += c));
-    req.on("end", () => resolve(raw ? JSON.parse(raw) : undefined));
-  });
-}
-
-function send(res: ServerResponse, status: number, value?: unknown): void {
-  res.writeHead(status, { "Content-Type": "application/json" });
-  res.end(value === undefined ? "" : JSON.stringify(value));
-}
-
-const server = createServer(async (req, res) => {
-  const url = new URL(req.url!, "http://fake");
-  calls.push(`${req.method} ${url.pathname}`);
-  if (url.pathname === "/realms/master/protocol/openid-connect/token") {
-    return send(res, 200, { access_token: "t", expires_in: 300 });
-  }
-  const base = `/admin/realms/${realm}/clients`;
-  if (!url.pathname.startsWith(base)) return send(res, 404, { error: "Realm not found." });
-  const rest = url.pathname.slice(base.length).split("/").filter(Boolean);
-  if (rest.length === 0 && req.method === "GET") {
-    const want = url.searchParams.get("clientId");
-    return send(res, 200, [...clients.values()].filter((c) => !want || c.clientId === want));
-  }
-  if (rest.length === 0 && req.method === "POST") {
-    const rep = await body(req);
-    if ([...clients.values()].some((c) => c.clientId === rep.clientId)) {
-      return send(res, 409, { errorMessage: `Client ${rep.clientId} already exists` });
-    }
-    const id = randomUUID();
-    const mappers = (rep.protocolMappers ?? []).map((m: Client) => ({ ...m, id: randomUUID() }));
-    clients.set(id, { ...rep, id, protocolMappers: mappers });
-    return send(res, 201);
-  }
-  const c = clients.get(rest[0]);
-  if (!c) return send(res, 404, { error: "Could not find client" });
-  if (rest.length === 1 && req.method === "PUT") {
-    // Keycloak ignores protocolMappers on a client update: they have their own endpoints.
-    const rep = await body(req);
-    clients.set(c.id, { ...rep, id: c.id, protocolMappers: c.protocolMappers });
-    return send(res, 204);
-  }
-  if (rest.length === 1 && req.method === "DELETE") {
-    clients.delete(c.id);
-    return send(res, 204);
-  }
-  if (rest[1] === "client-secret" && req.method === "GET") {
-    return send(res, 200, { type: "secret", value: c.secret });
-  }
-  if (rest[1] === "protocol-mappers") {
-    if (req.method === "GET") return send(res, 200, c.protocolMappers ?? []);
-    if (req.method === "POST") {
-      c.protocolMappers = [...(c.protocolMappers ?? []), { ...(await body(req)), id: randomUUID() }];
-      return send(res, 201);
-    }
-    if (req.method === "PUT") {
-      const m = await body(req);
-      c.protocolMappers = c.protocolMappers.map((x: Client) => (x.id === rest[4] ? m : x));
-      return send(res, 204);
-    }
-  }
-  send(res, 405);
-});
-await new Promise<void>((r) => server.listen(0, "127.0.0.1", r));
-after(() => server.close());
-const port = (server.address() as { port: number }).port;
-
-const oidc = new OidcClients(new KeycloakClient(`http://127.0.0.1:${port}`, "admin", "pw"), realm);
-
-/** Grafana on ace, as the mesh hands it to the provisioner. */
-function grafana(secret = "s3cret", values: Record<string, unknown> = {}) {
-  return {
-    as: "mesh_ace_grafana",
-    password: secret,
-    consumer: "ace",
-    values: {
-      label: "grafana", endpoint: "web", port: 20010, callback: "/login/generic_oauth",
-      name: "grafana.zurag.be", "internal-name": "grafana.ace.internal", ...values,
-    },
-  };
-}
-
-function only(clientId: string): Client {
-  const found = [...clients.values()].filter((c) => c.clientId === clientId);
-  assert.equal(found.length, 1, `exactly one client ${clientId}, found ${found.length}`);
-  return found[0];
-}
-
-test("the realm is read out of the issuer, and an issuer that names none is refused", () => {
-  assert.equal(realmOf("https://keycloak.novox.be/realms/Novox"), "Novox");
-  assert.equal(realmOf("https://keycloak.novox.be/realms/Novox/"), "Novox");
-  assert.equal(realmOf("http://127.0.0.1:18500/realms/master"), "master");
-  assert.throws(() => realmOf("https://keycloak.novox.be"), /realms/);
-  assert.throws(() => realmOf("keycloak"), /not a URL/);
-});
-
-test("the redirect is the consumer's callback under every name the mesh composed for it", () => {
-  assert.deepEqual(redirectsOf(grafana().values), {
-    root: "https://grafana.zurag.be",
-    redirects: ["https://grafana.zurag.be/login/generic_oauth", "https://grafana.ace.internal/login/generic_oauth"],
-  });
-  // A route reaching only the private network has only the internal name, and that is enough.
-  assert.deepEqual(redirectsOf({ callback: "/cb", "internal-name": "x.ace.internal" }).redirects,
-    ["https://x.ace.internal/cb"]);
-  assert.throws(() => redirectsOf({ name: "grafana.zurag.be" }), /callback/);
-  assert.throws(() => redirectsOf({ name: "grafana.zurag.be", callback: "login" }), /callback/);
-  assert.throws(() => redirectsOf({ callback: "/cb" }), /label/);
-});
-
-test("a consumer is given one confidential client, under its id and the mesh's secret", async () => {
-  clients.clear();
-  assert.equal(await oidc.ensure(grafana()), "created");
-  const c = only("mesh_ace_grafana");
-  assert.equal(c.publicClient, false);
-  assert.equal(c.clientAuthenticatorType, "client-secret");
-  assert.equal(c.secret, "s3cret");
-  assert.equal(c.enabled, true);
-  assert.equal(c.standardFlowEnabled, true);
-  assert.equal(c.directAccessGrantsEnabled, false);
-  assert.equal(c.implicitFlowEnabled, false);
-  assert.deepEqual(c.redirectUris, [
-    "https://grafana.zurag.be/login/generic_oauth", "https://grafana.ace.internal/login/generic_oauth"]);
-  assert.equal(c.attributes[MARK], "true");
-  assert.deepEqual(c.protocolMappers.map((m: Client) => m.name), [ROLES_MAPPER.name]);
-  assert.equal(await oidc.holds(grafana()), true);
-});
-
-test("applying the same grant again makes no second client", async () => {
-  clients.clear();
-  await oidc.ensure(grafana());
-  assert.equal(await oidc.ensure(grafana()), "updated");
-  assert.equal(await oidc.ensure(grafana()), "updated");
-  only("mesh_ace_grafana");
-  assert.equal(only("mesh_ace_grafana").protocolMappers.length, 1, "the roles mapper is not added twice");
-});
-
-test("a new secret or a moved name is applied in place, and what the mesh does not own survives", async () => {
-  clients.clear();
-  await oidc.ensure(grafana());
-  const id = only("mesh_ace_grafana").id;
-  // Something the mesh does not own, set on the client after it was made.
-  clients.get(id)!.consentRequired = true;
-  clients.get(id)!.attributes["post.logout.redirect.uris"] = "+";
-
-  assert.equal(await oidc.holds(grafana("rotated")), false, "a rotated secret is not held until applied");
-  await oidc.ensure(grafana("rotated", { name: "dash.zurag.be" }));
-  const c = only("mesh_ace_grafana");
-  assert.equal(c.id, id, "updated, not replaced");
-  assert.equal(c.secret, "rotated");
-  assert.deepEqual(c.redirectUris, [
-    "https://dash.zurag.be/login/generic_oauth", "https://grafana.ace.internal/login/generic_oauth"]);
-  assert.equal(c.rootUrl, "https://dash.zurag.be");
-  assert.equal(c.consentRequired, true);
-  assert.equal(c.attributes["post.logout.redirect.uris"], "+");
-  assert.equal(c.attributes[MARK], "true");
-  assert.equal(await oidc.holds(grafana("rotated", { name: "dash.zurag.be" })), true);
-});
-
-test("a client lost or edited behind the mesh's back is not held, and is made whole again", async () => {
-  clients.clear();
-  await oidc.ensure(grafana());
-  const c = only("mesh_ace_grafana");
-  c.redirectUris = ["*"];
-  assert.equal(await oidc.holds(grafana()), false, "a widened redirect is not what the mesh gave");
-  await oidc.ensure(grafana());
-  assert.equal(await oidc.holds(grafana()), true);
-
-  only("mesh_ace_grafana").protocolMappers = [];
-  assert.equal(await oidc.holds(grafana()), false, "a client without its roles mapper is not held");
-  await oidc.ensure(grafana());
-  assert.equal(await oidc.holds(grafana()), true);
-
-  clients.clear();
-  assert.equal(await oidc.holds(grafana()), false);
-});
-
-test("a client of the same id the mesh did not make is refused, and left exactly as it was", async () => {
-  clients.clear();
-  clients.set("theirs", { id: "theirs", clientId: "mesh_ace_grafana", secret: "their-secret", redirectUris: ["*"] });
-  const before = JSON.stringify(clients.get("theirs"));
-  const writes = calls.length;
-  await assert.rejects(oidc.ensure(grafana()), /did not make/);
-  assert.equal(JSON.stringify(clients.get("theirs")), before);
-  assert.ok(calls.slice(writes).every((c) => c.startsWith("GET") || c.startsWith("POST /realms/master")),
-    `only reads were made: ${calls.slice(writes).join(", ")}`);
-  assert.equal(await oidc.holds(grafana()), false);
-  assert.equal(await oidc.remove("mesh_ace_grafana"), "not ours");
-  assert.ok(clients.has("theirs"), "a client the mesh did not make is never deleted");
-});
-
-test("the predecessor's hand-made client is never touched: the mesh's has its own id", async () => {
-  clients.clear();
-  clients.set("hal", { id: "hal", clientId: "grafana", secret: "old", redirectUris: ["https://grafana.zurag.be/*"] });
-  await oidc.ensure(grafana());
-  assert.equal(clients.get("hal")!.secret, "old");
-  only("mesh_ace_grafana");
-  assert.equal(await oidc.remove("grafana"), "not ours");
-  assert.ok(clients.has("hal"));
-});
-
-test("a withdrawn consumer's client is removed, and an absent one is not an error", async () => {
-  clients.clear();
-  await oidc.ensure(grafana());
-  assert.equal(await oidc.remove("mesh_ace_grafana"), "removed");
-  assert.equal([...clients.values()].length, 0);
-  assert.equal(await oidc.remove("mesh_ace_grafana"), "absent");
-});
-
-test("a contribution with no callback makes no client at all", async () => {
-  clients.clear();
-  await assert.rejects(oidc.ensure({ ...grafana(), values: { name: "grafana.zurag.be" } }), /callback/);
-  assert.equal(clients.size, 0);
-});

