mosquitto: a consumer's grant is the topics it asks for, and its binding says the port

mqtt-topic served nothing: with two listens the mesh could not say which port a consumer dials, so a consumer had to type 1883 into its config. It now serves the MQTT listener's port (the machine's, once assigned) and the scheme, so `${bound:mqtt-topic:port}` fills. The provisioner confined every consumer to `<as>/#`, which leaves nothing for the consumers the broker exists for: Home Assistant discovers under homeassistant/# and tasmota/discovery/#, and Node-RED's flows follow the devices' own topics. A consumer now contributes `topics` (MQTT topic filters) to its mqtt-topic requirement and is granted exactly those; with none, its own subtree as before. Settings merge into contributions, so an operator narrows a grant per assignment. The role is brought to exactly the wanted ACLs (stale ones removed), `holds` checks the ACLs too, and an invalid list is refused, never quietly narrowed. Only the role named for the consumer is touched: a client carried from the predecessor's password file keeps its own.
mosquitto: its directories are placed, not stated, and it runs the build in use
2026-09-30 13:01:14 +02:00 · 2026-09-29 23:05:41 +02:00
29 changed files with 295 additions and 2092 deletions
@@ -94,7 +94,7 @@
      ],
      "env": {
        "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_BAZARR_URL": "http://127.0.0.1:${port:6767}",
+        "MESH_BAZARR_URL": "http://127.0.0.1:6767",
        "MESH_BAZARR_API_KEY_FILE": "/run/secrets/api-key",
        "MESH_BAZARR_CONFIG_FILE": "/run/config/config.json",
        "MESH_BAZARR_CONFIG_DIR": "/var/lib/bazarr/config"
@@ -76,7 +76,7 @@
      ],
      "env": {
        "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_BOOKSHELF_URL": "http://127.0.0.1:${port:8787}",
+        "MESH_BOOKSHELF_URL": "http://127.0.0.1:8787",
        "MESH_BOOKSHELF_CONFIG_DIR": "/var/lib/bookshelf/config"
      },
      "artifact": "runtime"
@@ -1,19 +1,6 @@
 {
  "module": "lidarr",
  "version": "1",
  "provides": [
    {
      "name": "lidarr-api",
      "scope": "mesh"
    }
  ],
  "serves": {
    "lidarr-api": {
      "scheme": "http",
      "port": 8686,
      "url-base": ""
    }
  },
  "capabilities": [
    "container-runtime"
  ],
@@ -88,7 +75,7 @@
      ],
      "env": {
        "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_LIDARR_URL": "http://127.0.0.1:${port:8686}",
+        "MESH_LIDARR_URL": "http://127.0.0.1:8686",
        "MESH_LIDARR_CONFIG_DIR": "/var/lib/lidarr/config"
      },
      "artifact": "runtime"
@@ -13,7 +13,7 @@ ARG RUNTIME_BASE
 FROM ${BUILD_BASE} AS build
 WORKDIR /app/modules/mosquitto
 COPY . .
-RUN node /app/node_modules/typescript/bin/tsc client.ts index.ts tools/index.ts provisioner/index.ts bootstrap/index.ts \
+RUN node /app/node_modules/typescript/bin/tsc topics.ts client.ts index.ts tools/index.ts provisioner/index.ts bootstrap/index.ts \
      --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist
 FROM ${RUNTIME_BASE}
@@ -20,6 +20,8 @@ import { readFileSync } from "node:fs";
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
 import { missingAcls, parseRoleAcls, staleAcls, wantedAcls } from "./topics.js";
 const run = promisify(execFile);
 export interface MqttConn {
@@ -141,14 +143,19 @@ export class MosquittoClient {
  }
  /**
-   * Create (or reset to a known state) a client scoped to one topic namespace, idempotently. The
+   * Create (or reset to a known state) a client granted exactly these topic filters, idempotently.
-   * client is confined to `<prefix>/#` by a same-named role: it may publish to, subscribe to and
+   * The grant is a same-named role carrying, for every filter, publish, receive and subscribe — and
-   * receive on exactly its own subtree and nothing else — the MQTT analog of redis's keyspace-scoped
+   * nothing else: an ACL the role carries that the filters no longer name is removed, so narrowing a
-   * ACL user. Called again for an existing client, it resets the password and re-asserts the ACLs.
+   * consumer's `topics` narrows what it may do. By default the filters are the consumer's own
   * subtree, `<as>/#` (see topics.ts). Called again for an existing client, it resets the password
   * and re-asserts the ACLs.
   *
   * Only the role named for this client is ever changed. A client or role the mesh did not make —
   * a device carried from the predecessor's password file, its `legacy-full-access` role — is never
   * read, changed or removed here.
   */
-  async createScopedClient(username: string, password: string, topicPrefix: string): Promise<void> {
+  async createScopedClient(username: string, password: string, filters: readonly string[]): Promise<void> {
    const role = username; // one role per client, named for it
    const pattern = `${topicPrefix}/#`;
    if (await this.clientExists(username)) {
      await this.ctl("setClientPassword", username, password);
@@ -161,17 +168,18 @@ export class MosquittoClient {
      await this.ctl("createClient", username, "-p", password);
    }
-    // A role carrying exactly this client's topic ACLs. createRole, addRoleACL and addClientRole are
+    // createRole and addRoleACL are one-shot: each rejects with an "already exists" when re-run
-    // all one-shot: each rejects with an "already exists" when re-run against a role/ACL/binding it
+    // against a role/ACL it created on a previous reconcile. That rejection is the intended terminal
-    // created on a previous reconcile. That rejection is the intended terminal state — the ACL is
+    // state, so it is swallowed.
    // deterministic (`<prefix>/#`, allow), so re-adding the identical entry is a no-op — so it is
    // swallowed. (Until the exit code was fixed this was invisible: the tool returned 0 and the
    // rejection was lost; now it surfaces, and each of these adds must tolerate its own idempotent
    // re-run explicitly.)
    await ignoreExisting(this.ctl("createRole", role));
-    for (const acl of ["publishClientSend", "publishClientReceive", "subscribePattern"]) {
+    const wanted = wantedAcls(filters);
-      // allow (1) this client to send to, receive on, and subscribe under its own subtree.
+    const current = parseRoleAcls(await this.ctl("getRole", role));
-      await ignoreExisting(this.ctl("addRoleACL", role, acl, pattern, "allow"));
+    for (const acl of missingAcls(current, wanted)) {
      await ignoreExisting(this.ctl("addRoleACL", role, acl.type, acl.topic, "allow"));
    }
    // What the consumer no longer asks for — added before it narrowed its topics — is taken away.
    for (const acl of staleAcls(current, wanted)) {
      await ignoreMissing(this.ctl("removeRoleACL", role, acl.type, acl.topic));
    }
    // Bind the role only when it is not already bound — addClientRole is the one call whose
    // idempotent re-run cannot be recognised by message (see clientHasRole).
@@ -181,25 +189,31 @@ export class MosquittoClient {
  }
  /**
-   * Whether a consumer's client accepts exactly this password and still carries its own role.
+   * Whether a consumer's client accepts exactly this password, still carries its own role, and that
-   * Read-only. The password is checked the way the consumer is checked, by an MQTT CONNECT as it,
+   * role grants exactly these filters. Read-only. The password is checked the way the consumer is
-   * and the broker's CONNACK code is the answer: 0 accepted, 4 bad credentials, 5 not authorised.
+   * checked, by an MQTT CONNECT as it, and the broker's CONNACK code is the answer: 0 accepted,
-   * Nothing rides on argv. An unreachable broker rejects (novox/hq issue 120).
+   * 4 bad credentials, 5 not authorised. Nothing rides on argv. An unreachable broker rejects
   * (novox/hq issue 120).
   */
-  async holdsClient(username: string, password: string): Promise<boolean> {
+  async holdsClient(username: string, password: string, filters: readonly string[]): Promise<boolean> {
    const code = await mqttConnack(this.conn.host, this.conn.port, username, password);
    if (code === 4 || code === 5) return false;
    if (code !== 0) throw new Error(`mosquitto refused ${username} with CONNACK ${code}`);
    // The role, asked directly: only "not found" means absent. Any other failure to ask rejects,
    // unlike clientHasRole, which reads every failure as "no role".
-    let out: string;
+    let client: string;
    let role: string;
    try {
-      out = await this.ctl("getClient", username);
+      client = await this.ctl("getClient", username);
      role = await this.ctl("getRole", username);
    } catch (err) {
      if (/not\s*found|does not exist|no such/i.test(String(err))) return false;
      throw err;
    }
-    return new RegExp(`(^|\\s)${escapeRegExp(username)}\\s+\\(priority`, "m").test(out);
+    if (!new RegExp(`(^|\\s)${escapeRegExp(username)}\\s+\\(priority`, "m").test(client)) return false;
    const current = parseRoleAcls(role);
    const wanted = wantedAcls(filters);
    return missingAcls(current, wanted).length === 0 && staleAcls(current, wanted).length === 0;
  }
  /** Remove a client and the per-client role created for it, idempotently. */
@@ -20,16 +20,19 @@
    "mosquitto.topic.deprovisioned"
  ],
  "serves": {
-    "mqtt-topic": {}
+    "mqtt-topic": {
      "scheme": "mqtt",
      "port": 1883
    }
  },
  "receives": {
-    "mqtt-topic": "/var/lib/mosquitto-module/grants/mesh.json"
+    "mqtt-topic": "${dir:grants}/mesh.json"
  },
  "grants": {
-    "mqtt-topic": "/var/lib/mosquitto-module/grants"
+    "mqtt-topic": "${dir:grants}"
  },
  "own-secrets": {
-    "admin": "/var/lib/mosquitto-module/admin.secret",
+    "admin": "/var/lib/mesh/mosquitto/admin",
    "broker": "/var/lib/mesh/mosquitto/broker"
  },
  "listens": [
@@ -58,26 +61,24 @@
    {
      "id": "state",
      "type": "directory",
-      "path": "/var/lib/mosquitto-module",
+      "mode": "0700",
-      "mode": "0700"
+      "place": "."
    },
    {
-      "id": "grants-dir",
+      "id": "grants",
      "type": "directory",
      "path": "/var/lib/mosquitto-module/grants",
      "mode": "0700"
    },
    {
      "id": "data",
      "type": "directory",
      "path": "/services/mosquitto/data",
      "mode": "0700",
      "owner": "1883:1883"
    },
    {
      "id": "server-conf",
      "type": "file",
-      "path": "/var/lib/mosquitto-module/mosquitto.conf",
+      "path": "${dir:state}/mosquitto.conf",
      "mode": "0600",
      "owner": "1883:1883",
      "content": "persistence true\npersistence_location /mosquitto/data\n\nlog_dest stdout\nlog_type warning\nlog_type error\nlog_type notice\n\n# Every client authenticates; identities and their per-topic ACLs are managed\n# at runtime by the dynamic security plugin, whose store the plugin itself owns.\nallow_anonymous false\nplugin /usr/lib/mosquitto_dynamic_security.so\nplugin_opt_config_file /mosquitto/data/dynamic-security.json\n\n# MQTT listener\nlistener 1883\n\n# MQTT-over-WebSockets listener\nlistener 8081\nprotocol websockets\n"
@@ -93,8 +94,8 @@
      "name": "mosquitto-bootstrap",
      "run-once": true,
      "volumes": [
-        "/services/mosquitto/data:/mosquitto/data",
+        "${dir:data}:/mosquitto/data",
-        "/var/lib/mosquitto-module/admin.secret:/run/secrets/admin:ro"
+        "/var/lib/mesh/mosquitto/admin:/run/secrets/admin:ro"
      ],
      "env": {
        "MESH_PROVISION_MQTT": "mosquitto:1883",
@@ -112,15 +113,15 @@
      "id": "server",
      "type": "container",
      "name": "mosquitto",
-      "image": "eclipse-mosquitto@sha256:6f8d8a947c506f8a2290ec65cd4bd2bc7cb4d43fb5f6271f861cb013e2ef9797",
+      "image": "eclipse-mosquitto@sha256:38c0da4f2ef84284d47b3b3eeea1cb3bdeabe81ee10caf0cd5c5ff61ee3ea408",
      "network": "mosquitto",
      "ports": [
        "1883",
        "8081"
      ],
      "volumes": [
-        "/services/mosquitto/data:/mosquitto/data",
+        "${dir:data}:/mosquitto/data",
-        "/var/lib/mosquitto-module/mosquitto.conf:/mosquitto/config/mosquitto.conf:ro"
+        "${dir:state}/mosquitto.conf:/mosquitto/config/mosquitto.conf:ro"
      ]
    },
    {
@@ -130,8 +131,8 @@
      "network": "mosquitto",
      "volumes": [
        "/var/lib/mesh/mosquitto/broker:/run/secrets/broker:ro",
-        "/var/lib/mosquitto-module/grants:/var/lib/mosquitto-module/grants:ro",
+        "${dir:grants}:/var/lib/mosquitto-module/grants:ro",
-        "/var/lib/mosquitto-module/admin.secret:/run/secrets/admin:ro"
+        "/var/lib/mesh/mosquitto/admin:/run/secrets/admin:ro"
      ],
      "env": {
        "MESH_BROKER_FILE": "/run/secrets/broker",
@@ -1,9 +1,14 @@
 {
  "name": "@novox/module-mosquitto",
  "version": "0.1.0",
-  "description": "mosquitto — provides the mesh mqtt-topic interface. Its admin client, provisioner, tools and events live here (novox/hq ADR 0039).",
+  "description": "mosquitto \u2014 provides the mesh mqtt-topic interface. Its admin client, provisioner, tools and events live here (novox/hq ADR 0039).",
  "type": "module",
  "private": true,
  "scripts": {
    "build": "tsc topics.ts client.ts index.ts tools/index.ts provisioner/index.ts bootstrap/index.ts --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist",
    "typecheck": "tsc -p tsconfig.json",
    "test": "node --test --experimental-strip-types 'test/*.test.ts'"
  },
  "dependencies": {
    "@novox/mesh-sdk": "^0.1.1"
  },
@@ -5,7 +5,14 @@
 //
 // The `mqtt-topic` interface: a consumer connects as `as` with the password the mesh minted, and
 // publishes and subscribes under `<as>/#`, isolated from every other consumer by a Dynamic Security
-// role scoped to exactly that subtree.
+// role scoped to exactly that subtree — unless it contributed `topics`, the MQTT topic filters its
 // work needs (a home-automation hub needs the devices' topics); then the role grants exactly those
 // (topics.ts). A list that is not valid topic filters is refused, and the consumer is not created
 // or changed until it is fixed.
 //
 // What a consumer is told (its binding): `at` — the broker's machine — and `port`, the machine port
 // of the MQTT listener (the manifest's `serves`); `as` is its login, and its copy of the password is
 // the pair credential the mesh delivers to it.
 //
 // **The login and password are the mesh's, not the provisioner's (ADR 0048).** The mesh derives the
 // login and hands it to both ends so they agree, and mints the password and delivers a copy to each.
@@ -15,6 +22,7 @@
 import { runProvisioner, type Provision } from "@novox/mesh-sdk/provisioner";
 import { emit } from "@novox/mesh-sdk/events";
 import { MosquittoClient } from "../client.js";
 import { topicFilters } from "../topics.js";
 const mosquitto = MosquittoClient.fromEnv();
@@ -29,13 +37,20 @@ async function announce(type: string, body: Record<string, string>): Promise<voi
 runProvisioner("mqtt-topic", {
  async create(p: Provision): Promise<void> {
-    // The topic subtree is scoped to the consumer's own login, so one cannot read another's topics.
+    // By default the consumer's own subtree, so one cannot read another's topics; what it
-    const topicPrefix = p.as;
+    // contributed as `topics` otherwise.
