No definition names this installation

keycloak, minio and n8n are told their names from their route bindings; mailu takes its domain, site
name, website and proxy address as settings and its front's name from its route, and the provisioner
reads the domain from the merged config; builder and route-proxy package the controller from the git
seat; the applications built outside the mesh say so per container; matrix says which of the world's
servers it means; the site module is named website, and the why prose no longer names a name (novox/hq
ADR 0155, issues 122 and 134). module check passes over all 77.

modules/anthropic-consumer/Dockerfile

@@ -0,0 +1,22 @@
+# anthropic-consumer's runtime: the tool runtime, carrying this module's compiled code.
+#
+# **Built from this module's own directory and nothing else.** The sdk and the tool runtime are in
+# the base images, published like any other artifact — which is what makes this buildable by the
+# mesh from a repository and a path (novox/hq ADR 0069) rather than only on a workstation that
+# happens to have the siblings.
+#
+# Two bases, named rather than pinned (novox/hq issue 044): the image this is COMPILED in and the
+# image it RUNS in — the second must not carry a compiler. Declared in module.json's `build.on`.
+ARG BUILD_BASE
+ARG RUNTIME_BASE
+
+FROM ${BUILD_BASE} AS build
+WORKDIR /app/modules/anthropic-consumer
+COPY . .
+RUN node /app/node_modules/typescript/bin/tsc apply/index.ts usage/index.ts \
+      --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist
+
+FROM ${RUNTIME_BASE}
+COPY --from=build /app/modules/anthropic-consumer/dist /app/modules/anthropic-consumer/dist
+# No serve-time entrypoints: every container of this module names its command (`run` on a
+# schedule), so nothing here serves — deliberately no MESH_TOOL_MODULES.

modules/anthropic-consumer/module.json

@@ -9,20 +9,29 @@
     "model-access"
   ],
   "binds": {
-    "model-access": "${dir:state}/model.json"
+    "model-access": "/var/lib/anthropic-consumer/model.json"
   },
   "secrets": {
-    "model-access": "${dir:state}/access-token"
+    "model-access": "/var/lib/anthropic-consumer/access-token"
+  },
+  "own-secrets": {
+    "broker": "/var/lib/mesh/anthropic-consumer/broker"
   },
   "emits": [
     "usage.session"
   ],
   "resources": [
+    {
+      "id": "mesh-state",
+      "type": "directory",
+      "path": "/var/lib/mesh/anthropic-consumer",
+      "mode": "0700"
+    },
     {
       "id": "state",
       "type": "directory",
-      "mode": "0700",
-      "place": "."
+      "path": "/var/lib/anthropic-consumer",
+      "mode": "0700"
     },
     {
       "id": "claude-home",
@@ -33,43 +42,71 @@
     {
       "id": "out",
       "type": "directory",
+      "path": "/var/lib/anthropic-consumer/out",
       "mode": "0700"
     },
     {
       "id": "apply",
-      "type": "process",
-      "name": "anthropic-consumer-apply",
-      "artifact": "code",
-      "run": [
-        "node",
-        "apply/index.js"
-      ],
+      "type": "container",
+      "name": "mesh-anthropic-consumer-apply",
+      "network": "host",
       "schedule": "*/5 * * * *",
+      "args": [
+        "run",
+        "/app/modules/anthropic-consumer/dist/apply/index.js"
+      ],
+      "volumes": [
+        "/var/lib/anthropic-consumer:/run/state"
+      ],
       "env": {
-        "MESH_MODEL_ACCESS_SECRET_FILE": "${dir:state}/access-token",
-        "MESH_MODEL_ACCESS_BIND_FILE": "${dir:state}/model.json",
-        "MESH_CLAUDE_CREDENTIALS_FILE": "${dir:state}/claude/.credentials.json",
-        "MESH_CLAUDE_IDENTITY_FILE": "${dir:state}/claude/.claude.json"
-      }
+        "MESH_MODEL_ACCESS_SECRET_FILE": "/run/state/access-token",
+        "MESH_MODEL_ACCESS_BIND_FILE": "/run/state/model.json",
+        "MESH_CLAUDE_CREDENTIALS_FILE": "/run/state/claude/.credentials.json",
+        "MESH_CLAUDE_IDENTITY_FILE": "/run/state/claude/.claude.json"
+      },
+      "artifact": "runtime"
+    },
+    {
+      "id": "usage",
+      "type": "container",
+      "name": "mesh-anthropic-consumer-usage",
+      "network": "host",
+      "schedule": "*/5 * * * *",
+      "args": [
+        "run",
+        "/app/modules/anthropic-consumer/dist/usage/index.js"
+      ],
+      "volumes": [
+        "/var/lib/mesh/anthropic-consumer/broker:/run/secrets/broker:ro",
+        "/var/lib/anthropic-consumer:/run/state"
+      ],
+      "env": {
+        "MESH_BROKER_FILE": "/run/secrets/broker",
+        "MESH_CLAUDE_PROJECTS_DIR": "/run/state/claude/projects",
+        "MESH_ANTHROPIC_USAGE_OUT": "/run/state/out/session-usage.json",
+        "MESH_TOOLS_MAIN": "/app/dist/main.js"
+      },
+      "artifact": "runtime"
     }
   ],
   "build": {
+    "on": [
+      {
+        "arg": "BUILD_BASE",
+        "module": "mesh-tools",
+        "artifact": "build"
+      },
+      {
+        "arg": "RUNTIME_BASE",
+        "module": "mesh-tools",
+        "artifact": "runtime"
+      }
+    ],
     "artifacts": [
       {
-        "name": "code",
-        "kind": "bundle",
-        "language": "typescript",
-        "entrypoints": [
-          "apply/index.js",
-          "usage/index.js"
-        ],
-        "loads": [
-          "usage/index.js"
-        ],
-        "env": {
-          "MESH_CLAUDE_PROJECTS_DIR": "${dir:state}/claude/projects",
-          "MESH_ANTHROPIC_USAGE_OUT": "${dir:state}/out/session-usage.json"
-        }
+        "name": "runtime",
+        "kind": "image",
+        "from": "Dockerfile"
       }
     ]
   }

modules/anthropic-consumer/usage/index.ts

@@ -3,15 +3,12 @@
 // per session. The consumer IS the (node,module) session's fixed binding, so no per-message account
 // attribution is done — just the totals (port map "don't-map" #3).
 //
-// Runs in the node's runtime (novox/hq ADR 0198), every five minutes, so events are emitted through
-// the runtime as this module; the totals are also written to a file so the reading is observable
-// without one.
+// Runs as `mesh-tools run` (no broker), so events are emitted best-effort via the sibling mesh-tools
+// `emit` primitive; the totals are also written to a file so the reading is observable without one.
 
 import { readdirSync, statSync, readFileSync, writeFileSync, renameSync, mkdirSync } from "node:fs";
 import { join, dirname } from "node:path";
 
-import { emit } from "@novox/mesh-sdk/events";
-
 import { readSessionFile, type SessionUsage } from "../transcript.js";
 
 /** The vendor-neutral usage row ADR 0054 fixes — the shape the model-usage store upserts. Kept local
@@ -119,20 +116,22 @@ function atomicWrite(path: string, content: string): void {
   renameSync(tmp, path);
 }
 
-/** Emit best-effort through the runtime: a reading that could not be announced is still in the file. */
+/** Emit best-effort via the sibling mesh-tools `emit`, which wires a broker a run step has none. */
 async function emitUsage(body: Record<string, unknown>): Promise<void> {
-  try {
-    await emit("usage.session", body);
-  } catch (err) {
-    console.error(`[anthropic-consumer] could not emit usage: ${err}`);
-  }
+  const main = process.env.MESH_TOOLS_MAIN ?? "/app/dist/main.js";
+  const { spawn } = await import("node:child_process");
+  await new Promise<void>((resolve) => {
+    const child = spawn(
+      process.execPath,
+      [main, "emit", "usage.session", JSON.stringify(body)],
+      { stdio: "inherit" },
+    );
+    child.on("exit", () => resolve());
+    child.on("error", (err) => {
+      console.error(`[anthropic-consumer] could not emit usage: ${err}`);
+      resolve();
+    });
+  });
 }
 
-// The cadence the scheduled container had: once at start, then every five minutes. Not awaited, so the
-// runtime's handshake is answered while a long first reading is still under way.
-const EVERY_MS = 5 * 60 * 1000;
-const tick = (): void => {
-  void main().catch((err) => console.error(`[anthropic-consumer] usage reading failed: ${err}`));
-};
-tick();
-setInterval(tick, EVERY_MS);
+await main();

modules/anthropic-manager/module.json

@@ -9,13 +9,13 @@
     "model-access"
   ],
   "binds": {
-    "model-access": "${dir:mesh-state}/model.json"
+    "model-access": "/var/lib/mesh/anthropic-manager/model.json"
   },
   "secrets": {
-    "model-access": "${dir:mesh-state}/refresh-token"
+    "model-access": "/var/lib/mesh/anthropic-manager/refresh-token"
   },
   "own-secrets": {
-    "broker": "${dir:mesh-state}/broker"
+    "broker": "/var/lib/mesh/anthropic-manager/broker"
   },
   "emits": [
     "usage.read"
@@ -24,13 +24,13 @@
     {
       "id": "mesh-state",
       "type": "directory",
-      "mode": "0700",
-      "place": "mesh"
+      "path": "/var/lib/mesh/anthropic-manager",
+      "mode": "0700"
     },
     {
       "id": "out",
       "type": "directory",
-      "path": "${dir:mesh-state}/out",
+      "path": "/var/lib/mesh/anthropic-manager/out",
       "mode": "0700"
     },
     {
@@ -45,8 +45,8 @@
         "/app/modules/anthropic-manager/dist/refresh/index.js"
       ],
       "volumes": [
-        "${dir:mesh-state}/broker:/run/secrets/broker:ro",
-        "${dir:mesh-state}:/run/state"
+        "/var/lib/mesh/anthropic-manager/broker:/run/secrets/broker:ro",
+        "/var/lib/mesh/anthropic-manager:/run/state"
       ],
       "env": {
         "MESH_BROKER_FILE": "/run/secrets/broker",

modules/audit-logger/Dockerfile

@@ -0,0 +1,33 @@
+# audit-logger's runtime: the shared runtime image, carrying this module's compiled code.
+#
+# **Built from this module's own directory and nothing else.** The toolkit is in the base image, so
+# nothing is copied out of a neighbouring checkout — which is what lets the mesh build this from a
+# repository and a path (novox/hq ADR 0069) rather than only on a workstation that happens to have
+# the siblings laid out beside it.
+
+# Two bases, named rather than pinned: the image this is COMPILED in, and the image it RUNS in.
+# They are different images on purpose — the first carries a compiler and the second must not, or
+# every running container would carry one it never invokes. The mesh answers both with the copies it
+# holds, because a fingerprint written here would name one particular copy and no other mesh has it
+# (novox/hq issue 044). Declared in module.json's `build.on`; deliberately no defaults, so a build
+# nobody told stops here and says which module to build first.
+ARG BUILD_BASE
+ARG RUNTIME_BASE
+
+FROM ${BUILD_BASE} AS build
+# Compiled under /app/modules so `@novox/mesh-sdk` resolves upward into the base's own
+# node_modules — the module is compiled against exactly the toolkit it will run against.
+WORKDIR /app/modules/audit-logger
+COPY . .
+# The compiler is invoked by its real path rather than through node_modules/.bin, whose entries are
+# symlinks to a launcher that requires its library relatively — resolved away when the base image
+# was assembled.
+RUN node /app/node_modules/typescript/bin/tsc audit.ts index.ts \
+      --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist
+
+FROM ${RUNTIME_BASE}
+COPY --from=build /app/modules/audit-logger/dist /app/modules/audit-logger/dist
+# **Served, not run.** This subscribes on import, and the serve mode binds the broker before it
+# imports anything — `run` exists for a step that works offline and exits, and would leave this
+# with nothing to subscribe to.
+ENV MESH_TOOL_MODULES=/app/modules/audit-logger/dist/index.js

modules/audit-logger/module.json

@@ -5,21 +5,27 @@
   "consumes": [
     "**"
   ],
+  "own-secrets": {
+    "broker": "/var/lib/audit-logger/broker"
+  },
   "build": {
+    "on": [
+      {
+        "arg": "BUILD_BASE",
+        "module": "mesh-tools",
+        "artifact": "build"
+      },
+      {
+        "arg": "RUNTIME_BASE",
+        "module": "mesh-tools",
+        "artifact": "runtime"
+      }
+    ],
     "artifacts": [
       {
-        "name": "code",
-        "kind": "bundle",
-        "language": "typescript",
-        "entrypoints": [
-          "index.js"
-        ],
-        "loads": [
-          "index.js"
-        ],
-        "env": {
-          "AUDIT_LOG": "${dir:trail}/audit.log"
-        }
+        "name": "runtime",
+        "kind": "image",
+        "from": "Dockerfile"
       }
     ]
   },
@@ -27,13 +33,29 @@
     {
       "id": "state",
       "type": "directory",
-      "mode": "0700",
-      "place": "."
+      "path": "/var/lib/audit-logger",
+      "mode": "0700"
     },
     {
       "id": "trail",
       "type": "directory",
+      "path": "/var/lib/audit-logger/trail",
       "mode": "0700"
+    },
+    {
+      "id": "run",
+      "type": "container",
+      "name": "mesh-audit-logger",
+      "network": "host",
+      "volumes": [
+        "/var/lib/audit-logger/broker:/run/secrets/broker:ro",
+        "/var/lib/audit-logger/trail:/trail"
+      ],
+      "env": {
+        "MESH_BROKER_FILE": "/run/secrets/broker",
+        "AUDIT_LOG": "/trail/audit.log"
+      },
+      "artifact": "runtime"
     }
   ],
   "capabilities": [

modules/audit-logger/test/audit.test.ts

@@ -15,7 +15,7 @@ test("audit-logger records every event to the trail as one line each", async ()
   const path = join(dir, "audit.log");
 
   // The audit-logger's whole behaviour: consume everything, record it.
-  await on("#", async (event) => record(event, path)); // the pattern index.ts subscribes
+  await on("**", async (event) => record(event, path));
 
   process.env.MESH_MODULE = "umami";
   process.env.MESH_NODE = "anchor";
@@ -24,9 +24,7 @@ test("audit-logger records every event to the trail as one line each", async ()
 
   const lines = (await readFile(path, "utf8")).trim().split("\n").map((l) => JSON.parse(l));
   assert.equal(lines.length, 2);
-  // A module names its events locally (design 29); the module is the `source`, which together with
-  // the type says whose event it was. This broker does no namespacing, so the type is as emitted.
-  assert.deepEqual(lines.map((l) => l.type), ["site.created", "node.anchor.joined"]);
+  assert.deepEqual(lines.map((l) => l.type), ["umami.site.created", "node.anchor.joined"]);
   assert.equal(lines[0].source, "umami");
   assert.equal(lines[0].node, "anchor");
   assert.equal(lines[0].body.domain, "my-app");

modules/baserow/Dockerfile

@@ -0,0 +1,24 @@
+# baserow's runtime: the tool runtime, carrying this module's compiled code.
+#
+# **Built from this module's own directory and nothing else.** The sdk and the tool runtime are in
+# the base images, published like any other artifact — which is what makes this buildable by the
+# mesh from a repository and a path (novox/hq ADR 0069) rather than only on a workstation that
+# happens to have the siblings.
+#
+# Two bases, named rather than pinned (novox/hq issue 044): the image this is COMPILED in and the
+# image it RUNS in — the second must not carry a compiler. Declared in module.json's `build.on`.
+ARG BUILD_BASE
+ARG RUNTIME_BASE
+
+FROM ${BUILD_BASE} AS build
+WORKDIR /app/modules/baserow
+COPY . .
+RUN node /app/node_modules/typescript/bin/tsc client.ts tools/index.ts \
+      --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist
+
+FROM ${RUNTIME_BASE}
+COPY --from=build /app/modules/baserow/dist /app/modules/baserow/dist
+# Every serve-time entrypoint, loaded by the runtime in serve mode: tools and events serve, and a
+# provider's provisioner runs its reconcile loop in the same process, with the broker connected —
+# the convention novox/hq issues 060/061 settled.
+ENV MESH_TOOL_MODULES=/app/modules/baserow/dist/tools/index.js

modules/baserow/module.json

@@ -25,7 +25,8 @@
     "postgres-database": "${dir:state}/database.secret"
   },
   "own-secrets": {
-    "admin": "${dir:state}/admin.secret"
+    "admin": "${dir:state}/admin.secret",
+    "broker": "/var/lib/mesh/baserow/broker"
   },
   "listens": [
     {
@@ -40,8 +41,8 @@
     {
       "id": "mesh-state",
       "type": "directory",
-      "mode": "0700",
-      "place": "mesh"
+      "path": "/var/lib/mesh/baserow",
+      "mode": "0700"
     },
     {
       "id": "state",
@@ -87,28 +88,49 @@
     {
       "id": "runtime-config",
       "type": "file",
-      "path": "${dir:mesh-state}/config.json",
+      "path": "/var/lib/mesh/baserow/config.json",
       "mode": "0600",
       "content": "{\n  \"password\": \"${secret:admin}\",\n  \"host\": \"${bound:route:name}\"\n}\n",
       "merge": "json"
+    },
+    {
+      "id": "runtime",
+      "type": "container",
+      "name": "mesh-baserow",
+      "network": "baserow",
+      "volumes": [
+        "/var/lib/mesh/baserow/broker:/run/secrets/broker:ro",
+        "/var/lib/mesh/baserow/config.json:/run/config/config.json:ro"
+      ],
+      "env": {
+        "MESH_BROKER_FILE": "/run/secrets/broker",
+        "MESH_BASEROW_URL": "http://baserow:80",
+        "MESH_BASEROW_CONFIG_FILE": "/run/config/config.json"
+      },
+      "restart-on": [
+        "runtime-config"
+      ],
+      "artifact": "runtime"
     }
   ],
   "build": {
+    "on": [
+      {
+        "arg": "BUILD_BASE",
+        "module": "mesh-tools",
+        "artifact": "build"
+      },
+      {
+        "arg": "RUNTIME_BASE",
+        "module": "mesh-tools",
+        "artifact": "runtime"
+      }
+    ],
     "artifacts": [
       {
-        "name": "tools",
-        "kind": "bundle",
-        "language": "typescript",
-        "entrypoints": [
-          "tools/index.js"
-        ],
-        "loads": [
-          "tools/index.js"
-        ],
-        "env": {
-          "MESH_BASEROW_URL": "http://127.0.0.1:${port:80}",
-          "MESH_BASEROW_CONFIG_FILE": "${dir:mesh-state}/config.json"
-        }
+        "name": "runtime",
+        "kind": "image",
+        "from": "Dockerfile"
       }
     ]
   }

modules/bazarr/Dockerfile

@@ -0,0 +1,24 @@
+# bazarr's runtime: the tool runtime, carrying this module's compiled code.
+#
+# **Built from this module's own directory and nothing else.** The sdk and the tool runtime are in
+# the base images, published like any other artifact — which is what makes this buildable by the
+# mesh from a repository and a path (novox/hq ADR 0069) rather than only on a workstation that
+# happens to have the siblings.
+#
+# Two bases, named rather than pinned (novox/hq issue 044): the image this is COMPILED in and the
+# image it RUNS in — the second must not carry a compiler. Declared in module.json's `build.on`.
+ARG BUILD_BASE
+ARG RUNTIME_BASE
+
+FROM ${BUILD_BASE} AS build
+WORKDIR /app/modules/bazarr
+COPY . .
+RUN node /app/node_modules/typescript/bin/tsc client.ts index.ts tools/index.ts \
+      --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist
+
+FROM ${RUNTIME_BASE}
+COPY --from=build /app/modules/bazarr/dist /app/modules/bazarr/dist
+# Every serve-time entrypoint, loaded by the runtime in serve mode: tools and events serve, and a
+# provider's provisioner runs its reconcile loop in the same process, with the broker connected —
+# the convention novox/hq issues 060/061 settled.
+ENV MESH_TOOL_MODULES=/app/modules/bazarr/dist/index.js,/app/modules/bazarr/dist/tools/index.js