modules/keycloak/tsconfig.json

@@ -8,5 +8,5 @@
     "skipLibCheck": true,
     "noEmit": true
   },
-  "include": ["client.ts", "oidc.ts", "index.ts", "provisioner/index.ts", "tools/index.ts"]
+  "include": ["client.ts", "index.ts", "tools/index.ts"]
 }

modules/lavinmq/Dockerfile

@@ -0,0 +1,42 @@
+# lavinmq's runtime: the tool runtime, carrying this module's compiled bootstrap, provisioner,
+# tools and event consumer.
+#
+# **Built from this module's own directory and nothing else.** The sdk is in the base image, so
+# nothing is copied out of a neighbouring checkout — which is what lets the mesh build this from a
+# repository and a path (novox/hq ADR 0069) rather than only on a workstation that happens to have
+# the siblings.
+#
+# Two bases, named rather than pinned: the image this is COMPILED in, and the image it RUNS in.
+# They are different images on purpose — the first carries a compiler and the second must not, or
+# every running container would carry one it never invokes. The mesh answers both with the copies it
+# holds, because a fingerprint written here would name one particular copy and no other mesh has it
+# (novox/hq issue 044). Declared in module.json's `build.on`; deliberately no defaults, so a build
+# nobody told stops here and says which module to build first.
+ARG BUILD_BASE
+ARG RUNTIME_BASE
+
+FROM ${BUILD_BASE} AS build
+# Compiled under /app/modules so `@novox/mesh-sdk` resolves upward into the base's own
+# node_modules — the module is compiled against exactly the sdk it will run against.
+WORKDIR /app/modules/lavinmq
+COPY . .
+# The compiler is invoked by its real path rather than through node_modules/.bin, whose entries are
+# symlinks to a launcher that requires its library relatively — resolved away when the base image
+# was assembled.
+#
+# Four entrypoints and a client, because this module is four things: a run-once bootstrap that
+# writes the broker's configuration before it first starts, a provisioner that grants consumers
+# their own vhost and user, a set of tools, and an event consumer.
+RUN node /app/node_modules/typescript/bin/tsc \
+      client.ts index.ts bootstrap/index.ts provisioner/index.ts tools/index.ts \
+      --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist
+
+FROM ${RUNTIME_BASE}
+COPY --from=build /app/modules/lavinmq/dist /app/modules/lavinmq/dist
+# What the runtime loads from this module in serve mode: its event consumer, its tools, and its
+# provisioner — all three in one process, so the provisioner's reconcile loop runs with the broker
+# connected (novox/hq issues 060/061; the provisioner used to be run as a separate container `args`
+# command, which meant it served no tools and, once, ran nowhere at all). The run-once bootstrap is
+# NOT listed here — it is named in its own container's `args`, because it runs to completion before
+# the broker starts rather than serving. One image, because they are one module and share a client.
+ENV MESH_TOOL_MODULES=/app/modules/lavinmq/dist/index.js,/app/modules/lavinmq/dist/tools/index.js,/app/modules/lavinmq/dist/provisioner/index.js

modules/lavinmq/bootstrap/index.ts

@@ -0,0 +1,45 @@
+// lavinmq's run-once bootstrap — lavinmq's own code (novox/hq ADR 0039), run once before the broker
+// first starts (ADR 0052). lavinmq's default admin is set at first boot from a config file's
+// `default_password_hash`, and that value is a HASH of the mesh-minted admin password, not the
+// password itself — a form the mesh's plain-secret delivery cannot produce and no `${secret:...}`
+// placeholder can compute. So this step computes it: it reads the admin password the mesh minted and
+// the host unsealed, hashes it the way lavinmq expects (see client.rabbitHash), and writes the config
+// file the broker container reads with `--config`. The host runs it to completion and only then
+// starts the broker the manifest places after it — so the broker's first boot finds a config with an
+// admin it can authenticate, and the provisioner (which reaches the management API as that admin)
+// can do its work.
+//
+// It runs in the module's own runtime image, under the module's own account, as `mesh-tools run`
+// imports it — no broker connection, because writing a config file is an offline operation and there
+// is no broker to reach yet.
+//
+// lavinmq consults `default_user`/`default_password_hash` only on a first boot with an empty data
+// dir; a later boot uses the persisted user database and ignores them. So this seeds the admin once,
+// and a rotation of the admin secret does not re-key an already-initialised broker — the same
+// first-boot-only shape the RabbitMQ-compatible default user has always had.
+
+import { writeFileSync } from "node:fs";
+import { readFileSync } from "node:fs";
+import { rabbitHash } from "../client.js";
+
+const adminUser = process.env.MESH_PROVISION_ADMIN_USER ?? process.env.MESH_LAVINMQ_ADMIN_USER ?? "mesh-admin";
+const passwordFile = process.env.MESH_PROVISION_PASSWORD_FILE ?? process.env.MESH_LAVINMQ_ADMIN_PASSWORD_FILE ?? "/run/secrets/default";
+const configOut = process.env.MESH_LAVINMQ_CONFIG_OUT ?? "/var/lib/lavinmq-module/lavinmq.ini";
+const dataDir = process.env.MESH_LAVINMQ_DATA_DIR ?? "/var/lib/lavinmq";
+
+const password = readFileSync(passwordFile, "utf8").replace(/\n$/, "");
+if (!password) {
+  throw new Error(`[lavinmq:bootstrap] admin password file ${passwordFile} is empty — cannot seed the admin`);
+}
+
+// The broker reads only what it needs to authenticate its admin on first boot; bind/ports come from
+// the container's entrypoint (`-b 0.0.0.0`), so this file names the admin and nothing else about the
+// network.
+const ini =
+  "[main]\n" +
+  `data_dir = ${dataDir}\n` +
+  `default_user = ${adminUser}\n` +
+  `default_password_hash = ${rabbitHash(password)}\n`;
+
+writeFileSync(configOut, ini, { mode: 0o600 });
+console.log(`[lavinmq:bootstrap] wrote ${configOut} with admin '${adminUser}' (password hashed for lavinmq)`);