-    await mosquitto.createScopedClient(p.as, p.password, topicPrefix);
+    const granted = topicFilters(p.values, p.as);
    if ("problem" in granted) {
      // Thrown, so the harness logs it and retries: the consumer stays as it was (or absent) until
      // its contribution is valid, rather than being given a grant it did not ask for.
      throw new Error(`${p.as}: ${granted.problem}`);
    }
    await mosquitto.createScopedClient(p.as, p.password, granted.filters);
    await announce("topic.provisioned", {
      consumer: p.consumer ?? "",
      username: p.as,
-      topicPrefix,
+      topicPrefix: granted.own ? p.as : "",
      topics: granted.filters.join(" "),
    });
  },
@@ -46,6 +61,9 @@ runProvisioner("mqtt-topic", {
  // Asked every minute by the harness: whether the backend still holds this consumer exactly as
  // the mesh gave it, so a login lost behind the provisioner's back is made again (novox/hq issue 120).
  async holds(p: Provision): Promise<boolean> {
-    return mosquitto.holdsClient(p.as, p.password);
+    const granted = topicFilters(p.values, p.as);
    // An invalid list was never applied; create refuses it again, loudly, on every pass.
    if ("problem" in granted) return false;
    return mosquitto.holdsClient(p.as, p.password, granted.filters);
  },
 });
@@ -0,0 +1,72 @@
 // What a consumer of mqtt-topic is granted (topics.ts): its own subtree unless it contributed
 // `topics`; a contributed list is granted exactly, refused whole when it is not topic filters; and
 // the role is brought to exactly the wanted ACLs — missing ones added, stale ones removed — read from
 // `mosquitto_ctrl dynsec getRole` as eclipse-mosquitto 2.1.2 prints it.
 import { test } from "node:test";
 import assert from "node:assert/strict";
 import { filterProblem, missingAcls, parseRoleAcls, staleAcls, topicFilters, wantedAcls } from "../topics.ts";
 test("a consumer that contributed nothing gets its own subtree", () => {
  assert.deepEqual(topicFilters({}, "mesh_ace_hass"), { ok: true, filters: ["mesh_ace_hass/#"], own: true });
  assert.deepEqual(topicFilters(undefined, "x"), { ok: true, filters: ["x/#"], own: true });
  // Settings merge into every contribution: keys that are not `topics` change nothing.
  assert.deepEqual(topicFilters({ endpoints: { web: {} } }, "x"), { ok: true, filters: ["x/#"], own: true });
 });
 test("a contributed list is granted exactly, duplicates once", () => {
  assert.deepEqual(topicFilters({ topics: ["#"] }, "x"), { ok: true, filters: ["#"], own: false });
  assert.deepEqual(topicFilters({ topics: ["stat/+/POWER", "tele/#", "tele/#", "/octoprint/x"] }, "x"), {
    ok: true,
    filters: ["stat/+/POWER", "tele/#", "/octoprint/x"],
    own: false,
  });
 });
 test("a list that is not topic filters is refused whole", () => {
  for (const topics of [[], "#", [""], ["a/#/b"], ["a#"], ["a/b+"], [42], ["a\u0000b"], {}]) {
    const out = topicFilters({ topics } as Record<string, unknown>, "x");
    assert.equal(out.ok, false, JSON.stringify(topics));
  }
  assert.equal(filterProblem("+/+/#"), undefined);
  assert.equal(filterProblem("#"), undefined);
 });
 const GET_ROLE = `Warning: You are running mosquitto_ctrl without encryption.
 This means all of the configuration changes you are making are visible on the network, including passwords.
 Rolename: u1
 ACLs:     publishClientSend    : allow : # (priority: 0)
          subscribePattern     : allow : u1/# (priority: 0)
          publishClientReceive : deny : secret topic/with space (priority: -1)
 `;
 test("getRole's ACL lines are read, the warning and headings are not", () => {
  assert.deepEqual(parseRoleAcls(GET_ROLE), [
    { type: "publishClientSend", allow: true, topic: "#" },
    { type: "subscribePattern", allow: true, topic: "u1/#" },
    { type: "publishClientReceive", allow: false, topic: "secret topic/with space" },
  ]);
  assert.deepEqual(parseRoleAcls("Rolename: empty\nACLs:\n"), []);
 });
 test("the role is brought to exactly the wanted ACLs", () => {
  const current = parseRoleAcls(GET_ROLE);
  const wanted = wantedAcls(["u1/#"]);
  assert.deepEqual(wanted, [
    { type: "publishClientSend", allow: true, topic: "u1/#" },
    { type: "publishClientReceive", allow: true, topic: "u1/#" },
    { type: "subscribePattern", allow: true, topic: "u1/#" },
  ]);
  assert.deepEqual(missingAcls(current, wanted), [
    { type: "publishClientSend", allow: true, topic: "u1/#" },
    { type: "publishClientReceive", allow: true, topic: "u1/#" },
  ]);
  assert.deepEqual(staleAcls(current, wanted), [
    { type: "publishClientSend", allow: true, topic: "#" },
    { type: "publishClientReceive", allow: false, topic: "secret topic/with space" },
  ]);
  assert.deepEqual(staleAcls(wanted, wanted), []);
  assert.deepEqual(missingAcls(wanted, wanted), []);
 });
@@ -0,0 +1,107 @@
 // Which topics a consumer of `mqtt-topic` may use — the one choice a consumer makes about its grant.
 //
 // **By default, its own subtree and nothing else.** A consumer connects as the login the mesh derived
 // (`as`) and may publish, receive and subscribe under `<as>/#` — isolated from every other consumer,
 // which is the point of a per-consumer client (novox/hq ADR 0039/0048).
 //
 // **A consumer whose work IS the shared topic space says so.** Home Assistant discovers devices
 // under `homeassistant/#` and `tasmota/discovery/#` and follows whatever state topics they announce;
 // Node-RED's flows subscribe to the topics devices publish on (`stat/<device>/POWER`, …). Confined
 // to `<as>/#` neither could do its job. So a consumer contributes `topics` to its `mqtt-topic`
 // requirement — a list of MQTT topic filters — and the provisioner grants exactly those, both ways.
 // Because assignment settings merge into every contribution, an operator narrows (or widens) the
 // list per machine with the same key, without editing a manifest.
 //
 // Pure, so it is tested without a broker (test/topics.test.ts).
 /** The dynsec ACL types a granted filter carries: send to it, receive from it, subscribe to it. */
 export const GRANTED_ACL_TYPES = ["publishClientSend", "publishClientReceive", "subscribePattern"] as const;
 /** One ACL on a role, as `mosquitto_ctrl dynsec getRole` reports it. */
 export interface Acl {
  type: string;
  allow: boolean;
  topic: string;
 }
 export type Filters = { ok: true; filters: string[]; own: boolean } | { ok: false; problem: string };
 /**
 * The topic filters a consumer is granted: what it contributed as `topics`, or its own subtree when
 * it contributed nothing. Refused — never silently narrowed or widened — when the list is not a
 * list of valid MQTT topic filters: a grant that quietly differs from what was asked is a consumer
 * that fails somewhere far from the cause.
 */
 export function topicFilters(values: Readonly<Record<string, unknown>> | undefined, as: string): Filters {
  const given = values?.topics;
  if (given === undefined || given === null) {
    return { ok: true, filters: [`${as}/#`], own: true };
  }
  if (!Array.isArray(given) || given.length === 0) {
    return { ok: false, problem: `topics must be a non-empty list of MQTT topic filters, not ${JSON.stringify(given)}` };
  }
  const out: string[] = [];
  for (const f of given) {
    if (typeof f !== "string") {
      return { ok: false, problem: `topics holds ${JSON.stringify(f)}, which is not a topic filter` };
    }
    const problem = filterProblem(f);
    if (problem) return { ok: false, problem: `topic filter ${JSON.stringify(f)}: ${problem}` };
    if (!out.includes(f)) out.push(f);
  }
  return { ok: true, filters: out, own: out.length === 1 && out[0] === `${as}/#` };
 }
 /** Why a string is not a valid MQTT topic filter (MQTT 3.1.1 §4.7), or undefined when it is one. */
 export function filterProblem(filter: string): string | undefined {
  if (filter.length === 0) return "it is empty";
  if (Buffer.byteLength(filter, "utf8") > 65535) return "it is longer than MQTT allows";
  if (filter.includes("\u0000")) return "it contains a NUL character";
  const levels = filter.split("/");
  for (let i = 0; i < levels.length; i++) {
    const level = levels[i];
    if (level.includes("#") && (level !== "#" || i !== levels.length - 1)) {
      return "'#' must be a whole level, and the last one";
    }
    if (level.includes("+") && level !== "+") return "'+' must be a whole level";
  }
  return undefined;
 }
 /** The ACLs a role must carry to grant these filters: every granted type, allowed, on every filter. */
 export function wantedAcls(filters: readonly string[]): Acl[] {
  const out: Acl[] = [];
  for (const topic of filters) {
    for (const type of GRANTED_ACL_TYPES) out.push({ type, allow: true, topic });
  }
  return out;
 }
 /**
 * The ACLs `mosquitto_ctrl dynsec getRole` lists, one per line under its "ACLs:" heading:
 *   `ACLs:     publishClientSend    : allow : # (priority: 0)`
 *   `          subscribePattern     : allow : u1/# (priority: 0)`
 */
 export function parseRoleAcls(output: string): Acl[] {
  const out: Acl[] = [];
  const line = /^(?:ACLs:)?\s*([A-Za-z]+)\s*:\s*(allow|deny)\s*:\s*(.*?)\s+\(priority:\s*-?\d+\)\s*$/;
  for (const raw of output.split(/\r?\n/)) {
    const m = raw.match(line);
    if (m) out.push({ type: m[1], allow: m[2] === "allow", topic: m[3] });
  }
  return out;
 }
 const key = (a: Acl): string => `${a.type}\u0000${a.allow ? "allow" : "deny"}\u0000${a.topic}`;
 /** ACLs a role carries that it should not: in `current` and not in `wanted`. */
 export function staleAcls(current: readonly Acl[], wanted: readonly Acl[]): Acl[] {
  const want = new Set(wanted.map(key));
  return current.filter((a) => !want.has(key(a)));
 }
 /** ACLs a role should carry and does not. */
 export function missingAcls(current: readonly Acl[], wanted: readonly Acl[]): Acl[] {
  const have = new Set(current.map(key));
  return wanted.filter((a) => !have.has(key(a)));
 }
@@ -8,5 +8,5 @@
    "skipLibCheck": true,
    "noEmit": true
  },
-  "include": ["client.ts", "index.ts", "provisioner/index.ts", "tools/index.ts", "bootstrap/index.ts"]
+  "include": ["topics.ts", "client.ts", "index.ts", "provisioner/index.ts", "tools/index.ts", "bootstrap/index.ts"]
 }
@@ -81,7 +81,7 @@
      ],
      "env": {
        "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_NZBGET_URL": "http://127.0.0.1:${port:6789}",
+        "MESH_NZBGET_URL": "http://127.0.0.1:6789",
        "MESH_NZBGET_PASSWORD_FILE": "/run/secrets/password",
        "MESH_NZBGET_CONFIG_FILE": "/run/config/config.json",
        "MESH_NZBGET_CONFIG_DIR": "/var/lib/nzbget/config"
@@ -13,7 +13,7 @@ ARG RUNTIME_BASE
 FROM ${BUILD_BASE} AS build
 WORKDIR /app/modules/ombi
 COPY . .
-RUN node /app/node_modules/typescript/bin/tsc client.ts index.ts tools/index.ts servarr/settings.ts servarr/index.ts \
+RUN node /app/node_modules/typescript/bin/tsc client.ts index.ts tools/index.ts \
      --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist
 FROM ${RUNTIME_BASE}
@@ -22,6 +22,3 @@ COPY --from=build /app/modules/ombi/dist /app/modules/ombi/dist
 # provider's provisioner runs its reconcile loop in the same process, with the broker connected —
 # the convention novox/hq issues 060/061 settled.
 ENV MESH_TOOL_MODULES=/app/modules/ombi/dist/index.js,/app/modules/ombi/dist/tools/index.js
 # NOT dist/servarr/index.js: that is a step the host runs to completion, named by the `servarr`
 # container's args as `mesh-tools run …` (novox/hq ADR 0052). Listed here it would run inside the
 # serving sidecar too, and exit it.
@@ -28,15 +28,10 @@
      "path": "/var/lib/mesh/ombi",
      "mode": "0700"
    },
    {
      "id": "state",
      "type": "directory",
      "mode": "0700",
      "place": "."
    },
    {
      "id": "config",
      "type": "directory",
      "path": "/services/ombi/config",
      "mode": "0700",
      "owner": "1000:1000"
    },
@@ -44,7 +39,7 @@
      "id": "server",
      "type": "container",
      "name": "ombi",
-      "image": "lscr.io/linuxserver/ombi@sha256:22d6ebadbaaa728571353e74dc2173719e0fb02d4eaec551a7e9d2ee99ef68ac",
+      "image": "lscr.io/linuxserver/ombi@sha256:a6f76ac521ba01eee2e9f0c23a3fed22e56630d97a04d5eeaeaa36c1e681640d",
      "env": {
        "PUID": "1000",
        "PGID": "1000",
@@ -54,7 +49,7 @@
        "3579"
      ],
      "volumes": [
-        "${dir:config}:/config"
+        "/services/ombi/config:/config"
      ]
    },
    {
@@ -73,59 +68,24 @@
      "volumes": [
        "/var/lib/mesh/ombi/broker:/run/secrets/broker:ro",
        "/var/lib/mesh/ombi/api-key:/run/secrets/api-key:ro",
-        "/var/lib/mesh/ombi/config.json:/run/config/config.json:ro"
+        "/var/lib/mesh/ombi/config.json:/run/config/config.json:ro",
        "/services/ombi/config:/var/lib/ombi/config:ro"
      ],
      "env": {
        "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_OMBI_URL": "http://127.0.0.1:${port:3579}",
+        "MESH_OMBI_URL": "http://127.0.0.1:3579",
        "MESH_OMBI_API_KEY_FILE": "/run/secrets/api-key",
-        "MESH_OMBI_CONFIG_FILE": "/run/config/config.json"
+        "MESH_OMBI_CONFIG_FILE": "/run/config/config.json",
        "MESH_OMBI_CONFIG_DIR": "/var/lib/ombi/config"
      },
      "restart-on": [
        "runtime-config"
      ],
      "artifact": "runtime"
    },
    {
      "id": "servarr",
      "type": "container",
      "name": "mesh-ombi-servarr",
      "network": "host",
      "run-once": true,
      "volumes": [
        "/var/lib/mesh/ombi/api-key:/run/secrets/api-key:ro",
        "${dir:state}/sonarr-api.json:/run/servarr/sonarr-api.json:ro",
        "${dir:state}/sonarr-api.secret:/run/servarr/sonarr-api.secret:ro",
        "${dir:state}/radarr-api.json:/run/servarr/radarr-api.json:ro",
        "${dir:state}/radarr-api.secret:/run/servarr/radarr-api.secret:ro",
        "${dir:state}/lidarr-api.json:/run/servarr/lidarr-api.json:ro",
        "${dir:state}/lidarr-api.secret:/run/servarr/lidarr-api.secret:ro"
      ],
      "env": {
        "MESH_OMBI_URL": "http://127.0.0.1:${port:3579}",
        "MESH_OMBI_API_KEY_FILE": "/run/secrets/api-key",
        "MESH_SERVARR_DIR": "/run/servarr"
      },
      "args": [
        "run",
        "/app/modules/ombi/dist/servarr/index.js"
      ],
      "restart-on": [
        "bound-sonarr-api",
        "secret-sonarr-api",
        "bound-radarr-api",
        "secret-radarr-api",
        "bound-lidarr-api",
        "secret-lidarr-api"
      ],
      "artifact": "runtime"
    }
  ],
  "requires": [
-    "lidarr-api",
+    "route"
    "radarr-api",
    "route",
    "sonarr-api"
  ],
  "contributes": {
    "route": {
@@ -134,15 +94,7 @@
    }
  },
  "binds": {
-    "route": "${dir:state}/route.json",
+    "route": "/var/lib/mesh/ombi/route.json"
    "sonarr-api": "${dir:state}/sonarr-api.json",
    "radarr-api": "${dir:state}/radarr-api.json",
    "lidarr-api": "${dir:state}/lidarr-api.json"
  },
  "secrets": {
    "sonarr-api": "${dir:state}/sonarr-api.secret",
    "radarr-api": "${dir:state}/radarr-api.secret",
    "lidarr-api": "${dir:state}/lidarr-api.secret"
  },
  "build": {
    "on": [
@@ -4,11 +4,6 @@
  "description": "ombi — media requests. Its API client, tools and events live here (novox/hq ADR 0039).",
  "type": "module",
  "private": true,
  "scripts": {
    "build": "tsc client.ts index.ts tools/index.ts servarr/settings.ts servarr/index.ts --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist",
    "typecheck": "tsc -p tsconfig.json",
    "test": "node --test --experimental-strip-types 'test/*.test.ts'"
  },
  "dependencies": {
    "@novox/mesh-sdk": "^0.1.0"
  },
@@ -1,59 +0,0 @@
 // ombi's Servarr step — run once by the host after ombi's server starts, and run again whenever a
 // binding or pair credential it reads changes (the container's `restart-on`, novox/hq ADR 0099).