modules/bazarr/client.ts

@@ -0,0 +1,173 @@
+// The Bazarr API client — bazarr's own code, living in the module (novox/hq ADR 0039). Bazarr
+// manages subtitles for a Sonarr/Radarr library: it tracks which episodes and movies are still
+// missing subtitles, searches providers for them, and records what it downloaded. This client
+// talks its /api surface (keyed by an X-API-KEY header); bazarr's tools and events import it.
+
+import { readFileSync } from "node:fs";
+
+export interface WantedSubtitle {
+  kind: "episode" | "movie";
+  title: string; // series + episode, or movie title
+  path?: string;
+  seriesId?: number; // sonarr series id (episodes)
+  episodeId?: number; // sonarr episode id (episodes)
+  radarrId?: number; // radarr movie id (movies)
+  missing: string[]; // language names still missing
+}
+
+export interface ProviderSubtitle {
+  provider: string;
+  language: string;
+  hearingImpaired: boolean;
+  forced: boolean;
+  score?: number;
+  release?: string;
+  subtitle: string; // the opaque token Bazarr uses to download this exact result
+}
+
+export interface HistoryEntry {
+  kind: "episode" | "movie";
+  id: string; // stable dedup key across polls
+  title: string;
+  language?: string;
+  provider?: string;
+  path?: string;
+  timestamp?: string;
+  description?: string;
+}
+
+/** The settings-merged config the mesh delivers (novox/hq ADR 0046): { url, apiKey, token, password, user, ... }. */
+function meshConfig(file?: string): Record<string, string> {
+  if (!file) return {};
+  try { return JSON.parse(readFileSync(file, "utf8")) as Record<string, string>; }
+  catch { return {}; }
+}
+
+/** Read a secret the mesh mounted at a file path (an own-secret delivered by `secret accept`);
+ *  absent or unreadable yields undefined so callers fall back rather than crash. */
+function readSecret(file?: string): string | undefined {
+  if (!file) return undefined;
+  try { return readFileSync(file, "utf8").trim(); }
+  catch { return undefined; }
+}
+
+export class BazarrClient {
+  readonly baseUrl: string;
+
+  constructor(
+    url: string,
+    private readonly apiKey: string,
+  ) {
+    this.baseUrl = url.replace(/\/$/, "");
+  }
+
+  /** Build from the module's resolved environment. Bazarr's API is keyed; without URL and key
+   *  there is nothing to talk to, so this throws rather than run half-configured. */
+  static fromEnv(env: NodeJS.ProcessEnv = process.env): BazarrClient {
+    const cfg = meshConfig(env.MESH_BAZARR_CONFIG_FILE);
+    const url = cfg.url ?? env.MESH_BAZARR_URL;
+    const apiKey = cfg.apiKey ?? readSecret(env.MESH_BAZARR_API_KEY_FILE) ?? env.MESH_BAZARR_API_KEY;
+    if (!url) throw new Error("no Bazarr URL — set MESH_BAZARR_URL");
+    if (!apiKey) throw new Error("no Bazarr API key — set MESH_BAZARR_API_KEY");
+    return new BazarrClient(url, apiKey);
+  }
+
+  private async request(method: string, path: string, params: Record<string, string> = {}): Promise<any> {
+    const url = new URL(`${this.baseUrl}/api${path}`);
+    for (const [k, v] of Object.entries(params)) url.searchParams.set(k, v);
+    const res = await fetch(url.toString(), { method, headers: { "X-API-KEY": this.apiKey, Accept: "application/json" } });
+    if (!res.ok) throw new Error(`Bazarr API ${method} ${path}: ${res.status} ${await res.text()}`);
+    // Downloads/patches return an empty body; only GETs carry JSON.
+    const text = await res.text();
+    return text ? JSON.parse(text) : {};
+  }
+
+  private get(path: string, params?: Record<string, string>): Promise<any> {
+    return this.request("GET", path, params);
+  }
+
+  private languageNames(missing: any[]): string[] {
+    return (missing ?? []).map((m: any) => m?.name ?? m?.code2 ?? m?.code3).filter(Boolean);
+  }
+
+  /** Episodes and movies still missing subtitles — Bazarr's core "what's left to do" list. */
+  async getWanted(limit = 50): Promise<WantedSubtitle[]> {
+    const [eps, movies] = await Promise.all([
+      this.get("/episodes/wanted", { start: "0", length: String(limit) }),
+      this.get("/movies/wanted", { start: "0", length: String(limit) }),
+    ]);
+    const episodes: WantedSubtitle[] = (eps?.data ?? []).map((e: any) => ({
+      kind: "episode" as const,
+      title: `${e.seriesTitle ?? e.series ?? "Unknown"} — ${e.episodeTitle ?? e.episode_title ?? ""}`.trim(),
+      path: e.path,
+      seriesId: e.sonarrSeriesId,
+      episodeId: e.sonarrEpisodeId,
+      missing: this.languageNames(e.missing_subtitles),
+    }));
+    const films: WantedSubtitle[] = (movies?.data ?? []).map((m: any) => ({
+      kind: "movie" as const,
+      title: m.title ?? "Unknown",
+      path: m.path,
+      radarrId: m.radarrId,
+      missing: this.languageNames(m.missing_subtitles),
+    }));
+    return [...episodes, ...films];
+  }
+
+  /** Ask providers what subtitles are available for one wanted episode — a manual search. */
+  async searchEpisode(episodeId: number): Promise<ProviderSubtitle[]> {
+    const raw = await this.get("/providers/episodes", { episodeid: String(episodeId) });
+    return this.mapProviderResults(raw);
+  }
+
+  /** Ask providers what subtitles are available for one movie — a manual search. */
+  async searchMovie(radarrId: number): Promise<ProviderSubtitle[]> {
+    const raw = await this.get("/providers/movies", { radarrid: String(radarrId) });
+    return this.mapProviderResults(raw);
+  }
+
+  private mapProviderResults(raw: any): ProviderSubtitle[] {
+    const list = Array.isArray(raw) ? raw : (raw?.data ?? []);
+    return list.map((r: any) => ({
+      provider: r.provider,
+      language: r.language?.name ?? r.language ?? "unknown",
+      hearingImpaired: Boolean(r.hearing_impaired ?? r.hi),
+      forced: Boolean(r.forced),
+      score: r.score,
+      release: r.release_info?.[0] ?? r.release_info,
+      subtitle: r.subtitle,
+    }));
+  }
+
+  /** Recent subtitle-download history, episodes and movies together, newest first. Each entry
+   *  carries a stable id so the events poller can tell a fresh download from one already seen. */
+  async getHistory(limit = 40): Promise<HistoryEntry[]> {
+    const [eps, movies] = await Promise.all([
+      this.get("/episodes/history", { start: "0", length: String(limit) }),
+      this.get("/movies/history", { start: "0", length: String(limit) }),
+    ]);
+    const key = (kind: string, r: any): string =>
+      `${kind}:${r.timestamp ?? r.parsed_timestamp ?? ""}:${r.subtitles_path ?? r.path ?? ""}:${r.language?.code3 ?? r.language ?? ""}`;
+    const episodes: HistoryEntry[] = (eps?.data ?? []).map((r: any) => ({
+      kind: "episode" as const,
+      id: key("episode", r),
+      title: `${r.seriesTitle ?? "Unknown"} — ${r.episodeTitle ?? ""}`.trim(),
+      language: r.language?.name ?? r.language,
+      provider: r.provider,
+      path: r.subtitles_path,
+      timestamp: r.timestamp,
+      description: r.description,
+    }));
+    const films: HistoryEntry[] = (movies?.data ?? []).map((r: any) => ({
+      kind: "movie" as const,
+      id: key("movie", r),
+      title: r.title ?? "Unknown",
+      language: r.language?.name ?? r.language,
+      provider: r.provider,
+      path: r.subtitles_path,
+      timestamp: r.timestamp,
+      description: r.description,
+    }));
+    return [...episodes, ...films];
+  }
+}

modules/bazarr/index.ts

@@ -0,0 +1,47 @@
+// bazarr's events. The tool runtime imports this once the broker is bound. Bazarr's one genuinely
+// observable thing is a subtitle arriving: it works away in the background, searching providers for
+// the missing-subtitle list, and when it succeeds a subtitle appears in its history. That is worth
+// announcing to the mesh.
+//
+// Emits (novox/hq ADR 0041/0042):
+//   module.bazarr.subtitle.downloaded   — a subtitle was fetched for an episode or movie
+//
+// Bazarr has nothing on the mesh it usefully reacts to (a download completing is Sonarr/Radarr's
+// business, and they trigger Bazarr directly), so it consumes nothing — a pure emitter.
+//
+// The event is observation-based: poll history and diff. Primed silently on the first look, or a
+// restart would re-announce the whole recent history as freshly downloaded.
+
+import { emit } from "@novox/mesh-sdk/events";
+import { BazarrClient } from "./client.js";
+
+const bazarr = BazarrClient.fromEnv();
+
+const seen = new Set<string>();
+let primed = false;
+async function pollHistory(): Promise<void> {
+  const entries = await bazarr.getHistory(40);
+  for (const entry of entries) {
+    if (seen.has(entry.id)) continue;
+    if (primed) {
+      await emit("subtitle.downloaded", {
+        kind: entry.kind,
+        title: entry.title,
+        language: entry.language,
+        provider: entry.provider,
+        path: entry.path,
+      });
+    }
+    seen.add(entry.id);
+  }
+  primed = true;
+}
+
+const tick = (fn: () => Promise<void>, everyMs: number): void => {
+  const run = (): void => void fn().catch((err) => console.error(`[bazarr] ${err}`));
+  setInterval(run, everyMs);
+  run();
+};
+tick(pollHistory, 60_000);
+
+console.log("[bazarr] watching subtitle-download history");

modules/bazarr/module.json

@@ -0,0 +1,141 @@
+{
+  "module": "bazarr",
+  "version": "1",
+  "capabilities": [
+    "container-runtime"
+  ],
+  "emits": [
+    "subtitle.downloaded"
+  ],
+  "own-secrets": {
+    "broker": "/var/lib/mesh/bazarr/broker",
+    "api-key": "/var/lib/mesh/bazarr/api-key"
+  },
+  "listens": [
+    {
+      "name": "web",
+      "port": 6767,
+      "protocol": "tcp",
+      "from": "mesh",
+      "why": "managing subtitles"
+    }
+  ],
+  "accesses": [
+    {
+      "path": "/services/media/movies",
+      "mode": "read-write"
+    },
+    {
+      "path": "/services/media/series",
+      "mode": "read-write"
+    },
+    {
+      "path": "/services/media/anime",
+      "mode": "read-write"
+    },
+    {
+      "path": "/services/media/downloads",
+      "mode": "read"
+    }
+  ],
+  "resources": [
+    {
+      "id": "mesh-state",
+      "type": "directory",
+      "path": "/var/lib/mesh/bazarr",
+      "mode": "0700"
+    },
+    {
+      "id": "config",
+      "type": "directory",
+      "path": "/services/bazarr/config",
+      "mode": "0700",
+      "owner": "1000:1000"
+    },
+    {
+      "id": "server",
+      "type": "container",
+      "name": "bazarr",
+      "image": "lscr.io/linuxserver/bazarr@sha256:3a820372f19fcb2981ea19fe4b5382934d67414afaba974bce831ddda0a64a02",
+      "env": {
+        "PUID": "1000",
+        "PGID": "1000",
+        "TZ": "Etc/UTC"
+      },
+      "ports": [
+        "6767"
+      ],
+      "volumes": [
+        "/services/bazarr/config:/config",
+        "/services/media/movies:/movies",
+        "/services/media/series:/series",
+        "/services/media/anime:/anime",
+        "/services/media/downloads:/downloads"
+      ]
+    },
+    {
+      "id": "runtime-config",
+      "type": "file",
+      "path": "/var/lib/mesh/bazarr/config.json",
+      "mode": "0600",
+      "content": "{}\n",
+      "merge": "json"
+    },
+    {
+      "id": "runtime",
+      "type": "container",
+      "name": "mesh-bazarr",
+      "network": "host",
+      "volumes": [
+        "/var/lib/mesh/bazarr/broker:/run/secrets/broker:ro",
+        "/var/lib/mesh/bazarr/api-key:/run/secrets/api-key:ro",
+        "/var/lib/mesh/bazarr/config.json:/run/config/config.json:ro",
+        "/services/bazarr/config:/var/lib/bazarr/config:ro"
+      ],
+      "env": {
+        "MESH_BROKER_FILE": "/run/secrets/broker",
+        "MESH_BAZARR_URL": "http://127.0.0.1:6767",
+        "MESH_BAZARR_API_KEY_FILE": "/run/secrets/api-key",
+        "MESH_BAZARR_CONFIG_FILE": "/run/config/config.json",
+        "MESH_BAZARR_CONFIG_DIR": "/var/lib/bazarr/config"
+      },
+      "restart-on": [
+        "runtime-config"
+      ],
+      "artifact": "runtime"
+    }
+  ],
+  "requires": [
+    "route"
+  ],
+  "contributes": {
+    "route": {
+      "label": "subs",
+      "endpoint": "web"
+    }
+  },
+  "binds": {
+    "route": "/var/lib/mesh/bazarr/route.json"
+  },
+  "build": {
+    "on": [
+      {
+        "arg": "BUILD_BASE",
+        "module": "mesh-tools",
+        "artifact": "build"
+      },
+      {
+        "arg": "RUNTIME_BASE",
+        "module": "mesh-tools",
+        "artifact": "runtime"
+      }
+    ],
+    "artifacts": [
+      {
+        "name": "runtime",
+        "kind": "image",
+        "from": "Dockerfile"
+      }
+    ]
+  }
+}

modules/bazarr/package.json

@@ -0,0 +1,14 @@
+{
+  "name": "@novox/module-bazarr",
+  "version": "0.1.0",
+  "description": "bazarr — subtitle management. Its API client, tools and events live here (novox/hq ADR 0039).",
+  "type": "module",
+  "private": true,
+  "dependencies": {
+    "@novox/mesh-sdk": "^0.1.0"
+  },
+  "devDependencies": {
+    "@types/node": "^22.0.0",
+    "typescript": "^5.6.0"
+  }
+}

modules/bazarr/tools/index.ts

@@ -0,0 +1,57 @@
+// bazarr's tools — its own code (novox/hq ADR 0039), importing bazarr's client. They return
+// structured data; the mesh serves them through the sdk's tool harness.
+
+import { registerModuleTools, type ToolDefinition } from "@novox/mesh-sdk/tools";
+import { BazarrClient } from "../client.js";
+
+export function getBazarrTools(bazarr: BazarrClient): ToolDefinition[] {
+  return [
+    {
+      name: "bazarr_wanted",
+      description: "Episodes and movies still missing subtitles, with the languages each still needs.",
+      input: { limit: { type: "number", description: "max items per kind (default 50)" } },
+      run: async (args) => {
+        const wanted = await bazarr.getWanted(args.limit ? Number(args.limit) : 50);
+        return { count: wanted.length, wanted };
+      },
+    },
+    {
+      name: "bazarr_search_subtitles",
+      description: "Manually search subtitle providers for one wanted item — pass an episodeId or a radarrId.",
+      input: {
+        episodeId: { type: "number", description: "a Sonarr episode id (from bazarr_wanted)" },
+        radarrId: { type: "number", description: "a Radarr movie id (from bazarr_wanted)" },
+      },
+      run: async (args) => {
+        if (args.episodeId !== undefined) {
+          const results = await bazarr.searchEpisode(Number(args.episodeId));
+          return { kind: "episode", episodeId: Number(args.episodeId), count: results.length, results };
+        }
+        if (args.radarrId !== undefined) {
+          const results = await bazarr.searchMovie(Number(args.radarrId));
+          return { kind: "movie", radarrId: Number(args.radarrId), count: results.length, results };
+        }
+        throw new Error("pass either episodeId or radarrId");
+      },
+    },
+    {
+      name: "bazarr_history",
+      description: "Recent subtitle-download history — what was downloaded, for which title, from which provider.",
+      input: { limit: { type: "number", description: "max entries per kind (default 40)" } },
+      run: async (args) => {
+        const history = await bazarr.getHistory(args.limit ? Number(args.limit) : 40);
+        return { count: history.length, history };
+      },
+    },
+  ];
+}
+
+// Exposed only when Bazarr is configured; otherwise bazarr contributes no tools rather than
+// failing the whole runtime.
+registerModuleTools("bazarr", (env) => {
+  try {
+    return getBazarrTools(BazarrClient.fromEnv(env));
+  } catch {
+    return [];
+  }
+});

modules/bazarr/tsconfig.json

@@ -8,8 +8,5 @@
     "skipLibCheck": true,
     "noEmit": true
   },
-  "include": [
-    "shell.ts",
-    "tools/index.ts"
-  ]
+  "include": ["client.ts", "index.ts", "tools/index.ts"]
 }

modules/bookshelf/Dockerfile

@@ -0,0 +1,24 @@
+# bookshelf's runtime: the tool runtime, carrying this module's compiled code.
+#
+# **Built from this module's own directory and nothing else.** The sdk and the tool runtime are in
+# the base images, published like any other artifact — which is what makes this buildable by the
+# mesh from a repository and a path (novox/hq ADR 0069) rather than only on a workstation that
+# happens to have the siblings.
+#
+# Two bases, named rather than pinned (novox/hq issue 044): the image this is COMPILED in and the
+# image it RUNS in — the second must not carry a compiler. Declared in module.json's `build.on`.
+ARG BUILD_BASE
+ARG RUNTIME_BASE
+
+FROM ${BUILD_BASE} AS build
+WORKDIR /app/modules/bookshelf
+COPY . .
+RUN node /app/node_modules/typescript/bin/tsc client.ts index.ts tools/index.ts \
+      --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist
+
+FROM ${RUNTIME_BASE}
+COPY --from=build /app/modules/bookshelf/dist /app/modules/bookshelf/dist
+# Every serve-time entrypoint, loaded by the runtime in serve mode: tools and events serve, and a
+# provider's provisioner runs its reconcile loop in the same process, with the broker connected —
+# the convention novox/hq issues 060/061 settled.
+ENV MESH_TOOL_MODULES=/app/modules/bookshelf/dist/index.js,/app/modules/bookshelf/dist/tools/index.js

modules/bookshelf/client.ts

@@ -0,0 +1,136 @@
+// The Bookshelf API client — bookshelf's own code, living in the module (novox/hq ADR 0039).
+// Ported from the shared hal `arr` client, but self-contained: in nox each Servarr app owns its own
+// copy, so a change to Bookshelf's API rebuilds only bookshelf and nothing else. Both this module's
+// tools and its events entrypoint import it, and nothing outside bookshelf does.
+//
+// Bookshelf is a Readarr fork (ghcr.io/pennydreadful/bookshelf). It speaks the Servarr v1 API; its
+// content is "book". Unlike Sonarr/Radarr it exposes no calendar endpoint, so there is no calendar
+// tool here — matching hal, which excluded bookshelf from its calendar-capable apps.
+
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+
+// Bookshelf speaks the v1 API; its content is "book".
+const API_VERSION = "v1";
+const CONTENT_ENDPOINT = "book";
+const APP_NAME = "Bookshelf";
+
+export interface BookshelfQueueItem {
+  /** The queue record id — stable while the item is in the queue, so events can diff on it. */
+  id: number;
+  title: string;
+  status: string;
+  size: string;
+  sizeleft: string;
+  timeleft?: string;
+}
+
+export interface BookshelfContentItem {
+  title: string;
+  author?: string;
+  year?: number;
+  status?: string;
+  monitored: boolean;
+}
+
+export class BookshelfClient {
+  readonly baseUrl: string;
+
+  constructor(
+    url: string,
+    private readonly apiKey: string,
+  ) {
+    this.baseUrl = url.replace(/\/$/, "");
+  }
+
+  /**
+   * Build from the module's resolved environment. The URL defaults to the server on this node (the
+   * runtime shares its network), and the API key is read from MESH_BOOKSHELF_API_KEY or, failing
+   * that, discovered from the server's own config.xml under MESH_BOOKSHELF_CONFIG_DIR — the same
+   * file Bookshelf writes it to, so a running server needs nothing configured by hand. Throws when
+   * no key can be found, so the tools/events simply do not load (the harness treats the throw as
+   * "exposes nothing").
+   */
+  static fromEnv(env: NodeJS.ProcessEnv = process.env): BookshelfClient {
+    const url = env.MESH_BOOKSHELF_URL ?? `http://127.0.0.1:${env.MESH_BOOKSHELF_PORT ?? "8787"}`;
+    const configDir = env.MESH_BOOKSHELF_CONFIG_DIR ?? "/config";
+    const apiKey = env.MESH_BOOKSHELF_API_KEY ?? BookshelfClient.detectApiKey(configDir);
+    if (!apiKey) {
+      throw new Error("Bookshelf not configured — set MESH_BOOKSHELF_API_KEY or make the config dir readable");
+    }
+    return new BookshelfClient(url, apiKey);
+  }
+
+  /** Discover the API key from the server's config.xml, falling back to null. Every Servarr app
+   *  writes <ApiKey> into config.xml at the root of its config directory. */
+  static detectApiKey(configDir: string): string | null {
+    const config = join(configDir, "config.xml");
+    if (existsSync(config)) {
+      const match = readFileSync(config, "utf8").match(/<ApiKey>([^<]+)<\/ApiKey>/);
+      if (match) return match[1];
+    }
+    return null;
+  }
+
+  private async get(endpoint: string, params?: Record<string, string>): Promise<unknown> {
+    const url = new URL(`${this.baseUrl}/api/${API_VERSION}/${endpoint}`);
+    if (params) {
+      for (const [k, v] of Object.entries(params)) url.searchParams.set(k, v);
+    }
+    const res = await fetch(url.toString(), { headers: { "X-Api-Key": this.apiKey } });
+    if (!res.ok) throw new Error(`${APP_NAME} API /${endpoint}: ${res.status} ${await res.text()}`);
+    return res.json();
+  }
+
+  async getStatus(): Promise<{ appName: string; version: string }> {
+    const data = (await this.get("system/status")) as { appName?: string; version?: string };
+    return { appName: data.appName || APP_NAME, version: data.version ?? "unknown" };
+  }
+
+  async getContent(limit?: number): Promise<BookshelfContentItem[]> {
+    const data = await this.get(CONTENT_ENDPOINT);
+    const items: any[] = Array.isArray(data) ? data : ((data as any)?.records ?? []);
+    const mapped = items.map((item) => ({
+      title: item.title ?? "Unknown",
+      author: item.author?.authorName ?? item.authorName,
+      year: item.releaseDate ? new Date(item.releaseDate).getFullYear() : item.year,
+      status: item.status,
+      monitored: item.monitored ?? true,
+    }));
+    return limit ? mapped.slice(0, limit) : mapped;
+  }
+
+  /** Library search is a filter over existing content, not an indexer lookup — same as hal's. */
+  async searchContent(term: string): Promise<BookshelfContentItem[]> {
+    const all = await this.getContent();
+    const lower = term.toLowerCase();
+    return all.filter(
+      (item) =>
+        item.title.toLowerCase().includes(lower) ||
+        (item.author?.toLowerCase().includes(lower) ?? false),
+    );
+  }
+
+  async getQueue(): Promise<{ totalRecords: number; items: BookshelfQueueItem[] }> {
+    const data = (await this.get("queue", { pageSize: "50" })) as { totalRecords?: number; records?: any[] };
+    const records = data.records ?? [];
+    return {
+      totalRecords: data.totalRecords ?? records.length,
+      items: records.map((r) => ({
+        id: r.id,
+        title: r.title ?? r.book?.title ?? r.author?.authorName ?? "Unknown",
+        status: r.status ?? "unknown",
+        size: formatBytes(r.size ?? 0),
+        sizeleft: formatBytes(r.sizeleft ?? 0),
+        timeleft: r.timeleft,
+      })),
+    };
+  }
+}
+
+function formatBytes(bytes: number): string {
+  if (bytes === 0) return "0 B";
+  const units = ["B", "KB", "MB", "GB", "TB"];
+  const i = Math.floor(Math.log(bytes) / Math.log(1024));
+  return `${(bytes / Math.pow(1024, i)).toFixed(1)} ${units[i]}`;
+}

modules/bookshelf/index.ts

@@ -0,0 +1,74 @@
+// bookshelf's events. The tool runtime imports this once the broker is bound. It watches the
+// download queue and turns its comings and goings into mesh events — the same mechanism radarr uses,
+// applied to a Servarr book manager.
+//
+// Emits (novox/hq ADR 0041/0042):
+//   module.bookshelf.book.grabbed        — a release entered the queue (Bookshelf grabbed it)
+//   module.bookshelf.download.completed  — a release left the queue, imported. This routing key is
+//                                          what the plex module consumes (module.*.download.completed)
+//                                          to rescan, so a new audiobook becomes a visible item.
+// Consumes: none.
+//
+// NOTE: the hal bookshelf module emitted no events (its hooks only did install-time provisioning).
+// This queue watcher is new in nox, modelled exactly on radarr's — bookshelf is a Servarr app with
+// the same queue semantics, so the diff-and-emit pattern carries over unchanged.
+//
+// The queue is polled and diffed, primed silently on the first look (like plex's index.ts) so a
+// restart mid-download does not re-announce everything already in flight as freshly grabbed.
+
+import { emit } from "@novox/mesh-sdk/events";
+import { BookshelfClient, type BookshelfQueueItem } from "./client.js";
+
+// Building the client throws when Bookshelf has no URL/key yet. Like the tools (see tools/index.ts),
+// the events entrypoint must not crash the runtime for that — it stays idle until configured.
+function buildClient(): BookshelfClient | null {
+  try {
+    return BookshelfClient.fromEnv();
+  } catch {
+    return null;
+  }
+}
+
+const bookshelf = buildClient();
+
+// Bookshelf removes an item from the queue once it has been imported; a "warning"/"failed" status is
+// how a stuck or broken grab shows itself, so we do not call those a completion when they vanish.
+const FAILED_STATUSES = new Set(["failed", "warning"]);
+
+const inQueue = new Map<number, BookshelfQueueItem>();
+let primed = false;
+
+async function pollQueue(bookshelf: BookshelfClient): Promise<void> {
+  const { items } = await bookshelf.getQueue();
+  const now = new Map(items.map((i) => [i.id, i]));
+
+  if (primed) {
+    // Entered the queue since last look — Bookshelf grabbed a release.
+    for (const [id, item] of now) {
+      if (!inQueue.has(id)) await emit("book.grabbed", { title: item.title, status: item.status });
+    }
+    // Left the queue — imported and done, unless it was last seen failing.
+    for (const [id, item] of inQueue) {
+      if (!now.has(id) && !FAILED_STATUSES.has(item.status)) {
+        await emit("download.completed", { title: item.title });
+      }
+    }
+  }
+
+  inQueue.clear();
+  for (const [id, item] of now) inQueue.set(id, item);
+  primed = true;
+}
+
+const tick = (fn: () => Promise<void>, everyMs: number): void => {
+  const run = (): void => void fn().catch((err) => console.error(`[bookshelf] ${err}`));
+  setInterval(run, everyMs);
+  run();
+};
+
+if (bookshelf) {
+  tick(() => pollQueue(bookshelf), 30_000);
+  console.log("[bookshelf] watching the download queue, emitting grabs and completions");
+} else {
+  console.log("[bookshelf] not configured — events idle until an API key is available");
+}