modules/lavinmq/client.ts

@@ -0,0 +1,183 @@
+// lavinmq's admin client — lavinmq's own code, living in the module (novox/hq ADR 0039). Both this
+// module's tools and its provisioner import it, and nothing outside lavinmq does.
+//
+// It drives lavinmq through its HTTP management API (the RabbitMQ-compatible surface lavinmq serves
+// on 15672), not a hand-rolled AMQP admin stack: the module may take NO npm dependency beyond
+// @novox/mesh-sdk, and the management API is exactly the admin surface — create/remove a vhost, a
+// user, and its permissions — reached with `fetch` (global on node 22) and HTTP Basic auth. One
+// boundary, `api()`, and every method is built on it. This is the module's one impure seam, the way
+// postgres's is `psql` and redis's is a RESP socket.
+//
+// **The login and password are the mesh's, not the provisioner's (novox/hq ADR 0048).** The mesh
+// derives the login and hands it to both ends so they agree, and mints the password and delivers a
+// copy to each. lavinmq creates exactly that user with exactly that password on a vhost of the same
+// name — a name or password the provisioner invented is one the consumer could never present.
+
+import { createHash, randomBytes } from "node:crypto";
+import { readFileSync } from "node:fs";
+
+export interface LavinmqConn {
+  /** Base URL of the management API, e.g. http://lavinmq:15672 (no trailing /api). */
+  readonly base: string;
+  readonly adminUser: string;
+  readonly adminPassword: string;
+}
+
+export class LavinmqClient {
+  constructor(private readonly conn: LavinmqConn) {}
+
+  /**
+   * Build from the module's resolved environment. Reads MESH_LAVINMQ_* first (the documented
+   * names), falling back to the MESH_PROVISION_* keys the manifest already sets on the provisioner
+   * container so the module runs unchanged there. Throws if it cannot find a management endpoint and
+   * an admin password — the right failure, because without them nothing it does can work.
+   */
+  static fromEnv(env: NodeJS.ProcessEnv = process.env): LavinmqClient {
+    const base = (env.MESH_LAVINMQ_MANAGEMENT ?? env.MESH_PROVISION_LAVINMQ ?? "").replace(/\/+$/, "");
+    const adminUser = env.MESH_LAVINMQ_ADMIN_USER ?? env.MESH_PROVISION_ADMIN_USER ?? "mesh-admin";
+    const adminPassword = env.MESH_LAVINMQ_ADMIN_PASSWORD ?? readSecretFile(env.MESH_PROVISION_PASSWORD_FILE);
+    if (!base || !adminPassword) {
+      throw new Error("lavinmq management endpoint or admin password is not set — lavinmq's own code cannot reach the server");
+    }
+    return new LavinmqClient({ base, adminUser, adminPassword });
+  }
+
+  /** One request against the management API. A non-2xx reply rejects, carrying the body for the log. */
+  async api(method: string, path: string, body?: unknown): Promise<unknown> {
+    const headers: Record<string, string> = {
+      Authorization: "Basic " + Buffer.from(`${this.conn.adminUser}:${this.conn.adminPassword}`).toString("base64"),
+    };
+    if (body !== undefined) headers["Content-Type"] = "application/json";
+    const resp = await fetch(`${this.conn.base}/api${path}`, {
+      method,
+      headers,
+      body: body !== undefined ? JSON.stringify(body) : undefined,
+    });
+    if (!resp.ok) {
+      throw new Error(`lavinmq management API ${method} ${path} -> ${resp.status}: ${await resp.text()}`);
+    }
+    const text = await resp.text();
+    return text ? JSON.parse(text) : null;
+  }
+
+  /** True once the management API answers — the server has finished starting. */
+  async ready(): Promise<boolean> {
+    try {
+      await this.api("GET", "/overview");
+      return true;
+    } catch {
+      return false;
+    }
+  }
+
+  /** Block until the management API answers, or throw once the budget is spent. */
+  async waitReady(retries = 30, delayMs = 1000): Promise<void> {
+    for (let i = 0; i < retries; i++) {
+      if (await this.ready()) return;
+      await new Promise((r) => setTimeout(r, delayMs));
+    }
+    throw new Error("lavinmq management API did not become ready");
+  }
+
+  /**
+   * Create (or reset to a known state) one consumer's broker: a vhost and a user both named for the
+   * consumer's login, with the login owning full permissions on exactly that vhost. Idempotent — a
+   * PUT of a vhost or user that exists is a no-op or a password reset, so a reconcile can call it
+   * again without harm. The consumer connects as `<login>` to vhost `<login>` and can reach nothing
+   * else (novox/hq ADR 0048).
+   */
+  async createConsumer(login: string, password: string): Promise<void> {
+    const v = encodeURIComponent(login);
+    const u = encodeURIComponent(login);
+    await this.api("PUT", `/vhosts/${v}`);
+    await this.api("PUT", `/users/${u}`, { password, tags: "" });
+    await this.api("PUT", `/permissions/${v}/${u}`, { configure: ".*", write: ".*", read: ".*" });
+  }
+
+  /**
+   * Whether a consumer's user exists with exactly this password and full permissions on its own
+   * vhost. Read-only: the stored hash is salted SHA-256, the scheme `rabbitHash` writes, so the
+   * password is checked by hashing it with the stored salt rather than by logging in. `false` when
+   * the user or its permission is gone or the password differs; an unreachable API rejects
+   * (novox/hq issue 120).
+   */
+  async holdsConsumer(login: string, password: string): Promise<boolean> {
+    const v = encodeURIComponent(login);
+    const u = encodeURIComponent(login);
+    const user = await this.getOrNull<{ password_hash?: string; hashing_algorithm?: string }>(`/users/${u}`);
+    if (!user?.password_hash) return false;
+    if (user.hashing_algorithm && !/sha256/i.test(user.hashing_algorithm)) {
+      throw new Error(`lavinmq user ${login} is hashed with ${user.hashing_algorithm}, which this check cannot verify`);
+    }
+    const stored = Buffer.from(user.password_hash, "base64");
+    if (stored.length < 5 || rabbitHash(password, stored.subarray(0, 4)) !== user.password_hash) return false;
+    const perm = await this.getOrNull<{ configure?: string; write?: string; read?: string }>(`/permissions/${v}/${u}`);
+    return perm?.configure === ".*" && perm?.write === ".*" && perm?.read === ".*";
+  }
+
+  /** A GET that answers null for a 404 and rejects on anything else that is not 2xx. */
+  private async getOrNull<T>(path: string): Promise<T | null> {
+    const resp = await fetch(`${this.conn.base}/api${path}`, {
+      headers: {
+        Authorization: "Basic " + Buffer.from(`${this.conn.adminUser}:${this.conn.adminPassword}`).toString("base64"),
+      },
+    });
+    if (resp.status === 404) return null;
+    if (!resp.ok) throw new Error(`lavinmq management API GET ${path} -> ${resp.status}: ${await resp.text()}`);
+    return (await resp.json()) as T;
+  }
+
+  /** Remove a consumer's vhost and user, idempotently. A DELETE of what is already gone is tolerated. */
+  async removeConsumer(login: string): Promise<void> {
+    const v = encodeURIComponent(login);
+    const u = encodeURIComponent(login);
+    try {
+      await this.api("DELETE", `/vhosts/${v}`);
+    } catch (err) {
+      console.error(`[lavinmq] delete vhost ${login} failed (continuing): ${err}`);
+    }
+    try {
+      await this.api("DELETE", `/users/${u}`);
+    } catch (err) {
+      console.error(`[lavinmq] delete user ${login} failed (continuing): ${err}`);
+    }
+  }
+
+  /** The vhosts, for the amqp_list_vhosts tool. */
+  async listVhosts(): Promise<{ name: string; messages: number }[]> {
+    const vhosts = (await this.api("GET", "/vhosts")) as { name: string; messages?: number }[];
+    return vhosts.map((v) => ({ name: v.name, messages: v.messages ?? 0 }));
+  }
+
+  /** The queues on one vhost (default the root vhost), for the amqp_list_queues tool. */
+  async listQueues(vhost = "/"): Promise<{ name: string; messages: number; consumers: number }[]> {
+    const queues = (await this.api("GET", `/queues/${encodeURIComponent(vhost)}`)) as
+      { name: string; messages?: number; consumers?: number }[];
+    return queues.map((q) => ({ name: q.name, messages: q.messages ?? 0, consumers: q.consumers ?? 0 }));
+  }
+}
+
+/**
+ * The RabbitMQ-compatible SHA-256 password hash lavinmq's `default_password_hash` expects:
+ * base64( salt[4] || sha256( salt || utf8(password) ) ). The salt is any four bytes — random here,
+ * because a fixed salt buys nothing and a fresh one is free. Verified against `lavinmqctl
+ * hash_password`: a hash produced here is accepted by the server unchanged.
+ */
+export function rabbitHash(password: string, salt: Buffer = randomBytes(4)): string {
+  const digest = createHash("sha256").update(Buffer.concat([salt, Buffer.from(password, "utf8")])).digest();
+  return Buffer.concat([salt, digest]).toString("base64");
+}
+
+/** Generate a URL-safe password. */
+export function generatePassword(): string {
+  return randomBytes(24).toString("base64url");
+}
+
+function readSecretFile(path: string | undefined): string | undefined {
+  if (!path) return undefined;
+  try {
+    return readFileSync(path, "utf8").trim();
+  } catch {
+    return undefined;
+  }
+}

modules/lavinmq/index.ts

@@ -0,0 +1,25 @@
+// lavinmq's events entrypoint, loaded by the per-node tool host (the provisioner container runs
+// ./provisioner separately). The broker lifecycle events are EMITTED from the provisioner, where the
+// lifecycle actually happens (novox/hq ADR 0041/0042):
+//   module.lavinmq.amqp.provisioned    — a consumer's vhost + user was created
+//   module.lavinmq.amqp.deprovisioned  — that vhost + user was removed
+// Here in the tool host we react to them, keeping a lightweight audit trail of who was granted a
+// broker and who lost one — observability the provider itself is best placed to log.
+
+import { on } from "@novox/mesh-sdk/events";
+
+interface AmqpEvent {
+  consumer?: string;
+  user: string;
+  vhost?: string;
+}
+
+await on<AmqpEvent>("module.lavinmq.amqp.provisioned", async (e) => {
+  console.log(`[lavinmq] broker provisioned for ${e.body.consumer ?? "?"} (user ${e.body.user}, vhost ${e.body.vhost})`);
+});
+
+await on<AmqpEvent>("module.lavinmq.amqp.deprovisioned", async (e) => {
+  console.log(`[lavinmq] broker deprovisioned (user ${e.body.user})`);
+});
+
+console.log("[lavinmq] auditing broker lifecycle events");

modules/lavinmq/module.json

@@ -0,0 +1,151 @@
+{
+  "module": "lavinmq",
+  "version": "1",
+  "provides": [
+    {
+      "name": "amqp",
+      "scope": "mesh"
+    }
+  ],
+  "claims": [
+    {
+      "name": "mesh-broker",
+      "scope": "mesh"
+    }
+  ],
+  "capabilities": [
+    "container-runtime"
+  ],
+  "emits": [
+    "module.lavinmq.amqp.provisioned",
+    "module.lavinmq.amqp.deprovisioned"
+  ],
+  "consumes": [
+    "module.lavinmq.amqp.provisioned",
+    "module.lavinmq.amqp.deprovisioned"
+  ],
+  "serves": {
+    "amqp": {
+      "port": 5672
+    }
+  },
+  "receives": {
+    "amqp": "/var/lib/lavinmq-module/grants/mesh.json"
+  },
+  "grants": {
+    "amqp": "/var/lib/lavinmq-module/grants"
+  },
+  "own-secrets": {
+    "admin": "/var/lib/lavinmq-module/admin.secret",
+    "broker": "/var/lib/mesh/lavinmq/broker"
+  },
+  "listens": [
+    {
+      "port": 5671,
+      "protocol": "tcp",
+      "from": "mesh",
+      "why": "the mesh bus \u2014 amqps, every module's events and the control plane, reached over the overlay"
+    },
+    {
+      "port": 5672,
+      "protocol": "tcp",
+      "from": "mesh",
+      "why": "modules on any machine that were granted a queue"
+    }
+  ],
+  "guards": [
+    15672
+  ],
+  "resources": [
+    {
+      "id": "mesh-state",
+      "type": "directory",
+      "path": "/var/lib/mesh/lavinmq",
+      "mode": "0700"
+    },
+    {
+      "id": "state",
+      "type": "directory",
+      "path": "/var/lib/lavinmq-module",
+      "mode": "0700"
+    },
+    {
+      "id": "grants-dir",
+      "type": "directory",
+      "path": "/var/lib/lavinmq-module/grants",
+      "mode": "0700"
+    },
+    {
+      "id": "broker-data",
+      "type": "directory",
+      "path": "/var/lib/mesh-broker",
+      "mode": "0700"
+    },
+    {
+      "id": "server",
+      "type": "container",
+      "name": "mesh-broker",
+      "image": "cloudamqp/lavinmq@sha256:3eb54c12916d700a978c2ea86e6362cd4974b0e3189508718006d4e6d341246b",
+      "ports": [
+        "5671:5671",
+        "5672:5672",
+        "127.0.0.1:15672:15672"
+      ],
+      "volumes": [
+        "/var/lib/mesh-broker:/var/lib/lavinmq",
+        "/var/lib/mesh-broker-tls:/tls:ro"
+      ],
+      "args": [
+        "--amqps-port=5671",
+        "--cert=/tls/tls.crt",
+        "--key=/tls/tls.key"
+      ]
+    },
+    {
+      "id": "runtime",
+      "type": "container",
+      "name": "mesh-lavinmq",
+      "artifact": "runtime",
+      "network": "host",
+      "volumes": [
+        "/var/lib/mesh/lavinmq/broker:/run/secrets/broker:ro",
+        "/var/lib/lavinmq-module/grants:/var/lib/lavinmq-module/grants:ro",
+        "/var/lib/lavinmq-module/admin.secret:/run/secrets/admin:ro"
+      ],
+      "env": {
+        "MESH_BROKER_FILE": "/run/secrets/broker",
+        "MESH_RECEIVES": "/var/lib/lavinmq-module/grants/mesh.json",
+        "MESH_PROVISION_LAVINMQ": "http://127.0.0.1:15672",
+        "MESH_PROVISION_ADMIN_USER": "guest",
+        "MESH_PROVISION_PASSWORD_FILE": "/run/secrets/admin"
+      }
+    }
+  ],
+  "build": {
+    "on": [
+      {
+        "arg": "BUILD_BASE",
+        "module": "mesh-tools",
+        "artifact": "build"
+      },
+      {
+        "arg": "RUNTIME_BASE",
+        "module": "mesh-tools",
+        "artifact": "runtime"
+      }
+    ],
+    "artifacts": [
+      {
+        "name": "runtime",
+        "kind": "image",
+        "from": "Dockerfile"
+      }
+    ]
+  },
+  "accesses": [
+    {
+      "path": "/var/lib/mesh-broker-tls",
+      "mode": "read"
+    }
+  ]
+}

