bookshelf: reach nzbget, qbittorrent and jackett through the mesh

bookshelf reached its download clients as nzbget:6789 and qbittorrent:8112 and its indexers
through jackett:9117 or indexers.zurag.be - HAL container names and a public route,
typed into its database by hand. Nothing on the mesh answers those names.

It now requires nzbget-api, qbittorrent-api and jackett-api. A run-once step
(downloads/, declared last, restart-on its bindings, credentials and settings) writes
host, port, TLS, base path, user and credential into bookshelf through bookshelf's own API:

- A download client is the mesh's when its name is downloads.<provision>.name and its
  kind the provider's; it is registered when missing. A jackett feed is the mesh's when
  its host is the bound one, one the step bound before, or one in
  downloads.jackett-api.adopt-hosts; the jackett indexers in
  downloads.jackett-api.indexers are registered when missing. Every other entry is left
  alone, and nothing is ever deleted.
- Only connection fields, only when they differ. The stored password is masked, so the
  app tests the entry with the credential it holds; only if that fails is the delivered
  one written. Categories, priorities and "enabled" are never touched.
- Each credential is tried against its provider first. A minted value (nothing accepted
  yet) is never written; the step exits 1 naming the exact secret accept.

The step is byte-identical in sonarr, radarr, lidarr and bookshelf (the same Servarr
API, v3 or v1): each module builds from its own directory, so each carries a copy, and
test/downloads.test.ts fails if a sibling's copy differs.

Verified: strict typecheck, the Dockerfile build, 14 unit tests; and the compiled step
against fresh pinned sonarr/radarr/lidarr/bookshelf with throwaway nzbget, qBittorrent
and jackett - minted credentials refused with nothing written, accepted ones registered
and tested by the app, a migration-shaped radarr repointed, reruns unchanged.

modules/bookshelf/Dockerfile

@@ -13,7 +13,7 @@ ARG RUNTIME_BASE
 FROM ${BUILD_BASE} AS build
 WORKDIR /app/modules/bookshelf
 COPY . .
-RUN node /app/node_modules/typescript/bin/tsc client.ts index.ts tools/index.ts \
+RUN node /app/node_modules/typescript/bin/tsc client.ts index.ts tools/index.ts downloads/settings.ts downloads/index.ts \
       --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist
 
 FROM ${RUNTIME_BASE}
@@ -22,3 +22,6 @@ COPY --from=build /app/modules/bookshelf/dist /app/modules/bookshelf/dist
 # provider's provisioner runs its reconcile loop in the same process, with the broker connected —
 # the convention novox/hq issues 060/061 settled.
 ENV MESH_TOOL_MODULES=/app/modules/bookshelf/dist/index.js,/app/modules/bookshelf/dist/tools/index.js
+# NOT dist/downloads/index.js: that is a step the host runs to completion, named by the `downloads`
+# container's args as `mesh-tools run …` (novox/hq ADR 0052). Listed here it would run inside the
+# serving sidecar too, and exit it.

modules/bookshelf/downloads/index.ts

@@ -0,0 +1,188 @@
+// The downloads step — run once by the host after the app's server starts, and again whenever a
+// binding, a pair credential or the step's settings change (the container's `restart-on`,
+// novox/hq ADR 0099). Byte-identical in sonarr, radarr, lidarr and bookshelf; see settings.ts.
+//
+// **A step, not a loop**: everything it does is a function of files the mesh writes, and the host
+// already knows when they change. It connects to no broker.
+//
+// Exits non-zero when anything could not be put right — a refused credential, an unreachable
+// provider, an entry the app would not save — so the node reports the step failed and the host
+// runs it again on the next apply. Declared last in the manifest, so its failing gates nothing
+// else of the module's (novox/hq ADR 0136).
+//
+// Reads, in MESH_DOWNLOADS_DIR, `<provision>.json` (the binding), `<provision>.secret` (the pair
+// credential) and the settings file; remembers in MESH_DOWNLOADS_MEMORY the jackett hosts it has
+// pointed feeds at, so a jackett that moves takes its feeds with it. Never prints a credential.
+
+import { mkdir, rename, writeFile } from "node:fs/promises";
+import { dirname, join } from "node:path";
+
+import {
+  CLIENTS,
+  JACKETT,
+  acceptRemedy,
+  appConfig,
+  appReady,
+  listEntries,
+  providerTakes,
+  readIfThere,
+  readJson,
+  reconcileClient,
+  reconcileIndexers,
+  scrub,
+  stepSettings,
+  wanted,
+  type App,
+  type Binding,
+  type Http,
+  type Entry,
+  type Outcome,
+  type Took,
+} from "./settings.js";
+
+const module = process.env.MESH_DOWNLOADS_APP ?? "app";
+const dir = process.env.MESH_DOWNLOADS_DIR ?? "/run/downloads";
+const settingsFile = process.env.MESH_DOWNLOADS_SETTINGS ?? join(dir, "downloads.json");
+const memoryFile = process.env.MESH_DOWNLOADS_MEMORY ?? "/var/lib/downloads/memory.json";
+const waitSeconds = Number(process.env.MESH_DOWNLOADS_WAIT_SECONDS ?? "180");
+const tag = `[${module}-downloads]`;
+
+const http: Http = { fetch: (u, init) => fetch(u, init) };
+const secrets: string[] = [];
+const say = (line: string) => console.log(scrub(`${tag} ${line}`, secrets));
+const fail = (line: string) => console.error(scrub(`${tag} ${line}`, secrets));
+
+const config = appConfig((await readIfThere(process.env.MESH_DOWNLOADS_APP_CONFIG)) ?? "");
+if (!config.apiKey) {
+  fail(`no API key in ${module}'s config.xml yet — ${module} writes it on its first start; the step runs again on the next apply`);
+  process.exit(1);
+}
+secrets.push(config.apiKey);
+const app: App = {
+  module,
+  url: `${(process.env.MESH_DOWNLOADS_APP_URL ?? "http://127.0.0.1").replace(/\/$/, "")}${config.urlBase}`,
+  apiKey: config.apiKey,
+  api: process.env.MESH_DOWNLOADS_API ?? "v3",
+};
+const settings = stepSettings(await readJson(settingsFile));
+
+if (!(await appReady(http, app, waitSeconds * 1000))) {
+  fail(`${module} did not answer at ${app.url} within ${waitSeconds}s`);
+  process.exit(1);
+}
+
+const outcomes: Outcome[] = [];
+
+// The download clients.
+let clients: Entry[];
+try {
+  clients = await listEntries(http, app, "downloadclient");
+} catch (err) {
+  fail(err instanceof Error ? err.message : String(err));
+  process.exit(1);
+}
+for (const kind of CLIENTS) {
+  const credential = await readIfThere(join(dir, `${kind.provision}.secret`));
+  if (credential) secrets.push(credential.trim());
+  const w = wanted(kind.provision, (await readJson(join(dir, `${kind.provision}.json`))) as Binding | undefined, credential, true);
+  // `in`, not `!w.ok`: the Dockerfile compiles without strict, where a boolean discriminant does not
+  // narrow.
+  if ("problem" in w) {
+    outcomes.push({ what: kind.provision, result: "refused", problem: w.problem });
+    continue;
+  }
+  const ep = w.endpoint;
+  try {
+    if (!(await providerTakes(http, kind.provision, ep)).took) {
+      outcomes.push({
+        what: kind.provision,
+        result: "refused",
+        problem: acceptRemedy(app, settings.node, kind.provision, kind.provider, kind.secretName, ep.from),
+      });
+      continue;
+    }
+  } catch (err) {
+    outcomes.push({
+      what: kind.provision,
+      result: "refused",
+      problem: `${kind.provider} could not be asked whether it takes the credential at ${ep.host}:${ep.port}: ${err instanceof Error ? err.message : String(err)}`,
+    });
+    continue;
+  }
+  outcomes.push(...(await reconcileClient(http, app, kind, settings.names[kind.provision], ep, clients)));
+}
+
+// The indexers, through jackett.
+{
+  const credential = await readIfThere(join(dir, `${JACKETT}.secret`));
+  if (credential) secrets.push(credential.trim());
+  const w = wanted(JACKETT, (await readJson(join(dir, `${JACKETT}.json`))) as Binding | undefined, credential, false);
+  if ("problem" in w) {
+    outcomes.push({ what: JACKETT, result: "refused", problem: w.problem });
+  } else {
+    const ep = w.endpoint;
+    let took: Took | undefined;
+    try {
+      took = await providerTakes(http, JACKETT, ep);
+    } catch (err) {
+      outcomes.push({
+        what: JACKETT,
+        result: "refused",
+        problem: `jackett could not be asked whether it takes the key at ${ep.host}:${ep.port}: ${err instanceof Error ? err.message : String(err)}`,
+      });
+    }
+    if (took && !took.took) {
+      outcomes.push({ what: JACKETT, result: "refused", problem: acceptRemedy(app, settings.node, JACKETT, "jackett", "API key", ep.from) });
+    } else if (took) {
+      const memory = ((await readJson(memoryFile)) ?? {}) as Record<string, { hosts?: string[] } | undefined>;
+      const remembered = Array.isArray(memory[JACKETT]?.hosts) ? (memory[JACKETT]?.hosts as string[]) : [];
+      try {
+        const indexers = await listEntries(http, app, "indexer");
+        outcomes.push(
+          ...(await reconcileIndexers(http, app, ep, took.configured ?? new Map(), settings.indexers, remembered, indexers)),
+        );
+      } catch (err) {
+        outcomes.push({ what: JACKETT, result: "refused", problem: err instanceof Error ? err.message : String(err) });
+      }
+      // Remember where the feeds now point, so they are still recognised as the mesh's if jackett
+      // moves. Written whole and renamed, so a crash leaves the old memory, never half of one.
+      const hosts = [...new Set([...remembered, ep.host.toLowerCase()])].sort();
+      if (hosts.join() !== [...remembered].sort().join()) {
+        try {
+          await mkdir(dirname(memoryFile), { recursive: true });
+          await writeFile(`${memoryFile}.tmp`, JSON.stringify({ ...memory, [JACKETT]: { hosts } }, null, 2) + "\n", { mode: 0o600 });
+          await rename(`${memoryFile}.tmp`, memoryFile);
+        } catch (err) {
+          outcomes.push({
+            what: JACKETT,
+            result: "notice",
+            note: `could not remember ${ep.host} as a jackett host (${err instanceof Error ? err.message : String(err)}); if jackett moves, list it in downloads.jackett-api.adopt-hosts`,
+          });
+        }
+      }
+    }
+  }
+}
+
+let failed = 0;
+for (const o of outcomes) {
+  switch (o.result) {
+    case "unchanged":
+      say(`${o.what}: already as the mesh says${o.untested ? "" : "; connection tested"}`);
+      break;
+    case "written":
+      say(`${o.what}: wrote ${o.fields.join(", ")}${o.untested ? "" : "; connection tested"}`);
+      break;
+    case "created":
+      say(`${o.what}: registered; connection tested`);
+      break;
+    case "notice":
+      say(`${o.what}: ${o.note}`);
+      break;
+    case "refused":
+      failed++;
+      fail(`${o.what}: ${o.problem}`);
+      break;
+  }
+}
+process.exitCode = failed > 0 ? 1 : 0;

