n8n: its own image built from source, placed data, and what its workflows use

The module named /var/lib/n8n, /services/n8n/n8n-data and n8n.novox.be -
paths and a domain no definition may carry (ADR 0112). State and data are
placed directories; the public name is ${bound:route:name} (depends on
mesh-controller #149), for N8N_HOST and WEBHOOK_URL alike.

The endpoint said 5682 while the container publishes 5678. 5682 was one
machine's host port; the endpoint is the software's port and the mesh
assigns the machine's (ADR 0038).

n8n had been run from an image in a registry that no longer exists: the
upstream image plus shadow, a `media` group (2000) with `node` in it, and
a global `uuid`. That recipe is now this module's Dockerfile, built on the
upstream 1.71.3 image named in build.on by digest, with uuid pinned to the
version the running image carries (14.0.1) - Code nodes require() it. The
media group is how the container writes into the shared media library, a
read-write `access` (ADR 0051), mounted where workflows expect it,
/media-library.

The workflows also use a redis (the Redis nodes of the chat workflows) and a
Selenium Chrome (the scraper), which the previous deployment ran beside n8n.
Both are containers on the module's own network, publishing nothing, pinned
to the digests in use; redis keeps its append-only file in a placed
directory.

The basic-auth secret is gone: N8N_BASIC_AUTH_* was removed in n8n 1.0 and
did nothing. The grant's password is a 0400 file owned by `node`, read
through DB_POSTGRESDB_PASSWORD_FILE, so nothing secret is in the
environment. The credentials' encryption key is n8n's own, in the data
directory (config), and moves with it - nothing to mint or accept.

Verified: catalogue tests with MESH_CATALOGUE set; the Dockerfile built
against the pinned base gives n8n 1.71.3, uid 1000 in group 2000, uuid
14.0.1 - the running image's shape. Throwaway containers: an instance on
PostgreSQL 15 with an owner, a workflow and an encrypted credential;
stopped, copied, dumped from the copy, restored (--no-owner --role, the
uuid-ossp extension pre-made by the superuser) into a grant-shaped
database on the postgres module's pgvector image (PG17); the new shape
(password from the file, data dir copied) serves /healthz, the owner logs
in, the workflow is listed, and the credential decrypts with the carried
key. The node user writes into a root:2000 0775 library through the media
group; redis and Selenium resolve by name on the module network and
Selenium reports ready. Test containers and data removed.

modules/anthropic-consumer/module.json

@@ -9,13 +9,13 @@
     "model-access"
   ],
   "binds": {
-    "model-access": "${dir:state}/model.json"
+    "model-access": "/var/lib/anthropic-consumer/model.json"
   },
   "secrets": {
-    "model-access": "${dir:state}/access-token"
+    "model-access": "/var/lib/anthropic-consumer/access-token"
   },
   "own-secrets": {
-    "broker": "${dir:mesh-state}/broker"
+    "broker": "/var/lib/mesh/anthropic-consumer/broker"
   },
   "emits": [
     "usage.session"
@@ -24,14 +24,14 @@
     {
       "id": "mesh-state",
       "type": "directory",
-      "mode": "0700",
-      "place": "mesh"
+      "path": "/var/lib/mesh/anthropic-consumer",
+      "mode": "0700"
     },
     {
       "id": "state",
       "type": "directory",
-      "mode": "0700",
-      "place": "."
+      "path": "/var/lib/anthropic-consumer",
+      "mode": "0700"
     },
     {
       "id": "claude-home",
@@ -42,6 +42,7 @@
     {
       "id": "out",
       "type": "directory",
+      "path": "/var/lib/anthropic-consumer/out",
       "mode": "0700"
     },
     {
@@ -55,7 +56,7 @@
         "/app/modules/anthropic-consumer/dist/apply/index.js"
       ],
       "volumes": [
-        "${dir:state}:/run/state"
+        "/var/lib/anthropic-consumer:/run/state"
       ],
       "env": {
         "MESH_MODEL_ACCESS_SECRET_FILE": "/run/state/access-token",
@@ -76,8 +77,8 @@
         "/app/modules/anthropic-consumer/dist/usage/index.js"
       ],
       "volumes": [
-        "${dir:mesh-state}/broker:/run/secrets/broker:ro",
-        "${dir:state}:/run/state"
+        "/var/lib/mesh/anthropic-consumer/broker:/run/secrets/broker:ro",
+        "/var/lib/anthropic-consumer:/run/state"
       ],
       "env": {
         "MESH_BROKER_FILE": "/run/secrets/broker",

modules/anthropic-manager/module.json

@@ -9,13 +9,13 @@
     "model-access"
   ],
   "binds": {
-    "model-access": "${dir:mesh-state}/model.json"
+    "model-access": "/var/lib/mesh/anthropic-manager/model.json"
   },
   "secrets": {
-    "model-access": "${dir:mesh-state}/refresh-token"
+    "model-access": "/var/lib/mesh/anthropic-manager/refresh-token"
   },
   "own-secrets": {
-    "broker": "${dir:mesh-state}/broker"
+    "broker": "/var/lib/mesh/anthropic-manager/broker"
   },
   "emits": [
     "usage.read"
@@ -24,13 +24,13 @@
     {
       "id": "mesh-state",
       "type": "directory",
-      "mode": "0700",
-      "place": "mesh"
+      "path": "/var/lib/mesh/anthropic-manager",
+      "mode": "0700"
     },
     {
       "id": "out",
       "type": "directory",
-      "path": "${dir:mesh-state}/out",
+      "path": "/var/lib/mesh/anthropic-manager/out",
       "mode": "0700"
     },
     {
@@ -45,8 +45,8 @@
         "/app/modules/anthropic-manager/dist/refresh/index.js"
       ],
       "volumes": [
-        "${dir:mesh-state}/broker:/run/secrets/broker:ro",
-        "${dir:mesh-state}:/run/state"
+        "/var/lib/mesh/anthropic-manager/broker:/run/secrets/broker:ro",
+        "/var/lib/mesh/anthropic-manager:/run/state"
       ],
       "env": {
         "MESH_BROKER_FILE": "/run/secrets/broker",

modules/audit-logger/module.json

@@ -6,7 +6,7 @@
     "**"
   ],
   "own-secrets": {
-    "broker": "${dir:state}/broker"
+    "broker": "/var/lib/audit-logger/broker"
   },
   "build": {
     "on": [
@@ -33,12 +33,13 @@
     {
       "id": "state",
       "type": "directory",
-      "mode": "0700",
-      "place": "."
+      "path": "/var/lib/audit-logger",
+      "mode": "0700"
     },
     {
       "id": "trail",
       "type": "directory",
+      "path": "/var/lib/audit-logger/trail",
       "mode": "0700"
     },
     {
@@ -47,8 +48,8 @@
       "name": "mesh-audit-logger",
       "network": "host",
       "volumes": [
-        "${dir:state}/broker:/run/secrets/broker:ro",
-        "${dir:trail}:/trail"
+        "/var/lib/audit-logger/broker:/run/secrets/broker:ro",
+        "/var/lib/audit-logger/trail:/trail"
       ],
       "env": {
         "MESH_BROKER_FILE": "/run/secrets/broker",

modules/baserow/module.json

@@ -26,7 +26,7 @@
   },
   "own-secrets": {
     "admin": "${dir:state}/admin.secret",
-    "broker": "${dir:mesh-state}/broker"
+    "broker": "/var/lib/mesh/baserow/broker"
   },
   "listens": [
     {
@@ -41,8 +41,8 @@
     {
       "id": "mesh-state",
       "type": "directory",
-      "mode": "0700",
-      "place": "mesh"
+      "path": "/var/lib/mesh/baserow",
+      "mode": "0700"
     },
     {
       "id": "state",
@@ -88,7 +88,7 @@
     {
       "id": "runtime-config",
       "type": "file",
-      "path": "${dir:mesh-state}/config.json",
+      "path": "/var/lib/mesh/baserow/config.json",
       "mode": "0600",
       "content": "{\n  \"password\": \"${secret:admin}\",\n  \"host\": \"${bound:route:name}\"\n}\n",
       "merge": "json"
@@ -99,8 +99,8 @@
       "name": "mesh-baserow",
       "network": "baserow",
       "volumes": [
-        "${dir:mesh-state}/broker:/run/secrets/broker:ro",
-        "${dir:mesh-state}/config.json:/run/config/config.json:ro"
+        "/var/lib/mesh/baserow/broker:/run/secrets/broker:ro",
+        "/var/lib/mesh/baserow/config.json:/run/config/config.json:ro"
       ],
       "env": {
         "MESH_BROKER_FILE": "/run/secrets/broker",

modules/bazarr/Dockerfile

@@ -0,0 +1,24 @@
+# bazarr's runtime: the tool runtime, carrying this module's compiled code.
+#
+# **Built from this module's own directory and nothing else.** The sdk and the tool runtime are in
+# the base images, published like any other artifact — which is what makes this buildable by the
+# mesh from a repository and a path (novox/hq ADR 0069) rather than only on a workstation that
+# happens to have the siblings.
+#
+# Two bases, named rather than pinned (novox/hq issue 044): the image this is COMPILED in and the
+# image it RUNS in — the second must not carry a compiler. Declared in module.json's `build.on`.
+ARG BUILD_BASE
+ARG RUNTIME_BASE
+
+FROM ${BUILD_BASE} AS build
+WORKDIR /app/modules/bazarr
+COPY . .
+RUN node /app/node_modules/typescript/bin/tsc client.ts index.ts tools/index.ts \
+      --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist
+
+FROM ${RUNTIME_BASE}
+COPY --from=build /app/modules/bazarr/dist /app/modules/bazarr/dist
+# Every serve-time entrypoint, loaded by the runtime in serve mode: tools and events serve, and a
+# provider's provisioner runs its reconcile loop in the same process, with the broker connected —
+# the convention novox/hq issues 060/061 settled.
+ENV MESH_TOOL_MODULES=/app/modules/bazarr/dist/index.js,/app/modules/bazarr/dist/tools/index.js

modules/bazarr/client.ts

@@ -0,0 +1,173 @@
+// The Bazarr API client — bazarr's own code, living in the module (novox/hq ADR 0039). Bazarr
+// manages subtitles for a Sonarr/Radarr library: it tracks which episodes and movies are still
+// missing subtitles, searches providers for them, and records what it downloaded. This client
+// talks its /api surface (keyed by an X-API-KEY header); bazarr's tools and events import it.
+
+import { readFileSync } from "node:fs";
+
+export interface WantedSubtitle {
+  kind: "episode" | "movie";
+  title: string; // series + episode, or movie title
+  path?: string;
+  seriesId?: number; // sonarr series id (episodes)
+  episodeId?: number; // sonarr episode id (episodes)
+  radarrId?: number; // radarr movie id (movies)
+  missing: string[]; // language names still missing
+}
+
+export interface ProviderSubtitle {
+  provider: string;
+  language: string;
+  hearingImpaired: boolean;
+  forced: boolean;
+  score?: number;
+  release?: string;
+  subtitle: string; // the opaque token Bazarr uses to download this exact result
+}
+
+export interface HistoryEntry {
+  kind: "episode" | "movie";
+  id: string; // stable dedup key across polls
+  title: string;
+  language?: string;
+  provider?: string;
+  path?: string;
+  timestamp?: string;
+  description?: string;
+}
+
+/** The settings-merged config the mesh delivers (novox/hq ADR 0046): { url, apiKey, token, password, user, ... }. */
+function meshConfig(file?: string): Record<string, string> {
+  if (!file) return {};
+  try { return JSON.parse(readFileSync(file, "utf8")) as Record<string, string>; }
+  catch { return {}; }
+}
+
+/** Read a secret the mesh mounted at a file path (an own-secret delivered by `secret accept`);
+ *  absent or unreadable yields undefined so callers fall back rather than crash. */
+function readSecret(file?: string): string | undefined {
+  if (!file) return undefined;
+  try { return readFileSync(file, "utf8").trim(); }
+  catch { return undefined; }
+}
+
+export class BazarrClient {
+  readonly baseUrl: string;
+
+  constructor(
+    url: string,
+    private readonly apiKey: string,
+  ) {
+    this.baseUrl = url.replace(/\/$/, "");
+  }
+
+  /** Build from the module's resolved environment. Bazarr's API is keyed; without URL and key
+   *  there is nothing to talk to, so this throws rather than run half-configured. */
+  static fromEnv(env: NodeJS.ProcessEnv = process.env): BazarrClient {
+    const cfg = meshConfig(env.MESH_BAZARR_CONFIG_FILE);
+    const url = cfg.url ?? env.MESH_BAZARR_URL;
+    const apiKey = cfg.apiKey ?? readSecret(env.MESH_BAZARR_API_KEY_FILE) ?? env.MESH_BAZARR_API_KEY;
+    if (!url) throw new Error("no Bazarr URL — set MESH_BAZARR_URL");
+    if (!apiKey) throw new Error("no Bazarr API key — set MESH_BAZARR_API_KEY");
+    return new BazarrClient(url, apiKey);
+  }
+
+  private async request(method: string, path: string, params: Record<string, string> = {}): Promise<any> {
+    const url = new URL(`${this.baseUrl}/api${path}`);
+    for (const [k, v] of Object.entries(params)) url.searchParams.set(k, v);
+    const res = await fetch(url.toString(), { method, headers: { "X-API-KEY": this.apiKey, Accept: "application/json" } });
+    if (!res.ok) throw new Error(`Bazarr API ${method} ${path}: ${res.status} ${await res.text()}`);
+    // Downloads/patches return an empty body; only GETs carry JSON.
+    const text = await res.text();
+    return text ? JSON.parse(text) : {};
+  }
+
+  private get(path: string, params?: Record<string, string>): Promise<any> {
+    return this.request("GET", path, params);
+  }
+
+  private languageNames(missing: any[]): string[] {
+    return (missing ?? []).map((m: any) => m?.name ?? m?.code2 ?? m?.code3).filter(Boolean);
+  }
+
+  /** Episodes and movies still missing subtitles — Bazarr's core "what's left to do" list. */
+  async getWanted(limit = 50): Promise<WantedSubtitle[]> {
+    const [eps, movies] = await Promise.all([
+      this.get("/episodes/wanted", { start: "0", length: String(limit) }),
+      this.get("/movies/wanted", { start: "0", length: String(limit) }),
+    ]);
+    const episodes: WantedSubtitle[] = (eps?.data ?? []).map((e: any) => ({
+      kind: "episode" as const,
+      title: `${e.seriesTitle ?? e.series ?? "Unknown"} — ${e.episodeTitle ?? e.episode_title ?? ""}`.trim(),
+      path: e.path,
+      seriesId: e.sonarrSeriesId,
+      episodeId: e.sonarrEpisodeId,
+      missing: this.languageNames(e.missing_subtitles),
+    }));
+    const films: WantedSubtitle[] = (movies?.data ?? []).map((m: any) => ({
+      kind: "movie" as const,
+      title: m.title ?? "Unknown",
+      path: m.path,
+      radarrId: m.radarrId,
+      missing: this.languageNames(m.missing_subtitles),
+    }));
+    return [...episodes, ...films];
+  }
+
+  /** Ask providers what subtitles are available for one wanted episode — a manual search. */
+  async searchEpisode(episodeId: number): Promise<ProviderSubtitle[]> {
+    const raw = await this.get("/providers/episodes", { episodeid: String(episodeId) });
+    return this.mapProviderResults(raw);
+  }
+
+  /** Ask providers what subtitles are available for one movie — a manual search. */
+  async searchMovie(radarrId: number): Promise<ProviderSubtitle[]> {
+    const raw = await this.get("/providers/movies", { radarrid: String(radarrId) });
+    return this.mapProviderResults(raw);
+  }
+
+  private mapProviderResults(raw: any): ProviderSubtitle[] {
+    const list = Array.isArray(raw) ? raw : (raw?.data ?? []);
+    return list.map((r: any) => ({
+      provider: r.provider,
+      language: r.language?.name ?? r.language ?? "unknown",
+      hearingImpaired: Boolean(r.hearing_impaired ?? r.hi),
+      forced: Boolean(r.forced),
+      score: r.score,
+      release: r.release_info?.[0] ?? r.release_info,
+      subtitle: r.subtitle,
+    }));
+  }
+
+  /** Recent subtitle-download history, episodes and movies together, newest first. Each entry
+   *  carries a stable id so the events poller can tell a fresh download from one already seen. */
+  async getHistory(limit = 40): Promise<HistoryEntry[]> {
+    const [eps, movies] = await Promise.all([
+      this.get("/episodes/history", { start: "0", length: String(limit) }),
+      this.get("/movies/history", { start: "0", length: String(limit) }),
+    ]);
+    const key = (kind: string, r: any): string =>
+      `${kind}:${r.timestamp ?? r.parsed_timestamp ?? ""}:${r.subtitles_path ?? r.path ?? ""}:${r.language?.code3 ?? r.language ?? ""}`;
+    const episodes: HistoryEntry[] = (eps?.data ?? []).map((r: any) => ({
+      kind: "episode" as const,
+      id: key("episode", r),
+      title: `${r.seriesTitle ?? "Unknown"} — ${r.episodeTitle ?? ""}`.trim(),
+      language: r.language?.name ?? r.language,
+      provider: r.provider,
+      path: r.subtitles_path,
+      timestamp: r.timestamp,
+      description: r.description,
+    }));
+    const films: HistoryEntry[] = (movies?.data ?? []).map((r: any) => ({
+      kind: "movie" as const,
+      id: key("movie", r),
+      title: r.title ?? "Unknown",
+      language: r.language?.name ?? r.language,
+      provider: r.provider,
+      path: r.subtitles_path,
+      timestamp: r.timestamp,
+      description: r.description,
+    }));
+    return [...episodes, ...films];
+  }
+}

modules/bazarr/index.ts

@@ -0,0 +1,47 @@
+// bazarr's events. The tool runtime imports this once the broker is bound. Bazarr's one genuinely
+// observable thing is a subtitle arriving: it works away in the background, searching providers for
+// the missing-subtitle list, and when it succeeds a subtitle appears in its history. That is worth
+// announcing to the mesh.
+//
+// Emits (novox/hq ADR 0041/0042):
+//   module.bazarr.subtitle.downloaded   — a subtitle was fetched for an episode or movie
+//
+// Bazarr has nothing on the mesh it usefully reacts to (a download completing is Sonarr/Radarr's
+// business, and they trigger Bazarr directly), so it consumes nothing — a pure emitter.
+//
+// The event is observation-based: poll history and diff. Primed silently on the first look, or a
+// restart would re-announce the whole recent history as freshly downloaded.
+
+import { emit } from "@novox/mesh-sdk/events";
+import { BazarrClient } from "./client.js";
+
+const bazarr = BazarrClient.fromEnv();
+
+const seen = new Set<string>();
+let primed = false;
+async function pollHistory(): Promise<void> {
+  const entries = await bazarr.getHistory(40);
+  for (const entry of entries) {
+    if (seen.has(entry.id)) continue;
+    if (primed) {
+      await emit("subtitle.downloaded", {
+        kind: entry.kind,
+        title: entry.title,
+        language: entry.language,
+        provider: entry.provider,
+        path: entry.path,
+      });
+    }
+    seen.add(entry.id);
+  }
+  primed = true;
+}
+
+const tick = (fn: () => Promise<void>, everyMs: number): void => {
+  const run = (): void => void fn().catch((err) => console.error(`[bazarr] ${err}`));
+  setInterval(run, everyMs);
+  run();
+};
+tick(pollHistory, 60_000);
+
+console.log("[bazarr] watching subtitle-download history");

modules/bazarr/module.json

@@ -0,0 +1,141 @@
+{
+  "module": "bazarr",
+  "version": "1",
+  "capabilities": [
+    "container-runtime"
+  ],
+  "emits": [
+    "subtitle.downloaded"
+  ],
+  "own-secrets": {
+    "broker": "/var/lib/mesh/bazarr/broker",
+    "api-key": "/var/lib/mesh/bazarr/api-key"
+  },
+  "listens": [
+    {
+      "name": "web",
+      "port": 6767,
+      "protocol": "tcp",
+      "from": "mesh",
+      "why": "managing subtitles"
+    }
+  ],
+  "accesses": [
+    {
+      "path": "/services/media/movies",
+      "mode": "read-write"
+    },
+    {
+      "path": "/services/media/series",
+      "mode": "read-write"
+    },
+    {
+      "path": "/services/media/anime",
+      "mode": "read-write"
+    },
+    {
+      "path": "/services/media/downloads",
+      "mode": "read"
+    }
+  ],
+  "resources": [
+    {
+      "id": "mesh-state",
+      "type": "directory",
+      "path": "/var/lib/mesh/bazarr",
+      "mode": "0700"
+    },
+    {
+      "id": "config",
+      "type": "directory",
+      "path": "/services/bazarr/config",
+      "mode": "0700",
+      "owner": "1000:1000"
+    },
+    {
+      "id": "server",
+      "type": "container",
+      "name": "bazarr",
+      "image": "lscr.io/linuxserver/bazarr@sha256:3a820372f19fcb2981ea19fe4b5382934d67414afaba974bce831ddda0a64a02",
+      "env": {
+        "PUID": "1000",
+        "PGID": "1000",
+        "TZ": "Etc/UTC"
+      },
+      "ports": [
+        "6767"
+      ],
+      "volumes": [
+        "/services/bazarr/config:/config",
+        "/services/media/movies:/movies",
+        "/services/media/series:/series",
+        "/services/media/anime:/anime",
+        "/services/media/downloads:/downloads"
+      ]
+    },
+    {
+      "id": "runtime-config",
+      "type": "file",
+      "path": "/var/lib/mesh/bazarr/config.json",
+      "mode": "0600",
+      "content": "{}\n",
+      "merge": "json"
+    },
+    {
+      "id": "runtime",
+      "type": "container",
+      "name": "mesh-bazarr",
+      "network": "host",
+      "volumes": [
+        "/var/lib/mesh/bazarr/broker:/run/secrets/broker:ro",
+        "/var/lib/mesh/bazarr/api-key:/run/secrets/api-key:ro",
+        "/var/lib/mesh/bazarr/config.json:/run/config/config.json:ro",
+        "/services/bazarr/config:/var/lib/bazarr/config:ro"
+      ],
+      "env": {
+        "MESH_BROKER_FILE": "/run/secrets/broker",
+        "MESH_BAZARR_URL": "http://127.0.0.1:6767",
+        "MESH_BAZARR_API_KEY_FILE": "/run/secrets/api-key",
+        "MESH_BAZARR_CONFIG_FILE": "/run/config/config.json",
+        "MESH_BAZARR_CONFIG_DIR": "/var/lib/bazarr/config"
+      },
+      "restart-on": [
+        "runtime-config"
+      ],
+      "artifact": "runtime"
+    }
+  ],
+  "requires": [
+    "route"
+  ],
+  "contributes": {
+    "route": {
+      "label": "subs",
+      "endpoint": "web"
+    }
+  },
+  "binds": {
+    "route": "/var/lib/mesh/bazarr/route.json"
+  },
+  "build": {
+    "on": [
+      {
+        "arg": "BUILD_BASE",
+        "module": "mesh-tools",
+        "artifact": "build"
+      },
+      {
+        "arg": "RUNTIME_BASE",
+        "module": "mesh-tools",
+        "artifact": "runtime"
+      }
+    ],
+    "artifacts": [
+      {
+        "name": "runtime",
+        "kind": "image",
+        "from": "Dockerfile"
+      }
+    ]
+  }
+}

modules/bazarr/package.json

@@ -0,0 +1,14 @@
+{
+  "name": "@novox/module-bazarr",
+  "version": "0.1.0",
+  "description": "bazarr — subtitle management. Its API client, tools and events live here (novox/hq ADR 0039).",
+  "type": "module",
+  "private": true,
+  "dependencies": {
+    "@novox/mesh-sdk": "^0.1.0"
+  },
+  "devDependencies": {
+    "@types/node": "^22.0.0",
+    "typescript": "^5.6.0"
+  }
+}

modules/bazarr/tools/index.ts

@@ -0,0 +1,57 @@
+// bazarr's tools — its own code (novox/hq ADR 0039), importing bazarr's client. They return
+// structured data; the mesh serves them through the sdk's tool harness.
+
+import { registerModuleTools, type ToolDefinition } from "@novox/mesh-sdk/tools";
+import { BazarrClient } from "../client.js";
+
+export function getBazarrTools(bazarr: BazarrClient): ToolDefinition[] {
+  return [
+    {
+      name: "bazarr_wanted",
+      description: "Episodes and movies still missing subtitles, with the languages each still needs.",
+      input: { limit: { type: "number", description: "max items per kind (default 50)" } },
+      run: async (args) => {
+        const wanted = await bazarr.getWanted(args.limit ? Number(args.limit) : 50);
+        return { count: wanted.length, wanted };
+      },
+    },
+    {
+      name: "bazarr_search_subtitles",
+      description: "Manually search subtitle providers for one wanted item — pass an episodeId or a radarrId.",
+      input: {
+        episodeId: { type: "number", description: "a Sonarr episode id (from bazarr_wanted)" },
+        radarrId: { type: "number", description: "a Radarr movie id (from bazarr_wanted)" },
+      },
+      run: async (args) => {
+        if (args.episodeId !== undefined) {
+          const results = await bazarr.searchEpisode(Number(args.episodeId));
+          return { kind: "episode", episodeId: Number(args.episodeId), count: results.length, results };
+        }
+        if (args.radarrId !== undefined) {
+          const results = await bazarr.searchMovie(Number(args.radarrId));
+          return { kind: "movie", radarrId: Number(args.radarrId), count: results.length, results };
+        }
+        throw new Error("pass either episodeId or radarrId");
+      },
+    },
+    {
+      name: "bazarr_history",
+      description: "Recent subtitle-download history — what was downloaded, for which title, from which provider.",
+      input: { limit: { type: "number", description: "max entries per kind (default 40)" } },
+      run: async (args) => {
+        const history = await bazarr.getHistory(args.limit ? Number(args.limit) : 40);
+        return { count: history.length, history };
+      },
+    },
+  ];
+}
+
+// Exposed only when Bazarr is configured; otherwise bazarr contributes no tools rather than
+// failing the whole runtime.
+registerModuleTools("bazarr", (env) => {
+  try {
+    return getBazarrTools(BazarrClient.fromEnv(env));
+  } catch {
+    return [];
+  }
+});

modules/bazarr/tsconfig.json

@@ -0,0 +1,12 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "NodeNext",
+    "moduleResolution": "NodeNext",
+    "strict": true,
+    "esModuleInterop": true,
+    "skipLibCheck": true,
+    "noEmit": true
+  },
+  "include": ["client.ts", "index.ts", "tools/index.ts"]
+}

modules/bookshelf/Dockerfile

@@ -0,0 +1,24 @@
+# bookshelf's runtime: the tool runtime, carrying this module's compiled code.
+#
+# **Built from this module's own directory and nothing else.** The sdk and the tool runtime are in
+# the base images, published like any other artifact — which is what makes this buildable by the
+# mesh from a repository and a path (novox/hq ADR 0069) rather than only on a workstation that
+# happens to have the siblings.
+#
+# Two bases, named rather than pinned (novox/hq issue 044): the image this is COMPILED in and the
+# image it RUNS in — the second must not carry a compiler. Declared in module.json's `build.on`.
+ARG BUILD_BASE
+ARG RUNTIME_BASE
+
+FROM ${BUILD_BASE} AS build
+WORKDIR /app/modules/bookshelf
+COPY . .
+RUN node /app/node_modules/typescript/bin/tsc client.ts index.ts tools/index.ts \
+      --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist
+
+FROM ${RUNTIME_BASE}
+COPY --from=build /app/modules/bookshelf/dist /app/modules/bookshelf/dist
+# Every serve-time entrypoint, loaded by the runtime in serve mode: tools and events serve, and a
+# provider's provisioner runs its reconcile loop in the same process, with the broker connected —
+# the convention novox/hq issues 060/061 settled.
+ENV MESH_TOOL_MODULES=/app/modules/bookshelf/dist/index.js,/app/modules/bookshelf/dist/tools/index.js

modules/bookshelf/client.ts

@@ -0,0 +1,136 @@
+// The Bookshelf API client — bookshelf's own code, living in the module (novox/hq ADR 0039).
+// Ported from the shared hal `arr` client, but self-contained: in nox each Servarr app owns its own
+// copy, so a change to Bookshelf's API rebuilds only bookshelf and nothing else. Both this module's
+// tools and its events entrypoint import it, and nothing outside bookshelf does.
+//
+// Bookshelf is a Readarr fork (ghcr.io/pennydreadful/bookshelf). It speaks the Servarr v1 API; its
+// content is "book". Unlike Sonarr/Radarr it exposes no calendar endpoint, so there is no calendar
+// tool here — matching hal, which excluded bookshelf from its calendar-capable apps.
+
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+
+// Bookshelf speaks the v1 API; its content is "book".
+const API_VERSION = "v1";
+const CONTENT_ENDPOINT = "book";
+const APP_NAME = "Bookshelf";
+
+export interface BookshelfQueueItem {
+  /** The queue record id — stable while the item is in the queue, so events can diff on it. */
+  id: number;
+  title: string;
+  status: string;
+  size: string;
+  sizeleft: string;
+  timeleft?: string;
+}
+
+export interface BookshelfContentItem {
+  title: string;
+  author?: string;
+  year?: number;
+  status?: string;
+  monitored: boolean;
+}
+
+export class BookshelfClient {
+  readonly baseUrl: string;
+
+  constructor(
+    url: string,
+    private readonly apiKey: string,
+  ) {
+    this.baseUrl = url.replace(/\/$/, "");
+  }
+
+  /**
+   * Build from the module's resolved environment. The URL defaults to the server on this node (the
+   * runtime shares its network), and the API key is read from MESH_BOOKSHELF_API_KEY or, failing
+   * that, discovered from the server's own config.xml under MESH_BOOKSHELF_CONFIG_DIR — the same
+   * file Bookshelf writes it to, so a running server needs nothing configured by hand. Throws when
+   * no key can be found, so the tools/events simply do not load (the harness treats the throw as
+   * "exposes nothing").
+   */
+  static fromEnv(env: NodeJS.ProcessEnv = process.env): BookshelfClient {
+    const url = env.MESH_BOOKSHELF_URL ?? `http://127.0.0.1:${env.MESH_BOOKSHELF_PORT ?? "8787"}`;
+    const configDir = env.MESH_BOOKSHELF_CONFIG_DIR ?? "/config";
+    const apiKey = env.MESH_BOOKSHELF_API_KEY ?? BookshelfClient.detectApiKey(configDir);
+    if (!apiKey) {
+      throw new Error("Bookshelf not configured — set MESH_BOOKSHELF_API_KEY or make the config dir readable");
+    }
+    return new BookshelfClient(url, apiKey);
+  }
+
+  /** Discover the API key from the server's config.xml, falling back to null. Every Servarr app
+   *  writes <ApiKey> into config.xml at the root of its config directory. */
+  static detectApiKey(configDir: string): string | null {
+    const config = join(configDir, "config.xml");
+    if (existsSync(config)) {
+      const match = readFileSync(config, "utf8").match(/<ApiKey>([^<]+)<\/ApiKey>/);
+      if (match) return match[1];
+    }
+    return null;
+  }
+
+  private async get(endpoint: string, params?: Record<string, string>): Promise<unknown> {
+    const url = new URL(`${this.baseUrl}/api/${API_VERSION}/${endpoint}`);
+    if (params) {
+      for (const [k, v] of Object.entries(params)) url.searchParams.set(k, v);
+    }
+    const res = await fetch(url.toString(), { headers: { "X-Api-Key": this.apiKey } });
+    if (!res.ok) throw new Error(`${APP_NAME} API /${endpoint}: ${res.status} ${await res.text()}`);
+    return res.json();
+  }
+
+  async getStatus(): Promise<{ appName: string; version: string }> {
+    const data = (await this.get("system/status")) as { appName?: string; version?: string };
+    return { appName: data.appName || APP_NAME, version: data.version ?? "unknown" };
+  }
+
+  async getContent(limit?: number): Promise<BookshelfContentItem[]> {
+    const data = await this.get(CONTENT_ENDPOINT);
+    const items: any[] = Array.isArray(data) ? data : ((data as any)?.records ?? []);
+    const mapped = items.map((item) => ({
+      title: item.title ?? "Unknown",
+      author: item.author?.authorName ?? item.authorName,
+      year: item.releaseDate ? new Date(item.releaseDate).getFullYear() : item.year,
+      status: item.status,
+      monitored: item.monitored ?? true,
+    }));
+    return limit ? mapped.slice(0, limit) : mapped;
+  }
+
+  /** Library search is a filter over existing content, not an indexer lookup — same as hal's. */
+  async searchContent(term: string): Promise<BookshelfContentItem[]> {
+    const all = await this.getContent();
+    const lower = term.toLowerCase();
+    return all.filter(
+      (item) =>
+        item.title.toLowerCase().includes(lower) ||
+        (item.author?.toLowerCase().includes(lower) ?? false),
+    );
+  }
+
+  async getQueue(): Promise<{ totalRecords: number; items: BookshelfQueueItem[] }> {
+    const data = (await this.get("queue", { pageSize: "50" })) as { totalRecords?: number; records?: any[] };
+    const records = data.records ?? [];
+    return {
+      totalRecords: data.totalRecords ?? records.length,
+      items: records.map((r) => ({
+        id: r.id,
+        title: r.title ?? r.book?.title ?? r.author?.authorName ?? "Unknown",
+        status: r.status ?? "unknown",
+        size: formatBytes(r.size ?? 0),
+        sizeleft: formatBytes(r.sizeleft ?? 0),
+        timeleft: r.timeleft,
+      })),
+    };
+  }
+}
+
+function formatBytes(bytes: number): string {
+  if (bytes === 0) return "0 B";
+  const units = ["B", "KB", "MB", "GB", "TB"];
+  const i = Math.floor(Math.log(bytes) / Math.log(1024));
+  return `${(bytes / Math.pow(1024, i)).toFixed(1)} ${units[i]}`;
+}

modules/bookshelf/index.ts

@@ -0,0 +1,74 @@
+// bookshelf's events. The tool runtime imports this once the broker is bound. It watches the
+// download queue and turns its comings and goings into mesh events — the same mechanism radarr uses,
+// applied to a Servarr book manager.
+//
+// Emits (novox/hq ADR 0041/0042):
+//   module.bookshelf.book.grabbed        — a release entered the queue (Bookshelf grabbed it)
+//   module.bookshelf.download.completed  — a release left the queue, imported. This routing key is
+//                                          what the plex module consumes (module.*.download.completed)
+//                                          to rescan, so a new audiobook becomes a visible item.
+// Consumes: none.
+//
+// NOTE: the hal bookshelf module emitted no events (its hooks only did install-time provisioning).
+// This queue watcher is new in nox, modelled exactly on radarr's — bookshelf is a Servarr app with
+// the same queue semantics, so the diff-and-emit pattern carries over unchanged.
+//
+// The queue is polled and diffed, primed silently on the first look (like plex's index.ts) so a
+// restart mid-download does not re-announce everything already in flight as freshly grabbed.
+
+import { emit } from "@novox/mesh-sdk/events";
+import { BookshelfClient, type BookshelfQueueItem } from "./client.js";
+
+// Building the client throws when Bookshelf has no URL/key yet. Like the tools (see tools/index.ts),
+// the events entrypoint must not crash the runtime for that — it stays idle until configured.
+function buildClient(): BookshelfClient | null {
+  try {
+    return BookshelfClient.fromEnv();
+  } catch {
+    return null;
+  }
+}
+
+const bookshelf = buildClient();
+
+// Bookshelf removes an item from the queue once it has been imported; a "warning"/"failed" status is
+// how a stuck or broken grab shows itself, so we do not call those a completion when they vanish.
+const FAILED_STATUSES = new Set(["failed", "warning"]);
+
+const inQueue = new Map<number, BookshelfQueueItem>();
+let primed = false;
+
+async function pollQueue(bookshelf: BookshelfClient): Promise<void> {
+  const { items } = await bookshelf.getQueue();
+  const now = new Map(items.map((i) => [i.id, i]));
+
+  if (primed) {
+    // Entered the queue since last look — Bookshelf grabbed a release.
+    for (const [id, item] of now) {
+      if (!inQueue.has(id)) await emit("book.grabbed", { title: item.title, status: item.status });
+    }
+    // Left the queue — imported and done, unless it was last seen failing.
+    for (const [id, item] of inQueue) {
+      if (!now.has(id) && !FAILED_STATUSES.has(item.status)) {
+        await emit("download.completed", { title: item.title });
+      }
+    }
+  }
+
+  inQueue.clear();
+  for (const [id, item] of now) inQueue.set(id, item);
+  primed = true;
+}
+
+const tick = (fn: () => Promise<void>, everyMs: number): void => {
+  const run = (): void => void fn().catch((err) => console.error(`[bookshelf] ${err}`));
+  setInterval(run, everyMs);
+  run();
+};
+
+if (bookshelf) {
+  tick(() => pollQueue(bookshelf), 30_000);
+  console.log("[bookshelf] watching the download queue, emitting grabs and completions");
+} else {
+  console.log("[bookshelf] not configured — events idle until an API key is available");
+}