modules/lavinmq/package.json

@@ -0,0 +1,14 @@
+{
+  "name": "@novox/module-lavinmq",
+  "version": "0.1.0",
+  "description": "lavinmq — provides the mesh amqp interface (a per-consumer AMQP message broker). Its management client, provisioner, run-once bootstrap, tools and events live here (novox/hq ADR 0039).",
+  "type": "module",
+  "private": true,
+  "dependencies": {
+    "@novox/mesh-sdk": "^0.1.1"
+  },
+  "devDependencies": {
+    "@types/node": "^22.0.0",
+    "typescript": "^5.6.0"
+  }
+}

modules/lavinmq/provisioner/index.ts

@@ -0,0 +1,56 @@
+// lavinmq's provisioner — the adapter that makes lavinmq a provider of the mesh `amqp` interface.
+// The reconcile loop, the contributions file, and reading the mesh's minted password are the sdk
+// harness's; this writes only the per-service half: how lavinmq creates and removes a consumer's own
+// broker (novox/hq ADR 0039/0040/0048).
+//
+// The `amqp` interface: a consumer connects as `as` with the password the mesh minted, to a vhost
+// named for that same login — its own message broker, isolated from every other consumer's by the
+// vhost boundary. It is a broker of its own, not a shared account on the mesh's control-plane broker.
+//
+// **The login and password are the mesh's, not the provisioner's (novox/hq ADR 0048).** The mesh
+// derives the login and hands it to both ends so they agree, and mints the password and delivers a
+// copy to each. lavinmq creates exactly that user with exactly that password — a name or password the
+// provisioner invented is one the consumer could never present.
+//
+// Vhost-per-login is the isolation model, the exact analog of postgres's database-per-login: the
+// consumer owns one vhost, named for its login, and a user with full rights on that vhost and no
+// rights anywhere else. lavinmq enforces it — a user with no permission on `/` is refused the moment
+// it opens that vhost (`NOT_ALLOWED`), so a login is a broker the consumer alone can reach.
+
+import { runProvisioner, type Provision } from "@novox/mesh-sdk/provisioner";
+import { emit } from "@novox/mesh-sdk/events";
+import { LavinmqClient } from "../client.js";
+
+const lavinmq = LavinmqClient.fromEnv();
+
+/** Emit a lifecycle event without letting a broker hiccup fail the provisioning itself. */
+async function announce(type: string, body: Record<string, string>): Promise<void> {
+  try {
+    await emit(type, body);
+  } catch (err) {
+    console.error(`[provisioner:amqp] emit ${type} failed: ${err}`);
+  }
+}
+
+runProvisioner("amqp", {
+  async create(p: Provision): Promise<void> {
+    // The vhost and the user share the consumer's login, so one cannot reach another's broker.
+    await lavinmq.waitReady();
+    await lavinmq.createConsumer(p.as, p.password);
+    await announce("module.lavinmq.amqp.provisioned", {
+      consumer: p.consumer ?? "",
+      user: p.as,
+      vhost: p.as,
+    });
+  },
+
+  async remove(p: { as: string }): Promise<void> {
+    await lavinmq.removeConsumer(p.as);
+    await announce("module.lavinmq.amqp.deprovisioned", { user: p.as, vhost: p.as });
+  },
+  // Asked every minute by the harness: whether the backend still holds this consumer exactly as
+  // the mesh gave it, so a login lost behind the provisioner's back is made again (novox/hq issue 120).
+  async holds(p: Provision): Promise<boolean> {
+    return lavinmq.holdsConsumer(p.as, p.password);
+  },
+});

modules/lavinmq/tools/index.ts

@@ -0,0 +1,32 @@
+// lavinmq's tools — lavinmq's own code (novox/hq ADR 0039), importing lavinmq's own management
+// client. They return structured data; the mesh serves them through the sdk's tool harness.
+
+import { registerModuleTools, type ToolDefinition } from "@novox/mesh-sdk/tools";
+import { LavinmqClient } from "../client.js";
+
+export function getLavinmqTools(lavinmq: LavinmqClient): ToolDefinition[] {
+  return [
+    {
+      name: "amqp_list_vhosts",
+      description: "List the lavinmq virtual hosts — one per consumer that was granted a broker.",
+      input: {},
+      run: async () => ({ vhosts: await lavinmq.listVhosts() }),
+    },
+    {
+      name: "amqp_list_queues",
+      description: "List the queues on a vhost with message and consumer counts. Omit vhost for the root '/'.",
+      input: { vhost: { type: "string", description: "the vhost to list, e.g. a consumer's login; defaults to '/'" } },
+      run: async (args) => ({ queues: await lavinmq.listQueues(args.vhost ? String(args.vhost) : undefined) }),
+    },
+  ];
+}
+
+// The tools exist only when the server can be reached from the environment; without it, lavinmq
+// contributes none rather than failing the whole tool runtime.
+registerModuleTools("lavinmq", (env) => {
+  try {
+    return getLavinmqTools(LavinmqClient.fromEnv(env));
+  } catch {
+    return [];
+  }
+});

modules/lavinmq/tsconfig.json

@@ -0,0 +1,12 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "NodeNext",
+    "moduleResolution": "NodeNext",
+    "strict": true,
+    "esModuleInterop": true,
+    "skipLibCheck": true,
+    "noEmit": true
+  },
+  "include": ["client.ts", "index.ts", "provisioner/index.ts", "tools/index.ts", "bootstrap/index.ts"]
+}

modules/letta/client.ts

@@ -1,10 +1,10 @@
 // The Letta API client — letta's own code, living in the module (novox/hq ADR 0039). Its tools
 // import it; nothing outside letta does.
 //
-// Letta authenticates with a single server password. That password is a mesh own-secret handed to
+// Letta authenticates with a single server password, presented as a Bearer token. That password is
-// both the server (LETTA_SERVER_PASSWORD) and this client, through the runtime config file the mesh
+// a mesh own-secret, minted once and handed to both the server (LETTA_SERVER_PASSWORD) and this
-// mounts (its `password` key) — so the module's tools are live without anything configured by hand.
+// client (MESH_LETTA_PASSWORD) — so the module's tools are live without anything configured by hand.
-// Where a server already has clients, the password is accepted rather than minted.
+// The runtime config file may still override the URL or password.
 
 import { readFileSync } from "node:fs";
 
@@ -58,10 +58,6 @@ export class LettaClient {
       ...options,
       headers: {
         "Content-Type": "application/json",
-        // The server's --secure mode checks X-BARE-PASSWORD ("password <it>") and answers a Bearer
-        // token alone with 401 (letta/server/rest_api/app.py, 0.6.x). Both are sent: Bearer is what
-        // later servers read.
-        "X-BARE-PASSWORD": `password ${this.password}`,
         Authorization: `Bearer ${this.password}`,
         ...(options.headers as Record<string, string> | undefined),
       },

modules/letta/module.json

@@ -5,37 +5,29 @@
     "container-runtime"
   ],
   "requires": [
-    "postgres-database",
+    "postgres-database"
-    "route"
   ],
   "contributes": {
     "postgres-database": {
       "name": "letta"
-    },
-    "route": {
-      "label": "letta",
-      "endpoint": "web"
     }
   },
   "binds": {
-    "postgres-database": "${dir:state}/database.json",
+    "postgres-database": "/var/lib/letta/database.json"
-    "route": "${dir:state}/route.json"
   },
   "secrets": {
-    "postgres-database": "${dir:state}/database.secret"
+    "postgres-database": "/var/lib/letta/database.secret"
   },
   "own-secrets": {
-    "server-password": "${dir:state}/server-password.secret",
+    "server-password": "/var/lib/letta/server-password.secret",
-    "openai-api-key": "${dir:state}/openai-api-key.secret",
     "broker": "/var/lib/mesh/letta/broker"
   },
   "listens": [
     {
-      "name": "web",
       "port": 8283,
       "protocol": "tcp",
       "from": "mesh",
-      "why": "the Letta agent server REST API and web UI, password-protected (--secure); a public name is the route's"
+      "why": "the Letta agent server REST API and web UI; a public name is a route grant later"
     }
   ],
   "resources": [
@@ -48,15 +40,15 @@
     {
       "id": "state",
       "type": "directory",
-      "mode": "0700",
+      "path": "/var/lib/letta",
-      "place": "."
+      "mode": "0700"
     },
     {
       "id": "server-env",
       "type": "file",
-      "path": "${dir:state}/server.env",
+      "path": "/var/lib/letta/server.env",
       "mode": "0600",
-      "content": "LETTA_PG_URI=postgresql://${bound:postgres-database:as}:${secret:postgres-database}@${bound:postgres-database:at}:${bound:postgres-database:port}/${bound:postgres-database:as}\nLETTA_SERVER_PASSWORD=${secret:server-password}\nOPENAI_API_KEY=${secret:openai-api-key}\nSECURE=true\nTZ=Europe/Brussels\n"
+      "content": "LETTA_PG_URI=postgresql://${bound:postgres-database:as}:${secret:postgres-database}@${bound:postgres-database:at}:${bound:postgres-database:port}/${bound:postgres-database:as}\nLETTA_SERVER_PASSWORD=${secret:server-password}\nSECURE=true\nTZ=Europe/Brussels\n"
     },
     {
       "id": "net",
@@ -67,24 +59,31 @@
       "id": "server",
       "type": "container",
       "name": "letta",
-      "image": "letta/letta@sha256:bfd1e49ce45b9a208c941e832c1d1d194017ff210a3784b0ca6c323aed767a29",
+      "image": "letta/letta@sha256:1d2e0692514287c5ed1a483e14e16ed945f8632d315539f5e66373bb7d7c471b",
       "network": "letta",
       "env-file": [
-        "${dir:state}/server.env"
+        "/var/lib/letta/server.env"
       ],
       "ports": [
         "8283"
       ],
-      "secrets-in-environment": "letta 0.6.x reads its settings from the environment only (pydantic settings, no secrets_dir or _FILE twin), and its startup.sh starts an embedded PostgreSQL unless LETTA_PG_URI is set - so the database password travels inside that URI (startup.sh also echoes it to the log); LETTA_SERVER_PASSWORD and OPENAI_API_KEY have no file source either"
+      "secrets-in-environment": "the letta image is env-driven and its file-source support could not be verified; the mesh runtime can take its password from config.json (client.ts) \u2014 not yet converted"
     },
     {
       "id": "runtime-config",
       "type": "file",
       "path": "/var/lib/mesh/letta/config.json",
       "mode": "0600",
-      "content": "{\n  \"password\": \"${secret:server-password}\"\n}\n",
+      "content": "{}\n",
       "merge": "json"
     },
+    {
+      "id": "runtime-env",
+      "type": "file",
+      "path": "/var/lib/letta/runtime.env",
+      "mode": "0600",
+      "content": "MESH_LETTA_PASSWORD=${secret:server-password}\n"
+    },
     {
       "id": "runtime",
       "type": "container",
@@ -99,10 +98,14 @@
         "MESH_LETTA_URL": "http://letta:8283",
         "MESH_LETTA_CONFIG_FILE": "/run/config/config.json"
       },
+      "env-file": [
+        "/var/lib/letta/runtime.env"
+      ],
       "restart-on": [
         "runtime-config"
       ],
-      "artifact": "runtime"
+      "artifact": "runtime",
+      "secrets-in-environment": "the letta image is env-driven and its file-source support could not be verified; the mesh runtime can take its password from config.json (client.ts) \u2014 not yet converted"
     }
   ],
   "build": {