modules/bookshelf/module.json

@@ -0,0 +1,118 @@
+{
+  "module": "bookshelf",
+  "version": "1",
+  "slug": "books",
+  "capabilities": [
+    "container-runtime"
+  ],
+  "emits": [
+    "book.grabbed",
+    "download.completed"
+  ],
+  "consumes": [],
+  "own-secrets": {
+    "broker": "/var/lib/mesh/bookshelf/broker"
+  },
+  "listens": [
+    {
+      "name": "web",
+      "port": 8787,
+      "protocol": "tcp",
+      "from": "mesh",
+      "why": "managing the ebook/audiobook library"
+    }
+  ],
+  "accesses": [
+    {
+      "path": "/services/media/books",
+      "mode": "read-write"
+    },
+    {
+      "path": "/services/media/downloads",
+      "mode": "read-write"
+    }
+  ],
+  "resources": [
+    {
+      "id": "mesh-state",
+      "type": "directory",
+      "path": "/var/lib/mesh/bookshelf",
+      "mode": "0700"
+    },
+    {
+      "id": "config",
+      "type": "directory",
+      "path": "/services/bookshelf/config",
+      "mode": "0700",
+      "owner": "1000:1000"
+    },
+    {
+      "id": "server",
+      "type": "container",
+      "name": "bookshelf",
+      "image": "ghcr.io/pennydreadful/bookshelf@sha256:388eecc94362580eae31ee0a454be6af516f8a311f8432a521c202fb475f4359",
+      "env": {
+        "PUID": "1000",
+        "PGID": "1000",
+        "TZ": "Etc/UTC"
+      },
+      "ports": [
+        "8787"
+      ],
+      "volumes": [
+        "/services/bookshelf/config:/config",
+        "/services/media/books:/books",
+        "/services/media/downloads:/downloads"
+      ]
+    },
+    {
+      "id": "runtime",
+      "type": "container",
+      "name": "mesh-bookshelf",
+      "network": "host",
+      "volumes": [
+        "/var/lib/mesh/bookshelf/broker:/run/secrets/broker:ro",
+        "/services/bookshelf/config:/var/lib/bookshelf/config:ro"
+      ],
+      "env": {
+        "MESH_BROKER_FILE": "/run/secrets/broker",
+        "MESH_BOOKSHELF_URL": "http://127.0.0.1:8787",
+        "MESH_BOOKSHELF_CONFIG_DIR": "/var/lib/bookshelf/config"
+      },
+      "artifact": "runtime"
+    }
+  ],
+  "requires": [
+    "route"
+  ],
+  "contributes": {
+    "route": {
+      "label": "books",
+      "endpoint": "web"
+    }
+  },
+  "binds": {
+    "route": "/var/lib/mesh/bookshelf/route.json"
+  },
+  "build": {
+    "on": [
+      {
+        "arg": "BUILD_BASE",
+        "module": "mesh-tools",
+        "artifact": "build"
+      },
+      {
+        "arg": "RUNTIME_BASE",
+        "module": "mesh-tools",
+        "artifact": "runtime"
+      }
+    ],
+    "artifacts": [
+      {
+        "name": "runtime",
+        "kind": "image",
+        "from": "Dockerfile"
+      }
+    ]
+  }
+}

modules/bookshelf/package.json

@@ -0,0 +1,14 @@
+{
+  "name": "@novox/module-bookshelf",
+  "version": "0.1.0",
+  "description": "bookshelf — ebook/audiobook management (Readarr fork). Its API client, tools and events live here (novox/hq ADR 0039).",
+  "type": "module",
+  "private": true,
+  "dependencies": {
+    "@novox/mesh-sdk": "^0.1.0"
+  },
+  "devDependencies": {
+    "@types/node": "^22.0.0",
+    "typescript": "^5.6.0"
+  }
+}

modules/bookshelf/tools/index.ts

@@ -0,0 +1,69 @@
+// bookshelf's tools — ported from the shared hal `arr` sdk (novox/hq ADR 0039), importing
+// bookshelf's own client. They return structured data (not the pre-formatted text hal returned); the
+// mesh serves them through the sdk's tool harness. Bookshelf has no calendar endpoint, so there is
+// no calendar tool — matching hal, which excluded it from its calendar-capable apps.
+
+import { registerModuleTools, type ToolDefinition } from "@novox/mesh-sdk/tools";
+import { BookshelfClient } from "../client.js";
+
+export function getBookshelfTools(bookshelf: BookshelfClient): ToolDefinition[] {
+  return [
+    {
+      name: "bookshelf_status",
+      description: "Bookshelf status overview: version, book count, monitored count, queue size.",
+      input: {},
+      run: async () => {
+        const [status, content, queue] = await Promise.all([
+          bookshelf.getStatus(),
+          bookshelf.getContent(),
+          bookshelf.getQueue(),
+        ]);
+        return {
+          app: status.appName,
+          version: status.version,
+          books: content.length,
+          monitored: content.filter((c) => c.monitored).length,
+          queue: queue.totalRecords,
+        };
+      },
+    },
+    {
+      name: "bookshelf_library",
+      description: "List books from the Bookshelf library.",
+      input: { limit: { type: "number", description: "max items to return (default 50)" } },
+      run: async (args) => {
+        const items = await bookshelf.getContent(args.limit ? Number(args.limit) : 50);
+        return { count: items.length, books: items };
+      },
+    },
+    {
+      name: "bookshelf_search",
+      description:
+        "Search the Bookshelf library for books by title or author (filters existing content, not indexers).",
+      input: { query: { type: "string", description: "the search term" } },
+      run: async (args) => {
+        const query = String(args.query);
+        return { query, results: await bookshelf.searchContent(query) };
+      },
+    },
+    {
+      name: "bookshelf_queue",
+      description: "Show the Bookshelf download queue — what is downloading and how far along.",
+      input: {},
+      run: async () => {
+        const queue = await bookshelf.getQueue();
+        return { count: queue.totalRecords, items: queue.items };
+      },
+    },
+  ];
+}
+
+// The tools exist only when Bookshelf is configured; without a URL and key, bookshelf contributes
+// none rather than failing the whole runtime.
+registerModuleTools("bookshelf", (env) => {
+  try {
+    return getBookshelfTools(BookshelfClient.fromEnv(env));
+  } catch {
+    return [];
+  }
+});

modules/bookshelf/tsconfig.json

@@ -8,8 +8,5 @@
     "skipLibCheck": true,
     "noEmit": true
   },
-  "include": [
-    "tools/index.ts",
-    "client.ts"
-  ]
+  "include": ["client.ts", "index.ts", "tools/index.ts"]
 }

modules/build-agent/README.md

@@ -1,15 +0,0 @@
-# build-agent
-
-The mesh's build machine as a role every machine can hold (novox/hq ADR 0190). It holds the node seat
-`node-build-agent`: every holder pulls one build at a time from the role's one work queue when it is
-idle, so a tier of many images is built by as many machines as hold the seat and are online, and a
-machine that is off builds nothing and blocks nothing. The controller asks the role, never a machine;
-the outcome names the machine that built it.
-
-What a holding machine needs is what the builder always needed, said here once: a container runtime
-(the socket is mounted), the artifact store and the package registry as provisions, a workspace, and
-the bus credential. The code is `cmd/mesh-builder` in the mesh-controller repository, compiled from
-that repository's main (`build.artifacts[].context`); this module ships the packaging.
-
-Assign it to every machine with a container runtime. It replaces `builder`, the one-holder form of the
-same thing; retire that once this is assigned where it was.

modules/builder/Dockerfile

@@ -1,6 +1,6 @@
 ARG GO_BASE
 ARG ALPINE_BASE
-# build-agent's image: the build machine itself, compiled into a container (novox/hq ADR 0190).
+# builder's own image: the build machine itself, compiled into a container.
 #
 # **The source is not vendored here.** builder's actual code — cmd/mesh-builder, internal/builder,
 # internal/catalogue — lives in the mesh-controller repository, the same control plane it is one

modules/builder/module.json

@@ -1,14 +1,13 @@
 {
-  "module": "build-agent",
+  "module": "builder",
   "version": "1",
-  "slug": "agent",
   "capabilities": [
     "container-runtime"
   ],
   "claims": [
     {
-      "name": "node-build-agent",
-      "scope": "node"
+      "name": "mesh-build-machine",
+      "scope": "mesh"
     }
   ],
   "requires": [
@@ -16,48 +15,49 @@
     "npm-package-registry"
   ],
   "binds": {
-    "npm-package-registry": "${dir:mesh-state}/package-registry.json"
+    "npm-package-registry": "/var/lib/mesh/builder/package-registry.json"
   },
   "secrets": {
-    "npm-package-registry": "${dir:mesh-state}/package-registry.secret"
+    "npm-package-registry": "/var/lib/mesh/builder/package-registry.secret"
   },
   "own-secrets": {
-    "broker": "${dir:mesh-state}/broker"
+    "broker": "/var/lib/mesh/builder/broker"
   },
   "resources": [
     {
       "id": "mesh-state",
       "type": "directory",
-      "mode": "0700",
-      "place": "mesh"
+      "path": "/var/lib/mesh/builder",
+      "mode": "0700"
     },
     {
       "id": "workspace",
       "type": "directory",
+      "path": "/var/lib/builder/workspace",
       "mode": "0700"
     },
     {
-      "id": "agent-env",
+      "id": "builder-env",
       "type": "file",
-      "path": "${dir:mesh-state}/build-agent.env",
+      "path": "/var/lib/mesh/builder/builder.env",
       "mode": "0600",
-      "content": "MESH_BROKER_FILE=/run/mesh/broker\nMESH_NODE=${machine:name}\nMESH_REGISTRY=${bound:artifact-store:at}:${bound:artifact-store:port}\nMESH_PACKAGE_BINDING=/run/mesh/package-registry.json\nMESH_NPM_TOKEN_FILE=/run/mesh/package-registry.secret\nMESH_WORKSPACE=${dir:workspace}\n"
+      "content": "MESH_BROKER_FILE=/run/mesh/broker\nMESH_NODE=${machine:name}\nMESH_REGISTRY=${bound:artifact-store:at}:${bound:artifact-store:port}\nMESH_PACKAGE_BINDING=/run/mesh/package-registry.json\nMESH_NPM_TOKEN_FILE=/run/mesh/package-registry.secret\nMESH_WORKSPACE=/var/lib/builder/workspace\n"
     },
     {
       "id": "server",
       "type": "container",
-      "name": "mesh-build-agent",
+      "name": "mesh-builder",
       "artifact": "server",
       "env-file": [
-        "${dir:mesh-state}/build-agent.env"
+        "/var/lib/mesh/builder/builder.env"
       ],
       "volumes": [
-        "${dir:mesh-state}:/run/mesh:ro",
-        "${dir:workspace}:${dir:workspace}",
+        "/var/lib/mesh/builder:/run/mesh:ro",
+        "/var/lib/builder/workspace:/var/lib/builder/workspace",
         "/var/run/docker.sock:/var/run/docker.sock"
       ],
       "restart-on": [
-        "agent-env"
+        "builder-env"
       ],
       "network": "host"
     }

modules/claude-code/README.md

@@ -1,74 +0,0 @@
-# claude-code
-
-The operator's agent on a machine (novox/hq design 36): its package, its machine-wide managed
-configuration, and the consumer side of the Anthropic licence manager (design 39, ADR 0183).
-
-## What it owns
-
-Two directories, declared, so the mesh refuses a second module owning either:
-
-- `/etc/claude-code`, the agent's machine-wide managed directory, root's, `0755`.
-- `~/.claude` under the operator account's home, the operator's, `0700`. The module owns the directory —
-  that it exists, who owns it, its mode — and of what is inside only what it writes. Everything else
-  in it (memory, history, projects, local settings, a person's own rules and skills) is the person's
-  and is never read or written (hq ADR 0182). Unassigned, the module leaves the directory: the host
-  removes a directory only when it is empty.
-
-## What it writes
-
-Under the agent's managed directory, `/etc/claude-code`, owned whole by this module and rewritten
-whenever the node's tool runtime collects the module's tools:
-
-| file | holds |
-|---|---|
-| `managed-mcp.json` | the tool servers every session loads: the mesh's console as `mesh`, and the servers set in this module's `mcp_servers` setting. **Exclusive**: a server not listed here does not load — not one added with `claude mcp add`, not a project's `.mcp.json`, not a plugin's |
-| `managed-settings.json` | the repositories' attribution convention, the claude.ai connectors kept beside the managed servers, and the key-helper while the node holds an API-key licence |
-| `CLAUDE.md` | how a session on this mesh works, this node's name and role, the conventions |
-
-Under the operator's home, only `~/.claude/.credentials.json`, and only when the licence manager hands
-this node a subscription token. Nothing else under the home is read or written.
-
-## Over NATS
-
-Everything between this module and the rest of the mesh is NATS, in three kinds: an **event** says that
-something happened and carries no secret, because a stream keeps it; a **request** carries a token,
-because nothing keeps it (hq design 32 §10); and **state** is the current value of something every node
-must see, a node that joins later included — kept, so it carries no secret either (hq ADR 0201).
-
-| what | how |
-|---|---|
-| the licence manager rotated a licence, or switched this node | its `licence.rotated` / `licence.switched` event; this module then asks `anthropic-licence-manager.current` for its token, sealed to the key it sends |
-| this node starts | it asks `current` once, so a node that was off catches up |
-| a person ran `/login` here | the credentials file gains a refresh token this module never writes; it asks `anthropic-licence-manager.adopt` at once with the grant sealed to the manager's key — the one time a refresh token travels, because the login made the manager's stale |
-| an MCP server registered through this module | a key in the module's `servers` state — `all.<server>` for every node, `<node>.<server>` for one; every node watches it and renders what applies to it, a node's own entry over the one for every node. A node that joins later, or was off, reads the whole current set at start; unregistering is a delete. An entry with a secret in its `env` or `headers` is refused by the runtime |
-
-## Tools
-
-`claude_code_status`, `claude_code_render`, `claude_code_pull`, `claude_code_mcp_list`,
-`claude_code_mcp_register` (this node by default; `nodes: "all"` or a list for more — called for this
-node alone, its answer names the other nodes running claude-code), `claude_code_mcp_unregister`.
-
-## Settings
-
-Per node or for the whole mesh, through `mesh-controller.settings module=claude-code`:
-
-- `role` — what this node is, in a few words; shown to every session.
-- `mcp_servers` — extra tool servers, set by the operator for the mesh or a node, beside the ones
-  registered through the tools; keyed by name, in the vendor's `.mcp.json` entry shape
-  (`{"type":"http","url":…}` or `{"type":"stdio","command":…,"args":[…]}`). The name `mesh` is the
-  module's own and cannot be set. Put a person's own servers here, or they stop loading.
-
-## On a machine that carried the predecessor
-
-Remove these by hand, once; the mesh removes nothing it did not make (ADR 0182):
-
-- `~/.claude/CLAUDE.md`
-- `~/.claude/rules/00-hal-mesh.md`, `~/.claude/rules/conventions.md`
-- `~/.claude/skills/cleanup/`, `~/.claude/skills/hal-switch-license/`
-- the hand-made console entry in `~/.claude.json` under `mcpServers` — it is ignored now anyway
-
-## Escalation
-
-Writing `/etc/claude-code` needs root. The runtime runs as the operator account, and the module uses
-that account's passwordless `sudo`; on a machine without it, `claude_code_render` says so and nothing
-is written.

modules/claude-code/grant.ts

@@ -1,112 +0,0 @@
-// The agent's credentials file, and whether an offered grant may replace what it holds (novox/hq
-// ADR 0183, design 36 §5). Pure where it decides, so the rules are tested without a file.
-//
-// The file is the vendor's: `{ claudeAiOauth: { accessToken, expiresAt, refreshTokenExpiresAt?,
-// scopes?, subscriptionType?, rateLimitTier? }, ... }`. A node never holds a refresh token, so the
-// one this module writes never carries one, and a full grant a login left behind is stripped the
-// moment the manager hands the node its own.
-//
-// The lineage rule is the predecessor's, with the incidents that earned it: a rotation of the same
-// licence is applied only if newer; a grant re-issued by a login is adopted whatever its expiry; a
-// switch to another licence is applied regardless, because across licences the expiries are
-// unrelated numbers.
-
-import { readFileSync, renameSync, writeFileSync, mkdirSync } from "node:fs";
-import { dirname } from "node:path";
-
-export interface Grant {
-  readonly accessToken: string;
-  readonly expiresAt: number;
-  readonly refreshTokenExpiresAt?: number | null;
-  readonly scopes?: readonly string[] | null;
-  readonly subscriptionType?: string | null;
-  readonly rateLimitTier?: string | null;
-}
-
-export type ApplySource = "rotation" | "switch";
-
-export type ApplyDecision =
-  | { apply: true; reissued?: boolean }
-  | { apply: false; reason: "already-current" }
-  | { apply: false; reason: "not-newer"; localExpiresAt: number };
-
-/** Two refresh-token expiries within a day are one lineage; a login starts a fresh window weeks away. */
-export const GENERATION_TOLERANCE_MS = 24 * 60 * 60 * 1000;
-
-export function sameGeneration(a?: number | null, b?: number | null): boolean {
-  if (a == null || b == null) return true;
-  return Math.abs(Number(a) - Number(b)) <= GENERATION_TOLERANCE_MS;
-}
-
-export function decideApply(local: Grant | null | undefined, offered: Grant, source: ApplySource): ApplyDecision {
-  if (!local?.accessToken) return { apply: true };
-  if (local.accessToken === offered.accessToken) return { apply: false, reason: "already-current" };
-  const reissued = !sameGeneration(local.refreshTokenExpiresAt, offered.refreshTokenExpiresAt);
-  if (source === "rotation" && !reissued && Number(local.expiresAt) >= Number(offered.expiresAt)) {
-    return { apply: false, reason: "not-newer", localExpiresAt: Number(local.expiresAt) };
-  }
-  return reissued ? { apply: true, reissued: true } : { apply: true };
-}
-
-type Oauth = Record<string, unknown> & { accessToken?: string; refreshToken?: string; expiresAt?: number };
-type Credentials = Record<string, unknown> & { claudeAiOauth?: Oauth };
-
-export function readCredentials(path: string): Credentials | null {
-  try {
-    const parsed = JSON.parse(readFileSync(path, "utf8")) as Credentials;
-    return parsed && typeof parsed === "object" ? parsed : null;
-  } catch {
-    return null;
-  }
-}
-
-/** The grant the file holds, or null. */
-export function grantOf(creds: Credentials | null): Grant | null {
-  const o = creds?.claudeAiOauth;
-  if (!o?.accessToken) return null;
-  return {
-    accessToken: o.accessToken,
-    expiresAt: Number(o.expiresAt ?? 0),
-    refreshTokenExpiresAt: o.refreshTokenExpiresAt == null ? null : Number(o.refreshTokenExpiresAt),
-  };
-}
-
-/** Does the file hold a full grant — a refresh token this module never writes, so a person's login? */
-export function holdsLogin(creds: Credentials | null): boolean {
-  return typeof creds?.claudeAiOauth?.refreshToken === "string" && creds.claudeAiOauth.refreshToken.length > 0;
-}
-
-/**
- * The handed grant laid over what is there — a rotation of the licence the node already holds — or,
- * for a switch, in place of it: the old licence's grant goes whole, scopes and subscription included,
- * and only keys outside the grant (another kind of credential the vendor keeps in the file) stay.
- * Either way, no refresh token survives.
- */
-export function replacedBy(local: Credentials | null, grant: Grant): Credentials {
-  const next: Credentials = { ...(local ?? {}) };
-  delete next.claudeAiOauth;
-  return withGrant(next, grant);
-}
-
-/** Overlay the handed grant on what is there, and delete any refresh token. */
-export function withGrant(local: Credentials | null, grant: Grant): Credentials {
-  const next: Credentials = { ...(local ?? {}) };
-  const oauth: Oauth = { ...(local?.claudeAiOauth ?? {}) };
-  oauth.accessToken = grant.accessToken;
-  oauth.expiresAt = grant.expiresAt;
-  for (const k of ["refreshTokenExpiresAt", "scopes", "subscriptionType", "rateLimitTier"] as const) {
-    const v = grant[k];
-    if (v != null) oauth[k] = v as unknown;
-  }
-  delete oauth.refreshToken;
-  next.claudeAiOauth = oauth;
-  return next;
-}
-
-/** Write atomically at 0600: a partial credentials file must never be read as a whole one. */
-export function writeCredentials(path: string, creds: Credentials): void {
-  mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
-  const tmp = `${path}.mesh-tmp`;
-  writeFileSync(tmp, JSON.stringify(creds, null, 2) + "\n", { mode: 0o600 });
-  renameSync(tmp, path);
-}

modules/claude-code/identity.ts

@@ -1,50 +0,0 @@
-// Which account the agent is logged in as (novox/hq ADR 0183): not in the token, but in the agent's
-// own state file beside the home, `~/.claude.json` → `oauthAccount`. Read to attribute a login; written,
-// three keys and nothing else, when a licence is switched, so the file Claude Code shows the account from
-// names the account whose token it now holds (as the predecessor learned: two files that disagree make
-// a later login look like the wrong account).
-
-import { readFileSync, renameSync, writeFileSync } from "node:fs";
-
-export interface Identity {
-  readonly accountUuid: string;
-  readonly emailAddress?: string;
-  readonly organizationUuid?: string;
-}
-
-export function readIdentity(stateFile: string): Identity | null {
-  try {
-    const raw = JSON.parse(readFileSync(stateFile, "utf8")) as { oauthAccount?: Record<string, unknown> };
-    const a = raw.oauthAccount;
-    if (!a || typeof a.accountUuid !== "string") return null;
-    return {
-      accountUuid: a.accountUuid,
-      emailAddress: typeof a.emailAddress === "string" ? a.emailAddress : undefined,
-      organizationUuid: typeof a.organizationUuid === "string" ? a.organizationUuid : undefined,
-    };
-  } catch {
-    return null;
-  }
-}
-
-/**
- * Point the state file's account at `id`, keeping every other key as found. Returns whether the file
- * changed; a file that cannot be read as an object is left alone rather than replaced.
- */
-export function writeIdentity(stateFile: string, id: Identity): boolean {
-  let raw: Record<string, unknown>;
-  try {
-    raw = JSON.parse(readFileSync(stateFile, "utf8")) as Record<string, unknown>;
-    if (!raw || typeof raw !== "object") return false;
-  } catch {
-    raw = {};
-  }
-  const current = (raw.oauthAccount ?? {}) as Record<string, unknown>;
-  if (current.accountUuid === id.accountUuid && current.emailAddress === id.emailAddress
-      && current.organizationUuid === id.organizationUuid) return false;
-  raw.oauthAccount = { ...current, accountUuid: id.accountUuid, emailAddress: id.emailAddress, organizationUuid: id.organizationUuid };
-  const tmp = `${stateFile}.mesh-tmp`;
-  writeFileSync(tmp, JSON.stringify(raw, null, 2), { mode: 0o600 });
-  renameSync(tmp, stateFile);
-  return true;
-}