modules/bookshelf/module.json

@@ -0,0 +1,118 @@
+{
+  "module": "bookshelf",
+  "version": "1",
+  "slug": "books",
+  "capabilities": [
+    "container-runtime"
+  ],
+  "emits": [
+    "book.grabbed",
+    "download.completed"
+  ],
+  "consumes": [],
+  "own-secrets": {
+    "broker": "/var/lib/mesh/bookshelf/broker"
+  },
+  "listens": [
+    {
+      "name": "web",
+      "port": 8787,
+      "protocol": "tcp",
+      "from": "mesh",
+      "why": "managing the ebook/audiobook library"
+    }
+  ],
+  "accesses": [
+    {
+      "path": "/services/media/books",
+      "mode": "read-write"
+    },
+    {
+      "path": "/services/media/downloads",
+      "mode": "read-write"
+    }
+  ],
+  "resources": [
+    {
+      "id": "mesh-state",
+      "type": "directory",
+      "path": "/var/lib/mesh/bookshelf",
+      "mode": "0700"
+    },
+    {
+      "id": "config",
+      "type": "directory",
+      "path": "/services/bookshelf/config",
+      "mode": "0700",
+      "owner": "1000:1000"
+    },
+    {
+      "id": "server",
+      "type": "container",
+      "name": "bookshelf",
+      "image": "ghcr.io/pennydreadful/bookshelf@sha256:388eecc94362580eae31ee0a454be6af516f8a311f8432a521c202fb475f4359",
+      "env": {
+        "PUID": "1000",
+        "PGID": "1000",
+        "TZ": "Etc/UTC"
+      },
+      "ports": [
+        "8787"
+      ],
+      "volumes": [
+        "/services/bookshelf/config:/config",
+        "/services/media/books:/books",
+        "/services/media/downloads:/downloads"
+      ]
+    },
+    {
+      "id": "runtime",
+      "type": "container",
+      "name": "mesh-bookshelf",
+      "network": "host",
+      "volumes": [
+        "/var/lib/mesh/bookshelf/broker:/run/secrets/broker:ro",
+        "/services/bookshelf/config:/var/lib/bookshelf/config:ro"
+      ],
+      "env": {
+        "MESH_BROKER_FILE": "/run/secrets/broker",
+        "MESH_BOOKSHELF_URL": "http://127.0.0.1:8787",
+        "MESH_BOOKSHELF_CONFIG_DIR": "/var/lib/bookshelf/config"
+      },
+      "artifact": "runtime"
+    }
+  ],
+  "requires": [
+    "route"
+  ],
+  "contributes": {
+    "route": {
+      "label": "books",
+      "endpoint": "web"
+    }
+  },
+  "binds": {
+    "route": "/var/lib/mesh/bookshelf/route.json"
+  },
+  "build": {
+    "on": [
+      {
+        "arg": "BUILD_BASE",
+        "module": "mesh-tools",
+        "artifact": "build"
+      },
+      {
+        "arg": "RUNTIME_BASE",
+        "module": "mesh-tools",
+        "artifact": "runtime"
+      }
+    ],
+    "artifacts": [
+      {
+        "name": "runtime",
+        "kind": "image",
+        "from": "Dockerfile"
+      }
+    ]
+  }
+}

modules/bookshelf/package.json

@@ -0,0 +1,14 @@
+{
+  "name": "@novox/module-bookshelf",
+  "version": "0.1.0",
+  "description": "bookshelf — ebook/audiobook management (Readarr fork). Its API client, tools and events live here (novox/hq ADR 0039).",
+  "type": "module",
+  "private": true,
+  "dependencies": {
+    "@novox/mesh-sdk": "^0.1.0"
+  },
+  "devDependencies": {
+    "@types/node": "^22.0.0",
+    "typescript": "^5.6.0"
+  }
+}

modules/bookshelf/tools/index.ts

@@ -0,0 +1,69 @@
+// bookshelf's tools — ported from the shared hal `arr` sdk (novox/hq ADR 0039), importing
+// bookshelf's own client. They return structured data (not the pre-formatted text hal returned); the
+// mesh serves them through the sdk's tool harness. Bookshelf has no calendar endpoint, so there is
+// no calendar tool — matching hal, which excluded it from its calendar-capable apps.
+
+import { registerModuleTools, type ToolDefinition } from "@novox/mesh-sdk/tools";
+import { BookshelfClient } from "../client.js";
+
+export function getBookshelfTools(bookshelf: BookshelfClient): ToolDefinition[] {
+  return [
+    {
+      name: "bookshelf_status",
+      description: "Bookshelf status overview: version, book count, monitored count, queue size.",
+      input: {},
+      run: async () => {
+        const [status, content, queue] = await Promise.all([
+          bookshelf.getStatus(),
+          bookshelf.getContent(),
+          bookshelf.getQueue(),
+        ]);
+        return {
+          app: status.appName,
+          version: status.version,
+          books: content.length,
+          monitored: content.filter((c) => c.monitored).length,
+          queue: queue.totalRecords,
+        };
+      },
+    },
+    {
+      name: "bookshelf_library",
+      description: "List books from the Bookshelf library.",
+      input: { limit: { type: "number", description: "max items to return (default 50)" } },
+      run: async (args) => {
+        const items = await bookshelf.getContent(args.limit ? Number(args.limit) : 50);
+        return { count: items.length, books: items };
+      },
+    },
+    {
+      name: "bookshelf_search",
+      description:
+        "Search the Bookshelf library for books by title or author (filters existing content, not indexers).",
+      input: { query: { type: "string", description: "the search term" } },
+      run: async (args) => {
+        const query = String(args.query);
+        return { query, results: await bookshelf.searchContent(query) };
+      },
+    },
+    {
+      name: "bookshelf_queue",
+      description: "Show the Bookshelf download queue — what is downloading and how far along.",
+      input: {},
+      run: async () => {
+        const queue = await bookshelf.getQueue();
+        return { count: queue.totalRecords, items: queue.items };
+      },
+    },
+  ];
+}
+
+// The tools exist only when Bookshelf is configured; without a URL and key, bookshelf contributes
+// none rather than failing the whole runtime.
+registerModuleTools("bookshelf", (env) => {
+  try {
+    return getBookshelfTools(BookshelfClient.fromEnv(env));
+  } catch {
+    return [];
+  }
+});

modules/bookshelf/tsconfig.json

@@ -0,0 +1,12 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "NodeNext",
+    "moduleResolution": "NodeNext",
+    "strict": true,
+    "esModuleInterop": true,
+    "skipLibCheck": true,
+    "noEmit": true
+  },
+  "include": ["client.ts", "index.ts", "tools/index.ts"]
+}

modules/builder/module.json

@@ -15,32 +15,33 @@
     "npm-package-registry"
   ],
   "binds": {
-    "npm-package-registry": "${dir:mesh-state}/package-registry.json"
+    "npm-package-registry": "/var/lib/mesh/builder/package-registry.json"
   },
   "secrets": {
-    "npm-package-registry": "${dir:mesh-state}/package-registry.secret"
+    "npm-package-registry": "/var/lib/mesh/builder/package-registry.secret"
   },
   "own-secrets": {
-    "broker": "${dir:mesh-state}/broker"
+    "broker": "/var/lib/mesh/builder/broker"
   },
   "resources": [
     {
       "id": "mesh-state",
       "type": "directory",
-      "mode": "0700",
-      "place": "mesh"
+      "path": "/var/lib/mesh/builder",
+      "mode": "0700"
     },
     {
       "id": "workspace",
       "type": "directory",
+      "path": "/var/lib/builder/workspace",
       "mode": "0700"
     },
     {
       "id": "builder-env",
       "type": "file",
-      "path": "${dir:mesh-state}/builder.env",
+      "path": "/var/lib/mesh/builder/builder.env",
       "mode": "0600",
-      "content": "MESH_BROKER_FILE=/run/mesh/broker\nMESH_NODE=${machine:name}\nMESH_REGISTRY=${bound:artifact-store:at}:${bound:artifact-store:port}\nMESH_PACKAGE_BINDING=/run/mesh/package-registry.json\nMESH_NPM_TOKEN_FILE=/run/mesh/package-registry.secret\nMESH_WORKSPACE=${dir:workspace}\n"
+      "content": "MESH_BROKER_FILE=/run/mesh/broker\nMESH_NODE=${machine:name}\nMESH_REGISTRY=${bound:artifact-store:at}:${bound:artifact-store:port}\nMESH_PACKAGE_BINDING=/run/mesh/package-registry.json\nMESH_NPM_TOKEN_FILE=/run/mesh/package-registry.secret\nMESH_WORKSPACE=/var/lib/builder/workspace\n"
     },
     {
       "id": "server",
@@ -48,11 +49,11 @@
       "name": "mesh-builder",
       "artifact": "server",
       "env-file": [
-        "${dir:mesh-state}/builder.env"
+        "/var/lib/mesh/builder/builder.env"
       ],
       "volumes": [
-        "${dir:mesh-state}:/run/mesh:ro",
-        "${dir:workspace}:${dir:workspace}",
+        "/var/lib/mesh/builder:/run/mesh:ro",
+        "/var/lib/builder/workspace:/var/lib/builder/workspace",
         "/var/run/docker.sock:/var/run/docker.sock"
       ],
       "restart-on": [

modules/cloudflare-dns/module.json

@@ -12,14 +12,14 @@
     "public-dns": {}
   },
   "grants": {
-    "public-dns": "${dir:grants}"
+    "public-dns": "/var/lib/cloudflare-dns/grants"
   },
   "receives": {
-    "public-dns": "${dir:grants}/mesh.json"
+    "public-dns": "/var/lib/cloudflare-dns/grants/mesh.json"
   },
   "own-secrets": {
-    "token": "${dir:state}/token",
-    "broker": "${dir:mesh-state}/broker"
+    "token": "/var/lib/cloudflare-dns/token",
+    "broker": "/var/lib/mesh/cloudflare-dns/broker"
   },
   "emits": [
     "record.created",
@@ -29,24 +29,25 @@
     {
       "id": "mesh-state",
       "type": "directory",
-      "mode": "0700",
-      "place": "mesh"
+      "path": "/var/lib/mesh/cloudflare-dns",
+      "mode": "0700"
     },
     {
       "id": "state",
       "type": "directory",
-      "mode": "0700",
-      "place": "."
+      "path": "/var/lib/cloudflare-dns",
+      "mode": "0700"
     },
     {
       "id": "grants",
       "type": "directory",
+      "path": "/var/lib/cloudflare-dns/grants",
       "mode": "0700"
     },
     {
       "id": "config",
       "type": "file",
-      "path": "${dir:state}/config.json",
+      "path": "/var/lib/cloudflare-dns/config.json",
       "merge": "json",
       "content": "{}",
       "mode": "0600"
@@ -57,10 +58,10 @@
       "name": "mesh-cloudflare-dns",
       "network": "host",
       "volumes": [
-        "${dir:state}/config.json:/run/config/config.json:ro",
-        "${dir:grants}:/grants",
-        "${dir:state}/token:/run/secrets/token:ro",
-        "${dir:mesh-state}/broker:/run/secrets/broker:ro"
+        "/var/lib/cloudflare-dns/config.json:/run/config/config.json:ro",
+        "/var/lib/cloudflare-dns/grants:/grants",
+        "/var/lib/cloudflare-dns/token:/run/secrets/token:ro",
+        "/var/lib/mesh/cloudflare-dns/broker:/run/secrets/broker:ro"
       ],
       "env": {
         "MESH_CLOUDFLARE_TOKEN_FILE": "/run/secrets/token",

modules/confluence/module.json

@@ -3,26 +3,26 @@
   "version": "1",
   "slug": "confl",
   "own-secrets": {
-    "token": "${dir:state}/token",
-    "broker": "${dir:mesh-state}/broker"
+    "token": "/var/lib/confluence/token",
+    "broker": "/var/lib/mesh/confluence/broker"
   },
   "resources": [
     {
       "id": "mesh-state",
       "type": "directory",
-      "mode": "0700",
-      "place": "mesh"
+      "path": "/var/lib/mesh/confluence",
+      "mode": "0700"
     },
     {
       "id": "state",
       "type": "directory",
-      "mode": "0700",
-      "place": "."
+      "path": "/var/lib/confluence",
+      "mode": "0700"
     },
     {
       "id": "config",
       "type": "file",
-      "path": "${dir:state}/config.json",
+      "path": "/var/lib/confluence/config.json",
       "merge": "json",
       "content": "{}",
       "mode": "0600"
@@ -33,9 +33,9 @@
       "name": "mesh-runtime-confluence",
       "network": "host",
       "volumes": [
-        "${dir:state}/config.json:/run/config/config.json:ro",
-        "${dir:state}/token:/run/secrets/token:ro",
-        "${dir:mesh-state}/broker:/run/secrets/broker:ro"
+        "/var/lib/confluence/config.json:/run/config/config.json:ro",
+        "/var/lib/confluence/token:/run/secrets/token:ro",
+        "/var/lib/mesh/confluence/broker:/run/secrets/broker:ro"
       ],
       "env": {
         "MESH_CONFLUENCE_TOKEN_FILE": "/run/secrets/token",

modules/de-spiegel/module.json

@@ -15,11 +15,11 @@
     }
   },
   "binds": {
-    "route": "${dir:state}/route.json"
+    "route": "/var/lib/de-spiegel/route.json"
   },
   "own-secrets": {
-    "smtp-user": "${dir:state}/smtp-user.secret",
-    "smtp-pass": "${dir:state}/smtp-pass.secret"
+    "smtp-user": "/var/lib/de-spiegel/smtp-user.secret",
+    "smtp-pass": "/var/lib/de-spiegel/smtp-pass.secret"
   },
   "listens": [
     {
@@ -34,13 +34,13 @@
     {
       "id": "state",
       "type": "directory",
-      "mode": "0700",
-      "place": "."
+      "path": "/var/lib/de-spiegel",
+      "mode": "0700"
     },
     {
       "id": "server-env",
       "type": "file",
-      "path": "${dir:state}/server.env",
+      "path": "/var/lib/de-spiegel/server.env",
       "mode": "0600",
       "content": "SMTP_AUTH_USER=${secret:smtp-user}\nSMTP_AUTH_PASS=${secret:smtp-pass}\n"
     },
@@ -56,7 +56,7 @@
       "image": "registry-api.novox.be/novox/de-spiegel@sha256:e144b72ce9c145870470d765343549f2c60211728cd118b9ff0e4029f36342ba",
       "network": "de-spiegel",
       "env-file": [
-        "${dir:state}/server.env"
+        "/var/lib/de-spiegel/server.env"
       ],
       "ports": [
         "35621"

modules/dhcpcd/module.json

@@ -3,8 +3,7 @@
   "version": "1",
   "capabilities": [
     "package-manager",
-    "service-manager",
-    "uplink-dhcpcd"
+    "service-manager"
   ],
   "claims": [
     {

modules/distribution/module.json

@@ -9,7 +9,7 @@
   ],
   "claims": [
     {
-      "name": "mesh-artifact-store",
+      "name": "the-artifact-store",
       "scope": "mesh"
     }
   ],

modules/gitea/client.ts

@@ -45,14 +45,6 @@ export interface GiteaPull {
   html_url: string;
 }
 
-export interface GiteaComment {
-  id: number;
-  user?: string;
-  body: string;
-  created_at?: string;
-  html_url: string;
-}
-
 export interface GiteaLabel {
   id: number;
   name: string;
@@ -265,64 +257,6 @@ export class GiteaClient {
     );
   }
 
-  /** Close or reopen a pull request without merging it. A pull request is an issue to the forge's
-   *  state machine, and the pulls endpoint takes the same `state`. */
-  async setPullState(owner: string, repo: string, index: number, state: "open" | "closed"): Promise<GiteaPull> {
-    return GiteaClient.mapPull(
-      await this.request<any>(`/repos/${owner}/${repo}/pulls/${index}`, { method: "PATCH", body: JSON.stringify({ state }) }),
-    );
-  }
-
-  /** Change a pull request's title or body; a field left undefined is left alone. */
-  async updatePullRequest(owner: string, repo: string, index: number, data: { title?: string; body?: string }): Promise<GiteaPull> {
-    return GiteaClient.mapPull(
-      await this.request<any>(`/repos/${owner}/${repo}/pulls/${index}`, { method: "PATCH", body: JSON.stringify(data) }),
-    );
-  }
-
-  /** The unified diff of a pull request, as text. */
-  async pullDiff(owner: string, repo: string, index: number): Promise<string> {
-    return this.requestText(`/repos/${owner}/${repo}/pulls/${index}.diff`);
-  }
-
-  /** Every comment on an issue or pull request, oldest first. */
-  async listComments(owner: string, repo: string, index: number): Promise<GiteaComment[]> {
-    const raw = await this.request<any[]>(`/repos/${owner}/${repo}/issues/${index}/comments`);
-    return (raw ?? []).map((c) => ({
-      id: Number(c?.id ?? 0),
-      user: c?.user?.login,
-      body: String(c?.body ?? ""),
-      created_at: c?.created_at,
-      html_url: String(c?.html_url ?? ""),
-    }));
-  }
-
-  /** One file's contents at a ref (default the repository's default branch), decoded. */
-  async getFile(owner: string, repo: string, path: string, ref?: string): Promise<{ path: string; ref?: string; sha: string; size: number; content: string }> {
-    const qs = ref ? `?ref=${encodeURIComponent(ref)}` : "";
-    const f = await this.request<any>(`/repos/${owner}/${repo}/contents/${path.split("/").map(encodeURIComponent).join("/")}${qs}`);
-    if (!f || f.type !== "file") throw new Error(`Gitea API: ${path} is not a file`);
-    const content = f.encoding === "base64" ? Buffer.from(String(f.content ?? ""), "base64").toString("utf8") : String(f.content ?? "");
-    return { path, ref, sha: String(f.sha ?? ""), size: Number(f.size ?? content.length), content };
-  }
-
-  async listBranches(owner: string, repo: string): Promise<{ name: string; commit: string; protected: boolean }[]> {
-    const raw = await this.request<any[]>(`/repos/${owner}/${repo}/branches?limit=100`);
-    return (raw ?? []).map((b) => ({ name: String(b?.name ?? ""), commit: String(b?.commit?.id ?? ""), protected: Boolean(b?.protected) }));
-  }
-
-  async deleteBranch(owner: string, repo: string, branch: string): Promise<void> {
-    await this.request(`/repos/${owner}/${repo}/branches/${encodeURIComponent(branch)}`, { method: "DELETE" });
-  }
-
-  /** A request whose answer is text, not JSON — a diff. Same token handling as request(). */
-  private async requestText(path: string): Promise<string> {
-    const token = await this.tokens.current();
-    const res = await this.send(path, { headers: { Accept: "text/plain" } }, token);
-    if (!res.ok) throw new Error(`Gitea API ${path}: ${res.status} ${await res.text()}`);
-    return res.text();
-  }
-
   async mergePullRequest(owner: string, repo: string, index: number, method = "merge", deleteBranch = false): Promise<void> {
     await this.request(`/repos/${owner}/${repo}/pulls/${index}/merge`, {
       method: "POST",

modules/gitea/module.json

@@ -86,19 +86,19 @@
     }
   ],
   "own-secrets": {
-    "broker": "${dir:mesh-state}/broker"
+    "broker": "/var/lib/mesh/gitea/broker"
   },
   "resources": [
     {
       "id": "mesh-state",
       "type": "directory",
-      "mode": "0700",
-      "place": "mesh"
+      "path": "/var/lib/mesh/gitea",
+      "mode": "0700"
     },
     {
       "id": "runtime-state",
       "type": "directory",
-      "path": "${dir:mesh-state}/state",
+      "path": "/var/lib/mesh/gitea/state",
       "mode": "0700"
     },
     {
@@ -175,7 +175,7 @@
     {
       "id": "runtime-config",
       "type": "file",
-      "path": "${dir:mesh-state}/config.json",
+      "path": "/var/lib/mesh/gitea/config.json",
       "mode": "0600",
       "content": "{}\n",
       "merge": "json"
@@ -186,11 +186,11 @@
       "name": "mesh-gitea",
       "network": "host",
       "volumes": [
-        "${dir:mesh-state}/broker:/run/secrets/broker:ro",
-        "${dir:mesh-state}/config.json:/run/config/config.json:ro",
+        "/var/lib/mesh/gitea/broker:/run/secrets/broker:ro",
+        "/var/lib/mesh/gitea/config.json:/run/config/config.json:ro",
         "${dir:grants}:${dir:grants}:ro",
         "${dir:state}/admin.secret:/run/secrets/admin:ro",
-        "${dir:runtime-state}:/run/state"
+        "/var/lib/mesh/gitea/state:/run/state"
       ],
       "env": {
         "MESH_BROKER_FILE": "/run/secrets/broker",

modules/gitea/test/token.test.ts

@@ -31,9 +31,6 @@ interface Forge {
   tokens: Map<string, string>;
   scopesOf: Map<string, string[]>;
   admins: Map<string, string>;
-  pullState: string;
-  pullTitle: string;
-  branchDeleted: boolean;
   close(): Promise<void>;
 }
 
@@ -44,9 +41,6 @@ function fakeForge(): Promise<Forge> {
     tokens: new Map<string, string>(), // name -> value
     scopesOf: new Map<string, string[]>(), // value -> scopes, so a route can enforce them like gitea does
     admins: new Map([[ADMIN, PASSWORD]]),
-    pullState: "open",
-    pullTitle: "The console shipped",
-    branchDeleted: false,
   };
   // write:X implies read:X — gitea's own rule (models/auth/access_token_scope.go).
   const covers = (scopes: string[], required: string): boolean =>
@@ -92,37 +86,6 @@ function fakeForge(): Promise<Forge> {
       }
       return json(res, 405, { message: "method not allowed" });
     }
-    const tokenOf = (): string => {
-      const h = req.headers.authorization ?? "";
-      return h.startsWith("token ") ? h.slice(6) : "";
-    };
-    const pull = url.pathname.match(/^\/api\/v1\/repos\/novox\/hq\/pulls\/(\d+)(\.diff)?$/);
-    if (pull) {
-      if (![...forge.tokens.values()].includes(tokenOf())) return json(res, 401, { message: "token is required" });
-      if (pull[2]) {
-        res.writeHead(200, { "Content-Type": "text/plain" });
-        return res.end("diff --git a/x b/x\n--- a/x\n+++ b/x\n@@ -1 +1 @@\n-old\n+new\n");
-      }
-      if (req.method === "PATCH") {
-        const patch = await body(req);
-        forge.pullState = patch?.state ?? forge.pullState;
-        forge.pullTitle = patch?.title ?? forge.pullTitle;
-      }
-      return json(res, 200, { number: Number(pull[1]), title: forge.pullTitle, state: forge.pullState, merged: false,
-        user: { login: "mesh-admin" }, head: { ref: "feat/x" }, base: { ref: "main" }, html_url: "http://fake/novox/hq/pulls/" + pull[1] });
-    }
-    if (url.pathname === "/api/v1/repos/novox/hq/issues/223/comments") {
-      return json(res, 200, [{ id: 1, user: { login: "jochen" }, body: "landed elsewhere", created_at: "2026-10-01T00:00:00Z", html_url: "http://fake/c/1" }]);
-    }
-    if (url.pathname === "/api/v1/repos/novox/hq/contents/README.md") {
-      return json(res, 200, { type: "file", encoding: "base64", sha: "abc", size: 5, content: Buffer.from("hello").toString("base64") });
-    }
-    if (url.pathname === "/api/v1/repos/novox/hq/branches") {
-      return json(res, 200, [{ name: "main", protected: true, commit: { id: "aaaa" } }, { name: "feat/x", protected: false, commit: { id: "bbbb" } }]);
-    }
-    if (url.pathname === "/api/v1/repos/novox/hq/branches/feat%2Fx" || url.pathname === "/api/v1/repos/novox/hq/branches/feat/x") {
-      if (req.method === "DELETE") { forge.branchDeleted = true; return json(res, 204, null); }
-    }
     if (url.pathname === "/api/v1/repos/search") {
       // The client lists through the search endpoint since 2026-09-28 (the forge's whole view);
       // it sits under `repository`, which write:repository covers.
@@ -177,9 +140,6 @@ function fakeForge(): Promise<Forge> {
         url: `http://127.0.0.1:${port}`,
         get mints() { return forge.mints; },
         get lastScopes() { return forge.lastScopes; },
-        get pullState() { return forge.pullState; },
-        get pullTitle() { return forge.pullTitle; },
-        get branchDeleted() { return forge.branchDeleted; },
         tokens: forge.tokens,
         scopesOf: forge.scopesOf,
         admins: forge.admins,
@@ -400,16 +360,6 @@ test("the tools register once there is a way to a token, and the first call mint
       "gitea_list_repos", "gitea_create_repo", "gitea_delete_repo",
       "gitea_list_issues", "gitea_get_issue", "gitea_create_issue", "gitea_close_issue", "gitea_add_comment",
       "gitea_list_pull_requests", "gitea_get_pull_request", "gitea_create_pull_request", "gitea_merge_pull_request",
-      "gitea_close_pull_request",
-      "gitea_reopen_pull_request",
-      "gitea_update_pull_request",
-      "gitea_pull_request_files",
-      "gitea_pull_request_diff",
-      "gitea_list_comments",
-      "gitea_reopen_issue",
-      "gitea_get_file",
-      "gitea_list_branches",
-      "gitea_delete_branch",
       "gitea_list_labels", "gitea_create_label",
       "gitea_api",
     ],
@@ -420,32 +370,3 @@ test("the tools register once there is a way to a token, and the first call mint
   assert.equal(result.repos.length, 1);
   assert.equal(forge.mints, before + 1);
 });
-
-// The forge's tools reach every action a review needs without a checkout and without the API
-// escape hatch: close a pull request whose work landed elsewhere, read its diff, its comments, a
-// file, the branches, and delete the branch left behind. Against the fake forge, through the
-// compiled tools, the way the console calls them.
-test("a pull request can be closed, read and cleaned up through the tools", async () => {
-  const { env } = await delivered(forge);
-  const tools = collectTools(env).find((c) => c.module === "gitea")!.tools;
-  const tool = (name: string) => tools.find((t) => t.name === name)!;
-  for (const name of ["gitea_close_pull_request", "gitea_reopen_pull_request", "gitea_update_pull_request", "gitea_pull_request_files",
-    "gitea_pull_request_diff", "gitea_list_comments", "gitea_reopen_issue", "gitea_get_file", "gitea_list_branches", "gitea_delete_branch"]) {
-    assert.ok(tool(name), `${name} is not a tool`);
-  }
-  const closed = (await tool("gitea_close_pull_request").run({ owner: "novox", repo: "hq", number: 223 })) as { pull: { state: string } };
-  assert.equal(closed.pull.state, "closed");
-  assert.equal(forge.pullState, "closed");
-  const renamed = (await tool("gitea_update_pull_request").run({ owner: "novox", repo: "hq", number: 223, title: "Superseded" })) as { pull: { title: string } };
-  assert.equal(renamed.pull.title, "Superseded");
-  const diff = (await tool("gitea_pull_request_diff").run({ owner: "novox", repo: "hq", number: 223 })) as { diff: string };
-  assert.match(diff.diff, /^diff --git/);
-  const comments = (await tool("gitea_list_comments").run({ owner: "novox", repo: "hq", number: 223 })) as { comments: { body: string }[] };
-  assert.equal(comments.comments[0].body, "landed elsewhere");
-  const file = (await tool("gitea_get_file").run({ owner: "novox", repo: "hq", path: "README.md" })) as { file: { content: string } };
-  assert.equal(file.file.content, "hello");
-  const branches = (await tool("gitea_list_branches").run({ owner: "novox", repo: "hq" })) as { branches: { name: string }[] };
-  assert.deepEqual(branches.branches.map((b) => b.name), ["main", "feat/x"]);
-  await tool("gitea_delete_branch").run({ owner: "novox", repo: "hq", branch: "feat/x" });
-  assert.equal(forge.branchDeleted, true);
-});

modules/gitea/tools/index.ts

@@ -254,131 +254,6 @@ export function getGiteaTools(gitea: GiteaClient): ToolDefinition[] {
       },
     },
 
-    {
-      name: "gitea_close_pull_request",
-      description: "Close a pull request without merging it — one whose work landed elsewhere, or was abandoned.",
-      input: {
-        owner: { type: "string", description: "the repository owner" },
-        repo: { type: "string", description: "the repository name" },
-        number: { type: "number", description: "the PR number" },
-      },
-      run: async (args) => ({
-        pull: await gitea.setPullState(String(args.owner), String(args.repo), Number(args.number), "closed"),
-      }),
-    },
-    {
-      name: "gitea_reopen_pull_request",
-      description: "Reopen a closed, unmerged pull request.",
-      input: {
-        owner: { type: "string", description: "the repository owner" },
-        repo: { type: "string", description: "the repository name" },
-        number: { type: "number", description: "the PR number" },
-      },
-      run: async (args) => ({
-        pull: await gitea.setPullState(String(args.owner), String(args.repo), Number(args.number), "open"),
-      }),
-    },
-    {
-      name: "gitea_update_pull_request",
-      description: "Change a pull request's title or body; a field not given is left as it is.",
-      input: {
-        owner: { type: "string", description: "the repository owner" },
-        repo: { type: "string", description: "the repository name" },
-        number: { type: "number", description: "the PR number" },
-        title: { type: "string", description: "the new title (optional)" },
-        body: { type: "string", description: "the new body, markdown (optional)" },
-      },
-      run: async (args) => ({
-        pull: await gitea.updatePullRequest(String(args.owner), String(args.repo), Number(args.number), {
-          title: args.title === undefined ? undefined : String(args.title),
-          body: args.body === undefined ? undefined : String(args.body),
-        }),
-      }),
-    },
-    {
-      name: "gitea_pull_request_files",
-      description: "The files a pull request changes, as paths from the repository's root (up to 100; says when there are more).",
-      input: {
-        owner: { type: "string", description: "the repository owner" },
-        repo: { type: "string", description: "the repository name" },
-        number: { type: "number", description: "the PR number" },
-      },
-      run: async (args) => gitea.listPullFiles(String(args.owner), String(args.repo), Number(args.number)),
-    },
-    {
-      name: "gitea_pull_request_diff",
-      description: "A pull request's unified diff, as text — for reviewing it without a checkout.",
-      input: {
-        owner: { type: "string", description: "the repository owner" },
-        repo: { type: "string", description: "the repository name" },
-        number: { type: "number", description: "the PR number" },
-      },
-      run: async (args) => ({
-        diff: await gitea.pullDiff(String(args.owner), String(args.repo), Number(args.number)),
-      }),
-    },
-    {
-      name: "gitea_list_comments",
-      description: "Every comment on an issue or pull request, oldest first.",
-      input: {
-        owner: { type: "string", description: "the repository owner" },
-        repo: { type: "string", description: "the repository name" },
-        number: { type: "number", description: "the issue or PR number" },
-      },
-      run: async (args) => ({
-        comments: await gitea.listComments(String(args.owner), String(args.repo), Number(args.number)),
-      }),
-    },
-    {
-      name: "gitea_reopen_issue",
-      description: "Reopen a closed issue.",
-      input: {
-        owner: { type: "string", description: "the repository owner" },
-        repo: { type: "string", description: "the repository name" },
-        number: { type: "number", description: "the issue number" },
-      },
-      run: async (args) => ({
-        issue: await gitea.setIssueState(String(args.owner), String(args.repo), Number(args.number), "open"),
-      }),
-    },
-
-    // ---- Contents and branches ----
-    {
-      name: "gitea_get_file",
-      description: "One file's contents from a repository, decoded, at a branch, tag or commit (default the repository's default branch).",
-      input: {
-        owner: { type: "string", description: "the repository owner" },
-        repo: { type: "string", description: "the repository name" },
-        path: { type: "string", description: "the file's path from the repository's root" },
-        ref: { type: "string", description: "branch, tag or commit (optional)" },
-      },
-      run: async (args) => ({
-        file: await gitea.getFile(String(args.owner), String(args.repo), String(args.path), args.ref ? String(args.ref) : undefined),
-      }),
-    },
-    {
-      name: "gitea_list_branches",
-      description: "Every branch of a repository with the commit it points at.",
-      input: {
-        owner: { type: "string", description: "the repository owner" },
-        repo: { type: "string", description: "the repository name" },
-      },
-      run: async (args) => ({ branches: await gitea.listBranches(String(args.owner), String(args.repo)) }),
-    },
-    {
-      name: "gitea_delete_branch",
-      description: "Delete a branch — a feature branch whose pull request was closed rather than merged. Refused by the forge for a protected branch.",
-      input: {
-        owner: { type: "string", description: "the repository owner" },
-        repo: { type: "string", description: "the repository name" },
-        branch: { type: "string", description: "the branch name" },
-      },
-      run: async (args) => {
-        await gitea.deleteBranch(String(args.owner), String(args.repo), String(args.branch));
-        return { deleted: true, branch: String(args.branch) };
-      },
-    },
-
     // ---- Labels ----
     {
       name: "gitea_list_labels",

modules/gitlab/module.json

@@ -2,26 +2,26 @@
   "module": "gitlab",
   "version": "1",
   "own-secrets": {
-    "token": "${dir:state}/token",
-    "broker": "${dir:mesh-state}/broker"
+    "token": "/var/lib/gitlab/token",
+    "broker": "/var/lib/mesh/gitlab/broker"
   },
   "resources": [
     {
       "id": "mesh-state",
       "type": "directory",
-      "mode": "0700",
-      "place": "mesh"
+      "path": "/var/lib/mesh/gitlab",
+      "mode": "0700"
     },
     {
       "id": "state",
       "type": "directory",
-      "mode": "0700",
-      "place": "."
+      "path": "/var/lib/gitlab",
+      "mode": "0700"
     },
     {
       "id": "config",
       "type": "file",
-      "path": "${dir:state}/config.json",
+      "path": "/var/lib/gitlab/config.json",
       "merge": "json",
       "content": "{}",
       "mode": "0600"
@@ -32,9 +32,9 @@
       "name": "mesh-runtime-gitlab",
       "network": "host",
       "volumes": [
-        "${dir:state}/config.json:/run/config/config.json:ro",
-        "${dir:state}/token:/run/secrets/token:ro",
-        "${dir:mesh-state}/broker:/run/secrets/broker:ro"
+        "/var/lib/gitlab/config.json:/run/config/config.json:ro",
+        "/var/lib/gitlab/token:/run/secrets/token:ro",
+        "/var/lib/mesh/gitlab/broker:/run/secrets/broker:ro"
       ],
       "env": {
         "MESH_GITLAB_TOKEN_FILE": "/run/secrets/token",

modules/grafana/module.json

@@ -5,8 +5,8 @@
     "alert.firing"
   ],
   "own-secrets": {
-    "admin": "${dir:mesh-state}/admin",
-    "broker": "${dir:mesh-state}/broker"
+    "admin": "/var/lib/mesh/grafana/admin",
+    "broker": "/var/lib/mesh/grafana/broker"
   },
   "capabilities": [
     "container-runtime"
@@ -24,8 +24,8 @@
     {
       "id": "mesh-state",
       "type": "directory",
-      "mode": "0700",
-      "place": "mesh"
+      "path": "/var/lib/mesh/grafana",
+      "mode": "0700"
     },
     {
       "id": "state",
@@ -108,7 +108,7 @@
     {
       "id": "runtime-config",
       "type": "file",
-      "path": "${dir:mesh-state}/config.json",
+      "path": "/var/lib/mesh/grafana/config.json",
       "mode": "0600",
       "content": "{\n  \"user\": \"admin\",\n  \"password\": \"${secret:admin}\"\n}\n",
       "merge": "json"
@@ -119,8 +119,8 @@
       "name": "mesh-grafana",
       "network": "host",
       "volumes": [
-        "${dir:mesh-state}/broker:/run/secrets/broker:ro",
-        "${dir:mesh-state}/config.json:/run/config/config.json:ro"
+        "/var/lib/mesh/grafana/broker:/run/secrets/broker:ro",
+        "/var/lib/mesh/grafana/config.json:/run/config/config.json:ro"
       ],
       "env": {
         "MESH_BROKER_FILE": "/run/secrets/broker",
@@ -158,8 +158,8 @@
     "influxdb-api": "${dir:state}/influxdb.json"
   },
   "secrets": {
-    "oidc-client": "${dir:mesh-state}/oidc-client",
-    "influxdb-api": "${dir:mesh-state}/influxdb-api"
+    "oidc-client": "/var/lib/mesh/grafana/oidc-client",
+    "influxdb-api": "/var/lib/mesh/grafana/influxdb-api"
   },
   "build": {
     "on": [

modules/hello-web/module.json

@@ -15,7 +15,7 @@
     }
   },
   "binds": {
-    "route": "${dir:state}/route.json"
+    "route": "/var/lib/hello-web/route.json"
   },
   "listens": [
     {
@@ -30,13 +30,13 @@
     {
       "id": "state",
       "type": "directory",
-      "mode": "0700",
-      "place": "."
+      "path": "/var/lib/hello-web",
+      "mode": "0700"
     },
     {
       "id": "page",
       "type": "file",
-      "path": "${dir:state}/index.html",
+      "path": "/var/lib/hello-web/index.html",
       "mode": "0644",
       "content": "hello from hello-web, routed by the mesh\n"
     },
@@ -54,7 +54,7 @@
         "8080"
       ],
       "volumes": [
-        "${dir:state}/index.html:/www/index.html:ro"
+        "/var/lib/hello-web/index.html:/www/index.html:ro"
       ],
       "args": [
         "sh",

modules/home-assistant/Dockerfile

@@ -13,7 +13,7 @@ ARG RUNTIME_BASE
 FROM ${BUILD_BASE} AS build
 WORKDIR /app/modules/home-assistant
 COPY . .
-RUN node /app/node_modules/typescript/bin/tsc client.ts index.ts tools/index.ts provisions/hass.ts provisions/probe.ts provisions/connections.ts provisions/mesh.ts provisions/index.ts \
+RUN node /app/node_modules/typescript/bin/tsc client.ts index.ts tools/index.ts \
       --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist
 