modules/lidarr/index.ts

@@ -40,12 +40,12 @@ async function pollQueue(lidarr: LidarrClient): Promise<void> {
   if (primed) {
     // Entered the queue since last look — Lidarr grabbed a release.
     for (const [id, item] of now) {
-      if (!inQueue.has(id)) await emit("album.grabbed", { title: item.title, status: item.status });
+      if (!inQueue.has(id)) await emit("module.lidarr.album.grabbed", { title: item.title, status: item.status });
     }
     // Left the queue — imported and done, unless it was last seen failing.
     for (const [id, item] of inQueue) {
       if (!now.has(id) && !FAILED_STATUSES.has(item.status)) {
-        await emit("download.completed", { title: item.title });
+        await emit("module.lidarr.download.completed", { title: item.title });
       }
     }
   }

modules/lidarr/module.json

@@ -5,8 +5,8 @@
     "container-runtime"
   ],
   "emits": [
-    "album.grabbed",
+    "module.lidarr.album.grabbed",
-    "download.completed"
+    "module.lidarr.download.completed"
   ],
   "consumes": [],
   "own-secrets": {
@@ -14,7 +14,6 @@
   },
   "listens": [
     {
-      "name": "web",
       "port": 8686,
       "protocol": "tcp",
       "from": "mesh",
@@ -87,7 +86,7 @@
   "contributes": {
     "route": {
       "label": "lidarr",
-      "endpoint": "web"
+      "port": 8686
     }
   },
   "binds": {

modules/mailu/README.md

@@ -1,17 +0,0 @@
-# mailu
-
-Mail — Mailu, with its provisioner (the `smtp` provision) and tools, on the tool runtime.
-
-## Settings
-
-A definition names no mesh (novox/hq ADR 0112, ADR 0155), so the values that are this
-installation's are settings on the assignment, `settings set mailu <file>`:
-
-```json
-{"domain": "…", "sitename": "…", "website": "https://…", "proxy-address": "…"}
-```
-
-`domain` is the mail domain (also the provisioner's, for a consumer's address); `sitename` and
-`website` are shown by the web front; `proxy-address` is what `REAL_IP_FROM` trusts a real-IP
-header from — the address the proxy forwards with. The front's own hostname is the name of its
-`web` route, told to it by the mesh.

modules/mailu/index.ts

@@ -36,8 +36,8 @@ function watcher(created: string, deleted: string): (keys: string[]) => Promise<
   };
 }
 
-const watchUsers = watcher("user.created", "user.deleted");
+const watchUsers = watcher("module.mailu.user.created", "module.mailu.user.deleted");
-const watchAliases = watcher("alias.created", "alias.deleted");
+const watchAliases = watcher("module.mailu.alias.created", "module.mailu.alias.deleted");
 
 async function pollUsers(): Promise<void> {
   await watchUsers((await mailu.listUsers()).map((u) => u.email));

modules/mailu/module.json

@@ -16,27 +16,27 @@
     "route": {
       "web": {
         "label": "mail",
-        "endpoint": "web-tls",
+        "port": 7443,
         "scheme": "https",
         "insecure": true
       },
       "acme": {
         "label": "mail",
         "path": "/.well-known/acme-challenge",
-        "endpoint": "web",
+        "port": 7080,
         "priority": 100
       },
       "autoconfig": {
         "label": "autoconfig",
-        "endpoint": "autoconfig"
+        "port": 4243
       },
       "autodiscover": {
         "label": "autodiscover",
-        "endpoint": "autoconfig"
+        "port": 4243
       },
       "automx": {
         "label": "automx",
-        "endpoint": "autoconfig"
+        "port": 4243
       }
     }
   },
@@ -53,14 +53,13 @@
     }
   },
   "emits": [
-    "user.created",
+    "module.mailu.user.created",
-    "user.deleted",
+    "module.mailu.user.deleted",
-    "alias.created",
+    "module.mailu.alias.created",
-    "alias.deleted"
+    "module.mailu.alias.deleted"
   ],
   "listens": [
     {
-      "name": "smtp",
       "port": 25,
       "protocol": "tcp",
       "from": "anywhere",
@@ -68,7 +67,6 @@
       "fixed": true
     },
     {
-      "name": "pop3",
       "port": 110,
       "protocol": "tcp",
       "from": "anywhere",
@@ -76,7 +74,6 @@
       "fixed": true
     },
     {
-      "name": "imap",
       "port": 143,
       "protocol": "tcp",
       "from": "anywhere",
@@ -84,7 +81,6 @@
       "fixed": true
     },
     {
-      "name": "smtps",
       "port": 465,
       "protocol": "tcp",
       "from": "anywhere",
@@ -92,7 +88,6 @@
       "fixed": true
     },
     {
-      "name": "submission",
       "port": 587,
       "protocol": "tcp",
       "from": "anywhere",
@@ -100,7 +95,6 @@
       "fixed": true
     },
     {
-      "name": "imaps",
       "port": 993,
       "protocol": "tcp",
       "from": "anywhere",
@@ -108,7 +102,6 @@
       "fixed": true
     },
     {
-      "name": "pop3s",
       "port": 995,
       "protocol": "tcp",
       "from": "anywhere",
@@ -116,25 +109,22 @@
       "fixed": true
     },
     {
-      "name": "web",
       "port": 7080,
       "protocol": "tcp",
       "from": "mesh",
-      "why": "the web front over http; only the ACME HTTP-01 passthrough is routed here — everything else 301s to https and would loop a proxy"
+      "why": "the web front over http; only the ACME HTTP-01 passthrough is routed here \u2014 everything else 301s to https and would loop a proxy"
     },
     {
-      "name": "web-tls",
       "port": 7443,
       "protocol": "tcp",
       "from": "mesh",
-      "why": "the web front over its own TLS (admin, webmail, API); its public name is a route grant reaching it here"
+      "why": "the web front over its own TLS (admin, webmail, API); the public name mail.novox.be is a route grant reaching it here"
     },
     {
-      "name": "autoconfig",
       "port": 4243,
       "protocol": "tcp",
       "from": "mesh",
-      "why": "automx: mail client autoconfiguration; the autoconfig, autodiscover and automx names are route grants reaching it here"
+      "why": "automx: mail client autoconfiguration; autoconfig/autodiscover/automx.novox.be are route grants reaching it here"
     }
   ],
   "own-secrets": {
@@ -168,7 +158,7 @@
       "type": "file",
       "path": "${dir:state}/mailu.env",
       "mode": "0644",
-      "content": "ADMIN_ADDRESS=mailu-admin\nANTISPAM_ADDRESS=mailu-antispam\nANTIVIRUS_ADDRESS=mailu-antivirus\nIMAP_ADDRESS=mailu-imap\nSMTP_ADDRESS=mailu-smtp\nFRONT_ADDRESS=mailu-front\nWEBMAIL_ADDRESS=mailu-webmail\nWEBDAV_ADDRESS=mailu-webdav\nREDIS_ADDRESS=mailu-redis\nPORTS=25,80,443,465,993,995,4190,110,143,587\nDOMAIN=${setting:domain}\nHOSTNAMES=${bound:route:name-web}\nPOSTMASTER=admin\nSITENAME=${setting:sitename}\nWEBSITE=${setting:website}\nTLS_FLAVOR=letsencrypt\nSUBNET=192.168.203.0/24\nCOMPOSE_PROJECT_NAME=mailu\nANTIVIRUS=clamav\nWEBMAIL=roundcube\nWEBDAV=radicale\nFETCHMAIL_ENABLED=True\nFETCHMAIL_DELAY=600\nADMIN=true\nWEB_ADMIN=/admin\nWEB_WEBMAIL=/webmail\nWEBROOT_REDIRECT=/webmail\nAPI=true\nWEB_API=/api\nAUTH_RATELIMIT_IP=6000/hour\nAUTH_RATELIMIT_USER=1000/day\nCREDENTIAL_ROUNDS=12\nPASSWORD_SCHEME=PBKDF2\nDISABLE_STATISTICS=True\nMESSAGE_SIZE_LIMIT=50000000\nMESSAGE_RATELIMIT=200/day\nRECIPIENT_DELIMITER=+\nPOSTFIX_MYNETWORKS=127.0.0.0/8 [::1]/128\nRELAYNETS=\nRELAYHOST=\nREJECT_UNLISTED_RECIPIENT=\nDB_FLAVOR=postgresql\nINITIAL_ADMIN_ACCOUNT=admin\nINITIAL_ADMIN_DOMAIN=${setting:domain}\nINITIAL_ADMIN_MODE=ifmissing\nSMTP_PORT=25\nSMTPS_PORT=465\nSUBMISSION_PORT=587\nPOP3_PORT=110\nPOP3S_PORT=995\nIMAP_PORT=143\nIMAPS_PORT=993\nHTTP_PORT=7080\nHTTPS_PORT=7443\nAUTOMX_PORT=4243\nAMX_SMTP_ADDRESS=${bound:route:name-web}\nAMX_SMTP_PORT=587\nAMX_IMAP_ADDRESS=${bound:route:name-web}\nAMX_IMAP_PORT=143\nAMX_MAIL_DOMAINS=${setting:domain}\nDMARC_RUA=admin\nDMARC_RUF=admin\nLETSENCRYPT_SHORTCHAIN=True\nTZ=Etc/UTC\nLOG_LEVEL=INFO\nWELCOME=false\nREAL_IP_HEADER=X-Real-IP\nREAL_IP_FROM=${setting:proxy-address}\nCOMPRESSION=\nCOMPRESS_LEVEL=\nCOMPRESSION_LEVEL=\nBIND_ADDRESS4=127.0.0.1\nBIND_ADDRESS6=::1\nMAILU_VERSION=1.9\nDOCKER_ORG=mailu\nDOCKER_PREFIX=\nWELCOME_SUBJECT=Welcome to your new email account\nWELCOME_BODY=Welcome to your new email account, if you can read this, then it is configured properly!\n"
+      "content": "ADMIN_ADDRESS=mailu-admin\nANTISPAM_ADDRESS=mailu-antispam\nANTIVIRUS_ADDRESS=mailu-antivirus\nIMAP_ADDRESS=mailu-imap\nSMTP_ADDRESS=mailu-smtp\nFRONT_ADDRESS=mailu-front\nWEBMAIL_ADDRESS=mailu-webmail\nWEBDAV_ADDRESS=mailu-webdav\nREDIS_ADDRESS=mailu-redis\nPORTS=25,80,443,465,993,995,4190,110,143,587\nDOMAIN=novox.be\nHOSTNAMES=mail.novox.be\nPOSTMASTER=admin\nSITENAME=Novox\nWEBSITE=https://novox.be\nTLS_FLAVOR=letsencrypt\nSUBNET=192.168.203.0/24\nCOMPOSE_PROJECT_NAME=mailu\nANTIVIRUS=clamav\nWEBMAIL=roundcube\nWEBDAV=radicale\nFETCHMAIL_ENABLED=True\nFETCHMAIL_DELAY=600\nADMIN=true\nWEB_ADMIN=/admin\nWEB_WEBMAIL=/webmail\nWEBROOT_REDIRECT=/webmail\nAPI=true\nWEB_API=/api\nAUTH_RATELIMIT_IP=6000/hour\nAUTH_RATELIMIT_USER=1000/day\nCREDENTIAL_ROUNDS=12\nPASSWORD_SCHEME=PBKDF2\nDISABLE_STATISTICS=True\nMESSAGE_SIZE_LIMIT=50000000\nMESSAGE_RATELIMIT=200/day\nRECIPIENT_DELIMITER=+\nPOSTFIX_MYNETWORKS=127.0.0.0/8 [::1]/128\nRELAYNETS=\nRELAYHOST=\nREJECT_UNLISTED_RECIPIENT=\nDB_FLAVOR=postgresql\nINITIAL_ADMIN_ACCOUNT=admin\nINITIAL_ADMIN_DOMAIN=novox.be\nINITIAL_ADMIN_MODE=ifmissing\nSMTP_PORT=25\nSMTPS_PORT=465\nSUBMISSION_PORT=587\nPOP3_PORT=110\nPOP3S_PORT=995\nIMAP_PORT=143\nIMAPS_PORT=993\nHTTP_PORT=7080\nHTTPS_PORT=7443\nAUTOMX_PORT=4243\nAMX_SMTP_ADDRESS=mail.novox.be\nAMX_SMTP_PORT=587\nAMX_IMAP_ADDRESS=mail.novox.be\nAMX_IMAP_PORT=143\nAMX_MAIL_DOMAINS=novox.be\nDMARC_RUA=admin\nDMARC_RUF=admin\nLETSENCRYPT_SHORTCHAIN=True\nTZ=Etc/UTC\nLOG_LEVEL=INFO\nWELCOME=false\nREAL_IP_HEADER=X-Real-IP\nREAL_IP_FROM=142.132.152.141\nCOMPRESSION=\nCOMPRESS_LEVEL=\nCOMPRESSION_LEVEL=\nBIND_ADDRESS4=127.0.0.1\nBIND_ADDRESS6=::1\nMAILU_VERSION=1.9\nDOCKER_ORG=mailu\nDOCKER_PREFIX=\nWELCOME_SUBJECT=Welcome to your new email account\nWELCOME_BODY=Welcome to your new email account, if you can read this, then it is configured properly!\n"
     },
     {
       "id": "secret-env",
@@ -315,7 +305,10 @@
         "${dir:data-data}:/data",
         "${dir:data-dkim}:/dkim"
       ],
-      "secrets-in-environment": "mailu-admin honours SECRET_KEY_FILE, DB_PW_FILE and API_TOKEN_FILE (configuration.py) but INITIAL_ADMIN_PW is env-only (start.py); the remaining containers' need for SECRET_KEY is unverified"
+      "secrets-in-environment": "mailu-admin honours SECRET_KEY_FILE, DB_PW_FILE and API_TOKEN_FILE (configuration.py) but INITIAL_ADMIN_PW is env-only (start.py); the remaining containers' need for SECRET_KEY is unverified",
+      "dns": [
+        "192.168.203.254"
+      ]
     },
     {
       "id": "imap",
@@ -490,6 +483,7 @@
         "MESH_MAILU_API_KEY_FILE": "/run/secrets/api-token",
         "MESH_MAILU_IMAP_CONTAINER": "mailu-imap",
         "MESH_MAILU_CONFIG_FILE": "/run/config/config.json",
+        "MESH_MAILU_DOMAIN": "novox.be",
         "MESH_RECEIVES": "${dir:grants}/mesh.json"
       },
       "restart-on": [
@@ -552,7 +546,9 @@
   ],
   "serves": {
     "smtp": {
-      "port": 587
+      "port": 587,
+      "domain": "novox.be",
+      "name": "mail.novox.be"
     }
   },
   "receives": {