modules/bookshelf/downloads/settings.ts

@@ -0,0 +1,778 @@
+// Where a Servarr app reaches its download clients and its indexer proxy — decided by the mesh,
+// written into the app by the app's own API.
+//
+// **One file, four copies.** sonarr, radarr, lidarr and bookshelf (a Readarr fork) keep their
+// download clients and indexers behind the same API — `/api/v3/…` for the first two, `/api/v1/…`
+// for the others — so this step is the same code in each. Each module builds from its own
+// directory (novox/hq ADR 0069), so each carries a byte-identical copy under `downloads/`;
+// `test/downloads.test.ts` checks the copies agree wherever the siblings are checked out beside
+// it. Change all four together.
+//
+// **Why this exists.** The app keeps its connection to nzbget, qBittorrent and jackett in its own
+// database, not in a file, so the mesh has nowhere to write `${bound:nzbget-api:at}` for it. The
+// module requires `nzbget-api`, `qbittorrent-api` and `jackett-api`; the mesh delivers, for each,
+// a binding (where the provider is — `at` — and what it serves: `port`, `scheme`, `url-base`, and
+// for a download client the `username`) and a pair credential (nzbget's ControlPassword,
+// qBittorrent's WebUI password, jackett's API key — each the provider's one and only, accepted by
+// the operator per pair; the mesh cannot mint them). This step reads those files and makes the
+// app's entries say the same thing.
+//
+// **Which entries are the mesh's.** Never a guess from what an entry looks like:
+//   - a download client is the mesh's when its name is the one the module's settings give for
+//     that provision (`downloads.<provision>.name`) and its kind is that provider's. On a fresh
+//     machine the step registers it under that name; on a migrated one the assignment names the
+//     entry the migration adopts ("NZBGet" on ace).
+//   - a Torznab indexer is the mesh's when it reads a jackett feed
+//     (`…/api/v2.0/indexers/<id>/results/torznab`) on a host the mesh put there — the bound `at`,
+//     one it bound before (remembered by the step), or one the settings adopt
+//     (`downloads.jackett-api.adopt-hosts`, which is how a migration names the entries that pointed
+//     at the old container). `downloads.jackett-api.indexers` lists the jackett indexers the app
+//     should have; one missing is registered.
+// Everything else — every entry a person made, an nzbget elsewhere, a seedbox's jackett, a Newznab
+// indexer — is left exactly as it is. **Nothing is ever deleted.**
+//
+// **Only the connection, and only when it differs.** Host, port, TLS, base path, user name and
+// the credential. Categories, priorities, "enabled", seed criteria and every other choice made in
+// the app are left alone. The stored credential cannot be read back (the app masks it), so the
+// step asks the app to test the entry with the mesh's host and port and the credential it already
+// holds: passing, the credential is already the provider's one and only; failing, the delivered
+// credential is written.
+//
+// **A credential the provider refuses is never written.** Until the operator accepts the
+// provider's secret for this pair, the mesh delivers a value it minted itself, which no provider
+// will ever accept (novox/hq ADR 0092). Writing it would replace a working password with a dead
+// one. So it is tried against the provider first; refused, nothing of that provision is written
+// and the step fails naming the `secret accept` that fixes it.
+//
+// Pure logic and a small HTTP seam, so it is tested against fake servers (test/downloads.test.ts).
+// Never prints a credential, an API key, or a URL carrying one.
+
+import { readFile } from "node:fs/promises";
+
+/** A download-client provision and the shape of its entry in the app. */
+export interface ClientKind {
+  provision: "nzbget-api" | "qbittorrent-api";
+  /** The app's `implementation` for it. */
+  implementation: "Nzbget" | "QBittorrent";
+  /** The provider, as a person calls it. */
+  provider: string;
+  /** What the pair credential is, in the provider's words. */
+  secretName: string;
+}
+
+export const CLIENTS: readonly ClientKind[] = [
+  { provision: "nzbget-api", implementation: "Nzbget", provider: "nzbget", secretName: "ControlPassword" },
+  { provision: "qbittorrent-api", implementation: "QBittorrent", provider: "qBittorrent", secretName: "WebUI password" },
+];
+
+export const JACKETT = "jackett-api";
+
+/** What the mesh wrote at `binds.<provision>`: the binding document. */
+export interface Binding {
+  provision?: string;
+  from?: string;
+  at?: string;
+  as?: string;
+  serves?: Record<string, unknown>;
+}
+
+/** Where a provider is, as the mesh bound it, and the credential for it. */
+export interface Endpoint {
+  scheme: "http" | "https";
+  host: string;
+  port: number;
+  /** "" at the root, otherwise "/base" — one leading slash, none trailing. */
+  urlBase: string;
+  /** The user a download client logs in as; "" for jackett, which takes a key. */
+  username: string;
+  credential: string;
+  /** The provider's node, for the `secret accept` remedy. */
+  from: string;
+}
+
+export type Wanted = { ok: true; endpoint: Endpoint } | { ok: false; problem: string };
+
+/**
+ * The endpoint the mesh says to use, from a binding and its pair credential.
+ *
+ * Refused rather than guessed when the binding cannot be dialled from the app's own container: a
+ * loopback `at` — what the mesh hands a machine that is not on the private network — is the app's
+ * container itself.
+ */
+export function wanted(
+  provision: string,
+  binding: Binding | undefined,
+  credential: string | undefined,
+  needsUser: boolean,
+): Wanted {
+  if (!binding) {
+    return { ok: false, problem: `no binding for ${provision} was delivered — the mesh writes it before this step runs` };
+  }
+  const host = typeof binding.at === "string" ? binding.at.trim() : "";
+  const serves = binding.serves ?? {};
+  const port = Number(serves.port);
+  if (!host) return { ok: false, problem: `the ${provision} binding names no host (at)` };
+  if (isLoopback(host)) {
+    return {
+      ok: false,
+      problem:
+        `the ${provision} binding says the provider is at ${host}, which from the app's own container is the ` +
+        `app itself. The mesh hands loopback to a machine that is not on the private network; put it on the ` +
+        `private network so the provider has an address the app can dial`,
+    };
+  }
+  if (!Number.isInteger(port) || port <= 0 || port > 65535) {
+    return { ok: false, problem: `the ${provision} binding serves no usable port (${String(serves.port)})` };
+  }
+  const scheme = typeof serves.scheme === "string" && serves.scheme ? serves.scheme : "http";
+  if (scheme !== "http" && scheme !== "https") {
+    return { ok: false, problem: `the ${provision} binding serves scheme ${scheme}, which the app cannot dial` };
+  }
+  const username = typeof serves.username === "string" ? serves.username.trim() : "";
+  if (needsUser && !username) {
+    return { ok: false, problem: `the ${provision} binding serves no username for the app to log in as` };
+  }
+  const key = (credential ?? "").trim();
+  if (!key) return { ok: false, problem: `the ${provision} credential is empty or was not delivered` };
+  return {
+    ok: true,
+    endpoint: {
+      scheme,
+      host,
+      port,
+      urlBase: normBase(serves["url-base"]),
+      username,
+      credential: key,
+      from: typeof binding.from === "string" ? binding.from : "",
+    },
+  };
+}
+
+/** A URL base as "" or "/x/y": slashes trimmed, one put back in front. */
+export function normBase(v: unknown): string {
+  const s = typeof v === "string" ? v.trim().replace(/^\/+|\/+$/g, "") : "";
+  return s === "" ? "" : `/${s}`;
+}
+
+function isLoopback(host: string): boolean {
+  const h = host.toLowerCase();
+  return h === "localhost" || h === "::1" || h === "[::1]" || /^127\./.test(h);
+}
+
+function hostForUrl(host: string): string {
+  return host.includes(":") && !host.startsWith("[") ? `[${host}]` : host;
+}
+
+/** The provider's base URL, as the step dials it and as the app is given it. */
+export function baseUrl(ep: Endpoint): string {
+  return `${ep.scheme}://${hostForUrl(ep.host)}:${ep.port}${ep.urlBase}`;
+}
+
+// ---------------------------------------------------------------------------------------------
+// HTTP
+
+/** The HTTP the step needs, so a test can stand fakes in for the app and the providers. */
+export interface Http {
+  fetch(
+    url: string,
+    init?: { method?: string; headers?: Record<string, string>; body?: string },
+  ): Promise<{ status: number; text(): Promise<string> }>;
+}
+
+/** The app, as the step reaches it from the host. */
+export interface App {
+  /** The module, for messages and the remedy: sonarr, radarr, lidarr, bookshelf. */
+  module: string;
+  /** Its own URL, base path included. */
+  url: string;
+  apiKey: string;
+  /** v3 (sonarr, radarr) or v1 (lidarr, bookshelf). */
+  api: string;
+}
+
+interface Answer {
+  status: number;
+  body: unknown;
+}
+
+async function appCall(http: Http, app: App, method: string, path: string, body?: unknown): Promise<Answer> {
+  const res = await http.fetch(`${app.url.replace(/\/$/, "")}/api/${app.api}${path}`, {
+    method,
+    headers: {
+      "X-Api-Key": app.apiKey,
+      Accept: "application/json",
+      ...(body !== undefined ? { "Content-Type": "application/json" } : {}),
+    },
+    body: body !== undefined ? JSON.stringify(body) : undefined,
+  });
+  const text = await res.text();
+  let parsed: unknown = undefined;
+  if (text) {
+    try {
+      parsed = JSON.parse(text) as unknown;
+    } catch {
+      parsed = text;
+    }
+  }
+  return { status: res.status, body: parsed };
+}
+
+async function appGet(http: Http, app: App, path: string): Promise<unknown> {
+  const a = await appCall(http, app, "GET", path);
+  if (a.status < 200 || a.status >= 300) throw new Error(`${app.module} GET ${path} answered ${a.status}`);
+  return a.body;
+}
+
+/** One of the app's validation failures: the only parts of an answer the step ever prints. */
+interface Failure {
+  property: string;
+  message: string;
+  warning: boolean;
+}
+
+function failuresOf(body: unknown): Failure[] {
+  const list = Array.isArray(body) ? body : [];
+  return list.map((f) => {
+    const o = (f ?? {}) as Record<string, unknown>;
+    return {
+      property: String(o.propertyName ?? ""),
+      message: String(o.errorMessage ?? ""),
+      warning: o.isWarning === true,
+    };
+  });
+}
+
+/**
+ * One shape rather than a union on `ok`: the Dockerfile compiles without strict, where a boolean
+ * discriminant does not narrow.
+ */
+interface Verdict {
+  ok: boolean;
+  /** Warnings the app raised on a pass; errors (and any warnings) on a failure. */
+  failures: Failure[];
+  status: number;
+  saved?: Entry;
+}
+
+function verdict(a: Answer): Verdict {
+  if (a.status >= 200 && a.status < 300) return { ok: true, failures: [], status: a.status };
+  const failures = failuresOf(a.body);
+  if (a.status === 400 && failures.length > 0 && failures.every((f) => f.warning)) return { ok: true, failures, status: a.status };
+  return { ok: false, failures, status: a.status };
+}
+
+/** The app's own test of an entry, from the app's own container. */
+async function appTest(http: Http, app: App, resource: string, entry: Entry): Promise<Verdict> {
+  return verdict(await appCall(http, app, "POST", `/${resource}/test`, entry));
+}
+
+/**
+ * Save an entry. The app tests an enabled entry before saving it; a test that passes with only
+ * warnings ("a category is recommended") is saved with `forceSave`, the same as pressing "save
+ * anyway" in its screen. An error is never forced.
+ */
+async function appSave(http: Http, app: App, resource: string, entry: Entry, create: boolean): Promise<Verdict> {
+  const path = create ? `/${resource}` : `/${resource}/${entry.id}`;
+  const method = create ? "POST" : "PUT";
+  let a = await appCall(http, app, method, path, entry);
+  let v = verdict(a);
+  if (v.ok && (a.status < 200 || a.status >= 300)) {
+    a = await appCall(http, app, method, `${path}?forceSave=true`, entry);
+    v = verdict(a);
+    if (v.ok && (a.status < 200 || a.status >= 300)) {
+      return { ok: false, failures: failuresOf(a.body), status: a.status };
+    }
+  }
+  if (!v.ok) return v;
+  return { ...v, saved: (a.body ?? undefined) as Entry | undefined };
+}
+
+// ---------------------------------------------------------------------------------------------
+// Entries
+
+/** An entry as the app's API gives it: a download client or an indexer. */
+export interface Entry {
+  id?: number;
+  name?: string;
+  implementation?: string;
+  enable?: boolean;
+  enableRss?: boolean;
+  enableAutomaticSearch?: boolean;
+  enableInteractiveSearch?: boolean;
+  supportsRss?: boolean;
+  supportsSearch?: boolean;
+  fields?: { name: string; value?: unknown; [k: string]: unknown }[];
+  [k: string]: unknown;
+}
+
+export function field(e: Entry, name: string): unknown {
+  return e.fields?.find((f) => f.name === name)?.value;
+}
+
+/** The entry with these fields' values replaced — added when the app's shape lacks one. */
+export function withFields(e: Entry, values: Record<string, unknown>): Entry {
+  const fields = (e.fields ?? []).map((f) => (f.name in values ? { ...f, value: values[f.name] } : { ...f }));
+  for (const [name, value] of Object.entries(values)) {
+    if (!fields.some((f) => f.name === name)) fields.push({ name, value });
+  }
+  return { ...e, fields };
+}
+
+function enabled(e: Entry): boolean {
+  return e.enable === true || e.enableRss === true || e.enableAutomaticSearch === true || e.enableInteractiveSearch === true;
+}
+
+/** What one provision, or one entry of it, came to. */
+export type Outcome =
+  | { what: string; result: "unchanged"; untested?: boolean }
+  | { what: string; result: "written"; fields: string[]; untested?: boolean }
+  | { what: string; result: "created"; fields: string[] }
+  | { what: string; result: "notice"; note: string }
+  | { what: string; result: "refused"; problem: string };
+
+function said(fs: Failure[]): string {
+  return fs.length === 0 ? "no reason given" : fs.map((f) => (f.property ? `${f.property}: ${f.message}` : f.message)).join("; ");
+}
+
+/**
+ * Bring one of the mesh's entries in line: `connection` is the non-secret fields as the mesh says
+ * them, `differs` which of them the entry does not already say, `secretField` where the credential
+ * goes. Never throws: every failure is an outcome with a reason.
+ */
+export async function reconcileEntry(
+  http: Http,
+  app: App,
+  resource: "downloadclient" | "indexer",
+  what: string,
+  current: Entry,
+  connection: Record<string, unknown>,
+  differs: string[],
+  secretField: string,
+  credential: string,
+  testable = true,
+): Promise<Outcome> {
+  try {
+    const base = withFields(current, connection); // the credential as the app holds it — masked
+    if (!testable) {
+      // Nothing to test against (jackett no longer has the indexer it names): the connection is
+      // still the mesh's to state, and the key goes with it when the address changes.
+      if (differs.length === 0) return { what, result: "unchanged", untested: true };
+      const s = await appSave(http, app, resource, withFields(base, { [secretField]: credential }), false);
+      if (!s.ok) return { what, result: "refused", problem: `${app.module} would not save it: ${said(s.failures)}` };
+      return { what, result: "written", fields: [...differs, secretField], untested: true };
+    }
+    const first = await appTest(http, app, resource, base);
+    if (first.ok) {
+      // The credential the app holds already works against the provider at the mesh's address —
+      // and the provider has exactly one, so it is the delivered one.
+      if (differs.length === 0) return { what, result: "unchanged" };
+      const s = await appSave(http, app, resource, base, false);
+      if (!s.ok) return { what, result: "refused", problem: `${app.module} would not save it: ${said(s.failures)}` };
+      return { what, result: "written", fields: differs };
+    }
+    // The app's test failed with what it holds. The delivered credential was already checked
+    // against the provider, so writing it is safe; the app tests an enabled entry again on save.
+    const s = await appSave(http, app, resource, withFields(base, { [secretField]: credential }), false);
+    if (!s.ok) {
+      return {
+        what,
+        result: "refused",
+        problem: `${app.module} tested it at the mesh's address and would not save it (nothing was written): ${said(s.failures)}`,
+      };
+    }
+    const stored = (await appGet(http, app, `/${resource}/${current.id}`)) as Entry;
+    const second = await appTest(http, app, resource, stored);
+    const fields = [...differs, secretField];
+    if (second.ok) return { what, result: "written", fields };
+    const why = `written (${fields.join(", ")}), and ${app.module}'s own test still fails: ${said(second.failures)}`;
+    return enabled(stored) ? { what, result: "refused", problem: why } : { what, result: "notice", note: `${why} — it is disabled, so nothing uses it` };