 FROM ${RUNTIME_BASE}
@@ -22,6 +22,3 @@ COPY --from=build /app/modules/home-assistant/dist /app/modules/home-assistant/d
 # provider's provisioner runs its reconcile loop in the same process, with the broker connected —
 # the convention novox/hq issues 060/061 settled.
 ENV MESH_TOOL_MODULES=/app/modules/home-assistant/dist/index.js,/app/modules/home-assistant/dist/tools/index.js
-# NOT dist/provisions/index.js: that is a step the host runs to completion, named by the
-# `provisions` container's args as `mesh-tools run …` (novox/hq ADR 0052). Listed here it would run
-# inside the serving sidecar too, and exit it.

modules/home-assistant/module.json

@@ -9,8 +9,8 @@
     "state.changed"
   ],
   "own-secrets": {
-    "broker": "${dir:mesh-state}/broker",
-    "token": "${dir:mesh-state}/token"
+    "broker": "/var/lib/mesh/home-assistant/broker",
+    "token": "/var/lib/mesh/home-assistant/token"
   },
   "listens": [
     {
@@ -18,63 +18,40 @@
       "port": 8123,
       "protocol": "tcp",
       "from": "mesh",
-      "why": "the dashboard, the API and the companion apps"
-    },
-    {
-      "name": "sonos-events",
-      "port": 1400,
-      "protocol": "tcp",
-      "from": "mesh",
-      "why": "the Sonos integration's event callback: speakers push their state changes here"
-    },
-    {
-      "name": "webrtc",
-      "port": 18555,
-      "protocol": "tcp",
-      "from": "mesh",
-      "why": "the bundled go2rtc's WebRTC port, which camera streams to a browser use"
+      "why": "the dashboard and the API"
     }
   ],
   "resources": [
     {
       "id": "mesh-state",
       "type": "directory",
-      "mode": "0700",
-      "place": "mesh"
-    },
-    {
-      "id": "state",
-      "type": "directory",
-      "mode": "0700",
-      "place": "."
+      "path": "/var/lib/mesh/home-assistant",
+      "mode": "0700"
     },
     {
       "id": "config",
       "type": "directory",
-      "mode": "0700"
-    },
-    {
-      "id": "written",
-      "type": "directory",
-      "mode": "0700"
+      "path": "/services/home-assistant/config",
+      "mode": "0700",
+      "owner": "1000:1000"
     },
     {
       "id": "server",
       "type": "container",
       "name": "home-assistant",
-      "image": "ghcr.io/home-assistant/home-assistant@sha256:d8922685169707fd91e8b9729902d975f06157d005e422874d201e0261dda196",
+      "image": "ghcr.io/home-assistant/home-assistant@sha256:14931c6b13756317849f46da1d01b45937a1150db66c081cfe529d48215943fe",
       "network": "host",
       "env": {
         "TZ": "Etc/UTC"
       },
       "volumes": [
-        "${dir:config}:/config"
+        "/services/home-assistant/config:/config"
       ]
     },
     {
       "id": "runtime-config",
       "type": "file",
-      "path": "${dir:mesh-state}/config.json",
+      "path": "/var/lib/mesh/home-assistant/config.json",
       "mode": "0600",
       "content": "{}\n",
       "merge": "json"
@@ -85,92 +62,35 @@
       "name": "mesh-home-assistant",
       "network": "host",
       "volumes": [
-        "${dir:mesh-state}/broker:/run/secrets/broker:ro",
-        "${dir:mesh-state}/token:/run/secrets/token:ro",
-        "${dir:mesh-state}/config.json:/run/config/config.json:ro"
+        "/var/lib/mesh/home-assistant/broker:/run/secrets/broker:ro",
+        "/var/lib/mesh/home-assistant/token:/run/secrets/token:ro",
+        "/var/lib/mesh/home-assistant/config.json:/run/config/config.json:ro",
+        "/services/home-assistant/config:/var/lib/home-assistant/config:ro"
       ],
       "env": {
         "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_HOMEASSISTANT_URL": "http://127.0.0.1:${port:8123}",
+        "MESH_HOMEASSISTANT_URL": "http://127.0.0.1:8123",
         "MESH_HOMEASSISTANT_TOKEN_FILE": "/run/secrets/token",
-        "MESH_HOMEASSISTANT_CONFIG_FILE": "/run/config/config.json"
+        "MESH_HOMEASSISTANT_CONFIG_FILE": "/run/config/config.json",
+        "MESH_HOMEASSISTANT_CONFIG_DIR": "/var/lib/home-assistant/config"
       },
       "restart-on": [
         "runtime-config"
       ],
       "artifact": "runtime"
-    },
-    {
-      "id": "provisions",
-      "type": "container",
-      "name": "mesh-home-assistant-provisions",
-      "network": "host",
-      "run-once": true,
-      "volumes": [
-        "${dir:mesh-state}/token:/run/secrets/token:ro",
-        "${dir:written}:/var/lib/home-assistant-provisions",
-        "${dir:state}/mqtt-topic.json:/run/provisions/mqtt-topic.json:ro",
-        "${dir:state}/mqtt-topic.secret:/run/provisions/mqtt-topic.secret:ro",
-        "${dir:state}/sonarr-api.json:/run/provisions/sonarr-api.json:ro",
-        "${dir:state}/sonarr-api.secret:/run/provisions/sonarr-api.secret:ro",
-        "${dir:state}/radarr-api.json:/run/provisions/radarr-api.json:ro",
-        "${dir:state}/radarr-api.secret:/run/provisions/radarr-api.secret:ro",
-        "${dir:state}/lidarr-api.json:/run/provisions/lidarr-api.json:ro",
-        "${dir:state}/lidarr-api.secret:/run/provisions/lidarr-api.secret:ro"
-      ],
-      "env": {
-        "MESH_HOMEASSISTANT_URL": "http://127.0.0.1:${port:8123}",
-        "MESH_HOMEASSISTANT_TOKEN_FILE": "/run/secrets/token",
-        "MESH_PROVISIONS_DIR": "/run/provisions",
-        "MESH_WRITTEN_DIR": "/var/lib/home-assistant-provisions"
-      },
-      "args": [
-        "run",
-        "/app/modules/home-assistant/dist/provisions/index.js"
-      ],
-      "restart-on": [
-        "bound-mqtt-topic",
-        "secret-mqtt-topic",
-        "bound-sonarr-api",
-        "secret-sonarr-api",
-        "bound-radarr-api",
-        "secret-radarr-api",
-        "bound-lidarr-api",
-        "secret-lidarr-api"
-      ],
-      "artifact": "runtime"
     }
   ],
   "requires": [
-    "lidarr-api",
-    "mqtt-topic",
-    "radarr-api",
-    "route",
-    "sonarr-api"
+    "route"
   ],
   "contributes": {
-    "mqtt-topic": {
-      "topics": [
-        "#"
-      ]
-    },
     "route": {
       "label": "home-assistant",
       "endpoint": "web"
     }
   },
   "binds": {
-    "route": "${dir:state}/route.json",
-    "mqtt-topic": "${dir:state}/mqtt-topic.json",
-    "sonarr-api": "${dir:state}/sonarr-api.json",
-    "radarr-api": "${dir:state}/radarr-api.json",
-    "lidarr-api": "${dir:state}/lidarr-api.json"
-  },
-  "secrets": {
-    "mqtt-topic": "${dir:state}/mqtt-topic.secret",
-    "sonarr-api": "${dir:state}/sonarr-api.secret",
-    "radarr-api": "${dir:state}/radarr-api.secret",
-    "lidarr-api": "${dir:state}/lidarr-api.secret"
+    "route": "/var/lib/mesh/home-assistant/route.json"
   },
   "build": {
     "on": [

modules/home-assistant/package.json

@@ -1,14 +1,9 @@
 {
   "name": "@novox/module-home-assistant",
   "version": "0.1.0",
-  "description": "home-assistant \u2014 home automation platform. Its API client, tools and events live here (novox/hq ADR 0039).",
+  "description": "home-assistant — home automation platform. Its API client, tools and events live here (novox/hq ADR 0039).",
   "type": "module",
   "private": true,
-  "scripts": {
-    "build": "tsc client.ts index.ts tools/index.ts provisions/hass.ts provisions/probe.ts provisions/connections.ts provisions/mesh.ts provisions/index.ts --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist",
-    "typecheck": "tsc -p tsconfig.json",
-    "test": "node --test --experimental-strip-types 'test/*.test.ts'"
-  },
   "dependencies": {
     "@novox/mesh-sdk": "^0.1.0"
   },

modules/home-assistant/provisions/connections.ts

@@ -1,486 +0,0 @@
-// How home-assistant's provisions step brings Home Assistant's integrations in line with what the
-// mesh bound: the MQTT integration to `mqtt-topic`, the Sonarr, Radarr and Lidarr integrations to
-// `sonarr-api`, `radarr-api` and `lidarr-api`. Pure logic over two seams — Home Assistant's config
-// flows (hass.ts) and the broker/apps — so it is tested against fakes (test/provisions.test.ts).
-//
-// The half that reads files and talks HTTP lives beside it (mesh.ts, hass.ts, probe.ts, index.ts).
-
-import { createHash } from "node:crypto";
-
-import type { Hass, SchemaField } from "./hass.js";
-import type { Probe } from "./probe.js";
-
-/** What the mesh wrote at `binds.<provision>` (the controller's binding document). */
-export interface Binding {
-  provision?: string;
-  from?: string;
-  at?: string;
-  as?: string;
-  serves?: Record<string, unknown>;
-}
-
-/** How one provision came out. Never carries a credential. */
-export type Outcome =
-  | { what: string; result: "unchanged"; note?: string }
-  | { what: string; result: "written"; fields: string[]; note?: string }
-  | { what: string; result: "equivalent"; note: string }
-  | { what: string; result: "refused"; problem: string };
-
-/** A port the binding serves, or undefined when it names none usable. */
-export function portOf(serves: Record<string, unknown> | undefined): number | undefined {
-  const port = Number(serves?.port);
-  return Number.isInteger(port) && port > 0 && port <= 65535 ? port : undefined;
-}
-
-/** A host as it goes into a URL: an IPv6 literal bracketed. */
-export function urlHost(host: string): string {
-  return host.includes(":") && !host.startsWith("[") ? `[${host}]` : host;
-}
-
-/**
- * What this step last wrote, per target, as a digest: the only way to know "already as the mesh
- * says" for a credential Home Assistant will not show back. A sha256 over the target and the values,
- * never the values; kept in the module's own placed directory.
- */
-export interface Marks {
-  get(name: string): Promise<string | undefined>;
-  set(name: string, digest: string): Promise<void>;
-}
-
-export function digest(...parts: (string | number)[]): string {
-  return createHash("sha256").update(parts.map(String).join("\u0000")).digest("hex");
-}
-
-/** An error as text with the credential taken out, raw and URL-encoded. */
-export function scrub(err: unknown, ...secrets: (string | undefined)[]): string {
-  let text = err instanceof Error ? err.message : String(err);
-  for (const s of secrets) {
-    if (!s) continue;
-    for (const form of new Set([s, encodeURIComponent(s)])) text = text.split(form).join("***");
-  }
-  return text;
-}
-
-/**
- * What a form would submit if a person pressed "submit" without touching it: each field's
- * suggested value (what Home Assistant pre-fills from the entry), else its default; a section's
- * fields nested under its name. The step lays only the connection fields over this, so every other
- * choice the entry carries is sent back exactly as Home Assistant showed it.
- */
-export function formValues(schema: readonly SchemaField[] | null | undefined): Record<string, unknown> {
-  const out: Record<string, unknown> = {};
-  for (const field of schema ?? []) {
-    if (Array.isArray(field.schema)) {
-      out[field.name] = formValues(field.schema);
-      continue;
-    }
-    const suggested = field.description?.suggested_value;
-    if (suggested !== undefined && suggested !== null) out[field.name] = suggested;
-    else if (field.default !== undefined) out[field.name] = field.default;
-  }
-  return out;
-}
-
-/** Whether a form has a field of this name at its top level. */
-export function hasField(schema: readonly SchemaField[] | null | undefined, name: string): boolean {
-  return (schema ?? []).some((f) => f.name === name);
-}
-
-// ---- MQTT ----
-
-// Home Assistant's MQTT integration, pointed at the broker the mesh bound — `mqtt-topic`.
-//
-// **Why a step.** Home Assistant keeps its broker, login and password in its MQTT config entry
-// (`.storage/core.config_entries`), not in a file the mesh could fill with `${bound:mqtt-topic:at}`.
-// So this reads the binding and the pair credential and makes the entry say the same thing, through
-// the MQTT integration's own reconfigure flow — the flow its "Reconfigure" button runs, which tests
-// the connection itself and saves nothing it could not connect with.
-//
-// **Only the connection, and only when it differs.** Broker, port, username, password. The protocol
-// version, client id, keepalive, TLS choices and discovery options the entry holds are sent back
-// exactly as Home Assistant pre-filled them. Whether the password already matches cannot be read
-// back (Home Assistant never shows a stored password), so the step keeps a digest of what it last
-// wrote: equal broker/port/username and an equal digest is "already as the mesh says".
-//
-// **Nothing loses its connection without someone seeing it.** Before Home Assistant is touched the
-// broker itself is asked whether it takes the delivered login (the provisioner creates it within
-// seconds of the grant): if not, nothing is written and the step fails saying why, and Home
-// Assistant keeps the login it has — the carried `luffy` on ace, which mosquitto keeps. If Home
-// Assistant's own connection test refuses the new settings, the flow saves nothing, and the step
-// fails with Home Assistant's reason. A login that may not subscribe to the discovery topics is said
-// as a warning: discovery would find nothing.
-
-export const MQTT_PROVISION = "mqtt-topic";
-/** Home Assistant's discovery prefix, subscribed to whenever discovery is on (the default). */
-export const DISCOVERY_FILTER = "homeassistant/#";
-
-export interface MqttWanted {
-  host: string;
-  port: number;
-  username: string;
-  password: string;
-}
-
-export type Wanted = { ok: true; want: MqttWanted } | { ok: false; problem: string };
-
-/** The broker, port and login the mesh says Home Assistant uses. */
-export function wantedMqtt(binding: Binding | undefined, credential: string | undefined): Wanted {
-  if (!binding) return { ok: false, problem: `no binding for ${MQTT_PROVISION} was delivered — the mesh writes it before this step runs` };
-  const host = typeof binding.at === "string" ? binding.at.trim() : "";
-  if (!host) return { ok: false, problem: `the ${MQTT_PROVISION} binding names no host (at)` };
-  const port = portOf(binding.serves);
-  if (port === undefined) return { ok: false, problem: `the ${MQTT_PROVISION} binding serves no usable port (${String(binding.serves?.port)})` };
-  const scheme = binding.serves?.scheme;
-  if (scheme !== undefined && scheme !== "mqtt") {
-    return { ok: false, problem: `the ${MQTT_PROVISION} binding serves scheme ${String(scheme)}; this step writes plain MQTT` };
-  }
-  const username = typeof binding.as === "string" ? binding.as.trim() : "";
-  if (!username) return { ok: false, problem: `the ${MQTT_PROVISION} binding names no login (as)` };
-  const password = (credential ?? "").replace(/\n$/, "");
-  if (!password) return { ok: false, problem: `the ${MQTT_PROVISION} credential is empty or was not delivered` };
-  return { ok: true, want: { host, port, username, password } };
-}
-
-export interface MqttDeps {
-  hass: Hass;
-  probe: Probe;
-  marks: Marks;
-}
-
-const markFor = (entryId: string, w: MqttWanted): string => digest("mqtt", entryId, w.host, w.port, w.username, w.password);
-
-/** Bring Home Assistant's MQTT entry in line with the mesh. Never throws: every failure is an outcome. */
-export async function reconcileMqtt(deps: MqttDeps, binding: Binding | undefined, credential: string | undefined): Promise<Outcome> {
-  const what = "mqtt";
-  const w = wantedMqtt(binding, credential);
-  if ("problem" in w) return { what, result: "refused", problem: w.problem };
-  const want = w.want;
-
-  // The broker first: a login it does not take is never written into Home Assistant.
-  let note: string | undefined;
-  try {
-    const probe = await deps.probe(want.host, want.port, want.username, want.password, DISCOVERY_FILTER);
-    if (probe.connack === 4 || probe.connack === 5) {
-      return {
-        what,
-        result: "refused",
-        problem:
-          `the broker at ${want.host}:${want.port} does not (yet) take the login ${want.username} with the delivered ` +
-          `password (CONNACK ${probe.connack}); mosquitto's provisioner creates it from the grant — nothing was ` +
-          `written, and Home Assistant keeps the broker login it has`,
-      };
-    }
-    if (probe.connack !== 0) {
-      return { what, result: "refused", problem: `the broker at ${want.host}:${want.port} answered CONNACK ${probe.connack}; nothing was written` };
-    }
-    if (probe.suback === 0x80) {
-      note =
-        `warning: ${want.username} may not subscribe to ${DISCOVERY_FILTER} — MQTT discovery will find nothing; ` +
-        `grant it with the mqtt-topic contribution's \`topics\``;
-    }
-  } catch (err) {
-    return {
-      what,
-      result: "refused",
-      problem: `the broker at ${want.host}:${want.port} could not be asked: ${scrub(err, want.password)}; nothing was written`,
-    };
-  }
-
-  try {
-    const entries = (await deps.hass.entries("mqtt")).filter((e) => e.domain === "mqtt");
-    if (entries.length > 1) {
-      return { what, result: "refused", problem: `Home Assistant has ${entries.length} MQTT entries; which one the mesh owns is not guessed` };
-    }
-    if (entries.length === 0) return await createEntry(deps, want, note);
-
-    const entry = entries[0];
-    const flow = await deps.hass.startFlow("mqtt", entry.entry_id);
-    if (flow.type !== "form" || !flow.flow_id || !flow.data_schema) {
-      if (flow.flow_id) await deps.hass.abortFlow(flow.flow_id);
-      return { what, result: "refused", problem: `Home Assistant's MQTT reconfigure flow answered ${flow.type}${flow.reason ? ` (${flow.reason})` : ""}` };
-    }
-    const current = formValues(flow.data_schema);
-    const fields: string[] = [];
-    if (String(current.broker ?? "") !== want.host) fields.push("broker");
-    if (Number(current.port ?? 0) !== want.port) fields.push("port");
-    if (String(current.username ?? "") !== want.username) fields.push("username");
-    if ((await deps.marks.get("mqtt")) !== markFor(entry.entry_id, want)) fields.push("password");
-    if (fields.length === 0) {
-      await deps.hass.abortFlow(flow.flow_id);
-      return note ? { what, result: "unchanged", note } : { what, result: "unchanged" };
-    }
-
-    const saved = await deps.hass.stepFlow(flow.flow_id, {
-      ...current,
-      broker: want.host,
-      port: want.port,
-      username: want.username,
-      password: want.password,
-    });
-    if (saved.type === "abort" && saved.reason === "reconfigure_successful") {
-      await deps.marks.set("mqtt", markFor(entry.entry_id, want));
-      return { what, result: "written", fields, ...(note ? { note } : {}) };
-    }
-    if (saved.flow_id) await deps.hass.abortFlow(saved.flow_id);
-    return {
-      what,
-      result: "refused",
-      problem:
-        `Home Assistant's own connection test refused ${want.username}@${want.host}:${want.port} ` +
-        `(${describe(saved)}); its MQTT entry is unchanged`,
-    };
-  } catch (err) {
-    return { what, result: "refused", problem: scrub(err, want.password) };
-  }
-}
-
-/** A fresh Home Assistant has no MQTT entry: made through the integration's user flow. */
-async function createEntry(deps: MqttDeps, want: MqttWanted, note?: string): Promise<Outcome> {
-  const what = "mqtt";
-  let flow = await deps.hass.startFlow("mqtt");
-  if (flow.type === "form" && flow.step_id !== "broker" && flow.flow_id) {
-    // Anything before the broker form (none outside the Supervisor) is not this step's to answer.
-    await deps.hass.abortFlow(flow.flow_id);
-    return { what, result: "refused", problem: `Home Assistant's MQTT user flow asked ${flow.step_id} before the broker` };
-  }
-  if (flow.type !== "form" || !flow.flow_id) {
-    return { what, result: "refused", problem: `Home Assistant's MQTT user flow answered ${describe(flow)}` };
-  }
-  const shown = formValues(flow.data_schema);
-  // A new entry's form has no value for its two certificate choices (a reconfigure pre-fills them
-  // from the entry): plain MQTT, so neither a CA nor a client certificate.
-  const other = (shown.other_settings ?? {}) as Record<string, unknown>;
-  if (flow.data_schema?.some((f) => f.name === "other_settings")) {
-    shown.other_settings = { set_ca_cert: "off", set_client_cert: false, ...other };
-  }
-  flow = await deps.hass.stepFlow(flow.flow_id, {
-    ...shown,
-    broker: want.host,
-    port: want.port,
-    username: want.username,
-    password: want.password,
-  });
-  if (flow.type === "create_entry") {
-    const id = (flow.result as { entry_id?: string } | undefined)?.entry_id;
-    if (id) await deps.marks.set("mqtt", markFor(id, want));
-    return { what, result: "written", fields: ["entry"], ...(note ? { note } : {}) };
-  }
-  if (flow.flow_id) await deps.hass.abortFlow(flow.flow_id);
-  return { what, result: "refused", problem: `Home Assistant refused a new MQTT entry for ${want.host}:${want.port} (${describe(flow)})` };
-}
-
-export function describe(r: { type: string; reason?: string; errors?: Record<string, string> | null }): string {
-  const errors = r.errors ? Object.entries(r.errors).map(([k, v]) => `${k}: ${v}`).join(", ") : "";
-  return [r.type, r.reason, errors].filter(Boolean).join(" — ");
-}
-
-// ---- Sonarr, Radarr, Lidarr ----
-
-// Home Assistant's Sonarr, Radarr and Lidarr integrations, pointed at the apps the mesh bound —
-// `sonarr-api`, `radarr-api`, `lidarr-api` (their providers: mesh-catalog #156).
-//
-// **What Home Assistant lets anyone change, and what it does not.** Each integration keeps a URL and
-// an API key in its config entry. None of the three has a reconfigure flow: Home Assistant changes
-// them only through the flow its UI runs —
-//   - a **user flow** makes a new entry (validated against the app);
-//   - a **reauth flow**, which Home Assistant starts by itself when the app refuses the key it holds,
-//     takes a new key (Sonarr) or a new URL and key (Radarr, Lidarr);
-//   - anything else — the URL of a working entry — only by removing the integration and adding it
-//     again, which throws away its entities' names, areas and history links. **This step never
-//     removes an entry.**
-// So, per app:
-//   1. The bound key is tried against the bound app first. Refused, nothing is written: until the
-//      operator accepts the app's own key for this pair, the mesh delivers a value it minted, which
-//      no Servarr app takes (novox/hq ADR 0092) — the failure names the `secret accept` that fixes it.
-//   2. No entry: one is made through the user flow.
-//   3. A reauth flow Home Assistant started for the entry: finished with the bound key (and URL,
-//      where the integration's reauth asks for one).
-//   4. An entry whose URL (read from the device the integration registered, `configuration_url`)
-//      is the bound one and which is loaded: already as the mesh says. The key needs no digest here:
-//      a Servarr app has one key, so an entry loaded against the app holds the key the app took.
-//   5. A working entry at a different URL that reaches **the same app** — the same process, by the
-//      app's own status (start time, data folder, version) — is left as it is and said: ace's entries
-//      say `127.0.0.1:<port>` and the binding says `ace.internal:<port>`, one Sonarr either way.
-//   6. Anything else is refused, loudly, with what the operator can do; nothing is removed.
-
-
-export interface ServarrApp {
-  /** The integration's domain, also the app. */
-  domain: "sonarr" | "radarr" | "lidarr";
-  /** The provision it is required as: the `requires`, `binds` and `secrets` key. */
-  provision: string;
-  /** The app's status endpoint: answers 401 to a wrong key, and says which process answered. */
-  statusPath: string;
-}
-
-export const APPS: readonly ServarrApp[] = [
-  { domain: "sonarr", provision: "sonarr-api", statusPath: "/api/v3/system/status" },
-  { domain: "radarr", provision: "radarr-api", statusPath: "/api/v3/system/status" },
-  { domain: "lidarr", provision: "lidarr-api", statusPath: "/api/v1/system/status" },
-];
-
-/** The HTTP the step needs toward the apps, so a test can stand fakes in. */
-export interface Http {
-  fetch(url: string, init?: { method?: string; headers?: Record<string, string> }): Promise<{ status: number; text(): Promise<string> }>;
-}
-
-export type AppWanted = { ok: true; url: string; key: string; from: string } | { ok: false; problem: string };
-
-/** The URL and key the mesh says Home Assistant uses for this app. */
-export function wantedApp(spec: ServarrApp, binding: Binding | undefined, credential: string | undefined): AppWanted {
-  if (!binding) return { ok: false, problem: `no binding for ${spec.provision} was delivered — the mesh writes it before this step runs` };
-  const at = typeof binding.at === "string" ? binding.at.trim() : "";
-  if (!at) return { ok: false, problem: `the ${spec.provision} binding names no host (at)` };
-  const port = portOf(binding.serves);
-  if (port === undefined) return { ok: false, problem: `the ${spec.provision} binding serves no usable port (${String(binding.serves?.port)})` };
-  const scheme = typeof binding.serves?.scheme === "string" && binding.serves.scheme ? binding.serves.scheme : "http";
-  if (scheme !== "http" && scheme !== "https") return { ok: false, problem: `the ${spec.provision} binding serves scheme ${scheme}` };
-  const base = typeof binding.serves?.["url-base"] === "string" ? String(binding.serves["url-base"]).trim().replace(/^\/+|\/+$/g, "") : "";
-  const key = (credential ?? "").trim();
-  if (!key) return { ok: false, problem: `the ${spec.provision} credential is empty or was not delivered` };
-  return {
-    ok: true,
-    url: `${scheme}://${urlHost(at)}:${port}${base ? `/${base}` : ""}`,
-    key,
-    from: typeof binding.from === "string" ? binding.from : "",
-  };
-}
-
-/** Two URLs naming the same place: scheme, host, port (explicit or default) and base path. */
-export function sameUrl(a: string | null | undefined, b: string): boolean {
-  if (!a) return false;
-  try {
-    const x = new URL(a);
-    const y = new URL(b);
-    const port = (u: URL) => u.port || (u.protocol === "https:" ? "443" : "80");
-    const path = (u: URL) => u.pathname.replace(/\/+$/, "");
-    return x.protocol === y.protocol && x.hostname.toLowerCase() === y.hostname.toLowerCase() && port(x) === port(y) && path(x) === path(y);
-  } catch {
-    return false;
-  }
-}
-
-type Status = { taken: true; status: Record<string, unknown> } | { taken: false };
-
-/** The app's status with this key: `taken: false` when it refuses the key; throws when it cannot be asked. */
-export async function appStatus(http: Http, spec: ServarrApp, url: string, key: string): Promise<Status> {
-  const res = await http.fetch(`${url.replace(/\/+$/, "")}${spec.statusPath}`, {
-    method: "GET",
-    headers: { "X-Api-Key": key, Accept: "application/json" },
-  });
-  if (res.status === 401 || res.status === 403) return { taken: false };
-  if (res.status < 200 || res.status >= 300) throw new Error(`${spec.domain} answered ${res.status} at ${spec.statusPath}`);
-  return { taken: true, status: JSON.parse(await res.text()) as Record<string, unknown> };
-}
-
-/** Whether two status answers came from one running app. */
-export function sameInstance(a: Record<string, unknown>, b: Record<string, unknown>): boolean {
-  const facts = ["startTime", "appData", "version"];
-  return facts.every((k) => a[k] !== undefined && a[k] !== null && a[k] === b[k]);
-}
-
-/** The remedy for a refused key, in the controller's words (ADR 0092). */
-export function acceptRemedy(spec: ServarrApp, from: string): string {
-  return (
-    `${spec.domain} refuses the ${spec.provision} credential the mesh delivered, so nothing was written into ` +
-    `Home Assistant. A Servarr app has one API key and the mesh cannot make it: accept ${spec.domain}'s own key ` +
-    `for this pair — \`secret accept <this node> home-assistant ${spec.provision} --provider ${from || "<its node>"} ` +
-    `--from <file holding ${spec.domain}'s ApiKey>\``
-  );
-}
-
-export interface ServarrDeps {
-  hass: Hass;
-  http: Http;
-}
-
-/** The input a Servarr form takes: what it shows, with the URL (where asked) and the key laid over. */
-function servarrInput(schema: readonly SchemaField[] | null | undefined, url: string, key: string): Record<string, unknown> {
-  const input = formValues(schema);
-  if (hasField(schema, "url")) input.url = url;
-  if (hasField(schema, "api_key")) input.api_key = key;
-  return input;
-}
-
-/** Bring Home Assistant's entry for one app in line with the mesh. Never throws. */
-export async function reconcileApp(deps: ServarrDeps, spec: ServarrApp, binding: Binding | undefined, credential: string | undefined): Promise<Outcome> {
-  const what = spec.domain;
-  const w = wantedApp(spec, binding, credential);
-  if ("problem" in w) return { what, result: "refused", problem: w.problem };
-
-  let bound: Status;
-  try {
-    bound = await appStatus(deps.http, spec, w.url, w.key);
-  } catch (err) {
-    return { what, result: "refused", problem: `${spec.domain} could not be asked at ${w.url}: ${scrub(err, w.key)}` };
-  }
-  if (!bound.taken) return { what, result: "refused", problem: acceptRemedy(spec, w.from) };
-
-  try {
-    const entries = (await deps.hass.entries(spec.domain)).filter((e) => e.domain === spec.domain);
-    if (entries.length > 1) {
-      return { what, result: "refused", problem: `Home Assistant has ${entries.length} ${spec.domain} entries; which one the mesh owns is not guessed` };
-    }
-
-    // No entry: made, through the integration's own user flow, which validates the key itself.
-    if (entries.length === 0) {
-      const flow = await deps.hass.startFlow(spec.domain);
-      if (flow.type !== "form" || !flow.flow_id) return { what, result: "refused", problem: `Home Assistant's ${spec.domain} user flow answered ${describe(flow)}` };
-      const made = await deps.hass.stepFlow(flow.flow_id, servarrInput(flow.data_schema, w.url, w.key));
-      if (made.type === "create_entry") return { what, result: "written", fields: ["entry"] };
-      if (made.flow_id) await deps.hass.abortFlow(made.flow_id);
-      return { what, result: "refused", problem: `Home Assistant refused a new ${spec.domain} entry at ${w.url} (${describe(made)})` };
-    }
-
-    const entry = entries[0];
-    if (entry.disabled_by) return { what, result: "unchanged", note: `the ${spec.domain} entry is disabled (by ${entry.disabled_by}); left alone` };
-
-    // A reauth Home Assistant started because the app refused its key: finished with the bound one.
-    const reauth = (await deps.hass.flowsInProgress()).find(
-      (f) => f.handler === spec.domain && f.context?.source === "reauth" && f.context?.entry_id === entry.entry_id,
-    );
-    if (reauth) {
-      let step = await deps.hass.stepFlow(reauth.flow_id, {}); // reauth_confirm: a confirmation, no fields
-      if (step.type === "form" && step.flow_id && step.step_id !== "reauth_confirm") {
-        const input = servarrInput(step.data_schema, w.url, w.key);
-        const fields = ["api_key", ...(hasField(step.data_schema, "url") ? ["url"] : [])];
-        step = await deps.hass.stepFlow(step.flow_id, input);
-        if (step.type === "abort" && step.reason === "reauth_successful") return { what, result: "written", fields };
-      }
-      return { what, result: "refused", problem: `Home Assistant's ${spec.domain} reauth did not take the bound key and URL (${describe(step)})` };
-    }
-
-    const device = (await deps.hass.devices()).find((d) => d.config_entries?.includes(entry.entry_id) && d.configuration_url);
-    const current = device?.configuration_url ?? undefined;
-    if (entry.state === "loaded" && sameUrl(current, w.url)) return { what, result: "unchanged" };
-
-    if (entry.state === "loaded" && current) {
-      let there: Status | undefined;
-      try {
-        there = await appStatus(deps.http, spec, current, w.key);
-      } catch {
-        there = undefined;
-      }
-      if (there?.taken && sameInstance(there.status, bound.status)) {
-        return {
-          what,
-          result: "equivalent",
-          note:
-            `Home Assistant reaches ${spec.domain} at ${current}, the same running app the mesh bound at ${w.url}; ` +
-            `Home Assistant has no way to change a working ${spec.domain} entry's URL short of removing it, so it is left as it is`,
-        };
-      }
-    }
-    return {
-      what,
-      result: "refused",
-      problem:
-        `Home Assistant's ${spec.domain} entry (${entry.state ?? "unknown state"}) points at ${current ?? "an unknown URL"}, ` +
-        `not the ${spec.domain} the mesh bound at ${w.url}. Home Assistant only lets a working entry's URL change by ` +
-        `removing and re-adding the integration, which this step never does: remove it in Home Assistant ` +
-        `(Settings → Devices & services → ${spec.domain}) and the next run adds it at the bound URL`,
-    };
-  } catch (err) {
-    return { what, result: "refused", problem: scrub(err, w.key) };
-  }
-}