modules/claude-code/module.json

@@ -1,90 +0,0 @@
-{
-  "module": "claude-code",
-  "version": "1",
-  "slug": "agent",
-  "capabilities": [
-    "package-manager"
-  ],
-  "requires": [
-    "mcp-endpoint"
-  ],
-  "binds": {
-    "mcp-endpoint": "${dir:state}/mcp-endpoint.json"
-  },
-  "consumes": [
-    "claude-licence-manager.licence.rotated",
-    "claude-licence-manager.licence.switched"
-  ],
-  "state": [
-    "servers"
-  ],
-  "tools": [
-    "claude_code_status",
-    "claude_code_render",
-    "claude_code_pull",
-    "claude_code_mcp_list",
-    "claude_code_mcp_register",
-    "claude_code_mcp_unregister"
-  ],
-  "resources": [
-    {
-      "id": "package",
-      "type": "package",
-      "package": "claude-code"
-    },
-    {
-      "id": "managed",
-      "type": "directory",
-      "path": "/etc/claude-code",
-      "mode": "0755"
-    },
-    {
-      "id": "agent-home",
-      "type": "directory",
-      "path": "${machine:account-home}/.claude",
-      "mode": "0700",
-      "owner": "${machine:account}"
-    },
-    {
-      "id": "state",
-      "type": "directory",
-      "mode": "0700",
-      "owner": "${machine:account}",
-      "place": "."
-    },
-    {
-      "id": "facts",
-      "type": "file",
-      "path": "${dir:state}/facts.json",
-      "mode": "0600",
-      "owner": "${machine:account}",
-      "content": "{\n  \"node\": \"${machine:name}\",\n  \"console\": \"http://127.0.0.1:${bound:mcp-endpoint:port}/mcp\"\n}\n"
-    },
-    {
-      "id": "settings",
-      "type": "file",
-      "path": "${dir:state}/settings.json",
-      "mode": "0600",
-      "owner": "${machine:account}",
-      "merge": "json",
-      "content": "{\n  \"role\": \"\",\n  \"mcp_servers\": {}\n}\n"
-    }
-  ],
-  "build": {
-    "artifacts": [
-      {
-        "name": "tools",
-        "kind": "bundle",
-        "language": "typescript",
-        "entrypoints": [
-          "tools/index.js"
-        ],
-        "env": {
-          "MESH_CLAUDE_CODE_STATE": "${dir:state}",
-          "MESH_CLAUDE_CODE_FACTS": "${dir:state}/facts.json",
-          "MESH_CLAUDE_CODE_SETTINGS": "${dir:state}/settings.json"
-        }
-      }
-    ]
-  }
-}

modules/claude-code/node.ts

@@ -1,271 +0,0 @@
-// What claude-code does on a node, written against two things it is handed — a way to ask a tool on the
-// bus and a way to emit an event — so every path is tested without a bus (novox/hq design 36 §4–§5,
-// ADR 0183, ADR 0198).
-//
-// **Over NATS, in two kinds** (design 32 §10): an event says that something happened and carries no
-// secret, because a stream keeps it; a token travels on a request, which nothing keeps. So:
-//   - the licence manager's `licence.rotated` and `licence.switched` events tell this module to ask the
-//     seat for its current token, sealed to the key it sends with the request;
-//   - a login a person made here — a refresh token this module never writes — is offered to the seat at
-//     once, sealed to the seat's key: the one moment a refresh token travels, because the login made the
-//     manager's stale;
-//   - an MCP server registered through this module is **state, not an event** (novox/hq ADR 0201): one
-//     key per server in the module's `servers` bucket — `all.<server>` for every node, `<node>.<server>`
-//     for one — which every node watches. A node that joins later, or was off, reads the whole current set
-//     at start; unregistering is a delete. A secret never goes in an entry: the runtime refuses one.
-
-import { chmodSync, existsSync, readFileSync, rmSync, writeFileSync } from "node:fs";
-import { join } from "node:path";
-
-import { render, entryProblem, MANAGED_DIR, type Binding, type Facts, type Settings, type Servers } from "./render.js";
-import { generateKeyPair, open, seal, type SealedBox } from "./seal.js";
-import { decideApply, grantOf, holdsLogin, readCredentials, replacedBy, withGrant, writeCredentials, type Grant } from "./grant.js";
-import { readIdentity, writeIdentity, type Identity } from "./identity.js";
-
-export const SEAT = "anthropic-licence-manager";
-
-export interface Paths {
-  state: string;
-  facts: string;
-  settings: string;
-  home: string;
-  node: string;
-}
-
-/** A tool on the bus: its address and arguments in, its JSON answer out. */
-export type Ask = (address: string, args: Record<string, unknown>) => Promise<unknown>;
-/** An event of this module's, by its local name. */
-export type Emit = (type: string, body: unknown) => Promise<void>;
-/** Write one managed file; answers what happened. */
-export type WriteManaged = (name: string, content: string) => string;
-
-export const readJson = <T>(p: string, fallback: T): T => {
-  try {
-    return JSON.parse(readFileSync(p, "utf8")) as T;
-  } catch {
-    return fallback;
-  }
-};
-
-const credentialsPath = (p: Paths) => join(p.home, ".claude", ".credentials.json");
-const accountPath = (p: Paths) => join(p.home, ".claude.json");
-const bindingPath = (p: Paths) => join(p.state, "licence.json");
-const apiKeyPath = (p: Paths) => join(p.state, "api-key");
-export const helperPath = (p: Paths) => join(p.state, "api-key-helper");
-const keyPath = (p: Paths) => join(p.state, "key.pem");
-const pubPath = (p: Paths) => join(p.state, "key.pub.pem");
-const registryPath = (p: Paths) => join(p.state, "mcp-servers.json");
-
-export function keypair(p: Paths): { publicKey: string; privateKey: string } {
-  if (!existsSync(keyPath(p))) {
-    const k = generateKeyPair();
-    writeFileSync(keyPath(p), k.privateKey, { mode: 0o600 });
-    writeFileSync(pubPath(p), k.publicKey, { mode: 0o644 });
-  }
-  return { privateKey: readFileSync(keyPath(p), "utf8"), publicKey: readFileSync(pubPath(p), "utf8") };
-}
-
-export function registered(p: Paths): Servers {
-  return readJson<Servers>(registryPath(p), {});
-}
-
-export function renderNow(p: Paths, write: WriteManaged): string[] {
-  const facts = readJson<Facts | null>(p.facts, null);
-  if (!facts?.console) throw new Error(`the mesh has not rendered ${p.facts} yet; nothing to write`);
-  const files = render(facts, readJson<Settings>(p.settings, {}), readJson<Binding | null>(bindingPath(p), null),
-    helperPath(p), registered(p));
-  return Object.entries(files).map(([name, content]) => write(name, content));
-}
-
-// ---- the licence ----------------------------------------------------------------------------------
-
-/** What the seat answers to `current`: the licence this node is bound to and its token, sealed. */
-export interface Current {
-  licence: string;
-  kind: "subscription" | "api-key";
-  sealed: SealedBox;
-  identity?: Identity | null;
-}
-
-/** Ask the seat for this node's current token and apply it. */
-export async function pull(p: Paths, ask: Ask, write: WriteManaged): Promise<Record<string, unknown>> {
-  const answer = (await ask(`${SEAT}.current`, { node: p.node, public_key: keypair(p).publicKey })) as Current | null;
-  if (!answer?.sealed) return { applied: false, reason: "the seat holds no licence for this node" };
-  return apply(p, answer, write);
-}
-
-/** Apply what the seat handed over. A switch replaces the grant whole and cleans up after the old licence. */
-export function apply(p: Paths, handed: Current, write: WriteManaged): Record<string, unknown> {
-  const plain = open(handed.sealed, keypair(p).privateKey);
-  const previous = readJson<Binding | null>(bindingPath(p), null);
-  const switched = previous?.licence !== handed.licence;
-  let outcome: Record<string, unknown> = { applied: true, licence: handed.licence, kind: handed.kind, switched };
-  if (handed.kind === "api-key") {
-    writeFileSync(apiKeyPath(p), plain.trim() + "\n", { mode: 0o600 });
-    writeFileSync(helperPath(p), `#!/bin/sh\nexec cat '${apiKeyPath(p)}'\n`, { mode: 0o700 });
-    chmodSync(helperPath(p), 0o700);
-  } else {
-    const grant = JSON.parse(plain) as Grant;
-    const local = readCredentials(credentialsPath(p));
-    const d = decideApply(grantOf(local), grant, switched ? "switch" : "rotation");
-    if (d.apply) writeCredentials(credentialsPath(p), switched ? replacedBy(local, grant) : withGrant(local, grant));
-    else outcome = { applied: false, licence: handed.licence, reason: "reason" in d ? d.reason : undefined }; // narrowed by hand: the build compiles without strict
-    // Away from the API key: it goes, with its helper.
-    rmSync(apiKeyPath(p), { force: true });
-    rmSync(helperPath(p), { force: true });
-  }
-  if (switched && handed.identity?.accountUuid) {
-    outcome.account = writeIdentity(accountPath(p), handed.identity) ? "updated" : "unchanged";
-  }
-  writeFileSync(bindingPath(p), JSON.stringify({ licence: handed.licence, kind: handed.kind }) + "\n", { mode: 0o600 });
-  try {
-    outcome.rendered = renderNow(p, write); // the key-helper comes or goes with the licence's kind
-  } catch (err) {
-    outcome.rendered = { failed: err instanceof Error ? err.message : String(err) };
-  }
-  return outcome;
-}
-
-/** A licence event from the manager: is it for this node? */
-export function concerns(p: Paths, type: string, body: { licence?: string; node?: string }): boolean {
-  if (type.endsWith("licence.switched")) return body.node === p.node;
-  if (type.endsWith("licence.rotated")) return body.licence === readJson<Binding | null>(bindingPath(p), null)?.licence;
-  return false;
-}
-
-/** A refresh token in the credentials file is a login: this module never writes one. Offer it to the seat. */
-export async function offerLogin(p: Paths, ask: Ask): Promise<Record<string, unknown> | null> {
-  const creds = readCredentials(credentialsPath(p));
-  if (!holdsLogin(creds)) return null;
-  const key = (await ask(`${SEAT}.public_key`, {})) as { public_key?: string } | null;
-  if (!key?.public_key) throw new Error("the licence manager did not say what key to seal a login to");
-  return (await ask(`${SEAT}.adopt`, {
-    node: p.node,
-    identity: readIdentity(accountPath(p)),
-    sealed: seal(JSON.stringify(creds!.claudeAiOauth), key.public_key),
-  })) as Record<string, unknown>;
-}
-
-// ---- MCP servers ----------------------------------------------------------------------------------
-
-export interface Registration {
-  name: string;
-  entry?: Record<string, unknown>;
-  /** Which nodes: this one (absent), every node running the module ("all"), or a list. */
-  nodes?: "all" | string[];
-}
-
-/** The `servers` state, as this module reaches it through the runtime (`state("servers")` in the SDK). */
-export interface ServerState {
-  put(key: string, value: Record<string, unknown>): Promise<number>;
-  delete(key: string): Promise<void>;
-  keys(): Promise<string[]>;
-}
-
-/** One change to the `servers` state, as a watch hands it over. */
-export interface ServerChange {
-  key: string;
-  op: "put" | "delete";
-  value?: Record<string, unknown>;
-}
-
-/** The key a registration lives at: `all.<server>` for every node, `<node>.<server>` for one. */
-export const keyOf = (scope: string, name: string) => `${scope}.${name}`;
-
-/**
- * What this node takes from the `servers` state: the entries for every node and for this one, by key —
- * kept in memory from the watch, and written through to the module's own file whenever what applies here
- * changes, so the managed directory can be rendered without the bus.
- */
-export class ServerView {
-  private readonly entries = new Map<string, Record<string, unknown>>();
-  constructor(private readonly p: Paths) {}
-
-  /** Take one change; answers whether what applies to this node changed. */
-  take(c: ServerChange): boolean {
-    const dot = c.key.indexOf(".");
-    const scope = c.key.slice(0, dot), name = c.key.slice(dot + 1);
-    if (dot <= 0 || (scope !== "all" && scope !== this.p.node)) return false;
-    if (c.op === "put" && c.value && entryProblem(name, c.value) === null) this.entries.set(c.key, c.value);
-    else this.entries.delete(c.key);
-    return this.writeThrough();
-  }
-
-  /** What applies here: every node's entries, with this node's own laid over them by server name. */
-  effective(): Servers {
-    const out: Record<string, Record<string, unknown>> = {};
-    for (const scope of ["all", this.p.node]) {
-      for (const [key, entry] of [...this.entries].sort(([a], [b]) => a.localeCompare(b))) {
-        if (key.startsWith(scope + ".")) out[key.slice(scope.length + 1)] = entry;
-      }
-    }
-    return out;
-  }
-
-  private writeThrough(): boolean {
-    const now = JSON.stringify(this.effective(), null, 2) + "\n";
-    let before = "";
-    try {
-      before = readFileSync(registryPath(this.p), "utf8");
-    } catch {
-      /* none yet */
-    }
-    if (now === before) return false;
-    writeFileSync(registryPath(this.p), now, { mode: 0o600 });
-    return true;
-  }
-}
-
-/** A change from the watch: take it, and render when what applies here changed. */
-export function onServerChange(view: ServerView, c: ServerChange, p: Paths, write: WriteManaged): string | null {
-  if (!view.take(c)) return null;
-  renderNow(p, write);
-  return `${c.op === "put" ? "registered" : "unregistered"} ${c.key}`;
-}
-
-const scopesOf = (p: Paths, nodes: Registration["nodes"]): string[] =>
-  nodes === undefined ? [p.node] : nodes === "all" ? ["all"] : nodes;
-
-/**
- * Register (or with no entry, unregister) a server: a put (or delete) per scope in the `servers` state.
- * Taken into this node's view at once, so the answer says what it did here; every other node takes it
- * from its watch, and a node that joins later from the current state.
- */
-export async function registerServer(p: Paths, r: Registration, servers: ServerState, view: ServerView,
-                                     write: WriteManaged, others: () => Promise<string[]>): Promise<Record<string, unknown>> {
-  if (r.entry) {
-    const problem = entryProblem(r.name, r.entry);
-    if (problem) return { registered: false, reason: problem };
-  }
-  const scopes = scopesOf(p, r.nodes);
-  // Compared before and after rather than read from take(): this node's own watch may hand the view the
-  // same change first, and then take() here finds nothing new although this call made it.
-  const before = JSON.stringify(view.effective());
-  for (const scope of scopes) {
-    const key = keyOf(scope, r.name);
-    if (r.entry) await servers.put(key, r.entry);
-    else await servers.delete(key);
-    view.take({ key, op: r.entry ? "put" : "delete", value: r.entry });
-  }
-  const changedHere = JSON.stringify(view.effective()) !== before;
-  const here = scopes.includes("all") || scopes.includes(p.node);
-  const answer: Record<string, unknown> = {
-    [r.entry ? "registered" : "unregistered"]: r.name,
-    on: r.nodes === undefined ? [p.node] : r.nodes,
-    here: here ? (changedHere ? "changed" : "already so") : "not this node",
-    rendered: changedHere ? renderNow(p, write) : [],
-  };
-  if (!r.entry && view.effective()[r.name]) {
-    answer.still = `${r.name} still applies here from another registration (for every node, or for this one); unregister that too`;
-  }
-  if (r.nodes === undefined) {
-    // The question the operator wanted asked: here only, or more?
-    const elsewhere = (await others().catch(() => [] as string[])).filter((n) => n !== p.node);
-    answer.also = elsewhere.length
-      ? `claude-code also runs on ${elsewhere.join(", ")}. To ${r.entry ? "register" : "unregister"} it there too, call again with nodes: "all" or a list of those nodes.`
-      : `To do the same on every node running claude-code, call again with nodes: "all".`;
-  }
-  return answer;
-}
-
-export { MANAGED_DIR };

modules/claude-code/package.json

@@ -1,18 +0,0 @@
-{
-  "name": "@novox/module-claude-code",
-  "version": "0.1.0",
-  "description": "claude-code — the operator's agent on a machine: its managed configuration, and the consumer side of the Anthropic licence manager (novox/hq design 36).",
-  "type": "module",
-  "private": true,
-  "scripts": {
-    "build": "tsc seal.ts grant.ts identity.ts render.ts node.ts tools/index.ts --module NodeNext --moduleResolution NodeNext --target ES2022 --rootDir . --outDir dist",
-    "test": "npm run build && node --test --experimental-strip-types 'test/*.test.ts'"
-  },
-  "dependencies": {
-    "@novox/mesh-sdk": "^0.1.7"
-  },
-  "devDependencies": {
-    "@types/node": "^22.0.0",
-    "typescript": "^5.6.0"
-  }
-}

modules/claude-code/render.ts

@@ -1,135 +0,0 @@
-// What the module writes into the agent's machine-wide managed directory (novox/hq design 36 §1–§4).
-// Pure: composed from the facts the mesh rendered, the settings the operator set and the licence the
-// node holds, so what lands under /etc is tested without a machine.
-//
-// Three files, owned whole by this module:
-//   managed-mcp.json        the tool servers every session loads: the mesh's console as `mesh`, and the
-//                           servers the operator declared for the mesh or this node. Exclusive by the
-//                           vendor's rule — a server not listed here does not load — which is why the
-//                           list is the module's settings and nothing else (operator's choice, 2026-10-03).
-//   managed-settings.json   the mesh's keys only: the repositories' attribution convention, the
-//                           claude.ai connectors kept beside the managed servers, and — for an API-key
-//                           licence only — the key-helper. A person's preferences are theirs.
-//   CLAUDE.md               how a session on this mesh works, who this node is, the conventions.
-
-export const MANAGED_DIR = "/etc/claude-code";
-
-export interface Facts {
-  readonly node: string;
-  readonly console: string;
-}
-
-export interface Settings {
-  readonly role?: string;
-  /** Extra tool servers, in the vendor's `.mcp.json` entry shape, keyed by name. */
-  readonly mcp_servers?: Readonly<Record<string, Record<string, unknown>>>;
-}
-
-export interface Binding {
-  readonly licence: string;
-  readonly kind: "subscription" | "api-key";
-}
-
-export interface Rendered {
-  readonly [file: string]: string;
-}
-
-const MESH_ENTRY = "mesh";
-
-export type Servers = Readonly<Record<string, Record<string, unknown>>>;
-
-/** Whether an entry is one the vendor's managed file takes: a name of letters, digits, `-` and `_`, and
- *  an http/sse server with a url or a stdio server with a command. Returns why not, or null. */
-export function entryProblem(name: string, entry: Record<string, unknown>): string | null {
-  if (!/^[A-Za-z0-9_-]+$/.test(name)) return `"${name}" is not a name the agent takes: letters, digits, - and _`;
-  if (name === MESH_ENTRY) return `"${MESH_ENTRY}" is the mesh's own entry`;
-  const type = entry?.type ?? "stdio";
-  if (type === "http" || type === "sse" || type === "streamable-http") {
-    return typeof entry.url === "string" && entry.url ? null : `an ${type} server needs a url`;
-  }
-  if (type === "stdio") return typeof entry.command === "string" && entry.command ? null : "a stdio server needs a command";
-  return `"${String(type)}" is not a server type the agent knows (http, sse, stdio)`;
-}
-
-/**
- * Compose the three files. `registered` is the module's own list on this node — what was registered
- * through its tools — laid over the servers the operator set in its settings.
- */
-export function render(facts: Facts, settings: Settings, binding: Binding | null, helperPath: string,
-                       registered: Servers = {}): Rendered {
-  const servers: Record<string, unknown> = {};
-  for (const [name, entry] of Object.entries({ ...(settings.mcp_servers ?? {}), ...registered })) {
-    if (entryProblem(name, entry) !== null) continue; // the mesh's own entry, or one the agent would refuse
-    servers[name] = entry;
-  }
-  servers[MESH_ENTRY] = { type: "http", url: facts.console };
-
-  const managed: Record<string, unknown> = {
-    attribution: { commit: "", pr: "" },
-    allowAllClaudeAiMcps: true,
-  };
-  if (binding?.kind === "api-key") managed.apiKeyHelper = helperPath;
-
-  return {
-    "managed-mcp.json": json({ mcpServers: sortKeys(servers) }),
-    "managed-settings.json": json(managed),
-    "CLAUDE.md": instructions(facts, settings),
-  };
-}
-
-function json(v: unknown): string {
-  return JSON.stringify(v, null, 2) + "\n";
-}
-
-function sortKeys(o: Record<string, unknown>): Record<string, unknown> {
-  return Object.fromEntries(Object.keys(o).sort().map((k) => [k, o[k]]));
-}
-
-export function instructions(facts: Facts, settings: Settings): string {
-  const role = settings.role?.trim() ? settings.role.trim() : "not stated — set it in this module's settings for the node";
-  return `# This machine is a node of a Novox mesh
-
-Written by the mesh's \`claude-code\` module. Edit the module's settings or the catalogue, never this file:
-it is rewritten whenever the module renders.
-
-## Who this node is
-
-- **Node:** \`${facts.node}\`
-- **Role:** ${role}
-- The other nodes, their roles and what runs where: ask the controller (\`mesh-controller.nodes\`,
-  \`mesh-controller.node\`). Nothing here lists them, because a copy drifts.
-
-## How a session on this mesh works
-
-The console is the only way to the mesh: the MCP server named \`mesh\`. It offers five tools, and
-everything else is an address you find and call through them:
-
-- \`mesh_search\` — words in, matching addresses out. \`mesh_describe\` — one address's arguments.
-- \`mesh_call\` — call an address. A seat the mesh holds once is \`<seat>.<verb>\` (the mesh's own verbs
-  are \`mesh-controller.<verb>\`: \`status\`, \`plan\`, \`node\`, \`assign\`, \`push\`, \`settings\`);
-  a module on a machine is \`<node>/<module>.<tool>\`.
-- \`mesh_overview\` and \`mesh_machine\` — the mesh's seats and machines, and what one machine runs.
-
-- **Symptom first.** For an error, a failing service or anything unexpected, search the record with the
-  literal text before forming a hypothesis: the records module's \`records_search\`, then
-  \`records_read\`.
-- **Ask the mesh before changing it**, and change it through the controller's verbs or the catalogue.
-- **A licence** through the \`anthropic-licence-manager\` seat's verbs. Never edit the agent's credentials
-  file by hand, never print or ask for a token.
-
-## Hard rules
-
-- A file the mesh manages is changed through the verb or the catalogue that owns it, never on disk. If
-  unsure, \`mesh-controller.plan\` for the node says what the mesh writes there.
-- Never write to a store's database by hand; schema changes are numbered migrations.
-- Never push to a main branch: a branch, a pull request, and a human approval for every merge.
-- The mesh creates no symlinks, and nobody else does either.
-- A package is declared in a module, never installed by hand.
-
-## Conventions
-
-- Commit messages are concise, in the imperative, about why.
-- Test before pushing: nodes update unattended.
-- The playbooks in the record say how research, decisions, designs, issues and hand-offs are done.
-`;
-}