modules/mailu/provisioner/index.ts

@@ -13,32 +13,17 @@
 // it to both ends; mailu sets exactly that password every run — so a rotation takes — and seals
 // nothing: the consumer already has its copy through the mesh's own channel.
 
-import { readFileSync } from "node:fs";
 import { runProvisioner, type Provision } from "@novox/mesh-sdk/provisioner";
 import { MailuClient } from "../client.js";
 
 const mailu = MailuClient.fromEnv();
 
-// The mail server's own domain: the operator's value, from the settings the mesh merges into this
+// The mail server's own domain. From the environment the manifest composes, because the client's
-// module's config file (`settings set mailu` with {"domain": …}; novox/hq ADR 0112, ADR 0155). A
+// config file carries the admin API's coordinates, not the mail domain.
-// definition names no mesh, so it is never a literal in the manifest — and it used to be, as
-// MESH_MAILU_DOMAIN, which is still read for a mesh that has not re-registered the manifest.
 function domain(): string {
-  const file = process.env.MESH_MAILU_CONFIG_FILE;
-  if (file) {
-    try {
-      const config = JSON.parse(readFileSync(file, "utf8")) as { domain?: unknown };
-      if (typeof config.domain === "string" && config.domain.trim() !== "") return config.domain.trim();
-    } catch {
-      // Unreadable or not JSON: fall through to the environment, and the error below names both.
-    }
-  }
   const named = (process.env.MESH_MAILU_DOMAIN ?? "").trim();
   if (named === "") {
-    throw new Error(
+    throw new Error("MESH_MAILU_DOMAIN is not set, so a consumer's address cannot be composed");
-      "no mail domain is set, so a consumer's address cannot be composed — `settings set mailu <file>` " +
-        'with {"domain": "<the mail domain>"}',
-    );
   }
   return named;
 }

modules/marrytts/module.json

@@ -6,7 +6,6 @@
   ],
   "listens": [
     {
-      "name": "api",
       "port": 59125,
       "protocol": "tcp",
       "from": "mesh",

modules/matrix/module.json

@@ -1,125 +0,0 @@
-{
-  "module": "matrix",
-  "version": "1",
-  "capabilities": [
-    "container-runtime"
-  ],
-  "listens": [
-    {
-      "name": "client",
-      "port": 6167,
-      "protocol": "tcp",
-      "from": "mesh",
-      "why": "Conduit's client-server and federation APIs over plain HTTP. Both arrive through the route on 443: Conduit answers /.well-known/matrix/server with <its name>:443, so other homeservers federate through the proxy and nothing needs the traditional 8448"
-    },
-    {
-      "name": "web",
-      "port": 80,
-      "protocol": "tcp",
-      "from": "mesh",
-      "why": "Element Web, the static browser client, served by the image's nginx; reached through its route"
-    }
-  ],
-  "requires": [
-    "route"
-  ],
-  "contributes": {
-    "route": {
-      "homeserver": {
-        "label": "matrix",
-        "endpoint": "client"
-      },
-      "element": {
-        "label": "element",
-        "endpoint": "web"
-      }
-    }
-  },
-  "binds": {
-    "route": "${dir:state}/route.json"
-  },
-  "resources": [
-    {
-      "id": "state",
-      "type": "directory",
-      "mode": "0700",
-      "place": "."
-    },
-    {
-      "id": "db",
-      "type": "directory",
-      "mode": "0700"
-    },
-    {
-      "id": "conduit-conf",
-      "type": "file",
-      "path": "${dir:state}/conduit.toml",
-      "mode": "0644",
-      "content": "# Written by the mesh (modules/matrix). Conduit reads this file (CONDUIT_CONFIG); nothing comes\n# from the environment. server_name is the homeserver's permanent identity: every user id, room id\n# and signature in the database carries it, so it is the name this module is served under\n# (${bound:route:name-homeserver}) and never changes once a database exists.\n[global]\nserver_name = \"${bound:route:name-homeserver}\"\ndatabase_backend = \"rocksdb\"\ndatabase_path = \"/var/lib/matrix-conduit/\"\naddress = \"0.0.0.0\"\nport = 6167\nmax_request_size = 20000000\nallow_registration = false\nallow_federation = true\nallow_check_for_updates = true\ntrusted_servers = [\"matrix.org\"]\n",
-      "names-on-purpose": {
-        "matrix.org": "the federation's public key server, trusted by default; the world's, not this mesh's"
-      }
-    },
-    {
-      "id": "element-conf",
-      "type": "file",
-      "path": "${dir:state}/element.json",
-      "mode": "0644",
-      "merge": "json",
-      "content": "{\n  \"default_server_name\": \"${bound:route:name-homeserver}\",\n  \"default_server_config\": {\n    \"m.homeserver\": {\n      \"base_url\": \"https://${bound:route:name-homeserver}\"\n    },\n    \"m.identity_server\": {\n      \"base_url\": \"https://vector.im\"\n    }\n  },\n  \"brand\": \"Element\",\n  \"integrations_ui_url\": \"https://scalar.vector.im/\",\n  \"integrations_rest_url\": \"https://scalar.vector.im/api\",\n  \"integrations_widgets_urls\": [\n    \"https://scalar.vector.im/_matrix/integrations/v1\",\n    \"https://scalar.vector.im/api\",\n    \"https://scalar-staging.vector.im/_matrix/integrations/v1\",\n    \"https://scalar-staging.vector.im/api\",\n    \"https://scalar-staging.riot.im/scalar/api\"\n  ],\n  \"bug_report_endpoint_url\": \"https://element.io/bugreports/submit\",\n  \"uisi_autorageshake_app\": \"element-auto-uisi\",\n  \"show_labs_settings\": true,\n  \"room_directory\": {\n    \"servers\": [\n      \"${bound:route:name-homeserver}\",\n      \"matrix.org\",\n      \"gitter.im\",\n      \"libera.chat\"\n    ]\n  },\n  \"enable_presence_by_hs_url\": {\n    \"https://matrix.org\": false,\n    \"https://matrix-client.matrix.org\": false\n  },\n  \"terms_and_conditions_links\": [\n    {\n      \"url\": \"https://element.io/privacy\",\n      \"text\": \"Privacy Policy\"\n    },\n    {\n      \"url\": \"https://element.io/cookie-policy\",\n      \"text\": \"Cookie Policy\"\n    }\n  ],\n  \"features\": {\n    \"feature_video_rooms\": true,\n    \"feature_rust_crypto\": true\n  },\n  \"element_call\": {\n    \"url\": \"https://call.element.dev\"\n  }\n}\n",
-      "names-on-purpose": {
-        "matrix.org": "the public room directory and the federation's largest homeserver; the world's",
-        "matrix-client.matrix.org": "the same homeserver's client endpoint; the world's",
-        "vector.im": "Element's public identity server; the world's",
-        "scalar.vector.im": "Element's public integration manager; the world's",
-        "scalar-staging.vector.im": "Element's staging integration manager, named by the upstream default config; the world's",
-        "scalar-staging.riot.im": "the same, under its former name; the world's",
-        "element.io": "Element's bug reports, privacy and cookie pages; the world's",
-        "gitter.im": "a public room directory; the world's",
-        "libera.chat": "a public room directory; the world's",
-        "call.element.dev": "Element Call's public instance; the world's"
-      }
-    },
-    {
-      "id": "net",
-      "type": "network",
-      "name": "matrix"
-    },
-    {
-      "id": "homeserver",
-      "type": "container",
-      "name": "matrix",
-      "image": "matrixconduit/matrix-conduit@sha256:b0d24248e94f944ca49f90f10c429e3d65f4472bdde25661ecea9840134fb133",
-      "network": "matrix",
-      "env": {
-        "CONDUIT_CONFIG": "/etc/conduit/conduit.toml"
-      },
-      "ports": [
-        "6167"
-      ],
-      "volumes": [
-        "${dir:db}:/var/lib/matrix-conduit",
-        "${dir:state}/conduit.toml:/etc/conduit/conduit.toml:ro"
-      ],
-      "restart-on": [
-        "conduit-conf"
-      ]
-    },
-    {
-      "id": "element",
-      "type": "container",
-      "name": "element-web",
-      "image": "vectorim/element-web@sha256:a8f415462ab8d2600a592ba1b92bea51efe5a4d10eb738aab9bed769f7099613",
-      "network": "matrix",
-      "ports": [
-        "80"
-      ],
-      "volumes": [
-        "${dir:state}/element.json:/app/config.json:ro"
-      ],
-      "restart-on": [
-        "element-conf"
-      ]
-    }
-  ]
-}