modules/home-assistant/provisions/hass.ts

@@ -1,160 +0,0 @@
-// Home Assistant's own configuration API, as the provisions step uses it — the supported way to
-// change an integration's connection. Home Assistant keeps every integration in
-// `.storage/core.config_entries`, a file it owns and rewrites; the mesh may not write it, and it is
-// not a file the mesh could merge into. What Home Assistant offers instead is the same thing its UI
-// uses: **config flows** over REST (`/api/config/config_entries/flow`) — a user flow creates an
-// entry, a reconfigure flow changes one, a reauth flow (which Home Assistant starts itself when a
-// credential stops working) replaces its credential — each validated by the integration's own
-// connection test before anything is saved. The two things REST does not answer (which flows Home
-// Assistant has started, which device an entry made) come over its WebSocket API.
-//
-// Nothing here reads `.storage`. Authenticated with the module's accepted long-lived access token.
-
-/** A config entry as `GET /api/config/config_entries/entry` lists it — no data, no credentials. */
-export interface ConfigEntry {
-  entry_id: string;
-  domain: string;
-  title?: string;
-  source?: string;
-  state?: string;
-  disabled_by?: string | null;
-}
-
-/** One field of a flow's form, as Home Assistant serializes a voluptuous schema. */
-export interface SchemaField {
-  name: string;
-  type?: string;
-  required?: boolean;
-  optional?: boolean;
-  default?: unknown;
-  description?: { suggested_value?: unknown } | null;
-  /** A section (`type: "expandable"`) carries its own fields. */
-  schema?: SchemaField[];
-}
-
-/** What a flow answered: another form, an entry made, or the flow ended (abort). */
-export interface FlowResult {
-  type: string;
-  flow_id?: string;
-  handler?: string;
-  step_id?: string;
-  data_schema?: SchemaField[] | null;
-  errors?: Record<string, string> | null;
-  reason?: string;
-  result?: { entry_id?: string } | unknown;
-}
-
-/** A flow in progress that Home Assistant started itself (a reauth, a discovery). */
-export interface FlowProgress {
-  flow_id: string;
-  handler: string;
-  step_id?: string;
-  context?: { source?: string; entry_id?: string };
-}
-
-/** A device from the device registry; an integration names where its app is as configuration_url. */
-export interface DeviceEntry {
-  id: string;
-  config_entries?: string[];
-  configuration_url?: string | null;
-}
-
-export interface Hass {
-  entries(domain: string): Promise<ConfigEntry[]>;
-  /** A user flow for `handler`, or — given an entry — a reconfigure flow for it. */
-  startFlow(handler: string, entryId?: string): Promise<FlowResult>;
-  stepFlow(flowId: string, input: Record<string, unknown>): Promise<FlowResult>;
-  abortFlow(flowId: string): Promise<void>;
-  flowsInProgress(): Promise<FlowProgress[]>;
-  devices(): Promise<DeviceEntry[]>;
-}
-
-/** Home Assistant over HTTP: REST for entries and flows, one short WebSocket session per question. */
-export class HassApi implements Hass {
-  private readonly base: string;
-
-  constructor(url: string, private readonly token: string) {
-    this.base = url.replace(/\/$/, "");
-  }
-
-  private async rest(method: string, path: string, body?: unknown): Promise<unknown> {
-    const res = await fetch(`${this.base}${path}`, {
-      method,
-      headers: {
-        Authorization: `Bearer ${this.token}`,
-        Accept: "application/json",
-        ...(body !== undefined ? { "Content-Type": "application/json" } : {}),
-      },
-      body: body !== undefined ? JSON.stringify(body) : undefined,
-    });
-    const text = await res.text();
-    if (!res.ok) {
-      // Home Assistant's error text names fields, never echoes their values.
-      throw new Error(`Home Assistant ${method} ${path} answered ${res.status}${text ? `: ${text.slice(0, 200)}` : ""}`);
-    }
-    return text ? (JSON.parse(text) as unknown) : undefined;
-  }
-
-  async entries(domain: string): Promise<ConfigEntry[]> {
-    return ((await this.rest("GET", `/api/config/config_entries/entry?domain=${encodeURIComponent(domain)}`)) ??
-      []) as ConfigEntry[];
-  }
-
-  async startFlow(handler: string, entryId?: string): Promise<FlowResult> {
-    return (await this.rest("POST", "/api/config/config_entries/flow", {
-      handler,
-      show_advanced_options: true,
-      ...(entryId ? { entry_id: entryId } : {}),
-    })) as FlowResult;
-  }
-
-  async stepFlow(flowId: string, input: Record<string, unknown>): Promise<FlowResult> {
-    return (await this.rest("POST", `/api/config/config_entries/flow/${encodeURIComponent(flowId)}`, input)) as FlowResult;
-  }
-
-  async abortFlow(flowId: string): Promise<void> {
-    await this.rest("DELETE", `/api/config/config_entries/flow/${encodeURIComponent(flowId)}`).catch(() => undefined);
-  }
-
-  async flowsInProgress(): Promise<FlowProgress[]> {
-    return (await this.ws("config_entries/flow/progress")) as FlowProgress[];
-  }
-
-  async devices(): Promise<DeviceEntry[]> {
-    return (await this.ws("config/device_registry/list")) as DeviceEntry[];
-  }
-
-  /** One WebSocket command: connect, authenticate, ask, close. */
-  private ws(type: string): Promise<unknown> {
-    const url = `${this.base.replace(/^http/, "ws")}/api/websocket`;
-    return new Promise((resolve, reject) => {
-      const socket = new WebSocket(url);
-      const timer = setTimeout(() => {
-        socket.close();
-        reject(new Error(`Home Assistant's WebSocket did not answer ${type} within 30s`));
-      }, 30_000);
-      const done = (fn: () => void): void => {
-        clearTimeout(timer);
-        socket.close();
-        fn();
-      };
-      socket.onerror = () => done(() => reject(new Error(`Home Assistant's WebSocket at ${url} failed`)));
-      socket.onmessage = (event: { data: unknown }) => {
-        const msg = JSON.parse(String(event.data)) as {
-          type: string;
-          id?: number;
-          success?: boolean;
-          result?: unknown;
-          error?: { message?: string };
-        };
-        if (msg.type === "auth_required") socket.send(JSON.stringify({ type: "auth", access_token: this.token }));
-        else if (msg.type === "auth_invalid") done(() => reject(new Error("Home Assistant refused the token")));
-        else if (msg.type === "auth_ok") socket.send(JSON.stringify({ id: 1, type }));
-        else if (msg.type === "result" && msg.id === 1) {
-          if (msg.success) done(() => resolve(msg.result));
-          else done(() => reject(new Error(`Home Assistant ${type}: ${msg.error?.message ?? "failed"}`)));
-        }
-      };
-    });
-  }
-}

modules/home-assistant/provisions/index.ts

@@ -1,84 +0,0 @@
-// home-assistant's provisions step — run once by the host after Home Assistant starts, and again
-// whenever a binding or pair credential it reads changes (the container's `restart-on`, novox/hq
-// ADR 0099). It points Home Assistant's MQTT integration at the `mqtt-topic` broker and its Sonarr,
-// Radarr and Lidarr integrations at the `sonarr-api`, `radarr-api` and `lidarr-api` apps, through
-// Home Assistant's own config flows (connections.ts). It connects to no mesh broker.
-//
-// Exits non-zero when anything could not be put right, so the node reports the step failed and the
-// host runs it again on the next apply. Declared last in the manifest, so its failing gates nothing
-// else of home-assistant's (novox/hq ADR 0136). Never prints a key or password.
-
-import { join } from "node:path";
-
-import { APPS, MQTT_PROVISION, reconcileApp, reconcileMqtt, type Outcome } from "./connections.js";
-import { HassApi } from "./hass.js";
-import { marksIn, readBinding, readIfThere } from "./mesh.js";
-import { probeBroker } from "./probe.js";
-
-const dir = process.env.MESH_PROVISIONS_DIR ?? "/run/provisions";
-const url = process.env.MESH_HOMEASSISTANT_URL ?? "http://127.0.0.1:8123";
-const token = (await readIfThere(process.env.MESH_HOMEASSISTANT_TOKEN_FILE))?.trim() ?? "";
-const marks = marksIn(process.env.MESH_WRITTEN_DIR ?? "/var/lib/home-assistant-provisions");
-const waitSeconds = Number(process.env.MESH_HOMEASSISTANT_WAIT_SECONDS ?? "300");
-
-if (!token) {
-  console.error("[hass-provisions] no Home Assistant token — home-assistant's own `token` secret has not been accepted");
-  process.exit(1);
-}
-
-/** Home Assistant answers /api/ with 200 once it is up and the token is good. */
-async function ready(): Promise<boolean> {
-  const until = Date.now() + waitSeconds * 1000;
-  for (;;) {
-    try {
-      const res = await fetch(`${url.replace(/\/$/, "")}/api/`, { headers: { Authorization: `Bearer ${token}` } });
-      if (res.status === 200) return true;
-      if (res.status === 401 || res.status === 403) {
-        console.error("[hass-provisions] Home Assistant refuses the token — accept a long-lived access token it issued");
-        return false;
-      }
-    } catch {
-      // not listening yet
-    }
-    if (Date.now() >= until) return false;
-    await new Promise((r) => setTimeout(r, 3000));
-  }
-}
-
-if (!(await ready())) {
-  console.error(`[hass-provisions] Home Assistant did not answer at ${url} within ${waitSeconds}s`);
-  process.exit(1);
-}
-
-const hass = new HassApi(url, token);
-const read = async (p: string) => [await readBinding(join(dir, `${p}.json`)), await readIfThere(join(dir, `${p}.secret`))] as const;
-
-const outcomes: Outcome[] = [];
-{
-  const [binding, secret] = await read(MQTT_PROVISION);
-  outcomes.push(await reconcileMqtt({ hass, probe: probeBroker, marks }, binding, secret));
-}
-for (const spec of APPS) {
-  const [binding, secret] = await read(spec.provision);
-  outcomes.push(await reconcileApp({ hass, http: { fetch: (u, init) => fetch(u, init) } }, spec, binding, secret));
-}
-
-let failed = 0;
-for (const o of outcomes) {
-  switch (o.result) {
-    case "unchanged":
-      console.log(`[hass-provisions] ${o.what}: already as the mesh says${o.note ? ` — ${o.note}` : ""}`);
-      break;
-    case "written":
-      console.log(`[hass-provisions] ${o.what}: wrote ${o.fields.join(", ")}; Home Assistant's own test passed${o.note ? ` — ${o.note}` : ""}`);
-      break;
-    case "equivalent":
-      console.log(`[hass-provisions] ${o.what}: ${o.note}`);
-      break;
-    case "refused":
-      failed++;
-      console.error(`[hass-provisions] ${o.what}: ${o.problem}`);
-      break;
-  }
-}
-process.exitCode = failed > 0 ? 1 : 0;

modules/home-assistant/provisions/mesh.ts

@@ -1,42 +0,0 @@
-// What the mesh delivered to home-assistant's provisions step, and the step's own small memory.
-//
-// Per provision it requires, the mesh writes two files beside each other (the manifest's `binds` and
-// `secrets`): `<provision>.json`, the binding — where the provider is (`at`), what it serves (`port`,
-// `scheme`, …) and the login this module presents (`as`) — and `<provision>.secret`, the pair
-// credential. Nothing here guesses a host, a port or a key.
-
-import { mkdir, readFile, rename, writeFile } from "node:fs/promises";
-import { join } from "node:path";
-
-import type { Binding, Marks } from "./connections.js";
-
-/** A file the mesh wrote, or undefined when it is not there. */
-export async function readIfThere(path: string | undefined): Promise<string | undefined> {
-  if (!path) return undefined;
-  return readFile(path, "utf8").catch(() => undefined);
-}
-
-/** A binding file parsed, or undefined when absent or not JSON. */
-export async function readBinding(path: string): Promise<Binding | undefined> {
-  const raw = await readIfThere(path);
-  if (raw === undefined) return undefined;
-  try {
-    return JSON.parse(raw) as Binding;
-  } catch {
-    return undefined;
-  }
-}
-
-export function marksIn(dir: string): Marks {
-  return {
-    async get(name) {
-      return (await readIfThere(join(dir, `${name}.digest`)))?.trim() || undefined;
-    },
-    async set(name, value) {
-      await mkdir(dir, { recursive: true, mode: 0o700 });
-      const path = join(dir, `${name}.digest`);
-      await writeFile(`${path}.tmp`, `${value}\n`, { mode: 0o600 });
-      await rename(`${path}.tmp`, path);
-    },
-  };
-}

modules/home-assistant/provisions/probe.ts

@@ -1,117 +0,0 @@
-// Ask the broker, before Home Assistant is told anything, whether it takes the login and password
-// the mesh delivered — and whether that login may subscribe to Home Assistant's discovery topics.
-//
-// One MQTT 3.1.1 session: CONNECT (clean, a throwaway client id, so Home Assistant's own session is
-// never taken over), read the CONNACK, optionally SUBSCRIBE once and read the SUBACK, DISCONNECT.
-// No dependency: the handful of bytes MQTT needs for this are written here.
-
-import { randomBytes } from "node:crypto";
-import { connect } from "node:net";
-
-export interface ProbeResult {
-  /** 0 accepted; 4 bad username or password; 5 not authorised. */
-  connack: number;
-  /** The SUBACK return code for the filter asked about: 0–2 granted, 0x80 refused. */
-  suback?: number;
-}
-
-export type Probe = (host: string, port: number, username: string, password: string, subscribe?: string) => Promise<ProbeResult>;
-
-function str(v: string): Buffer {
-  const b = Buffer.from(v, "utf8");
-  const len = Buffer.alloc(2);
-  len.writeUInt16BE(b.length);
-  return Buffer.concat([len, b]);
-}
-
-function packet(type: number, body: Buffer): Buffer {
-  let remaining = body.length;
-  const lenBytes: number[] = [];
-  do {
-    let byte = remaining % 128;
-    remaining = Math.floor(remaining / 128);
-    if (remaining > 0) byte |= 0x80;
-    lenBytes.push(byte);
-  } while (remaining > 0);
-  return Buffer.concat([Buffer.from([type, ...lenBytes]), body]);
-}
-
-/** The first complete packet in `buf`: its type byte, its body, and how many bytes it took. */
-export function firstPacket(buf: Buffer): { type: number; body: Buffer; used: number } | undefined {
-  if (buf.length < 2) return undefined;
-  let length = 0;
-  let multiplier = 1;
-  let i = 1;
-  for (;;) {
-    if (i >= buf.length) return undefined;
-    const byte = buf[i++];
-    length += (byte & 0x7f) * multiplier;
-    if ((byte & 0x80) === 0) break;
-    multiplier *= 128;
-    if (i > 4) throw new Error("malformed MQTT remaining length");
-  }
-  if (buf.length < i + length) return undefined;
-  return { type: buf[0], body: buf.subarray(i, i + length), used: i + length };
-}
-
-export const probeBroker: Probe = (host, port, username, password, subscribe) => {
-  const connectBody = Buffer.concat([
-    str("MQTT"),
-    Buffer.from([4, 0xc2, 0, 10]), // level 4 (3.1.1); username + password + clean session; keepalive 10s
-    str(`mesh-probe-${randomBytes(6).toString("hex")}`),
-    str(username),
-    str(password),
-  ]);
-  return new Promise((resolve, reject) => {
-    const socket = connect({ host, port });
-    let buf = Buffer.alloc(0);
-    const result: ProbeResult = { connack: -1 };
-    const timer = setTimeout(() => {
-      socket.destroy();
-      reject(new Error(`no answer from the broker at ${host}:${port} within 10s`));
-    }, 10_000);
-    const finish = (): void => {
-      clearTimeout(timer);
-      if (result.connack === 0) socket.end(Buffer.from([0xe0, 0]));
-      else socket.destroy();
-      resolve(result);
-    };
-    socket.on("connect", () => socket.write(packet(0x10, connectBody)));
-    socket.on("data", (chunk) => {
-      buf = Buffer.concat([buf, chunk]);
-      for (;;) {
-        let p;
-        try {
-          p = firstPacket(buf);
-        } catch (err) {
-          clearTimeout(timer);
-          socket.destroy();
-          reject(err);
-          return;
-        }
-        if (!p) return;
-        buf = buf.subarray(p.used);
-        const kind = p.type >> 4;
-        if (kind === 2) {
-          result.connack = p.body[1] ?? -1;
-          if (result.connack !== 0 || !subscribe) return finish();
-          // SUBSCRIBE, packet id 1, one filter at QoS 0.
-          socket.write(packet(0x82, Buffer.concat([Buffer.from([0, 1]), str(subscribe), Buffer.from([0])])));
-        } else if (kind === 9) {
-          result.suback = p.body[2];
-          return finish();
-        }
-      }
-    });
-    socket.on("error", (err) => {
-      clearTimeout(timer);
-      reject(err);
-    });
-    socket.on("close", () => {
-      if (result.connack === -1) {
-        clearTimeout(timer);
-        reject(new Error(`the broker at ${host}:${port} closed the connection without answering`));
-      }
-    });
-  });
-};

modules/home-assistant/test/provisions.test.ts

@@ -1,293 +0,0 @@
-// What holds home-assistant's provisions step (provisions/*.ts): Home Assistant's MQTT entry is
-// made to use the broker, port and login the mesh bound — only after the broker takes that login,
-// through the reconfigure flow, keeping every other setting as Home Assistant pre-filled it, and not
-// again once it already says so; its Sonarr/Radarr/Lidarr entries are made, finished (reauth), left
-// alone when they already reach the bound app, and never removed; a key the app refuses (the mesh's
-// minted value before the operator accepts the app's) is never written.
-//
-// Home Assistant and the apps are fakes answering as the real ones do (flow shapes checked against
-// ghcr.io/home-assistant/home-assistant 2026.9.3, the build ace runs).
-
-import { test } from "node:test";
-import assert from "node:assert/strict";
-
-import type { ConfigEntry, DeviceEntry, FlowProgress, FlowResult, Hass, SchemaField } from "../provisions/hass.ts";
-
-import type { Binding, Marks } from "../provisions/connections.ts";
-import { APPS, formValues, reconcileApp, reconcileMqtt, sameUrl, type Http, type ServarrApp } from "../provisions/connections.ts";
-import type { Probe } from "../provisions/probe.ts";
-
-const PWD_NOT_CHANGED = "__**password_not_changed**__";
-const MINTED = "mesh-minted-password";
-
-function mqttBinding(): Binding {
-  return { provision: "mqtt-topic", from: "ace", at: "ace.internal", as: "mesh_ace_hass", serves: { scheme: "mqtt", port: 1883 } };
-}
-
-/** The MQTT reconfigure form as Home Assistant serializes it, pre-filled from an entry. */
-function brokerForm(data: Record<string, unknown>): SchemaField[] {
-  return [
-    { name: "broker", type: "string", required: true, description: { suggested_value: data.broker } },
-    { name: "port", type: "integer", required: true, default: 1883, description: { suggested_value: data.port } },
-    { name: "protocol", type: "select", required: true, default: "3.1.1", description: { suggested_value: data.protocol } },
-    { name: "username", type: "string", optional: true, description: { suggested_value: data.username } },
-    { name: "password", type: "string", optional: true, description: { suggested_value: data.password ? PWD_NOT_CHANGED : undefined } },
-    {
-      name: "other_settings",
-      type: "expandable",
-      required: true,
-      schema: [
-        { name: "keepalive", type: "integer", optional: true, description: { suggested_value: 60 } },
-        { name: "transport", type: "select", required: true, default: "tcp", description: { suggested_value: "tcp" } },
-        { name: "set_ca_cert", type: "select", required: true, description: { suggested_value: "off" } },
-        { name: "set_client_cert", type: "boolean", required: true, description: { suggested_value: false } },
-      ],
-    },
-  ];
-}
-
-interface FakeOpts {
-  entries?: Record<string, (ConfigEntry & { data: Record<string, unknown> })[]>;
-  /** What Home Assistant's own connection test accepts. */
-  accepts?: (data: Record<string, unknown>) => boolean;
-  reauth?: FlowProgress[];
-  devices?: DeviceEntry[];
-}
-
-function fakeHass(opts: FakeOpts = {}) {
-  const entries = opts.entries ?? {};
-  const calls: string[] = [];
-  const submitted: Record<string, unknown>[] = [];
-  const flows = new Map<string, { handler: string; entryId?: string; step: string; reauth?: boolean }>();
-  let n = 0;
-  const accepts = opts.accepts ?? (() => true);
-  const form = (id: string, step: string, schema: SchemaField[], errors?: Record<string, string>): FlowResult => ({
-    type: "form", flow_id: id, step_id: step, data_schema: schema, errors: errors ?? null,
-  });
-  const servarrUser: SchemaField[] = [
-    { name: "url", type: "string", required: true },
-    { name: "api_key", type: "string", required: true },
-    { name: "more_options", type: "expandable", required: true, schema: [{ name: "verify_ssl", type: "boolean", optional: true, default: false }] },
-  ];
-  const hass: Hass = {
-    async entries(domain) {
-      calls.push(`entries ${domain}`);
-      return (entries[domain] ?? []).map(({ data: _d, ...e }) => e);
-    },
-    async startFlow(handler, entryId) {
-      calls.push(`start ${handler}${entryId ? ` ${entryId}` : ""}`);
-      const id = `f${++n}`;
-      if (handler === "mqtt") {
-        const entry = entryId ? entries.mqtt.find((e) => e.entry_id === entryId) : undefined;
-        if (entryId && !entry) return { type: "abort", reason: "not_found" };
-        flows.set(id, { handler, entryId, step: "broker" });
-        return form(id, "broker", brokerForm(entry?.data ?? {}));
-      }
-      if (entryId) return { type: "abort", reason: "not_implemented" }; // no reconfigure for Servarr
-      flows.set(id, { handler, step: "user" });
-      return form(id, "user", servarrUser);
-    },
-    async stepFlow(flowId, input) {
-      calls.push(`step ${flowId}`);
-      const flow = flows.get(flowId);
-      if (!flow) throw new Error(`Home Assistant POST flow/${flowId} answered 404`);
-      if (flow.step === "reauth_confirm") {
-        flow.step = "user";
-        return form(flowId, "user", [
-          { name: "url", type: "string", required: true, default: "http://old:1" },
-          { name: "api_key", type: "string", optional: true },
-          { name: "verify_ssl", type: "boolean", optional: true, default: false },
-        ]);
-      }
-      submitted.push(input);
-      if (flow.handler === "mqtt") {
-        const entry = entries.mqtt?.find((e) => e.entry_id === flow.entryId);
-        const data = { ...input, ...(input.password === PWD_NOT_CHANGED ? { password: entry?.data.password } : {}) };
-        if (!accepts(data)) return form(flowId, "broker", brokerForm(data), { base: "cannot_connect" });
-        flows.delete(flowId);
-        if (entry) {
-          entry.data = data;
-          return { type: "abort", reason: "reconfigure_successful" };
-        }
-        (entries.mqtt ??= []).push({ entry_id: "new-mqtt", domain: "mqtt", state: "loaded", data });
-        return { type: "create_entry", result: { entry_id: "new-mqtt" } };
-      }
-      if (!accepts(input)) return form(flowId, "user", servarrUser, { base: "invalid_auth" });
-      flows.delete(flowId);
-      if (flow.reauth) return { type: "abort", reason: "reauth_successful" };
-      (entries[flow.handler] ??= []).push({ entry_id: `new-${flow.handler}`, domain: flow.handler, state: "loaded", data: input });
-      return { type: "create_entry", result: { entry_id: `new-${flow.handler}` } };
-    },
-    async abortFlow(flowId) {
-      calls.push(`abort ${flowId}`);
-      flows.delete(flowId);
-    },
-    async flowsInProgress() {
-      for (const f of opts.reauth ?? []) flows.set(f.flow_id, { handler: f.handler, entryId: f.context?.entry_id, step: "reauth_confirm", reauth: true });
-      return opts.reauth ?? [];
-    },
-    async devices() {
-      return opts.devices ?? [];
-    },
-  };
-  return { hass, calls, submitted, entries };
-}
-
-function memoryMarks(): Marks & { store: Map<string, string> } {
-  const store = new Map<string, string>();
-  return { store, get: async (k) => store.get(k), set: async (k, v) => void store.set(k, v) };
-}
-
-const takes = (suback = 0): Probe => async (_h, _p, user, pass) => ({ connack: user === "mesh_ace_hass" && pass === MINTED ? 0 : 5, suback });
-
-const aceMqttEntry = () => ({
-  entry_id: "7d1e", domain: "mqtt", state: "loaded",
-  data: { broker: "127.0.0.1", port: 1883, protocol: "5", username: "luffy", password: "luffys-password" },
-});
-
-test("mqtt: the broker is asked first; a login it does not take is never written", async () => {
-  const f = fakeHass({ entries: { mqtt: [aceMqttEntry()] } });
-  const out = await reconcileMqtt({ hass: f.hass, probe: async () => ({ connack: 5 }), marks: memoryMarks() }, mqttBinding(), MINTED);
-  assert.equal(out.result, "refused");
-  assert.match((out as { problem: string }).problem, /does not \(yet\) take the login mesh_ace_hass/);
-  assert.deepEqual(f.calls, []); // Home Assistant not even asked
-  assert.equal(f.entries.mqtt[0].data.username, "luffy");
-});
-
-test("mqtt: ace's entry (127.0.0.1, luffy) is moved to the bound broker and login, every other setting kept", async () => {
-  const f = fakeHass({ entries: { mqtt: [aceMqttEntry()] } });
-  const marks = memoryMarks();
-  const out = await reconcileMqtt({ hass: f.hass, probe: takes(), marks }, mqttBinding(), `${MINTED}\n`);
-  assert.deepEqual(out, { what: "mqtt", result: "written", fields: ["broker", "username", "password"] });
-  assert.deepEqual(f.entries.mqtt[0].data, {
-    broker: "ace.internal", port: 1883, protocol: "5", username: "mesh_ace_hass", password: MINTED,
-    other_settings: { keepalive: 60, transport: "tcp", set_ca_cert: "off", set_client_cert: false },
-  });
-  assert.ok(marks.store.get("mqtt"));
-  assert.ok(![...marks.store.values()].some((v) => v.includes(MINTED)));
-
-  // Run again: nothing differs, the flow is opened to read and closed without submitting.
-  const before = f.submitted.length;
-  const again = await reconcileMqtt({ hass: f.hass, probe: takes(), marks }, mqttBinding(), MINTED);
-  assert.deepEqual(again, { what: "mqtt", result: "unchanged" });
-  assert.equal(f.submitted.length, before);
-  assert.match(f.calls.at(-1) ?? "", /^abort /);
-});
-
-test("mqtt: a new password alone is written (the digest tells)", async () => {
-  const f = fakeHass({ entries: { mqtt: [aceMqttEntry()] } });
-  const marks = memoryMarks();
-  await reconcileMqtt({ hass: f.hass, probe: takes(), marks }, mqttBinding(), MINTED);
-  const rotated: Probe = async () => ({ connack: 0, suback: 0 });
-  const out = await reconcileMqtt({ hass: f.hass, probe: rotated, marks }, mqttBinding(), "rotated");
-  assert.deepEqual(out, { what: "mqtt", result: "written", fields: ["password"] });
-  assert.equal(f.entries.mqtt[0].data.password, "rotated");
-});
-
-test("mqtt: Home Assistant's own connection test refusing saves nothing and fails loudly", async () => {
-  const f = fakeHass({ entries: { mqtt: [aceMqttEntry()] }, accepts: () => false });
-  const marks = memoryMarks();
-  const out = await reconcileMqtt({ hass: f.hass, probe: takes(), marks }, mqttBinding(), MINTED);
-  assert.equal(out.result, "refused");
-  assert.match((out as { problem: string }).problem, /cannot_connect.*unchanged/);
-  assert.equal(f.entries.mqtt[0].data.username, "luffy");
-  assert.equal(marks.store.size, 0);
-});
-
-test("mqtt: a fresh Home Assistant gets an entry; a grant without the discovery topics is warned about", async () => {
-  const f = fakeHass();
-  const out = await reconcileMqtt({ hass: f.hass, probe: takes(0x80), marks: memoryMarks() }, mqttBinding(), MINTED);
-  assert.equal(out.result, "written");
-  assert.match((out as { note?: string }).note ?? "", /may not subscribe to homeassistant\/#/);
-  assert.equal(f.entries.mqtt[0].data.broker, "ace.internal");
-});
-
-test("mqtt: two entries, or a binding without a port, are refused rather than guessed", async () => {
-  const f = fakeHass({ entries: { mqtt: [aceMqttEntry(), { ...aceMqttEntry(), entry_id: "other" }] } });
-  assert.equal((await reconcileMqtt({ hass: f.hass, probe: takes(), marks: memoryMarks() }, mqttBinding(), MINTED)).result, "refused");
-  const noPort = { ...mqttBinding(), serves: {} };
-  assert.match(((await reconcileMqtt({ hass: f.hass, probe: takes(), marks: memoryMarks() }, noPort, MINTED)) as { problem: string }).problem, /no usable port/);
-});
-
-// ---- Servarr ----
-
-const SONARR = APPS.find((a) => a.domain === "sonarr") as ServarrApp;
-const RADARR = APPS.find((a) => a.domain === "radarr") as ServarrApp;
-const KEY = "the-apps-own-key";
-const servarrBinding = (port: number, at = "ace.internal"): Binding => ({ provision: "sonarr-api", from: "ace", at, as: "mesh_ace_hass", serves: { scheme: "http", port, "url-base": "" } });
-
-/** One running Sonarr, answering on several addresses (127.0.0.1 and ace.internal are one host). */
-function apps(instances: Record<string, { startTime: string }>): Http & { asked: string[] } {
-  const asked: string[] = [];
-  return {
-    asked,
-    async fetch(url, init) {
-      asked.push(url);
-      const u = new URL(url);
-      const inst = instances[`${u.hostname}:${u.port}`];
-      if (!inst) throw new Error("connect ECONNREFUSED");
-      if (init?.headers?.["X-Api-Key"] !== KEY) return { status: 401, text: async () => "" };
-      return { status: 200, text: async () => JSON.stringify({ version: "4.0.15", appData: "/config", startTime: inst.startTime }) };
-    },
-  };
-}
-const oneSonarr = () => apps({ "ace.internal:8989": { startTime: "t1" }, "127.0.0.1:8989": { startTime: "t1" } });
-const sonarrEntry = (state = "loaded") => ({ entry_id: "5a1d", domain: "sonarr", state, data: { url: "http://127.0.0.1:8989", api_key: KEY } });
-
-test("servarr: the mesh's minted key is never written; the remedy names the accept", async () => {
-  const f = fakeHass({ entries: { sonarr: [sonarrEntry()] } });
-  const out = await reconcileApp({ hass: f.hass, http: oneSonarr() }, SONARR, servarrBinding(8989), "minted-by-the-mesh");
-  assert.equal(out.result, "refused");
-  assert.match((out as { problem: string }).problem, /secret accept <this node> home-assistant sonarr-api --provider ace/);
-  assert.deepEqual(f.calls, []);
-});
-
-test("servarr: ace's entry at 127.0.0.1 reaches the same Sonarr the mesh bound at ace.internal — left, and said", async () => {
-  const f = fakeHass({ entries: { sonarr: [sonarrEntry()] }, devices: [{ id: "d", config_entries: ["5a1d"], configuration_url: "http://127.0.0.1:8989" }] });
-  const out = await reconcileApp({ hass: f.hass, http: oneSonarr() }, SONARR, servarrBinding(8989), KEY);
-  assert.equal(out.result, "equivalent");
-  assert.equal(f.submitted.length, 0);
-});
-
-test("servarr: an entry already at the bound URL is unchanged", async () => {
-  const f = fakeHass({ entries: { sonarr: [sonarrEntry()] }, devices: [{ id: "d", config_entries: ["5a1d"], configuration_url: "http://ace.internal:8989" }] });
-  assert.deepEqual(await reconcileApp({ hass: f.hass, http: oneSonarr() }, SONARR, servarrBinding(8989), KEY), { what: "sonarr", result: "unchanged" });
-});
-
-test("servarr: a working entry that reaches a different app is refused, and nothing is removed", async () => {
-  const f = fakeHass({ entries: { sonarr: [sonarrEntry()] }, devices: [{ id: "d", config_entries: ["5a1d"], configuration_url: "http://127.0.0.1:8989" }] });
-  const two = apps({ "ace.internal:8989": { startTime: "t1" }, "127.0.0.1:8989": { startTime: "another" } });
-  const out = await reconcileApp({ hass: f.hass, http: two }, SONARR, servarrBinding(8989), KEY);
-  assert.equal(out.result, "refused");
-  assert.match((out as { problem: string }).problem, /never does/);
-  assert.equal(f.entries.sonarr.length, 1);
-});
-
-test("servarr: no entry — one is made at the bound URL through the user flow", async () => {
-  const f = fakeHass({ entries: {} });
-  const out = await reconcileApp({ hass: f.hass, http: oneSonarr() }, SONARR, servarrBinding(8989), KEY);
-  assert.deepEqual(out, { what: "sonarr", result: "written", fields: ["entry"] });
-  assert.deepEqual(f.submitted[0], { url: "http://ace.internal:8989", api_key: KEY, more_options: { verify_ssl: false } });
-});
-
-test("servarr: a reauth Home Assistant started is finished with the bound URL and key", async () => {
-  const entry = { ...sonarrEntry("setup_error"), domain: "radarr", entry_id: "1955" };
-  const f = fakeHass({
-    entries: { radarr: [entry] },
-    reauth: [{ flow_id: "r1", handler: "radarr", step_id: "reauth_confirm", context: { source: "reauth", entry_id: "1955" } }],
-  });
-  const radarr = apps({ "ace.internal:7878": { startTime: "t" } });
-  const out = await reconcileApp({ hass: f.hass, http: radarr }, RADARR, { ...servarrBinding(7878), provision: "radarr-api" }, KEY);
-  assert.deepEqual(out, { what: "radarr", result: "written", fields: ["api_key", "url"] });
-  assert.deepEqual(f.submitted[0], { url: "http://ace.internal:7878", api_key: KEY, verify_ssl: false });
-});
-
-test("form values: suggested first, then default, sections nested", () => {
-  assert.deepEqual(formValues(brokerForm({ broker: "b", port: 1, protocol: "5", username: "u", password: "p" })), {
-    broker: "b", port: 1, protocol: "5", username: "u", password: PWD_NOT_CHANGED,
-    other_settings: { keepalive: 60, transport: "tcp", set_ca_cert: "off", set_client_cert: false },
-  });
-  assert.ok(sameUrl("http://ace.internal:8989/", "http://ace.internal:8989"));
-  assert.ok(sameUrl("http://ACE.internal", "http://ace.internal:80"));
-  assert.ok(!sameUrl("http://127.0.0.1:8989", "http://ace.internal:8989"));
-});