+  } catch (err) {
+    return { what, result: "refused", problem: message(err) };
+  }
+}
+
+/**
+ * Register a new entry from the app's own template for that kind: its defaults, the name, the
+ * connection and the credential. A category the provider does not have (nzbget refuses one it was
+ * not told about) is left empty rather than failing the registration, and said.
+ */
+export async function createEntry(
+  http: Http,
+  app: App,
+  resource: "downloadclient" | "indexer",
+  what: string,
+  implementation: string,
+  name: string,
+  values: Record<string, unknown>,
+): Promise<Outcome> {
+  try {
+    const schema = (await appGet(http, app, `/${resource}/schema`)) as Entry[];
+    const template = (schema ?? []).find((s) => s.implementation === implementation);
+    if (!template) return { what, result: "refused", problem: `${app.module} has no ${implementation} to register` };
+    let entry: Entry = withFields({ ...template, id: undefined, name }, values);
+    if (resource === "downloadclient") entry.enable = true;
+    else {
+      entry.enableRss = template.supportsRss !== false;
+      entry.enableAutomaticSearch = template.supportsSearch !== false;
+      entry.enableInteractiveSearch = template.supportsSearch !== false;
+    }
+    let s = await appSave(http, app, resource, entry, true);
+    let note = "";
+    if (!s.ok && s.failures.length > 0 && s.failures.every((f) => /category/i.test(f.property))) {
+      const emptied: Record<string, unknown> = {};
+      for (const f of entry.fields ?? []) if (/category$/i.test(f.name) && !/imported/i.test(f.name)) emptied[f.name] = "";
+      entry = withFields(entry, emptied);
+      s = await appSave(http, app, resource, entry, true);
+      note = " with its category left empty — the provider has none by the app's default name; set one in both";
+    }
+    if (!s.ok) return { what, result: "refused", problem: `${app.module} would not register it: ${said(s.failures)}` };
+    const created = s.saved;
+    if (created?.id !== undefined) {
+      const t = await appTest(http, app, resource, (await appGet(http, app, `/${resource}/${created.id}`)) as Entry);
+      if (!t.ok) {
+        return { what, result: "refused", problem: `registered as "${name}"${note}, and ${app.module}'s own test fails: ${said(t.failures)}` };
+      }
+    }
+    return note
+      ? { what, result: "notice", note: `registered as "${name}"${note}` }
+      : { what, result: "created", fields: Object.keys(values) };
+  } catch (err) {
+    return { what, result: "refused", problem: message(err) };
+  }
+}
+
+// ---------------------------------------------------------------------------------------------
+// Providers: does it take the credential?
+
+/**
+ * Does the provider take this credential? `took` it does (for jackett, with the ids of the indexers
+ * it has configured); `refused` it said no; a thrown error when it could not be asked.
+ */
+export interface Took {
+  took: boolean;
+  configured?: Map<string, string>;
+}
+
+export async function providerTakes(http: Http, provision: string, ep: Endpoint): Promise<Took> {
+  const base = baseUrl(ep);
+  if (provision === "nzbget-api") {
+    const auth = Buffer.from(`${ep.username}:${ep.credential}`).toString("base64");
+    const res = await http.fetch(`${base}/jsonrpc/version`, { method: "GET", headers: { Authorization: `Basic ${auth}` } });
+    await res.text();
+    if (res.status === 401 || res.status === 403) return { took: false };
+    if (res.status >= 200 && res.status < 300) return { took: true };
+    throw new Error(`nzbget answered ${res.status}`);
+  }
+  if (provision === "qbittorrent-api") {
+    const form = `username=${encodeURIComponent(ep.username)}&password=${encodeURIComponent(ep.credential)}`;
+    const res = await http.fetch(`${base}/api/v2/auth/login`, {
+      method: "POST",
+      headers: { "Content-Type": "application/x-www-form-urlencoded" },
+      body: form,
+    });
+    const text = (await res.text()).trim();
+    if (res.status === 401 || /^fails\.?$/i.test(text)) return { took: false };
+    if (res.status === 403) {
+      throw new Error(
+        "qBittorrent answered 403: it has banned this address after failed logins (WebUI\\BanDuration); it lifts by itself",
+      );
+    }
+    if (res.status >= 200 && res.status < 300) return { took: true };
+    throw new Error(`qBittorrent answered ${res.status}`);
+  }
+  if (provision === JACKETT) {
+    const url = `${base}/api/v2.0/indexers/all/results/torznab/api?t=indexers&configured=true&apikey=${encodeURIComponent(ep.credential)}`;
+    const res = await http.fetch(url, { method: "GET" });
+    const text = await res.text();
+    if (res.status === 401 || res.status === 403) return { took: false };
+    if (res.status < 200 || res.status >= 300) throw new Error(`jackett answered ${res.status}`);
+    // jackett answers a wrong key 200 with an error document: code 100, "Invalid API Key".
+    if (/<error\b[^>]*\bcode="100"/i.test(text)) return { took: false };
+    if (/<error\b/i.test(text)) throw new Error("jackett answered with an error document");
+    return { took: true, configured: configuredIndexers(text) };
+  }
+  throw new Error(`no check for ${provision}`);
+}
+
+/** jackett's configured indexers, id → title, from its `t=indexers` feed. */
+export function configuredIndexers(xml: string): Map<string, string> {
+  const out = new Map<string, string>();
+  const re = /<indexer\b[^>]*\bid="([^"]+)"[^>]*>([\s\S]*?)<\/indexer>/g;
+  for (let m = re.exec(xml); m; m = re.exec(xml)) {
+    const title = /<title>([\s\S]*?)<\/title>/.exec(m[2])?.[1]?.trim() ?? m[1];
+    out.set(m[1], decodeXml(title));
+  }
+  return out;
+}
+
+function decodeXml(s: string): string {
+  return s.replace(/&lt;/g, "<").replace(/&gt;/g, ">").replace(/&quot;/g, '"').replace(/&apos;/g, "'").replace(/&amp;/g, "&");
+}
+
+/** The remedy for a refused credential, in the controller's own words (ADR 0092). */
+export function acceptRemedy(app: App, node: string, provision: string, provider: string, secretName: string, from: string): string {
+  return (
+    `${provider} refuses the ${provision} credential the mesh delivered, so nothing of ${provision} was written ` +
+    `into ${app.module}. ${provider} has one ${secretName} and the mesh cannot make it: accept it for this pair — ` +
+    `\`secret accept ${node || "<this node>"} ${app.module} ${provision} --provider ${from || "<its node>"} ` +
+    `--from <file holding ${provider}'s ${secretName}>\``
+  );
+}
+
+// ---------------------------------------------------------------------------------------------
+// Download clients
+
+/** The non-secret fields of a download client as the mesh says them. */
+export function clientConnection(ep: Endpoint): Record<string, unknown> {
+  return { host: ep.host, port: ep.port, useSsl: ep.scheme === "https", urlBase: ep.urlBase === "" ? null : ep.urlBase, username: ep.username };
+}
+
+/** Which of them the entry does not already say. Names only. */
+export function clientDiffers(e: Entry, ep: Endpoint): string[] {
+  const out: string[] = [];
+  if (String(field(e, "host") ?? "").toLowerCase() !== ep.host.toLowerCase()) out.push("host");
+  if (Number(field(e, "port") ?? 0) !== ep.port) out.push("port");
+  if (Boolean(field(e, "useSsl")) !== (ep.scheme === "https")) out.push("useSsl");
+  if (normBase(field(e, "urlBase")) !== ep.urlBase) out.push("urlBase");
+  if (String(field(e, "username") ?? "") !== ep.username) out.push("username");
+  return out;
+}
+
+/**
+ * Bring the app's download client for one provision in line: the entry by that name and kind is
+ * the mesh's and is updated; none, it is registered. An entry by that name of another kind, or by
+ * that name in another case, is somebody else's and is refused rather than touched.
+ */
+export async function reconcileClient(
+  http: Http,
+  app: App,
+  kind: ClientKind,
+  name: string,
+  ep: Endpoint,
+  entries: Entry[],
+): Promise<Outcome[]> {
+  const what = `${kind.provision} ("${name}")`;
+  const exact = entries.filter((e) => e.name === name);
+  const alike = entries.filter((e) => e.name !== name && String(e.name ?? "").toLowerCase() === name.toLowerCase());
+  if (exact.length > 0 && exact[0].implementation !== kind.implementation) {
+    return [{
+      what,
+      result: "refused",
+      problem: `the download client named "${name}" is a ${exact[0].implementation}, not ${kind.implementation}; it is not the mesh's and was left alone. Name the mesh's entry otherwise in downloads.${kind.provision}.name`,
+    }];
+  }
+  if (exact.length === 0 && alike.length > 0) {
+    return [{
+      what,
+      result: "refused",
+      problem: `${app.module} already has "${alike[0].name}", which is not the mesh's name ("${name}") and was left alone. To have the mesh manage it, set downloads.${kind.provision}.name to "${alike[0].name}"`,
+    }];
+  }
+  const outcomes: Outcome[] = [];
+  const others = entries.filter((e) => e.implementation === kind.implementation && e.name !== name);
+  if (others.length > 0) {
+    outcomes.push({
+      what,
+      result: "notice",
+      note: `also present and not the mesh's, left alone: ${others.map((o) => `"${o.name}"`).join(", ")}`,
+    });
+  }
+  if (exact.length === 0) {
+    outcomes.push(
+      await createEntry(http, app, "downloadclient", what, kind.implementation, name, {
+        ...clientConnection(ep),
+        password: ep.credential,
+      }),
+    );
+    return outcomes;
+  }
+  outcomes.push(
+    await reconcileEntry(http, app, "downloadclient", what, exact[0], clientConnection(ep), clientDiffers(exact[0], ep), "password", ep.credential),
+  );
+  return outcomes;
+}
+
+// ---------------------------------------------------------------------------------------------
+// Indexers
+
+const FEED = /\/api\/v2\.0\/indexers\/([^/]+)\/results\/torznab\/?$/;
+
+/** A Torznab entry reading a jackett feed: the host it points at and the jackett indexer's id. */
+export function jackettFeed(e: Entry): { host: string; id: string } | undefined {
+  if (e.implementation !== "Torznab") return undefined;
+  const raw = String(field(e, "baseUrl") ?? "").trim();
+  if (!raw) return undefined;
+  let u: URL;
+  try {
+    u = new URL(raw);
+  } catch {
+    return undefined;
+  }
+  const path = `${u.pathname.replace(/\/+$/, "")}/${String(field(e, "apiPath") ?? "").replace(/^\/+/, "")}`;
+  const m = FEED.exec(path);
+  if (!m) return undefined;
+  return { host: u.hostname.replace(/^\[|\]$/g, "").toLowerCase(), id: decodeURIComponent(m[1]) };
+}
+
+/** The feed's two fields as the mesh says them. */
+export function feedConnection(ep: Endpoint, id: string): Record<string, unknown> {
+  return { baseUrl: baseUrl(ep), apiPath: `/api/v2.0/indexers/${id}/results/torznab/` };
+}
+
+function sameUrl(a: string, b: string): boolean {
+  try {
+    const x = new URL(a);
+    const y = new URL(b);
+    const port = (u: URL) => u.port || (u.protocol === "https:" ? "443" : "80");
+    return (
+      x.protocol === y.protocol &&
+      x.hostname.toLowerCase() === y.hostname.toLowerCase() &&
+      port(x) === port(y) &&
+      x.pathname.replace(/\/+$/, "") === y.pathname.replace(/\/+$/, "")
+    );
+  } catch {
+    return false;
+  }
+}
+
+export function feedDiffers(e: Entry, ep: Endpoint, id: string): string[] {
+  const want = feedConnection(ep, id);
+  const out: string[] = [];
+  if (!sameUrl(String(field(e, "baseUrl") ?? ""), String(want.baseUrl))) out.push("baseUrl");
+  const path = (v: unknown) => `/${String(v ?? "").replace(/^\/+|\/+$/g, "")}`;
+  if (path(field(e, "apiPath")) !== path(want.apiPath)) out.push("apiPath");
+  return out;
+}
+
+export interface IndexerSettings {
+  /** Hosts whose jackett feeds the mesh takes over — a migration's old names. */
+  adoptHosts: string[];
+  /** jackett indexer ids the app should have. */
+  indexers: string[];
+}
+
+/**
+ * Bring the app's jackett feeds in line: every one the mesh manages is pointed at the bound jackett
+ * with its key, and every listed jackett indexer the app lacks is registered.
+ */
+export async function reconcileIndexers(
+  http: Http,
+  app: App,
+  ep: Endpoint,
+  configured: Map<string, string>,
+  settings: IndexerSettings,
+  remembered: string[],
+  entries: Entry[],
+): Promise<Outcome[]> {
+  const ours = new Set([ep.host, ...settings.adoptHosts, ...remembered].map((h) => h.trim().toLowerCase()).filter(Boolean));
+  const outcomes: Outcome[] = [];
+  const managed = new Set<string>();
+  for (const e of entries) {
+    const feed = jackettFeed(e);
+    if (!feed || !ours.has(feed.host)) continue;
+    managed.add(feed.id);
+    const what = `jackett-api ("${e.name}", jackett indexer ${feed.id})`;
+    const known = feed.id === "all" || configured.has(feed.id);
+    const outcome = await reconcileEntry(
+      http, app, "indexer", what, e, feedConnection(ep, feed.id), feedDiffers(e, ep, feed.id), "apiKey", ep.credential, known,
+    );
+    outcomes.push(outcome);
+    if (!known && outcome.result !== "refused") {
+      outcomes.push({ what, result: "notice", note: `jackett has no indexer "${feed.id}" configured, so it was not tested; configure it in jackett or remove the entry in ${app.module}` });
+    }
+  }
+  for (const id of settings.indexers) {
+    if (managed.has(id)) continue;
+    const what = `jackett-api (jackett indexer ${id})`;
+    if (id !== "all" && !configured.has(id)) {
+      outcomes.push({ what, result: "refused", problem: `downloads.jackett-api.indexers lists "${id}", and jackett has no indexer by that id configured` });
+      continue;
+    }
+    const name = `Jackett - ${id === "all" ? "all" : configured.get(id)}`;
+    outcomes.push(await createEntry(http, app, "indexer", what, "Torznab", name, { ...feedConnection(ep, id), apiKey: ep.credential }));
+  }
+  if (outcomes.length === 0) {
+    outcomes.push({ what: "jackett-api", result: "notice", note: `${app.module} has no jackett feed the mesh manages, and downloads.jackett-api.indexers lists none to register` });
+  }
+  return outcomes;
+}
+
+// ---------------------------------------------------------------------------------------------
+// Files
+
+/** The module's settings for this step, from its merged `downloads.json`. */
+export interface StepSettings {
+  node: string;
+  names: Record<string, string>;
+  indexers: IndexerSettings;
+}
+
+export function stepSettings(raw: unknown): StepSettings {
+  const doc = (raw ?? {}) as Record<string, unknown>;
+  const d = (doc.downloads ?? {}) as Record<string, Record<string, unknown> | undefined>;
+  const names: Record<string, string> = {};
+  for (const k of CLIENTS) {
+    const n = d[k.provision]?.name;
+    names[k.provision] = typeof n === "string" && n.trim() ? n.trim() : k.provision.replace(/-api$/, "");
+  }
+  const j = d[JACKETT] ?? {};
+  const strings = (v: unknown) => (Array.isArray(v) ? v.filter((x): x is string => typeof x === "string" && x.trim() !== "").map((x) => x.trim()) : []);
+  return {
+    node: typeof doc.node === "string" ? doc.node : "",
+    names,
+    indexers: { adoptHosts: strings(j["adopt-hosts"]), indexers: strings(j.indexers) },
+  };
+}
+
+/** The app's own key and base path, from its config.xml. */
+export function appConfig(xml: string): { apiKey: string; urlBase: string } {
+  const tag = (t: string) => new RegExp(`<${t}>([^<]*)</${t}>`).exec(xml)?.[1]?.trim() ?? "";
+  return { apiKey: tag("ApiKey"), urlBase: normBase(tag("UrlBase")) };
+}
+
+/** A file the mesh wrote, or undefined when it is not there. */
+export async function readIfThere(path: string | undefined): Promise<string | undefined> {
+  if (!path) return undefined;
+  return readFile(path, "utf8").catch(() => undefined);
+}
+
+/** A JSON file parsed, or undefined when absent or not JSON. */
+export async function readJson(path: string | undefined): Promise<unknown> {
+  const raw = await readIfThere(path);
+  if (raw === undefined) return undefined;
+  try {
+    return JSON.parse(raw) as unknown;
+  } catch {
+    return undefined;
+  }
+}
+
+/** Wait for the app to answer, because the step runs right after its container starts. */
+export async function appReady(http: Http, app: App, waitMs: number, pauseMs = 2000): Promise<boolean> {
+  const until = Date.now() + waitMs;
+  for (;;) {
+    try {
+      const a = await appCall(http, app, "GET", "/system/status");
+      if (a.status === 200) return true;
+    } catch {
+      // not listening yet
+    }
+    if (Date.now() >= until) return false;
+    await new Promise((r) => setTimeout(r, pauseMs));
+  }
+}
+
+export async function listEntries(http: Http, app: App, resource: "downloadclient" | "indexer"): Promise<Entry[]> {
+  return ((await appGet(http, app, `/${resource}`)) as Entry[]) ?? [];
+}
+
+/** Anything printed goes through this: the credentials the step holds never reach a log. */
+export function scrub(text: string, secrets: string[]): string {
+  let out = text;
+  for (const s of secrets) if (s && s.length >= 4) out = out.split(s).join("<redacted>");
+  return out;
+}
+
+function message(err: unknown): string {
+  return err instanceof Error ? err.message : String(err);
+}