modules/mesh-catalog/Dockerfile

@@ -22,7 +22,7 @@ COPY . .
 # The compiler is invoked by its real path rather than through node_modules/.bin, whose entries are
 # symlinks to a launcher that requires its library relatively — resolved away when the base image
 # was assembled.
-RUN node /app/node_modules/typescript/bin/tsc pg.d.ts store.ts index.ts tools/index.ts prepare/index.ts \
+RUN node /app/node_modules/typescript/bin/tsc pg.d.ts store.ts index.ts tools/index.ts \
       --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist
 
 # **A module may need something the base image does not carry.** The base holds what every module
@@ -48,8 +48,3 @@ COPY --from=build /deps/node_modules /app/modules/mesh-catalog/node_modules
 # to listen for what the builder announces. Serve binds the broker first, then imports these, so
 # `on()` has something to subscribe to.
 ENV MESH_TOOL_MODULES=/app/modules/mesh-catalog/dist/index.js,/app/modules/mesh-catalog/dist/tools/index.js
-
-# And what prepares this module's state, for the runtime's `prepare` mode (novox/hq ADR 0135). Named
-# here, beside the entrypoints above, because the module knows which of its files prepares its state
-# and nothing else could: the mesh asks one word and this says what answers it.
-ENV MESH_PREPARE=/app/modules/mesh-catalog/dist/prepare/index.js

modules/mesh-catalog/index.ts

@@ -1,6 +1,6 @@
 // mesh-catalog's entrypoint — the module graph's consumer (novox/hq ADR 0070, ADR 0072).
 //
-// The build-machine role announces what it built; this places it in the graph and announces what that means.
+// The builder announces what it built; this places it in the graph and announces what that means.
 // The control plane hooks the *meaning* — a module was upgraded — rather than the build output, so
 // it never has to interpret an artifact or ask this module anything.
 //
@@ -14,12 +14,10 @@ import { Graph, type Made } from "./store.js";
 
 const graph = Graph.fromEnv();
 
-// The schema is not brought up here. The mesh prepares this module's state before it starts this
+// Before subscribing, and idempotent. The runtime is restarted until its store is reachable, which
-// version, and does not start it if that failed (novox/hq ADR 0135) — see prepare/index.ts. Doing it
+// is the same arrangement model-usage uses: a schema step that had to reach the provider over the
-// at start made a schema that could not be reached a crash loop instead of a stop, with the graph
+// overlay would block the very apply that brings the overlay up.
-// keeping a gap and nothing saying so. The reason it used to be here — that a step blocking the apply
+await graph.migrate();
-// would block the very apply that brings the overlay up — stopped being true when a step's failure
-// became this module's business and not the machine's (ADR 0136).
 
 /** What the builder says when it has built something. */
 interface Built {
@@ -49,15 +47,7 @@ interface Built {
   replay?: boolean;
 }
 
-/**
+await on("module.builder.built", async (event) => {
- * What a build means for the graph, wherever it came from.
- *
- * Two emitters say the same thing and neither is a mistake: the build machine says it as it happens,
- * and the control plane says what it already held when this module asks what it missed
- * (novox/hq ADR 0134). A replay is marked as one in its body, so nothing acts on a module that moved
- * months ago — see `replay` above.
- */
-const placeTheBuild = async (event: { body: unknown }): Promise<void> => {
   const body = event.body as Built;
   if (!body.module || !body.commit) {
     // Said rather than dropped: a build that announced itself without saying what it built is a
@@ -79,7 +69,7 @@ const placeTheBuild = async (event: { body: unknown }): Promise<void> => {
   // it was missing, and the mesh is told nothing happened, because nothing did.
   if (body.replay) return;
 
-  await emit("registered", {
+  await emit("module.mesh-catalog.registered", {
     module: body.module, commit: body.commit, upgraded,
   });
 
@@ -87,23 +77,19 @@ const placeTheBuild = async (event: { body: unknown }): Promise<void> => {
   // through modules that did not change, forever (ADR 0072).
   if (!upgraded) return;
 
-  await emit("upgraded", {
+  await emit("module.mesh-catalog.upgraded", {
     module: body.module, commit: body.commit, previous,
   });
 
   // What can be built now — stale, and waiting on nothing that is itself stale.
   for (const next of await graph.buildable()) {
-    await emit("rebuild-needed", {
+    await emit("module.mesh-catalog.rebuild-needed", {
       module: next.module,
       builtAt: next.commit,
       because: next.because,
     });
   }
-};
+});
-
-// As it happens, and what the mesh already held when this module asked what it missed.
-await on("mesh-build-machine.built", placeTheBuild);
-await on("mesh-controller.built-before", placeTheBuild);
 
 // **And ask for what was built before this catalogue existed** (novox/hq 04-ISSUES/050).
 //
@@ -115,4 +101,4 @@ await on("mesh-controller.built-before", placeTheBuild);
 // Asked on every start, not only the first. A catalogue cannot tell whether it has a gap, and the
 // answer is idempotent: registering a build already held changes nothing and announces nothing.
 // Asked AFTER subscribing, so a build arriving during the replay is not lost between the two.
-await emit("catching-up", {});
+await emit("module.mesh-catalog.catching-up", {});

modules/mesh-catalog/module.json

@@ -29,16 +29,13 @@
     "broker": "/var/lib/mesh/mesh-catalog/broker"
   },
   "consumes": [
-    "mesh-build-machine.built",
+    "module.builder.built"
-    "mesh-controller.built-before"
   ],
   "emits": [
-    "registered",
+    "module.mesh-catalog.registered",
-    "upgraded",
+    "module.mesh-catalog.upgraded",
-    "rebuild-needed",
+    "module.mesh-catalog.rebuild-needed"
-    "catching-up"
   ],
-  "prepares": true,
   "resources": [
     {
       "id": "mesh-state",

modules/mesh-catalog/prepare/index.ts

@@ -1,17 +0,0 @@
-// The catalogue's state, brought to the shape this version needs (novox/hq ADR 0135).
-//
-// **The mesh runs this before the version that needs it, and does not start that version if it
-// fails** — and the refusal reaches this module and nothing else on the machine
-// (novox/hq ADR 0136). That is the whole difference from where this used to happen: at start, inside
-// the runtime, a schema that could not be brought up was a crash loop, the graph kept a gap, and
-// nothing anywhere said so.
-//
-// Nothing here connects to the broker. Preparation runs before the version that would use it, so
-// there is nothing yet to talk to; the runtime's `prepare` mode imports this and awaits it, and this
-// process exiting non-zero is how the host knows not to start the runtime.
-import { Graph } from "../store.js";
-
-const graph = Graph.fromEnv();
-await graph.migrate();
-console.log("[mesh-catalog] the module graph's schema is what this version needs");
-await graph.close();

modules/mesh-catalog/tsconfig.json

@@ -12,7 +12,6 @@
     "pg.d.ts",
     "store.ts",
     "index.ts",
-    "tools/index.ts",
+    "tools/index.ts"
-    "prepare/index.ts"
   ]
 }

modules/mesh-console/Dockerfile

@@ -1,13 +0,0 @@
-# The console (novox/hq ADR 0152, design 34): the mesh's tools for whoever is on a machine, served
-# over MCP on that machine's loopback.
-#
-# **Nothing is compiled here.** The console is the tool runtime's own client — `mesh serve` — which
-# the runtime image already carries beside the runtime it runs modules with. This recipe changes the
-# program the image starts and nothing else, so the console is exactly the client a person can run by
-# hand, started by the mesh instead, on the credential the mesh sealed to the machine.
-#
-# One base, named rather than pinned: the mesh answers with the copy it holds (novox/hq issue 044).
-ARG RUNTIME_BASE
-
-FROM ${RUNTIME_BASE}
-ENTRYPOINT ["node", "dist/mesh.js"]

modules/mesh-console/README.md

@@ -1,38 +0,0 @@
-# mesh-console
-
-The mesh's tools, on the machine a person sits at, served by a module the mesh assigned there
-(novox/hq [ADR 0152](https://git.novox.be/novox/hq), design 34).
-
-Assign it to a machine and an agent on that machine has the mesh's tools at
-`http://127.0.0.1:<port>/mcp` — MCP over HTTP, `initialize`, `tools/list`, `tools/call`. A person at
-a terminal reaches the same endpoint with `mesh tools --console http://127.0.0.1:<port>` and
-`mesh call <module>.<tool> --console …`, with no credential of their own: the console holds it.
-
-## What it is
-
-The tool runtime's own client, `mesh serve`, started by the mesh on the credential it sealed to the
-machine for `<node>.mesh-console`. The manifest says three things nothing else in the catalogue says
-together:
-
-- `invokes: ["*"]` — it calls every tool on the mesh, and the bus grants exactly that publish side;
-- a listener `from: machine` — loopback only, and the filter opens nothing for it;
-- no `emits`, no `consumes`, no `tools` — nothing on the bus can address it.
-
-**Loopback is the authority boundary.** Whoever can connect is on the machine, and whoever is on the
-machine is the account that owns the mesh there (ADR 0034, ADR 0144). There is no token and no login,
-and `mesh serve` refuses to bind anything but a loopback address.
-
-## What it lists
-
-What the running modules answer: every tool runtime serves a `tools` verb for its module, and the
-console asks the catalogue which modules the mesh holds and each module what it serves. A module that
-did not answer — not assigned, not up, or built before the runtime answered `tools` — is named in the
-list's `_meta.notAnswering` and can still be called by `<module>.<tool>`.
-
-The mesh's own verbs (`status`, `push`, `assign`) are the `mesh-controller` seat's tools under
-ADR 0132 and are not served on the bus yet; they appear here when they are.
-
-## Port
-
-The manifest declares port 4270 and the mesh assigns the machine port as it does for any listener;
-the console binds `127.0.0.1:${port:4270}`. `node show <machine>` says which port a machine was given.