modules/home-assistant/tsconfig.json

@@ -8,14 +8,5 @@
     "skipLibCheck": true,
     "noEmit": true
   },
-  "include": [
-    "client.ts",
-    "index.ts",
-    "tools/index.ts",
-    "provisions/hass.ts",
-    "provisions/probe.ts",
-    "provisions/connections.ts",
-    "provisions/mesh.ts",
-    "provisions/index.ts"
-  ]
+  "include": ["client.ts", "index.ts", "tools/index.ts"]
 }

modules/icecast/module.json

@@ -29,7 +29,7 @@
     "stream.stopped"
   ],
   "own-secrets": {
-    "broker": "${dir:mesh-state}/broker"
+    "broker": "/var/lib/mesh/icecast/broker"
   },
   "listens": [
     {
@@ -44,8 +44,8 @@
     {
       "id": "mesh-state",
       "type": "directory",
-      "mode": "0700",
-      "place": "mesh"
+      "path": "/var/lib/mesh/icecast",
+      "mode": "0700"
     },
     {
       "id": "state",
@@ -91,7 +91,7 @@
     {
       "id": "runtime-config",
       "type": "file",
-      "path": "${dir:mesh-state}/config.json",
+      "path": "/var/lib/mesh/icecast/config.json",
       "mode": "0600",
       "content": "{}\n",
       "merge": "json"
@@ -102,8 +102,8 @@
       "name": "mesh-icecast",
       "network": "icecast",
       "volumes": [
-        "${dir:mesh-state}/broker:/run/secrets/broker:ro",
-        "${dir:mesh-state}/config.json:/run/config/config.json:ro"
+        "/var/lib/mesh/icecast/broker:/run/secrets/broker:ro",
+        "/var/lib/mesh/icecast/config.json:/run/config/config.json:ro"
       ],
       "env": {
         "MESH_BROKER_FILE": "/run/secrets/broker",

modules/influxdb/module.json

@@ -11,7 +11,7 @@
     "container-runtime"
   ],
   "own-secrets": {
-    "broker": "${dir:mesh-state}/broker",
+    "broker": "/var/lib/mesh/influxdb/broker",
     "admin": "${dir:state}/admin.secret",
     "admin-token": "${dir:state}/admin-token.secret"
   },
@@ -42,8 +42,8 @@
     {
       "id": "mesh-state",
       "type": "directory",
-      "mode": "0700",
-      "place": "mesh"
+      "path": "/var/lib/mesh/influxdb",
+      "mode": "0700"
     },
     {
       "id": "state",
@@ -96,7 +96,7 @@
     {
       "id": "runtime-config",
       "type": "file",
-      "path": "${dir:mesh-state}/config.json",
+      "path": "/var/lib/mesh/influxdb/config.json",
       "mode": "0600",
       "content": "{}\n",
       "merge": "json"
@@ -107,8 +107,8 @@
       "name": "mesh-influxdb",
       "network": "host",
       "volumes": [
-        "${dir:mesh-state}/broker:/run/secrets/broker:ro",
-        "${dir:mesh-state}/config.json:/run/config/config.json:ro",
+        "/var/lib/mesh/influxdb/broker:/run/secrets/broker:ro",
+        "/var/lib/mesh/influxdb/config.json:/run/config/config.json:ro",
         "${dir:state}/admin-token.secret:/run/secrets/admin-token:ro",
         "${dir:grants}:${dir:grants}:ro"
       ],

modules/invoicing/module.json

@@ -26,13 +26,13 @@
     }
   },
   "binds": {
-    "mongodb-database": "${dir:state}/database.json",
-    "s3-bucket": "${dir:state}/store.json",
-    "route": "${dir:state}/route.json"
+    "mongodb-database": "/var/lib/invoicing/database.json",
+    "s3-bucket": "/var/lib/invoicing/store.json",
+    "route": "/var/lib/invoicing/route.json"
   },
   "secrets": {
-    "mongodb-database": "${dir:state}/database.secret",
-    "s3-bucket": "${dir:state}/store.secret"
+    "mongodb-database": "/var/lib/invoicing/database.secret",
+    "s3-bucket": "/var/lib/invoicing/store.secret"
   },
   "listens": [
     {
@@ -54,19 +54,19 @@
     {
       "id": "mesh-state",
       "type": "directory",
-      "mode": "0700",
-      "place": "mesh"
+      "path": "/var/lib/mesh/invoicing",
+      "mode": "0700"
     },
     {
       "id": "state",
       "type": "directory",
-      "mode": "0700",
-      "place": "."
+      "path": "/var/lib/invoicing",
+      "mode": "0700"
     },
     {
       "id": "api-env",
       "type": "file",
-      "path": "${dir:state}/api.env",
+      "path": "/var/lib/invoicing/api.env",
       "mode": "0600",
       "content": "NODE_ENV=production\nPORT=9000\nMONGO_URL=mongodb://${bound:mongodb-database:as}:${secret:mongodb-database}@${bound:mongodb-database:at}:${bound:mongodb-database:port}/${bound:mongodb-database:as}?authSource=${bound:mongodb-database:as}\nMONGO_DB=${bound:mongodb-database:as}\nMINIO_BUCKET=mesh-novox-invoice\nMINIO_ENDPOINT=${bound:s3-bucket:at}\nMINIO_PORT=${bound:s3-bucket:port}\nMINIO_ACCESSKEY=${bound:s3-bucket:as}\nMINIO_SECRET=${secret:s3-bucket}\n"
     },
@@ -103,7 +103,7 @@
         "GID": "2201"
       },
       "env-file": [
-        "${dir:state}/api.env"
+        "/var/lib/invoicing/api.env"
       ],
       "ports": [
         "9000"

modules/jackett/Dockerfile

@@ -0,0 +1,24 @@
+# jackett's runtime: the tool runtime, carrying this module's compiled code.
+#
+# **Built from this module's own directory and nothing else.** The sdk and the tool runtime are in
+# the base images, published like any other artifact — which is what makes this buildable by the
+# mesh from a repository and a path (novox/hq ADR 0069) rather than only on a workstation that
+# happens to have the siblings.
+#
+# Two bases, named rather than pinned (novox/hq issue 044): the image this is COMPILED in and the
+# image it RUNS in — the second must not carry a compiler. Declared in module.json's `build.on`.
+ARG BUILD_BASE
+ARG RUNTIME_BASE
+
+FROM ${BUILD_BASE} AS build
+WORKDIR /app/modules/jackett
+COPY . .
+RUN node /app/node_modules/typescript/bin/tsc client.ts tools/index.ts \
+      --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist
+
+FROM ${RUNTIME_BASE}
+COPY --from=build /app/modules/jackett/dist /app/modules/jackett/dist
+# Every serve-time entrypoint, loaded by the runtime in serve mode: tools and events serve, and a
+# provider's provisioner runs its reconcile loop in the same process, with the broker connected —
+# the convention novox/hq issues 060/061 settled.
+ENV MESH_TOOL_MODULES=/app/modules/jackett/dist/tools/index.js

modules/jackett/client.ts

@@ -0,0 +1,136 @@
+// The Jackett API client — jackett's own code, living in the module (novox/hq ADR 0039). Jackett is
+// an indexer proxy: it normalises many torrent trackers behind one Torznab surface. This client
+// talks its /api/v2.0 REST API, and only jackett's tools import it.
+
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+
+export interface JackettIndexer {
+  id: string;
+  name: string;
+  type: string; // "public" | "private" | "semi-public"
+  configured: boolean;
+  siteLink?: string;
+  lastError?: string;
+}
+
+export interface JackettResult {
+  title: string;
+  tracker: string;
+  category?: string;
+  size: number;
+  seeders?: number;
+  peers?: number;
+  publishDate?: string;
+  link?: string;
+}
+
+/** The settings-merged config the mesh delivers (novox/hq ADR 0046): { url, apiKey, token, password, user, ... }. */
+function meshConfig(file?: string): Record<string, string> {
+  if (!file) return {};
+  try { return JSON.parse(readFileSync(file, "utf8")) as Record<string, string>; }
+  catch { return {}; }
+}
+
+export class JackettClient {
+  readonly baseUrl: string;
+
+  constructor(
+    url: string,
+    private readonly apiKey: string,
+  ) {
+    this.baseUrl = url.replace(/\/$/, "");
+  }
+
+  /**
+   * Build from the module's resolved environment. Jackett's REST API is keyed, so both the URL and
+   * the key must be present. The key is read from the settings-merged config or MESH_JACKETT_API_KEY,
+   * or, failing those, discovered from Jackett's own ServerConfig.json under MESH_JACKETT_CONFIG_DIR
+   * — the file Jackett writes it to, as sonarr/radarr read theirs from config.xml — so a running
+   * server needs no key configured by hand and no secret has to be put in an assignment. Without a
+   * URL or key there is nothing to talk to, so this throws and the module contributes no tools
+   * rather than failing half-configured.
+   */
+  static fromEnv(env: NodeJS.ProcessEnv = process.env): JackettClient {
+    const cfg = meshConfig(env.MESH_JACKETT_CONFIG_FILE);
+    const url = cfg.url ?? env.MESH_JACKETT_URL;
+    const apiKey = cfg.apiKey ?? env.MESH_JACKETT_API_KEY
+      ?? JackettClient.detectApiKey(env.MESH_JACKETT_CONFIG_DIR ?? "/config");
+    if (!url) throw new Error("no Jackett URL — set MESH_JACKETT_URL");
+    if (!apiKey) throw new Error("no Jackett API key — set MESH_JACKETT_API_KEY or make the config dir readable");
+    return new JackettClient(url, apiKey);
+  }
+
+  /** Discover the API key from Jackett's ServerConfig.json (the linuxserver image keeps it at
+   *  <config>/Jackett/ServerConfig.json), falling back to null. */
+  static detectApiKey(configDir: string): string | null {
+    for (const file of [join(configDir, "Jackett", "ServerConfig.json"), join(configDir, "ServerConfig.json")]) {
+      if (!existsSync(file)) continue;
+      try {
+        const key = (JSON.parse(readFileSync(file, "utf8")) as { APIKey?: unknown }).APIKey;
+        if (typeof key === "string" && key) return key;
+      } catch { /* unreadable or mid-write: try the next, then give up */ }
+    }
+    return null;
+  }
+
+  private async get(path: string, params: Record<string, string> = {}): Promise<any> {
+    const url = new URL(`${this.baseUrl}${path}`);
+    url.searchParams.set("apikey", this.apiKey);
+    for (const [k, v] of Object.entries(params)) url.searchParams.set(k, v);
+    const res = await fetch(url.toString(), { headers: { Accept: "application/json" } });
+    if (!res.ok) throw new Error(`Jackett API ${path}: ${res.status} ${await res.text()}`);
+    return res.json();
+  }
+
+  /**
+   * The configured indexers Jackett proxies. `configured=false` also lists the ones not set up.
+   * Read from the Torznab `t=indexers` feed, not /api/v2.0/indexers: that one is the web UI's and
+   * wants a login cookie (it answers an API-key request with a redirect), while the Torznab feed is
+   * what the key is for. The feed carries no last error, so `lastError` stays unset.
+   */
+  async getIndexers(configuredOnly = true): Promise<JackettIndexer[]> {
+    const url = new URL(`${this.baseUrl}/api/v2.0/indexers/all/results/torznab/api`);
+    url.searchParams.set("apikey", this.apiKey);
+    url.searchParams.set("t", "indexers");
+    url.searchParams.set("configured", configuredOnly ? "true" : "false");
+    const res = await fetch(url.toString(), { headers: { Accept: "application/xml" } });
+    if (!res.ok) throw new Error(`Jackett API torznab t=indexers: ${res.status} ${await res.text()}`);
+    const xml = await res.text();
+    // Torznab reports failures (a wrong key among them) as 200 with an <error> body.
+    const err = xml.match(/<error code="(\d+)" description="([^"]*)"/);
+    if (err) throw new Error(`Jackett API torznab t=indexers: error ${err[1]} ${err[2]}`);
+    const text = (block: string, tag: string) =>
+      block.match(new RegExp(`<${tag}>([^<]*)</${tag}>`))?.[1];
+    const out: JackettIndexer[] = [];
+    for (const m of xml.matchAll(/<indexer id="([^"]+)" configured="([^"]+)">([\s\S]*?)<\/indexer>/g)) {
+      out.push({
+        id: m[1],
+        name: text(m[3], "title") ?? m[1],
+        type: text(m[3], "type") ?? "unknown",
+        configured: m[2] === "true",
+        siteLink: text(m[3], "link"),
+      });
+    }
+    return out;
+  }
+
+  /**
+   * A Torznab search across one indexer, or the "all" aggregate. Jackett returns a normalised JSON
+   * result set regardless of the underlying tracker, which is the whole point of the proxy.
+   */
+  async search(query: string, indexer = "all", limit = 25): Promise<JackettResult[]> {
+    const raw = await this.get(`/api/v2.0/indexers/${encodeURIComponent(indexer)}/results`, { Query: query });
+    const results = Array.isArray(raw?.Results) ? raw.Results : [];
+    return results.slice(0, limit).map((r: any) => ({
+      title: r.Title,
+      tracker: r.Tracker ?? r.TrackerId ?? "unknown",
+      category: Array.isArray(r.CategoryDesc) ? r.CategoryDesc.join(", ") : r.CategoryDesc,
+      size: r.Size ?? 0,
+      seeders: r.Seeders,
+      peers: r.Peers,
+      publishDate: r.PublishDate,
+      link: r.Link ?? r.Details,
+    }));
+  }
+}

modules/jackett/module.json

@@ -0,0 +1,131 @@
+{
+  "module": "jackett",
+  "version": "1",
+  "provides": [
+    {
+      "name": "jackett-api",
+      "scope": "mesh"
+    }
+  ],
+  "serves": {
+    "jackett-api": {
+      "scheme": "http",
+      "port": 9117,
+      "url-base": ""
+    }
+  },
+  "capabilities": [
+    "container-runtime"
+  ],
+  "listens": [
+    {
+      "name": "web",
+      "port": 9117,
+      "protocol": "tcp",
+      "from": "mesh",
+      "why": "the indexer proxy: its web UI, and the Torznab feeds the *arr apps search through, which other modules reach as jackett-api"
+    }
+  ],
+  "resources": [
+    {
+      "id": "mesh-state",
+      "type": "directory",
+      "path": "/var/lib/mesh/jackett",
+      "mode": "0700"
+    },
+    {
+      "id": "state",
+      "type": "directory",
+      "mode": "0700",
+      "place": "."
+    },
+    {
+      "id": "config",
+      "type": "directory",
+      "mode": "0700",
+      "owner": "1000:1000"
+    },
+    {
+      "id": "server",
+      "type": "container",
+      "name": "jackett",
+      "image": "lscr.io/linuxserver/jackett@sha256:7b19f4f6ac33d855ca9226600ecbd096ee678f66da28b13a7c09980b035ff583",
+      "env": {
+        "PUID": "1000",
+        "PGID": "1000",
+        "TZ": "Etc/UTC"
+      },
+      "ports": [
+        "9117"
+      ],
+      "volumes": [
+        "${dir:config}:/config"
+      ]
+    },
+    {
+      "id": "runtime-config",
+      "type": "file",
+      "path": "${dir:state}/config.json",
+      "mode": "0600",
+      "content": "{}\n",
+      "merge": "json"
+    },
+    {
+      "id": "runtime",
+      "type": "container",
+      "name": "mesh-jackett",
+      "network": "host",
+      "volumes": [
+        "/var/lib/mesh/jackett/broker:/run/secrets/broker:ro",
+        "${dir:state}/config.json:/run/config/config.json:ro",
+        "${dir:config}:/var/lib/jackett/config:ro"
+      ],
+      "env": {
+        "MESH_BROKER_FILE": "/run/secrets/broker",
+        "MESH_JACKETT_URL": "http://127.0.0.1:${port:9117}",
+        "MESH_JACKETT_CONFIG_FILE": "/run/config/config.json",
+        "MESH_JACKETT_CONFIG_DIR": "/var/lib/jackett/config"
+      },
+      "restart-on": [
+        "runtime-config"
+      ],
+      "artifact": "runtime"
+    }
+  ],
+  "own-secrets": {
+    "broker": "/var/lib/mesh/jackett/broker"
+  },
+  "requires": [
+    "route"
+  ],
+  "contributes": {
+    "route": {
+      "label": "indexers",
+      "endpoint": "web"
+    }
+  },
+  "binds": {
+    "route": "${dir:state}/route.json"
+  },
+  "build": {
+    "on": [
+      {
+        "arg": "BUILD_BASE",
+        "module": "mesh-tools",
+        "artifact": "build"
+      },
+      {
+        "arg": "RUNTIME_BASE",
+        "module": "mesh-tools",
+        "artifact": "runtime"
+      }
+    ],
+    "artifacts": [
+      {
+        "name": "runtime",
+        "kind": "image",
+        "from": "Dockerfile"
+      }
+    ]
+  }
+}

modules/jackett/package.json

@@ -0,0 +1,14 @@
+{
+  "name": "@novox/module-jackett",
+  "version": "0.1.0",
+  "description": "jackett — indexer proxy. Its API client and tools live here (novox/hq ADR 0039).",
+  "type": "module",
+  "private": true,
+  "dependencies": {
+    "@novox/mesh-sdk": "^0.1.0"
+  },
+  "devDependencies": {
+    "@types/node": "^22.0.0",
+    "typescript": "^5.6.0"
+  }
+}

modules/jackett/tools/index.ts

@@ -0,0 +1,48 @@
+// jackett's tools — its own code (novox/hq ADR 0039), importing jackett's client. Jackett has
+// nothing worth watching (an indexer proxy answers queries; it has no timeline of its own), so it
+// is a tools-only module: no events entrypoint, no broker. What is useful is asking it things.
+
+import { registerModuleTools, type ToolDefinition } from "@novox/mesh-sdk/tools";
+import { JackettClient } from "../client.js";
+
+export function getJackettTools(jackett: JackettClient): ToolDefinition[] {
+  return [
+    {
+      name: "jackett_indexers",
+      description: "List the indexers Jackett proxies, with their type and site.",
+      input: { all: { type: "boolean", description: "include indexers not yet configured (default false)" } },
+      run: async (args) => {
+        const indexers = await jackett.getIndexers(!args.all);
+        return { count: indexers.length, indexers };
+      },
+    },
+    {
+      name: "jackett_search",
+      description: "Torznab search across Jackett's indexers, returning normalised torrent results.",
+      input: {
+        query: { type: "string", description: "the search query" },
+        indexer: { type: "string", description: 'an indexer id, or "all" to aggregate (default "all")' },
+        limit: { type: "number", description: "max results (default 25)" },
+      },
+      run: async (args) => {
+        const query = String(args.query);
+        const results = await jackett.search(
+          query,
+          args.indexer ? String(args.indexer) : "all",
+          args.limit ? Number(args.limit) : 25,
+        );
+        return { query, count: results.length, results };
+      },
+    },
+  ];
+}
+
+// Only exposed when Jackett is configured; otherwise jackett contributes no tools rather than
+// failing the whole runtime.
+registerModuleTools("jackett", (env) => {
+  try {
+    return getJackettTools(JackettClient.fromEnv(env));
+  } catch {
+    return [];
+  }
+});

modules/jackett/tsconfig.json

@@ -8,5 +8,5 @@
     "skipLibCheck": true,
     "noEmit": true
   },
-  "include": ["tools/index.ts", "tools/runs.ts"]
+  "include": ["client.ts", "tools/index.ts"]
 }

modules/jira/module.json

@@ -2,26 +2,26 @@
   "module": "jira",
   "version": "1",
   "own-secrets": {
-    "token": "${dir:state}/token",
-    "broker": "${dir:mesh-state}/broker"
+    "token": "/var/lib/jira/token",
+    "broker": "/var/lib/mesh/jira/broker"
   },
   "resources": [
     {
       "id": "mesh-state",
       "type": "directory",
-      "mode": "0700",
-      "place": "mesh"
+      "path": "/var/lib/mesh/jira",
+      "mode": "0700"
     },
     {
       "id": "state",
       "type": "directory",
-      "mode": "0700",
-      "place": "."
+      "path": "/var/lib/jira",
+      "mode": "0700"
     },
     {
       "id": "config",
       "type": "file",
-      "path": "${dir:state}/config.json",
+      "path": "/var/lib/jira/config.json",
       "merge": "json",
       "content": "{}",
       "mode": "0600"
@@ -32,9 +32,9 @@
       "name": "mesh-runtime-jira",
       "network": "host",
       "volumes": [
-        "${dir:state}/config.json:/run/config/config.json:ro",
-        "${dir:state}/token:/run/secrets/token:ro",
-        "${dir:mesh-state}/broker:/run/secrets/broker:ro"
+        "/var/lib/jira/config.json:/run/config/config.json:ro",
+        "/var/lib/jira/token:/run/secrets/token:ro",
+        "/var/lib/mesh/jira/broker:/run/secrets/broker:ro"
       ],
       "env": {
         "MESH_JIRA_TOKEN_FILE": "/run/secrets/token",

modules/keycloak/module.json

@@ -21,11 +21,11 @@
     }
   },
   "binds": {
-    "postgres-database": "${dir:state}/database.json",
-    "route": "${dir:state}/route.json"
+    "postgres-database": "/var/lib/keycloak/database.json",
+    "route": "/var/lib/keycloak/route.json"
   },
   "secrets": {
-    "postgres-database": "${dir:state}/database.secret"
+    "postgres-database": "/var/lib/keycloak/database.secret"
   },
   "capabilities": [
     "container-runtime"
@@ -51,49 +51,49 @@
     "oidc-client": {
       "authorization-path": "/protocol/openid-connect/auth",
       "token-path": "/protocol/openid-connect/token",
-      "userinfo-path": "/protocol/openid-connect/userinfo",
-      "issuer": "${setting:issuer}"
+      "userinfo-path": "/protocol/openid-connect/userinfo"
     }
   },
   "receives": {
-    "oidc-client": "${dir:grants}/mesh.json"
+    "oidc-client": "/var/lib/keycloak/grants/mesh.json"
   },
   "grants": {
-    "oidc-client": "${dir:grants}"
+    "oidc-client": "/var/lib/keycloak/grants"
   },
   "own-secrets": {
-    "admin": "${dir:state}/admin.secret",
-    "broker": "${dir:mesh-state}/broker"
+    "admin": "/var/lib/keycloak/admin.secret",
+    "broker": "/var/lib/mesh/keycloak/broker"
   },
   "resources": [
     {
       "id": "mesh-state",
       "type": "directory",
-      "mode": "0700",
-      "place": "mesh"
+      "path": "/var/lib/mesh/keycloak",
+      "mode": "0700"
     },
     {
       "id": "state",
       "type": "directory",
-      "mode": "0700",
-      "place": "."
+      "path": "/var/lib/keycloak",
+      "mode": "0700"
     },
     {
       "id": "grants",
       "type": "directory",
+      "path": "/var/lib/keycloak/grants",
       "mode": "0700"
     },
     {
       "id": "admin-env",
       "type": "file",
-      "path": "${dir:state}/admin.env",
+      "path": "/var/lib/keycloak/admin.env",
       "mode": "0600",
       "content": "KEYCLOAK_ADMIN=admin\nKEYCLOAK_ADMIN_PASSWORD=${secret:admin}\n"
     },
     {
       "id": "database-env",
       "type": "file",
-      "path": "${dir:state}/database.env",
+      "path": "/var/lib/keycloak/database.env",
       "mode": "0600",
       "content": "KC_DB_URL=jdbc:postgresql://${bound:postgres-database:at}:${bound:postgres-database:port}/${bound:postgres-database:as}\nKC_DB_USERNAME=${bound:postgres-database:as}\nKC_DB_PASSWORD=${secret:postgres-database}\n"
     },
@@ -105,7 +105,7 @@
     {
       "id": "hostname",
       "type": "file",
-      "path": "${dir:state}/hostname.env",
+      "path": "/var/lib/keycloak/hostname.env",
       "mode": "0644",
       "content": "KC_HOSTNAME=https://${bound:route:name}\n"
     },
@@ -125,9 +125,9 @@
         "KC_PROXY_HEADERS": "xforwarded"
       },
       "env-file": [
-        "${dir:state}/admin.env",
-        "${dir:state}/database.env",
-        "${dir:state}/hostname.env"
+        "/var/lib/keycloak/admin.env",
+        "/var/lib/keycloak/database.env",
+        "/var/lib/keycloak/hostname.env"
       ],
       "ports": [
         "8080"
@@ -140,7 +140,7 @@
     {
       "id": "runtime-config",
       "type": "file",
-      "path": "${dir:mesh-state}/config.json",
+      "path": "/var/lib/mesh/keycloak/config.json",
       "mode": "0600",
       "content": "{}\n",
       "merge": "json"
@@ -151,17 +151,17 @@
       "name": "mesh-keycloak",
       "network": "host",
       "volumes": [
-        "${dir:mesh-state}/broker:/run/secrets/broker:ro",
-        "${dir:mesh-state}/config.json:/run/config/config.json:ro",
-        "${dir:state}/admin.secret:/run/secrets/admin:ro",
-        "${dir:grants}:${dir:grants}:ro"
+        "/var/lib/mesh/keycloak/broker:/run/secrets/broker:ro",
+        "/var/lib/mesh/keycloak/config.json:/run/config/config.json:ro",
+        "/var/lib/keycloak/admin.secret:/run/secrets/admin:ro",
+        "/var/lib/keycloak/grants:/var/lib/keycloak/grants:ro"
       ],
       "env": {
         "MESH_BROKER_FILE": "/run/secrets/broker",
         "MESH_KEYCLOAK_URL": "http://127.0.0.1:${port:8080}",
         "MESH_KEYCLOAK_CONFIG_FILE": "/run/config/config.json",
         "MESH_KEYCLOAK_PASSWORD_FILE": "/run/secrets/admin",
-        "MESH_RECEIVES": "${dir:grants}/mesh.json"
+        "MESH_RECEIVES": "/var/lib/keycloak/grants/mesh.json"
       },
       "restart-on": [
         "runtime-config"

modules/lab/Dockerfile

@@ -1,31 +0,0 @@
-# lab's runtime: the tool runtime, carrying this module's code, and the toolchain the lab's suite
-# builds the mesh with (novox/hq ADR 0172). It reaches the machine's virtualisation and container
-# runtime through their sockets, so what it raises is what a hand run on this machine raises.
-#
-# Every download is pinned by its checksum: an image that builds the mesh is the last place to take
-# whatever an upstream serves today.
-ARG BUILD_BASE
-ARG RUNTIME_BASE
-
-FROM ${BUILD_BASE} AS build
-WORKDIR /app/modules/lab
-COPY . .
-RUN node /app/node_modules/typescript/bin/tsc tools/index.ts tools/runs.ts \
-      --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist
-
-FROM ${RUNTIME_BASE}
-RUN apt-get update \
- && apt-get install -y --no-install-recommends git make ca-certificates curl \
- && rm -rf /var/lib/apt/lists/*
-RUN curl -fsSL -o /tmp/go.tgz https://go.dev/dl/go1.26.8.linux-amd64.tar.gz \
- && echo "d0f743b33e8d8945e6b1f432edd15785c70507121d6e2a723b21285eddf8b57b  /tmp/go.tgz" | sha256sum -c - \
- && tar -C /usr/local -xzf /tmp/go.tgz && rm /tmp/go.tgz
-RUN curl -fsSL -o /usr/local/bin/incus https://github.com/lxc/incus/releases/download/v7.5.1/bin.linux.incus.x86_64 \
- && echo "7bd6223b369f4d693fcde695bd8549a73b5b3d403735329212483702aa22c179  /usr/local/bin/incus" | sha256sum -c - \
- && chmod 0755 /usr/local/bin/incus
-RUN curl -fsSL -o /tmp/docker.tgz https://download.docker.com/linux/static/stable/x86_64/docker-28.5.2.tgz \
- && echo "ea90cfd12e1eeb12aa1c971741adb8bd4ed88e2a574eaac13f5029a1dbc6300d  /tmp/docker.tgz" | sha256sum -c - \
- && tar -C /tmp -xzf /tmp/docker.tgz docker/docker && mv /tmp/docker/docker /usr/local/bin/docker && rm -rf /tmp/docker /tmp/docker.tgz
-ENV PATH=/usr/local/go/bin:$PATH
-COPY --from=build /app/modules/lab/dist /app/modules/lab/dist
-ENV MESH_TOOL_MODULES=/app/modules/lab/dist/tools/index.js

modules/lab/module.json

@@ -1,81 +0,0 @@
-{
-  "module": "lab",
-  "version": "1",
-  "capabilities": [
-    "container-runtime"
-  ],
-  "own-secrets": {
-    "broker": "${dir:mesh-state}/broker"
-  },
-  "resources": [
-    {
-      "id": "mesh-state",
-      "type": "directory",
-      "mode": "0700",
-      "place": "mesh"
-    },
-    {
-      "id": "state",
-      "type": "directory",
-      "mode": "0700",
-      "place": "."
-    },
-    {
-      "id": "work",
-      "type": "directory",
-      "path": "/var/lib/mesh-lab-runs",
-      "mode": "0700"
-    },
-    {
-      "id": "runtime-env",
-      "type": "file",
-      "path": "${dir:state}/lab.env",
-      "mode": "0600",
-      "content": "MESH_LAB_FORGE=${setting:forge}\n"
-    },
-    {
-      "id": "runtime",
-      "type": "container",
-      "name": "mesh-lab",
-      "network": "host",
-      "env-file": [
-        "${dir:state}/lab.env"
-      ],
-      "volumes": [
-        "${dir:mesh-state}/broker:/run/secrets/broker:ro",
-        "${dir:work}:${dir:work}",
-        "/var/run/docker.sock:/var/run/docker.sock",
-        "/var/lib/incus/unix.socket:/var/lib/incus/unix.socket"
-      ],
-      "env": {
-        "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_LAB_WORK": "${dir:work}"
-      },
-      "restart-on": [
-        "runtime-env"
-      ],
-      "artifact": "runtime"
-    }
-  ],
-  "build": {
-    "on": [
-      {
-        "arg": "BUILD_BASE",
-        "module": "mesh-tools",
-        "artifact": "build"
-      },
-      {
-        "arg": "RUNTIME_BASE",
-        "module": "mesh-tools",
-        "artifact": "runtime"
-      }
-    ],
-    "artifacts": [
-      {
-        "name": "runtime",
-        "kind": "image",
-        "from": "Dockerfile"
-      }
-    ]
-  }
-}

modules/lab/package.json

@@ -1,9 +0,0 @@
-{
-  "name": "@novox/module-lab",
-  "version": "0.1.0",
-  "description": "lab — the lab, as a module: runs beds against the forge's branches when the mesh asks (novox/hq ADR 0172).",
-  "type": "module",
-  "private": true,
-  "dependencies": { "@novox/mesh-sdk": "^0.1.0" },
-  "devDependencies": { "@types/node": "^22.0.0", "typescript": "^5.6.0" }
-}

modules/lab/tools/index.ts

@@ -1,86 +0,0 @@
-// lab's tools — the lab, as the mesh asks for it (novox/hq ADR 0172). They run on the machine the
-// lab is assigned to, and only there: a bed raises virtual machines on that machine's virtualisation.
-
-import { spawnSync } from "node:child_process";
-import { registerModuleTools, type ToolDefinition } from "@novox/mesh-sdk/tools";
-import { listRuns, readStatus, REPOSITORIES, running, start, stop, tail } from "./runs.js";
-
-export function getLabTools(env: NodeJS.ProcessEnv): ToolDefinition[] {
-  const work = env.MESH_LAB_WORK ?? "/var/lib/mesh-lab-runs";
-  const forge = (env.MESH_LAB_FORGE ?? "").replace(/\/+$/, "");
-  return [
-    {
-      name: "lab_check",
-      description: "Whether this machine can run the lab's beds: the lab's own check, against the forge's main branch.",
-      input: {},
-      run: async () => {
-        if (!forge) return { ok: false, output: "the lab's forge is not set: settings for lab, {\"forge\": \"<url>\"}" };
-        const dir = `${work}/check`;
-        spawnSync("rm", ["-rf", dir]);
-        const clone = spawnSync("git", ["clone", "--quiet", "--depth", "1", `${forge}/novox/mesh-lab.git`, dir], { encoding: "utf8" });
-        if (clone.status !== 0) return { ok: false, output: clone.stderr };
-        spawnSync("npm", ["ci", "--no-audit", "--no-fund", "--loglevel=error"], { cwd: dir, encoding: "utf8" });
-        const check = spawnSync("node", ["--experimental-strip-types", "src/cli.ts", "check"], { cwd: dir, encoding: "utf8" });
-        return { ok: check.status === 0, output: `${check.stdout}${check.stderr}`.trim() };
-      },
-    },
-    {
-      name: "lab_run",
-      description:
-        "Run the lab's beds against branches on the forge: fresh checkouts of every repository the lab builds, " +
-        "side by side, then the suite on the named test files. Answers at once with the run's id; lab_status " +
-        "and lab_log follow it. One run at a time.",
-      input: {
-        tests: { type: "string", description: "the bed test files, comma-separated, relative to mesh-lab (e.g. test/integration/mesh.test.ts)" },
-        refs: {
-          type: "string",
-          description: `a JSON object of repository to branch, for any of ${REPOSITORIES.join(", ")}; the rest run main`,
-        },
-      },
-      run: async (args) => {
-        if (!forge) return { started: false, reason: "the lab's forge is not set: settings for lab, {\"forge\": \"<url>\"}" };
-        const tests = String(args.tests ?? "").split(",").map((s) => s.trim()).filter(Boolean);
-        if (tests.length === 0) return { started: false, reason: "name at least one bed test file" };
-        let refs: Record<string, string> = {};
-        if (args.refs) {
-          try {
-            refs = JSON.parse(String(args.refs)) as Record<string, string>;
-          } catch {
-            return { started: false, reason: "refs is not a JSON object of repository to branch" };
-          }
-        }
-        const stranger = Object.keys(refs).filter((r) => !REPOSITORIES.includes(r));
-        if (stranger.length > 0) return { started: false, reason: `the lab does not build ${stranger.join(", ")}` };
-        const busy = running(work);
-        if (busy) return { started: false, reason: `${busy.id} is still ${busy.state}; one run at a time`, running: busy };
-        return { started: true, run: start(work, forge, tests, refs) };
-      },
-    },
-    {
-      name: "lab_status",
-      description: "A run's state, the commits it tested and how it ended — or every run, newest first, when no id is given.",
-      input: { id: { type: "string", description: "the run's id (optional)" } },
-      run: async (args) => {
-        if (args.id) return readStatus(work, String(args.id)) ?? { found: false, id: String(args.id) };
-        return { runs: listRuns(work).slice(0, 10) };
-      },
-    },
-    {
-      name: "lab_log",
-      description: "The last lines of a run's log.",
-      input: {
-        id: { type: "string", description: "the run's id" },
-        lines: { type: "number", description: "how many lines from the end (default 200)" },
-      },
-      run: async (args) => ({ id: String(args.id), log: tail(work, String(args.id), Number(args.lines ?? 200)) }),
-    },
-    {
-      name: "lab_stop",
-      description: "Stop a run and everything it started.",
-      input: { id: { type: "string", description: "the run's id" } },
-      run: async (args) => stop(work, String(args.id)) ?? { found: false, id: String(args.id) },
-    },
-  ];
-}
-
-registerModuleTools("lab", (env) => getLabTools(env));