 //
 // **A step, not a loop**, for the reason route-adapter gives: everything it does is a function of
 // files the mesh writes, and the host already knows when they change. It connects to no broker.
 //
 // Exits non-zero when any app could not be put right — a refused credential, an unreachable app, an
 // ombi that cannot reach it — so the node reports the step failed and the host runs it again on the
 // next apply. It is declared last in the manifest, so its failing gates nothing else of ombi's
 // (novox/hq ADR 0136).
 //
 // Reads, per app, `<dir>/<provision>.json` (the binding) and `<dir>/<provision>.secret` (the pair
 // credential), where <dir> is MESH_SERVARR_DIR. Never prints a key.
 import { join } from "node:path";
 import { APPS, ombiReady, readBinding, readIfThere, reconcileApp, type Http } from "./settings.js";
 const dir = process.env.MESH_SERVARR_DIR ?? "/run/servarr";
 const url = process.env.MESH_OMBI_URL ?? "http://127.0.0.1:3579";
 const apiKey = (await readIfThere(process.env.MESH_OMBI_API_KEY_FILE))?.trim() ?? process.env.MESH_OMBI_API_KEY ?? "";
 const waitSeconds = Number(process.env.MESH_OMBI_WAIT_SECONDS ?? "180");
 const http: Http = { fetch: (u, init) => fetch(u, init) };
 if (!apiKey) {
  console.error("[ombi-servarr] no ombi API key — ombi's own `api-key` secret has not been accepted");
  process.exit(1);
 }
 const ombi = { url, apiKey };
 if (!(await ombiReady(http, ombi, waitSeconds * 1000))) {
  console.error(`[ombi-servarr] ombi did not answer at ${url} within ${waitSeconds}s`);
  process.exit(1);
 }
 let failed = 0;
 for (const spec of APPS) {
  const outcome = await reconcileApp(
    http,
    ombi,
    spec,
    await readBinding(join(dir, `${spec.provision}.json`)),
    await readIfThere(join(dir, `${spec.provision}.secret`)),
  );
  switch (outcome.result) {
    case "unchanged":
      console.log(`[ombi-servarr] ${outcome.app}: already as the mesh says; connection tested`);
      break;
    case "written":
      console.log(`[ombi-servarr] ${outcome.app}: wrote ${outcome.fields.join(", ")}; connection tested`);
      break;
    case "refused":
      failed++;
      console.error(`[ombi-servarr] ${outcome.app}: ${outcome.problem}`);
      break;
  }
 }
 process.exitCode = failed > 0 ? 1 : 0;
@@ -1,304 +0,0 @@
 // Where ombi reaches Sonarr, Radarr and Lidarr — decided by the mesh, written into ombi by ombi's
 // own API.
 //
 // **Why this exists.** ombi keeps its connection to each Servarr app in its own database
 // (OmbiSettings.db), not in a file, so the mesh has nowhere to write `${bound:sonarr-api:at}` for it.
 // ombi requires `sonarr-api`, `radarr-api` and `lidarr-api`; the mesh delivers, for each, a binding
 // (where the app is: `at`, and what it serves: `port`, `scheme`, `url-base`) and a pair credential
 // (the app's API key, accepted by the operator — a Servarr app has exactly one key and the mesh
 // cannot mint it). This step reads those files and makes ombi's settings say the same thing.
 //
 // **Only the connection, and only when it differs.** Host, port, TLS, base path and API key. The
 // quality profile, root folder, language profile, tags, "enabled" and every other choice an operator
 // made in ombi's settings screen are left exactly as they are: the mesh knows where the app is, not
 // what ombi should do with it. Radarr's 4K instance is a different Radarr and is not touched.
 //
 // **A credential the app refuses is never written.** Until the operator accepts the app's API key
 // for this pair, the mesh delivers a value it minted itself, which no Servarr app will ever accept
 // (novox/hq ADR 0092). Writing it would replace a working key in ombi with a dead one. So the key is
 // tried against the app first; refused, nothing for that app is written and the step fails naming
 // the `secret accept` that fixes it.
 //
 // Pure logic and a small HTTP seam, so it is tested against fake servers (test/servarr.test.ts).
 import { readFile } from "node:fs/promises";
 /** One Servarr app ombi connects to, and the shape of that connection in ombi's API. */
 export interface ServarrApp {
  /** The app, as ombi's API names it: /Settings/<app>, /Tester/<app>. */
  app: "sonarr" | "radarr" | "lidarr";
  /** The provision it is required as — the manifest's `requires`, `binds` and `secrets` key. */
  provision: string;
  /** The app's own status endpoint, which answers 401 to a wrong key. */
  statusPath: string;
  /**
   * Where the one connection sits in ombi's settings document. Radarr's is `{radarr, radarr4K}`
   * (two Radarr instances); only `radarr` is this provision's.
   */
  within?: string;
 }
 export const APPS: readonly ServarrApp[] = [
  { app: "sonarr", provision: "sonarr-api", statusPath: "/api/v3/system/status" },
  { app: "radarr", provision: "radarr-api", statusPath: "/api/v3/system/status", within: "radarr" },
  { app: "lidarr", provision: "lidarr-api", statusPath: "/api/v1/system/status" },
 ];
 /** The connection fields ombi keeps for an app — the only ones this step ever writes. */
 export interface Connection {
  ip: string;
  port: number;
  ssl: boolean;
  /** ombi's name for the app's URL base; null when the app is served at the root. */
  subDir: string | null;
  apiKey: string;
 }
 /** What the mesh wrote at `binds.<provision>`: the binding document (controller's boundFile). */
 export interface Binding {
  provision?: string;
  from?: string;
  at?: string;
  as?: string;
  serves?: Record<string, unknown>;
 }
 export type Wanted = { ok: true; connection: Connection; from: string } | { ok: false; problem: string };
 /**
 * The connection the mesh says ombi should use, from the binding and the pair credential.
 *
 * Refused rather than guessed when the binding cannot be dialled from ombi's own container: a
 * loopback `at` — what the mesh hands a machine that is not on the private network — is ombi's
 * container itself, not the app.
 */
 export function wanted(spec: ServarrApp, binding: Binding | undefined, credential: string | undefined): Wanted {
  if (!binding) {
    return { ok: false, problem: `no binding for ${spec.provision} was delivered — the mesh writes it before this step runs` };
  }
  const at = typeof binding.at === "string" ? binding.at.trim() : "";
  const serves = binding.serves ?? {};
  const port = Number(serves.port);
  if (!at) {
    return { ok: false, problem: `the ${spec.provision} binding names no host (at)` };
  }
  if (isLoopback(at)) {
    return {
      ok: false,
      problem:
        `the ${spec.provision} binding says ${spec.app} is at ${at}, which from ombi's own container is ` +
        `ombi itself. The mesh hands loopback to a machine that is not on the private network; put it ` +
        `on the private network so ${spec.app} has an address ombi can dial`,
    };
  }
  if (!Number.isInteger(port) || port <= 0 || port > 65535) {
    return { ok: false, problem: `the ${spec.provision} binding serves no usable port (${String(serves.port)})` };
  }
  const scheme = typeof serves.scheme === "string" && serves.scheme ? serves.scheme : "http";
  if (scheme !== "http" && scheme !== "https") {
    return { ok: false, problem: `the ${spec.provision} binding serves scheme ${scheme}, which ombi cannot dial` };
  }
  const key = (credential ?? "").trim();
  if (!key) {
    return { ok: false, problem: `the ${spec.provision} credential is empty or was not delivered` };
  }
  return {
    ok: true,
    from: typeof binding.from === "string" ? binding.from : "",
    connection: { ip: at, port, ssl: scheme === "https", subDir: subDirOf(serves["url-base"]), apiKey: key },
  };
 }
 /** ombi's `subDir`: the URL base with its slashes trimmed, null when there is none. */
 export function subDirOf(urlBase: unknown): string | null {
  const trimmed = typeof urlBase === "string" ? urlBase.trim().replace(/^\/+|\/+$/g, "") : "";
  return trimmed === "" ? null : trimmed;
 }
 function isLoopback(host: string): boolean {
  const h = host.toLowerCase();
  return h === "localhost" || h === "::1" || h === "[::1]" || /^127\./.test(h);
 }
 /** Which connection fields differ between what ombi holds and what the mesh says. Names only. */
 export function differing(current: Record<string, unknown> | undefined, want: Connection): (keyof Connection)[] {
  const now = current ?? {};
  const out: (keyof Connection)[] = [];
  if (String(now.ip ?? "") !== want.ip) out.push("ip");
  if (Number(now.port ?? 0) !== want.port) out.push("port");
  if (Boolean(now.ssl) !== want.ssl) out.push("ssl");
  if (subDirOf(now.subDir) !== want.subDir) out.push("subDir");
  if (String(now.apiKey ?? "") !== want.apiKey) out.push("apiKey");
  return out;
 }
 /** ombi's settings for the app with the connection laid over them and nothing else changed. */
 export function withConnection(current: Record<string, unknown> | undefined, want: Connection): Record<string, unknown> {
  return { ...(current ?? {}), ip: want.ip, port: want.port, ssl: want.ssl, subDir: want.subDir, apiKey: want.apiKey };
 }
 /** The app's base URL as the step dials it — the same host and port ombi will be given. */
 export function appUrl(want: Connection): string {
  const scheme = want.ssl ? "https" : "http";
  const host = want.ip.includes(":") && !want.ip.startsWith("[") ? `[${want.ip}]` : want.ip;
  return `${scheme}://${host}:${want.port}${want.subDir ? `/${want.subDir}` : ""}`;
 }
 /** How one app came out. */
 export type Outcome =
  | { app: string; result: "unchanged" }
  | { app: string; result: "written"; fields: string[] }
  | { app: string; result: "refused"; problem: string };
 /** The HTTP the step needs, so a test can stand fakes in for ombi and the apps. */
 export interface Http {
  fetch(url: string, init?: { method?: string; headers?: Record<string, string>; body?: string }): Promise<{
    status: number;
    text(): Promise<string>;
  }>;
 }
 export interface Ombi {
  url: string;
  apiKey: string;
 }
 async function ombiCall(http: Http, ombi: Ombi, method: string, path: string, body?: unknown): Promise<unknown> {
  const res = await http.fetch(`${ombi.url.replace(/\/$/, "")}/api/v1${path}`, {
    method,
    headers: {
      ApiKey: ombi.apiKey,
      Accept: "application/json",
      ...(body !== undefined ? { "Content-Type": "application/json" } : {}),
    },
    body: body !== undefined ? JSON.stringify(body) : undefined,
  });
  const text = await res.text();
  if (res.status < 200 || res.status >= 300) {
    // The body is ombi's error, never a request echo, so it carries no key.
    throw new Error(`ombi ${method} ${path} answered ${res.status}${text ? `: ${text.slice(0, 200)}` : ""}`);
  }
  return text ? (JSON.parse(text) as unknown) : undefined;
 }
 /**
 * Does the app take this key? `true` it does, `false` it refused it (401/403), and a thrown error
 * when it could not be asked — unreachable, or answering something that is neither.
 */
 export async function appTakes(http: Http, spec: ServarrApp, want: Connection): Promise<boolean> {
  const res = await http.fetch(`${appUrl(want)}${spec.statusPath}`, {
    method: "GET",
    headers: { "X-Api-Key": want.apiKey, Accept: "application/json" },
  });
  if (res.status === 401 || res.status === 403) return false;
  if (res.status >= 200 && res.status < 300) return true;
  throw new Error(`${spec.app} answered ${res.status} at ${spec.statusPath}`);
 }
 /** The remedy for a refused key, in the controller's own words (ADR 0092). */
 export function acceptRemedy(spec: ServarrApp, from: string): string {
  return (
    `${spec.app} refuses the ${spec.provision} credential the mesh delivered, so it was not written ` +
    `into ombi. A Servarr app has one API key and the mesh cannot make it: accept ${spec.app}'s own ` +
    `key for this pair — \`secret accept <this node> ombi ${spec.provision} --provider ${from || "<its node>"} ` +
    `--from <file holding ${spec.app}'s ApiKey>\``
  );
 }
 /**
 * Bring ombi's connection to one app in line with the mesh: check the key against the app, compare,
 * write only the connection fields when they differ, then have ombi test the connection from its own
 * container. Never throws: every failure is an outcome with a reason.
 */
 export async function reconcileApp(
  http: Http,
  ombi: Ombi,
  spec: ServarrApp,
  binding: Binding | undefined,
  credential: string | undefined,
 ): Promise<Outcome> {
  const w = wanted(spec, binding, credential);
  // `in`, not `!w.ok`: the Dockerfile compiles without strict, where a boolean discriminant does not
  // narrow.
  if ("problem" in w) return { app: spec.app, result: "refused", problem: w.problem };
  const want = w.connection;
  try {
    if (!(await appTakes(http, spec, want))) {
      return { app: spec.app, result: "refused", problem: acceptRemedy(spec, w.from) };
    }
  } catch (err) {
    return {
      app: spec.app,
      result: "refused",
      problem: `${spec.app} could not be asked whether it takes the key at ${want.ip}:${want.port}: ${message(err)}`,
    };
  }
  try {
    const document = (await ombiCall(http, ombi, "GET", `/Settings/${spec.app}`)) as Record<string, unknown> | undefined;
    const current = spec.within ? (document?.[spec.within] as Record<string, unknown> | undefined) : document;
    const fields = differing(current, want);
    if (fields.length > 0) {
      const next = withConnection(current, want);
      const body = spec.within ? { ...(document ?? {}), [spec.within]: next } : next;
      const saved = await ombiCall(http, ombi, "POST", `/Settings/${spec.app}`, body);
      if (saved === false) {
        return { app: spec.app, result: "refused", problem: `ombi declined to save its ${spec.app} settings` };
      }
    }
    // ombi's own test, from ombi's own container — the path the step's check above did not take.
    const tested = (await ombiCall(http, ombi, "POST", `/Tester/${spec.app}`, withConnection(current, want))) as
      | { isValid?: boolean; expectedSubDir?: string | null }
      | undefined;
    if (!tested?.isValid) {
      const hint = tested?.expectedSubDir ? ` (ombi expected the base path ${tested.expectedSubDir})` : "";
      return {
        app: spec.app,
        result: "refused",
        problem:
          `ombi cannot reach ${spec.app} at ${want.ip}:${want.port} from its own container${hint}` +
          (fields.length > 0 ? `; its settings were written (${fields.join(", ")})` : ""),
      };
    }
    return fields.length > 0 ? { app: spec.app, result: "written", fields } : { app: spec.app, result: "unchanged" };
  } catch (err) {
    return { app: spec.app, result: "refused", problem: message(err) };
  }
 }
 /** Wait for ombi to answer, because the step runs right after its container starts. */
 export async function ombiReady(http: Http, ombi: Ombi, waitMs: number, pauseMs = 2000): Promise<boolean> {
  const until = Date.now() + waitMs;
  for (;;) {
    try {
      const res = await http.fetch(`${ombi.url.replace(/\/$/, "")}/api/v1/Status`, { method: "GET" });
      if (res.status === 200) return true;
    } catch {
      // not listening yet
    }
    if (Date.now() >= until) return false;
    await new Promise((r) => setTimeout(r, pauseMs));
  }
 }
 /** A file the mesh wrote, or undefined when it is not there. */
 export async function readIfThere(path: string | undefined): Promise<string | undefined> {
  if (!path) return undefined;
  return readFile(path, "utf8").catch(() => undefined);
 }
 /** A binding file parsed, or undefined when absent or not JSON. */
 export async function readBinding(path: string | undefined): Promise<Binding | undefined> {
  const raw = await readIfThere(path);
  if (raw === undefined) return undefined;
  try {
    return JSON.parse(raw) as Binding;
  } catch {
    return undefined;
  }
 }
 function message(err: unknown): string {
  return err instanceof Error ? err.message : String(err);
 }
@@ -1,147 +0,0 @@
 // What holds ombi's Servarr step (servarr/settings.ts): the connection ombi keeps for each app is
 // made to say what the mesh bound — host, port, TLS, base path, key — and nothing else it keeps is
 // touched; nothing is written when nothing differs; Radarr's 4K instance is left alone; and a key the
 // app refuses (the mesh's own minted value, before the operator accepts the app's key) is never
 // written, with the `secret accept` that fixes it named.