modules/bookshelf/module.json

@@ -39,10 +39,15 @@
       "path": "/var/lib/mesh/bookshelf",
       "mode": "0700"
     },
+    {
+      "id": "state",
+      "type": "directory",
+      "mode": "0700",
+      "place": "."
+    },
     {
       "id": "config",
       "type": "directory",
-      "path": "/services/bookshelf/config",
       "mode": "0700",
       "owner": "1000:1000"
     },
@@ -50,7 +55,7 @@
       "id": "server",
       "type": "container",
       "name": "bookshelf",
-      "image": "ghcr.io/pennydreadful/bookshelf@sha256:388eecc94362580eae31ee0a454be6af516f8a311f8432a521c202fb475f4359",
+      "image": "ghcr.io/pennydreadful/bookshelf@sha256:67498dd5ece516867d72ee642abd6c1a66b36a135c8f7da0127109564372beb1",
       "env": {
         "PUID": "1000",
         "PGID": "1000",
@@ -60,7 +65,7 @@
         "8787"
       ],
       "volumes": [
-        "/services/bookshelf/config:/config",
+        "${dir:config}:/config",
         "/services/media/books:/books",
         "/services/media/downloads:/downloads"
       ]
@@ -72,17 +77,74 @@
       "network": "host",
       "volumes": [
         "/var/lib/mesh/bookshelf/broker:/run/secrets/broker:ro",
-        "/services/bookshelf/config:/var/lib/bookshelf/config:ro"
+        "${dir:config}:/var/lib/bookshelf/config:ro"
       ],
       "env": {
         "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_BOOKSHELF_URL": "http://127.0.0.1:8787",
+        "MESH_BOOKSHELF_URL": "http://127.0.0.1:${port:8787}",
         "MESH_BOOKSHELF_CONFIG_DIR": "/var/lib/bookshelf/config"
       },
       "artifact": "runtime"
+    },
+    {
+      "id": "downloads-config",
+      "type": "file",
+      "path": "${dir:state}/downloads.json",
+      "mode": "0600",
+      "content": "{\n  \"node\": \"${machine:name}\",\n  \"downloads\": {\n    \"nzbget-api\": {\n      \"name\": \"nzbget\"\n    },\n    \"qbittorrent-api\": {\n      \"name\": \"qbittorrent\"\n    },\n    \"jackett-api\": {\n      \"adopt-hosts\": [],\n      \"indexers\": []\n    }\n  }\n}\n",
+      "merge": "json"
+    },
+    {
+      "id": "downloads-memory",
+      "type": "directory",
+      "mode": "0700"
+    },
+    {
+      "id": "downloads",
+      "type": "container",
+      "name": "mesh-bookshelf-downloads",
+      "network": "host",
+      "run-once": true,
+      "volumes": [
+        "${dir:state}/downloads.json:/run/downloads/downloads.json:ro",
+        "${dir:state}/nzbget-api.json:/run/downloads/nzbget-api.json:ro",
+        "${dir:state}/nzbget-api.secret:/run/downloads/nzbget-api.secret:ro",
+        "${dir:state}/qbittorrent-api.json:/run/downloads/qbittorrent-api.json:ro",
+        "${dir:state}/qbittorrent-api.secret:/run/downloads/qbittorrent-api.secret:ro",
+        "${dir:state}/jackett-api.json:/run/downloads/jackett-api.json:ro",
+        "${dir:state}/jackett-api.secret:/run/downloads/jackett-api.secret:ro",
+        "${dir:config}:/var/lib/bookshelf/config:ro",
+        "${dir:downloads-memory}:/var/lib/downloads"
+      ],
+      "env": {
+        "MESH_DOWNLOADS_APP": "bookshelf",
+        "MESH_DOWNLOADS_API": "v1",
+        "MESH_DOWNLOADS_APP_URL": "http://127.0.0.1:${port:8787}",
+        "MESH_DOWNLOADS_APP_CONFIG": "/var/lib/bookshelf/config/config.xml",
+        "MESH_DOWNLOADS_DIR": "/run/downloads",
+        "MESH_DOWNLOADS_SETTINGS": "/run/downloads/downloads.json",
+        "MESH_DOWNLOADS_MEMORY": "/var/lib/downloads/memory.json"
+      },
+      "args": [
+        "run",
+        "/app/modules/bookshelf/dist/downloads/index.js"
+      ],
+      "restart-on": [
+        "downloads-config",
+        "bound-nzbget-api",
+        "secret-nzbget-api",
+        "bound-qbittorrent-api",
+        "secret-qbittorrent-api",
+        "bound-jackett-api",
+        "secret-jackett-api"
+      ],
+      "artifact": "runtime"
     }
   ],
   "requires": [
+    "jackett-api",
+    "nzbget-api",
+    "qbittorrent-api",
     "route"
   ],
   "contributes": {
@@ -92,7 +154,15 @@
     }
   },
   "binds": {
-    "route": "/var/lib/mesh/bookshelf/route.json"
+    "route": "${dir:state}/route.json",
+    "nzbget-api": "${dir:state}/nzbget-api.json",
+    "qbittorrent-api": "${dir:state}/qbittorrent-api.json",
+    "jackett-api": "${dir:state}/jackett-api.json"
+  },
+  "secrets": {
+    "nzbget-api": "${dir:state}/nzbget-api.secret",
+    "qbittorrent-api": "${dir:state}/qbittorrent-api.secret",
+    "jackett-api": "${dir:state}/jackett-api.secret"
   },
   "build": {
     "on": [

modules/bookshelf/package.json

@@ -4,6 +4,11 @@
   "description": "bookshelf — ebook/audiobook management (Readarr fork). Its API client, tools and events live here (novox/hq ADR 0039).",
   "type": "module",
   "private": true,
+  "scripts": {
+    "build": "tsc client.ts index.ts tools/index.ts downloads/settings.ts downloads/index.ts --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist",
+    "typecheck": "tsc -p tsconfig.json",
+    "test": "node --test --experimental-strip-types 'test/*.test.ts'"
+  },
   "dependencies": {
     "@novox/mesh-sdk": "^0.1.0"
   },