modules/lab/tools/runs.ts

@@ -1,171 +0,0 @@
-// A lab run: fresh checkouts of the named branches, side by side, then the lab's suite on the named
-// beds (novox/hq ADR 0172).
-//
-// **A run is a detached script with its own process group**, so it outlives the tool call that started
-// it and `stop` ends everything it started. It writes what it is doing to a status file beside its log,
-// and that file is the whole of what the tools read back: a runtime that restarts mid-run still answers
-// for it, and says it was lost rather than pretending it is still going.
-
-import { spawn } from "node:child_process";
-import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from "node:fs";
-import { join } from "node:path";
-
-/** The repositories a lab run checks out, side by side, as the lab expects its siblings. */
-export const REPOSITORIES = ["mesh-lab", "mesh-controller", "mesh-host", "mesh-catalog", "mesh-tools", "mesh-sdk"];
-
-export interface RunStatus {
-  id: string;
-  state: "checking-out" | "building" | "running" | "passed" | "failed" | "stopped" | "lost";
-  started: string;
-  ended?: string;
-  tests: string[];
-  refs: Record<string, string>;
-  commits?: Record<string, string>;
-  exit?: number;
-  pid?: number;
-}
-
-export function runDir(work: string, id: string): string {
-  return join(work, id);
-}
-
-function statusPath(work: string, id: string): string {
-  return join(runDir(work, id), "status.json");
-}
-
-export function readStatus(work: string, id: string): RunStatus | undefined {
-  try {
-    const s = JSON.parse(readFileSync(statusPath(work, id), "utf8")) as RunStatus;
-    // A run whose process is gone while its status still says it is going was lost — the runtime or
-    // the machine restarted under it. Said, rather than left reading as running for ever.
-    if (!["passed", "failed", "stopped", "lost"].includes(s.state) && s.pid && !alive(s.pid)) {
-      s.state = "lost";
-    }
-    return s;
-  } catch {
-    return undefined;
-  }
-}
-
-function alive(pid: number): boolean {
-  try {
-    process.kill(pid, 0);
-    return true;
-  } catch {
-    return false;
-  }
-}
-
-export function listRuns(work: string): RunStatus[] {
-  if (!existsSync(work)) return [];
-  return readdirSync(work)
-    .filter((d) => d.startsWith("run-"))
-    .map((id) => readStatus(work, id))
-    .filter((s): s is RunStatus => !!s)
-    .sort((a, b) => b.started.localeCompare(a.started));
-}
-
-/** The run still going, if any: one at a time, because two would contend for the same machine. */
-export function running(work: string): RunStatus | undefined {
-  return listRuns(work).find((s) => !["passed", "failed", "stopped", "lost"].includes(s.state));
-}
-
-const shellQuote = (s: string) => `'${s.replace(/'/g, `'\\''`)}'`;
-
-/**
- * The script one run executes. Every step writes its state first, so a run that dies says where.
- *
- * The environment is the one the lab's README describes for a run against sibling checkouts, pointed
- * at this run's own tree, so what is built and claimed is exactly what was checked out.
- */
-export function script(work: string, id: string, forge: string, tests: string[], refs: Record<string, string>): string {
-  const dir = runDir(work, id);
-  const setState = (state: string) =>
-    `node -e ${shellQuote(
-      `const f=${JSON.stringify(join(dir, "status.json"))};const s=JSON.parse(require("fs").readFileSync(f,"utf8"));s.state=${JSON.stringify(state)};require("fs").writeFileSync(f,JSON.stringify(s,null,2))`,
-    )}`;
-  const clones = REPOSITORIES.map((repo) => {
-    const ref = refs[repo] ?? "main";
-    return [
-      `git clone --quiet --depth 50 --branch ${shellQuote(ref)} ${shellQuote(`${forge}/novox/${repo}.git`)} ${shellQuote(join(dir, repo))}`,
-      `echo "${repo} $(git -C ${shellQuote(join(dir, repo))} rev-parse HEAD)" >> ${shellQuote(join(dir, "commits.txt"))}`,
-    ].join("\n");
-  }).join("\n");
-  const bin = join(dir, "bin");
-  return `set -euo pipefail
-cd ${shellQuote(dir)}
-${setState("checking-out")}
-${clones}
-node -e ${shellQuote(
-    `const fs=require("fs");const f=${JSON.stringify(join(dir, "status.json"))};const s=JSON.parse(fs.readFileSync(f,"utf8"));s.commits=Object.fromEntries(fs.readFileSync(${JSON.stringify(join(dir, "commits.txt"))},"utf8").trim().split("\\n").map(l=>l.split(" ")));fs.writeFileSync(f,JSON.stringify(s,null,2))`,
-  )}
-${setState("building")}
-for repo in mesh-sdk mesh-tools mesh-lab; do (cd ${shellQuote(dir)}/$repo && npm ci --no-audit --no-fund --loglevel=error); done
-(cd ${shellQuote(dir)}/mesh-sdk && npm run build --if-present)
-(cd ${shellQuote(dir)}/mesh-tools && npm run build --if-present)
-mkdir -p ${shellQuote(bin)}
-for p in postgres-provisioner objectstore-provisioner route-proxy; do
-  (cd ${shellQuote(dir)}/mesh-controller && CGO_ENABLED=0 go build -o ${shellQuote(bin)}/$p ./examples/$p)
-done
-export MESH_LAB_HOST_BINARY=${shellQuote(join(dir, "mesh-host", "mesh-host"))}
-export MESH_LAB_BUNDLE=${shellQuote(join(dir, "mesh-host", "examples", "foundation-first-node-nats.lock"))}
-export MESH_LAB_MODULES=${shellQuote(join(dir, "mesh-controller", "examples", "modules"))}
-export MESH_LAB_BUILDER=${shellQuote(join(dir, "mesh-controller", "build", "mesh-builder"))}
-export MESH_LAB_BOOTSTRAP_BINARY=${shellQuote(join(dir, "mesh-host", "mesh-bootstrap"))}
-export MESH_LAB_CATALOG=${shellQuote(join(dir, "mesh-catalog", "modules"))}
-export MESH_LAB_PROVISIONER=${shellQuote(join(bin, "postgres-provisioner"))}
-export MESH_LAB_OBJECTSTORE_PROVISIONER=${shellQuote(join(bin, "objectstore-provisioner"))}
-export MESH_LAB_ROUTE_PROXY=${shellQuote(join(bin, "route-proxy"))}
-${setState("running")}
-cd ${shellQuote(join(dir, "mesh-lab"))}
-node --experimental-strip-types src/cli.ts suite ${tests.map(shellQuote).join(" ")}
-`;
-}
-
-/** start begins a run and returns at once with its status. */
-export function start(work: string, forge: string, tests: string[], refs: Record<string, string>): RunStatus {
-  const id = `run-${new Date().toISOString().replace(/[:.]/g, "-")}`;
-  const dir = runDir(work, id);
-  mkdirSync(dir, { recursive: true });
-  const status: RunStatus = { id, state: "checking-out", started: new Date().toISOString(), tests, refs };
-  writeFileSync(statusPath(work, id), JSON.stringify(status, null, 2));
-  writeFileSync(join(dir, "run.sh"), script(work, id, forge, tests, refs), { mode: 0o700 });
-
-  // The wrapper records how the run ended, then removes the checkouts and keeps the log and status: a
-  // run's tree is its own, and the next run starts from fresh ones (novox/hq ADR 0172).
-  const wrapper = `bash ${shellQuote(join(dir, "run.sh"))} > ${shellQuote(join(dir, "run.log"))} 2>&1; code=$?
-node -e ${shellQuote(
-    `const f=${JSON.stringify(statusPath(work, id))};const s=JSON.parse(require("fs").readFileSync(f,"utf8"));if(s.state!=="stopped"){s.state=process.argv[1]==="0"?"passed":"failed"};s.exit=Number(process.argv[1]);s.ended=new Date().toISOString();require("fs").writeFileSync(f,JSON.stringify(s,null,2))`,
-  )} "$code"
-cd ${shellQuote(dir)} && rm -rf ${REPOSITORIES.map(shellQuote).join(" ")} bin`;
-  const child = spawn("bash", ["-c", wrapper], { detached: true, stdio: "ignore" });
-  child.unref();
-  status.pid = child.pid;
-  writeFileSync(statusPath(work, id), JSON.stringify(status, null, 2));
-  return status;
-}
-
-/** stop ends a run and everything it started, by its process group. */
-export function stop(work: string, id: string): RunStatus | undefined {
-  const s = readStatus(work, id);
-  if (!s || !s.pid) return s;
-  if (["passed", "failed", "stopped", "lost"].includes(s.state)) return s;
-  s.state = "stopped";
-  writeFileSync(statusPath(work, id), JSON.stringify(s, null, 2));
-  try {
-    process.kill(-s.pid, "SIGTERM");
-  } catch {
-    // Already gone between the read and the kill.
-  }
-  return s;
-}
-
-/** tail is the last lines of a run's log. */
-export function tail(work: string, id: string, lines: number): string {
-  try {
-    const all = readFileSync(join(runDir(work, id), "run.log"), "utf8").split("\n");
-    return all.slice(-Math.max(1, lines)).join("\n");
-  } catch {
-    return "";
-  }
-}

modules/letta/module.json

@@ -27,7 +27,7 @@
   "own-secrets": {
     "server-password": "${dir:state}/server-password.secret",
     "openai-api-key": "${dir:state}/openai-api-key.secret",
-    "broker": "${dir:mesh-state}/broker"
+    "broker": "/var/lib/mesh/letta/broker"
   },
   "listens": [
     {
@@ -42,8 +42,8 @@
     {
       "id": "mesh-state",
       "type": "directory",
-      "mode": "0700",
-      "place": "mesh"
+      "path": "/var/lib/mesh/letta",
+      "mode": "0700"
     },
     {
       "id": "state",
@@ -80,7 +80,7 @@
     {
       "id": "runtime-config",
       "type": "file",
-      "path": "${dir:mesh-state}/config.json",
+      "path": "/var/lib/mesh/letta/config.json",
       "mode": "0600",
       "content": "{\n  \"password\": \"${secret:server-password}\"\n}\n",
       "merge": "json"
@@ -91,8 +91,8 @@
       "name": "mesh-letta",
       "network": "letta",
       "volumes": [
-        "${dir:mesh-state}/broker:/run/secrets/broker:ro",
-        "${dir:mesh-state}/config.json:/run/config/config.json:ro"
+        "/var/lib/mesh/letta/broker:/run/secrets/broker:ro",
+        "/var/lib/mesh/letta/config.json:/run/config/config.json:ro"
       ],
       "env": {
         "MESH_BROKER_FILE": "/run/secrets/broker",

modules/lidarr/Dockerfile

@@ -0,0 +1,24 @@
+# lidarr's runtime: the tool runtime, carrying this module's compiled code.
+#
+# **Built from this module's own directory and nothing else.** The sdk and the tool runtime are in
+# the base images, published like any other artifact — which is what makes this buildable by the
+# mesh from a repository and a path (novox/hq ADR 0069) rather than only on a workstation that
+# happens to have the siblings.
+#
+# Two bases, named rather than pinned (novox/hq issue 044): the image this is COMPILED in and the
+# image it RUNS in — the second must not carry a compiler. Declared in module.json's `build.on`.
+ARG BUILD_BASE
+ARG RUNTIME_BASE
+
+FROM ${BUILD_BASE} AS build
+WORKDIR /app/modules/lidarr
+COPY . .
+RUN node /app/node_modules/typescript/bin/tsc client.ts index.ts tools/index.ts \
+      --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist
+
+FROM ${RUNTIME_BASE}
+COPY --from=build /app/modules/lidarr/dist /app/modules/lidarr/dist
+# Every serve-time entrypoint, loaded by the runtime in serve mode: tools and events serve, and a
+# provider's provisioner runs its reconcile loop in the same process, with the broker connected —
+# the convention novox/hq issues 060/061 settled.
+ENV MESH_TOOL_MODULES=/app/modules/lidarr/dist/index.js,/app/modules/lidarr/dist/tools/index.js

modules/lidarr/client.ts

@@ -0,0 +1,144 @@
+// The Lidarr API client — lidarr's own code, living in the module (novox/hq ADR 0039). Ported from
+// the shared hal `arr` client, but self-contained: in nox each Servarr app owns its own copy, so a
+// change to Lidarr's API rebuilds only lidarr and nothing else. Both this module's tools and its
+// events entrypoint import it, and nothing outside lidarr does.
+
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+
+// Lidarr speaks the v1 API (Radarr/Sonarr are v3); its content is the "artist".
+const API_VERSION = "v1";
+const CONTENT_ENDPOINT = "artist";
+const APP_NAME = "Lidarr";
+
+export interface LidarrQueueItem {
+  /** The queue record id — stable while the item is in the queue, so events can diff on it. */
+  id: number;
+  title: string;
+  status: string;
+  size: string;
+  sizeleft: string;
+  timeleft?: string;
+}
+
+export interface LidarrCalendarItem {
+  title: string;
+  date: string;
+  overview?: string;
+}
+
+export interface LidarrContentItem {
+  title: string;
+  status?: string;
+  monitored: boolean;
+}
+
+export class LidarrClient {
+  readonly baseUrl: string;
+
+  constructor(
+    url: string,
+    private readonly apiKey: string,
+  ) {
+    this.baseUrl = url.replace(/\/$/, "");
+  }
+
+  /**
+   * Build from the module's resolved environment. The URL defaults to the server on this node (the
+   * runtime shares its network), and the API key is read from MESH_LIDARR_API_KEY or, failing that,
+   * discovered from the server's own config.xml under MESH_LIDARR_CONFIG_DIR — the same file Lidarr
+   * writes it to, so a running server needs nothing configured by hand. Throws when no key can be
+   * found, so the tools/events simply do not load (the harness treats the throw as "exposes
+   * nothing").
+   */
+  static fromEnv(env: NodeJS.ProcessEnv = process.env): LidarrClient {
+    const url = env.MESH_LIDARR_URL ?? `http://127.0.0.1:${env.MESH_LIDARR_PORT ?? "8686"}`;
+    const configDir = env.MESH_LIDARR_CONFIG_DIR ?? "/config";
+    const apiKey = env.MESH_LIDARR_API_KEY ?? LidarrClient.detectApiKey(configDir);
+    if (!apiKey) {
+      throw new Error("Lidarr not configured — set MESH_LIDARR_API_KEY or make the config dir readable");
+    }
+    return new LidarrClient(url, apiKey);
+  }
+
+  /** Discover the API key from the server's config.xml, falling back to null. Every Servarr app
+   *  writes <ApiKey> into config.xml at the root of its config directory. */
+  static detectApiKey(configDir: string): string | null {
+    const config = join(configDir, "config.xml");
+    if (existsSync(config)) {
+      const match = readFileSync(config, "utf8").match(/<ApiKey>([^<]+)<\/ApiKey>/);
+      if (match) return match[1];
+    }
+    return null;
+  }
+
+  private async get(endpoint: string, params?: Record<string, string>): Promise<unknown> {
+    const url = new URL(`${this.baseUrl}/api/${API_VERSION}/${endpoint}`);
+    if (params) {
+      for (const [k, v] of Object.entries(params)) url.searchParams.set(k, v);
+    }
+    const res = await fetch(url.toString(), { headers: { "X-Api-Key": this.apiKey } });
+    if (!res.ok) throw new Error(`${APP_NAME} API /${endpoint}: ${res.status} ${await res.text()}`);
+    return res.json();
+  }
+
+  async getStatus(): Promise<{ appName: string; version: string }> {
+    const data = (await this.get("system/status")) as { appName?: string; version?: string };
+    return { appName: data.appName || APP_NAME, version: data.version ?? "unknown" };
+  }
+
+  async getContent(limit?: number): Promise<LidarrContentItem[]> {
+    const data = await this.get(CONTENT_ENDPOINT);
+    const items: any[] = Array.isArray(data) ? data : ((data as any)?.records ?? []);
+    const mapped = items.map((item) => ({
+      // Lidarr's content is an artist; its display name is artistName, not title.
+      title: item.artistName ?? item.title ?? "Unknown",
+      status: item.status,
+      monitored: item.monitored ?? true,
+    }));
+    return limit ? mapped.slice(0, limit) : mapped;
+  }
+
+  /** Library search is a filter over existing content, not an indexer lookup — same as hal's. */
+  async searchContent(term: string): Promise<LidarrContentItem[]> {
+    const all = await this.getContent();
+    const lower = term.toLowerCase();
+    return all.filter((item) => item.title.toLowerCase().includes(lower));
+  }
+
+  async getQueue(): Promise<{ totalRecords: number; items: LidarrQueueItem[] }> {
+    const data = (await this.get("queue", { pageSize: "50" })) as { totalRecords?: number; records?: any[] };
+    const records = data.records ?? [];
+    return {
+      totalRecords: data.totalRecords ?? records.length,
+      items: records.map((r) => ({
+        id: r.id,
+        title: r.title ?? r.artist?.artistName ?? r.album?.title ?? "Unknown",
+        status: r.status ?? "unknown",
+        size: formatBytes(r.size ?? 0),
+        sizeleft: formatBytes(r.sizeleft ?? 0),
+        timeleft: r.timeleft,
+      })),
+    };
+  }
+
+  async getCalendar(days = 7): Promise<LidarrCalendarItem[]> {
+    const start = new Date().toISOString().split("T")[0];
+    const end = new Date(Date.now() + days * 86400000).toISOString().split("T")[0];
+    const data = await this.get("calendar", { start, end });
+    const items: any[] = Array.isArray(data) ? data : [];
+    return items.map((item) => ({
+      // A Lidarr calendar entry is an album release.
+      title: item.title ?? item.artist?.artistName ?? "Unknown",
+      date: item.releaseDate ?? "",
+      overview: item.overview?.slice(0, 150),
+    }));
+  }
+}
+
+function formatBytes(bytes: number): string {
+  if (bytes === 0) return "0 B";
+  const units = ["B", "KB", "MB", "GB", "TB"];
+  const i = Math.floor(Math.log(bytes) / Math.log(1024));
+  return `${(bytes / Math.pow(1024, i)).toFixed(1)} ${units[i]}`;
+}

modules/lidarr/index.ts

@@ -0,0 +1,69 @@
+// lidarr's events. The tool runtime imports this once the broker is bound. It watches the download
+// queue and turns its comings and goings into mesh events.
+//
+// Emits (novox/hq ADR 0041/0042):
+//   module.lidarr.album.grabbed        — a release entered the queue (Lidarr grabbed it)
+//   module.lidarr.download.completed   — a release left the queue, imported. The download.completed
+//                                        routing key matches what a media consumer subscribes to
+//                                        (module.*.download.completed) to rescan its library.
+// Consumes: none.
+//
+// The queue is polled and diffed, primed silently on the first look (like plex's index.ts) so a
+// restart mid-download does not re-announce everything already in flight as freshly grabbed.
+
+import { emit } from "@novox/mesh-sdk/events";
+import { LidarrClient, type LidarrQueueItem } from "./client.js";
+
+// Building the client throws when Lidarr has no URL/key yet. Like the tools (see tools/index.ts),
+// the events entrypoint must not crash the runtime for that — it stays idle until configured.
+function buildClient(): LidarrClient | null {
+  try {
+    return LidarrClient.fromEnv();
+  } catch {
+    return null;
+  }
+}
+
+const lidarr = buildClient();
+
+// Lidarr removes an item from the queue once it has been imported; a "warning"/"failed" status is
+// how a stuck or broken grab shows itself, so we do not call those a completion when they vanish.
+const FAILED_STATUSES = new Set(["failed", "warning"]);
+
+const inQueue = new Map<number, LidarrQueueItem>();
+let primed = false;
+
+async function pollQueue(lidarr: LidarrClient): Promise<void> {
+  const { items } = await lidarr.getQueue();
+  const now = new Map(items.map((i) => [i.id, i]));
+
+  if (primed) {
+    // Entered the queue since last look — Lidarr grabbed a release.
+    for (const [id, item] of now) {
+      if (!inQueue.has(id)) await emit("album.grabbed", { title: item.title, status: item.status });
+    }
+    // Left the queue — imported and done, unless it was last seen failing.
+    for (const [id, item] of inQueue) {
+      if (!now.has(id) && !FAILED_STATUSES.has(item.status)) {
+        await emit("download.completed", { title: item.title });
+      }
+    }
+  }
+
+  inQueue.clear();
+  for (const [id, item] of now) inQueue.set(id, item);
+  primed = true;
+}
+
+const tick = (fn: () => Promise<void>, everyMs: number): void => {
+  const run = (): void => void fn().catch((err) => console.error(`[lidarr] ${err}`));
+  setInterval(run, everyMs);
+  run();
+};
+
+if (lidarr) {
+  tick(() => pollQueue(lidarr), 30_000);
+  console.log("[lidarr] watching the download queue, emitting grabs and completions");
+} else {
+  console.log("[lidarr] not configured — events idle until an API key is available");
+}

modules/lidarr/module.json

@@ -0,0 +1,117 @@
+{
+  "module": "lidarr",
+  "version": "1",
+  "capabilities": [
+    "container-runtime"
+  ],
+  "emits": [
+    "album.grabbed",
+    "download.completed"
+  ],
+  "consumes": [],
+  "own-secrets": {
+    "broker": "/var/lib/mesh/lidarr/broker"
+  },
+  "listens": [
+    {
+      "name": "web",
+      "port": 8686,
+      "protocol": "tcp",
+      "from": "mesh",
+      "why": "managing music"
+    }
+  ],
+  "accesses": [
+    {
+      "path": "/services/media/music",
+      "mode": "read-write"
+    },
+    {
+      "path": "/services/media/downloads",
+      "mode": "read-write"
+    }
+  ],
+  "resources": [
+    {
+      "id": "mesh-state",
+      "type": "directory",
+      "path": "/var/lib/mesh/lidarr",
+      "mode": "0700"
+    },
+    {
+      "id": "config",
+      "type": "directory",
+      "path": "/services/lidarr/config",
+      "mode": "0700",
+      "owner": "1000:1000"
+    },
+    {
+      "id": "server",
+      "type": "container",
+      "name": "lidarr",
+      "image": "lscr.io/linuxserver/lidarr@sha256:6b38dd330b0c653351c2e23c8b962ea51c95683dd7acace9d106c922baf85f75",
+      "env": {
+        "PUID": "1000",
+        "PGID": "1000",
+        "TZ": "Etc/UTC"
+      },
+      "ports": [
+        "8686"
+      ],
+      "volumes": [
+        "/services/lidarr/config:/config",
+        "/services/media/music:/music",
+        "/services/media/downloads:/downloads"
+      ]
+    },
+    {
+      "id": "runtime",
+      "type": "container",
+      "name": "mesh-lidarr",
+      "network": "host",
+      "volumes": [
+        "/var/lib/mesh/lidarr/broker:/run/secrets/broker:ro",
+        "/services/lidarr/config:/var/lib/lidarr/config:ro"
+      ],
+      "env": {
+        "MESH_BROKER_FILE": "/run/secrets/broker",
+        "MESH_LIDARR_URL": "http://127.0.0.1:8686",
+        "MESH_LIDARR_CONFIG_DIR": "/var/lib/lidarr/config"
+      },
+      "artifact": "runtime"
+    }
+  ],
+  "requires": [
+    "route"
+  ],
+  "contributes": {
+    "route": {
+      "label": "lidarr",
+      "endpoint": "web"
+    }
+  },
+  "binds": {
+    "route": "/var/lib/mesh/lidarr/route.json"
+  },
+  "build": {
+    "on": [
+      {
+        "arg": "BUILD_BASE",
+        "module": "mesh-tools",
+        "artifact": "build"
+      },
+      {
+        "arg": "RUNTIME_BASE",
+        "module": "mesh-tools",
+        "artifact": "runtime"
+      }
+    ],
+    "artifacts": [
+      {
+        "name": "runtime",
+        "kind": "image",
+        "from": "Dockerfile"
+      }
+    ]
+  }
+}

modules/lidarr/package.json

@@ -0,0 +1,14 @@
+{
+  "name": "@novox/module-lidarr",
+  "version": "0.1.0",
+  "description": "lidarr — music management. Its API client, tools and events live here (novox/hq ADR 0039).",
+  "type": "module",
+  "private": true,
+  "dependencies": {
+    "@novox/mesh-sdk": "^0.1.0"
+  },
+  "devDependencies": {
+    "@types/node": "^22.0.0",
+    "typescript": "^5.6.0"
+  }
+}

modules/lidarr/tools/index.ts

@@ -0,0 +1,78 @@
+// lidarr's tools — ported from the shared hal sdk (novox/hq ADR 0039), importing lidarr's own
+// client. They return structured data (not pre-formatted text as hal did); the mesh serves them
+// through the sdk's tool harness.
+
+import { registerModuleTools, type ToolDefinition } from "@novox/mesh-sdk/tools";
+import { LidarrClient } from "../client.js";
+
+export function getLidarrTools(lidarr: LidarrClient): ToolDefinition[] {
+  return [
+    {
+      name: "lidarr_status",
+      description: "Lidarr status overview: version, artist count, monitored count, queue size.",
+      input: {},
+      run: async () => {
+        const [status, content, queue] = await Promise.all([
+          lidarr.getStatus(),
+          lidarr.getContent(),
+          lidarr.getQueue(),
+        ]);
+        return {
+          app: status.appName,
+          version: status.version,
+          artists: content.length,
+          monitored: content.filter((c) => c.monitored).length,
+          queue: queue.totalRecords,
+        };
+      },
+    },
+    {
+      name: "lidarr_library",
+      description: "List artists from the Lidarr library.",
+      input: { limit: { type: "number", description: "max items to return (default 50)" } },
+      run: async (args) => {
+        const items = await lidarr.getContent(args.limit ? Number(args.limit) : 50);
+        return { count: items.length, artists: items };
+      },
+    },
+    {
+      name: "lidarr_search",
+      description: "Search the Lidarr library for artists by name (filters existing content, not indexers).",
+      input: { query: { type: "string", description: "the search term" } },
+      run: async (args) => {
+        const query = String(args.query);
+        return { query, results: await lidarr.searchContent(query) };
+      },
+    },
+    {
+      name: "lidarr_queue",
+      description: "Show the Lidarr download queue — what is downloading and how far along.",
+      input: {},
+      run: async () => {
+        const queue = await lidarr.getQueue();
+        return { count: queue.totalRecords, items: queue.items };
+      },
+    },
+    {
+      name: "lidarr_calendar",
+      description: "Upcoming album releases from the Lidarr calendar.",
+      input: { days: { type: "number", description: "how many days to look ahead (default 7)" } },
+      run: async (args) => {
+        const days = args.days ? Number(args.days) : 7;
+        const items = await lidarr.getCalendar(days);
+        items.sort((a, b) => a.date.localeCompare(b.date));
+        return { days, count: items.length, items };
+      },
+    },
+  ];
+}
+
+// The tools exist only when Lidarr is configured; without a URL and key, lidarr contributes none
+// rather than failing the whole runtime.
+registerModuleTools("lidarr", (env) => {
+  try {
+    return getLidarrTools(LidarrClient.fromEnv(env));
+  } catch {
+    return [];
+  }
+});

modules/lidarr/tsconfig.json

@@ -0,0 +1,12 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "NodeNext",
+    "moduleResolution": "NodeNext",
+    "strict": true,
+    "esModuleInterop": true,
+    "skipLibCheck": true,
+    "noEmit": true
+  },
+  "include": ["client.ts", "index.ts", "tools/index.ts"]
+}

modules/local-model-consumer/module.json

@@ -6,24 +6,25 @@
     "model-access"
   ],
   "binds": {
-    "model-access": "${dir:state}/model.json"
+    "model-access": "/var/lib/local-model-consumer/model.json"
   },
   "resources": [
     {
       "id": "state",
       "type": "directory",
-      "mode": "0700",
-      "place": "."
+      "path": "/var/lib/local-model-consumer",
+      "mode": "0700"
     },
     {
       "id": "config",
       "type": "directory",
+      "path": "/var/lib/local-model-consumer/config",
       "mode": "0700"
     },
     {
       "id": "openai-env",
       "type": "file",
-      "path": "${dir:config}/openai.env",
+      "path": "/var/lib/local-model-consumer/config/openai.env",
       "mode": "0600",
       "content": "OPENAI_BASE_URL=http://${bound:model-access:at}:${bound:model-access:port}/v1\nOPENAI_MODEL=${bound:model-access:model}\nOPENAI_API_KEY=local\n"
     }

modules/mailu/module.json

@@ -138,14 +138,14 @@
     }
   ],
   "own-secrets": {
-    "broker": "${dir:mesh-state}/broker"
+    "broker": "/var/lib/mesh/mailu/broker"
   },
   "resources": [
     {
       "id": "mesh-state",
       "type": "directory",
-      "mode": "0700",
-      "place": "mesh"
+      "path": "/var/lib/mesh/mailu",
+      "mode": "0700"
     },
     {
       "id": "state",
@@ -467,7 +467,7 @@
     {
       "id": "runtime-config",
       "type": "file",
-      "path": "${dir:mesh-state}/config.json",
+      "path": "/var/lib/mesh/mailu/config.json",
       "mode": "0600",
       "content": "{}\n",
       "merge": "json"
@@ -478,10 +478,10 @@
       "name": "mesh-mailu",
       "network": "mailu",
       "volumes": [
-        "${dir:mesh-state}/broker:/run/secrets/broker:ro",
+        "/var/lib/mesh/mailu/broker:/run/secrets/broker:ro",
         "${dir:state}/api-token.secret:/run/secrets/api-token:ro",
         "${dir:grants}:${dir:grants}:ro",
-        "${dir:mesh-state}/config.json:/run/config/config.json:ro",
+        "/var/lib/mesh/mailu/config.json:/run/config/config.json:ro",
         "/var/run/docker.sock:/var/run/docker.sock"
       ],
       "env": {
@@ -552,8 +552,7 @@
   ],
   "serves": {
     "smtp": {
-      "port": 587,
-      "domain": "${setting:domain}"
+      "port": 587
     }
   },
   "receives": {

modules/marrytts/module.json

@@ -17,8 +17,8 @@
     {
       "id": "mesh-state",
       "type": "directory",
-      "mode": "0700",
-      "place": "mesh"
+      "path": "/var/lib/mesh/marrytts",
+      "mode": "0700"
     },
     {
       "id": "server",

modules/mesh-catalog/module.json

@@ -20,13 +20,13 @@
     }
   },
   "binds": {
-    "postgres-database": "${dir:state}/database.json"
+    "postgres-database": "/var/lib/mesh-catalog/database.json"
   },
   "secrets": {
-    "postgres-database": "${dir:state}/database.secret"
+    "postgres-database": "/var/lib/mesh-catalog/database.secret"
   },
   "own-secrets": {
-    "broker": "${dir:mesh-state}/broker"
+    "broker": "/var/lib/mesh/mesh-catalog/broker"
   },
   "consumes": [
     "mesh-build-machine.built",
@@ -43,19 +43,19 @@
     {
       "id": "mesh-state",
       "type": "directory",
-      "mode": "0700",
-      "place": "mesh"
+      "path": "/var/lib/mesh/mesh-catalog",
+      "mode": "0700"
     },
     {
       "id": "state",
       "type": "directory",
-      "mode": "0700",
-      "place": "."
+      "path": "/var/lib/mesh-catalog",
+      "mode": "0700"
     },
     {
       "id": "database-url",
       "type": "file",
-      "path": "${dir:state}/database.url",
+      "path": "/var/lib/mesh-catalog/database.url",
       "mode": "0600",
       "content": "postgresql://${bound:postgres-database:as}:${secret:postgres-database}@${bound:postgres-database:at}:${bound:postgres-database:port}/${bound:postgres-database:as}\n"
     },
@@ -65,9 +65,9 @@
       "name": "mesh-catalog",
       "network": "host",
       "volumes": [
-        "${dir:mesh-state}/broker:/run/secrets/broker:ro",
-        "${dir:state}:/run/state",
-        "${dir:state}/database.url:/run/secrets/database-url:ro"
+        "/var/lib/mesh/mesh-catalog/broker:/run/secrets/broker:ro",
+        "/var/lib/mesh-catalog:/run/state",
+        "/var/lib/mesh-catalog/database.url:/run/secrets/database-url:ro"
       ],
       "env": {
         "MESH_BROKER_FILE": "/run/secrets/broker",

modules/mesh-console/module.json

@@ -9,7 +9,7 @@
     "*"
   ],
   "own-secrets": {
-    "broker": "${dir:mesh-state}/broker"
+    "broker": "/var/lib/mesh/mesh-console/broker"
   },
   "listens": [
     {
@@ -24,8 +24,8 @@
     {
       "id": "mesh-state",
       "type": "directory",
-      "mode": "0700",
-      "place": "mesh"
+      "path": "/var/lib/mesh/mesh-console",
+      "mode": "0700"
     },
     {
       "id": "server",
@@ -40,7 +40,7 @@
         "MESH_CONSOLE_LISTEN": "127.0.0.1:${port:4270}"
       },
       "volumes": [
-        "${dir:mesh-state}/broker:/run/secrets/broker:ro"
+        "/var/lib/mesh/mesh-console/broker:/run/secrets/broker:ro"
       ],
       "artifact": "runtime"
     }

modules/mesh-vault/index.ts

@@ -1,9 +1,9 @@
 // mesh-vault's events entrypoint, loaded by the per-node tool host (the provisioner runs in the same
 // process — ADR 0052). The lifecycle events are EMITTED from the provisioner, where custody
 // actually changes (novox/hq ADR 0041/0042):
-//   mesh-vault.provisioned    — a consumer was granted a secret
-//   mesh-vault.rotated        — that consumer's value changed (`rotate secret`)
-//   mesh-vault.deprovisioned  — the consumer went away and its secret was withdrawn
+//   module.mesh-vault.secret.provisioned    — a consumer was granted a secret
+//   module.mesh-vault.secret.rotated        — that consumer's value changed (`rotate secret`)
+//   module.mesh-vault.secret.deprovisioned  — the consumer went away and its secret was withdrawn
 // Here the vault reacts to them, keeping a lightweight audit line of who holds what and when it
 // moved — the audit an owner of secrets is best placed to log. Fingerprints, never values.
 