 //
 // ombi and the apps are fakes: the routes the step touches, answering as the real ones do (checked
 // against lscr.io/linuxserver/ombi 4.53.10 and the catalogue's pinned sonarr/radarr/lidarr).
 import { test } from "node:test";
 import assert from "node:assert/strict";
 import { APPS, differing, reconcileApp, subDirOf, wanted, type Binding, type Http, type ServarrApp } from "../servarr/settings.ts";
 const SONARR = APPS.find((a) => a.app === "sonarr") as ServarrApp;
 const RADARR = APPS.find((a) => a.app === "radarr") as ServarrApp;
 const LIDARR = APPS.find((a) => a.app === "lidarr") as ServarrApp;
 const THE_KEY = "the-apps-own-key";
 function binding(provision: string, port: number, at = "ace.internal"): Binding {
  return { binding: 1, provision, from: "ace", at, as: "mesh_ace_ombi", serves: { scheme: "http", port, "url-base": "" } } as Binding;
 }
 interface Call {
  method: string;
  url: string;
  body?: unknown;
 }
 /** ombi's settings store and the apps' key check, behind one fetch. */
 function fakes(settings: Record<string, unknown>, opts: { appKey?: string; reachable?: boolean } = {}) {
  const calls: Call[] = [];
  const appKey = opts.appKey ?? THE_KEY;
  const http: Http = {
    async fetch(url, init) {
      const method = init?.method ?? "GET";
      const body = init?.body ? (JSON.parse(init.body) as unknown) : undefined;
      calls.push({ method, url, body });
      const reply = (status: number, value?: unknown) => ({
        status,
        text: async () => (value === undefined ? "" : JSON.stringify(value)),
      });
      const u = new URL(url);
      if (u.pathname.endsWith("/system/status")) {
        if (opts.reachable === false) throw new Error("connect ECONNREFUSED");
        return init?.headers?.["X-Api-Key"] === appKey ? reply(200, { version: "4" }) : reply(401);
      }
      if (init?.headers?.ApiKey !== "ombi-key") return reply(401);
      const m = u.pathname.match(/^\/api\/v1\/(Settings|Tester)\/(\w+)$/);
      if (!m) return reply(404);
      const [, kind, app] = m;
      if (kind === "Settings" && method === "GET") return reply(200, settings[app]);
      if (kind === "Settings" && method === "POST") {
        settings[app] = body;
        return reply(200, true);
      }
      const tried = body as { apiKey?: string };
      return reply(200, { isValid: tried.apiKey === appKey, expectedSubDir: null });
    },
  };
  return { http, calls, settings };
 }
 const OMBI = { url: "http://127.0.0.1:3579", apiKey: "ombi-key" };
 const operatorSonarr = () => ({
  enabled: true, apiKey: "old-key", qualityProfile: "3", seasonFolders: true, rootPath: "10",
  qualityProfileAnime: "7", rootPathAnime: "9", languageProfile: 1, ssl: false, subDir: null,
  ip: "sonarr", port: 8989, id: 5,
 });
 test("it writes the connection the mesh bound, and keeps every other setting ombi had", async () => {
  const f = fakes({ sonarr: operatorSonarr() });
  const out = await reconcileApp(f.http, OMBI, SONARR, binding("sonarr-api", 20101), `${THE_KEY}\n`);
  assert.deepEqual(out, { app: "sonarr", result: "written", fields: ["ip", "port", "apiKey"] });
  assert.deepEqual(f.settings.sonarr, {
    ...operatorSonarr(), ip: "ace.internal", port: 20101, apiKey: THE_KEY, ssl: false, subDir: null,
  });
  // Checked against the app itself, at the bound address, before anything was written.
  assert.equal(f.calls[0].url, "http://ace.internal:20101/api/v3/system/status");
 });
 test("nothing is written when ombi already says what the mesh says", async () => {
  const f = fakes({ sonarr: { ...operatorSonarr(), ip: "ace.internal", port: 20101, apiKey: THE_KEY } });
  const out = await reconcileApp(f.http, OMBI, SONARR, binding("sonarr-api", 20101), THE_KEY);
  assert.deepEqual(out, { app: "sonarr", result: "unchanged" });
  assert.equal(f.calls.filter((c) => c.method === "POST" && c.url.includes("/Settings/")).length, 0);
 });
 test("a key the app refuses is never written, and the accept that fixes it is named", async () => {
  const f = fakes({ sonarr: operatorSonarr() });
  const out = await reconcileApp(f.http, OMBI, SONARR, binding("sonarr-api", 20101), "a-value-the-mesh-minted");
  assert.equal(out.result, "refused");
  assert.match((out as { problem: string }).problem, /secret accept <this node> ombi sonarr-api --provider ace/);
  assert.doesNotMatch((out as { problem: string }).problem, /a-value-the-mesh-minted/);
  assert.deepEqual(f.settings.sonarr, operatorSonarr(), "ombi's working settings were left alone");
  assert.equal(f.calls.some((c) => c.url.includes("/api/v1/")), false, "ombi was not even asked");
 });
 test("an app it cannot reach is reported, and ombi is left alone", async () => {
  const f = fakes({ sonarr: operatorSonarr() }, { reachable: false });
  const out = await reconcileApp(f.http, OMBI, SONARR, binding("sonarr-api", 20101), THE_KEY);
  assert.equal(out.result, "refused");
  assert.match((out as { problem: string }).problem, /could not be asked.*ECONNREFUSED/);
  assert.deepEqual(f.settings.sonarr, operatorSonarr());
 });
 test("radarr's connection is written inside its combined document, and the 4K instance is untouched", async () => {
  const fourK = { enabled: true, apiKey: "4k-key", ip: "radarr4k", port: 7879, defaultQualityProfile: "9", id: 7 };
  const f = fakes({ radarr: { radarr: { enabled: true, apiKey: "old", ip: "radarr", port: 7878, defaultRootPath: "/movies", id: 6 }, radarr4K: fourK } });
  const out = await reconcileApp(f.http, OMBI, RADARR, binding("radarr-api", 20102), THE_KEY);
  assert.equal(out.result, "written");
  const doc = f.settings.radarr as { radarr: Record<string, unknown>; radarr4K: unknown };
  assert.deepEqual(doc.radarr4K, fourK);
  assert.equal(doc.radarr.ip, "ace.internal");
  assert.equal(doc.radarr.port, 20102);
  assert.equal(doc.radarr.defaultRootPath, "/movies");
 });
 test("lidarr is checked on its own API version", async () => {
  const f = fakes({ lidarr: { enabled: true, apiKey: null, ip: null, port: 0, id: 0 } });
  const out = await reconcileApp(f.http, OMBI, LIDARR, binding("lidarr-api", 20103), THE_KEY);
  assert.equal(out.result, "written");
  assert.equal(f.calls[0].url, "http://ace.internal:20103/api/v1/system/status");
 });
 test("a loopback binding is refused: from ombi's container it is ombi itself", () => {
  const w = wanted(SONARR, binding("sonarr-api", 20101, "127.0.0.1"), THE_KEY);
  assert.equal(w.ok, false);
  assert.match((w as { problem: string }).problem, /private network/);
 });
 test("the base path is ombi's subDir, slashes trimmed; empty is none", () => {
  assert.equal(subDirOf(""), null);
  assert.equal(subDirOf("/sonarr/"), "sonarr");
  assert.deepEqual(
    differing({ ip: "h", port: 1, ssl: false, subDir: "", apiKey: "k" }, { ip: "h", port: 1, ssl: false, subDir: null, apiKey: "k" }),
    [],
  );
 });
 test("an https binding sets ombi's ssl flag", () => {
  const b = binding("sonarr-api", 443);
  (b.serves as Record<string, unknown>).scheme = "https";
  const w = wanted(SONARR, b, THE_KEY);
  assert.equal(w.ok && w.connection.ssl, true);
 });
@@ -8,5 +8,5 @@
    "skipLibCheck": true,
    "noEmit": true
  },
-  "include": ["client.ts", "index.ts", "tools/index.ts", "servarr/settings.ts", "servarr/index.ts"]
+  "include": ["client.ts", "index.ts", "tools/index.ts"]
 }
@@ -82,7 +82,7 @@
      ],
      "env": {
        "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_QBITTORRENT_URL": "http://127.0.0.1:${port:8080}",
+        "MESH_QBITTORRENT_URL": "http://127.0.0.1:8080",
        "MESH_QBITTORRENT_PASSWORD_FILE": "/run/secrets/password",
        "MESH_QBITTORRENT_CONFIG_FILE": "/run/config/config.json",
        "MESH_QBITTORRENT_CONFIG_DIR": "/var/lib/qbittorrent/config"
@@ -13,7 +13,7 @@ ARG RUNTIME_BASE
 FROM ${BUILD_BASE} AS build
 WORKDIR /app/modules/radarr
 COPY . .
-RUN node /app/node_modules/typescript/bin/tsc client.ts index.ts tools/index.ts downloads/settings.ts downloads/index.ts \
+RUN node /app/node_modules/typescript/bin/tsc client.ts index.ts tools/index.ts \
      --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist
 FROM ${RUNTIME_BASE}
@@ -22,6 +22,3 @@ COPY --from=build /app/modules/radarr/dist /app/modules/radarr/dist
 # provider's provisioner runs its reconcile loop in the same process, with the broker connected —
 # the convention novox/hq issues 060/061 settled.
 ENV MESH_TOOL_MODULES=/app/modules/radarr/dist/index.js,/app/modules/radarr/dist/tools/index.js
 # NOT dist/downloads/index.js: that is a step the host runs to completion, named by the `downloads`
 # container's args as `mesh-tools run …` (novox/hq ADR 0052). Listed here it would run inside the
 # serving sidecar too, and exit it.
@@ -1,188 +0,0 @@
 // The downloads step — run once by the host after the app's server starts, and again whenever a
 // binding, a pair credential or the step's settings change (the container's `restart-on`,
 // novox/hq ADR 0099). Byte-identical in sonarr, radarr, lidarr and bookshelf; see settings.ts.
 //
 // **A step, not a loop**: everything it does is a function of files the mesh writes, and the host
 // already knows when they change. It connects to no broker.
 //
 // Exits non-zero when anything could not be put right — a refused credential, an unreachable
 // provider, an entry the app would not save — so the node reports the step failed and the host
 // runs it again on the next apply. Declared last in the manifest, so its failing gates nothing
 // else of the module's (novox/hq ADR 0136).
 //
 // Reads, in MESH_DOWNLOADS_DIR, `<provision>.json` (the binding), `<provision>.secret` (the pair
 // credential) and the settings file; remembers in MESH_DOWNLOADS_MEMORY the jackett hosts it has
 // pointed feeds at, so a jackett that moves takes its feeds with it. Never prints a credential.
 import { mkdir, rename, writeFile } from "node:fs/promises";
 import { dirname, join } from "node:path";
 import {
  CLIENTS,
  JACKETT,
  acceptRemedy,
  appConfig,
  appReady,
  listEntries,
  providerTakes,
  readIfThere,
  readJson,
  reconcileClient,
  reconcileIndexers,
  scrub,
  stepSettings,
  wanted,
  type App,
  type Binding,
  type Http,
  type Entry,
  type Outcome,
  type Took,
 } from "./settings.js";
 const module = process.env.MESH_DOWNLOADS_APP ?? "app";
 const dir = process.env.MESH_DOWNLOADS_DIR ?? "/run/downloads";
 const settingsFile = process.env.MESH_DOWNLOADS_SETTINGS ?? join(dir, "downloads.json");
 const memoryFile = process.env.MESH_DOWNLOADS_MEMORY ?? "/var/lib/downloads/memory.json";
 const waitSeconds = Number(process.env.MESH_DOWNLOADS_WAIT_SECONDS ?? "180");
 const tag = `[${module}-downloads]`;
 const http: Http = { fetch: (u, init) => fetch(u, init) };
 const secrets: string[] = [];
 const say = (line: string) => console.log(scrub(`${tag} ${line}`, secrets));
 const fail = (line: string) => console.error(scrub(`${tag} ${line}`, secrets));
 const config = appConfig((await readIfThere(process.env.MESH_DOWNLOADS_APP_CONFIG)) ?? "");
 if (!config.apiKey) {
  fail(`no API key in ${module}'s config.xml yet — ${module} writes it on its first start; the step runs again on the next apply`);
  process.exit(1);
 }
 secrets.push(config.apiKey);
 const app: App = {
  module,
  url: `${(process.env.MESH_DOWNLOADS_APP_URL ?? "http://127.0.0.1").replace(/\/$/, "")}${config.urlBase}`,
  apiKey: config.apiKey,
  api: process.env.MESH_DOWNLOADS_API ?? "v3",
 };
 const settings = stepSettings(await readJson(settingsFile));
 if (!(await appReady(http, app, waitSeconds * 1000))) {
  fail(`${module} did not answer at ${app.url} within ${waitSeconds}s`);
  process.exit(1);
 }
 const outcomes: Outcome[] = [];
 // The download clients.
 let clients: Entry[];
 try {
  clients = await listEntries(http, app, "downloadclient");
 } catch (err) {
  fail(err instanceof Error ? err.message : String(err));
  process.exit(1);
 }
 for (const kind of CLIENTS) {
  const credential = await readIfThere(join(dir, `${kind.provision}.secret`));
  if (credential) secrets.push(credential.trim());
  const w = wanted(kind.provision, (await readJson(join(dir, `${kind.provision}.json`))) as Binding | undefined, credential, true);
  // `in`, not `!w.ok`: the Dockerfile compiles without strict, where a boolean discriminant does not
  // narrow.
  if ("problem" in w) {
    outcomes.push({ what: kind.provision, result: "refused", problem: w.problem });
    continue;
  }
  const ep = w.endpoint;
  try {
    if (!(await providerTakes(http, kind.provision, ep)).took) {
      outcomes.push({
        what: kind.provision,
        result: "refused",
        problem: acceptRemedy(app, settings.node, kind.provision, kind.provider, kind.secretName, ep.from),
      });
      continue;
    }
  } catch (err) {
    outcomes.push({
      what: kind.provision,
      result: "refused",
      problem: `${kind.provider} could not be asked whether it takes the credential at ${ep.host}:${ep.port}: ${err instanceof Error ? err.message : String(err)}`,
    });
    continue;
  }
  outcomes.push(...(await reconcileClient(http, app, kind, settings.names[kind.provision], ep, clients)));
 }
 // The indexers, through jackett.