modules/claude-code/seal.ts

@@ -1,77 +0,0 @@
-// Sealing a token to one recipient (novox/hq ADR 0183): the manager seals what it hands a node to that
-// node's agent module key, and a node seals a waiting login to the key the manager names. X25519 for
-// the agreement, HKDF-SHA256 for the key, AES-256-GCM for the box — all from Node's own library, so a
-// bundle carries no dependency and no secret ever crosses the bus in the clear.
-//
-// A sealed box is `{ v: 1, eph, iv, tag, ct }`, every field base64. `eph` is a one-time public key, so
-// two boxes of one value to one recipient share nothing, and only the recipient's private key opens it.
-
-import {
-  createCipheriv, createDecipheriv, createPrivateKey, createPublicKey, diffieHellman,
-  generateKeyPairSync, hkdfSync, randomBytes, type KeyObject,
-} from "node:crypto";
-
-export interface SealedBox {
-  readonly v: 1;
-  readonly eph: string;
-  readonly iv: string;
-  readonly tag: string;
-  readonly ct: string;
-}
-
-/** A recipient's keypair, as the two PEM strings it is kept and published as. */
-export interface KeyPairPem {
-  readonly publicKey: string;
-  readonly privateKey: string;
-}
-
-const INFO = Buffer.from("novox-mesh sealed box v1");
-
-export function generateKeyPair(): KeyPairPem {
-  const { publicKey, privateKey } = generateKeyPairSync("x25519");
-  return {
-    publicKey: publicKey.export({ type: "spki", format: "pem" }).toString(),
-    privateKey: privateKey.export({ type: "pkcs8", format: "pem" }).toString(),
-  };
-}
-
-function keyFor(secret: Buffer, eph: Buffer, recipient: Buffer): Buffer {
-  // The ephemeral and the recipient's public halves are bound into the key, so a box cannot be
-  // re-addressed to another recipient by swapping its `eph`.
-  return Buffer.from(hkdfSync("sha256", secret, Buffer.concat([eph, recipient]), INFO, 32));
-}
-
-function rawPublic(key: KeyObject): Buffer {
-  return key.export({ type: "spki", format: "der" }).subarray(-32);
-}
-
-export function seal(plaintext: string, recipientPublicPem: string): SealedBox {
-  const recipient = createPublicKey(recipientPublicPem);
-  const eph = generateKeyPairSync("x25519");
-  const secret = diffieHellman({ privateKey: eph.privateKey, publicKey: recipient });
-  const ephRaw = eph.publicKey.export({ type: "spki", format: "der" });
-  const key = keyFor(secret, ephRaw, rawPublic(recipient));
-  const iv = randomBytes(12);
-  const cipher = createCipheriv("aes-256-gcm", key, iv);
-  const ct = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
-  return {
-    v: 1,
-    eph: ephRaw.toString("base64"),
-    iv: iv.toString("base64"),
-    tag: cipher.getAuthTag().toString("base64"),
-    ct: ct.toString("base64"),
-  };
-}
-
-/** Open a box with the recipient's private key. Throws on a box for another key or one tampered with. */
-export function open(box: SealedBox, privateKeyPem: string): string {
-  if (!box || box.v !== 1) throw new Error("not a sealed box this module can open");
-  const priv = createPrivateKey(privateKeyPem);
-  const ephRaw = Buffer.from(box.eph, "base64");
-  const eph = createPublicKey({ key: ephRaw, format: "der", type: "spki" });
-  const secret = diffieHellman({ privateKey: priv, publicKey: eph });
-  const key = keyFor(secret, ephRaw, rawPublic(createPublicKey(priv)));
-  const decipher = createDecipheriv("aes-256-gcm", key, Buffer.from(box.iv, "base64"));
-  decipher.setAuthTag(Buffer.from(box.tag, "base64"));
-  return Buffer.concat([decipher.update(Buffer.from(box.ct, "base64")), decipher.final()]).toString("utf8");
-}

modules/claude-code/test/grant.test.ts

@@ -1,54 +0,0 @@
-import { test } from "node:test";
-import assert from "node:assert/strict";
-import { mkdtempSync, readFileSync, statSync, writeFileSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-import {
-  decideApply, grantOf, holdsLogin, readCredentials, withGrant, writeCredentials, type Grant,
-} from "../dist/grant.js";
-
-const NOW = 1_700_000_000_000;
-const HOUR = 3_600_000;
-const g = (over: Partial<Grant> = {}): Grant => ({
-  accessToken: "tok-A", expiresAt: NOW + HOUR, refreshTokenExpiresAt: NOW + 30 * 24 * HOUR, ...over,
-});
-
-test("a rotation applies a newer grant of the same licence", () => {
-  assert.deepEqual(decideApply(g(), g({ accessToken: "tok-B", expiresAt: NOW + 2 * HOUR }), "rotation"), { apply: true });
-});
-
-test("a rotation refuses a grant that arrived late and is older", () => {
-  const d = decideApply(g({ accessToken: "new", expiresAt: NOW + 2 * HOUR }), g({ accessToken: "old" }), "rotation");
-  assert.equal(d.apply === false && d.reason, "not-newer");
-});
-
-test("a grant re-issued by a login is adopted even though it expires sooner (2026-09-05)", () => {
-  const local = g({ expiresAt: NOW + 8 * HOUR, refreshTokenExpiresAt: NOW + 30 * 24 * HOUR });
-  const offered = g({ accessToken: "reissued", expiresAt: NOW + HOUR, refreshTokenExpiresAt: NOW + 5 * 24 * HOUR });
-  assert.deepEqual(decideApply(local, offered, "rotation"), { apply: true, reissued: true });
-});
-
-test("a switch to another licence applies whatever the expiries say", () => {
-  const local = g({ expiresAt: NOW + 8 * HOUR });
-  assert.equal(decideApply(local, g({ accessToken: "other", expiresAt: NOW + HOUR }), "switch").apply, true);
-});
-
-test("the same token is not rewritten", () => {
-  assert.deepEqual(decideApply(g(), g(), "switch"), { apply: false, reason: "already-current" });
-});
-
-test("a full grant left by a login is seen as a login, and stripped when the node's own is written", () => {
-  const dir = mkdtempSync(join(tmpdir(), "claude-code-"));
-  const path = join(dir, ".claude", ".credentials.json");
-  writeFileSync(join(dir, "x"), "");
-  const login = { claudeAiOauth: { accessToken: "at-login", refreshToken: "rt-login", expiresAt: NOW }, other: 1 };
-  assert.equal(holdsLogin(login), true);
-  writeCredentials(path, withGrant(login, g({ accessToken: "at-mesh", scopes: ["user:inference"] })));
-  const back = readCredentials(path)!;
-  assert.equal(holdsLogin(back), false);
-  assert.equal(grantOf(back)!.accessToken, "at-mesh");
-  assert.deepEqual(back.claudeAiOauth!.scopes, ["user:inference"]);
-  assert.equal(back.other, 1, "a key the module does not know was lost");
-  assert.ok(!readFileSync(path, "utf8").includes("rt-login"));
-  assert.equal(statSync(path).mode & 0o777, 0o600);
-});

modules/claude-code/test/identity.test.ts

@@ -1,19 +0,0 @@
-import { test } from "node:test";
-import assert from "node:assert/strict";
-import { mkdtempSync, writeFileSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-import { readIdentity } from "../dist/identity.js";
-
-test("the account is read from the agent's state file", () => {
-  const p = join(mkdtempSync(join(tmpdir(), "cc-id-")), ".claude.json");
-  writeFileSync(p, JSON.stringify({ oauthAccount: { accountUuid: "u-1", emailAddress: "a@example.org" }, other: 2 }));
-  assert.deepEqual(readIdentity(p), { accountUuid: "u-1", emailAddress: "a@example.org", organizationUuid: undefined });
-});
-
-test("no state file, or no account in it, is no identity rather than a guess", () => {
-  assert.equal(readIdentity("/nonexistent/.claude.json"), null);
-  const p = join(mkdtempSync(join(tmpdir(), "cc-id-")), ".claude.json");
-  writeFileSync(p, "{}");
-  assert.equal(readIdentity(p), null);
-});

modules/claude-code/test/node.test.ts

@@ -1,173 +0,0 @@
-import { test } from "node:test";
-import assert from "node:assert/strict";
-import { existsSync, mkdirSync, mkdtempSync, readFileSync, writeFileSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-import {
-  apply, concerns, keypair, offerLogin, onServerChange, pull, registerServer, registered, ServerView, type Paths,
-  type ServerChange, type ServerState,
-} from "../dist/node.js";
-import { generateKeyPair, open, seal } from "../dist/seal.js";
-
-const NOW = Date.now();
-function node(name = "laptop"): { p: Paths; written: Record<string, string> } {
-  const root = mkdtempSync(join(tmpdir(), "cc-node-"));
-  const p = { state: join(root, "state"), facts: join(root, "state", "facts.json"), settings: join(root, "state", "settings.json"), home: join(root, "home"), node: name };
-  mkdirSync(p.state, { recursive: true });
-  mkdirSync(join(p.home, ".claude"), { recursive: true });
-  writeFileSync(p.facts, JSON.stringify({ node: name, console: "http://127.0.0.1:4270/mcp" }));
-  writeFileSync(p.settings, JSON.stringify({ role: "", mcp_servers: {} }));
-  return { p, written: {} };
-}
-const writer = (w: Record<string, string>) => (name: string, content: string) => { w[name] = content; return `${name}: written`; };
-const creds = (p: Paths) => JSON.parse(readFileSync(join(p.home, ".claude", ".credentials.json"), "utf8"));
-const grantFor = (p: Paths, licence: string, token: string, kind: "subscription" | "api-key" = "subscription", identity?: object) => ({
-  licence, kind, identity,
-  sealed: seal(kind === "api-key" ? token : JSON.stringify({ accessToken: token, expiresAt: NOW + 3_600_000, refreshTokenExpiresAt: NOW + 86_400_000, subscriptionType: licence }), keypair(p).publicKey),
-});
-
-test("a pull asks the seat with this node's key and applies what it answers", async () => {
-  const { p, written } = node();
-  let asked: [string, Record<string, unknown>] | null = null;
-  const r = await pull(p, async (address, args) => { asked = [address, args]; return grantFor(p, "personal", "at-1"); }, writer(written));
-  assert.equal(asked![0], "anthropic-licence-manager.current");
-  assert.equal(asked![1].node, "laptop");
-  assert.match(String(asked![1].public_key), /BEGIN PUBLIC KEY/);
-  assert.equal(r.applied, true);
-  assert.equal(creds(p).claudeAiOauth.accessToken, "at-1");
-  assert.ok(written["managed-mcp.json"]);
-});
-
-test("a switch replaces the old licence's grant whole and points the account at the new one", () => {
-  const { p, written } = node();
-  writeFileSync(join(p.home, ".claude.json"), JSON.stringify({ oauthAccount: { accountUuid: "old" }, projects: { keep: 1 } }));
-  apply(p, grantFor(p, "personal", "at-1"), writer(written));
-  const r = apply(p, grantFor(p, "work", "at-2", "subscription", { accountUuid: "new", emailAddress: "w@example.org" }), writer(written));
-  assert.equal(r.switched, true);
-  assert.equal(creds(p).claudeAiOauth.accessToken, "at-2");
-  assert.equal(creds(p).claudeAiOauth.subscriptionType, "work", "the old licence's subscription type survived the switch");
-  const account = JSON.parse(readFileSync(join(p.home, ".claude.json"), "utf8"));
-  assert.equal(account.oauthAccount.accountUuid, "new");
-  assert.deepEqual(account.projects, { keep: 1 });
-});
-
-test("switching to the API key adds the key-helper; switching away removes the key and the helper", () => {
-  const { p, written } = node();
-  apply(p, grantFor(p, "api", "sk-key", "api-key"), writer(written));
-  assert.ok(JSON.parse(written["managed-settings.json"]).apiKeyHelper);
-  assert.ok(existsSync(join(p.state, "api-key")));
-  apply(p, grantFor(p, "personal", "at-1"), writer(written));
-  assert.ok(!("apiKeyHelper" in JSON.parse(written["managed-settings.json"])));
-  assert.ok(!existsSync(join(p.state, "api-key")) && !existsSync(join(p.state, "api-key-helper")));
-});
-
-test("a rotation event concerns the node bound to that licence; a switch event the node it names", () => {
-  const { p, written } = node();
-  apply(p, grantFor(p, "personal", "at-1"), writer(written));
-  assert.equal(concerns(p, "claude-licence-manager.licence.rotated", { licence: "personal" }), true);
-  assert.equal(concerns(p, "claude-licence-manager.licence.rotated", { licence: "work" }), false);
-  assert.equal(concerns(p, "claude-licence-manager.licence.switched", { node: "laptop", licence: "work" }), true);
-  assert.equal(concerns(p, "claude-licence-manager.licence.switched", { node: "server" }), false);
-});
-
-test("a login is offered to the seat sealed to the seat's key, with the account it belongs to", async () => {
-  const { p } = node();
-  const manager = generateKeyPair();
-  writeFileSync(join(p.home, ".claude", ".credentials.json"), JSON.stringify({ claudeAiOauth: { accessToken: "at-login", refreshToken: "rt-login", expiresAt: NOW } }));
-  writeFileSync(join(p.home, ".claude.json"), JSON.stringify({ oauthAccount: { accountUuid: "u-9" } }));
-  const calls: [string, Record<string, unknown>][] = [];
-  await offerLogin(p, async (address, args) => { calls.push([address, args]); return address.endsWith("public_key") ? { public_key: manager.publicKey } : { adopted: true }; });
-  assert.deepEqual(calls.map((c) => c[0]), ["anthropic-licence-manager.public_key", "anthropic-licence-manager.adopt"]);
-  const adopt = calls[1][1] as { identity: { accountUuid: string }; sealed: never };
-  assert.equal(adopt.identity.accountUuid, "u-9");
-  assert.equal(JSON.parse(open(adopt.sealed, manager.privateKey)).refreshToken, "rt-login");
-  assert.ok(!JSON.stringify(adopt).includes("rt-login"), "the refresh token crossed in the clear");
-});
-
-test("no refresh token in the file is no login, and nothing is asked", async () => {
-  const { p } = node();
-  writeFileSync(join(p.home, ".claude", ".credentials.json"), JSON.stringify({ claudeAiOauth: { accessToken: "at", expiresAt: NOW } }));
-  assert.equal(await offerLogin(p, async () => { throw new Error("asked"); }), null);
-});
-
-/** The `servers` state as the bus holds it, shared by every node in a test, with each node's watch. */
-function bus() {
-  const kept = new Map<string, Record<string, unknown>>();
-  const watchers: ((c: ServerChange) => void)[] = [];
-  const state: ServerState = {
-    put: async (key, value) => { kept.set(key, value); watchers.forEach((w) => w({ key, op: "put", value })); return kept.size; },
-    delete: async (key) => { kept.delete(key); watchers.forEach((w) => w({ key, op: "delete" })); },
-    keys: async () => [...kept.keys()].sort(),
-  };
-  /** A node joining: its view takes the current state, then every change. */
-  const join = (n: { p: Paths; written: Record<string, string> }) => {
-    const view = new ServerView(n.p);
-    for (const [key, value] of kept) onServerChange(view, { key, op: "put", value }, n.p, writer(n.written));
-    watchers.push((c) => onServerChange(view, c, n.p, writer(n.written)));
-    return view;
-  };
-  return { state, join, kept };
-}
-
-test("registering a server here puts it under this node's key, renders it, and asks about the other nodes", async () => {
-  const n = node();
-  const b = bus();
-  const view = b.join(n);
-  const r = await registerServer(n.p, { name: "search", entry: { type: "http", url: "https://s.example/mcp" } },
-    b.state, view, writer(n.written), async () => ["laptop", "server", "desktop"]);
-  assert.equal(r.here, "changed");
-  assert.match(String(r.also), /server, desktop/);
-  assert.deepEqual([...b.kept.keys()], ["laptop.search"]);
-  assert.ok(JSON.parse(n.written["managed-mcp.json"]).mcpServers.search);
-});
-
-test("registering for every node reaches the others through their watch, and a node joining later reads it", async () => {
-  const a = node("laptop"), s = node("server");
-  const b = bus();
-  const va = b.join(a);
-  b.join(s);
-  await registerServer(a.p, { name: "docs", entry: { type: "stdio", command: "docs-mcp" }, nodes: "all" },
-    b.state, va, writer(a.written), async () => []);
-  assert.deepEqual([...b.kept.keys()], ["all.docs"]);
-  assert.deepEqual(registered(s.p).docs, { type: "stdio", command: "docs-mcp" });
-  assert.ok(JSON.parse(s.written["managed-mcp.json"]).mcpServers.docs);
-  // The gap events left: a node assigned after the registration takes the whole current set at start.
-  const late = node("desktop");
-  b.join(late);
-  assert.deepEqual(registered(late.p).docs, { type: "stdio", command: "docs-mcp" });
-  // Unregistering is a delete, and every node's view drops it.
-  await registerServer(a.p, { name: "docs", nodes: "all" }, b.state, va, writer(a.written), async () => []);
-  assert.equal(registered(s.p).docs, undefined);
-  assert.equal(registered(late.p).docs, undefined);
-});
-
-test("a node's own registration overrides the one for every node; other nodes' keys leave this one alone", async () => {
-  const a = node("laptop"), s = node("server");
-  const b = bus();
-  const va = b.join(a);
-  const vs = b.join(s);
-  await registerServer(a.p, { name: "x", entry: { type: "http", url: "https://all" }, nodes: "all" }, b.state, va, writer(a.written), async () => []);
-  await registerServer(a.p, { name: "x", entry: { type: "http", url: "https://laptop" } }, b.state, va, writer(a.written), async () => []);
-  assert.equal(registered(a.p).x.url, "https://laptop");
-  assert.equal(registered(s.p).x.url, "https://all");
-  await registerServer(a.p, { name: "only", entry: { type: "http", url: "https://o" }, nodes: ["server"] }, b.state, va, writer(a.written), async () => []);
-  assert.equal(registered(a.p).only, undefined);
-  assert.equal(registered(s.p).only.url, "https://o");
-  // Unregistering here leaves the every-node one applying, and says so.
-  const r = await registerServer(a.p, { name: "x" }, b.state, va, writer(a.written), async () => []);
-  assert.match(String(r.still), /still applies here/);
-  assert.equal(registered(a.p).x.url, "https://all");
-  assert.equal(vs.effective().x.url, "https://all");
-});
-
-test("a bad entry is refused before anything is put; a repeated change changes nothing", async () => {
-  const n = node();
-  const b = bus();
-  const view = b.join(n);
-  const r = await registerServer(n.p, { name: "mesh", entry: { type: "http", url: "https://x" } }, b.state, view, writer(n.written), async () => []);
-  assert.equal(r.registered, false);
-  assert.equal(b.kept.size, 0);
-  assert.equal(onServerChange(view, { key: "all.a", op: "put", value: { type: "http", url: "https://a" } }, n.p, writer(n.written)), "registered all.a");
-  assert.equal(onServerChange(view, { key: "all.a", op: "put", value: { type: "http", url: "https://a" } }, n.p, writer(n.written)), null);
-  assert.equal(onServerChange(view, { key: "server.b", op: "put", value: { type: "http", url: "https://b" } }, n.p, writer(n.written)), null);
-});

modules/claude-code/test/render.test.ts

@@ -1,40 +0,0 @@
-import { test } from "node:test";
-import assert from "node:assert/strict";
-import { render } from "../dist/render.js";
-
-const facts = { node: "workstation", console: "http://127.0.0.1:4270/mcp" };
-
-test("the console is the `mesh` server, and an operator's servers are listed beside it", () => {
-  const out = render(facts, { mcp_servers: { search: { type: "http", url: "https://s.example/mcp" } } }, null, "/h");
-  const mcp = JSON.parse(out["managed-mcp.json"]);
-  assert.deepEqual(Object.keys(mcp.mcpServers), ["mesh", "search"]);
-  assert.deepEqual(mcp.mcpServers.mesh, { type: "http", url: facts.console });
-});
-
-test("a setting cannot replace the mesh's own entry, and a name the vendor refuses is left out", () => {
-  const out = render(facts, { mcp_servers: { mesh: { type: "http", url: "http://evil" }, "bad name": {} } }, null, "/h");
-  const mcp = JSON.parse(out["managed-mcp.json"]);
-  assert.equal(mcp.mcpServers.mesh.url, facts.console);
-  assert.ok(!("bad name" in mcp.mcpServers));
-});
-
-test("managed settings carry the mesh's keys only, and the key-helper only for an API-key licence", () => {
-  const sub = JSON.parse(render(facts, {}, { licence: "personal", kind: "subscription" }, "/h")["managed-settings.json"]);
-  assert.deepEqual(sub, { attribution: { commit: "", pr: "" }, allowAllClaudeAiMcps: true });
-  const key = JSON.parse(render(facts, {}, { licence: "api", kind: "api-key" }, "/state/api-key-helper")["managed-settings.json"]);
-  assert.equal(key.apiKeyHelper, "/state/api-key-helper");
-  assert.ok(!("model" in key), "a preference is the person's");
-});
-
-test("the instruction file names the node and its role, and no other node", () => {
-  const md = render(facts, { role: "the laptop" }, null, "/h")["CLAUDE.md"];
-  assert.match(md, /\*\*Node:\*\* `workstation`/);
-  assert.match(md, /\*\*Role:\*\* the laptop/);
-  assert.match(md, /mesh_call/);
-  assert.match(md, /records_search/);
-});
-
-test("rendering is deterministic, so an unchanged input writes nothing", () => {
-  const s = { mcp_servers: { b: { type: "http", url: "https://b" }, a: { type: "http", url: "https://a" } } };
-  assert.deepEqual(render(facts, s, null, "/h"), render(facts, s, null, "/h"));
-});

modules/claude-code/test/seal.test.ts

@@ -1,31 +0,0 @@
-import { test } from "node:test";
-import assert from "node:assert/strict";
-import { generateKeyPair, open, seal } from "../dist/seal.js";
-
-test("a box opens with its recipient's key and yields the value", () => {
-  const k = generateKeyPair();
-  assert.equal(open(seal("at-secret", k.publicKey), k.privateKey), "at-secret");
-});
-
-test("a box sealed for one node does not open with another node's key", () => {
-  const a = generateKeyPair();
-  const b = generateKeyPair();
-  assert.throws(() => open(seal("at-secret", a.publicKey), b.privateKey));
-});
-
-test("a tampered box is refused, not opened to garbage", () => {
-  const k = generateKeyPair();
-  const box = seal("at-secret", k.publicKey);
-  const ct = Buffer.from(box.ct, "base64");
-  ct[0] ^= 0xff;
-  assert.throws(() => open({ ...box, ct: ct.toString("base64") }, k.privateKey));
-});
-
-test("two boxes of one value share nothing a reader could compare", () => {
-  const k = generateKeyPair();
-  const x = seal("at-secret", k.publicKey);
-  const y = seal("at-secret", k.publicKey);
-  assert.notEqual(x.ct, y.ct);
-  assert.notEqual(x.eph, y.eph);
-  assert.ok(!JSON.stringify(x).includes("at-secret"));
-});