modules/bookshelf/test/downloads.test.ts

@@ -0,0 +1,365 @@
+// What holds the downloads step (downloads/settings.ts): the app's download clients and jackett
+// feeds are made to say what the mesh bound — host, port, TLS, base path, user, credential — and
+// nothing else they keep is touched; only the mesh's entries are touched, and nothing is ever
+// deleted; nothing is written when nothing differs; a missing one is registered; and a credential
+// the provider refuses (the mesh's own minted value, before the operator accepts the provider's)
+// is never written, with the `secret accept` that fixes it named.
+//
+// The app and the providers are fakes: the routes the step touches, answering as the real ones do
+// (checked against the catalogue's pinned sonarr, radarr, lidarr, bookshelf, nzbget, qBittorrent
+// and jackett): the app masks a stored password as "********", tests an enabled entry before
+// saving it, refuses a warning unless forceSave, and jackett answers a wrong key 200 with an error.
+
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { existsSync, readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+
+import {
+  CLIENTS,
+  acceptRemedy,
+  jackettFeed,
+  providerTakes,
+  reconcileClient,
+  reconcileIndexers,
+  stepSettings,
+  wanted,
+  type App,
+  type Binding,
+  type Endpoint,
+  type Entry,
+  type Http,
+} from "../downloads/settings.ts";
+
+const NZBGET = CLIENTS.find((c) => c.provision === "nzbget-api")!;
+const QBIT = CLIENTS.find((c) => c.provision === "qbittorrent-api")!;
+const APP: App = { module: "sonarr", url: "http://127.0.0.1:8989", apiKey: "app-key", api: "v3" };
+const MASK = "********";
+
+interface Provider {
+  host: string;
+  port: number;
+  user?: string;
+  secret: string;
+  configured?: Record<string, string>;
+}
+
+const nzbget: Provider = { host: "ace.internal", port: 20201, user: "luffy", secret: "nzb-real" };
+const qbit: Provider = { host: "ace.internal", port: 8112, user: "luffy", secret: "qbt-real" };
+const jackett: Provider = { host: "ace.internal", port: 20204, secret: "jackett-real", configured: { rutracker: "RuTracker", torrent9: "Torrent9" } };
+
+function binding(p: Provider, provision: string, extra: Record<string, unknown> = {}): Binding {
+  return {
+    provision,
+    from: "ace",
+    at: p.host,
+    as: "mesh_ace_sonarr",
+    serves: { scheme: "http", port: p.port, "url-base": "", ...(p.user ? { username: p.user } : {}), ...extra },
+  };
+}
+
+function endpoint(p: Provider, provision: string, credential = p.secret): Endpoint {
+  const w = wanted(provision, binding(p, provision), credential, provision !== "jackett-api");
+  if (!w.ok) throw new Error(w.problem);
+  return w.endpoint;
+}
+
+const f = (name: string, value: unknown) => ({ name, value });
+
+function client(id: number, name: string, implementation: string, host: string, port: number, password: string, extra: Record<string, unknown> = {}): Entry {
+  return {
+    id, name, implementation, enable: true, priority: 1, tags: [],
+    fields: [f("host", host), f("port", port), f("useSsl", false), f("urlBase", null), f("username", "luffy"), f("password", password), f("tvCategory", "Series"), ...Object.entries(extra).map(([k, v]) => f(k, v))],
+  };
+}
+
+function feed(id: number, name: string, baseUrl: string, jid: string, key: string, on = true): Entry {
+  return {
+    id, name, implementation: "Torznab", enableRss: on, enableAutomaticSearch: on, enableInteractiveSearch: on, priority: 25,
+    fields: [f("baseUrl", baseUrl), f("apiPath", `/api/v2.0/indexers/${jid}/results/torznab/`), f("apiKey", key), f("categories", [5000])],
+  };
+}
+
+interface Call {
+  method: string;
+  url: string;
+  body?: unknown;
+}
+
+/** A Servarr app and the three providers behind one fetch. */
+function fakes(start: { clients?: Entry[]; indexers?: Entry[] }) {
+  const calls: Call[] = [];
+  const store: Record<string, Entry[]> = {
+    downloadclient: structuredClone(start.clients ?? []),
+    indexer: structuredClone(start.indexers ?? []),
+  };
+  let next = 100;
+  const secretOf: Record<string, string> = { downloadclient: "password", indexer: "apiKey" };
+  const masked = (e: Entry): Entry => ({ ...e, fields: e.fields!.map((x) => (x.name === "password" || x.name === "apiKey") && x.value ? { ...x, value: MASK } : { ...x }) });
+  const val = (e: Entry, n: string) => e.fields?.find((x) => x.name === n)?.value;
+
+  /** What the app's own test says: dialled from its container, with its stored secret for a mask. */
+  const appTest = (kind: string, e: Entry): { propertyName: string; errorMessage: string; isWarning: boolean }[] => {
+    let secret = val(e, secretOf[kind]);
+    if (secret === MASK) secret = val(store[kind].find((s) => s.id === e.id) ?? {}, secretOf[kind]);
+    if (kind === "downloadclient") {
+      const p = e.implementation === "Nzbget" ? nzbget : qbit;
+      if (val(e, "host") !== p.host || val(e, "port") !== p.port) return [{ propertyName: "Host", errorMessage: "Unable to connect", isWarning: false }];
+      if (secret !== p.secret || val(e, "username") !== p.user) return [{ propertyName: "Username", errorMessage: "Authentication Failure", isWarning: false }];
+      if (val(e, "tvCategory") === "") return [{ propertyName: "TvCategory", errorMessage: "A category is recommended", isWarning: true }];
+      if (e.implementation === "Nzbget" && val(e, "tvCategory") === "tv") return [{ propertyName: "TvCategory", errorMessage: "Category does not exist", isWarning: false }];
+      return [];
+    }
+    const u = new URL(String(val(e, "baseUrl")));
+    if (u.hostname !== jackett.host || Number(u.port) !== jackett.port) return [{ propertyName: "BaseUrl", errorMessage: "Unable to connect", isWarning: false }];
+    if (secret !== jackett.secret) return [{ propertyName: "ApiKey", errorMessage: "Invalid API Key", isWarning: false }];
+    const id = /indexers\/([^/]+)\//.exec(String(val(e, "apiPath")))?.[1] ?? "";
+    if (!(id in jackett.configured!)) return [{ propertyName: "", errorMessage: "Unknown indexer", isWarning: false }];
+    return [];
+  };
+
+  const http: Http = {
+    async fetch(url, init) {
+      const method = init?.method ?? "GET";
+      const body = init?.body && init.headers?.["Content-Type"] === "application/json" ? (JSON.parse(init.body) as Entry) : init?.body;
+      calls.push({ method, url, body });
+      const reply = (status: number, value?: unknown) => ({ status, text: async () => (value === undefined ? "" : typeof value === "string" ? value : JSON.stringify(value)) });
+      const u = new URL(url);
+      // Providers.
+      if (u.pathname === "/jsonrpc/version") {
+        const want = "Basic " + Buffer.from(`${nzbget.user}:${nzbget.secret}`).toString("base64");
+        return init?.headers?.Authorization === want ? reply(200, { result: "26.0" }) : reply(401);
+      }
+      if (u.pathname === "/api/v2/auth/login") {
+        const form = new URLSearchParams(String(init?.body ?? ""));
+        return form.get("username") === qbit.user && form.get("password") === qbit.secret ? reply(204) : reply(401, "Unauthorized");
+      }
+      if (u.pathname.endsWith("/torznab/api")) {
+        if (u.searchParams.get("apikey") !== jackett.secret) return reply(200, '<?xml version="1.0"?><error code="100" description="Invalid API Key" />');
+        const items = Object.entries(jackett.configured!).map(([id, t]) => `<indexer id="${id}" configured="true"><title>${t}</title></indexer>`).join("");
+        return reply(200, `<?xml version="1.0"?><indexers>${items}</indexers>`);
+      }
+      // The app.
+      if (init?.headers?.["X-Api-Key"] !== APP.apiKey) return reply(401);
+      const m = /^\/api\/v3\/(downloadclient|indexer)(?:\/(schema|test|\d+))?$/.exec(u.pathname);
+      if (!m) return reply(404);
+      const [, kind, sub] = m;
+      const force = u.searchParams.get("forceSave") === "true";
+      if (method === "GET" && !sub) return reply(200, store[kind].map(masked));
+      if (method === "GET" && sub === "schema") {
+        return reply(200, kind === "downloadclient"
+          ? [client(0, "", "Nzbget", "localhost", 6789, MASK, {}), client(0, "", "QBittorrent", "localhost", 8080, "", {})].map((e) => ({ ...e, fields: e.fields!.map((x) => x.name === "tvCategory" ? { ...x, value: e.implementation === "Nzbget" ? "tv" : "tv-sonarr" } : x.name === "username" ? { ...x, value: null } : x) }))
+          : [{ ...feed(0, "", "", "x", "", false), supportsRss: true, supportsSearch: true, fields: [f("baseUrl", null), f("apiPath", "/api"), f("apiKey", null), f("categories", [5030, 5040])] }]);
+      }
+      if (method === "GET") {
+        const e = store[kind].find((s) => s.id === Number(sub));
+        return e ? reply(200, masked(e)) : reply(404);
+      }
+      if (method === "POST" && sub === "test") {
+        const fails = appTest(kind, body as Entry);
+        return fails.length ? reply(400, fails) : reply(200);
+      }
+      // Save: tested when enabled; a mask keeps what is stored.
+      const e = body as Entry;
+      const on = e.enable === true || e.enableRss === true || e.enableAutomaticSearch === true;
+      if (on) {
+        const fails = appTest(kind, e);
+        if (fails.some((x) => !x.isWarning) || (fails.length && !force)) return reply(400, fails);
+      }
+      if (method === "POST" && !sub) {
+        if (store[kind].some((s) => String(s.name).toLowerCase() === String(e.name).toLowerCase())) {
+          return reply(400, [{ propertyName: "Name", errorMessage: "Should be unique", isWarning: false }]);
+        }
+        const created = { ...e, id: next++ };
+        store[kind].push(created);
+        return reply(201, masked(created));
+      }
+      if (method === "PUT") {
+        const i = store[kind].findIndex((s) => s.id === Number(sub));
+        if (i < 0) return reply(404);
+        const was = store[kind][i];
+        store[kind][i] = { ...e, fields: e.fields!.map((x) => x.value === MASK ? { ...x, value: val(was, x.name) } : x) };
+        return reply(202, masked(store[kind][i]));
+      }
+      return reply(405);
+    },
+  };
+  const saves = () => calls.filter((c) => (c.method === "PUT" || (c.method === "POST" && !c.url.endsWith("/test"))) && c.url.includes("/api/v3/"));
+  return { http, calls, store, saves };
+}
+
+const aceClients = () => [
+  client(1, "NZBGet", "Nzbget", "nzbget", 6789, "nzb-real"),
+  client(2, "qBitTorrent", "QBittorrent", "qbittorrent", 8112, "qbt-real"),
+];
+
+test("the migration's download client is repointed, its category and everything else kept", async () => {
+  const f = fakes({ clients: aceClients() });
+  const out = await reconcileClient(f.http, APP, NZBGET, "NZBGet", endpoint(nzbget, "nzbget-api"), f.store.downloadclient.map((e) => ({ ...e })));
+  assert.deepEqual(out, [{ what: 'nzbget-api ("NZBGet")', result: "written", fields: ["host", "port"] }]);
+  const saved = f.store.downloadclient.find((e) => e.id === 1)!;
+  const v = (n: string) => saved.fields!.find((x) => x.name === n)?.value;
+  assert.equal(v("host"), "ace.internal");
+  assert.equal(v("port"), 20201);
+  assert.equal(v("tvCategory"), "Series");
+  assert.equal(v("password"), "nzb-real", "the password it held works, so it was kept, not rewritten");
+  assert.equal(saved.priority, 1);
+});
+
+test("rerun: already as the mesh says, nothing saved", async () => {
+  const f = fakes({ clients: [client(1, "NZBGet", "Nzbget", "ace.internal", 20201, "nzb-real")] });
+  const out = await reconcileClient(f.http, APP, NZBGET, "NZBGet", endpoint(nzbget, "nzbget-api"), f.store.downloadclient);
+  assert.deepEqual(out, [{ what: 'nzbget-api ("NZBGet")', result: "unchanged" }]);
+  assert.equal(f.saves().length, 0);
+});
+
+test("a stale password is replaced by the delivered one, which the provider took first", async () => {
+  const f = fakes({ clients: [client(2, "qBitTorrent", "QBittorrent", "ace.internal", 8112, "old-pass")] });
+  const out = await reconcileClient(f.http, APP, QBIT, "qBitTorrent", endpoint(qbit, "qbittorrent-api"), f.store.downloadclient);
+  assert.deepEqual(out, [{ what: 'qbittorrent-api ("qBitTorrent")', result: "written", fields: ["password"] }]);
+  assert.equal(f.store.downloadclient[0].fields!.find((x) => x.name === "password")?.value, "qbt-real");
+});
+
+test("a minted credential is refused by the provider: nothing written, the accept named", async () => {
+  const f = fakes({ clients: aceClients() });
+  const ep = endpoint(nzbget, "nzbget-api", "a-value-the-mesh-minted");
+  assert.deepEqual(await providerTakes(f.http, "nzbget-api", ep), { took: false });
+  const remedy = acceptRemedy(APP, "ace", "nzbget-api", "nzbget", "ControlPassword", ep.from);
+  assert.match(remedy, /`secret accept ace sonarr nzbget-api --provider ace --from <file holding nzbget's ControlPassword>`/);
+  assert.doesNotMatch(remedy, /minted/);
+  assert.equal(f.calls.some((c) => c.url.includes("/api/v3/")), false, "the app was not even asked");
+  const q = endpoint(qbit, "qbittorrent-api", "minted");
+  assert.deepEqual(await providerTakes(f.http, "qbittorrent-api", q), { took: false });
+  const j = endpoint(jackett, "jackett-api", "minted");
+  assert.deepEqual(await providerTakes(f.http, "jackett-api", j), { took: false });
+  assert.equal(f.calls.find((c) => c.url.includes("apikey="))?.url.includes("jackett-real"), false);
+});
+
+test("a fresh app gets the mesh's client registered, under the mesh's name", async () => {
+  const f = fakes({});
+  const out = await reconcileClient(f.http, APP, QBIT, "qbittorrent", endpoint(qbit, "qbittorrent-api"), []);
+  assert.equal(out[0].result, "created");
+  const e = f.store.downloadclient[0];
+  assert.equal(e.name, "qbittorrent");
+  assert.equal(e.enable, true);
+  assert.equal(e.fields!.find((x) => x.name === "tvCategory")?.value, "tv-sonarr", "the app's own default category");
+});
+
+test("nzbget without the app's default category: registered with none, and said", async () => {
+  const f = fakes({});
+  const out = await reconcileClient(f.http, APP, NZBGET, "nzbget", endpoint(nzbget, "nzbget-api"), []);
+  assert.equal(out[0].result, "notice");
+  assert.match((out[0] as { note: string }).note, /category left empty/);
+  assert.equal(f.store.downloadclient[0].fields!.find((x) => x.name === "tvCategory")?.value, "");
+});
+
+test("somebody else's entries are never touched: another name of the same kind, and a clash of names", async () => {
+  const mine = client(7, "My seedbox", "QBittorrent", "seedbox.example", 443, "theirs");
+  const f = fakes({ clients: [mine] });
+  const out = await reconcileClient(f.http, APP, QBIT, "qbittorrent", endpoint(qbit, "qbittorrent-api"), f.store.downloadclient);
+  assert.equal(out[0].result, "notice");
+  assert.deepEqual(f.store.downloadclient.find((e) => e.id === 7), mine);
+  // Same name in another case: refused, and the setting that adopts it named.
+  const g = fakes({ clients: aceClients() });
+  const clash = await reconcileClient(g.http, APP, NZBGET, "nzbget", endpoint(nzbget, "nzbget-api"), g.store.downloadclient);
+  assert.equal(clash[0].result, "refused");
+  assert.match((clash[0] as { problem: string }).problem, /downloads\.nzbget-api\.name to "NZBGet"/);
+  assert.equal(g.saves().length, 0);
+});
+
+test("jackett feeds: the migration's are repointed, a person's is left, a listed one is registered", async () => {
+  const personal = feed(9, "Seedbox jackett", "https://jackett.seedbox.example", "rutracker", "their-key");
+  const f = fakes({
+    indexers: [
+      feed(5, "Torznab - RuTracker", "https://indexers.zurag.be", "rutracker-ru", "jackett-real", false),
+      feed(6, "Torznab - Torrent9", "https://indexers.zurag.be", "torrent9", "jackett-real", false),
+      feed(4, "Jackett - RARBG", "http://jackett:9117", "therarbg", "old", false),
+      personal,
+    ],
+  });
+  const configured = new Map(Object.entries(jackett.configured!));
+  const out = await reconcileIndexers(
+    f.http, APP, endpoint(jackett, "jackett-api"), configured,
+    { adoptHosts: ["indexers.zurag.be", "jackett"], indexers: ["rutracker"] }, [], f.store.indexer,
+  );
+  const byWhat = Object.fromEntries(out.map((o) => [o.what + ":" + o.result, o]));
+  // torrent9: jackett has it; repointed, key already right, tested.
+  assert.ok(byWhat['jackett-api ("Torznab - Torrent9", jackett indexer torrent9):written']);
+  // rutracker-ru and therarbg: jackett has neither — repointed with the key, untested, and said.
+  assert.ok(byWhat['jackett-api ("Jackett - RARBG", jackett indexer therarbg):written']);
+  assert.ok(byWhat['jackett-api ("Jackett - RARBG", jackett indexer therarbg):notice']);
+  // rutracker is listed and nothing of the mesh's reads it: registered.
+  assert.ok(byWhat["jackett-api (jackett indexer rutracker):created"]);
+  assert.deepEqual(f.store.indexer.find((e) => e.id === 9), personal, "a person's jackett is not the mesh's");
+  const t9 = f.store.indexer.find((e) => e.id === 6)!;
+  assert.equal(t9.fields!.find((x) => x.name === "baseUrl")?.value, "http://ace.internal:20204");
+  assert.equal(t9.enableRss, false, "disabled stays disabled");
+  const created = f.store.indexer.find((e) => e.name === "Jackett - RuTracker")!;
+  assert.equal(created.enableRss, true);
+  assert.equal(f.calls.some((c) => c.method === "DELETE"), false, "nothing is ever deleted");
+});
+
+test("jackett feeds rerun: nothing saved, and a remembered host keeps a moved jackett's feeds", async () => {
+  const f = fakes({ indexers: [feed(6, "Torznab - Torrent9", "http://ace.internal:20204", "torrent9", "jackett-real")] });
+  const configured = new Map(Object.entries(jackett.configured!));
+  const out = await reconcileIndexers(f.http, APP, endpoint(jackett, "jackett-api"), configured, { adoptHosts: [], indexers: ["torrent9"] }, [], f.store.indexer);
+  assert.deepEqual(out.map((o) => o.result), ["unchanged"]);
+  assert.equal(f.saves().length, 0);
+  // jackett moved to novox: the feed on ace.internal is still the mesh's because it was remembered.
+  const moved = { ...jackett, host: "novox.internal" };
+  const g = fakes({ indexers: [feed(6, "Torznab - Torrent9", "http://ace.internal:20204", "torrent9", "jackett-real")] });
+  const saved = jackett.host;
+  jackett.host = moved.host;
+  try {
+    const again = await reconcileIndexers(g.http, APP, endpoint(moved, "jackett-api"), configured, { adoptHosts: [], indexers: [] }, ["ace.internal"], g.store.indexer);
+    assert.equal(again[0].result, "written");
+    assert.equal(g.store.indexer[0].fields!.find((x) => x.name === "baseUrl")?.value, "http://novox.internal:20204");
+  } finally {
+    jackett.host = saved;
+  }
+});
+
+test("an enabled entry the app cannot test at the mesh's address is not saved", async () => {
+  const f = fakes({ clients: [client(1, "NZBGet", "Nzbget", "nzbget", 6789, "nzb-real")] });
+  const elsewhere = { ...nzbget, port: 1 };
+  const out = await reconcileClient(f.http, APP, NZBGET, "NZBGet", endpoint(elsewhere, "nzbget-api"), f.store.downloadclient);
+  assert.equal(out[0].result, "refused");
+  assert.equal(f.store.downloadclient[0].fields!.find((x) => x.name === "host")?.value, "nzbget", "left as it was");
+});
+
+test("bindings: loopback, no user, no credential are refused; the base path is normalised", () => {
+  assert.equal(wanted("nzbget-api", { ...binding(nzbget, "nzbget-api"), at: "127.0.0.1" }, "x", true).ok, false);
+  assert.equal(wanted("nzbget-api", binding({ ...nzbget, user: undefined }, "nzbget-api"), "x", true).ok, false);
+  assert.equal(wanted("nzbget-api", binding(nzbget, "nzbget-api"), "  \n", true).ok, false);
+  const w = wanted("jackett-api", binding(jackett, "jackett-api", { "url-base": "jackett/" }), "k", false);
+  assert.equal(w.ok && w.endpoint.urlBase, "/jackett");
+});
+
+test("a feed is read whole: base path in the base URL or in the API path", () => {
+  const e = feed(1, "x", "http://ace.internal:9117/jackett", "rutracker", "k");
+  assert.deepEqual(jackettFeed(e), { host: "ace.internal", id: "rutracker" });
+  assert.equal(jackettFeed({ ...e, implementation: "Newznab" }), undefined);
+  assert.equal(jackettFeed({ ...e, fields: [f("baseUrl", "https://api.nzbgeek.info"), f("apiPath", "/api")] }), undefined);
+});
+
+test("settings: names default to the provider's, adoption and registration read from the merged file", () => {
+  assert.deepEqual(stepSettings({ node: "ace" }), { node: "ace", names: { "nzbget-api": "nzbget", "qbittorrent-api": "qbittorrent" }, indexers: { adoptHosts: [], indexers: [] } });
+  const s = stepSettings({ node: "ace", downloads: { "nzbget-api": { name: "NZBGet" }, "jackett-api": { "adopt-hosts": ["jackett"], indexers: ["torrent9", 3] } } });
+  assert.equal(s.names["nzbget-api"], "NZBGet");
+  assert.deepEqual(s.indexers, { adoptHosts: ["jackett"], indexers: ["torrent9"] });
+});
+
+// The four copies are one step. Where the siblings are checked out beside this module, they must
+// be byte-identical — a fix made in one and not the others is a bug in three apps.
+test("the step is the same in sonarr, radarr, lidarr and bookshelf", () => {
+  const here = dirname(dirname(fileURLToPath(import.meta.url)));
+  const modules = dirname(here);
+  for (const file of ["downloads/settings.ts", "downloads/index.ts", "test/downloads.test.ts"]) {
+    const mine = readFileSync(join(here, file), "utf8");
+    for (const sibling of ["sonarr", "radarr", "lidarr", "bookshelf"]) {
+      const theirs = join(modules, sibling, file);
+      if (existsSync(theirs)) assert.equal(readFileSync(theirs, "utf8"), mine, `${sibling}/${file} differs`);
+    }
+  }
+});