 {
  const credential = await readIfThere(join(dir, `${JACKETT}.secret`));
  if (credential) secrets.push(credential.trim());
  const w = wanted(JACKETT, (await readJson(join(dir, `${JACKETT}.json`))) as Binding | undefined, credential, false);
  if ("problem" in w) {
    outcomes.push({ what: JACKETT, result: "refused", problem: w.problem });
  } else {
    const ep = w.endpoint;
    let took: Took | undefined;
    try {
      took = await providerTakes(http, JACKETT, ep);
    } catch (err) {
      outcomes.push({
        what: JACKETT,
        result: "refused",
        problem: `jackett could not be asked whether it takes the key at ${ep.host}:${ep.port}: ${err instanceof Error ? err.message : String(err)}`,
      });
    }
    if (took && !took.took) {
      outcomes.push({ what: JACKETT, result: "refused", problem: acceptRemedy(app, settings.node, JACKETT, "jackett", "API key", ep.from) });
    } else if (took) {
      const memory = ((await readJson(memoryFile)) ?? {}) as Record<string, { hosts?: string[] } | undefined>;
      const remembered = Array.isArray(memory[JACKETT]?.hosts) ? (memory[JACKETT]?.hosts as string[]) : [];
      try {
        const indexers = await listEntries(http, app, "indexer");
        outcomes.push(
          ...(await reconcileIndexers(http, app, ep, took.configured ?? new Map(), settings.indexers, remembered, indexers)),
        );
      } catch (err) {
        outcomes.push({ what: JACKETT, result: "refused", problem: err instanceof Error ? err.message : String(err) });
      }
      // Remember where the feeds now point, so they are still recognised as the mesh's if jackett
      // moves. Written whole and renamed, so a crash leaves the old memory, never half of one.
      const hosts = [...new Set([...remembered, ep.host.toLowerCase()])].sort();
      if (hosts.join() !== [...remembered].sort().join()) {
        try {
          await mkdir(dirname(memoryFile), { recursive: true });
          await writeFile(`${memoryFile}.tmp`, JSON.stringify({ ...memory, [JACKETT]: { hosts } }, null, 2) + "\n", { mode: 0o600 });
          await rename(`${memoryFile}.tmp`, memoryFile);
        } catch (err) {
          outcomes.push({
            what: JACKETT,
            result: "notice",
            note: `could not remember ${ep.host} as a jackett host (${err instanceof Error ? err.message : String(err)}); if jackett moves, list it in downloads.jackett-api.adopt-hosts`,
          });
        }
      }
    }
  }
 }
 let failed = 0;
 for (const o of outcomes) {
  switch (o.result) {
    case "unchanged":
      say(`${o.what}: already as the mesh says${o.untested ? "" : "; connection tested"}`);
      break;
    case "written":
      say(`${o.what}: wrote ${o.fields.join(", ")}${o.untested ? "" : "; connection tested"}`);
      break;
    case "created":
      say(`${o.what}: registered; connection tested`);
      break;
    case "notice":
      say(`${o.what}: ${o.note}`);
      break;
    case "refused":
      failed++;
      fail(`${o.what}: ${o.problem}`);
      break;
  }
 }
 process.exitCode = failed > 0 ? 1 : 0;
@@ -1,778 +0,0 @@
 // Where a Servarr app reaches its download clients and its indexer proxy — decided by the mesh,
 // written into the app by the app's own API.
 //
 // **One file, four copies.** sonarr, radarr, lidarr and bookshelf (a Readarr fork) keep their
 // download clients and indexers behind the same API — `/api/v3/…` for the first two, `/api/v1/…`
 // for the others — so this step is the same code in each. Each module builds from its own
 // directory (novox/hq ADR 0069), so each carries a byte-identical copy under `downloads/`;
 // `test/downloads.test.ts` checks the copies agree wherever the siblings are checked out beside
 // it. Change all four together.
 //
 // **Why this exists.** The app keeps its connection to nzbget, qBittorrent and jackett in its own
 // database, not in a file, so the mesh has nowhere to write `${bound:nzbget-api:at}` for it. The
 // module requires `nzbget-api`, `qbittorrent-api` and `jackett-api`; the mesh delivers, for each,
 // a binding (where the provider is — `at` — and what it serves: `port`, `scheme`, `url-base`, and
 // for a download client the `username`) and a pair credential (nzbget's ControlPassword,
 // qBittorrent's WebUI password, jackett's API key — each the provider's one and only, accepted by
 // the operator per pair; the mesh cannot mint them). This step reads those files and makes the
 // app's entries say the same thing.
 //
 // **Which entries are the mesh's.** Never a guess from what an entry looks like:
 //   - a download client is the mesh's when its name is the one the module's settings give for
 //     that provision (`downloads.<provision>.name`) and its kind is that provider's. On a fresh
 //     machine the step registers it under that name; on a migrated one the assignment names the
 //     entry the migration adopts ("NZBGet" on ace).
 //   - a Torznab indexer is the mesh's when it reads a jackett feed
 //     (`…/api/v2.0/indexers/<id>/results/torznab`) on a host the mesh put there — the bound `at`,
 //     one it bound before (remembered by the step), or one the settings adopt
 //     (`downloads.jackett-api.adopt-hosts`, which is how a migration names the entries that pointed
 //     at the old container). `downloads.jackett-api.indexers` lists the jackett indexers the app
 //     should have; one missing is registered.
 // Everything else — every entry a person made, an nzbget elsewhere, a seedbox's jackett, a Newznab
 // indexer — is left exactly as it is. **Nothing is ever deleted.**
 //
 // **Only the connection, and only when it differs.** Host, port, TLS, base path, user name and
 // the credential. Categories, priorities, "enabled", seed criteria and every other choice made in
 // the app are left alone. The stored credential cannot be read back (the app masks it), so the
 // step asks the app to test the entry with the mesh's host and port and the credential it already
 // holds: passing, the credential is already the provider's one and only; failing, the delivered
 // credential is written.
 //
 // **A credential the provider refuses is never written.** Until the operator accepts the
 // provider's secret for this pair, the mesh delivers a value it minted itself, which no provider
 // will ever accept (novox/hq ADR 0092). Writing it would replace a working password with a dead
 // one. So it is tried against the provider first; refused, nothing of that provision is written
 // and the step fails naming the `secret accept` that fixes it.
 //
 // Pure logic and a small HTTP seam, so it is tested against fake servers (test/downloads.test.ts).
 // Never prints a credential, an API key, or a URL carrying one.
 import { readFile } from "node:fs/promises";
 /** A download-client provision and the shape of its entry in the app. */
 export interface ClientKind {
  provision: "nzbget-api" | "qbittorrent-api";
  /** The app's `implementation` for it. */
  implementation: "Nzbget" | "QBittorrent";
  /** The provider, as a person calls it. */
  provider: string;
  /** What the pair credential is, in the provider's words. */
  secretName: string;
 }
 export const CLIENTS: readonly ClientKind[] = [
  { provision: "nzbget-api", implementation: "Nzbget", provider: "nzbget", secretName: "ControlPassword" },
  { provision: "qbittorrent-api", implementation: "QBittorrent", provider: "qBittorrent", secretName: "WebUI password" },
 ];
 export const JACKETT = "jackett-api";
 /** What the mesh wrote at `binds.<provision>`: the binding document. */
 export interface Binding {
  provision?: string;
  from?: string;
  at?: string;
  as?: string;
  serves?: Record<string, unknown>;
 }
 /** Where a provider is, as the mesh bound it, and the credential for it. */
 export interface Endpoint {
  scheme: "http" | "https";
  host: string;
  port: number;
  /** "" at the root, otherwise "/base" — one leading slash, none trailing. */
  urlBase: string;
  /** The user a download client logs in as; "" for jackett, which takes a key. */
  username: string;
  credential: string;
  /** The provider's node, for the `secret accept` remedy. */
  from: string;
 }
 export type Wanted = { ok: true; endpoint: Endpoint } | { ok: false; problem: string };
 /**
 * The endpoint the mesh says to use, from a binding and its pair credential.
 *
 * Refused rather than guessed when the binding cannot be dialled from the app's own container: a
 * loopback `at` — what the mesh hands a machine that is not on the private network — is the app's
 * container itself.
 */
 export function wanted(
  provision: string,
  binding: Binding | undefined,
  credential: string | undefined,
  needsUser: boolean,
 ): Wanted {
  if (!binding) {
    return { ok: false, problem: `no binding for ${provision} was delivered — the mesh writes it before this step runs` };
  }
  const host = typeof binding.at === "string" ? binding.at.trim() : "";
  const serves = binding.serves ?? {};
  const port = Number(serves.port);
  if (!host) return { ok: false, problem: `the ${provision} binding names no host (at)` };
  if (isLoopback(host)) {
    return {
      ok: false,
      problem:
        `the ${provision} binding says the provider is at ${host}, which from the app's own container is the ` +
        `app itself. The mesh hands loopback to a machine that is not on the private network; put it on the ` +
        `private network so the provider has an address the app can dial`,
    };
  }
  if (!Number.isInteger(port) || port <= 0 || port > 65535) {
    return { ok: false, problem: `the ${provision} binding serves no usable port (${String(serves.port)})` };
  }
  const scheme = typeof serves.scheme === "string" && serves.scheme ? serves.scheme : "http";
  if (scheme !== "http" && scheme !== "https") {
    return { ok: false, problem: `the ${provision} binding serves scheme ${scheme}, which the app cannot dial` };
  }
  const username = typeof serves.username === "string" ? serves.username.trim() : "";
  if (needsUser && !username) {
    return { ok: false, problem: `the ${provision} binding serves no username for the app to log in as` };
  }
  const key = (credential ?? "").trim();
  if (!key) return { ok: false, problem: `the ${provision} credential is empty or was not delivered` };
  return {
    ok: true,
    endpoint: {
      scheme,
      host,
      port,
      urlBase: normBase(serves["url-base"]),
      username,
      credential: key,
      from: typeof binding.from === "string" ? binding.from : "",
    },
  };
 }
 /** A URL base as "" or "/x/y": slashes trimmed, one put back in front. */
 export function normBase(v: unknown): string {
  const s = typeof v === "string" ? v.trim().replace(/^\/+|\/+$/g, "") : "";
  return s === "" ? "" : `/${s}`;
 }
 function isLoopback(host: string): boolean {
  const h = host.toLowerCase();
  return h === "localhost" || h === "::1" || h === "[::1]" || /^127\./.test(h);
 }
 function hostForUrl(host: string): string {
  return host.includes(":") && !host.startsWith("[") ? `[${host}]` : host;
 }
 /** The provider's base URL, as the step dials it and as the app is given it. */
 export function baseUrl(ep: Endpoint): string {
  return `${ep.scheme}://${hostForUrl(ep.host)}:${ep.port}${ep.urlBase}`;
 }
 // ---------------------------------------------------------------------------------------------
 // HTTP
 /** The HTTP the step needs, so a test can stand fakes in for the app and the providers. */
 export interface Http {
  fetch(
    url: string,
    init?: { method?: string; headers?: Record<string, string>; body?: string },
  ): Promise<{ status: number; text(): Promise<string> }>;
 }
 /** The app, as the step reaches it from the host. */
 export interface App {
  /** The module, for messages and the remedy: sonarr, radarr, lidarr, bookshelf. */
  module: string;
  /** Its own URL, base path included. */
  url: string;
  apiKey: string;
  /** v3 (sonarr, radarr) or v1 (lidarr, bookshelf). */
  api: string;
 }
 interface Answer {
  status: number;
  body: unknown;
 }
 async function appCall(http: Http, app: App, method: string, path: string, body?: unknown): Promise<Answer> {
  const res = await http.fetch(`${app.url.replace(/\/$/, "")}/api/${app.api}${path}`, {
    method,
    headers: {
      "X-Api-Key": app.apiKey,
      Accept: "application/json",
      ...(body !== undefined ? { "Content-Type": "application/json" } : {}),
    },
    body: body !== undefined ? JSON.stringify(body) : undefined,
  });
  const text = await res.text();
  let parsed: unknown = undefined;
  if (text) {
    try {
      parsed = JSON.parse(text) as unknown;
    } catch {
      parsed = text;
    }
  }
  return { status: res.status, body: parsed };
 }
 async function appGet(http: Http, app: App, path: string): Promise<unknown> {
  const a = await appCall(http, app, "GET", path);
  if (a.status < 200 || a.status >= 300) throw new Error(`${app.module} GET ${path} answered ${a.status}`);
  return a.body;
 }
 /** One of the app's validation failures: the only parts of an answer the step ever prints. */
 interface Failure {
  property: string;
  message: string;
  warning: boolean;
 }
 function failuresOf(body: unknown): Failure[] {
  const list = Array.isArray(body) ? body : [];
  return list.map((f) => {
    const o = (f ?? {}) as Record<string, unknown>;
    return {
      property: String(o.propertyName ?? ""),
      message: String(o.errorMessage ?? ""),
      warning: o.isWarning === true,
    };
  });
 }
 /**
 * One shape rather than a union on `ok`: the Dockerfile compiles without strict, where a boolean
 * discriminant does not narrow.
 */
 interface Verdict {
  ok: boolean;
  /** Warnings the app raised on a pass; errors (and any warnings) on a failure. */
  failures: Failure[];
  status: number;
  saved?: Entry;
 }
 function verdict(a: Answer): Verdict {
  if (a.status >= 200 && a.status < 300) return { ok: true, failures: [], status: a.status };
  const failures = failuresOf(a.body);
  if (a.status === 400 && failures.length > 0 && failures.every((f) => f.warning)) return { ok: true, failures, status: a.status };
  return { ok: false, failures, status: a.status };
 }
 /** The app's own test of an entry, from the app's own container. */
 async function appTest(http: Http, app: App, resource: string, entry: Entry): Promise<Verdict> {
  return verdict(await appCall(http, app, "POST", `/${resource}/test`, entry));
 }
 /**
 * Save an entry. The app tests an enabled entry before saving it; a test that passes with only
 * warnings ("a category is recommended") is saved with `forceSave`, the same as pressing "save
 * anyway" in its screen. An error is never forced.
 */
 async function appSave(http: Http, app: App, resource: string, entry: Entry, create: boolean): Promise<Verdict> {
  const path = create ? `/${resource}` : `/${resource}/${entry.id}`;
  const method = create ? "POST" : "PUT";
  let a = await appCall(http, app, method, path, entry);
  let v = verdict(a);
  if (v.ok && (a.status < 200 || a.status >= 300)) {
    a = await appCall(http, app, method, `${path}?forceSave=true`, entry);
    v = verdict(a);
    if (v.ok && (a.status < 200 || a.status >= 300)) {
      return { ok: false, failures: failuresOf(a.body), status: a.status };
    }
  }
  if (!v.ok) return v;
  return { ...v, saved: (a.body ?? undefined) as Entry | undefined };
 }
 // ---------------------------------------------------------------------------------------------
 // Entries
 /** An entry as the app's API gives it: a download client or an indexer. */
 export interface Entry {
  id?: number;
  name?: string;
  implementation?: string;
  enable?: boolean;
  enableRss?: boolean;
  enableAutomaticSearch?: boolean;
  enableInteractiveSearch?: boolean;
  supportsRss?: boolean;
  supportsSearch?: boolean;
  fields?: { name: string; value?: unknown; [k: string]: unknown }[];
  [k: string]: unknown;
 }
 export function field(e: Entry, name: string): unknown {
  return e.fields?.find((f) => f.name === name)?.value;
 }
 /** The entry with these fields' values replaced — added when the app's shape lacks one. */
 export function withFields(e: Entry, values: Record<string, unknown>): Entry {
  const fields = (e.fields ?? []).map((f) => (f.name in values ? { ...f, value: values[f.name] } : { ...f }));
  for (const [name, value] of Object.entries(values)) {
    if (!fields.some((f) => f.name === name)) fields.push({ name, value });
  }
  return { ...e, fields };
 }
 function enabled(e: Entry): boolean {
  return e.enable === true || e.enableRss === true || e.enableAutomaticSearch === true || e.enableInteractiveSearch === true;
 }
 /** What one provision, or one entry of it, came to. */
 export type Outcome =
  | { what: string; result: "unchanged"; untested?: boolean }
  | { what: string; result: "written"; fields: string[]; untested?: boolean }
  | { what: string; result: "created"; fields: string[] }
  | { what: string; result: "notice"; note: string }
  | { what: string; result: "refused"; problem: string };
 function said(fs: Failure[]): string {
  return fs.length === 0 ? "no reason given" : fs.map((f) => (f.property ? `${f.property}: ${f.message}` : f.message)).join("; ");
 }
 /**
 * Bring one of the mesh's entries in line: `connection` is the non-secret fields as the mesh says
 * them, `differs` which of them the entry does not already say, `secretField` where the credential
 * goes. Never throws: every failure is an outcome with a reason.