modules/claude-code/tools/index.ts

@@ -1,208 +0,0 @@
-// claude-code's bundle (novox/hq design 36, ADR 0183). The node's runtime launches it over stdio, as the
-// operator account (ADR 0193), and is its bus (ADR 0198): it asks tools, emits and consumes through the
-// runtime. It is given its state directory and two files the mesh renders into it (ADR 0192), beside the
-// runtime's own words. **stdout is the MCP channel**: everything this module says, it says on stderr.
-//
-// At start it renders the agent's managed directory, asks the licence manager for this node's token,
-// begins watching the credentials file for a login, takes the manager's licence events, and watches the
-// module's `servers` state — every node's MCP server registrations (novox/hq ADR 0201). node.ts holds the
-// logic.
-
-import { readFileSync, watchFile } from "node:fs";
-import { spawnSync } from "node:child_process";
-import { join } from "node:path";
-import { registerModuleTools, type ToolDefinition } from "@novox/mesh-sdk/tools";
-import { broker } from "@novox/mesh-sdk/messaging";
-import { on } from "@novox/mesh-sdk/events";
-import { state } from "@novox/mesh-sdk/state";
-
-import {
-  MANAGED_DIR, SEAT, ServerView, concerns, keypair, offerLogin, onServerChange, pull, readJson, registerServer,
-  registered, renderNow, type Ask, type Paths, type Registration, type ServerChange, type ServerState, type WriteManaged,
-} from "../node.js";
-import { grantOf, holdsLogin, readCredentials } from "../grant.js";
-import { createHash } from "node:crypto";
-
-const say = (line: string) => console.error(`[claude-code] ${line}`);
-const fingerprint = (s: string) => "sha256:" + createHash("sha256").update(s).digest("hex").slice(0, 16);
-
-function pathsFrom(env: NodeJS.ProcessEnv): Paths | null {
-  const state = env.MESH_CLAUDE_CODE_STATE, facts = env.MESH_CLAUDE_CODE_FACTS;
-  const settings = env.MESH_CLAUDE_CODE_SETTINGS, home = env.MESH_OPERATOR_HOME, node = env.MESH_NODE;
-  if (!state || !facts || !settings || !home || !node) return null;
-  return { state, facts, settings, home, node };
-}
-
-/** Write one managed file as root, only when its content changed. */
-const writeManaged: WriteManaged = (name, content) => {
-  const path = join(MANAGED_DIR, name);
-  try {
-    if (readFileSync(path, "utf8") === content) return `${name}: unchanged`;
-  } catch {
-    /* absent */
-  }
-  const asRoot = process.getuid?.() === 0;
-  const cmd = asRoot ? ["install", "-D", "-m", "0644", "/dev/stdin", path] : ["sudo", "-n", "install", "-D", "-m", "0644", "/dev/stdin", path];
-  const r = spawnSync(cmd[0], cmd.slice(1), { input: content, encoding: "utf8" });
-  if (r.status !== 0) {
-    throw new Error(`${name}: could not be written to ${MANAGED_DIR} (${(r.stderr || r.error?.message || "").trim()}); ` +
-      `the module writes there through the operator account's passwordless sudo`);
-  }
-  return `${name}: written`;
-};
-
-/** A tool on the bus, through the runtime; its MCP answer read back as JSON where it is JSON. */
-const ask: Ask = async (address, args) => {
-  const answer = (await broker().request<Record<string, unknown>, { content?: { text?: string }[]; isError?: boolean }>(address, args)) ?? {};
-  const text = answer.content?.map((c) => c.text ?? "").join("") ?? "";
-  if (answer.isError) throw new Error(`${address}: ${text}`);
-  try {
-    return JSON.parse(text);
-  } catch {
-    return text;
-  }
-};
-
-/** The nodes claude-code runs on, from the controller's list of modules — for the register tool's question. */
-async function nodesRunningMe(): Promise<string[]> {
-  const out = await ask("mesh-controller.modules", {});
-  const text = typeof out === "string" ? out : String((out as { output?: string })?.output ?? "");
-  const line = text.split("\n").find((l) => /^claude-code\s/.test(l)) ?? "";
-  const on = line.split(" on ")[1] ?? "";
-  return on.trim() === "nothing" ? [] : on.split(",").map((s) => s.trim()).filter(Boolean);
-}
-
-function status(p: Paths): Record<string, unknown> {
-  const creds = readCredentials(join(p.home, ".claude", ".credentials.json"));
-  const grant = grantOf(creds);
-  const managed = ["managed-mcp.json", "managed-settings.json", "CLAUDE.md"].map((f) => {
-    try {
-      return { file: join(MANAGED_DIR, f), fingerprint: fingerprint(readFileSync(join(MANAGED_DIR, f), "utf8")) };
-    } catch {
-      return { file: join(MANAGED_DIR, f), fingerprint: null };
-    }
-  });
-  return {
-    node: p.node,
-    licence: readJson(join(p.state, "licence.json"), null),
-    token: grant ? { fingerprint: fingerprint(grant.accessToken), expiresAt: new Date(grant.expiresAt).toISOString(),
-      loginWaiting: holdsLogin(creds) } : null,
-    managed,
-    registered: Object.keys(registered(p)),
-  };
-}
-
-/** The module's MCP servers on the bus (ADR 0201): its own state, which every node of it watches. */
-const servers = () => state<Record<string, unknown>>("servers") as unknown as ServerState;
-
-/** What this node takes from that state, kept from the watch. One per process. */
-let view: ServerView | null = null;
-const viewOf = (p: Paths) => (view ??= new ServerView(p));
-
-function tools(p: Paths): ToolDefinition[] {
-  const nodesArg = { type: "string", description: 'more nodes: "all" for every node running claude-code, or a comma-separated list; absent is this node only' };
-  const nodesOf = (v: unknown): Registration["nodes"] =>
-    v === undefined || v === "" ? undefined : v === "all" ? "all" : String(v).split(",").map((s) => s.trim()).filter(Boolean);
-  return [
-    {
-      name: "claude_code_status",
-      description: "Claude Code on this machine as the mesh configured it: the licence it holds and when its token expires, the managed files, the MCP servers registered here. Fingerprints only, never a token.",
-      input: {},
-      run: async () => status(p),
-    },
-    {
-      name: "claude_code_render",
-      description: "Write Claude Code's managed directory now, from the mesh's facts, this module's settings and the servers registered here.",
-      input: {},
-      run: async () => ({ rendered: renderNow(p, writeManaged) }),
-    },
-    {
-      name: "claude_code_pull",
-      description: "Ask the licence manager for this node's current token now and apply it, rather than waiting for its next event.",
-      input: {},
-      run: async () => pull(p, ask, writeManaged),
-    },
-    {
-      name: "claude_code_mcp_list",
-      description: "The MCP servers registered through this module: those that apply on this node (beside the console, `mesh`, and those set in the module's settings), and every registration on the mesh, by key — `all.<server>` for every node, `<node>.<server>` for one.",
-      input: {},
-      run: async () => ({ here: registered(p), everywhere: await servers().keys() }),
-    },
-    {
-      name: "claude_code_mcp_register",
-      description: "Register an MCP server with Claude Code on this node, every node, or a list — an http/sse server by url, or a stdio server by command. Kept on the bus, so a node that joins later takes it too. Never put a secret in env or headers: the mesh refuses one.",
-      input: {
-        name: { type: "string", description: "the server's name: letters, digits, - and _" },
-        type: { type: "string", description: "http, sse or stdio (default stdio when a command is given, http when a url is)" },
-        url: { type: "string", description: "an http or sse server's url" },
-        command: { type: "string", description: "a stdio server's program" },
-        args: { type: "array", description: "a stdio server's arguments" },
-        env: { type: "object", description: "a stdio server's environment" },
-        headers: { type: "object", description: "an http server's headers" },
-        nodes: nodesArg,
-      },
-      run: async (a) => {
-        const entry: Record<string, unknown> = { type: a.type ?? (a.url ? "http" : "stdio") };
-        for (const k of ["url", "command", "args", "env", "headers"]) if (a[k] !== undefined) entry[k] = a[k];
-        return registerServer(p, { name: String(a.name ?? ""), entry, nodes: nodesOf(a.nodes) }, servers(), viewOf(p), writeManaged, nodesRunningMe);
-      },
-    },
-    {
-      name: "claude_code_mcp_unregister",
-      description: "Remove an MCP server registered through this module, on this node or more.",
-      input: { name: { type: "string", description: "the server's name" }, nodes: nodesArg },
-      run: async (a) => registerServer(p, { name: String(a.name ?? ""), nodes: nodesOf(a.nodes) }, servers(), viewOf(p), writeManaged, nodesRunningMe),
-    },
-  ];
-}
-
-registerModuleTools("claude-code", (env) => {
-  const p = pathsFrom(env);
-  if (!p) return [];
-  try {
-    keypair(p);
-    for (const line of renderNow(p, writeManaged)) if (!line.endsWith("unchanged")) say(line);
-  } catch (err) {
-    say(err instanceof Error ? err.message : String(err));
-  }
-  return tools(p);
-});
-
-// Launched by the runtime: the bus is there from the first line (ADR 0198). Outside it — a test, a
-// build — nothing below runs.
-const p = process.env.MESH_SERVED_MODULE ? pathsFrom(process.env) : null;
-if (p) {
-  const loud = (what: string) => (err: unknown) => say(`${what}: ${err instanceof Error ? err.message : String(err)}`);
-
-  void on<{ licence?: string; node?: string }>("claude-licence-manager.licence.*", async (event) => {
-    if (!concerns(p, event.type, event.body ?? {})) return;
-    say(`${event.type} — asking ${SEAT} for this node's token`);
-    say(JSON.stringify(await pull(p, ask, writeManaged).catch((e) => ({ failed: String(e) }))));
-  }).catch(loud("the licence events"));
-
-  // Every node's MCP servers: the whole current set first, then each change (ADR 0201). Awaited, so the
-  // managed directory holds every server that applies here before the bundle says what it serves.
-  try {
-    await state<Record<string, unknown>>("servers").watch((c) => {
-      try {
-        const done = onServerChange(viewOf(p), c as ServerChange, p, writeManaged);
-        if (done) say(done);
-      } catch (err) {
-        loud(`taking ${c.op} ${c.key}`)(err); // the view took it; the next render writes it
-      }
-    });
-  } catch (err) {
-    loud("watching the MCP servers")(err);
-  }
-
-  // Catch up once at start: a node that was off takes its current token now.
-  void pull(p, ask, writeManaged).then((r) => say(`at start: ${JSON.stringify(r)}`), loud("asking for this node's token at start"));
-
-  // A login: a refresh token appears in the credentials file. Polled, because the file is replaced by
-  // rename and a watch on the old inode would go quiet.
-  const credentials = join(p.home, ".claude", ".credentials.json");
-  watchFile(credentials, { interval: 5000 }, () => {
-    void offerLogin(p, ask).then((r) => { if (r) say(`a login here was offered to ${SEAT}: ${JSON.stringify(r)}`); },
-      loud("offering a login to the licence manager"));
-  });
-}

modules/claude-code/tsconfig.json

@@ -1,12 +0,0 @@
-{
-  "compilerOptions": {
-    "target": "ES2022",
-    "module": "NodeNext",
-    "moduleResolution": "NodeNext",
-    "strict": true,
-    "esModuleInterop": true,
-    "skipLibCheck": true,
-    "noEmit": true
-  },
-  "include": ["seal.ts", "grant.ts", "identity.ts", "render.ts", "node.ts", "tools/index.ts"]
-}

modules/cloudflare-dns/Dockerfile

@@ -0,0 +1,24 @@
+# cloudflare-dns's runtime: the tool runtime, carrying this module's compiled code.
+#
+# **Built from this module's own directory and nothing else.** The sdk and the tool runtime are in
+# the base images, published like any other artifact — which is what makes this buildable by the
+# mesh from a repository and a path (novox/hq ADR 0069) rather than only on a workstation that
+# happens to have the siblings.
+#
+# Two bases, named rather than pinned (novox/hq issue 044): the image this is COMPILED in and the
+# image it RUNS in — the second must not carry a compiler. Declared in module.json's `build.on`.
+ARG BUILD_BASE
+ARG RUNTIME_BASE
+
+FROM ${BUILD_BASE} AS build
+WORKDIR /app/modules/cloudflare-dns
+COPY . .
+RUN node /app/node_modules/typescript/bin/tsc client.ts tools/index.ts provisioner/index.ts \
+      --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist
+
+FROM ${RUNTIME_BASE}
+COPY --from=build /app/modules/cloudflare-dns/dist /app/modules/cloudflare-dns/dist
+# Every serve-time entrypoint, loaded by the runtime in serve mode: tools and events serve, and a
+# provider's provisioner runs its reconcile loop in the same process, with the broker connected —
+# the convention novox/hq issues 060/061 settled.
+ENV MESH_TOOL_MODULES=/app/modules/cloudflare-dns/dist/tools/index.js,/app/modules/cloudflare-dns/dist/provisioner/index.js

modules/cloudflare-dns/module.json

@@ -12,61 +12,87 @@
     "public-dns": {}
   },
   "grants": {
-    "public-dns": "${dir:grants}"
+    "public-dns": "/var/lib/cloudflare-dns/grants"
   },
   "receives": {
-    "public-dns": "${dir:grants}/mesh.json"
+    "public-dns": "/var/lib/cloudflare-dns/grants/mesh.json"
   },
   "own-secrets": {
-    "token": "${dir:state}/token"
+    "token": "/var/lib/cloudflare-dns/token",
+    "broker": "/var/lib/mesh/cloudflare-dns/broker"
   },
   "emits": [
     "record.created",
     "record.removed"
   ],
   "resources": [
+    {
+      "id": "mesh-state",
+      "type": "directory",
+      "path": "/var/lib/mesh/cloudflare-dns",
+      "mode": "0700"
+    },
     {
       "id": "state",
       "type": "directory",
-      "mode": "0700",
-      "place": "."
+      "path": "/var/lib/cloudflare-dns",
+      "mode": "0700"
     },
     {
       "id": "grants",
       "type": "directory",
+      "path": "/var/lib/cloudflare-dns/grants",
       "mode": "0700"
     },
     {
       "id": "config",
       "type": "file",
-      "path": "${dir:state}/config.json",
+      "path": "/var/lib/cloudflare-dns/config.json",
       "merge": "json",
       "content": "{}",
       "mode": "0600"
+    },
+    {
+      "id": "runtime",
+      "type": "container",
+      "name": "mesh-cloudflare-dns",
+      "network": "host",
+      "volumes": [
+        "/var/lib/cloudflare-dns/config.json:/run/config/config.json:ro",
+        "/var/lib/cloudflare-dns/grants:/grants",
+        "/var/lib/cloudflare-dns/token:/run/secrets/token:ro",
+        "/var/lib/mesh/cloudflare-dns/broker:/run/secrets/broker:ro"
+      ],
+      "env": {
+        "MESH_CLOUDFLARE_TOKEN_FILE": "/run/secrets/token",
+        "MESH_BROKER_FILE": "/run/secrets/broker",
+        "MESH_CLOUDFLARE_CONFIG_FILE": "/run/config/config.json",
+        "MESH_RECEIVES": "/var/lib/cloudflare-dns/grants/mesh.json"
+      },
+      "artifact": "runtime"
     }
   ],
   "capabilities": [
     "container-runtime"
   ],
   "build": {
+    "on": [
+      {
+        "arg": "BUILD_BASE",
+        "module": "mesh-tools",
+        "artifact": "build"
+      },
+      {
+        "arg": "RUNTIME_BASE",
+        "module": "mesh-tools",
+        "artifact": "runtime"
+      }
+    ],
     "artifacts": [
       {
-        "name": "code",
-        "kind": "bundle",
-        "language": "typescript",
-        "entrypoints": [
-          "tools/index.js",
-          "provisioner/index.js"
-        ],
-        "loads": [
-          "tools/index.js",
-          "provisioner/index.js"
-        ],
-        "env": {
-          "MESH_CLOUDFLARE_TOKEN_FILE": "${dir:state}/token",
-          "MESH_CLOUDFLARE_CONFIG_FILE": "${dir:state}/config.json",
-          "MESH_RECEIVES": "${dir:grants}/mesh.json"
-        }
+        "name": "runtime",
+        "kind": "image",
+        "from": "Dockerfile"
       }
     ]
   }

modules/confluence/Dockerfile

@@ -0,0 +1,24 @@
+# confluence's runtime: the tool runtime, carrying this module's compiled code.
+#
+# **Built from this module's own directory and nothing else.** The sdk and the tool runtime are in
+# the base images, published like any other artifact — which is what makes this buildable by the
+# mesh from a repository and a path (novox/hq ADR 0069) rather than only on a workstation that
+# happens to have the siblings.
+#
+# Two bases, named rather than pinned (novox/hq issue 044): the image this is COMPILED in and the
+# image it RUNS in — the second must not carry a compiler. Declared in module.json's `build.on`.
+ARG BUILD_BASE
+ARG RUNTIME_BASE
+
+FROM ${BUILD_BASE} AS build
+WORKDIR /app/modules/confluence
+COPY . .
+RUN node /app/node_modules/typescript/bin/tsc client.ts tools/index.ts \
+      --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist
+
+FROM ${RUNTIME_BASE}
+COPY --from=build /app/modules/confluence/dist /app/modules/confluence/dist
+# Every serve-time entrypoint, loaded by the runtime in serve mode: tools and events serve, and a
+# provider's provisioner runs its reconcile loop in the same process, with the broker connected —
+# the convention novox/hq issues 060/061 settled.
+ENV MESH_TOOL_MODULES=/app/modules/confluence/dist/tools/index.js

modules/confluence/module.json

@@ -3,43 +3,69 @@
   "version": "1",
   "slug": "confl",
   "own-secrets": {
-    "token": "${dir:state}/token"
+    "token": "/var/lib/confluence/token",
+    "broker": "/var/lib/mesh/confluence/broker"
   },
   "resources": [
+    {
+      "id": "mesh-state",
+      "type": "directory",
+      "path": "/var/lib/mesh/confluence",
+      "mode": "0700"
+    },
     {
       "id": "state",
       "type": "directory",
-      "mode": "0700",
-      "place": "."
+      "path": "/var/lib/confluence",
+      "mode": "0700"
     },
     {
       "id": "config",
       "type": "file",
-      "path": "${dir:state}/config.json",
+      "path": "/var/lib/confluence/config.json",
       "merge": "json",
       "content": "{}",
       "mode": "0600"
+    },
+    {
+      "id": "runtime",
+      "type": "container",
+      "name": "mesh-runtime-confluence",
+      "network": "host",
+      "volumes": [
+        "/var/lib/confluence/config.json:/run/config/config.json:ro",
+        "/var/lib/confluence/token:/run/secrets/token:ro",
+        "/var/lib/mesh/confluence/broker:/run/secrets/broker:ro"
+      ],
+      "env": {
+        "MESH_CONFLUENCE_TOKEN_FILE": "/run/secrets/token",
+        "MESH_CONFLUENCE_CONFIG_FILE": "/run/config/config.json",
+        "MESH_BROKER_FILE": "/run/secrets/broker"
+      },
+      "artifact": "runtime"
     }
   ],
   "capabilities": [
     "container-runtime"
   ],
   "build": {
+    "on": [
+      {
+        "arg": "BUILD_BASE",
+        "module": "mesh-tools",
+        "artifact": "build"
+      },
+      {
+        "arg": "RUNTIME_BASE",
+        "module": "mesh-tools",
+        "artifact": "runtime"
+      }
+    ],
     "artifacts": [
       {
-        "name": "tools",
-        "kind": "bundle",
-        "language": "typescript",
-        "entrypoints": [
-          "tools/index.js"
-        ],
-        "loads": [
-          "tools/index.js"
-        ],
-        "env": {
-          "MESH_CONFLUENCE_TOKEN_FILE": "${dir:state}/token",
-          "MESH_CONFLUENCE_CONFIG_FILE": "${dir:state}/config.json"
-        }
+        "name": "runtime",
+        "kind": "image",
+        "from": "Dockerfile"
       }
     ]
   }

modules/de-spiegel/module.json

@@ -15,11 +15,11 @@
     }
   },
   "binds": {
-    "route": "${dir:state}/route.json"
+    "route": "/var/lib/de-spiegel/route.json"
   },
   "own-secrets": {
-    "smtp-user": "${dir:state}/smtp-user.secret",
-    "smtp-pass": "${dir:state}/smtp-pass.secret"
+    "smtp-user": "/var/lib/de-spiegel/smtp-user.secret",
+    "smtp-pass": "/var/lib/de-spiegel/smtp-pass.secret"
   },
   "listens": [
     {
@@ -34,13 +34,13 @@
     {
       "id": "state",
       "type": "directory",
-      "mode": "0700",
-      "place": "."
+      "path": "/var/lib/de-spiegel",
+      "mode": "0700"
     },
     {
       "id": "server-env",
       "type": "file",
-      "path": "${dir:state}/server.env",
+      "path": "/var/lib/de-spiegel/server.env",
       "mode": "0600",
       "content": "SMTP_AUTH_USER=${secret:smtp-user}\nSMTP_AUTH_PASS=${secret:smtp-pass}\n"
     },
@@ -56,7 +56,7 @@
       "image": "registry-api.novox.be/novox/de-spiegel@sha256:e144b72ce9c145870470d765343549f2c60211728cd118b9ff0e4029f36342ba",
       "network": "de-spiegel",
       "env-file": [
-        "${dir:state}/server.env"
+        "/var/lib/de-spiegel/server.env"
       ],
       "ports": [
         "35621"

modules/dhcpcd/module.json

@@ -3,8 +3,7 @@
   "version": "1",
   "capabilities": [
     "package-manager",
-    "service-manager",
-    "uplink-dhcpcd"
+    "service-manager"
   ],
   "claims": [
     {

modules/distribution/module.json

@@ -9,7 +9,7 @@
   ],
   "claims": [
     {
-      "name": "mesh-artifact-store",
+      "name": "the-artifact-store",
       "scope": "mesh"
     }
   ],
@@ -59,10 +59,7 @@
       ],
       "volumes": [
         "/var/lib/mesh-registry:/var/lib/registry"
-      ],
-      "env": {
-        "REGISTRY_STORAGE_DELETE_ENABLED": "true"
-      }
+      ]
     }
   ]
 }

modules/fail2ban/client.ts

@@ -1,236 +1,51 @@
-// fail2ban's own code, in the module (novox/hq ADR 0039). The jails are composed by the mesh from
-// the modules a machine runs (to-be 31) and written as declared resources; the daemon is kept
-// running by one. This code exists only to read and steer the *live* state the daemon owns: who is
-// banned now and until when, and the ban or release an operator asks for — the node-intrusion-
-// prevention seat's four verbs (ADR 0179). The daemon's state is fail2ban's, not the mesh's: the
-// mesh composes the jails and never writes the ban list.
-//
-// Spoken through fail2ban-client over the daemon's socket. Client and daemon come from the one
-// package this module declares on the machine, and the socket is root's: root is the module's
-// concern (ADR 0175 §4), and the runtime loading this bundle runs as the operator's account (to-be
-// 38 WP4), so the client is run through sudo without a prompt where the account is not root.
+// fail2ban's own code, in the module (novox/hq ADR 0039). The jails and the daemon are declared
+// resources — the mesh writes /etc/fail2ban/jail.d/* and keeps fail2ban.service running (see
+// module.json). This code exists only to read and steer the *live* state the daemon owns at
+// runtime: which IPs are banned right now, and the manual ban/unban an operator reaches for. That
+// state (the running bans, /var/lib/fail2ban's sqlite) is fail2ban's, not the mesh's — the mesh
+// reconciles the config, never the ban list.
 