modules/mesh-console/module.json

@@ -1,64 +0,0 @@
-{
-  "module": "mesh-console",
-  "version": "1",
-  "slug": "console",
-  "capabilities": [
-    "container-runtime"
-  ],
-  "invokes": [
-    "*"
-  ],
-  "own-secrets": {
-    "broker": "/var/lib/mesh/mesh-console/broker"
-  },
-  "listens": [
-    {
-      "name": "mcp",
-      "port": 4270,
-      "protocol": "tcp",
-      "from": "machine",
-      "why": "the mesh's tools for whoever is on this machine, over MCP on loopback; the machine's login is the authority (novox/hq ADR 0152)"
-    }
-  ],
-  "resources": [
-    {
-      "id": "mesh-state",
-      "type": "directory",
-      "path": "/var/lib/mesh/mesh-console",
-      "mode": "0700"
-    },
-    {
-      "id": "server",
-      "type": "container",
-      "name": "mesh-console",
-      "network": "host",
-      "args": [
-        "serve"
-      ],
-      "env": {
-        "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_CONSOLE_LISTEN": "127.0.0.1:${port:4270}"
-      },
-      "volumes": [
-        "/var/lib/mesh/mesh-console/broker:/run/secrets/broker:ro"
-      ],
-      "artifact": "runtime"
-    }
-  ],
-  "build": {
-    "on": [
-      {
-        "arg": "RUNTIME_BASE",
-        "module": "mesh-tools",
-        "artifact": "runtime"
-      }
-    ],
-    "artifacts": [
-      {
-        "name": "runtime",
-        "kind": "image",
-        "from": "Dockerfile"
-      }
-    ]
-  }
-}

modules/mesh-vault/index.ts

@@ -16,15 +16,15 @@ interface SecretEvent {
   rotations?: number;
 }
 
-await on<SecretEvent>("secret.provisioned", async (e) => {
+await on<SecretEvent>("module.mesh-vault.secret.provisioned", async (e) => {
   console.log(`[mesh-vault] secret provisioned for ${e.body.as} on ${e.body.consumer} (${e.body.fingerprint})`);
 });
 
-await on<SecretEvent>("secret.rotated", async (e) => {
+await on<SecretEvent>("module.mesh-vault.secret.rotated", async (e) => {
   console.log(`[mesh-vault] secret rotated for ${e.body.as} — rotation ${e.body.rotations} (${e.body.fingerprint})`);
 });
 
-await on<SecretEvent>("secret.deprovisioned", async (e) => {
+await on<SecretEvent>("module.mesh-vault.secret.deprovisioned", async (e) => {
   console.log(`[mesh-vault] secret withdrawn from ${e.body.as}`);
 });
 

modules/mesh-vault/module.json

@@ -11,14 +11,14 @@
     "container-runtime"
   ],
   "emits": [
-    "secret.provisioned",
+    "module.mesh-vault.secret.provisioned",
-    "secret.rotated",
+    "module.mesh-vault.secret.rotated",
-    "secret.deprovisioned"
+    "module.mesh-vault.secret.deprovisioned"
   ],
   "consumes": [
-    "mesh-vault.secret.provisioned",
+    "module.mesh-vault.secret.provisioned",
-    "mesh-vault.secret.rotated",
+    "module.mesh-vault.secret.rotated",
-    "mesh-vault.secret.deprovisioned"
+    "module.mesh-vault.secret.deprovisioned"
   ],
   "receives": {
     "secret": "/var/lib/mesh-vault/grants/mesh.json"

modules/mesh-vault/provisioner/index.ts

@@ -43,6 +43,6 @@ runProvisioner("secret", {
   async remove(p: { as: string }): Promise<void> {
     if (!ledger.withdraw(p.as)) return;
     console.log(`[mesh-vault] withdrawn: ${p.as}`);
-    await announce("secret.deprovisioned", { as: p.as });
+    await announce("module.mesh-vault.secret.deprovisioned", { as: p.as });
   },
 });

modules/minio/module.json

@@ -14,11 +14,11 @@
     "route": {
       "api": {
         "label": "files-api",
-        "endpoint": "s3"
+        "port": 9000
       },
       "console": {
         "label": "files",
-        "endpoint": "console"
+        "port": 9001
       }
     }
   },
@@ -26,19 +26,17 @@
     "container-runtime"
   ],
   "emits": [
-    "bucket.created",
+    "module.minio.bucket.created",
-    "bucket.removed"
+    "module.minio.bucket.removed"
   ],
   "listens": [
     {
-      "name": "s3",
       "port": 9000,
       "protocol": "tcp",
       "from": "mesh",
       "why": "the S3 endpoint"
     },
     {
-      "name": "console",
       "port": 9001,
       "protocol": "tcp",
       "from": "mesh",
@@ -86,7 +84,7 @@
       "type": "file",
       "path": "/var/lib/minio/root.env",
       "mode": "0600",
-      "content": "MINIO_ROOT_USER=meshroot\nMINIO_BROWSER_REDIRECT_URL=https://${bound:route:name-console}\n"
+      "content": "MINIO_ROOT_USER=meshroot\n"
     },
     {
       "id": "data",
@@ -124,6 +122,7 @@
       ],
       "env": {
         "MINIO_ROOT_PASSWORD_FILE": "/run/secrets/root",
+        "MINIO_BROWSER_REDIRECT_URL": "https://files.novox.be",
         "MINIO_REGION": "eu-west"
       }
     },

modules/minio/provisioner/index.ts

@@ -30,7 +30,7 @@ runProvisioner("s3-bucket", {
     try { await minio.removeAccessKey(accessKeyId); } catch { /* none yet — first provision */ }
     await minio.createAccessKey(bucket, accessKeyId, p.password);
 
-    await announce("bucket.created", {
+    await announce("module.minio.bucket.created", {
       bucket,
       consumer: p.consumer ?? "",
       accessKey: accessKeyId,
@@ -51,7 +51,7 @@ runProvisioner("s3-bucket", {
       console.error(`[minio] bucket ${bucket} not removed (likely non-empty), access revoked: ${err}`);
     }
 
-    await announce("bucket.removed", { bucket, accessKey: p.as });
+    await announce("module.minio.bucket.removed", { bucket, accessKey: p.as });
   },
 
   // Asked every minute by the harness: whether the backend still holds this consumer exactly as

modules/model-usage/index.ts

@@ -22,7 +22,7 @@ const store = UsageStore.fromEnv();
 // to reach the provider over the overlay would block the very apply that brings the overlay up.
 await store.migrate();
 
-await on("*.usage.*", async (event) => {
+await on("module.*.usage.*", async (event) => {
   const body = event.body as { rows?: UsageRow[]; raw?: unknown };
   for (const row of body.rows ?? []) {
     try {

modules/model-usage/module.json

@@ -20,7 +20,7 @@
     "postgres-database": "/var/lib/model-usage/database.secret"
   },
   "consumes": [
-    "*.usage.*"
+    "module.*.usage.*"
   ],
   "own-secrets": {
     "broker": "/var/lib/mesh/model-usage/broker"

modules/mongodb/index.ts

@@ -14,11 +14,11 @@ interface DatabaseEvent {
   user?: string;
 }
 
-await on<DatabaseEvent>("database.provisioned", async (e) => {
+await on<DatabaseEvent>("module.mongodb.database.provisioned", async (e) => {
   console.log(`[mongodb] database provisioned for ${e.body.consumer} (db ${e.body.database})`);
 });
 
-await on<DatabaseEvent>("database.deprovisioned", async (e) => {
+await on<DatabaseEvent>("module.mongodb.database.deprovisioned", async (e) => {
   console.log(`[mongodb] database deprovisioned for ${e.body.consumer} (db ${e.body.database})`);
 });
 

modules/mongodb/module.json

@@ -11,16 +11,15 @@
     "container-runtime"
   ],
   "emits": [
-    "database.provisioned",
+    "module.mongodb.database.provisioned",
-    "database.deprovisioned"
+    "module.mongodb.database.deprovisioned"
   ],
   "consumes": [
-    "mongodb.database.provisioned",
+    "module.mongodb.database.provisioned",
-    "mongodb.database.deprovisioned"
+    "module.mongodb.database.deprovisioned"
   ],
   "listens": [
     {
-      "name": "database",
       "port": 27017,
       "protocol": "tcp",
       "from": "mesh",

modules/mongodb/provisioner/index.ts

@@ -34,7 +34,7 @@ runProvisioner("mongodb-database", {
     // Database and owning user share the consumer's login, so the consumer owns exactly its own.
     const database = p.as;
     await mongo.createDatabaseAndUser(database, p.as, p.password);
-    await announce("database.provisioned", {
+    await announce("module.mongodb.database.provisioned", {
       consumer: p.consumer ?? "",
       database,
       user: p.as,
@@ -43,7 +43,7 @@ runProvisioner("mongodb-database", {
 
   async remove(p: { as: string }): Promise<void> {
     await mongo.dropDatabaseAndUser(p.as, p.as);
-    await announce("database.deprovisioned", { database: p.as });
+    await announce("module.mongodb.database.deprovisioned", { database: p.as });
   },
   // Asked every minute by the harness: whether the backend still holds this consumer exactly as
   // the mesh gave it, so a login lost behind the provisioner's back is made again (novox/hq issue 120).