 */
 export async function reconcileEntry(
  http: Http,
  app: App,
  resource: "downloadclient" | "indexer",
  what: string,
  current: Entry,
  connection: Record<string, unknown>,
  differs: string[],
  secretField: string,
  credential: string,
  testable = true,
 ): Promise<Outcome> {
  try {
    const base = withFields(current, connection); // the credential as the app holds it — masked
    if (!testable) {
      // Nothing to test against (jackett no longer has the indexer it names): the connection is
      // still the mesh's to state, and the key goes with it when the address changes.
      if (differs.length === 0) return { what, result: "unchanged", untested: true };
      const s = await appSave(http, app, resource, withFields(base, { [secretField]: credential }), false);
      if (!s.ok) return { what, result: "refused", problem: `${app.module} would not save it: ${said(s.failures)}` };
      return { what, result: "written", fields: [...differs, secretField], untested: true };
    }
    const first = await appTest(http, app, resource, base);
    if (first.ok) {
      // The credential the app holds already works against the provider at the mesh's address —
      // and the provider has exactly one, so it is the delivered one.
      if (differs.length === 0) return { what, result: "unchanged" };
      const s = await appSave(http, app, resource, base, false);
      if (!s.ok) return { what, result: "refused", problem: `${app.module} would not save it: ${said(s.failures)}` };
      return { what, result: "written", fields: differs };
    }
    // The app's test failed with what it holds. The delivered credential was already checked
    // against the provider, so writing it is safe; the app tests an enabled entry again on save.
    const s = await appSave(http, app, resource, withFields(base, { [secretField]: credential }), false);
    if (!s.ok) {
      return {
        what,
        result: "refused",
        problem: `${app.module} tested it at the mesh's address and would not save it (nothing was written): ${said(s.failures)}`,
      };
    }
    const stored = (await appGet(http, app, `/${resource}/${current.id}`)) as Entry;
    const second = await appTest(http, app, resource, stored);
    const fields = [...differs, secretField];
    if (second.ok) return { what, result: "written", fields };
    const why = `written (${fields.join(", ")}), and ${app.module}'s own test still fails: ${said(second.failures)}`;
    return enabled(stored) ? { what, result: "refused", problem: why } : { what, result: "notice", note: `${why} — it is disabled, so nothing uses it` };
  } catch (err) {
    return { what, result: "refused", problem: message(err) };
  }
 }
 /**
 * Register a new entry from the app's own template for that kind: its defaults, the name, the
 * connection and the credential. A category the provider does not have (nzbget refuses one it was
 * not told about) is left empty rather than failing the registration, and said.
 */
 export async function createEntry(
  http: Http,
  app: App,
  resource: "downloadclient" | "indexer",
  what: string,
  implementation: string,
  name: string,
  values: Record<string, unknown>,
 ): Promise<Outcome> {
  try {
    const schema = (await appGet(http, app, `/${resource}/schema`)) as Entry[];
    const template = (schema ?? []).find((s) => s.implementation === implementation);
    if (!template) return { what, result: "refused", problem: `${app.module} has no ${implementation} to register` };
    let entry: Entry = withFields({ ...template, id: undefined, name }, values);
    if (resource === "downloadclient") entry.enable = true;
    else {
      entry.enableRss = template.supportsRss !== false;
      entry.enableAutomaticSearch = template.supportsSearch !== false;
      entry.enableInteractiveSearch = template.supportsSearch !== false;
    }
    let s = await appSave(http, app, resource, entry, true);
    let note = "";
    if (!s.ok && s.failures.length > 0 && s.failures.every((f) => /category/i.test(f.property))) {
      const emptied: Record<string, unknown> = {};
      for (const f of entry.fields ?? []) if (/category$/i.test(f.name) && !/imported/i.test(f.name)) emptied[f.name] = "";
      entry = withFields(entry, emptied);
      s = await appSave(http, app, resource, entry, true);
      note = " with its category left empty — the provider has none by the app's default name; set one in both";
    }
    if (!s.ok) return { what, result: "refused", problem: `${app.module} would not register it: ${said(s.failures)}` };
    const created = s.saved;
    if (created?.id !== undefined) {
      const t = await appTest(http, app, resource, (await appGet(http, app, `/${resource}/${created.id}`)) as Entry);
      if (!t.ok) {
        return { what, result: "refused", problem: `registered as "${name}"${note}, and ${app.module}'s own test fails: ${said(t.failures)}` };
      }
    }
    return note
      ? { what, result: "notice", note: `registered as "${name}"${note}` }
      : { what, result: "created", fields: Object.keys(values) };
  } catch (err) {
    return { what, result: "refused", problem: message(err) };
  }
 }
 // ---------------------------------------------------------------------------------------------
 // Providers: does it take the credential?
 /**
 * Does the provider take this credential? `took` it does (for jackett, with the ids of the indexers
 * it has configured); `refused` it said no; a thrown error when it could not be asked.
 */
 export interface Took {
  took: boolean;
  configured?: Map<string, string>;
 }
 export async function providerTakes(http: Http, provision: string, ep: Endpoint): Promise<Took> {
  const base = baseUrl(ep);
  if (provision === "nzbget-api") {
    const auth = Buffer.from(`${ep.username}:${ep.credential}`).toString("base64");
    const res = await http.fetch(`${base}/jsonrpc/version`, { method: "GET", headers: { Authorization: `Basic ${auth}` } });
    await res.text();
    if (res.status === 401 || res.status === 403) return { took: false };
    if (res.status >= 200 && res.status < 300) return { took: true };
    throw new Error(`nzbget answered ${res.status}`);
  }
  if (provision === "qbittorrent-api") {
    const form = `username=${encodeURIComponent(ep.username)}&password=${encodeURIComponent(ep.credential)}`;
    const res = await http.fetch(`${base}/api/v2/auth/login`, {
      method: "POST",
      headers: { "Content-Type": "application/x-www-form-urlencoded" },
      body: form,
    });
    const text = (await res.text()).trim();
    if (res.status === 401 || /^fails\.?$/i.test(text)) return { took: false };
    if (res.status === 403) {
      throw new Error(
        "qBittorrent answered 403: it has banned this address after failed logins (WebUI\\BanDuration); it lifts by itself",
      );
    }
    if (res.status >= 200 && res.status < 300) return { took: true };
    throw new Error(`qBittorrent answered ${res.status}`);
  }
  if (provision === JACKETT) {
    const url = `${base}/api/v2.0/indexers/all/results/torznab/api?t=indexers&configured=true&apikey=${encodeURIComponent(ep.credential)}`;
    const res = await http.fetch(url, { method: "GET" });
    const text = await res.text();
    if (res.status === 401 || res.status === 403) return { took: false };
    if (res.status < 200 || res.status >= 300) throw new Error(`jackett answered ${res.status}`);
    // jackett answers a wrong key 200 with an error document: code 100, "Invalid API Key".
    if (/<error\b[^>]*\bcode="100"/i.test(text)) return { took: false };
    if (/<error\b/i.test(text)) throw new Error("jackett answered with an error document");
    return { took: true, configured: configuredIndexers(text) };
  }
  throw new Error(`no check for ${provision}`);
 }
 /** jackett's configured indexers, id → title, from its `t=indexers` feed. */
 export function configuredIndexers(xml: string): Map<string, string> {
  const out = new Map<string, string>();
  const re = /<indexer\b[^>]*\bid="([^"]+)"[^>]*>([\s\S]*?)<\/indexer>/g;
  for (let m = re.exec(xml); m; m = re.exec(xml)) {
    const title = /<title>([\s\S]*?)<\/title>/.exec(m[2])?.[1]?.trim() ?? m[1];
    out.set(m[1], decodeXml(title));
  }
  return out;
 }
 function decodeXml(s: string): string {
  return s.replace(/&lt;/g, "<").replace(/&gt;/g, ">").replace(/&quot;/g, '"').replace(/&apos;/g, "'").replace(/&amp;/g, "&");
 }
 /** The remedy for a refused credential, in the controller's own words (ADR 0092). */
 export function acceptRemedy(app: App, node: string, provision: string, provider: string, secretName: string, from: string): string {
  return (
    `${provider} refuses the ${provision} credential the mesh delivered, so nothing of ${provision} was written ` +
    `into ${app.module}. ${provider} has one ${secretName} and the mesh cannot make it: accept it for this pair — ` +
    `\`secret accept ${node || "<this node>"} ${app.module} ${provision} --provider ${from || "<its node>"} ` +
    `--from <file holding ${provider}'s ${secretName}>\``
  );
 }
 // ---------------------------------------------------------------------------------------------
 // Download clients
 /** The non-secret fields of a download client as the mesh says them. */
 export function clientConnection(ep: Endpoint): Record<string, unknown> {
  return { host: ep.host, port: ep.port, useSsl: ep.scheme === "https", urlBase: ep.urlBase === "" ? null : ep.urlBase, username: ep.username };
 }
 /** Which of them the entry does not already say. Names only. */
 export function clientDiffers(e: Entry, ep: Endpoint): string[] {
  const out: string[] = [];
  if (String(field(e, "host") ?? "").toLowerCase() !== ep.host.toLowerCase()) out.push("host");
  if (Number(field(e, "port") ?? 0) !== ep.port) out.push("port");
  if (Boolean(field(e, "useSsl")) !== (ep.scheme === "https")) out.push("useSsl");
  if (normBase(field(e, "urlBase")) !== ep.urlBase) out.push("urlBase");
  if (String(field(e, "username") ?? "") !== ep.username) out.push("username");
  return out;
 }
 /**
 * Bring the app's download client for one provision in line: the entry by that name and kind is
 * the mesh's and is updated; none, it is registered. An entry by that name of another kind, or by
 * that name in another case, is somebody else's and is refused rather than touched.
 */
 export async function reconcileClient(
  http: Http,
  app: App,
  kind: ClientKind,
  name: string,
  ep: Endpoint,
  entries: Entry[],
 ): Promise<Outcome[]> {
  const what = `${kind.provision} ("${name}")`;
  const exact = entries.filter((e) => e.name === name);
  const alike = entries.filter((e) => e.name !== name && String(e.name ?? "").toLowerCase() === name.toLowerCase());
  if (exact.length > 0 && exact[0].implementation !== kind.implementation) {
    return [{
      what,
      result: "refused",
      problem: `the download client named "${name}" is a ${exact[0].implementation}, not ${kind.implementation}; it is not the mesh's and was left alone. Name the mesh's entry otherwise in downloads.${kind.provision}.name`,
    }];
  }
  if (exact.length === 0 && alike.length > 0) {
    return [{
      what,
      result: "refused",
      problem: `${app.module} already has "${alike[0].name}", which is not the mesh's name ("${name}") and was left alone. To have the mesh manage it, set downloads.${kind.provision}.name to "${alike[0].name}"`,
    }];
  }
  const outcomes: Outcome[] = [];
  const others = entries.filter((e) => e.implementation === kind.implementation && e.name !== name);
  if (others.length > 0) {
    outcomes.push({
      what,
      result: "notice",
      note: `also present and not the mesh's, left alone: ${others.map((o) => `"${o.name}"`).join(", ")}`,
    });
  }
  if (exact.length === 0) {
    outcomes.push(
      await createEntry(http, app, "downloadclient", what, kind.implementation, name, {
        ...clientConnection(ep),
        password: ep.credential,
      }),
    );
    return outcomes;
  }
  outcomes.push(
    await reconcileEntry(http, app, "downloadclient", what, exact[0], clientConnection(ep), clientDiffers(exact[0], ep), "password", ep.credential),
  );
  return outcomes;
 }
 // ---------------------------------------------------------------------------------------------
 // Indexers
 const FEED = /\/api\/v2\.0\/indexers\/([^/]+)\/results\/torznab\/?$/;
 /** A Torznab entry reading a jackett feed: the host it points at and the jackett indexer's id. */
 export function jackettFeed(e: Entry): { host: string; id: string } | undefined {
  if (e.implementation !== "Torznab") return undefined;
  const raw = String(field(e, "baseUrl") ?? "").trim();
  if (!raw) return undefined;
  let u: URL;
  try {
    u = new URL(raw);
  } catch {
    return undefined;
  }
  const path = `${u.pathname.replace(/\/+$/, "")}/${String(field(e, "apiPath") ?? "").replace(/^\/+/, "")}`;
  const m = FEED.exec(path);
  if (!m) return undefined;
  return { host: u.hostname.replace(/^\[|\]$/g, "").toLowerCase(), id: decodeURIComponent(m[1]) };
 }
 /** The feed's two fields as the mesh says them. */
 export function feedConnection(ep: Endpoint, id: string): Record<string, unknown> {
  return { baseUrl: baseUrl(ep), apiPath: `/api/v2.0/indexers/${id}/results/torznab/` };
 }
 function sameUrl(a: string, b: string): boolean {
  try {
    const x = new URL(a);
    const y = new URL(b);
    const port = (u: URL) => u.port || (u.protocol === "https:" ? "443" : "80");
    return (
      x.protocol === y.protocol &&
      x.hostname.toLowerCase() === y.hostname.toLowerCase() &&
      port(x) === port(y) &&
      x.pathname.replace(/\/+$/, "") === y.pathname.replace(/\/+$/, "")
    );
  } catch {
    return false;
  }
 }
 export function feedDiffers(e: Entry, ep: Endpoint, id: string): string[] {
  const want = feedConnection(ep, id);
  const out: string[] = [];
  if (!sameUrl(String(field(e, "baseUrl") ?? ""), String(want.baseUrl))) out.push("baseUrl");
  const path = (v: unknown) => `/${String(v ?? "").replace(/^\/+|\/+$/g, "")}`;
  if (path(field(e, "apiPath")) !== path(want.apiPath)) out.push("apiPath");
  return out;
 }
 export interface IndexerSettings {
  /** Hosts whose jackett feeds the mesh takes over — a migration's old names. */
  adoptHosts: string[];
  /** jackett indexer ids the app should have. */
  indexers: string[];
 }
 /**
 * Bring the app's jackett feeds in line: every one the mesh manages is pointed at the bound jackett
 * with its key, and every listed jackett indexer the app lacks is registered.