 import { execFile } from "node:child_process";
-import { accessSync, constants } from "node:fs";
-import { isIP } from "node:net";
-import { delimiter, join } from "node:path";
 import { promisify } from "node:util";
 
-const execFileP = promisify(execFile);
-
-/** A command runner, so the verbs can be tested without a daemon. */
-export type Runner = (cmd: string, args: string[]) => Promise<string>;
-
-/** The command as it is run: as given when this process is root, else through sudo without a
- *  prompt. The daemon's socket answers only to root. */
-export function escalated(cmd: string, args: string[], uid: number | undefined = process.getuid?.()): [string, string[]] {
-  if (uid === 0) return [cmd, args];
-  return ["sudo", ["-n", cmd, ...args]];
-}
-
-/** Whether a tool is on this machine: an executable of that name on the path, or where the
- *  system keeps its administration. */
-export function installed(tool: string, path: string = process.env.PATH ?? ""): boolean {
-  const dirs = [...path.split(delimiter), "/usr/sbin", "/sbin", "/usr/bin"].filter((d) => d !== "");
-  return dirs.some((dir) => {
-    try {
-      accessSync(join(dir, tool), constants.X_OK);
-      return true;
-    } catch {
-      return false;
-    }
-  });
-}
-
-export const execRunner: Runner = async (cmd, args) => {
-  if (!installed(cmd)) throw new Error(`${cmd} is not installed on this machine`);
-  const [program, argv] = escalated(cmd, args);
-  try {
-    const { stdout } = await execFileP(program, argv, { maxBuffer: 16 * 1024 * 1024 });
-    return stdout;
-  } catch (err) {
-    const e = err as { code?: string | number; stderr?: string; stdout?: string; message?: string };
-    const said = `${e.stdout ?? ""}${e.stderr ?? ""}`.trim();
-    // What failed is named by how it failed: sudo missing is a spawn error, sudo refusing speaks
-    // on its own stderr line, and the rest is the client's own answer.
-    if (program === "sudo") {
-      if (e.code === "ENOENT") throw new Error(`${cmd} needs root, and sudo is not installed here for the runtime's account to escalate with`);
-      if (/^sudo:/m.test(said)) throw new Error(`${cmd} needs root and the runtime's account may not run it without a prompt: ${said}`);
-    }
-    if (/Failed to access socket path|Is fail2ban running|Permission denied to socket/i.test(said)) {
-      throw new Error("fail2ban is not running on this machine, or its socket does not answer the runtime's account");
-    }
-    // fail2ban-client's own last line is the one a person reads ("Sorry but the jail 'x' does not exist").
-    const lines = said.split("\n").map((l) => l.trim()).filter(Boolean);
-    throw new Error(lines.length ? lines[lines.length - 1] : (e.message ?? `${cmd} failed`));
-  }
-};
-
-/** One jail as the daemon reports it. */
-export interface JailStatus {
-  jail: string;
-  /** What the jail is reading: files or journal matches, as fail2ban names them. */
-  watching: string[];
-  /** Addresses with failures counted against them right now, and all failures since the jail started. */
-  failing: { now: number; total: number };
-  /** Addresses held right now, and all bans since the jail started. */
-  banned: { now: number; total: number; addresses: string[] };
-}
-
-/** One ban as the daemon holds it. */
-export interface Ban {
-  ip: string;
-  jail: string;
-  /** When the ban was placed, in the machine's local time as fail2ban prints it. */
-  since: string;
-  /** When the ban ends; "never" for a permanent ban. */
-  until: string;
-}
-
-export interface JailSettings {
-  jail: string;
-  bantime: string;
-  findtime: string;
-  maxretry: number;
-  ignoreip: string[];
-  actions: string[];
-  /** The log files the jail reads, when it reads files. */
-  logpath: string[];
-  /** The journal match the jail reads, when it reads the journal. */
-  journalmatch: string;
-}
+const run = promisify(execFile);
 
 export class Fail2banClient {
-  private readonly run: Runner;
-
-  constructor(run: Runner = execRunner) {
-    this.run = run;
-  }
-
-  /** The daemon as this machine has it, through its own client. */
-  static onThisMachine(): Fail2banClient {
+  static fromEnv(_env: NodeJS.ProcessEnv = process.env): Fail2banClient {
     return new Fail2banClient();
   }
 
-  private client(...args: string[]): Promise<string> {
-    return this.run("fail2ban-client", args);
-  }
-
-  /** The jails the daemon runs, by name. */
-  async jails(): Promise<string[]> {
-    const out = await this.client("status");
-    const m = out.match(/Jail list:\s*(.*)/);
-    if (!m) return [];
-    return m[1].split(",").map((j) => j.trim()).filter(Boolean);
-  }
-
-  /** Every jail with what it watches and holds, or one jail's detail. */
-  async status(jail?: string): Promise<{ jails: JailStatus[] }> {
-    const names = jail ? [jail] : await this.jails();
-    const jails: JailStatus[] = [];
-    for (const name of names) {
-      jails.push(parseJailStatus(name, await this.client("status", name)));
-    }
-    return { jails };
-  }
-
-  /** Every address banned now, with the jail holding it and when the ban ends. */
-  async banned(jail?: string): Promise<{ banned: Ban[] }> {
-    const names = jail ? [jail] : await this.jails();
-    const banned: Ban[] = [];
-    for (const name of names) {
-      banned.push(...parseBans(name, await this.client("get", name, "banip", "--with-time")));
-    }
-    banned.sort((a, b) => a.until.localeCompare(b.until) || a.ip.localeCompare(b.ip));
-    return { banned };
-  }
-
-  /** Ban one address in one jail now. The daemon's own answer is how many addresses it added. */
-  async ban(ip: string, jail: string): Promise<{ banned: Ban | null; added: number }> {
-    address(ip);
-    name(jail);
-    const out = await this.client("set", jail, "banip", ip);
-    const added = Number.parseInt(out.trim(), 10) || 0;
-    const held = (await this.banned(jail)).banned.find((b) => b.ip === ip) ?? null;
-    return { banned: held, added };
-  }
-
-  /** Let one address go, from one jail or from every jail. The daemon's answer is how many it released. */
-  async unban(ip: string, jail?: string): Promise<{ released: number; ip: string; jail: string | "every jail" }> {
-    address(ip);
-    let out: string;
+  /** Overview of every jail, or the detailed status of one — currently-banned IPs and totals. */
+  async status(jail?: string): Promise<string> {
     if (jail) {
-      name(jail);
-      out = await this.client("set", jail, "unbanip", ip);
-    } else {
-      out = await this.client("unban", ip);
+      const { stdout } = await run("sudo", ["fail2ban-client", "status", jail]);
+      return stdout;
     }
-    return { released: Number.parseInt(out.trim(), 10) || 0, ip, jail: jail ?? "every jail" };
+    const { stdout: overview } = await run("sudo", ["fail2ban-client", "status"]);
+    const match = overview.match(/Jail list:\s*(.+)/);
+    if (!match) return overview;
+
+    const jails = match[1].split(",").map((j) => j.trim()).filter(Boolean);
+    const parts: string[] = [overview.trimEnd(), ""];
+    for (const j of jails) {
+      const { stdout } = await run("sudo", ["fail2ban-client", "status", j]);
+      parts.push(`=== ${j} ===`, stdout.trimEnd(), "");
+    }
+    return parts.join("\n");
   }
 
-  /** One jail's effective settings — the module's own tool, beside the seat's verbs. */
-  async settings(jail: string): Promise<JailSettings> {
-    name(jail);
-    const get = (key: string) => this.client("get", jail, key);
-    const [bantime, findtime, maxretry, ignoreip, actions, logpath, journalmatch] = await Promise.all([
-      get("bantime"), get("findtime"), get("maxretry"), get("ignoreip"), get("actions"), get("logpath"),
-      get("journalmatch"),
-    ]);
-    return {
-      jail,
-      bantime: bantime.trim(),
-      findtime: findtime.trim(),
-      maxretry: Number.parseInt(maxretry.trim(), 10),
-      ignoreip: listed(ignoreip),
-      actions: actions.split("\n").slice(1).map((l) => l.trim()).filter(Boolean),
-      logpath: /No file is currently monitored/.test(logpath) ? [] : listed(logpath),
-      journalmatch: journalmatch.split("\n").slice(1).map((l) => l.trim()).filter(Boolean).join(" "),
-    };
+  /** Manually ban an IP in a jail. Mutates live state, not a mesh-managed file. */
+  async ban(jail: string, ip: string): Promise<string> {
+    const { stdout } = await run("sudo", ["fail2ban-client", "set", jail, "banip", ip]);
+    return stdout;
+  }
+
+  /** Unban an IP from one jail, or from every jail when no jail is given. */
+  async unban(ip: string, jail?: string): Promise<string> {
+    const args = jail
+      ? ["fail2ban-client", "set", jail, "unbanip", ip]
+      : ["fail2ban-client", "unban", ip];
+    const { stdout } = await run("sudo", args);
+    return stdout;
   }
 }
-
-/** fail2ban's tree listings: lines like "|- 127.0.0.0/8" and "`- ::1", after a heading. */
-function listed(out: string): string[] {
-  return out
-    .split("\n")
-    .map((l) => l.replace(/^[\s|`-]+/, "").trim())
-    .filter((l, i) => i > 0 && l.length > 0);
-}
-
-export function parseJailStatus(jail: string, out: string): JailStatus {
-  const field = (label: string) => {
-    const m = out.match(new RegExp(label.replace(/[.*+?^${}()|[\]\\]/g, "\\$&") + ":\\t?\\s*(.*)"));
-    return m ? m[1].trim() : "";
-  };
-  const num = (label: string) => Number.parseInt(field(label), 10) || 0;
-  const watching = [field("File list"), field("Journal matches")].filter(Boolean);
-  return {
-    jail,
-    watching,
-    failing: { now: num("Currently failed"), total: num("Total failed") },
-    banned: {
-      now: num("Currently banned"),
-      total: num("Total banned"),
-      addresses: field("Banned IP list").split(/\s+/).filter(Boolean),
-    },
-  };
-}
-
-/** `get <jail> banip --with-time` prints one ban per line: "IP \tsince + seconds = until". */
-export function parseBans(jail: string, out: string): Ban[] {
-  const bans: Ban[] = [];
-  for (const line of out.split("\n")) {
-    const m = line.match(/^(\S+)\s+(\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}) \+ (-?\d+) = (\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}|\S+)/);
-    if (!m) continue;
-    bans.push({ ip: m[1], jail, since: m[2], until: Number(m[3]) < 0 ? "never" : m[4] });
-  }
-  return bans;
-}
-
-function address(ip: string): void {
-  if (!isIP(ip)) throw new Error(`${JSON.stringify(ip)} is not an address`);
-}
-
-function name(jail: string): void {
-  if (!/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(jail)) throw new Error(`${JSON.stringify(jail)} is not a jail's name`);
-}

modules/fail2ban/module.json

@@ -7,22 +7,9 @@
   "claims": [
     {
       "name": "node-intrusion-prevention",
-      "scope": "node",
-      "serves": [
-        "status",
-        "banned",
-        "ban",
-        "unban"
-      ]
+      "scope": "node"
     }
   ],
-  "tools": [
-    "fail2ban_settings"
-  ],
-  "jailing": {
-    "into": "/etc/fail2ban/jail.d/mesh.conf",
-    "filter-into": "/etc/fail2ban/filter.d"
-  },
   "resources": [
     {
       "id": "package",
@@ -41,31 +28,19 @@
       "path": "/etc/fail2ban/action.d",
       "mode": "0755"
     },
-    {
-      "id": "filter-d",
-      "type": "directory",
-      "path": "/etc/fail2ban/filter.d",
-      "mode": "0755"
-    },
-    {
-      "id": "run-dir",
-      "type": "directory",
-      "path": "/var/run/fail2ban",
-      "mode": "0755"
-    },
     {
       "id": "jail-local",
       "type": "file",
       "path": "/etc/fail2ban/jail.local",
       "mode": "0644",
-      "content": "[INCLUDES]\n\nbefore = paths-arch.conf\n\n[DEFAULT]\n\n# Never act on the machine itself or on a tunnel peer: the mesh's private range is\n# ${machine:mesh-range}, named here rather than written as a value the module cannot\n# know (novox/hq ADR 0112). Without this, fail2ban could ban the mesh's own nodes.\n# **A ban list never holds a neighbour.** The mesh's own range is named rather than written\n# (novox/hq ADR 0112), and every private range beside it: a source on one is somebody's own\n# network, not the internet. On a machine behind a router that reflects local traffic, every\n# client in the house arrives as the gateway's address — so one mistyped local request banned\n# 192.168.1.1 on the home server and would have cut the whole house off from it (ADR 0186).\nignoreip = 127.0.0.1/8 ::1 ${machine:mesh-range} 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 169.254.0.0/16 fc00::/7 fe80::/10\n\n# Three failures in a day ban for a day (novox/hq ADR 0179). The attackers this mesh sees pace\n# themselves at one try every ten minutes, under any ten-minute window; a day's window counts\n# them, and a day's ban costs a person who mistyped three times once, from one address, while\n# the mesh's own range is never banned at all.\nbantime  = 1d\nfindtime = 1d\nmaxretry = 3\n\n# Ban through iptables, not through a firewall front-end the machine may not have. ufw is\n# installed on two of this mesh's machines and absent on the other two, and fail2ban finds out\n# only at ban time: the service reports healthy, the jail counts the attempt, the ban command\n# exits 127, and nothing is blocked. Proven on 2026-09-28 -- 'ufw: command not found' on a\n# machine the mesh reported as protected.\n#\n# The action below is this module's own, already used by the recidive jail on every machine\n# here, and it bans in DOCKER-USER as well as INPUT, so a container's published port is\n# covered too.\nbanaction = iptables-allports-dualchain\nbanaction_allports = iptables-allports-dualchain\n\n[sshd]\nenabled = true\nport    = ssh\nlogpath = %(sshd_log)s\nbackend = %(sshd_backend)s\n"
+      "content": "[INCLUDES]\n\nbefore = paths-arch.conf\n\n[DEFAULT]\n\n# Never act on the machine itself or on a tunnel peer: the mesh's private range is\n# ${machine:mesh-range}, named here rather than written as a value the module cannot\n# know (novox/hq ADR 0112). Without this, fail2ban could ban the mesh's own nodes.\nignoreip = 127.0.0.1/8 ::1 ${machine:mesh-range}\n\nbantime  = 10m\nfindtime = 10m\nmaxretry = 5\n\n# Ban through iptables, not through a firewall front-end the machine may not have. ufw is\n# installed on two of this mesh's machines and absent on the other two, and fail2ban finds out\n# only at ban time: the service reports healthy, the jail counts the attempt, the ban command\n# exits 127, and nothing is blocked. Proven on 2026-09-28 -- 'ufw: command not found' on a\n# machine the mesh reported as protected.\n#\n# The action below is this module's own, already used by the recidive jail on every machine\n# here, and it bans in DOCKER-USER as well as INPUT, so a container's published port is\n# covered too.\nbanaction = iptables-allports-dualchain\nbanaction_allports = iptables-allports-dualchain\n\n[sshd]\nenabled = true\nport    = ssh\nlogpath = %(sshd_log)s\nbackend = %(sshd_backend)s\n"
     },
     {
       "id": "jail-sshd",
       "type": "file",
       "path": "/etc/fail2ban/jail.d/sshd.conf",
       "mode": "0644",
-      "content": "[sshd]\nenabled = true\nport    = ssh\nlogpath = %(sshd_log)s\nbackend = %(sshd_backend)s\nmaxretry = 3\nfindtime = 1d\nbantime  = 1d\n"
+      "content": "[sshd]\nenabled = true\nport    = ssh\nlogpath = %(sshd_log)s\nbackend = %(sshd_backend)s\nmaxretry = 5\n"
     },
     {
       "id": "log",
@@ -80,7 +55,7 @@
       "type": "file",
       "path": "/etc/fail2ban/jail.d/recidive.conf",
       "mode": "0644",
-      "content": "[recidive]\nenabled = true\nlogpath  = /var/log/fail2ban.log\n# Ban in both INPUT (host services like SSH) and DOCKER-USER (container services)\nbanaction = iptables-allports-dualchain\n# Banned twice in two weeks, by any jail, is banned for four (novox/hq ADR 0179).\nbantime  = 4w\nfindtime = 2w\nmaxretry = 2\n"
+      "content": "[recidive]\nenabled = true\nlogpath  = /var/log/fail2ban.log\n# Ban in both INPUT (host services like SSH) and DOCKER-USER (container services)\nbanaction = iptables-allports-dualchain\nbantime  = 1w\nfindtime = 1d\n"
     },
     {
       "id": "action-dualchain",
@@ -106,21 +81,8 @@
         "jail-local",
         "jail-sshd",
         "jail-recidive",
-        "action-dualchain",
-        "composed-jails"
+        "action-dualchain"
       ]
     }
-  ],
-  "build": {
-    "artifacts": [
-      {
-        "name": "tools",
-        "kind": "bundle",
-        "language": "typescript",
-        "entrypoints": [
-          "tools/index.js"
-        ]
-      }
-    ]
-  }
+  ]
 }

modules/fail2ban/package.json

@@ -1,18 +1,14 @@
 {
   "name": "@novox/module-fail2ban",
   "version": "0.1.0",
-  "description": "fail2ban \u2014 intrusion prevention: the mesh composes the jails and keeps the daemon running; this module holds the node-intrusion-prevention seat and serves its verbs status, banned, ban and unban (novox/hq to-be 31, ADR 0179).",
+  "description": "fail2ban — intrusion prevention: the mesh declares the jails and keeps the daemon running; its ban/unban/status tools live here.",
   "type": "module",
   "private": true,
   "dependencies": {
-    "@novox/mesh-sdk": "^0.1.1"
+    "@novox/mesh-sdk": "^0.1.0"
   },
   "devDependencies": {
     "@types/node": "^22.0.0",
     "typescript": "^5.6.0"
-  },
-  "scripts": {
-    "build": "tsc client.ts tools/index.ts --module NodeNext --moduleResolution NodeNext --target ES2022 --rootDir . --outDir dist",
-    "test": "node --test --experimental-strip-types 'test/*.test.ts'"
   }
 }

modules/fail2ban/test/client.test.ts

@@ -1,114 +0,0 @@
-// The intrusion prevention's verbs over a fake daemon, with the shapes fail2ban-client 1.1.0 printed
-// on the control node on 2026-10-02 (novox/hq ADR 0179).
-import { test } from "node:test";
-import assert from "node:assert/strict";
-import { Fail2banClient, escalated, installed, parseBans, parseJailStatus, type Runner } from "../client.ts";
-
-const STATUS = "Status\n|- Number of jail:\t2\n`- Jail list:\trecidive, sshd\n";
-const RECIDIVE =
-  "Status for the jail: recidive\n|- Filter\n|  |- Currently failed:\t36\n|  |- Total failed:\t149\n" +
-  "|  `- File list:\t/var/log/fail2ban.log\n`- Actions\n   |- Currently banned:\t9\n   |- Total banned:\t13\n" +
-  "   `- Banned IP list:\t195.178.110.30 45.148.10.240 92.118.39.71\n";
-const SSHD =
-  "Status for the jail: sshd\n|- Filter\n|  |- Currently failed:\t5\n|  |- Total failed:\t11776\n" +
-  "|  `- Journal matches:\t_SYSTEMD_UNIT=sshd.service + _COMM=sshd\n`- Actions\n   |- Currently banned:\t0\n" +
-  "   |- Total banned:\t150\n   `- Banned IP list:\t\n";
-const WITH_TIME =
-  "195.178.110.30 \t2026-09-26 23:18:47 + 604800 = 2026-10-03 23:18:47\n" +
-  "92.118.39.71 \t2026-09-28 10:33:49 + 604800 = 2026-10-05 10:33:49\n";
-
-function fake(answers: Record<string, string>, calls: string[][] = []): Runner {
-  return async (cmd, args) => {
-    calls.push([cmd, ...args]);
-    const key = args.join(" ");
-    if (key in answers) return answers[key];
-    throw new Error(`unexpected ${cmd} ${key}`);
-  };
-}
-
-test("a jail's status is read into numbers, what it watches and who it holds", () => {
-  const s = parseJailStatus("recidive", RECIDIVE);
-  assert.deepEqual(s, {
-    jail: "recidive",
-    watching: ["/var/log/fail2ban.log"],
-    failing: { now: 36, total: 149 },
-    banned: { now: 9, total: 13, addresses: ["195.178.110.30", "45.148.10.240", "92.118.39.71"] },
-  });
-  const j = parseJailStatus("sshd", SSHD);
-  assert.deepEqual(j.watching, ["_SYSTEMD_UNIT=sshd.service + _COMM=sshd"]);
-  assert.deepEqual(j.banned, { now: 0, total: 150, addresses: [] });
-});
-
-test("status covers every jail the daemon lists, or the one named", async () => {
-  const calls: string[][] = [];
-  const f = new Fail2banClient(fake({ status: STATUS, "status recidive": RECIDIVE, "status sshd": SSHD }, calls));
-  const all = await f.status();
-  assert.deepEqual(all.jails.map((j) => j.jail), ["recidive", "sshd"]);
-  const one = await f.status("sshd");
-  assert.equal(one.jails.length, 1);
-  assert.deepEqual(calls[calls.length - 1], ["fail2ban-client", "status", "sshd"]);
-});
-
-test("bans are read with when they were placed and when they end, a permanent one as never", () => {
-  const bans = parseBans("recidive", WITH_TIME + "203.0.113.9 \t2026-10-01 00:00:00 + -1 = never\n");
-  assert.equal(bans.length, 3);
-  assert.deepEqual(bans[0], { ip: "195.178.110.30", jail: "recidive", since: "2026-09-26 23:18:47", until: "2026-10-03 23:18:47" });
-  assert.equal(bans[2].until, "never");
-  assert.deepEqual(parseBans("sshd", "\n"), []);
-});
-
-test("banned gathers every jail's bans, soonest to end first", async () => {
-  const f = new Fail2banClient(fake({
-    status: STATUS,
-    "get recidive banip --with-time": WITH_TIME,
-    "get sshd banip --with-time": "198.51.100.7 \t2026-10-02 15:06:58 + 600 = 2026-10-02 15:16:58\n",
-  }));
-  const { banned } = await f.banned();
-  assert.deepEqual(banned.map((b) => `${b.ip}@${b.jail}`), ["198.51.100.7@sshd", "195.178.110.30@recidive", "92.118.39.71@recidive"]);
-});
-
-test("ban asks the daemon by jail and answers with the ban as held; a non-address is refused before anything runs", async () => {
-  const calls: string[][] = [];
-  const f = new Fail2banClient(fake({
-    "set recidive banip 198.51.100.7": "1\n",
-    "get recidive banip --with-time": WITH_TIME + "198.51.100.7 \t2026-10-02 17:00:00 + 604800 = 2026-10-09 17:00:00\n",
-  }, calls));
-  const r = await f.ban("198.51.100.7", "recidive");
-  assert.equal(r.added, 1);
-  assert.equal(r.banned?.until, "2026-10-09 17:00:00");
-  assert.deepEqual(calls[0], ["fail2ban-client", "set", "recidive", "banip", "198.51.100.7"]);
-  await assert.rejects(() => f.ban("not-an-ip", "recidive"), /is not an address/);
-  await assert.rejects(() => f.ban("198.51.100.7", "a jail; rm"), /is not a jail's name/);
-  assert.equal(calls.length, 2);
-});
-
-test("unban releases from one jail or from every jail", async () => {
-  const calls: string[][] = [];
-  const f = new Fail2banClient(fake({ "set sshd unbanip 198.51.100.7": "1\n", "unban 198.51.100.7": "2\n" }, calls));
-  assert.deepEqual(await f.unban("198.51.100.7", "sshd"), { released: 1, ip: "198.51.100.7", jail: "sshd" });
-  assert.deepEqual(await f.unban("198.51.100.7"), { released: 2, ip: "198.51.100.7", jail: "every jail" });
-  assert.deepEqual(calls[1], ["fail2ban-client", "unban", "198.51.100.7"]);
-});
-
-test("a jail's settings are read from the daemon's listings", async () => {
-  const f = new Fail2banClient(fake({
-    "get sshd bantime": "86400\n", "get sshd findtime": "86400\n", "get sshd maxretry": "3\n",
-    "get sshd ignoreip": "These IP addresses/networks are ignored:\n|- 127.0.0.0/8\n|- 10.10.0.0/24\n`- ::1\n",
-    "get sshd actions": "The jail sshd has the following actions:\niptables-allports-dualchain\n",
-    "get sshd logpath": "No file is currently monitored\n",
-    "get sshd journalmatch": "Current match filter:\n_SYSTEMD_UNIT=sshd.service + _COMM=sshd\n",
-  }));
-  assert.deepEqual(await f.settings("sshd"), {
-    jail: "sshd", bantime: "86400", findtime: "86400", maxretry: 3,
-    ignoreip: ["127.0.0.0/8", "10.10.0.0/24", "::1"], actions: ["iptables-allports-dualchain"],
-    logpath: [], journalmatch: "_SYSTEMD_UNIT=sshd.service + _COMM=sshd",
-  });
-});
-
-test("the client runs as given by root and through sudo without a prompt by anyone else", () => {
-  assert.deepEqual(escalated("fail2ban-client", ["status"], 0), ["fail2ban-client", ["status"]]);
-  assert.deepEqual(escalated("fail2ban-client", ["set", "sshd", "banip", "198.51.100.7"], 1000),
-    ["sudo", ["-n", "fail2ban-client", "set", "sshd", "banip", "198.51.100.7"]]);
-  assert.equal(installed("sh"), true);
-  assert.equal(installed("no-such-client-of-the-mesh"), false);
-});

modules/fail2ban/tools/index.ts

@@ -1,62 +1,55 @@
-// The intrusion prevention's tools: the node-intrusion-prevention seat's four verbs — who is banned,
-// the jails' state, ban one, let one go — and the module's own reading of a jail's settings
-// (novox/hq to-be 31, ADR 0179). The jails themselves are composed by the mesh from the modules a
-// machine runs and written as declared resources; these touch only what the running daemon holds.
+// fail2ban's tools — reading and steering the live ban state. The jails themselves are declared
+// resources (module.json); these three touch what the running daemon holds: what is banned now,
+// and the manual ban/unban an operator reaches for. The daemon's state is fail2ban's own, so this
+// is the only way to see or change it — the mesh reconciles the config, not the bans.
 