@@ -16,15 +16,15 @@ interface SecretEvent {
   rotations?: number;
 }
 
-await on<SecretEvent>("provisioned", async (e) => {
+await on<SecretEvent>("secret.provisioned", async (e) => {
   console.log(`[mesh-vault] secret provisioned for ${e.body.as} on ${e.body.consumer} (${e.body.fingerprint})`);
 });
 
-await on<SecretEvent>("rotated", async (e) => {
+await on<SecretEvent>("secret.rotated", async (e) => {
   console.log(`[mesh-vault] secret rotated for ${e.body.as} — rotation ${e.body.rotations} (${e.body.fingerprint})`);
 });
 
-await on<SecretEvent>("deprovisioned", async (e) => {
+await on<SecretEvent>("secret.deprovisioned", async (e) => {
   console.log(`[mesh-vault] secret withdrawn from ${e.body.as}`);
 });
 

modules/mesh-vault/module.json

@@ -11,51 +11,54 @@
     "container-runtime"
   ],
   "emits": [
-    "provisioned",
-    "rotated",
-    "deprovisioned"
+    "secret.provisioned",
+    "secret.rotated",
+    "secret.deprovisioned"
   ],
   "consumes": [
-    "mesh-vault.provisioned",
-    "mesh-vault.rotated",
-    "mesh-vault.deprovisioned"
+    "mesh-vault.secret.provisioned",
+    "mesh-vault.secret.rotated",
+    "mesh-vault.secret.deprovisioned"
   ],
   "receives": {
-    "secret": "${dir:grants}/mesh.json"
+    "secret": "/var/lib/mesh-vault/grants/mesh.json"
   },
   "grants": {
-    "secret": "${dir:grants}"
+    "secret": "/var/lib/mesh-vault/grants"
   },
   "keeps": "/var/lib/mesh-vault/root",
   "own-secrets": {
-    "broker": "${dir:mesh-state}/broker"
+    "broker": "/var/lib/mesh/mesh-vault/broker"
   },
   "resources": [
     {
       "id": "mesh-state",
       "type": "directory",
-      "mode": "0700",
-      "place": "mesh"
+      "path": "/var/lib/mesh/mesh-vault",
+      "mode": "0700"
     },
     {
       "id": "state",
       "type": "directory",
-      "mode": "0700",
-      "place": "."
+      "path": "/var/lib/mesh-vault",
+      "mode": "0700"
     },
     {
       "id": "grants",
       "type": "directory",
+      "path": "/var/lib/mesh-vault/grants",
       "mode": "0700"
     },
     {
       "id": "ledger",
       "type": "directory",
+      "path": "/var/lib/mesh-vault/ledger",
       "mode": "0700"
     },
     {
       "id": "root",
       "type": "directory",
+      "path": "/var/lib/mesh-vault/root",
       "mode": "0700"
     },
     {
@@ -64,16 +67,16 @@
       "name": "mesh-vault",
       "network": "host",
       "volumes": [
-        "${dir:mesh-state}/broker:/run/secrets/broker:ro",
-        "${dir:grants}:${dir:grants}:ro",
-        "${dir:ledger}:${dir:ledger}",
-        "${dir:root}:${dir:root}:ro"
+        "/var/lib/mesh/mesh-vault/broker:/run/secrets/broker:ro",
+        "/var/lib/mesh-vault/grants:/var/lib/mesh-vault/grants:ro",
+        "/var/lib/mesh-vault/ledger:/var/lib/mesh-vault/ledger",
+        "/var/lib/mesh-vault/root:/var/lib/mesh-vault/root:ro"
       ],
       "env": {
         "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_RECEIVES": "${dir:grants}/mesh.json",
-        "MESH_VAULT_LEDGER": "${dir:ledger}",
-        "MESH_VAULT_ROOT": "${dir:root}"
+        "MESH_RECEIVES": "/var/lib/mesh-vault/grants/mesh.json",
+        "MESH_VAULT_LEDGER": "/var/lib/mesh-vault/ledger",
+        "MESH_VAULT_ROOT": "/var/lib/mesh-vault/root"
       },
       "artifact": "runtime"
     }
@@ -98,11 +101,5 @@
         "from": "Dockerfile"
       }
     ]
-  },
-  "claims": [
-    {
-      "name": "mesh-vault",
-      "scope": "mesh"
-    }
-  ]
+  }
 }

modules/mesh-vault/provisioner/index.ts

@@ -43,6 +43,6 @@ runProvisioner("secret", {
   async remove(p: { as: string }): Promise<void> {
     if (!ledger.withdraw(p.as)) return;
     console.log(`[mesh-vault] withdrawn: ${p.as}`);
-    await announce("deprovisioned", { as: p.as });
+    await announce("secret.deprovisioned", { as: p.as });
   },
 });

modules/minio/module.json

@@ -53,37 +53,38 @@
     }
   },
   "receives": {
-    "s3-bucket": "${dir:grants}/mesh.json"
+    "s3-bucket": "/var/lib/minio/grants/mesh.json"
   },
   "grants": {
-    "s3-bucket": "${dir:grants}"
+    "s3-bucket": "/var/lib/minio/grants"
   },
   "own-secrets": {
-    "root": "${dir:state}/root.secret",
-    "broker": "${dir:mesh-state}/broker"
+    "root": "/var/lib/minio/root.secret",
+    "broker": "/var/lib/mesh/minio/broker"
   },
   "resources": [
     {
       "id": "mesh-state",
       "type": "directory",
-      "mode": "0700",
-      "place": "mesh"
+      "path": "/var/lib/mesh/minio",
+      "mode": "0700"
     },
     {
       "id": "state",
       "type": "directory",
-      "mode": "0700",
-      "place": "."
+      "path": "/var/lib/minio",
+      "mode": "0700"
     },
     {
       "id": "grants",
       "type": "directory",
+      "path": "/var/lib/minio/grants",
       "mode": "0700"
     },
     {
       "id": "root-env",
       "type": "file",
-      "path": "${dir:state}/root.env",
+      "path": "/var/lib/minio/root.env",
       "mode": "0600",
       "content": "MINIO_ROOT_USER=meshroot\nMINIO_BROWSER_REDIRECT_URL=https://${bound:route:name-console}\n"
     },
@@ -111,7 +112,7 @@
         ":9001"
       ],
       "env-file": [
-        "${dir:state}/root.env"
+        "/var/lib/minio/root.env"
       ],
       "ports": [
         "9000",
@@ -119,7 +120,7 @@
       ],
       "volumes": [
         "/var/lib/minio-store:/data",
-        "${dir:state}/root.secret:/run/secrets/root:ro"
+        "/var/lib/minio/root.secret:/run/secrets/root:ro"
       ],
       "env": {
         "MINIO_ROOT_PASSWORD_FILE": "/run/secrets/root",
@@ -132,9 +133,9 @@
       "name": "mesh-minio",
       "network": "minio-net",
       "volumes": [
-        "${dir:mesh-state}/broker:/run/secrets/broker:ro",
-        "${dir:grants}:${dir:grants}:ro",
-        "${dir:state}/root.secret:/run/secrets/root:ro"
+        "/var/lib/mesh/minio/broker:/run/secrets/broker:ro",
+        "/var/lib/minio/grants:/var/lib/minio/grants:ro",
+        "/var/lib/minio/root.secret:/run/secrets/root:ro"
       ],
       "env": {
         "MESH_MINIO_ENDPOINT": "http://minio:9000",
@@ -142,7 +143,7 @@
         "MESH_MINIO_ROOT_PASSWORD_FILE": "/run/secrets/root",
         "MESH_MINIO_REGION": "eu-west",
         "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_RECEIVES": "${dir:grants}/mesh.json"
+        "MESH_RECEIVES": "/var/lib/minio/grants/mesh.json"
       },
       "artifact": "runtime"
     }

modules/model-usage/module.json

@@ -14,34 +14,34 @@
     }
   },
   "binds": {
-    "postgres-database": "${dir:state}/database.json"
+    "postgres-database": "/var/lib/model-usage/database.json"
   },
   "secrets": {
-    "postgres-database": "${dir:state}/database.secret"
+    "postgres-database": "/var/lib/model-usage/database.secret"
   },
   "consumes": [
     "*.usage.*"
   ],
   "own-secrets": {
-    "broker": "${dir:mesh-state}/broker"
+    "broker": "/var/lib/mesh/model-usage/broker"
   },
   "resources": [
     {
       "id": "mesh-state",
       "type": "directory",
-      "mode": "0700",
-      "place": "mesh"
+      "path": "/var/lib/mesh/model-usage",
+      "mode": "0700"
     },
     {
       "id": "state",
       "type": "directory",
-      "mode": "0700",
-      "place": "."
+      "path": "/var/lib/model-usage",
+      "mode": "0700"
     },
     {
       "id": "database-url",
       "type": "file",
-      "path": "${dir:state}/database.url",
+      "path": "/var/lib/model-usage/database.url",
       "mode": "0600",
       "content": "postgresql://${bound:postgres-database:as}:${secret:postgres-database}@${bound:postgres-database:at}:${bound:postgres-database:port}/${bound:postgres-database:as}\n"
     },
@@ -52,9 +52,9 @@
       "image": "mesh-runtime-model-usage@sha256:0000000000000000000000000000000000000000000000000000000000000000",
       "network": "host",
       "volumes": [
-        "${dir:mesh-state}/broker:/run/secrets/broker:ro",
-        "${dir:state}:/run/state",
-        "${dir:state}/database.url:/run/secrets/database-url:ro"
+        "/var/lib/mesh/model-usage/broker:/run/secrets/broker:ro",
+        "/var/lib/model-usage:/run/state",
+        "/var/lib/model-usage/database.url:/run/secrets/database-url:ro"
       ],
       "env": {
         "MESH_BROKER_FILE": "/run/secrets/broker",

modules/mongodb/module.json

@@ -40,15 +40,15 @@
   },
   "own-secrets": {
     "root": "${dir:state}/root.secret",
-    "broker": "${dir:mesh-state}/broker"
+    "broker": "/var/lib/mesh/mongodb/broker"
   },
   "secrets-owner": "999:999",
   "resources": [
     {
       "id": "mesh-state",
       "type": "directory",
-      "mode": "0700",
-      "place": "mesh"
+      "path": "/var/lib/mesh/mongodb",
+      "mode": "0700"
     },
     {
       "id": "state",
@@ -95,7 +95,7 @@
       "name": "mesh-mongodb",
       "network": "mongodb",
       "volumes": [
-        "${dir:mesh-state}/broker:/run/secrets/broker:ro",
+        "/var/lib/mesh/mongodb/broker:/run/secrets/broker:ro",
         "${dir:grants}:${dir:grants}:ro",
         "${dir:state}/root.secret:/run/secrets/root:ro"
       ],

modules/mosquitto/module.json

@@ -32,8 +32,8 @@
     "mqtt-topic": "${dir:grants}"
   },
   "own-secrets": {
-    "admin": "${dir:mesh-state}/admin",
-    "broker": "${dir:mesh-state}/broker"
+    "admin": "/var/lib/mesh/mosquitto/admin",
+    "broker": "/var/lib/mesh/mosquitto/broker"
   },
   "listens": [
     {
@@ -55,8 +55,8 @@
     {
       "id": "mesh-state",
       "type": "directory",
-      "mode": "0700",
-      "place": "mesh"
+      "path": "/var/lib/mesh/mosquitto",
+      "mode": "0700"
     },
     {
       "id": "state",
@@ -95,7 +95,7 @@
       "run-once": true,
       "volumes": [
         "${dir:data}:/mosquitto/data",
-        "${dir:mesh-state}/admin:/run/secrets/admin:ro"
+        "/var/lib/mesh/mosquitto/admin:/run/secrets/admin:ro"
       ],
       "env": {
         "MESH_PROVISION_MQTT": "mosquitto:1883",
@@ -130,9 +130,9 @@
       "name": "mesh-mosquitto",
       "network": "mosquitto",
       "volumes": [
-        "${dir:mesh-state}/broker:/run/secrets/broker:ro",
+        "/var/lib/mesh/mosquitto/broker:/run/secrets/broker:ro",
         "${dir:grants}:${dir:grants}:ro",
-        "${dir:mesh-state}/admin:/run/secrets/admin:ro"
+        "/var/lib/mesh/mosquitto/admin:/run/secrets/admin:ro"
       ],
       "env": {
         "MESH_BROKER_FILE": "/run/secrets/broker",

modules/mssql/Dockerfile

@@ -20,20 +20,7 @@ COPY . .
 RUN node /app/node_modules/typescript/bin/tsc client.ts index.ts tools/index.ts provisioner/index.ts \
       --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist
 
-# **sqlcmd, which this module's client drives, has to be here** — it never was, so every tool failed
-# with `spawn sqlcmd ENOENT`. go-sqlcmd is one static binary; fetched at a pinned release and checked
-# against its digest, so a build that receives anything else stops here.
-FROM ${BUILD_BASE} AS sqlcmd
-ARG SQLCMD_VERSION=v1.10.0
-ARG SQLCMD_SHA256=92516d98c63d99b0994de5b61350c91f6915f9b76f139a59039fbcb225c2e987
-RUN apt-get update && apt-get install -y --no-install-recommends curl ca-certificates bzip2 \
-      && curl -fsSL -o /tmp/sqlcmd.tar.bz2 \
-           "https://github.com/microsoft/go-sqlcmd/releases/download/${SQLCMD_VERSION}/sqlcmd-linux-amd64.tar.bz2" \
-      && echo "${SQLCMD_SHA256}  /tmp/sqlcmd.tar.bz2" | sha256sum -c - \
-      && tar -xjf /tmp/sqlcmd.tar.bz2 -C /usr/local/bin sqlcmd
-
 FROM ${RUNTIME_BASE}
-COPY --from=sqlcmd /usr/local/bin/sqlcmd /usr/local/bin/sqlcmd
 COPY --from=build /app/modules/mssql/dist /app/modules/mssql/dist
 # Every serve-time entrypoint, loaded by the runtime in serve mode: tools and events serve, and a
 # provider's provisioner runs its reconcile loop in the same process, with the broker connected —

modules/mssql/client.ts

@@ -29,40 +29,11 @@ export interface MssqlConn {
   readonly port: number;
   readonly user: string;
   readonly password: string;
-  /**
-   * The read-only login's password, which the mesh mints for this module (`own-secrets.reader`).
-   * Absent when the mesh has not delivered it: then a caller's statement is refused, never run as
-   * the administrator (novox/hq issue 193).
-   */
-  readonly readerPassword?: string;
-}
-
-/**
- * The login a caller's statement runs as (novox/hq issue 193). It may connect to every database and
- * read every table, and holds no other permission. A statement cannot climb out of a login the way it
- * could out of a transaction wrapped around it as text, and the administrator — who can run programs
- * on the server — never runs a caller's text.
- */
-export const READER = "mesh_mssql_reader";
-
-/** Who a sqlcmd invocation logs in as, and whether the text is a caller's rather than the module's. */
-interface Invocation {
-  readonly user: string;
-  readonly password: string;
-  /**
-   * A caller's text: sqlcmd substitutes no `$(NAME)` in it, which would read this process's
-   * environment — the administrator's password among it. (Its own commands are kept out by the
-   * caller's text never beginning a line; see readOnlyQuery.)
-   */
-  readonly caller: boolean;
 }
 
 export class MssqlClient {
   constructor(private readonly conn: MssqlConn) {}
 
-  /** The reader is made once per process: idempotent, and repeating it re-sets a rotated password. */
-  private readerReady?: Promise<void>;
-
   /**
    * Build from the module's resolved environment. Reads MESH_MSSQL_* first (the documented
    * names), falling back to the MESH_PROVISION_* keys the manifest already sets on the provisioner
@@ -77,9 +48,7 @@ export class MssqlClient {
     if (!host || !password) {
       throw new Error("mssql host or admin password is not set — mssql's own code cannot reach the server");
     }
-    const readerPassword = env.MESH_MSSQL_READER_PASSWORD ??
-      readSecretFile(env.MESH_MSSQL_READER_PASSWORD_FILE);
-    return new MssqlClient({ host, port, user, password, readerPassword });
+    return new MssqlClient({ host, port, user, password });
   }
 
   get host(): string {
@@ -117,12 +86,7 @@ export class MssqlClient {
   }
 
   /** The one execution boundary: invoke `sqlcmd` and return its concatenated stdout. */
-  private async sqlcmd(
-    sql: string,
-    database: string,
-    variables: Record<string, string> = {},
-    as: Invocation = { user: this.conn.user, password: this.conn.password, caller: false },
-  ): Promise<string> {
+  private async sqlcmd(sql: string, database: string, variables: Record<string, string> = {}): Promise<string> {
     // `-h -1` drops the column-header rule; `-y 0`/`-Y 0` lift the display-width cap so a long
     // JSON document is not truncated; `-W` trims trailing whitespace so the JSON chunks rejoin
     // cleanly. sqlcmd from the mssql-tools ships in the runtime container, the way `psql` ships
@@ -131,9 +95,8 @@ export class MssqlClient {
       "sqlcmd",
       [
         "-S", `${this.conn.host},${this.conn.port}`,
-        "-U", as.user,
+        "-U", this.conn.user,
         "-d", database,
-        ...(as.caller ? ["-x"] : []),
         "-C",
         "-b",
         "-h", "-1",
@@ -144,7 +107,7 @@ export class MssqlClient {
       ],
       // `variables` reach sqlcmd as environment variables, which it substitutes as `$(NAME)` scripting
       // variables: a value that must not appear on argv, or in the message of a failed command.
-      { env: { ...process.env, ...variables, SQLCMDPASSWORD: as.password }, maxBuffer: 16 << 20 },
+      { env: { ...process.env, ...variables, SQLCMDPASSWORD: this.conn.password }, maxBuffer: 16 << 20 },
     );
     return stdout;
   }
@@ -262,78 +225,18 @@ export class MssqlClient {
     }));
   }
 
-  /**
-   * Make the read-only login, idempotently, with the password the mesh minted for it: it may connect
-   * to every database and read every table, and is taken out of the administrators' role should
-   * anyone have put it there. Run as the administrator, because only it can make a login.
-   */
-  async ensureReader(): Promise<void> {
-    const password = this.conn.readerPassword;
-    if (!password) throw readerMissing();
-    const logins = await this.query(
-      `SELECT 1 AS ok FROM sys.server_principals WHERE name = ${literal(READER)}`,
-    );
-    if (logins.length === 0) {
-      await this.exec(
-        `CREATE LOGIN ${ident(READER)} WITH PASSWORD = ${literal(password)}, CHECK_POLICY = OFF`,
-      );
-    } else {
-      await this.exec(`ALTER LOGIN ${ident(READER)} WITH PASSWORD = ${literal(password)}`);
-      await this.exec(`ALTER LOGIN ${ident(READER)} ENABLE`);
-    }
-    await this.exec(
-      `IF IS_SRVROLEMEMBER('sysadmin', ${literal(READER)}) = 1 ` +
-        `ALTER SERVER ROLE sysadmin DROP MEMBER ${ident(READER)}`,
-    );
-    await this.exec(`GRANT CONNECT ANY DATABASE TO ${ident(READER)}`);
-    await this.exec(`GRANT SELECT ALL USER SECURABLES TO ${ident(READER)}`);
-  }
-
-  /**
-   * Run a caller's SELECT against a named database as the read-only login, for the mssql_query tool
-   * (novox/hq issue 193). Read-only by the login, not by a transaction wrapped around the text; the
-   * rows are rendered by FOR JSON. Never as the administrator: without the reader's password the call
-   * is refused.
-   */
+  /** Run a read-only SELECT against a named database, for the mssql_query tool. */
   async readOnlyQuery(database: string, sql: string): Promise<QueryResult> {
-    const password = this.conn.readerPassword;
-    if (!password) throw readerMissing();
-    // **One line, refused otherwise.** sqlcmd reads a line that BEGINS with `:` or `!!` as its own
-    // command rather than SQL, and `:!!` starts a program in this container, which holds the
-    // administrator's password. Its switch for refusing those (-X) makes it ignore -Q in the
-    // version shipped here, so instead no line of a caller's text can begin one: the text follows
-    // this module's own on the first line, and a line break in it is refused. Proven on a throwaway
-    // server: the same text at the start of a line ran a program; mid-line it is a syntax error.
-    if (/[\r\n]/.test(sql)) {
-      throw new Error(
-        "mssql_query: the statement must be one line — sqlcmd takes a line beginning with ':' or " +
-          "'!!' as a command of its own, which can start a program (novox/hq issue 193)",
-      );
-    }
-    this.readerReady ??= this.ensureReader().catch((err) => {
-      this.readerReady = undefined; // asked again next call, not failed for the process's life
-      throw err;
-    });
-    await this.readerReady;
-    const stdout = await this.sqlcmd(
-      `SET NOCOUNT ON; ${stripTrailingSemis(sql)}\nFOR JSON PATH, INCLUDE_NULL_VALUES;`,
+    // The read-only guarantee is a wrapping transaction that is always rolled back: any write the
+    // statement attempts is undone. The rows are rendered by FOR JSON inside query().
+    const rows = await this.query(
+      `BEGIN TRANSACTION;\n${stripTrailingSemis(sql)}\nFOR JSON PATH, INCLUDE_NULL_VALUES;\nROLLBACK;`,
       database,
-      {},
-      { user: READER, password, caller: true },
     );
-    const command = /^\s*([A-Za-z]+)/.exec(sql)?.[1]?.toUpperCase() ?? "";
-    return { command, rows: parseJsonRows(stdout) };
+    return { command: sql.trimStart().split(/\s+/)[0]?.toUpperCase() ?? "", rows };
   }
 }
 
-function readerMissing(): Error {
-  return new Error(
-    "the read-only login's password was not delivered (own-secrets.reader, " +
-      "MESH_MSSQL_READER_PASSWORD_FILE), so the statement is refused rather than run as the " +
-      "administrator (novox/hq issue 193)",
-  );
-}
-
 /** Generate a URL-safe password. */
 export function generatePassword(): string {
   return randomBytes(24).toString("base64url");

modules/mssql/module.json

@@ -38,15 +38,14 @@
   },
   "own-secrets": {
     "sa": "${dir:state}/sa.secret",
-    "broker": "${dir:mesh-state}/broker",
-    "reader": "${dir:state}/reader.secret"
+    "broker": "/var/lib/mesh/mssql/broker"
   },
   "resources": [
     {
       "id": "mesh-state",
       "type": "directory",
-      "mode": "0700",
-      "place": "mesh"
+      "path": "/var/lib/mesh/mssql",
+      "mode": "0700"
     },
     {
       "id": "state",
@@ -100,17 +99,15 @@
       "name": "mesh-mssql",
       "network": "mssql",
       "volumes": [
-        "${dir:mesh-state}/broker:/run/secrets/broker:ro",
+        "/var/lib/mesh/mssql/broker:/run/secrets/broker:ro",
         "${dir:grants}:/var/lib/mssql/grants:ro",
-        "${dir:state}/sa.secret:/run/secrets/sa:ro",
-        "${dir:state}/reader.secret:/run/secrets/reader:ro"
+        "${dir:state}/sa.secret:/run/secrets/sa:ro"
       ],
       "env": {
         "MESH_PROVISION_MSSQL": "mssql://sa@mssql:1433/master",
         "MESH_PROVISION_PASSWORD_FILE": "/run/secrets/sa",
         "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_RECEIVES": "/var/lib/mssql/grants/mesh.json",
-        "MESH_MSSQL_READER_PASSWORD_FILE": "/run/secrets/reader"
+        "MESH_RECEIVES": "/var/lib/mssql/grants/mesh.json"
       },
       "artifact": "runtime"
     }

modules/mssql/package.json

@@ -1,13 +1,9 @@
 {
   "name": "@novox/module-mssql",
   "version": "0.1.0",
-  "description": "mssql \u2014 provides the mesh mssql-database interface. Its client, provisioner, tools and events live here (novox/hq ADR 0039).",
+  "description": "mssql — provides the mesh mssql-database interface. Its client, provisioner, tools and events live here (novox/hq ADR 0039).",
   "type": "module",
   "private": true,
-  "scripts": {
-    "build": "tsc client.ts index.ts tools/index.ts provisioner/index.ts --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist",
-    "test": "npm run build && node --test --experimental-strip-types 'test/*.test.ts'"
-  },
   "dependencies": {
     "@novox/mesh-sdk": "^0.1.1"
   },

modules/mssql/test/reader.test.ts

@@ -1,96 +0,0 @@
-// What holds mssql_query to being read-only (novox/hq issue 193): a caller's statement runs as the
-// reader login and never as the administrator, with sqlcmd's variable substitution off, on one line
-// that follows the module's own — a line break is refused before sqlcmd starts — and with no
-// transaction wrapped around it as text. Without the reader's password the statement is refused.
-//
-// sqlcmd is a fake on PATH that records each call's login, flags and text. That the reader cannot
-// write is the server's to enforce and was proven against a real server; this holds the module to
-// asking for it. Run against the compiled module (npm test builds first), the way the runtime loads it.
-
-import { test, before, after } from "node:test";
-import assert from "node:assert/strict";
-import { chmod, mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-
-import { MssqlClient, READER } from "../dist/client.js";
-
-let dir: string;
-let log: string;
-const originalPath = process.env.PATH;
-
-before(async () => {
-  dir = await mkdtemp(join(tmpdir(), "mssql-reader-"));
-  log = join(dir, "calls.jsonl");
-  await writeFile(join(dir, "sqlcmd"), `#!/usr/bin/env node
-const fs = require("node:fs");
-const args = process.argv.slice(2);
-const at = (flag) => args[args.indexOf(flag) + 1];
-fs.appendFileSync(${JSON.stringify(log)}, JSON.stringify({
-  user: at("-U"), database: at("-d"), sql: at("-Q"), noVariables: args.includes("-x"),
-  password: process.env.SQLCMDPASSWORD,
-}) + "\\n");
-const sql = at("-Q");
-if (/FROM sys.server_principals/.test(sql)) process.stdout.write("");
-else if (/FOR JSON/.test(sql)) process.stdout.write('[{"name":"alpha","n":1}]\\n');
-`);
-  await chmod(join(dir, "sqlcmd"), 0o755);
-  process.env.PATH = `${dir}:${originalPath}`;
-});
-
-after(async () => {
-  process.env.PATH = originalPath;
-  await rm(dir, { recursive: true, force: true });
-});
-
-async function calls(): Promise<Record<string, unknown>[]> {
-  const text = await readFile(log, "utf8").catch(() => "");
-  await writeFile(log, "");
-  return text.split("\n").filter(Boolean).map((line) => JSON.parse(line));
-}
-
-const conn = { host: "127.0.0.1", port: 1433, user: "sa", password: "admin-secret" };
-
-test("a caller's statement runs as the reader, without variables, on the module's first line", async () => {
-  const client = new MssqlClient({ ...conn, readerPassword: "reader-secret" });
-  const result = await client.readOnlyQuery("inventory", "SELECT '$(SQLCMDPASSWORD)' AS p");
-
-  const asked = (await calls()).at(-1)!;
-  assert.equal(asked.user, READER, "the statement never runs as the administrator");
-  assert.equal(asked.password, "reader-secret");
-  assert.equal(asked.noVariables, true, "no $(NAME) is substituted in a caller's text");
-  const [first] = String(asked.sql).split("\n");
-  assert.ok(first.startsWith("SET NOCOUNT ON; SELECT '$(SQLCMDPASSWORD)'"), "the caller's text never begins a line");
-  assert.doesNotMatch(String(asked.sql), /BEGIN TRANSACTION|ROLLBACK/, "no transaction wrapped around it as text");
-  assert.deepEqual(result.rows, [{ name: "alpha", n: 1 }]);
-  assert.equal(result.command, "SELECT");
-});
-
-test("a line break in a caller's statement is refused before sqlcmd starts", async () => {
-  const client = new MssqlClient({ ...conn, readerPassword: "reader-secret" });
-  for (const sql of ["SELECT 1\n:!! id", "SELECT 1\r\n:!! id", "SELECT 1\r:!! id"]) {
-    await assert.rejects(client.readOnlyQuery("inventory", sql), /must be one line/);
-  }
-  assert.deepEqual(await calls(), []);
-});
-
-test("the reader is made as the administrator, kept out of sysadmin, and granted only reading", async () => {
-  const client = new MssqlClient({ ...conn, readerPassword: "reader-secret" });
-  await client.readOnlyQuery("inventory", "SELECT 1 AS x");
-  await client.readOnlyQuery("inventory", "SELECT 2 AS x");
-
-  const made = await calls();
-  const asAdmin = made.filter((c) => c.user === "sa").map((c) => String(c.sql));
-  assert.ok(asAdmin.some((s) => s.startsWith(`CREATE LOGIN [${READER}]`)));
-  assert.ok(asAdmin.some((s) => /ALTER SERVER ROLE sysadmin DROP MEMBER/.test(s)));
-  assert.ok(asAdmin.includes(`GRANT CONNECT ANY DATABASE TO [${READER}]`));
-  assert.ok(asAdmin.includes(`GRANT SELECT ALL USER SECURABLES TO [${READER}]`));
-  assert.equal(asAdmin.filter((s) => s.startsWith("CREATE LOGIN")).length, 1, "made once, not per call");
-  assert.equal(made.filter((c) => c.user === READER).length, 2);
-});
-
-test("without the reader's password the statement is refused, and nothing runs as the administrator", async () => {
-  const client = new MssqlClient(conn);
-  await assert.rejects(client.readOnlyQuery("inventory", "SELECT 1"), /refused rather than run as the administrator/);
-  assert.deepEqual(await calls(), []);
-});

modules/mssql/tools/index.ts

@@ -16,7 +16,7 @@ export function getMssqlTools(mssql: MssqlClient): ToolDefinition[] {
     },
     {
       name: "mssql_query",
-      description: "Run a read-only SELECT against a named database, as a login that can read every table and change nothing.",
+      description: "Run a read-only SELECT against a named database (wrapped in a rolled-back transaction).",
       input: {
         database: { type: "string", description: "the database to query" },
         sql: { type: "string", description: "a single SELECT statement" },

modules/n8n/module.json

@@ -26,7 +26,7 @@
   },
   "accesses": [
     {
-      "id": "media",
+      "path": "/services/media",
       "mode": "read-write"
     }
   ],
@@ -93,7 +93,7 @@
       "volumes": [
         "${dir:data}:/home/node/.n8n",
         "${dir:state}/n8n-database.secret:/run/secrets/database:ro",
-        "${access:media}:/media-library"
+        "/services/media:/media-library"
       ]
     },
     {

modules/nats/module.json

@@ -62,14 +62,13 @@
       "volumes": [
         "/var/lib/mesh-broker-nats:/data",
         "/var/lib/nats-module/conf:/etc/nats:ro",
-        "${access:tls}:/tls:ro"
+        "/var/lib/mesh-broker-tls:/tls:ro"
       ],
       "artifact": "server"
     }
   ],
   "accesses": [
     {
-      "id": "tls",
       "path": "/var/lib/mesh-broker-tls",
       "mode": "read"
     }

modules/networkmanager/module.json

@@ -3,8 +3,7 @@
   "version": "1",
   "capabilities": [
     "package-manager",
-    "service-manager",
-    "uplink-networkmanager"
+    "service-manager"
   ],
   "claims": [
     {

modules/nextcloud/module.json

@@ -31,7 +31,7 @@
   ],
   "own-secrets": {
     "admin": "${dir:state}/admin.secret",
-    "broker": "${dir:mesh-state}/broker"
+    "broker": "/var/lib/mesh/nextcloud/broker"
   },
   "capabilities": [
     "container-runtime"
@@ -49,8 +49,8 @@
     {
       "id": "mesh-state",
       "type": "directory",
-      "mode": "0700",
-      "place": "mesh"
+      "path": "/var/lib/mesh/nextcloud",
+      "mode": "0700"
     },
     {
       "id": "state",
@@ -90,7 +90,7 @@
     {
       "id": "runtime-config",
       "type": "file",
-      "path": "${dir:mesh-state}/config.json",
+      "path": "/var/lib/mesh/nextcloud/config.json",
       "mode": "0600",
       "content": "{}\n",
       "merge": "json"
@@ -101,8 +101,8 @@
       "name": "mesh-nextcloud",
       "network": "host",
       "volumes": [
-        "${dir:mesh-state}/broker:/run/secrets/broker:ro",
-        "${dir:mesh-state}/config.json:/run/config/config.json:ro",
+        "/var/lib/mesh/nextcloud/broker:/run/secrets/broker:ro",
+        "/var/lib/mesh/nextcloud/config.json:/run/config/config.json:ro",
         "${dir:state}/admin.secret:/run/secrets/admin:ro",
         "/var/run/docker.sock:/var/run/docker.sock"
       ],

modules/nftables/Dockerfile

@@ -1,23 +0,0 @@
-# nftables' runtime: the tool runtime, carrying the packet filter's tools and the binaries they speak.
-#
-# Built from this module's own directory and nothing else (novox/hq ADR 0069). Two bases, named in
-# module.json's `build.on`: the image this is compiled in and the image it runs in.
-ARG BUILD_BASE
-ARG RUNTIME_BASE
-
-FROM ${BUILD_BASE} AS build
-WORKDIR /app/modules/nftables
-COPY . .
-RUN node /app/node_modules/typescript/bin/tsc client.ts tools/index.ts \
-      --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist
-
-FROM ${RUNTIME_BASE}
-# The filter's own tools: nft for the machine's ruleset and the mesh's table, iptables for the
-# legacy filter and the tables iptables-nft manages — a predecessor's rules live there (ADR 0168).
-# The container runs on the machine's network with NET_ADMIN (ADR 0170), so these act on the
-# machine's packet filter, not on a namespace of their own.
-RUN apt-get update \
-      && apt-get install -y --no-install-recommends nftables iptables \
-      && rm -rf /var/lib/apt/lists/*
-COPY --from=build /app/modules/nftables/dist /app/modules/nftables/dist
-ENV MESH_TOOL_MODULES=/app/modules/nftables/dist/tools/index.js

modules/nftables/client.ts

@@ -1,211 +1,22 @@
-// The packet filter's own code, in the module (novox/hq ADR 0039). The mesh computes this node's
-// rule set from every module's `listens` and writes it to the filter file (ADR 0045); the module
-// loads it through its own unit. This code reads the filter back as the machine enforces it, reloads
-// the mesh's own table, and removes one thing the mesh did not write when the operator names it
-// (ADR 0168, ADR 0170) — the seat's three verbs, over the machine's own tools.
+// The firewall's own code, in the module (novox/hq ADR 0039). The mesh computes this node's whole
+// rule set from every module's `listens` and writes it to /etc/nftables.conf (novox/hq ADR 0045);
+// the module loads it through its own mesh-filter unit, reloaded whenever the rules change, whose
+// stop deletes only the mesh's table and never flushes the whole ruleset (novox/hq ADR 0100). This
+// code exists only to read back what is actually enforced — the enforcement itself is declarative.
 