 */
 export async function reconcileIndexers(
  http: Http,
  app: App,
  ep: Endpoint,
  configured: Map<string, string>,
  settings: IndexerSettings,
  remembered: string[],
  entries: Entry[],
 ): Promise<Outcome[]> {
  const ours = new Set([ep.host, ...settings.adoptHosts, ...remembered].map((h) => h.trim().toLowerCase()).filter(Boolean));
  const outcomes: Outcome[] = [];
  const managed = new Set<string>();
  for (const e of entries) {
    const feed = jackettFeed(e);
    if (!feed || !ours.has(feed.host)) continue;
    managed.add(feed.id);
    const what = `jackett-api ("${e.name}", jackett indexer ${feed.id})`;
    const known = feed.id === "all" || configured.has(feed.id);
    const outcome = await reconcileEntry(
      http, app, "indexer", what, e, feedConnection(ep, feed.id), feedDiffers(e, ep, feed.id), "apiKey", ep.credential, known,
    );
    outcomes.push(outcome);
    if (!known && outcome.result !== "refused") {
      outcomes.push({ what, result: "notice", note: `jackett has no indexer "${feed.id}" configured, so it was not tested; configure it in jackett or remove the entry in ${app.module}` });
    }
  }
  for (const id of settings.indexers) {
    if (managed.has(id)) continue;
    const what = `jackett-api (jackett indexer ${id})`;
    if (id !== "all" && !configured.has(id)) {
      outcomes.push({ what, result: "refused", problem: `downloads.jackett-api.indexers lists "${id}", and jackett has no indexer by that id configured` });
      continue;
    }
    const name = `Jackett - ${id === "all" ? "all" : configured.get(id)}`;
    outcomes.push(await createEntry(http, app, "indexer", what, "Torznab", name, { ...feedConnection(ep, id), apiKey: ep.credential }));
  }
  if (outcomes.length === 0) {
    outcomes.push({ what: "jackett-api", result: "notice", note: `${app.module} has no jackett feed the mesh manages, and downloads.jackett-api.indexers lists none to register` });
  }
  return outcomes;
 }
 // ---------------------------------------------------------------------------------------------
 // Files
 /** The module's settings for this step, from its merged `downloads.json`. */
 export interface StepSettings {
  node: string;
  names: Record<string, string>;
  indexers: IndexerSettings;
 }
 export function stepSettings(raw: unknown): StepSettings {
  const doc = (raw ?? {}) as Record<string, unknown>;
  const d = (doc.downloads ?? {}) as Record<string, Record<string, unknown> | undefined>;
  const names: Record<string, string> = {};
  for (const k of CLIENTS) {
    const n = d[k.provision]?.name;
    names[k.provision] = typeof n === "string" && n.trim() ? n.trim() : k.provision.replace(/-api$/, "");
  }
  const j = d[JACKETT] ?? {};
  const strings = (v: unknown) => (Array.isArray(v) ? v.filter((x): x is string => typeof x === "string" && x.trim() !== "").map((x) => x.trim()) : []);
  return {
    node: typeof doc.node === "string" ? doc.node : "",
    names,
    indexers: { adoptHosts: strings(j["adopt-hosts"]), indexers: strings(j.indexers) },
  };
 }
 /** The app's own key and base path, from its config.xml. */
 export function appConfig(xml: string): { apiKey: string; urlBase: string } {
  const tag = (t: string) => new RegExp(`<${t}>([^<]*)</${t}>`).exec(xml)?.[1]?.trim() ?? "";
  return { apiKey: tag("ApiKey"), urlBase: normBase(tag("UrlBase")) };
 }
 /** A file the mesh wrote, or undefined when it is not there. */
 export async function readIfThere(path: string | undefined): Promise<string | undefined> {
  if (!path) return undefined;
  return readFile(path, "utf8").catch(() => undefined);
 }
 /** A JSON file parsed, or undefined when absent or not JSON. */
 export async function readJson(path: string | undefined): Promise<unknown> {
  const raw = await readIfThere(path);
  if (raw === undefined) return undefined;
  try {
    return JSON.parse(raw) as unknown;
  } catch {
    return undefined;
  }
 }
 /** Wait for the app to answer, because the step runs right after its container starts. */
 export async function appReady(http: Http, app: App, waitMs: number, pauseMs = 2000): Promise<boolean> {
  const until = Date.now() + waitMs;
  for (;;) {
    try {
      const a = await appCall(http, app, "GET", "/system/status");
      if (a.status === 200) return true;
    } catch {
      // not listening yet
    }
    if (Date.now() >= until) return false;
    await new Promise((r) => setTimeout(r, pauseMs));
  }
 }
 export async function listEntries(http: Http, app: App, resource: "downloadclient" | "indexer"): Promise<Entry[]> {
  return ((await appGet(http, app, `/${resource}`)) as Entry[]) ?? [];
 }
 /** Anything printed goes through this: the credentials the step holds never reach a log. */
 export function scrub(text: string, secrets: string[]): string {
  let out = text;
  for (const s of secrets) if (s && s.length >= 4) out = out.split(s).join("<redacted>");
  return out;
 }
 function message(err: unknown): string {
  return err instanceof Error ? err.message : String(err);
 }
@@ -1,19 +1,6 @@
 {
  "module": "radarr",
  "version": "1",
  "provides": [
    {
      "name": "radarr-api",
      "scope": "mesh"
    }
  ],
  "serves": {
    "radarr-api": {
      "scheme": "http",
      "port": 7878,
      "url-base": ""
    }
  },
  "capabilities": [
    "container-runtime"
  ],
@@ -31,7 +18,7 @@
      "port": 7878,
      "protocol": "tcp",
      "from": "mesh",
-      "why": "managing films: its web UI, and the API other modules reach as radarr-api"
+      "why": "managing films"
    }
  ],
  "accesses": [
@@ -51,15 +38,10 @@
      "path": "/var/lib/mesh/radarr",
      "mode": "0700"
    },
    {
      "id": "state",
      "type": "directory",
      "mode": "0700",
      "place": "."
    },
    {
      "id": "config",
      "type": "directory",
      "path": "/services/radarr/config",
      "mode": "0700",
      "owner": "1000:1000"
    },
@@ -67,7 +49,7 @@
      "id": "server",
      "type": "container",
      "name": "radarr",
-      "image": "lscr.io/linuxserver/radarr@sha256:c960f2b52ec6542dbe6707c5a21e696a7c74fd8b17997454f4d10a55dacee133",
+      "image": "lscr.io/linuxserver/radarr@sha256:119aaa4a4f7349bcd2a136c5373a0d7925b5479915c7dfe0c0ad352db2a6d438",
      "env": {
        "PUID": "1000",
        "PGID": "1000",
@@ -77,7 +59,7 @@
        "7878"
      ],
      "volumes": [
-        "${dir:config}:/config",
+        "/services/radarr/config:/config",
        "/services/media/movies:/movies",
        "/services/media/downloads:/downloads"
      ]
@@ -89,74 +71,17 @@
      "network": "host",
      "volumes": [
        "/var/lib/mesh/radarr/broker:/run/secrets/broker:ro",
-        "${dir:config}:/var/lib/radarr/config:ro"
+        "/services/radarr/config:/var/lib/radarr/config:ro"
      ],
      "env": {
        "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_RADARR_URL": "http://127.0.0.1:${port:7878}",
+        "MESH_RADARR_URL": "http://127.0.0.1:7878",
        "MESH_RADARR_CONFIG_DIR": "/var/lib/radarr/config"
      },
      "artifact": "runtime"
    },
    {
      "id": "downloads-config",
      "type": "file",
      "path": "${dir:state}/downloads.json",
      "mode": "0600",
      "content": "{\n  \"node\": \"${machine:name}\",\n  \"downloads\": {\n    \"nzbget-api\": {\n      \"name\": \"nzbget\"\n    },\n    \"qbittorrent-api\": {\n      \"name\": \"qbittorrent\"\n    },\n    \"jackett-api\": {\n      \"adopt-hosts\": [],\n      \"indexers\": []\n    }\n  }\n}\n",
      "merge": "json"
    },
    {
      "id": "downloads-memory",
      "type": "directory",
      "mode": "0700"
    },
    {
      "id": "downloads",
      "type": "container",
      "name": "mesh-radarr-downloads",
      "network": "host",
      "run-once": true,
      "volumes": [
        "${dir:state}/downloads.json:/run/downloads/downloads.json:ro",
        "${dir:state}/nzbget-api.json:/run/downloads/nzbget-api.json:ro",
        "${dir:state}/nzbget-api.secret:/run/downloads/nzbget-api.secret:ro",
        "${dir:state}/qbittorrent-api.json:/run/downloads/qbittorrent-api.json:ro",
        "${dir:state}/qbittorrent-api.secret:/run/downloads/qbittorrent-api.secret:ro",
        "${dir:state}/jackett-api.json:/run/downloads/jackett-api.json:ro",
        "${dir:state}/jackett-api.secret:/run/downloads/jackett-api.secret:ro",
        "${dir:config}:/var/lib/radarr/config:ro",
        "${dir:downloads-memory}:/var/lib/downloads"
      ],
      "env": {
        "MESH_DOWNLOADS_APP": "radarr",
        "MESH_DOWNLOADS_API": "v3",
        "MESH_DOWNLOADS_APP_URL": "http://127.0.0.1:${port:7878}",
        "MESH_DOWNLOADS_APP_CONFIG": "/var/lib/radarr/config/config.xml",
        "MESH_DOWNLOADS_DIR": "/run/downloads",
        "MESH_DOWNLOADS_SETTINGS": "/run/downloads/downloads.json",
        "MESH_DOWNLOADS_MEMORY": "/var/lib/downloads/memory.json"
      },
      "args": [
        "run",
        "/app/modules/radarr/dist/downloads/index.js"
      ],
      "restart-on": [
        "downloads-config",
        "bound-nzbget-api",
        "secret-nzbget-api",
        "bound-qbittorrent-api",
        "secret-qbittorrent-api",
        "bound-jackett-api",
        "secret-jackett-api"
      ],
      "artifact": "runtime"
    }
  ],
  "requires": [
    "jackett-api",
    "nzbget-api",
    "qbittorrent-api",
    "route"
  ],
  "contributes": {
@@ -166,15 +91,7 @@
    }
  },
  "binds": {
-    "route": "${dir:state}/route.json",
+    "route": "/var/lib/mesh/radarr/route.json"
    "nzbget-api": "${dir:state}/nzbget-api.json",
    "qbittorrent-api": "${dir:state}/qbittorrent-api.json",
    "jackett-api": "${dir:state}/jackett-api.json"
  },
  "secrets": {
    "nzbget-api": "${dir:state}/nzbget-api.secret",
    "qbittorrent-api": "${dir:state}/qbittorrent-api.secret",
    "jackett-api": "${dir:state}/jackett-api.secret"
  },
  "build": {
    "on": [
@@ -4,11 +4,6 @@
  "description": "radarr — movie management. Its API client, tools and events live here (novox/hq ADR 0039).",
  "type": "module",
  "private": true,
  "scripts": {
    "build": "tsc client.ts index.ts tools/index.ts downloads/settings.ts downloads/index.ts --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist",
    "typecheck": "tsc -p tsconfig.json",
    "test": "node --test --experimental-strip-types 'test/*.test.ts'"
  },
  "dependencies": {
    "@novox/mesh-sdk": "^0.1.0"
  },
@@ -1,365 +0,0 @@
 // What holds the downloads step (downloads/settings.ts): the app's download clients and jackett
 // feeds are made to say what the mesh bound — host, port, TLS, base path, user, credential — and
 // nothing else they keep is touched; only the mesh's entries are touched, and nothing is ever
 // deleted; nothing is written when nothing differs; a missing one is registered; and a credential
 // the provider refuses (the mesh's own minted value, before the operator accepts the provider's)
 // is never written, with the `secret accept` that fixes it named.
 //
 // The app and the providers are fakes: the routes the step touches, answering as the real ones do
 // (checked against the catalogue's pinned sonarr, radarr, lidarr, bookshelf, nzbget, qBittorrent
 // and jackett): the app masks a stored password as "********", tests an enabled entry before
 // saving it, refuses a warning unless forceSave, and jackett answers a wrong key 200 with an error.
 import { test } from "node:test";
 import assert from "node:assert/strict";
 import { existsSync, readFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 import {
  CLIENTS,
  acceptRemedy,
  jackettFeed,
  providerTakes,
  reconcileClient,
  reconcileIndexers,
  stepSettings,
  wanted,
  type App,
  type Binding,
  type Endpoint,
  type Entry,
  type Http,
 } from "../downloads/settings.ts";
 const NZBGET = CLIENTS.find((c) => c.provision === "nzbget-api")!;
 const QBIT = CLIENTS.find((c) => c.provision === "qbittorrent-api")!;
 const APP: App = { module: "sonarr", url: "http://127.0.0.1:8989", apiKey: "app-key", api: "v3" };
 const MASK = "********";
 interface Provider {
  host: string;
  port: number;
  user?: string;
  secret: string;
  configured?: Record<string, string>;
 }
 const nzbget: Provider = { host: "ace.internal", port: 20201, user: "luffy", secret: "nzb-real" };
 const qbit: Provider = { host: "ace.internal", port: 8112, user: "luffy", secret: "qbt-real" };
 const jackett: Provider = { host: "ace.internal", port: 20204, secret: "jackett-real", configured: { rutracker: "RuTracker", torrent9: "Torrent9" } };
 function binding(p: Provider, provision: string, extra: Record<string, unknown> = {}): Binding {
  return {
    provision,
    from: "ace",
    at: p.host,
    as: "mesh_ace_sonarr",
    serves: { scheme: "http", port: p.port, "url-base": "", ...(p.user ? { username: p.user } : {}), ...extra },
  };
 }
 function endpoint(p: Provider, provision: string, credential = p.secret): Endpoint {
  const w = wanted(provision, binding(p, provision), credential, provision !== "jackett-api");
  if (!w.ok) throw new Error(w.problem);
  return w.endpoint;
 }
 const f = (name: string, value: unknown) => ({ name, value });
 function client(id: number, name: string, implementation: string, host: string, port: number, password: string, extra: Record<string, unknown> = {}): Entry {
  return {
    id, name, implementation, enable: true, priority: 1, tags: [],
    fields: [f("host", host), f("port", port), f("useSsl", false), f("urlBase", null), f("username", "luffy"), f("password", password), f("tvCategory", "Series"), ...Object.entries(extra).map(([k, v]) => f(k, v))],
  };
 }
 function feed(id: number, name: string, baseUrl: string, jid: string, key: string, on = true): Entry {
  return {
    id, name, implementation: "Torznab", enableRss: on, enableAutomaticSearch: on, enableInteractiveSearch: on, priority: 25,
    fields: [f("baseUrl", baseUrl), f("apiPath", `/api/v2.0/indexers/${jid}/results/torznab/`), f("apiKey", key), f("categories", [5000])],
  };
 }
 interface Call {
  method: string;
  url: string;
  body?: unknown;
 }
 /** A Servarr app and the three providers behind one fetch. */
 function fakes(start: { clients?: Entry[]; indexers?: Entry[] }) {
  const calls: Call[] = [];
  const store: Record<string, Entry[]> = {
    downloadclient: structuredClone(start.clients ?? []),
    indexer: structuredClone(start.indexers ?? []),
  };
  let next = 100;
  const secretOf: Record<string, string> = { downloadclient: "password", indexer: "apiKey" };
  const masked = (e: Entry): Entry => ({ ...e, fields: e.fields!.map((x) => (x.name === "password" || x.name === "apiKey") && x.value ? { ...x, value: MASK } : { ...x }) });
  const val = (e: Entry, n: string) => e.fields?.find((x) => x.name === n)?.value;
  /** What the app's own test says: dialled from its container, with its stored secret for a mask. */
  const appTest = (kind: string, e: Entry): { propertyName: string; errorMessage: string; isWarning: boolean }[] => {
    let secret = val(e, secretOf[kind]);
    if (secret === MASK) secret = val(store[kind].find((s) => s.id === e.id) ?? {}, secretOf[kind]);
    if (kind === "downloadclient") {
      const p = e.implementation === "Nzbget" ? nzbget : qbit;
      if (val(e, "host") !== p.host || val(e, "port") !== p.port) return [{ propertyName: "Host", errorMessage: "Unable to connect", isWarning: false }];
      if (secret !== p.secret || val(e, "username") !== p.user) return [{ propertyName: "Username", errorMessage: "Authentication Failure", isWarning: false }];
      if (val(e, "tvCategory") === "") return [{ propertyName: "TvCategory", errorMessage: "A category is recommended", isWarning: true }];
      if (e.implementation === "Nzbget" && val(e, "tvCategory") === "tv") return [{ propertyName: "TvCategory", errorMessage: "Category does not exist", isWarning: false }];
      return [];
    }
    const u = new URL(String(val(e, "baseUrl")));
    if (u.hostname !== jackett.host || Number(u.port) !== jackett.port) return [{ propertyName: "BaseUrl", errorMessage: "Unable to connect", isWarning: false }];
    if (secret !== jackett.secret) return [{ propertyName: "ApiKey", errorMessage: "Invalid API Key", isWarning: false }];
    const id = /indexers\/([^/]+)\//.exec(String(val(e, "apiPath")))?.[1] ?? "";
    if (!(id in jackett.configured!)) return [{ propertyName: "", errorMessage: "Unknown indexer", isWarning: false }];
    return [];
  };
  const http: Http = {
    async fetch(url, init) {
      const method = init?.method ?? "GET";
      const body = init?.body && init.headers?.["Content-Type"] === "application/json" ? (JSON.parse(init.body) as Entry) : init?.body;
      calls.push({ method, url, body });
      const reply = (status: number, value?: unknown) => ({ status, text: async () => (value === undefined ? "" : typeof value === "string" ? value : JSON.stringify(value)) });
      const u = new URL(url);
      // Providers.
      if (u.pathname === "/jsonrpc/version") {
        const want = "Basic " + Buffer.from(`${nzbget.user}:${nzbget.secret}`).toString("base64");
        return init?.headers?.Authorization === want ? reply(200, { result: "26.0" }) : reply(401);
      }
      if (u.pathname === "/api/v2/auth/login") {
        const form = new URLSearchParams(String(init?.body ?? ""));
        return form.get("username") === qbit.user && form.get("password") === qbit.secret ? reply(204) : reply(401, "Unauthorized");
      }
      if (u.pathname.endsWith("/torznab/api")) {
        if (u.searchParams.get("apikey") !== jackett.secret) return reply(200, '<?xml version="1.0"?><error code="100" description="Invalid API Key" />');
        const items = Object.entries(jackett.configured!).map(([id, t]) => `<indexer id="${id}" configured="true"><title>${t}</title></indexer>`).join("");
        return reply(200, `<?xml version="1.0"?><indexers>${items}</indexers>`);
      }
      // The app.