modules/bookshelf/tsconfig.json

@@ -8,5 +8,5 @@
     "skipLibCheck": true,
     "noEmit": true
   },
-  "include": ["client.ts", "index.ts", "tools/index.ts"]
+  "include": ["client.ts", "index.ts", "tools/index.ts", "downloads/settings.ts", "downloads/index.ts"]
 }

modules/nodered/Dockerfile

@@ -13,7 +13,7 @@ ARG RUNTIME_BASE
 FROM ${BUILD_BASE} AS build
 WORKDIR /app/modules/nodered
 COPY . .
-RUN node /app/node_modules/typescript/bin/tsc client.ts tools/index.ts mqtt/probe.ts mqtt/connection.ts mqtt/index.ts \
+RUN node /app/node_modules/typescript/bin/tsc client.ts tools/index.ts \
       --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist
 
 FROM ${RUNTIME_BASE}
@@ -22,6 +22,3 @@ COPY --from=build /app/modules/nodered/dist /app/modules/nodered/dist
 # provider's provisioner runs its reconcile loop in the same process, with the broker connected —
 # the convention novox/hq issues 060/061 settled.
 ENV MESH_TOOL_MODULES=/app/modules/nodered/dist/tools/index.js
-# NOT dist/mqtt/index.js: that is a step the host runs to completion, named by the `mqtt`
-# container's args as `mesh-tools run …` (novox/hq ADR 0052). Listed here it would run inside the
-# serving sidecar too, and exit it.

modules/nodered/client.ts

@@ -3,8 +3,7 @@
 //
 // Node-RED exposes a runtime admin API under its base URL: GET/POST /flows for the whole flow
 // configuration, GET /nodes for installed node modules. A default install has no auth; when
-// adminAuth is on, a bearer token is required — the module's settings accept the mesh-minted
-// api-token, which the runtime config file carries as `token`.
+// adminAuth is on, a bearer token (minted at /auth/token) is required.
 
 import { readFileSync } from "node:fs";
 
@@ -82,35 +81,6 @@ export class NodeRedClient {
     return modules.map((m) => ({ name: m.name, version: m.version, types: m.types ?? [] }));
   }
 
-  /** The whole flow configuration with its revision (API v2), for a deploy that must not clobber
-   *  a change made meanwhile. */
-  async flowsWithRev(): Promise<{ rev: string; flows: any[] }> {
-    const body = await this.req("/flows", { headers: this.headers({ "Node-RED-API-Version": "v2" }) });
-    return { rev: String(body?.rev ?? ""), flows: Array.isArray(body?.flows) ? body.flows : [] };
-  }
-
-  /** A node's stored credentials as Node-RED shows them: plain fields, and `has_<field>` for secret ones. */
-  async credentials(type: string, id: string): Promise<{ user?: string; has_password?: boolean }> {
-    return (await this.req(`/credentials/${encodeURIComponent(type)}/${encodeURIComponent(id)}`, { headers: this.headers() })) ?? {};
-  }
-
-  /**
-   * Deploy the flow configuration read at `rev`. Node-RED answers 409 when the flows changed since,
-   * rather than overwriting what someone deployed in between. A node carrying `credentials` has them
-   * stored (encrypted) and counts as changed, so a "nodes" deploy restarts it and nothing else.
-   */
-  async deployFlowsAt(rev: string, config: any[], type = "nodes"): Promise<void> {
-    await this.req("/flows", {
-      method: "POST",
-      headers: this.headers({
-        "Content-Type": "application/json",
-        "Node-RED-API-Version": "v2",
-        "Node-RED-Deployment-Type": type,
-      }),
-      body: JSON.stringify({ rev, flows: config }),
-    });
-  }
-
   /**
    * Replace the whole flow configuration and deploy. Returns the new revision. `type` maps to
    * Node-RED's deployment types — "full" (default), "nodes", or "flows".
@@ -118,13 +88,8 @@ export class NodeRedClient {
   async deployFlows(config: any[], type = "full"): Promise<{ rev?: string; nodeCount: number }> {
     const body = await this.req("/flows", {
       method: "POST",
-      // v2 answers { rev }; v1 answers 204 with no body, which req() cannot parse.
-      headers: this.headers({
-        "Content-Type": "application/json",
-        "Node-RED-API-Version": "v2",
-        "Node-RED-Deployment-Type": type,
-      }),
-      body: JSON.stringify({ flows: config }),
+      headers: this.headers({ "Content-Type": "application/json", "Node-RED-Deployment-Type": type }),
+      body: JSON.stringify(config),
     });
     return { rev: body?.rev, nodeCount: config.length };
   }

modules/nodered/module.json

@@ -5,8 +5,6 @@
     "flows.deployed"
   ],
   "own-secrets": {
-    "admin": "/var/lib/mesh/nodered/admin",
-    "api-token": "/var/lib/mesh/nodered/api-token",
     "broker": "/var/lib/mesh/nodered/broker"
   },
   "capabilities": [
@@ -28,63 +26,26 @@
       "path": "/var/lib/mesh/nodered",
       "mode": "0700"
     },
-    {
-      "id": "state",
-      "type": "directory",
-      "mode": "0700",
-      "place": "."
-    },
     {
       "id": "data",
       "type": "directory",
+      "path": "/services/nodered/data",
       "mode": "0700",
       "owner": "1000:1000"
     },
-    {
-      "id": "written",
-      "type": "directory",
-      "mode": "0700"
-    },
-    {
-      "id": "settings-code",
-      "type": "file",
-      "path": "${dir:state}/settings.js",
-      "mode": "0600",
-      "owner": "1000:1000",
-      "content": "// Node-RED's settings, written by the mesh from the nodered module. What an assignment may change\n// is settings.json beside this file (merged key by key); the credentials are the mesh's secrets and\n// reach Node-RED only through this file. The flows' own credentials stay encrypted in the user\n// directory under the key Node-RED keeps there (.config.runtime.json), which is data, not this.\nconst fs = require(\"fs\");\nconst path = require(\"path\");\nconst crypto = require(\"crypto\");\n\nconst ADMIN_PASSWORD = \"${secret:admin}\";\nconst API_TOKEN = \"${secret:api-token}\";\nconst ADMIN = { username: \"admin\", permissions: \"*\" };\n\nconst settings = JSON.parse(fs.readFileSync(path.join(__dirname, \"settings.json\"), \"utf8\"));\n// The mesh's keys, not Node-RED's: endpoints lands in every merged file; timeZone is the\n// assignment's way to set the zone flows schedule and format in; mqtt names the broker nodes the\n// module's MQTT step keeps pointed at the mesh's broker; topics is what nodered asks the broker for.\nif (settings.timeZone) process.env.TZ = settings.timeZone;\ndelete settings.timeZone;\ndelete settings.endpoints;\ndelete settings.mqtt;\ndelete settings.topics;\n\nfunction same(a, b) {\n  const x = crypto.createHash(\"sha256\").update(String(a)).digest();\n  const y = crypto.createHash(\"sha256\").update(String(b)).digest();\n  return crypto.timingSafeEqual(x, y);\n}\n\n// The admin secret is a password, or, accepted from an existing install, the bcrypt hash its\n// settings held, so the password people already use keeps working.\nfunction passwordMatches(given) {\n  if (/^\\$2[aby]\\$\\d\\d\\$/.test(ADMIN_PASSWORD)) return require(\"bcryptjs\").compare(String(given), ADMIN_PASSWORD);\n  return Promise.resolve(same(given, ADMIN_PASSWORD));\n}\n\nmodule.exports = Object.assign(settings, {\n  uiPort: 1880,\n  adminAuth: {\n    type: \"credentials\",\n    users: (username) => Promise.resolve(username === ADMIN.username ? ADMIN : null),\n    authenticate: (username, password) =>\n      username === ADMIN.username\n        ? passwordMatches(password).then((ok) => (ok ? ADMIN : null))\n        : Promise.resolve(null),\n    // The module's own tools call the admin API with this bearer token.\n    tokens: (token) => Promise.resolve(same(token, API_TOKEN) ? { username: \"mesh\", permissions: \"*\" } : null),\n  },\n});\n"
-    },
-    {
-      "id": "settings",
-      "type": "file",
-      "path": "${dir:state}/settings.json",
-      "mode": "0600",
-      "owner": "1000:1000",
-      "merge": "json",
-      "content": "{\n  \"flowFile\": \"flows.json\",\n  \"flowFilePretty\": true,\n  \"diagnostics\": { \"enabled\": true, \"ui\": true },\n  \"runtimeState\": { \"enabled\": false, \"ui\": false },\n  \"logging\": { \"console\": { \"level\": \"info\", \"metrics\": false, \"audit\": false } },\n  \"exportGlobalContextKeys\": false,\n  \"externalModules\": {},\n  \"editorTheme\": { \"projects\": { \"enabled\": false } },\n  \"functionExternalModules\": true,\n  \"debugMaxLength\": 1000,\n  \"mqttReconnectTime\": 15000,\n  \"serialReconnectTime\": 15000\n}\n"
-    },
     {
       "id": "server",
       "type": "container",
       "name": "nodered",
-      "image": "nodered/node-red@sha256:a649dd711d55490151a2c39a8e48ad0c44325488fbc0e66315f2d2e19e5e1ace",
+      "image": "nodered/node-red@sha256:02a2b92a41b73d2bc388238b86e4fcaab7fb5466373adb24e1df6aa5845265ff",
       "env": {
         "TZ": "Etc/UTC"
       },
       "ports": [
         "1880"
       ],
-      "args": [
-        "--settings",
-        "/config/settings.js"
-      ],
       "volumes": [
-        "${dir:data}:/data",
-        "${dir:state}/settings.js:/config/settings.js:ro",
-        "${dir:state}/settings.json:/config/settings.json:ro"
-      ],
-      "restart-on": [
-        "settings-code",
-        "settings"
+        "/services/nodered/data:/data"
       ]
     },
     {
@@ -92,7 +53,8 @@
       "type": "file",
       "path": "/var/lib/mesh/nodered/config.json",
       "mode": "0600",
-      "content": "{\n  \"token\": \"${secret:api-token}\"\n}\n"
+      "content": "{}\n",
+      "merge": "json"
     },
     {
       "id": "runtime",
@@ -105,66 +67,26 @@
       ],
       "env": {
         "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_NODERED_URL": "http://127.0.0.1:${port:1880}",
+        "MESH_NODERED_URL": "http://127.0.0.1:1880",
         "MESH_NODERED_CONFIG_FILE": "/run/config/config.json"
       },
       "restart-on": [
         "runtime-config"
       ],
       "artifact": "runtime"
-    },
-    {
-      "id": "mqtt",
-      "type": "container",
-      "name": "mesh-nodered-mqtt",
-      "network": "host",
-      "run-once": true,
-      "volumes": [
-        "/var/lib/mesh/nodered/config.json:/run/config/config.json:ro",
-        "${dir:written}:/var/lib/nodered-provisions",
-        "${dir:state}/mqtt-topic.json:/run/provisions/mqtt-topic.json:ro",
-        "${dir:state}/mqtt-topic.secret:/run/provisions/mqtt-topic.secret:ro",
-        "${dir:state}/settings.json:/run/provisions/settings.json:ro"
-      ],
-      "env": {
-        "MESH_NODERED_URL": "http://127.0.0.1:${port:1880}",
-        "MESH_NODERED_CONFIG_FILE": "/run/config/config.json",
-        "MESH_PROVISIONS_DIR": "/run/provisions",
-        "MESH_WRITTEN_DIR": "/var/lib/nodered-provisions"
-      },
-      "args": [
-        "run",
-        "/app/modules/nodered/dist/mqtt/index.js"
-      ],
-      "restart-on": [
-        "bound-mqtt-topic",
-        "secret-mqtt-topic",
-        "settings"
-      ],
-      "artifact": "runtime"
     }
   ],
   "requires": [
-    "mqtt-topic",
     "route"
   ],
   "contributes": {
-    "mqtt-topic": {
-      "topics": [
-        "#"
-      ]
-    },
     "route": {
       "label": "nodered",
       "endpoint": "web"
     }
   },
   "binds": {
-    "route": "${dir:state}/route.json",
-    "mqtt-topic": "${dir:state}/mqtt-topic.json"
-  },
-  "secrets": {
-    "mqtt-topic": "${dir:state}/mqtt-topic.secret"
+    "route": "/var/lib/mesh/nodered/route.json"
   },
   "build": {
     "on": [