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
 
-const execFileP = promisify(execFile);
-
-/** A command runner, so the acts can be tested without a packet filter. */
-export type Runner = (cmd: string, args: string[]) => Promise<string>;
-
-export const execRunner: Runner = async (cmd, args) => {
-  const { stdout } = await execFileP(cmd, args, { maxBuffer: 16 * 1024 * 1024 });
-  return stdout;
-};
-
-/** The mesh's own tables, which `remove` never touches. */
-const MESH_TABLES = new Set(["inet mesh", "inet mesh_guard"]);
-/** The tables iptables-nft manages, spoken through iptables rather than nft. */
-const IPTABLES_TABLES = new Set(["filter", "nat", "raw", "mangle", "security"]);
-/** The chains the kernel has built in; flushing one is the owner's act, not an operator's removal. */
-const BUILT_IN = new Set(["INPUT", "FORWARD", "OUTPUT", "PREROUTING", "POSTROUTING"]);
-/** The chain the container runtime leaves for an administrator, which is emptied, never deleted. */
-const USER_CHAIN = "DOCKER-USER";
-
-export interface Removal {
-  where: string;
-  did: string[];
-}
+const run = promisify(execFile);
 
 export class FirewallClient {
-  private readonly run: Runner;
-  private readonly filterFile: string;
-
-  constructor(run: Runner = execRunner, filterFile: string = process.env.MESH_FILTER_FILE ?? "/etc/nftables.conf") {
-    this.run = run;
-    this.filterFile = filterFile;
+  static fromEnv(_env: NodeJS.ProcessEnv = process.env): FirewallClient {
+    return new FirewallClient();
   }
 
-  static fromEnv(env: NodeJS.ProcessEnv = process.env): FirewallClient {
-    return new FirewallClient(execRunner, env.MESH_FILTER_FILE ?? "/etc/nftables.conf");
-  }
-
-  /** The mesh's live table — exactly what the mesh's own filter is dropping and accepting. */
+  /** The mesh's live table — exactly what is dropping and accepting on this node right now. */
   async ruleset(): Promise<string> {
-    return this.run("nft", ["list", "table", "inet", "mesh"]);
-  }
-
-  /** The packet filter as the machine enforces it: nftables whole or narrowed, and the legacy filter's
-   *  listings where the tools exist. */
-  async rules(table?: string, chain?: string): Promise<{ nftables: string; legacy: Record<string, string> }> {
-    let nftables: string;
-    if (table && chain) {
-      const [family, name] = splitTable(table);
-      nftables = await this.run("nft", ["list", "chain", family, name, chain]);
-    } else if (table) {
-      const [family, name] = splitTable(table);
-      nftables = await this.run("nft", ["list", "table", family, name]);
-    } else {
-      nftables = await this.run("nft", ["list", "ruleset"]);
-    }
-    const legacy: Record<string, string> = {};
-    if (!table) {
-      for (const tool of ["iptables-legacy", "ip6tables-legacy"]) {
-        try {
-          const out = await this.run(tool, ["-S"]);
-          if (out.trim()) legacy[tool] = out;
-        } catch {
-          // the tool is not here, or the legacy filter is empty: nothing to list
-        }
-      }
-    }
-    return { nftables, legacy };
-  }
-
-  /** Load the mesh's own filter again from the file the mesh writes, and answer with the table. */
-  async reload(): Promise<{ loaded: string; table: string }> {
-    await this.run("nft", ["-f", this.filterFile]);
-    return { loaded: this.filterFile, table: await this.ruleset() };
-  }
-
-  /** Whether the found front end is in force, whose chains `remove` leaves alone. */
-  private async ufwActive(): Promise<boolean> {
-    try {
-      const out = await this.run("ufw", ["status"]);
-      return /^Status:\s*active/m.test(out);
-    } catch {
-      return false;
-    }
-  }
-
-  /** Remove one rule set the mesh did not write, named as the host reports it (ADR 0168). */
-  async remove(where: string): Promise<Removal> {
-    const did: string[] = [];
-    const legacy = /^chain (\S+) \((iptables-legacy|ip6tables-legacy|iptables|ip6tables)\)$/.exec(where.trim());
-    const nft = /^table (\S+) (\S+), chain (\S+)$/.exec(where.trim());
-    if (legacy) {
-      const [, chain, tool] = legacy;
-      await this.refuseOwned(chain, "ip", "filter");
-      await this.removeChainWith(tool, undefined, chain, did);
-      return { where, did };
-    }
-    if (nft) {
-      const [, family, name, chain] = nft;
-      const table = `${family} ${name}`;
-      if (MESH_TABLES.has(table)) throw new Error(`${where} is the mesh's own table; it is not removed, it is composed`);
-      await this.refuseOwned(chain, family, name);
-      if ((family === "ip" || family === "ip6") && IPTABLES_TABLES.has(name)) {
-        const tool = family === "ip6" ? "ip6tables" : "iptables";
-        await this.removeChainWith(tool, name, chain, did);
-        return { where, did };
-      }
-      // A table of the machine's own: a chain of it goes, and the table with it when nothing is left.
-      const listing = await this.run("nft", ["list", "table", family, name]);
-      const base = new RegExp(`chain ${escape(chain)} \\{[^}]*type \\S+ hook`).test(listing);
-      for (const from of chainsJumpingTo(listing, chain)) {
-        await this.deleteNftRules(family, name, from, chain, did);
-      }
-      if (base) {
-        await this.run("nft", ["flush", "chain", family, name, chain]);
-        did.push(`nft flush chain ${family} ${name} ${chain}`);
-      } else {
-        await this.run("nft", ["delete", "chain", family, name, chain]);
-        did.push(`nft delete chain ${family} ${name} ${chain}`);
-      }
-      return { where, did };
-    }
-    throw new Error(`${JSON.stringify(where)} is not a rule set as the host reports one: ` +
-      "`chain X (iptables-legacy)` or `table <family> <name>, chain X`");
-  }
-
-  private async refuseOwned(chain: string, family: string, table: string): Promise<void> {
-    if (chain !== USER_CHAIN && chain.startsWith("DOCKER")) {
-      throw new Error(`chain ${chain} is the container runtime's own; it is left`);
-    }
-    if (BUILT_IN.has(chain)) {
-      throw new Error(`chain ${chain} is built in; its policy is its owner's and it is not flushed`);
-    }
-    if (chain.startsWith("ufw") && (await this.ufwActive())) {
-      throw new Error(`chain ${chain} belongs to the found firewall, which is in force; converge retires it`);
-    }
-    void family; void table;
-  }
-
-  /** Through an iptables tool: the user chain is emptied back to its one return; another chain loses
-   *  the jumps into it, is flushed and deleted. */
-  private async removeChainWith(tool: string, table: string | undefined, chain: string, did: string[]): Promise<void> {
-    const t = table && table !== "filter" ? ["-t", table] : [];
-    if (chain === USER_CHAIN) {
-      await this.run(tool, [...t, "-F", chain]);
-      await this.run(tool, [...t, "-A", chain, "-j", "RETURN"]);
-      did.push(`${tool} ${[...t, "-F", chain].join(" ")}`, `${tool} ${[...t, "-A", chain, "-j", "RETURN"].join(" ")}`);
-      return;
-    }
-    const listing = await this.run(tool, [...t, "-S"]);
-    for (const line of listing.split("\n")) {
-      const fields = line.trim().split(/\s+/);
-      if (fields[0] !== "-A") continue;
-      const j = fields.indexOf("-j");
-      const g = fields.indexOf("-g");
-      const target = j >= 0 ? fields[j + 1] : g >= 0 ? fields[g + 1] : "";
-      if (target !== chain) continue;
-      const args = [...t, "-D", ...fields.slice(1)];
-      await this.run(tool, args);
-      did.push(`${tool} ${args.join(" ")}`);
-    }
-    await this.run(tool, [...t, "-F", chain]);
-    await this.run(tool, [...t, "-X", chain]);
-    did.push(`${tool} ${[...t, "-F", chain].join(" ")}`, `${tool} ${[...t, "-X", chain].join(" ")}`);
-  }
-
-  private async deleteNftRules(family: string, name: string, from: string, target: string, did: string[]): Promise<void> {
-    const listing = await this.run("nft", ["-a", "list", "chain", family, name, from]);
-    for (const line of listing.split("\n")) {
-      if (!new RegExp(`\\b(jump|goto) ${escape(target)}\\b`).test(line)) continue;
-      const handle = /# handle (\d+)/.exec(line)?.[1];
-      if (!handle) continue;
-      await this.run("nft", ["delete", "rule", family, name, from, "handle", handle]);
-      did.push(`nft delete rule ${family} ${name} ${from} handle ${handle}`);
-    }
+    const { stdout } = await run("nft", ["list", "table", "inet", "mesh"]);
+    return stdout;
   }
 }
-
-function splitTable(table: string): [string, string] {
-  const parts = table.trim().split(/\s+/);
-  if (parts.length !== 2) throw new Error(`a table is \`family name\`, not ${JSON.stringify(table)}`);
-  return [parts[0], parts[1]];
-}
-
-/** Which chains of a listed table jump or go to the named one. */
-export function chainsJumpingTo(listing: string, target: string): string[] {
-  const out: string[] = [];
-  let chain = "";
-  for (const raw of listing.split("\n")) {
-    const line = raw.trim();
-    const head = /^chain (\S+) \{/.exec(line);
-    if (head) { chain = head[1]; continue; }
-    if (line === "}") { chain = ""; continue; }
-    if (chain && chain !== target && new RegExp(`\\b(jump|goto) ${escape(target)}\\b`).test(line) && !out.includes(chain)) {
-      out.push(chain);
-    }
-  }
-  return out;
-}
-
-function escape(s: string): string {
-  return s.replace(/[.*+?^${}()|[\]\\-]/g, "\\$&");
-}

modules/nftables/module.json

@@ -2,30 +2,18 @@
   "module": "nftables",
   "version": "1",
   "capabilities": [
-    "firewall",
-    "container-runtime"
+    "firewall"
   ],
   "claims": [
     {
       "name": "node-packet-filter",
-      "scope": "node",
-      "serves": [
-        "rules",
-        "reload",
-        "remove"
-      ]
+      "scope": "node"
     }
   ],
   "filtering": {
     "into": "/etc/nftables.conf"
   },
   "resources": [
-    {
-      "id": "mesh-state",
-      "type": "directory",
-      "mode": "0700",
-      "place": "mesh"
-    },
     {
       "id": "package",
       "type": "package",
@@ -58,51 +46,6 @@
       "reload-on": [
         "filtering"
       ]
-    },
-    {
-      "id": "runtime",
-      "type": "container",
-      "name": "mesh-nftables",
-      "network": "host",
-      "capabilities": [
-        "NET_ADMIN"
-      ],
-      "volumes": [
-        "${dir:mesh-state}/broker:/run/secrets/broker:ro",
-        "/etc/nftables.conf:/etc/nftables.conf:ro"
-      ],
-      "env": {
-        "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_FILTER_FILE": "/etc/nftables.conf"
-      },
-      "artifact": "runtime"
     }
-  ],
-  "tools": [
-    "firewall_rules"
-  ],
-  "own-secrets": {
-    "broker": "${dir:mesh-state}/broker"
-  },
-  "build": {
-    "on": [
-      {
-        "arg": "BUILD_BASE",
-        "module": "mesh-tools",
-        "artifact": "build"
-      },
-      {
-        "arg": "RUNTIME_BASE",
-        "module": "mesh-tools",
-        "artifact": "runtime"
-      }
-    ],
-    "artifacts": [
-      {
-        "name": "runtime",
-        "kind": "image",
-        "from": "Dockerfile"
-      }
-    ]
-  }
+  ]
 }

modules/nftables/package.json

@@ -1,15 +1,11 @@
 {
-  "name": "@novox/module-nftables",
+  "name": "@novox/module-firewall",
   "version": "0.1.0",
-  "description": "nftables — loads the mesh's packet filter and holds the node-packet-filter seat: its verbs rules, reload and remove (novox/hq ADR 0045, ADR 0170).",
+  "description": "firewall — applies the mesh-computed packet filter (ADR 0045). Its diagnostic tool lives here.
   "type": "module",
   "private": true,
-  "scripts": {
-    "build": "tsc client.ts tools/index.ts --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist",
-    "test": "node --test --experimental-strip-types 'test/*.test.ts'"
-  },
   "dependencies": {
-    "@novox/mesh-sdk": "^0.1.1"
+    "@novox/mesh-sdk": "^0.1.0"
   },
   "devDependencies": {
     "@types/node": "^22.0.0",

modules/nftables/test/remove.test.ts

@@ -1,74 +0,0 @@
-// `remove` acts on one rule set the mesh did not write, named as the host reports it (novox/hq ADR
-// 0168, 0169), over the shapes two machines of the first mesh reported live: a predecessor's chain in
-// the legacy filter, the runtime's user chain in the IPv6 legacy filter, a leftover front-end chain,
-// and the same in an iptables-nft table. It refuses what is not the operator's to remove.
-import { test } from "node:test";
-import assert from "node:assert/strict";
-import { FirewallClient, chainsJumpingTo, type Runner } from "../client.ts";
-
-const legacy = [
-  "-P INPUT ACCEPT", "-P FORWARD DROP", "-P OUTPUT ACCEPT",
-  "-N DOCKER", "-N DOCKER-USER", "-N HAL-MESH-ONLY",
-  "-A FORWARD -j DOCKER-USER",
-  "-A DOCKER-USER -i enp6s0 -p tcp -m conntrack --ctstate NEW -j HAL-MESH-ONLY",
-  "-A HAL-MESH-ONLY -m conntrack --ctorigdstport 80 -j RETURN",
-  "-A HAL-MESH-ONLY -m comment --comment \"HAL: not public -> mesh only\" -j DROP",
-].join("\n") + "\n";
-
-function fake(ufwActive = false): { run: Runner; asked: string[] } {
-  const asked: string[] = [];
-  const run: Runner = async (cmd, args) => {
-    asked.push([cmd, ...args].join(" "));
-    if (cmd === "ufw") return ufwActive ? "Status: active\n" : "Status: inactive\n";
-    if (args.join(" ") === "-S") return legacy;
-    if (cmd === "nft" && args[0] === "list" && args[1] === "table") {
-      return "table ip6 own {\n\tchain forward {\n\t\ttype filter hook forward priority filter; policy accept;\n\t\tjump deny\n\t}\n\tchain deny {\n\t\tdrop\n\t}\n}\n";
-    }
-    if (cmd === "nft" && args[0] === "-a") {
-      return "table ip6 own {\n\tchain forward {\n\t\ttype filter hook forward priority filter; policy accept;\n\t\tjump deny # handle 7\n\t}\n}\n";
-    }
-    return "";
-  };
-  return { run, asked };
-}
-
-test("a predecessor's chain in the legacy filter loses its jumps, is flushed and deleted", async () => {
-  const f = fake();
-  const out = await new FirewallClient(f.run).remove("chain HAL-MESH-ONLY (iptables-legacy)");
-  assert.deepEqual(out.did, [
-    "iptables-legacy -D DOCKER-USER -i enp6s0 -p tcp -m conntrack --ctstate NEW -j HAL-MESH-ONLY",
-    "iptables-legacy -F HAL-MESH-ONLY",
-    "iptables-legacy -X HAL-MESH-ONLY",
-  ]);
-});
-
-test("the runtime's user chain is emptied back to its one return, never deleted", async () => {
-  const f = fake();
-  const out = await new FirewallClient(f.run).remove("chain DOCKER-USER (ip6tables-legacy)");
-  assert.deepEqual(out.did, ["ip6tables-legacy -F DOCKER-USER", "ip6tables-legacy -A DOCKER-USER -j RETURN"]);
-  const nft = await new FirewallClient(fake().run).remove("table ip6 filter, chain DOCKER-USER");
-  assert.deepEqual(nft.did, ["ip6tables -F DOCKER-USER", "ip6tables -A DOCKER-USER -j RETURN"]);
-});
-
-test("a chain of the machine's own nftables table goes with the rules that reach it", async () => {
-  const f = fake();
-  const out = await new FirewallClient(f.run).remove("table ip6 own, chain deny");
-  assert.deepEqual(out.did, ["nft delete rule ip6 own forward handle 7", "nft delete chain ip6 own deny"]);
-});
-
-test("what is not the operator's to remove is refused by name", async () => {
-  const c = new FirewallClient(fake(true).run);
-  await assert.rejects(c.remove("table inet mesh, chain forward"), /the mesh's own table/);
-  await assert.rejects(c.remove("chain DOCKER (iptables-legacy)"), /container runtime's own/);
-  await assert.rejects(c.remove("chain FORWARD (iptables-legacy)"), /built in/);
-  await assert.rejects(c.remove("chain ufw6-docker-logging-deny (ip6tables-legacy)"), /found firewall, which is in force/);
-  await assert.rejects(c.remove("something else"), /not a rule set as the host reports one/);
-  // Retired, a front end's leftover is nobody's and goes.
-  const retired = await new FirewallClient(fake(false).run).remove("chain ufw6-docker-logging-deny (ip6tables-legacy)");
-  assert.ok(retired.did.includes("ip6tables-legacy -X ufw6-docker-logging-deny"));
-});
-
-test("which chains jump to a target is read from a listing", () => {
-  const listing = "table ip6 own {\n\tchain a {\n\t\tjump deny\n\t}\n\tchain b {\n\t\tgoto deny\n\t}\n\tchain deny {\n\t\tdrop\n\t}\n}\n";
-  assert.deepEqual(chainsJumpingTo(listing, "deny"), ["a", "b"]);
-});

modules/nftables/tools/index.ts

@@ -1,51 +1,19 @@
-// The packet filter's tools: the node-packet-filter seat's three verbs — what the machine enforces,
-// reload the mesh's own, remove one thing the mesh did not write — and the module's own reading of
-// the mesh's table (novox/hq ADR 0045, ADR 0168, ADR 0170).
+// firewall's tools — one, and the useful one: what is actually enforced. The rules are the mesh's,
+// computed from every module's listens; this reads the live table so a declared scope can be checked
+// against what the packet filter is really doing.
+
 import { registerModuleTools, type ToolDefinition } from "@novox/mesh-sdk/tools";
 import { FirewallClient } from "../client.js";
 
-export function getSeatVerbs(firewall: FirewallClient): ToolDefinition[] {
-  return [
-    {
-      name: "rules",
-      description:
-        "The packet filter as this machine enforces it now: the nftables ruleset and, where the tool exists, the legacy filter's listings. Narrowed to one table or chain when asked.",
-      input: {
-        table: { type: "string", description: "one nftables table, as `family name` (optional)" },
-        chain: { type: "string", description: "one chain of that table (optional)" },
-      },
-      run: async (args) => firewall.rules(args.table ? String(args.table) : undefined, args.chain ? String(args.chain) : undefined),
-    },
-    {
-      name: "reload",
-      description: "Load the mesh's own filter again from the file the mesh writes, and answer with the mesh's table as loaded.",
-      input: {},
-      run: async () => firewall.reload(),
-    },
-    {
-      name: "remove",
-      description:
-        "Remove one rule set the mesh did not write, named exactly as `node show` lists it: `chain X (iptables-legacy)` or `table ip6 filter, chain DOCKER-USER`. " +
-        "Refuses the mesh's tables, the runtime's own chains, a built-in chain and an active found firewall's chains. An operator's act, by name, never a flush.",
-      input: { where: { type: "string", description: "the rule set, as `node show` lists it" } },
-      run: async (args) => firewall.remove(String(args.where ?? "")),
-    },
-  ];
-}
-
 export function getFirewallTools(firewall: FirewallClient): ToolDefinition[] {
   return [
     {
       name: "firewall_rules",
-      description: "The mesh's live nftables table on this node — what the mesh's own filter is accepting and dropping.",
+      description: "The mesh's live nftables rules on this node — what is actually accepting and dropping.",
       input: {},
       run: async () => ({ ruleset: await firewall.ruleset() }),
     },
   ];
 }
 
-const firewall = FirewallClient.fromEnv();
-// The seat's verbs under the seat's name: the runtime serves them on the seat's subjects where this
-// module holds it (ADR 0159, 0160). The module's own under its own.
-registerModuleTools("node-packet-filter", () => getSeatVerbs(firewall));
-registerModuleTools("nftables", () => getFirewallTools(firewall));
+registerModuleTools("firewall", () => getFirewallTools(FirewallClient.fromEnv()));

modules/nodered/module.json

@@ -5,15 +5,9 @@
     "flows.deployed"
   ],
   "own-secrets": {
-    "admin": {
-      "path": "${dir:mesh-state}/admin",
-      "taken": "at-start"
-    },
-    "api-token": {
-      "path": "${dir:mesh-state}/api-token",
-      "taken": "at-start"
-    },
-    "broker": "${dir:mesh-state}/broker"
+    "admin": "/var/lib/mesh/nodered/admin",
+    "api-token": "/var/lib/mesh/nodered/api-token",
+    "broker": "/var/lib/mesh/nodered/broker"
   },
   "capabilities": [
     "container-runtime"
@@ -31,8 +25,8 @@
     {
       "id": "mesh-state",
       "type": "directory",
-      "mode": "0700",
-      "place": "mesh"
+      "path": "/var/lib/mesh/nodered",
+      "mode": "0700"
     },
     {
       "id": "state",
@@ -96,7 +90,7 @@
     {
       "id": "runtime-config",
       "type": "file",
-      "path": "${dir:mesh-state}/config.json",
+      "path": "/var/lib/mesh/nodered/config.json",
       "mode": "0600",
       "content": "{\n  \"token\": \"${secret:api-token}\"\n}\n"
     },
@@ -106,8 +100,8 @@
       "name": "mesh-nodered",
       "network": "host",
       "volumes": [
-        "${dir:mesh-state}/broker:/run/secrets/broker:ro",
-        "${dir:mesh-state}/config.json:/run/config/config.json:ro"
+        "/var/lib/mesh/nodered/broker:/run/secrets/broker:ro",
+        "/var/lib/mesh/nodered/config.json:/run/config/config.json:ro"
       ],
       "env": {
         "MESH_BROKER_FILE": "/run/secrets/broker",
@@ -126,7 +120,7 @@
       "network": "host",
       "run-once": true,
       "volumes": [
-        "${dir:mesh-state}/config.json:/run/config/config.json:ro",
+        "/var/lib/mesh/nodered/config.json:/run/config/config.json:ro",
         "${dir:written}:/var/lib/nodered-provisions",
         "${dir:state}/mqtt-topic.json:/run/provisions/mqtt-topic.json:ro",
         "${dir:state}/mqtt-topic.secret:/run/provisions/mqtt-topic.secret:ro",

modules/nzbget/Dockerfile

@@ -0,0 +1,24 @@
+# nzbget's runtime: the tool runtime, carrying this module's compiled code.
+#
+# **Built from this module's own directory and nothing else.** The sdk and the tool runtime are in
+# the base images, published like any other artifact — which is what makes this buildable by the
+# mesh from a repository and a path (novox/hq ADR 0069) rather than only on a workstation that
+# happens to have the siblings.
+#
+# Two bases, named rather than pinned (novox/hq issue 044): the image this is COMPILED in and the
+# image it RUNS in — the second must not carry a compiler. Declared in module.json's `build.on`.
+ARG BUILD_BASE
+ARG RUNTIME_BASE
+
+FROM ${BUILD_BASE} AS build
+WORKDIR /app/modules/nzbget
+COPY . .
+RUN node /app/node_modules/typescript/bin/tsc client.ts index.ts tools/index.ts \
+      --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist
+
+FROM ${RUNTIME_BASE}
+COPY --from=build /app/modules/nzbget/dist /app/modules/nzbget/dist
+# Every serve-time entrypoint, loaded by the runtime in serve mode: tools and events serve, and a
+# provider's provisioner runs its reconcile loop in the same process, with the broker connected —
+# the convention novox/hq issues 060/061 settled.
+ENV MESH_TOOL_MODULES=/app/modules/nzbget/dist/index.js,/app/modules/nzbget/dist/tools/index.js

modules/nzbget/client.ts

@@ -0,0 +1,178 @@
+// The NZBGet API client — nzbget's own code, living in the module (novox/hq ADR 0039). Ported from
+// hal's shared nzbget tools, but self-contained: a change to NZBGet's JSON-RPC now rebuilds only
+// nzbget and nothing else. Both this module's tools and its events entrypoint import it, and
+// nothing outside nzbget does. NZBGet speaks JSON-RPC at /jsonrpc, behind HTTP Basic auth.
+
+import { readFileSync } from "node:fs";
+
+export interface NzbgetStatus {
+  /** Bytes/sec — NZBGet reports it split across two 32-bit halves, rejoined here. */
+  speedBytesPerSec: number;
+  remainingMB: number;
+  downloadedTodayMB: number;
+  downloadedMonthMB: number;
+  freeDiskMB: number;
+  paused: boolean;
+  postJobs: number;
+  uptimeSec: number;
+}
+
+export interface NzbgetQueueItem {
+  /** The NZBID — stable while the item is queued, so events can diff on it. */
+  id: number;
+  name: string;
+  status: string;
+  category: string;
+  sizeMB: number;
+  remainingMB: number;
+  percent: number;
+}
+
+export interface NzbgetHistoryItem {
+  /** The NZBID — the same id the item carried in the queue. */
+  id: number;
+  name: string;
+  /** NZBGet's own status string, e.g. "SUCCESS/ALL", "FAILURE/PAR", "DELETED/MANUAL". */
+  status: string;
+  category: string;
+  sizeMB: number;
+  /** A genuine completion (status starts "SUCCESS") vs a failed or deleted entry — the difference
+   *  between something to announce as done and something that merely left the queue. */
+  success: boolean;
+}
+
+/** The settings-merged config the mesh delivers (novox/hq ADR 0046): { url, apiKey, token, password, user, ... }. */
+function meshConfig(file?: string): Record<string, string> {
+  if (!file) return {};
+  try { return JSON.parse(readFileSync(file, "utf8")) as Record<string, string>; }
+  catch { return {}; }
+}
+
+/** Read a secret the mesh mounted at a file path (an own-secret delivered by `secret accept`);
+ *  absent or unreadable yields undefined so callers fall back rather than crash. */
+function readSecret(file?: string): string | undefined {
+  if (!file) return undefined;
+  try { return readFileSync(file, "utf8").trim(); }
+  catch { return undefined; }
+}
+
+export class NzbgetClient {
+  readonly rpcUrl: string;
+  private readonly auth: string;
+
+  constructor(url: string, user: string, password: string) {
+    this.rpcUrl = `${url.replace(/\/$/, "")}/jsonrpc`;
+    this.auth = Buffer.from(`${user}:${password}`).toString("base64");
+  }
+
+  /**
+   * Build from the module's resolved environment. URL and password are read from MESH_NZBGET_URL
+   * and MESH_NZBGET_PASSWORD; both must be present — an unconfigured NZBGet throws rather than
+   * pretend to be reachable, so the tools/events simply do not load (the harness treats the throw
+   * as "exposes nothing"). The control username defaults to "nzbget", NZBGet's own default.
+   */
+  static fromEnv(env: NodeJS.ProcessEnv = process.env): NzbgetClient {
+    const cfg = meshConfig(env.MESH_NZBGET_CONFIG_FILE);
+    const url = cfg.url ?? env.MESH_NZBGET_URL;
+    const password = cfg.password ?? readSecret(env.MESH_NZBGET_PASSWORD_FILE) ?? env.MESH_NZBGET_PASSWORD;
+    if (!url || !password) {
+      throw new Error("NZBGet not configured — set MESH_NZBGET_URL and MESH_NZBGET_PASSWORD");
+    }
+    const user = cfg.user ?? env.MESH_NZBGET_USER ?? "nzbget";
+    return new NzbgetClient(url, user, password);
+  }
+
+  private async rpc<T>(method: string, params: unknown[] = []): Promise<T> {
+    const res = await fetch(this.rpcUrl, {
+      method: "POST",
+      headers: { "Content-Type": "application/json", Authorization: `Basic ${this.auth}` },
+      body: JSON.stringify({ method, params, id: 1 }),
+    });
+    if (!res.ok) throw new Error(`NZBGet API ${method}: ${res.status} ${await res.text()}`);
+    const data = (await res.json()) as { result?: T; error?: unknown };
+    if (data.error) throw new Error(`NZBGet RPC ${method}: ${JSON.stringify(data.error)}`);
+    return data.result as T;
+  }
+
+  async getVersion(): Promise<string> {
+    return this.rpc<string>("version");
+  }
+
+  async getStatus(): Promise<NzbgetStatus> {
+    const s = await this.rpc<Record<string, number | boolean>>("status");
+    const lo = Number(s.DownloadRateLo ?? 0);
+    const hi = Number(s.DownloadRateHi ?? 0);
+    return {
+      speedBytesPerSec: lo + hi * 4294967296,
+      remainingMB: Number(s.RemainingSizeMB ?? 0),
+      downloadedTodayMB: Number(s.DaySizeMB ?? 0),
+      downloadedMonthMB: Number(s.MonthSizeMB ?? 0),
+      freeDiskMB: Number(s.FreeDiskSpaceMB ?? 0),
+      paused: Boolean(s.DownloadPaused),
+      postJobs: Number(s.PostJobCount ?? 0),
+      uptimeSec: Number(s.UpTimeSec ?? 0),
+    };
+  }
+
+  async getQueue(): Promise<NzbgetQueueItem[]> {
+    const groups = await this.rpc<Record<string, any>[]>("listgroups", [0]);
+    return groups.map((g) => {
+      const size = Number(g.FileSizeMB ?? 0);
+      const remaining = Number(g.RemainingSizeMB ?? 0);
+      return {
+        id: Number(g.NZBID),
+        name: String(g.NZBName ?? "Unknown"),
+        status: String(g.Status ?? "unknown"),
+        category: String(g.Category ?? ""),
+        sizeMB: size,
+        remainingMB: remaining,
+        percent: size > 0 ? Math.round(((size - remaining) / size) * 100) : 0,
+      };
+    });
+  }
+
+  async getHistory(limit = 20): Promise<NzbgetHistoryItem[]> {
+    const history = await this.rpc<Record<string, any>[]>("history", [false]);
+    return history.slice(0, limit).map((h) => {
+      const status = String(h.Status ?? "");
+      return {
+        id: Number(h.NZBID),
+        name: String(h.Name ?? "Unknown"),
+        status,
+        category: String(h.Category ?? ""),
+        sizeMB: Number(h.FileSizeMB ?? 0),
+        success: status.startsWith("SUCCESS"),
+      };
+    });
+  }
+
+  /** Queue an NZB by URL. Returns the new NZBID; a non-positive id means NZBGet refused it. */
+  async add(url: string, category = "", priority = 0, paused = false): Promise<number> {
+    const id = await this.rpc<number>("append", [
+      "", url, category, priority, false, paused, "", 0, "SCORE", false, [],
+    ]);
+    if (!id || id <= 0) throw new Error("NZBGet refused the NZB (append returned 0)");
+    return id;
+  }
+
+  async pauseAll(): Promise<void> {
+    await this.rpc("pausedownload");
+  }
+
+  async resumeAll(): Promise<void> {
+    await this.rpc("resumedownload");
+  }
+
+  async pauseItem(id: number): Promise<void> {
+    await this.rpc("editqueue", ["GroupPause", "", [id]]);
+  }
+
+  async resumeItem(id: number): Promise<void> {
+    await this.rpc("editqueue", ["GroupResume", "", [id]]);
+  }
+
+  /** Delete an item from the queue or from history. */
+  async delete(id: number, from: "queue" | "history" = "queue"): Promise<void> {
+    await this.rpc("editqueue", [from === "history" ? "HistoryDelete" : "GroupDelete", "", [id]]);
+  }
+}

modules/nzbget/index.ts

@@ -0,0 +1,64 @@
+// nzbget's events. The tool runtime imports this once the broker is bound. It watches the download
+// queue and the history and turns their comings and goings into mesh events.
+//
+// Emits (novox/hq ADR 0041/0042):
+//   module.nzbget.download.added       — an NZB entered the queue
+//   module.nzbget.download.completed   — an NZB finished successfully (left the queue, landed in
+//                                        history as SUCCESS). This exact routing key is what the
+//                                        plex module consumes (module.*.download.completed) to
+//                                        rescan, so the new file becomes a visible item.
+// Consumes: none.
+//
+// Two diffs, each primed silently on the first look (like plex's and sonarr's index.ts) so a
+// restart mid-download does not re-announce everything already in flight or already finished. The
+// queue tells us what was grabbed; history — not the queue's disappearance — tells us what actually
+// succeeded, since a failed or deleted download also leaves the queue.
+
+import { emit } from "@novox/mesh-sdk/events";
+import { NzbgetClient } from "./client.js";
+
+const nzbget = NzbgetClient.fromEnv();
+
+const inQueue = new Set<number>();
+let queuePrimed = false;
+async function pollQueue(): Promise<void> {
+  const items = await nzbget.getQueue();
+  const now = new Set(items.map((i) => i.id));
+  if (queuePrimed) {
+    for (const item of items) {
+      if (!inQueue.has(item.id)) {
+        await emit("download.added", { name: item.name, category: item.category, sizeMB: item.sizeMB });
+      }
+    }
+  }
+  inQueue.clear();
+  for (const id of now) inQueue.add(id);
+  queuePrimed = true;
+}
+
+const seenHistory = new Set<number>();
+let historyPrimed = false;
+async function pollHistory(): Promise<void> {
+  const items = await nzbget.getHistory(50);
+  for (const item of items) {
+    if (!seenHistory.has(item.id)) {
+      // A newly-appeared history entry is a completion only if it actually succeeded; a failure or
+      // a manual delete lands in history too, and neither is a "download.completed".
+      if (historyPrimed && item.success) {
+        await emit("download.completed", { name: item.name, category: item.category, sizeMB: item.sizeMB });
+      }
+      seenHistory.add(item.id);
+    }
+  }
+  historyPrimed = true;
+}
+
+const tick = (fn: () => Promise<void>, everyMs: number): void => {
+  const run = (): void => void fn().catch((err) => console.error(`[nzbget] ${err}`));
+  setInterval(run, everyMs);
+  run();
+};
+tick(pollQueue, 20_000);
+tick(pollHistory, 30_000);
+
+console.log("[nzbget] watching the queue and history, emitting adds and completions");

modules/nzbget/module.json

@@ -0,0 +1,116 @@
+{
+  "module": "nzbget",
+  "version": "1",
+  "capabilities": [
+    "container-runtime"
+  ],
+  "emits": [
+    "download.added",
+    "download.completed"
+  ],
+  "consumes": [],
+  "own-secrets": {
+    "broker": "/var/lib/mesh/nzbget/broker",
+    "password": "/var/lib/mesh/nzbget/password"
+  },
+  "listens": [
+    {
+      "name": "web",
+      "port": 6789,
+      "protocol": "tcp",
+      "from": "mesh",
+      "why": "the download client's pages"
+    }
+  ],
+  "accesses": [
+    {
+      "path": "/services/media/downloads",
+      "mode": "read-write"
+    }
+  ],
+  "resources": [
+    {
+      "id": "mesh-state",
+      "type": "directory",
+      "path": "/var/lib/mesh/nzbget",
+      "mode": "0700"
+    },
+    {
+      "id": "config",
+      "type": "directory",
+      "path": "/services/nzbget/config",
+      "mode": "0700",
+      "owner": "1000:1000"
+    },
+    {
+      "id": "server",
+      "type": "container",
+      "name": "nzbget",
+      "image": "lscr.io/linuxserver/nzbget@sha256:5f3d3fa71029004156eff2cbf4ef4455ce4ce59517cf13fa7d1d7c8a4cd2c8a4",
+      "env": {
+        "PUID": "1000",
+        "PGID": "1000",
+        "TZ": "Etc/UTC"
+      },
+      "ports": [
+        "6789"
+      ],
+      "volumes": [
+        "/services/nzbget/config:/config",
+        "/services/media/downloads:/downloads"
+      ]
+    },
+    {
+      "id": "runtime-config",
+      "type": "file",
+      "path": "/var/lib/mesh/nzbget/config.json",
+      "mode": "0600",
+      "content": "{}\n",
+      "merge": "json"
+    },
+    {
+      "id": "runtime",
+      "type": "container",
+      "name": "mesh-nzbget",
+      "network": "host",
+      "volumes": [
+        "/var/lib/mesh/nzbget/broker:/run/secrets/broker:ro",
+        "/var/lib/mesh/nzbget/password:/run/secrets/password:ro",
+        "/var/lib/mesh/nzbget/config.json:/run/config/config.json:ro",
+        "/services/nzbget/config:/var/lib/nzbget/config:ro"
+      ],
+      "env": {
+        "MESH_BROKER_FILE": "/run/secrets/broker",
+        "MESH_NZBGET_URL": "http://127.0.0.1:6789",
+        "MESH_NZBGET_PASSWORD_FILE": "/run/secrets/password",
+        "MESH_NZBGET_CONFIG_FILE": "/run/config/config.json",
+        "MESH_NZBGET_CONFIG_DIR": "/var/lib/nzbget/config"
+      },
+      "restart-on": [
+        "runtime-config"
+      ],
+      "artifact": "runtime"
+    }
+  ],
+  "build": {
+    "on": [
+      {
+        "arg": "BUILD_BASE",
+        "module": "mesh-tools",
+        "artifact": "build"
+      },
+      {
+        "arg": "RUNTIME_BASE",
+        "module": "mesh-tools",
+        "artifact": "runtime"
+      }
+    ],
+    "artifacts": [
+      {
+        "name": "runtime",
+        "kind": "image",
+        "from": "Dockerfile"
+      }
+    ]
+  }
+}

modules/nzbget/package.json

@@ -0,0 +1,14 @@
+{
+  "name": "@novox/module-nzbget",
+  "version": "0.1.0",
+  "description": "nzbget — Usenet download client. Its API client, tools and events live here (novox/hq ADR 0039).",
+  "type": "module",
+  "private": true,
+  "dependencies": {
+    "@novox/mesh-sdk": "^0.1.0"
+  },
+  "devDependencies": {
+    "@types/node": "^22.0.0",
+    "typescript": "^5.6.0"
+  }
+}