      if (init?.headers?.["X-Api-Key"] !== APP.apiKey) return reply(401);
      const m = /^\/api\/v3\/(downloadclient|indexer)(?:\/(schema|test|\d+))?$/.exec(u.pathname);
      if (!m) return reply(404);
      const [, kind, sub] = m;
      const force = u.searchParams.get("forceSave") === "true";
      if (method === "GET" && !sub) return reply(200, store[kind].map(masked));
      if (method === "GET" && sub === "schema") {
        return reply(200, kind === "downloadclient"
          ? [client(0, "", "Nzbget", "localhost", 6789, MASK, {}), client(0, "", "QBittorrent", "localhost", 8080, "", {})].map((e) => ({ ...e, fields: e.fields!.map((x) => x.name === "tvCategory" ? { ...x, value: e.implementation === "Nzbget" ? "tv" : "tv-sonarr" } : x.name === "username" ? { ...x, value: null } : x) }))
          : [{ ...feed(0, "", "", "x", "", false), supportsRss: true, supportsSearch: true, fields: [f("baseUrl", null), f("apiPath", "/api"), f("apiKey", null), f("categories", [5030, 5040])] }]);
      }
      if (method === "GET") {
        const e = store[kind].find((s) => s.id === Number(sub));
        return e ? reply(200, masked(e)) : reply(404);
      }
      if (method === "POST" && sub === "test") {
        const fails = appTest(kind, body as Entry);
        return fails.length ? reply(400, fails) : reply(200);
      }
      // Save: tested when enabled; a mask keeps what is stored.
      const e = body as Entry;
      const on = e.enable === true || e.enableRss === true || e.enableAutomaticSearch === true;
      if (on) {
        const fails = appTest(kind, e);
        if (fails.some((x) => !x.isWarning) || (fails.length && !force)) return reply(400, fails);
      }
      if (method === "POST" && !sub) {
        if (store[kind].some((s) => String(s.name).toLowerCase() === String(e.name).toLowerCase())) {
          return reply(400, [{ propertyName: "Name", errorMessage: "Should be unique", isWarning: false }]);
        }
        const created = { ...e, id: next++ };
        store[kind].push(created);
        return reply(201, masked(created));
      }
      if (method === "PUT") {
        const i = store[kind].findIndex((s) => s.id === Number(sub));
        if (i < 0) return reply(404);
        const was = store[kind][i];
        store[kind][i] = { ...e, fields: e.fields!.map((x) => x.value === MASK ? { ...x, value: val(was, x.name) } : x) };
        return reply(202, masked(store[kind][i]));
      }
      return reply(405);
    },
  };
  const saves = () => calls.filter((c) => (c.method === "PUT" || (c.method === "POST" && !c.url.endsWith("/test"))) && c.url.includes("/api/v3/"));
  return { http, calls, store, saves };
 }
 const aceClients = () => [
  client(1, "NZBGet", "Nzbget", "nzbget", 6789, "nzb-real"),
  client(2, "qBitTorrent", "QBittorrent", "qbittorrent", 8112, "qbt-real"),
 ];
 test("the migration's download client is repointed, its category and everything else kept", async () => {
  const f = fakes({ clients: aceClients() });
  const out = await reconcileClient(f.http, APP, NZBGET, "NZBGet", endpoint(nzbget, "nzbget-api"), f.store.downloadclient.map((e) => ({ ...e })));
  assert.deepEqual(out, [{ what: 'nzbget-api ("NZBGet")', result: "written", fields: ["host", "port"] }]);
  const saved = f.store.downloadclient.find((e) => e.id === 1)!;
  const v = (n: string) => saved.fields!.find((x) => x.name === n)?.value;
  assert.equal(v("host"), "ace.internal");
  assert.equal(v("port"), 20201);
  assert.equal(v("tvCategory"), "Series");
  assert.equal(v("password"), "nzb-real", "the password it held works, so it was kept, not rewritten");
  assert.equal(saved.priority, 1);
 });
 test("rerun: already as the mesh says, nothing saved", async () => {
  const f = fakes({ clients: [client(1, "NZBGet", "Nzbget", "ace.internal", 20201, "nzb-real")] });
  const out = await reconcileClient(f.http, APP, NZBGET, "NZBGet", endpoint(nzbget, "nzbget-api"), f.store.downloadclient);
  assert.deepEqual(out, [{ what: 'nzbget-api ("NZBGet")', result: "unchanged" }]);
  assert.equal(f.saves().length, 0);
 });
 test("a stale password is replaced by the delivered one, which the provider took first", async () => {
  const f = fakes({ clients: [client(2, "qBitTorrent", "QBittorrent", "ace.internal", 8112, "old-pass")] });
  const out = await reconcileClient(f.http, APP, QBIT, "qBitTorrent", endpoint(qbit, "qbittorrent-api"), f.store.downloadclient);
  assert.deepEqual(out, [{ what: 'qbittorrent-api ("qBitTorrent")', result: "written", fields: ["password"] }]);
  assert.equal(f.store.downloadclient[0].fields!.find((x) => x.name === "password")?.value, "qbt-real");
 });
 test("a minted credential is refused by the provider: nothing written, the accept named", async () => {
  const f = fakes({ clients: aceClients() });
  const ep = endpoint(nzbget, "nzbget-api", "a-value-the-mesh-minted");
  assert.deepEqual(await providerTakes(f.http, "nzbget-api", ep), { took: false });
  const remedy = acceptRemedy(APP, "ace", "nzbget-api", "nzbget", "ControlPassword", ep.from);
  assert.match(remedy, /`secret accept ace sonarr nzbget-api --provider ace --from <file holding nzbget's ControlPassword>`/);
  assert.doesNotMatch(remedy, /minted/);
  assert.equal(f.calls.some((c) => c.url.includes("/api/v3/")), false, "the app was not even asked");
  const q = endpoint(qbit, "qbittorrent-api", "minted");
  assert.deepEqual(await providerTakes(f.http, "qbittorrent-api", q), { took: false });
  const j = endpoint(jackett, "jackett-api", "minted");
  assert.deepEqual(await providerTakes(f.http, "jackett-api", j), { took: false });
  assert.equal(f.calls.find((c) => c.url.includes("apikey="))?.url.includes("jackett-real"), false);
 });
 test("a fresh app gets the mesh's client registered, under the mesh's name", async () => {
  const f = fakes({});
  const out = await reconcileClient(f.http, APP, QBIT, "qbittorrent", endpoint(qbit, "qbittorrent-api"), []);
  assert.equal(out[0].result, "created");
  const e = f.store.downloadclient[0];
  assert.equal(e.name, "qbittorrent");
  assert.equal(e.enable, true);
  assert.equal(e.fields!.find((x) => x.name === "tvCategory")?.value, "tv-sonarr", "the app's own default category");
 });
 test("nzbget without the app's default category: registered with none, and said", async () => {
  const f = fakes({});
  const out = await reconcileClient(f.http, APP, NZBGET, "nzbget", endpoint(nzbget, "nzbget-api"), []);
  assert.equal(out[0].result, "notice");
  assert.match((out[0] as { note: string }).note, /category left empty/);
  assert.equal(f.store.downloadclient[0].fields!.find((x) => x.name === "tvCategory")?.value, "");
 });
 test("somebody else's entries are never touched: another name of the same kind, and a clash of names", async () => {
  const mine = client(7, "My seedbox", "QBittorrent", "seedbox.example", 443, "theirs");
  const f = fakes({ clients: [mine] });
  const out = await reconcileClient(f.http, APP, QBIT, "qbittorrent", endpoint(qbit, "qbittorrent-api"), f.store.downloadclient);
  assert.equal(out[0].result, "notice");
  assert.deepEqual(f.store.downloadclient.find((e) => e.id === 7), mine);
  // Same name in another case: refused, and the setting that adopts it named.
  const g = fakes({ clients: aceClients() });
  const clash = await reconcileClient(g.http, APP, NZBGET, "nzbget", endpoint(nzbget, "nzbget-api"), g.store.downloadclient);
  assert.equal(clash[0].result, "refused");
  assert.match((clash[0] as { problem: string }).problem, /downloads\.nzbget-api\.name to "NZBGet"/);
  assert.equal(g.saves().length, 0);
 });
 test("jackett feeds: the migration's are repointed, a person's is left, a listed one is registered", async () => {
  const personal = feed(9, "Seedbox jackett", "https://jackett.seedbox.example", "rutracker", "their-key");
  const f = fakes({
    indexers: [
      feed(5, "Torznab - RuTracker", "https://indexers.zurag.be", "rutracker-ru", "jackett-real", false),
      feed(6, "Torznab - Torrent9", "https://indexers.zurag.be", "torrent9", "jackett-real", false),
      feed(4, "Jackett - RARBG", "http://jackett:9117", "therarbg", "old", false),
      personal,
    ],
  });
  const configured = new Map(Object.entries(jackett.configured!));
  const out = await reconcileIndexers(
    f.http, APP, endpoint(jackett, "jackett-api"), configured,
    { adoptHosts: ["indexers.zurag.be", "jackett"], indexers: ["rutracker"] }, [], f.store.indexer,
  );
  const byWhat = Object.fromEntries(out.map((o) => [o.what + ":" + o.result, o]));
  // torrent9: jackett has it; repointed, key already right, tested.
  assert.ok(byWhat['jackett-api ("Torznab - Torrent9", jackett indexer torrent9):written']);
  // rutracker-ru and therarbg: jackett has neither — repointed with the key, untested, and said.
  assert.ok(byWhat['jackett-api ("Jackett - RARBG", jackett indexer therarbg):written']);
  assert.ok(byWhat['jackett-api ("Jackett - RARBG", jackett indexer therarbg):notice']);
  // rutracker is listed and nothing of the mesh's reads it: registered.
  assert.ok(byWhat["jackett-api (jackett indexer rutracker):created"]);
  assert.deepEqual(f.store.indexer.find((e) => e.id === 9), personal, "a person's jackett is not the mesh's");
  const t9 = f.store.indexer.find((e) => e.id === 6)!;
  assert.equal(t9.fields!.find((x) => x.name === "baseUrl")?.value, "http://ace.internal:20204");
  assert.equal(t9.enableRss, false, "disabled stays disabled");
  const created = f.store.indexer.find((e) => e.name === "Jackett - RuTracker")!;
  assert.equal(created.enableRss, true);
  assert.equal(f.calls.some((c) => c.method === "DELETE"), false, "nothing is ever deleted");
 });
 test("jackett feeds rerun: nothing saved, and a remembered host keeps a moved jackett's feeds", async () => {
  const f = fakes({ indexers: [feed(6, "Torznab - Torrent9", "http://ace.internal:20204", "torrent9", "jackett-real")] });
  const configured = new Map(Object.entries(jackett.configured!));
  const out = await reconcileIndexers(f.http, APP, endpoint(jackett, "jackett-api"), configured, { adoptHosts: [], indexers: ["torrent9"] }, [], f.store.indexer);
  assert.deepEqual(out.map((o) => o.result), ["unchanged"]);
  assert.equal(f.saves().length, 0);
  // jackett moved to novox: the feed on ace.internal is still the mesh's because it was remembered.
  const moved = { ...jackett, host: "novox.internal" };
  const g = fakes({ indexers: [feed(6, "Torznab - Torrent9", "http://ace.internal:20204", "torrent9", "jackett-real")] });
  const saved = jackett.host;
  jackett.host = moved.host;
  try {
    const again = await reconcileIndexers(g.http, APP, endpoint(moved, "jackett-api"), configured, { adoptHosts: [], indexers: [] }, ["ace.internal"], g.store.indexer);
    assert.equal(again[0].result, "written");
    assert.equal(g.store.indexer[0].fields!.find((x) => x.name === "baseUrl")?.value, "http://novox.internal:20204");
  } finally {
    jackett.host = saved;
  }
 });
 test("an enabled entry the app cannot test at the mesh's address is not saved", async () => {
  const f = fakes({ clients: [client(1, "NZBGet", "Nzbget", "nzbget", 6789, "nzb-real")] });
  const elsewhere = { ...nzbget, port: 1 };
  const out = await reconcileClient(f.http, APP, NZBGET, "NZBGet", endpoint(elsewhere, "nzbget-api"), f.store.downloadclient);
  assert.equal(out[0].result, "refused");
  assert.equal(f.store.downloadclient[0].fields!.find((x) => x.name === "host")?.value, "nzbget", "left as it was");
 });
 test("bindings: loopback, no user, no credential are refused; the base path is normalised", () => {
  assert.equal(wanted("nzbget-api", { ...binding(nzbget, "nzbget-api"), at: "127.0.0.1" }, "x", true).ok, false);
  assert.equal(wanted("nzbget-api", binding({ ...nzbget, user: undefined }, "nzbget-api"), "x", true).ok, false);
  assert.equal(wanted("nzbget-api", binding(nzbget, "nzbget-api"), "  \n", true).ok, false);
  const w = wanted("jackett-api", binding(jackett, "jackett-api", { "url-base": "jackett/" }), "k", false);
  assert.equal(w.ok && w.endpoint.urlBase, "/jackett");
 });
 test("a feed is read whole: base path in the base URL or in the API path", () => {
  const e = feed(1, "x", "http://ace.internal:9117/jackett", "rutracker", "k");
  assert.deepEqual(jackettFeed(e), { host: "ace.internal", id: "rutracker" });
  assert.equal(jackettFeed({ ...e, implementation: "Newznab" }), undefined);
  assert.equal(jackettFeed({ ...e, fields: [f("baseUrl", "https://api.nzbgeek.info"), f("apiPath", "/api")] }), undefined);
 });
 test("settings: names default to the provider's, adoption and registration read from the merged file", () => {
  assert.deepEqual(stepSettings({ node: "ace" }), { node: "ace", names: { "nzbget-api": "nzbget", "qbittorrent-api": "qbittorrent" }, indexers: { adoptHosts: [], indexers: [] } });
  const s = stepSettings({ node: "ace", downloads: { "nzbget-api": { name: "NZBGet" }, "jackett-api": { "adopt-hosts": ["jackett"], indexers: ["torrent9", 3] } } });
  assert.equal(s.names["nzbget-api"], "NZBGet");
  assert.deepEqual(s.indexers, { adoptHosts: ["jackett"], indexers: ["torrent9"] });
 });
 // The four copies are one step. Where the siblings are checked out beside this module, they must
 // be byte-identical — a fix made in one and not the others is a bug in three apps.
 test("the step is the same in sonarr, radarr, lidarr and bookshelf", () => {
  const here = dirname(dirname(fileURLToPath(import.meta.url)));
  const modules = dirname(here);
  for (const file of ["downloads/settings.ts", "downloads/index.ts", "test/downloads.test.ts"]) {
    const mine = readFileSync(join(here, file), "utf8");
    for (const sibling of ["sonarr", "radarr", "lidarr", "bookshelf"]) {
      const theirs = join(modules, sibling, file);
      if (existsSync(theirs)) assert.equal(readFileSync(theirs, "utf8"), mine, `${sibling}/${file} differs`);
    }
  }
 });
@@ -8,5 +8,5 @@
    "skipLibCheck": true,
    "noEmit": true
  },
-  "include": ["client.ts", "index.ts", "tools/index.ts", "downloads/settings.ts", "downloads/index.ts"]
+  "include": ["client.ts", "index.ts", "tools/index.ts"]
 }
@@ -100,7 +100,7 @@
      ],
      "env": {
        "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_SEARXNG_URL": "http://127.0.0.1:${port:8080}",
+        "MESH_SEARXNG_URL": "http://127.0.0.1:8080",
        "MESH_SEARXNG_CONFIG_FILE": "/run/config/config.json"
      },
      "restart-on": [
@@ -1,19 +1,6 @@
 {
  "module": "sonarr",
  "version": "1",
  "provides": [
    {
      "name": "sonarr-api",
      "scope": "mesh"
    }
  ],
  "serves": {
    "sonarr-api": {
      "scheme": "http",
      "port": 8989,
      "url-base": ""
    }
  },
  "capabilities": [
    "container-runtime"
  ],
@@ -93,7 +80,7 @@
      ],
      "env": {
        "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_SONARR_URL": "http://127.0.0.1:${port:8989}",
+        "MESH_SONARR_URL": "http://127.0.0.1:8989",
        "MESH_SONARR_CONFIG_DIR": "/var/lib/sonarr/config"
      },
      "artifact": "runtime"