modules/nodered/mqtt/connection.ts

@@ -1,232 +0,0 @@
-// Node-RED's MQTT broker config node, pointed at the broker the mesh bound — `mqtt-topic`.
-//
-// **Why a step.** Node-RED keeps a broker as a config node in its flows (`flows.json`) and the login
-// and password in its encrypted credentials file, both of them Node-RED's to write. So this reads the
-// binding and the pair credential and makes the broker node say the same thing through Node-RED's
-// admin API — `GET /flows`, then `POST /flows` with the changed node and its `credentials`, deployed
-// as "nodes" so only what changed restarts — with the module's own `api-token`.
-//
-// **Which broker nodes are the mesh's.** Never guessed: a flow may talk to a broker that has nothing
-// to do with this mesh. The step owns the node it creates itself (id `mesh-mqtt-topic`, "mesh:
-// mqtt-topic") and the ones an assignment names in settings (`mqtt.brokers`: node ids — how ace's
-// existing broker node, which every one of its MQTT flows uses, is handed over). With none named and
-// none made yet, it makes one, so a fresh Node-RED has a broker the flows can pick.
-//
-// **Only the connection, and only when it differs.** Host, port, TLS off (the broker serves plain
-// MQTT), login, password. Every other field of the node — client id, keepalive, birth/close/will
-// messages — is left as it is. Node-RED never hands a stored password back, so the step keeps a
-// digest of what it last wrote: equal host/port/login and an equal digest is "already as the mesh
-// says".
-//
-// **Nothing loses its connection without someone seeing it.** The broker is asked first whether it
-// takes the delivered login; if not, nothing is written and the step fails saying why.
-//
-// Pure logic over two seams (Node-RED, the broker), tested against fakes (test/mqtt.test.ts).
-
-import { createHash } from "node:crypto";
-
-import type { Probe } from "./probe.js";
-
-export const PROVISION = "mqtt-topic";
-/** The id and name of the broker node the step makes when none is named. */
-export const MESH_BROKER_ID = "mesh-mqtt-topic";
-export const MESH_BROKER_NAME = "mesh: mqtt-topic";
-
-/** What the mesh wrote at `binds.mqtt-topic`. */
-export interface Binding {
-  provision?: string;
-  from?: string;
-  at?: string;
-  as?: string;
-  serves?: Record<string, unknown>;
-}
-
-export type Outcome =
-  | { what: string; result: "unchanged"; note?: string }
-  | { what: string; result: "written"; fields: string[]; note?: string }
-  | { what: string; result: "refused"; problem: string };
-
-/** A flow node; a broker config node carries `broker`, `port`, `usetls`. */
-export interface FlowNode {
-  id: string;
-  type: string;
-  [key: string]: unknown;
-}
-
-/** Node-RED's admin API, as the step uses it. */
-export interface NodeRed {
-  /** The whole flow configuration and its revision (API v2). */
-  flows(): Promise<{ rev: string; flows: FlowNode[] }>;
-  /** A node's stored credentials as Node-RED shows them: the user, and only whether a password is set. */
-  credentials(type: string, id: string): Promise<{ user?: string; has_password?: boolean }>;
-  /** Deploy the configuration against the revision it was read at; "nodes" restarts only what changed. */
-  deploy(rev: string, flows: FlowNode[]): Promise<void>;
-}
-
-export interface Marks {
-  get(name: string): Promise<string | undefined>;
-  set(name: string, digest: string): Promise<void>;
-}
-
-export interface Deps {
-  nodered: NodeRed;
-  probe: Probe;
-  marks: Marks;
-}
-
-export interface Wanted {
-  host: string;
-  port: number;
-  user: string;
-  password: string;
-}
-
-export function digest(...parts: (string | number)[]): string {
-  return createHash("sha256").update(parts.map(String).join("\u0000")).digest("hex");
-}
-
-function isLoopback(host: string): boolean {
-  const h = host.toLowerCase();
-  return h === "localhost" || h === "::1" || h === "[::1]" || /^127\./.test(h);
-}
-
-/**
- * The broker and login the mesh says Node-RED uses. A loopback `at` — what the mesh hands a machine
- * that is not on the private network — is refused: from Node-RED's own container it is Node-RED.
- */
-export function wanted(binding: Binding | undefined, credential: string | undefined): { ok: true; want: Wanted } | { ok: false; problem: string } {
-  if (!binding) return { ok: false, problem: `no binding for ${PROVISION} was delivered — the mesh writes it before this step runs` };
-  const host = typeof binding.at === "string" ? binding.at.trim() : "";
-  if (!host) return { ok: false, problem: `the ${PROVISION} binding names no host (at)` };
-  if (isLoopback(host)) {
-    return {
-      ok: false,
-      problem:
-        `the ${PROVISION} binding says the broker is at ${host}, which from Node-RED's own container is Node-RED ` +
-        `itself; put the machine on the private network so the broker has an address Node-RED can dial`,
-    };
-  }
-  const port = Number(binding.serves?.port);
-  if (!Number.isInteger(port) || port <= 0 || port > 65535) {
-    return { ok: false, problem: `the ${PROVISION} binding serves no usable port (${String(binding.serves?.port)})` };
-  }
-  const scheme = binding.serves?.scheme;
-  if (scheme !== undefined && scheme !== "mqtt") return { ok: false, problem: `the ${PROVISION} binding serves scheme ${String(scheme)}; this step writes plain MQTT` };
-  const user = typeof binding.as === "string" ? binding.as.trim() : "";
-  if (!user) return { ok: false, problem: `the ${PROVISION} binding names no login (as)` };
-  const password = (credential ?? "").replace(/\n$/, "");
-  if (!password) return { ok: false, problem: `the ${PROVISION} credential is empty or was not delivered` };
-  return { ok: true, want: { host, port, user, password } };
-}
-
-/** The broker node ids an assignment named in settings (`mqtt.brokers`), or none. */
-export function namedBrokers(settings: unknown): string[] {
-  const brokers = (settings as { mqtt?: { brokers?: unknown } } | undefined)?.mqtt?.brokers;
-  return Array.isArray(brokers) ? brokers.filter((b): b is string => typeof b === "string" && b.length > 0) : [];
-}
-
-/** A new broker node, Node-RED 5's defaults, pointed at the broker. */
-export function newBrokerNode(want: Wanted): FlowNode {
-  return {
-    id: MESH_BROKER_ID, type: "mqtt-broker", name: MESH_BROKER_NAME,
-    broker: want.host, port: String(want.port), clientid: "", autoConnect: true, usetls: false,
-    protocolVersion: "4", keepalive: "60", cleansession: true, autoUnsubscribe: true,
-    birthTopic: "", birthQos: "0", birthRetain: "false", birthPayload: "", birthMsg: {},
-    closeTopic: "", closeQos: "0", closeRetain: "false", closePayload: "", closeMsg: {},
-    willTopic: "", willQos: "0", willRetain: "false", willPayload: "", willMsg: {},
-    userProps: "", sessionExpiry: "",
-  };
-}
-
-const markFor = (id: string, w: Wanted): string => digest("nodered-mqtt", id, w.host, w.port, w.user, w.password);
-
-function scrub(err: unknown, secret: string): string {
-  let text = err instanceof Error ? err.message : String(err);
-  for (const form of new Set([secret, encodeURIComponent(secret)])) text = text.split(form).join("***");
-  return text;
-}
-
-/**
- * Bring the mesh's broker nodes in line with the binding: one outcome per node. Never throws. A node
- * the settings name that is not in the flows is refused (the others are still put right).
- */
-export async function reconcileBrokers(deps: Deps, binding: Binding | undefined, credential: string | undefined, named: readonly string[]): Promise<Outcome[]> {
-  const w = wanted(binding, credential);
-  if ("problem" in w) return [{ what: "mqtt", result: "refused", problem: w.problem }];
-  const want = w.want;
-
-  let note: string | undefined;
-  try {
-    const probe = await deps.probe(want.host, want.port, want.user, want.password, "#");
-    if (probe.connack === 4 || probe.connack === 5) {
-      return [{
-        what: "mqtt",
-        result: "refused",
-        problem:
-          `the broker at ${want.host}:${want.port} does not (yet) take the login ${want.user} with the delivered password ` +
-          `(CONNACK ${probe.connack}); mosquitto's provisioner creates it from the grant — nothing was written`,
-      }];
-    }
-    if (probe.connack !== 0) return [{ what: "mqtt", result: "refused", problem: `the broker at ${want.host}:${want.port} answered CONNACK ${probe.connack}; nothing was written` }];
-    if (probe.suback === 0x80) note = `warning: ${want.user} may not subscribe to every topic; flows subscribing outside its grant will get nothing`;
-  } catch (err) {
-    return [{ what: "mqtt", result: "refused", problem: `the broker at ${want.host}:${want.port} could not be asked: ${scrub(err, want.password)}; nothing was written` }];
-  }
-
-  const outcomes: Outcome[] = [];
-  for (let attempt = 0; attempt < 2; attempt++) {
-    outcomes.length = 0;
-    try {
-      const { rev, flows } = await deps.nodered.flows();
-      const targets = named.length > 0 ? [...named] : [MESH_BROKER_ID];
-      const changed: { id: string; fields: string[] }[] = [];
-      for (const id of targets) {
-        let node = flows.find((n) => n.id === id);
-        if (node && node.type !== "mqtt-broker") {
-          outcomes.push({ what: `broker ${id}`, result: "refused", problem: `node ${id} is a ${node.type}, not an mqtt-broker` });
-          continue;
-        }
-        if (!node) {
-          if (id !== MESH_BROKER_ID) {
-            outcomes.push({ what: `broker ${id}`, result: "refused", problem: `the settings name broker node ${id}, and Node-RED's flows have no such node` });
-            continue;
-          }
-          node = newBrokerNode(want);
-          flows.push(node);
-          node.credentials = { user: want.user, password: want.password };
-          changed.push({ id, fields: ["node"] });
-          continue;
-        }
-        const fields: string[] = [];
-        if (String(node.broker ?? "") !== want.host) fields.push("broker");
-        if (Number(node.port ?? 0) !== want.port) fields.push("port");
-        if (node.usetls === true) fields.push("usetls");
-        const creds = await deps.nodered.credentials("mqtt-broker", id);
-        if ((creds.user ?? "") !== want.user) fields.push("user");
-        if (!creds.has_password || (await deps.marks.get(`broker-${id}`)) !== markFor(id, want)) fields.push("password");
-        if (fields.length === 0) {
-          outcomes.push(note ? { what: `broker ${id}`, result: "unchanged", note } : { what: `broker ${id}`, result: "unchanged" });
-          continue;
-        }
-        node.broker = want.host;
-        node.port = String(want.port);
-        node.usetls = false;
-        node.credentials = { user: want.user, password: want.password };
-        changed.push({ id, fields });
-      }
-      if (changed.length > 0) {
-        await deps.nodered.deploy(rev, flows);
-        for (const c of changed) {
-          await deps.marks.set(`broker-${c.id}`, markFor(c.id, want));
-          outcomes.push({ what: `broker ${c.id}`, result: "written", fields: c.fields, ...(note ? { note } : {}) });
-        }
-      }
-      return outcomes;
-    } catch (err) {
-      // A deploy against a revision someone else changed meanwhile (409) is read again once.
-      if (attempt === 0 && /\b409\b/.test(String(err))) continue;
-      return [...outcomes, { what: "mqtt", result: "refused", problem: scrub(err, want.password) }];
-    }
-  }
-  return outcomes;
-}

modules/nodered/mqtt/index.ts

@@ -1,102 +0,0 @@
-// nodered's MQTT step — run once by the host after Node-RED starts, and again whenever the
-// `mqtt-topic` binding, its pair credential or the settings change (the container's `restart-on`,
-// novox/hq ADR 0099). It points the mesh's broker config nodes at the broker the mesh bound, through
-// Node-RED's admin API (connection.ts). It connects to no mesh broker.
-//
-// Exits non-zero when anything could not be put right, so the node reports the step failed and the
-// host runs it again on the next apply. Declared last in the manifest, so its failing gates nothing
-// else of nodered's (novox/hq ADR 0136). Never prints a password.
-
-import { mkdir, readFile, rename, writeFile } from "node:fs/promises";
-import { join } from "node:path";
-
-import { NodeRedClient } from "../client.js";
-import { namedBrokers, reconcileBrokers, type Binding, type Marks } from "./connection.js";
-import { probeBroker } from "./probe.js";
-
-const dir = process.env.MESH_PROVISIONS_DIR ?? "/run/provisions";
-const writtenDir = process.env.MESH_WRITTEN_DIR ?? "/var/lib/nodered-provisions";
-const waitSeconds = Number(process.env.MESH_NODERED_WAIT_SECONDS ?? "180");
-
-const readIfThere = (path: string): Promise<string | undefined> => readFile(path, "utf8").catch(() => undefined);
-const parse = <T>(raw: string | undefined): T | undefined => {
-  if (raw === undefined) return undefined;
-  try {
-    return JSON.parse(raw) as T;
-  } catch {
-    return undefined;
-  }
-};
-
-const marks: Marks = {
-  async get(name) {
-    return (await readIfThere(join(writtenDir, `${name}.digest`)))?.trim() || undefined;
-  },
-  async set(name, value) {
-    await mkdir(writtenDir, { recursive: true, mode: 0o700 });
-    const path = join(writtenDir, `${name}.digest`);
-    await writeFile(`${path}.tmp`, `${value}\n`, { mode: 0o600 });
-    await rename(`${path}.tmp`, path);
-  },
-};
-
-let client: NodeRedClient;
-try {
-  client = NodeRedClient.fromEnv();
-} catch (err) {
-  console.error(`[nodered-mqtt] ${err instanceof Error ? err.message : String(err)}`);
-  process.exit(1);
-}
-
-/** Node-RED answers the admin API once its flows are loaded and the token is good. */
-async function ready(): Promise<boolean> {
-  const until = Date.now() + waitSeconds * 1000;
-  for (;;) {
-    try {
-      await client.flowsWithRev();
-      return true;
-    } catch (err) {
-      if (/\b(401|403)\b/.test(String(err))) {
-        console.error("[nodered-mqtt] Node-RED refuses the api-token — settings.js and this step disagree");
-        return false;
-      }
-    }
-    if (Date.now() >= until) return false;
-    await new Promise((r) => setTimeout(r, 2000));
-  }
-}
-
-if (!(await ready())) {
-  console.error(`[nodered-mqtt] Node-RED's admin API did not answer at ${client.baseUrl} within ${waitSeconds}s`);
-  process.exit(1);
-}
-
-const binding = parse<Binding>(await readIfThere(join(dir, "mqtt-topic.json")));
-const secret = await readIfThere(join(dir, "mqtt-topic.secret"));
-const settings = parse<unknown>(await readIfThere(join(dir, "settings.json")));
-
-const outcomes = await reconcileBrokers(
-  {
-    nodered: {
-      flows: () => client.flowsWithRev(),
-      credentials: (type, id) => client.credentials(type, id),
-      deploy: (rev, flows) => client.deployFlowsAt(rev, flows, "nodes"),
-    },
-    probe: probeBroker,
-    marks,
-  },
-  binding,
-  secret,
-  namedBrokers(settings),
-);
-
-let failed = 0;
-for (const o of outcomes) {
-  if (o.result === "unchanged") console.log(`[nodered-mqtt] ${o.what}: already as the mesh says${o.note ? ` — ${o.note}` : ""}`);
-  else if (o.result === "written") console.log(`[nodered-mqtt] ${o.what}: wrote ${o.fields.join(", ")}${o.note ? ` — ${o.note}` : ""}`);
-  else {
-    failed++;
-    console.error(`[nodered-mqtt] ${o.what}: ${o.problem}`);
-  }
-}
-process.exitCode = failed > 0 ? 1 : 0;

modules/nodered/mqtt/probe.ts

@@ -1,117 +0,0 @@
-// Ask the broker, before Node-RED is told anything, whether it takes the login and password the
-// mesh delivered — and whether that login may subscribe to every topic, as flows expect.
-//
-// One MQTT 3.1.1 session: CONNECT (clean, a throwaway client id, so no flow's session is taken
-// over), read the CONNACK, optionally SUBSCRIBE once and read the SUBACK, DISCONNECT. No dependency:
-// the handful of bytes MQTT needs for this are written here.
-
-import { randomBytes } from "node:crypto";
-import { connect } from "node:net";
-
-export interface ProbeResult {
-  /** 0 accepted; 4 bad username or password; 5 not authorised. */
-  connack: number;
-  /** The SUBACK return code for the filter asked about: 0–2 granted, 0x80 refused. */
-  suback?: number;
-}
-
-export type Probe = (host: string, port: number, username: string, password: string, subscribe?: string) => Promise<ProbeResult>;
-
-function str(v: string): Buffer {
-  const b = Buffer.from(v, "utf8");
-  const len = Buffer.alloc(2);
-  len.writeUInt16BE(b.length);
-  return Buffer.concat([len, b]);
-}
-
-function packet(type: number, body: Buffer): Buffer {
-  let remaining = body.length;
-  const lenBytes: number[] = [];
-  do {
-    let byte = remaining % 128;
-    remaining = Math.floor(remaining / 128);
-    if (remaining > 0) byte |= 0x80;
-    lenBytes.push(byte);
-  } while (remaining > 0);
-  return Buffer.concat([Buffer.from([type, ...lenBytes]), body]);
-}
-
-/** The first complete packet in `buf`: its type byte, its body, and how many bytes it took. */
-export function firstPacket(buf: Buffer): { type: number; body: Buffer; used: number } | undefined {
-  if (buf.length < 2) return undefined;
-  let length = 0;
-  let multiplier = 1;
-  let i = 1;
-  for (;;) {
-    if (i >= buf.length) return undefined;
-    const byte = buf[i++];
-    length += (byte & 0x7f) * multiplier;
-    if ((byte & 0x80) === 0) break;
-    multiplier *= 128;
-    if (i > 4) throw new Error("malformed MQTT remaining length");
-  }
-  if (buf.length < i + length) return undefined;
-  return { type: buf[0], body: buf.subarray(i, i + length), used: i + length };
-}
-
-export const probeBroker: Probe = (host, port, username, password, subscribe) => {
-  const connectBody = Buffer.concat([
-    str("MQTT"),
-    Buffer.from([4, 0xc2, 0, 10]), // level 4 (3.1.1); username + password + clean session; keepalive 10s
-    str(`mesh-probe-${randomBytes(6).toString("hex")}`),
-    str(username),
-    str(password),
-  ]);
-  return new Promise((resolve, reject) => {
-    const socket = connect({ host, port });
-    let buf = Buffer.alloc(0);
-    const result: ProbeResult = { connack: -1 };
-    const timer = setTimeout(() => {
-      socket.destroy();
-      reject(new Error(`no answer from the broker at ${host}:${port} within 10s`));
-    }, 10_000);
-    const finish = (): void => {
-      clearTimeout(timer);
-      if (result.connack === 0) socket.end(Buffer.from([0xe0, 0]));
-      else socket.destroy();
-      resolve(result);
-    };
-    socket.on("connect", () => socket.write(packet(0x10, connectBody)));
-    socket.on("data", (chunk) => {
-      buf = Buffer.concat([buf, chunk]);
-      for (;;) {
-        let p;
-        try {
-          p = firstPacket(buf);
-        } catch (err) {
-          clearTimeout(timer);
-          socket.destroy();
-          reject(err);
-          return;
-        }
-        if (!p) return;
-        buf = buf.subarray(p.used);
-        const kind = p.type >> 4;
-        if (kind === 2) {
-          result.connack = p.body[1] ?? -1;
-          if (result.connack !== 0 || !subscribe) return finish();
-          // SUBSCRIBE, packet id 1, one filter at QoS 0.
-          socket.write(packet(0x82, Buffer.concat([Buffer.from([0, 1]), str(subscribe), Buffer.from([0])])));
-        } else if (kind === 9) {
-          result.suback = p.body[2];
-          return finish();
-        }
-      }
-    });
-    socket.on("error", (err) => {
-      clearTimeout(timer);
-      reject(err);
-    });
-    socket.on("close", () => {
-      if (result.connack === -1) {
-        clearTimeout(timer);
-        reject(new Error(`the broker at ${host}:${port} closed the connection without answering`));
-      }
-    });
-  });
-};

modules/nodered/package.json

@@ -1,14 +1,9 @@
 {
   "name": "@novox/module-nodered",
   "version": "0.1.0",
-  "description": "nodered \u2014 flow-based automation. Its client and tools live here (novox/hq ADR 0039).",
+  "description": "nodered — flow-based automation. Its client and tools live here (novox/hq ADR 0039).",
   "type": "module",
   "private": true,
-  "scripts": {
-    "build": "tsc client.ts tools/index.ts mqtt/probe.ts mqtt/connection.ts mqtt/index.ts --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist",
-    "typecheck": "tsc -p tsconfig.json",
-    "test": "node --test --experimental-strip-types 'test/*.test.ts'"
-  },
   "dependencies": {
     "@novox/mesh-sdk": "^0.1.0"
   },

modules/nodered/test/mqtt.test.ts

@@ -1,124 +0,0 @@
-// What holds nodered's MQTT step (mqtt/connection.ts): the broker nodes the mesh owns — the one it
-// makes, or the ones settings name — are made to use the broker and login the mesh bound, only after
-// the broker takes that login; every other field of a node is kept; nothing is deployed when nothing
-// differs; a node that is not named is never touched; a loopback broker address is refused.
-//
-// Node-RED and the broker are fakes answering as the real ones do (admin API v2 of nodered/node-red
-// 5.0.7, the build ace runs).
-
-import { test } from "node:test";
-import assert from "node:assert/strict";
-
-import { MESH_BROKER_ID, namedBrokers, reconcileBrokers, type Binding, type FlowNode, type Marks, type NodeRed } from "../mqtt/connection.ts";
-import type { Probe } from "../mqtt/probe.ts";
-
-const MINTED = "mesh-minted-password";
-const binding = (at = "ace.internal"): Binding => ({ provision: "mqtt-topic", from: "ace", at, as: "mesh_ace_nodered", serves: { scheme: "mqtt", port: 1883 } });
-
-/** ace's flows, reduced: its one broker node (dead, zurag.be:1884) and a node that uses it. */
-function aceFlows(): FlowNode[] {
-  return [
-    { id: "2b0aece9c5f3b307", type: "mqtt-broker", name: "MQTT Broker", broker: "zurag.be", port: "1884", clientid: "", usetls: false, protocolVersion: "4", keepalive: "60" },
-    { id: "fe0cae96f1e3ae4d", type: "mqtt in", topic: "stat/sonoff_office_light_switch/RESULT", broker: "2b0aece9c5f3b307", z: "t" },
-    { id: "other-broker", type: "mqtt-broker", name: "someone else's", broker: "test.mosquitto.org", port: "1883" },
-  ];
-}
-
-function fakeNodeRed(flows: FlowNode[], creds: Record<string, { user?: string; password?: string }> = {}) {
-  let rev = "r1";
-  const deploys: FlowNode[][] = [];
-  const nodered: NodeRed = {
-    async flows() {
-      return { rev, flows: structuredClone(flows) };
-    },
-    async credentials(_type, id) {
-      const c = creds[id] ?? {};
-      return { user: c.user, has_password: Boolean(c.password) };
-    },
-    async deploy(at, next) {
-      if (at !== rev) throw new Error("Node-RED /flows: 409 version_mismatch");
-      for (const n of next) {
-        if (n.credentials) creds[n.id] = { ...(creds[n.id] ?? {}), ...(n.credentials as object) };
-      }
-      flows.splice(0, flows.length, ...next.map(({ credentials: _c, ...n }) => n as FlowNode));
-      deploys.push(next);
-      rev = `r${deploys.length + 1}`;
-    },
-  };
-  return { nodered, deploys, flows, creds };
-}
-
-const marks = (): Marks & { store: Map<string, string> } => {
-  const store = new Map<string, string>();
-  return { store, get: async (k) => store.get(k), set: async (k, v) => void store.set(k, v) };
-};
-const takes: Probe = async (_h, _p, user, pass) => ({ connack: user === "mesh_ace_nodered" && pass === MINTED ? 0 : 5, suback: 0 });
-
-test("ace: the named broker node is moved to the bound broker and login; the other broker is not touched", async () => {
-  const f = fakeNodeRed(aceFlows(), { "2b0aece9c5f3b307": { user: "luffy", password: "old" }, "other-broker": { user: "x", password: "y" } });
-  const m = marks();
-  const out = await reconcileBrokers({ nodered: f.nodered, probe: takes, marks: m }, binding(), `${MINTED}\n`, ["2b0aece9c5f3b307"]);
-  assert.deepEqual(out, [{ what: "broker 2b0aece9c5f3b307", result: "written", fields: ["broker", "port", "user", "password"] }]);
-  const node = f.flows.find((n) => n.id === "2b0aece9c5f3b307");
-  assert.deepEqual(node, { ...aceFlows()[0], broker: "ace.internal", port: "1883", usetls: false });
-  assert.deepEqual(f.creds["2b0aece9c5f3b307"], { user: "mesh_ace_nodered", password: MINTED });
-  assert.deepEqual(f.flows.find((n) => n.id === "other-broker"), aceFlows()[2]);
-  assert.deepEqual(f.creds["other-broker"], { user: "x", password: "y" });
-  // Only the changed node carried credentials in the deploy.
-  assert.deepEqual(f.deploys[0].filter((n) => n.credentials).map((n) => n.id), ["2b0aece9c5f3b307"]);
-
-  // Again: nothing differs, nothing is deployed.
-  const again = await reconcileBrokers({ nodered: f.nodered, probe: takes, marks: m }, binding(), MINTED, ["2b0aece9c5f3b307"]);
-  assert.deepEqual(again, [{ what: "broker 2b0aece9c5f3b307", result: "unchanged" }]);
-  assert.equal(f.deploys.length, 1);
-});
-
-test("fresh: with nothing named, the step makes its own broker node", async () => {
-  const f = fakeNodeRed([]);
-  const out = await reconcileBrokers({ nodered: f.nodered, probe: takes, marks: marks() }, binding(), MINTED, []);
-  assert.deepEqual(out, [{ what: `broker ${MESH_BROKER_ID}`, result: "written", fields: ["node"] }]);
-  assert.equal(f.flows[0].type, "mqtt-broker");
-  assert.equal(f.flows[0].broker, "ace.internal");
-  assert.deepEqual(f.creds[MESH_BROKER_ID], { user: "mesh_ace_nodered", password: MINTED });
-});
-
-test("a login the broker does not take is never written", async () => {
-  const f = fakeNodeRed(aceFlows());
-  const out = await reconcileBrokers({ nodered: f.nodered, probe: async () => ({ connack: 5 }), marks: marks() }, binding(), MINTED, ["2b0aece9c5f3b307"]);
-  assert.equal(out[0].result, "refused");
-  assert.equal(f.deploys.length, 0);
-});
-
-test("a named node that is not there, or a loopback broker, is refused", async () => {
-  const f = fakeNodeRed(aceFlows());
-  const out = await reconcileBrokers({ nodered: f.nodered, probe: takes, marks: marks() }, binding(), MINTED, ["gone"]);
-  assert.match((out[0] as { problem: string }).problem, /no such node/);
-  const lo = await reconcileBrokers({ nodered: f.nodered, probe: takes, marks: marks() }, binding("127.0.0.1"), MINTED, []);
-  assert.match((lo[0] as { problem: string }).problem, /Node-RED itself/);
-  assert.equal(f.deploys.length, 0);
-});
-
-test("a deploy that raced another is read again once", async () => {
-  const f = fakeNodeRed(aceFlows());
-  let first = true;
-  const racing: NodeRed = {
-    ...f.nodered,
-    async flows() {
-      const got = await f.nodered.flows();
-      if (first) {
-        first = false;
-        return { ...got, rev: "stale" };
-      }
-      return got;
-    },
-  };
-  const out = await reconcileBrokers({ nodered: racing, probe: takes, marks: marks() }, binding(), MINTED, ["2b0aece9c5f3b307"]);
-  assert.equal(out[0].result, "written");
-  assert.equal(f.deploys.length, 1);
-});
-
-test("settings name broker nodes under mqtt.brokers", () => {
-  assert.deepEqual(namedBrokers({ mqtt: { brokers: ["a", "", 3, "b"] } }), ["a", "b"]);
-  assert.deepEqual(namedBrokers({ endpoints: {} }), []);
-  assert.deepEqual(namedBrokers(undefined), []);
-});

modules/nodered/tsconfig.json

@@ -8,11 +8,5 @@
     "skipLibCheck": true,
     "noEmit": true
   },
-  "include": [
-    "client.ts",
-    "tools/index.ts",
-    "mqtt/probe.ts",
-    "mqtt/connection.ts",
-    "mqtt/index.ts"
-  ]
+  "include": ["client.ts", "tools/index.ts"]
 }