 import { registerModuleTools, type ToolDefinition } from "@novox/mesh-sdk/tools";
 import { Fail2banClient } from "../client.js";
 
-export function getSeatVerbs(fail2ban: Fail2banClient): ToolDefinition[] {
-  return [
-    {
-      name: "status",
-      description:
-        "Every jail on this machine with what it watches, how many addresses it is counting failures against and holding now, and the totals since it started; one jail's detail when named.",
-      input: { jail: { type: "string", description: "one jail (optional)" } },
-      run: async (args) => fail2ban.status(args.jail ? String(args.jail) : undefined),
-    },
-    {
-      name: "banned",
-      description: "Every address banned on this machine right now, with the jail that holds it, when it was banned and when the ban ends.",
-      input: { jail: { type: "string", description: "one jail (optional)" } },
-      run: async (args) => fail2ban.banned(args.jail ? String(args.jail) : undefined),
-    },
-    {
-      name: "ban",
-      description:
-        "Ban one address in one jail now, for the jail's ban time — an operator's act on the live ban list, which the mesh never writes itself.",
-      input: {
-        ip: { type: "string", description: "the address" },
-        jail: { type: "string", description: "the jail to hold it (recidive for the long ban)" },
-      },
-      run: async (args) => fail2ban.ban(String(args.ip ?? ""), String(args.jail ?? "")),
-    },
-    {
-      name: "unban",
-      description: "Let one address go, from one jail or from every jail when none is named.",
-      input: {
-        ip: { type: "string", description: "the address" },
-        jail: { type: "string", description: "one jail (optional)" },
-      },
-      run: async (args) => fail2ban.unban(String(args.ip ?? ""), args.jail ? String(args.jail) : undefined),
-    },
-  ];
-}
-
 export function getFail2banTools(fail2ban: Fail2banClient): ToolDefinition[] {
   return [
     {
-      name: "fail2ban_settings",
+      name: "fail2ban_status",
       description:
-        "One jail's effective settings on this machine: ban time, window, tries, the addresses it never bans, its actions and what it reads.",
-      input: { jail: { type: "string", description: "the jail" } },
-      run: async (args) => fail2ban.settings(String(args.jail ?? "")),
+        "fail2ban status on this node — the jails and their live bans. Omit `jail` for every jail, or name one for its detail.",
+      input: {
+        type: "object",
+        properties: {
+          jail: {
+            type: "string",
+            description: "A specific jail (e.g. sshd, recidive); omit for the overview of all jails.",
+          },
+        },
+      },
+      run: async (args) => ({ status: await fail2ban.status(args.jail as string | undefined) }),
+    },
+    {
+      name: "fail2ban_ban",
+      description: "Manually ban an IP address in a jail — a live change to the running daemon, not a mesh-managed file.",
+      input: {
+        type: "object",
+        properties: {
+          jail: { type: "string", description: "Jail name (e.g. sshd, recidive)." },
+          ip: { type: "string", description: "IP address to ban." },
+        },
+        required: ["jail", "ip"],
+      },
+      run: async (args) => ({ result: await fail2ban.ban(args.jail as string, args.ip as string) }),
+    },
+    {
+      name: "fail2ban_unban",
+      description: "Unban an IP address from one jail, or from every jail when `jail` is omitted.",
+      input: {
+        type: "object",
+        properties: {
+          ip: { type: "string", description: "IP address to unban." },
+          jail: { type: "string", description: "A specific jail; omit to unban from all jails." },
+        },
+        required: ["ip"],
+      },
+      run: async (args) => ({ result: await fail2ban.unban(args.ip as string, args.jail as string | undefined) }),
     },
   ];
 }
 
-const fail2ban = Fail2banClient.onThisMachine();
-// The seat's verbs under the seat's name: the runtime serves them on the seat's subjects where this
-// module holds it (ADR 0159, 0160). The module's own under its own.
-registerModuleTools("node-intrusion-prevention", () => getSeatVerbs(fail2ban));
-registerModuleTools("fail2ban", () => getFail2banTools(fail2ban));
+registerModuleTools("fail2ban", () => getFail2banTools(Fail2banClient.fromEnv()));

modules/gitea/Dockerfile

@@ -0,0 +1,37 @@
+# gitea's runtime: the tool runtime, carrying this module's compiled provisioner, tools and event
+# consumer.
+#
+# **Built from this module's own directory and nothing else.** The sdk is in the base image, so
+# nothing is copied out of a neighbouring checkout — which is what lets the mesh build this from a
+# repository and a path (novox/hq ADR 0069) rather than only on a workstation that happens to have
+# the siblings.
+#
+# Two bases, named rather than pinned: the image this is COMPILED in, and the image it RUNS in.
+# They are different images on purpose — the first carries a compiler and the second must not, or
+# every running container would carry one it never invokes. The mesh answers both with the copies it
+# holds, because a fingerprint written here would name one particular copy and no other mesh has it
+# (novox/hq issue 044). Declared in module.json's `build.on`; deliberately no defaults, so a build
+# nobody told stops here and says which module to build first.
+ARG BUILD_BASE
+ARG RUNTIME_BASE
+
+FROM ${BUILD_BASE} AS build
+# Compiled under /app/modules so `@novox/mesh-sdk` resolves upward into the base's own
+# node_modules — the module is compiled against exactly the sdk it will run against.
+WORKDIR /app/modules/gitea
+COPY . .
+# The compiler is invoked by its real path rather than through node_modules/.bin, whose entries are
+# symlinks to a launcher that requires its library relatively — resolved away when the base image
+# was assembled.
+RUN node /app/node_modules/typescript/bin/tsc client.ts token.ts index.ts provisioner/index.ts tools/index.ts \
+      --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist
+
+FROM ${RUNTIME_BASE}
+# **No apt packages.** gitea's provisioner talks to the forge over HTTP (the gitea REST API), not
+# through a CLI the way postgres drives psql — so the runtime base holds everything this needs.
+COPY --from=build /app/modules/gitea/dist /app/modules/gitea/dist
+# What a tool host should load from this module: its event consumer and its tools, which are
+# separate entrypoints because they are loaded by different things. The provisioner is the third,
+# and is not listed here — the declaration names it in the container's `args`, because it is what
+# this module's own container runs. One image, because they are one module and share a client.
+ENV MESH_TOOL_MODULES=/app/modules/gitea/dist/index.js,/app/modules/gitea/dist/tools/index.js,/app/modules/gitea/dist/provisioner/index.js

modules/gitea/client.ts

@@ -45,14 +45,6 @@ export interface GiteaPull {
   html_url: string;
 }
 
-export interface GiteaComment {
-  id: number;
-  user?: string;
-  body: string;
-  created_at?: string;
-  html_url: string;
-}
-
 export interface GiteaLabel {
   id: number;
   name: string;
@@ -103,13 +95,6 @@ export class GiteaClient {
     if (res.status === 401) {
       token = await this.tokens.renew(token);
       res = await this.send(path, options, token);
-    } else if (res.status === 403) {
-      // A kept token minted before a scope was added lacks it. The forge says so; the source
-      // re-mints with the whole list and the call is retried once. Any other 403 stays a 403.
-      const text = await res.text();
-      if (!MintedToken.lacksScope(res.status, text)) throw new Error(`Gitea API ${path}: 403 ${text}`);
-      token = await this.tokens.renew(token);
-      res = await this.send(path, options, token);
     }
     if (!res.ok) throw new Error(`Gitea API ${path}: ${res.status} ${await res.text()}`);
     if (res.status === 204) return null as T;
@@ -265,64 +250,6 @@ export class GiteaClient {
     );
   }
 
-  /** Close or reopen a pull request without merging it. A pull request is an issue to the forge's
-   *  state machine, and the pulls endpoint takes the same `state`. */
-  async setPullState(owner: string, repo: string, index: number, state: "open" | "closed"): Promise<GiteaPull> {
-    return GiteaClient.mapPull(
-      await this.request<any>(`/repos/${owner}/${repo}/pulls/${index}`, { method: "PATCH", body: JSON.stringify({ state }) }),
-    );
-  }
-
-  /** Change a pull request's title or body; a field left undefined is left alone. */
-  async updatePullRequest(owner: string, repo: string, index: number, data: { title?: string; body?: string }): Promise<GiteaPull> {
-    return GiteaClient.mapPull(
-      await this.request<any>(`/repos/${owner}/${repo}/pulls/${index}`, { method: "PATCH", body: JSON.stringify(data) }),
-    );
-  }
-
-  /** The unified diff of a pull request, as text. */
-  async pullDiff(owner: string, repo: string, index: number): Promise<string> {
-    return this.requestText(`/repos/${owner}/${repo}/pulls/${index}.diff`);
-  }
-
-  /** Every comment on an issue or pull request, oldest first. */
-  async listComments(owner: string, repo: string, index: number): Promise<GiteaComment[]> {
-    const raw = await this.request<any[]>(`/repos/${owner}/${repo}/issues/${index}/comments`);
-    return (raw ?? []).map((c) => ({
-      id: Number(c?.id ?? 0),
-      user: c?.user?.login,
-      body: String(c?.body ?? ""),
-      created_at: c?.created_at,
-      html_url: String(c?.html_url ?? ""),
-    }));
-  }
-
-  /** One file's contents at a ref (default the repository's default branch), decoded. */
-  async getFile(owner: string, repo: string, path: string, ref?: string): Promise<{ path: string; ref?: string; sha: string; size: number; content: string }> {
-    const qs = ref ? `?ref=${encodeURIComponent(ref)}` : "";
-    const f = await this.request<any>(`/repos/${owner}/${repo}/contents/${path.split("/").map(encodeURIComponent).join("/")}${qs}`);
-    if (!f || f.type !== "file") throw new Error(`Gitea API: ${path} is not a file`);
-    const content = f.encoding === "base64" ? Buffer.from(String(f.content ?? ""), "base64").toString("utf8") : String(f.content ?? "");
-    return { path, ref, sha: String(f.sha ?? ""), size: Number(f.size ?? content.length), content };
-  }
-
-  async listBranches(owner: string, repo: string): Promise<{ name: string; commit: string; protected: boolean }[]> {
-    const raw = await this.request<any[]>(`/repos/${owner}/${repo}/branches?limit=100`);
-    return (raw ?? []).map((b) => ({ name: String(b?.name ?? ""), commit: String(b?.commit?.id ?? ""), protected: Boolean(b?.protected) }));
-  }
-
-  async deleteBranch(owner: string, repo: string, branch: string): Promise<void> {
-    await this.request(`/repos/${owner}/${repo}/branches/${encodeURIComponent(branch)}`, { method: "DELETE" });
-  }
-
-  /** A request whose answer is text, not JSON — a diff. Same token handling as request(). */
-  private async requestText(path: string): Promise<string> {
-    const token = await this.tokens.current();
-    const res = await this.send(path, { headers: { Accept: "text/plain" } }, token);
-    if (!res.ok) throw new Error(`Gitea API ${path}: ${res.status} ${await res.text()}`);
-    return res.text();
-  }
-
   async mergePullRequest(owner: string, repo: string, index: number, method = "merge", deleteBranch = false): Promise<void> {
     await this.request(`/repos/${owner}/${repo}/pulls/${index}/merge`, {
       method: "POST",

modules/gitea/module.json

@@ -85,17 +85,20 @@
       "scope": "mesh"
     }
   ],
+  "own-secrets": {
+    "broker": "/var/lib/mesh/gitea/broker"
+  },
   "resources": [
     {
       "id": "mesh-state",
       "type": "directory",
-      "mode": "0700",
-      "place": "mesh"
+      "path": "/var/lib/mesh/gitea",
+      "mode": "0700"
     },
     {
       "id": "runtime-state",
       "type": "directory",
-      "path": "${dir:mesh-state}/state",
+      "path": "/var/lib/mesh/gitea/state",
       "mode": "0700"
     },
     {
@@ -142,8 +145,7 @@
       "volumes": [
         "${dir:data}:/data"
       ],
-      "secrets-in-environment": "gitea honours GITEA__database__PASSWD__FILE and GITEA__security__INTERNAL_TOKEN__FILE; convertible, awaiting a bed that proves it",
-      "logging": "journald"
+      "secrets-in-environment": "gitea honours GITEA__database__PASSWD__FILE and GITEA__security__INTERNAL_TOKEN__FILE; convertible, awaiting a bed that proves it"
     },
     {
       "id": "admin-bootstrap",
@@ -173,10 +175,36 @@
     {
       "id": "runtime-config",
       "type": "file",
-      "path": "${dir:mesh-state}/config.json",
+      "path": "/var/lib/mesh/gitea/config.json",
       "mode": "0600",
       "content": "{}\n",
       "merge": "json"
+    },
+    {
+      "id": "runtime",
+      "type": "container",
+      "name": "mesh-gitea",
+      "network": "host",
+      "volumes": [
+        "/var/lib/mesh/gitea/broker:/run/secrets/broker:ro",
+        "/var/lib/mesh/gitea/config.json:/run/config/config.json:ro",
+        "${dir:grants}:${dir:grants}:ro",
+        "${dir:state}/admin.secret:/run/secrets/admin:ro",
+        "/var/lib/mesh/gitea/state:/run/state"
+      ],
+      "env": {
+        "MESH_BROKER_FILE": "/run/secrets/broker",
+        "MESH_GITEA_URL": "http://127.0.0.1:${port:3000}",
+        "MESH_GITEA_CONFIG_FILE": "/run/config/config.json",
+        "MESH_GITEA_ADMIN_USER": "mesh-admin",
+        "MESH_GITEA_ADMIN_PASSWORD_FILE": "/run/secrets/admin",
+        "MESH_GITEA_STATE_DIR": "/run/state",
+        "MESH_RECEIVES": "${dir:grants}/npm.json"
+      },
+      "artifact": "runtime",
+      "restart-on": [
+        "runtime-config"
+      ]
     }
   ],
   "provides": [
@@ -190,37 +218,24 @@
     }
   ],
   "build": {
+    "on": [
+      {
+        "arg": "BUILD_BASE",
+        "module": "mesh-tools",
+        "artifact": "build"
+      },
+      {
+        "arg": "RUNTIME_BASE",
+        "module": "mesh-tools",
+        "artifact": "runtime"
+      }
+    ],
     "artifacts": [
       {
-        "name": "code",
-        "kind": "bundle",
-        "language": "typescript",
-        "entrypoints": [
-          "index.js",
-          "tools/index.js",
-          "provisioner/index.js"
-        ],
-        "loads": [
-          "index.js",
-          "tools/index.js",
-          "provisioner/index.js"
-        ],
-        "env": {
-          "MESH_GITEA_URL": "http://127.0.0.1:${port:3000}",
-          "MESH_GITEA_CONFIG_FILE": "${dir:mesh-state}/config.json",
-          "MESH_GITEA_ADMIN_USER": "mesh-admin",
-          "MESH_GITEA_ADMIN_PASSWORD_FILE": "${dir:state}/admin.secret",
-          "MESH_GITEA_STATE_DIR": "${dir:runtime-state}",
-          "MESH_RECEIVES": "${dir:grants}/npm.json"
-        }
+        "name": "runtime",
+        "kind": "image",
+        "from": "Dockerfile"
       }
     ]
-  },
-  "jails": [
-    {
-      "name": "gitea",
-      "failregex": "^.*Failed authentication attempt for .* from <HOST>(?::\\d+)?\\s*$\n            ^.*Invalid user .* from <HOST> port \\d+\\s*$\n            ^.*User \\S+ from <HOST> not allowed because .*$",
-      "jail": "backend = systemd\njournalmatch = CONTAINER_NAME=gitea\nport = http,https,222\nmaxretry = 3\nfindtime = 1d\nbantime = 1d"
-    }
-  ]
+  }
 }

modules/gitea/test/token.test.ts

@@ -29,11 +29,7 @@ interface Forge {
   mints: number;
   lastScopes: string[] | null;
   tokens: Map<string, string>;
-  scopesOf: Map<string, string[]>;
   admins: Map<string, string>;
-  pullState: string;
-  pullTitle: string;
-  branchDeleted: boolean;
   close(): Promise<void>;
 }
 
@@ -44,9 +40,6 @@ function fakeForge(): Promise<Forge> {
     tokens: new Map<string, string>(), // name -> value
     scopesOf: new Map<string, string[]>(), // value -> scopes, so a route can enforce them like gitea does
     admins: new Map([[ADMIN, PASSWORD]]),
-    pullState: "open",
-    pullTitle: "The console shipped",
-    branchDeleted: false,
   };
   // write:X implies read:X — gitea's own rule (models/auth/access_token_scope.go).
   const covers = (scopes: string[], required: string): boolean =>
@@ -92,51 +85,6 @@ function fakeForge(): Promise<Forge> {
       }
       return json(res, 405, { message: "method not allowed" });
     }
-    const tokenOf = (): string => {
-      const h = req.headers.authorization ?? "";
-      return h.startsWith("token ") ? h.slice(6) : "";
-    };
-    const pull = url.pathname.match(/^\/api\/v1\/repos\/novox\/hq\/pulls\/(\d+)(\.diff)?$/);
-    if (pull) {
-      if (![...forge.tokens.values()].includes(tokenOf())) return json(res, 401, { message: "token is required" });
-      if (pull[2]) {
-        res.writeHead(200, { "Content-Type": "text/plain" });
-        return res.end("diff --git a/x b/x\n--- a/x\n+++ b/x\n@@ -1 +1 @@\n-old\n+new\n");
-      }
-      if (req.method === "PATCH") {
-        const patch = await body(req);
-        forge.pullState = patch?.state ?? forge.pullState;
-        forge.pullTitle = patch?.title ?? forge.pullTitle;
-      }
-      return json(res, 200, { number: Number(pull[1]), title: forge.pullTitle, state: forge.pullState, merged: false,
-        user: { login: "mesh-admin" }, head: { ref: "feat/x" }, base: { ref: "main" }, html_url: "http://fake/novox/hq/pulls/" + pull[1] });
-    }
-    if (url.pathname === "/api/v1/repos/novox/hq/issues/223/comments") {
-      return json(res, 200, [{ id: 1, user: { login: "jochen" }, body: "landed elsewhere", created_at: "2026-10-01T00:00:00Z", html_url: "http://fake/c/1" }]);
-    }
-    if (url.pathname === "/api/v1/repos/novox/hq/contents/README.md") {
-      return json(res, 200, { type: "file", encoding: "base64", sha: "abc", size: 5, content: Buffer.from("hello").toString("base64") });
-    }
-    if (url.pathname === "/api/v1/repos/novox/hq/branches") {
-      return json(res, 200, [{ name: "main", protected: true, commit: { id: "aaaa" } }, { name: "feat/x", protected: false, commit: { id: "bbbb" } }]);
-    }
-    if (url.pathname === "/api/v1/repos/novox/hq/branches/feat%2Fx" || url.pathname === "/api/v1/repos/novox/hq/branches/feat/x") {
-      if (req.method === "DELETE") { forge.branchDeleted = true; return json(res, 204, null); }
-    }
-    if (url.pathname === "/api/v1/repos/search") {
-      // The client lists through the search endpoint since 2026-09-28 (the forge's whole view);
-      // it sits under `repository`, which write:repository covers.
-      const h = req.headers.authorization ?? "";
-      const value = h.startsWith("token ") ? h.slice(6) : "";
-      if (![...forge.tokens.values()].includes(value)) return json(res, 401, { message: "token is required" });
-      if (!covers(forge.scopesOf.get(value) ?? [], "read:repository")) {
-        return json(res, 403, { message: `token does not have at least one of required scope(s), required=[read:repository]` });
-      }
-      return json(res, 200, {
-        ok: true,
-        data: [{ full_name: "novox/hq", name: "hq", owner: { login: "novox" }, private: true, html_url: "http://fake/novox/hq" }],
-      });
-    }
     if (url.pathname === "/api/v1/user/repos") {
       const h = req.headers.authorization ?? "";
       const value = h.startsWith("token ") ? h.slice(6) : "";
@@ -153,21 +101,6 @@ function fakeForge(): Promise<Forge> {
         { full_name: "novox/hq", name: "hq", owner: { login: "novox" }, private: true, html_url: "http://fake/novox/hq" },
       ]);
     }
-    const adminUser = url.pathname.match(/^\/api\/v1\/admin\/users\/([^/]+)$/);
-    if (adminUser && req.method === "PATCH") {
-      const h = req.headers.authorization ?? "";
-      const value = h.startsWith("token ") ? h.slice(6) : "";
-      if (![...forge.tokens.values()].includes(value)) return json(res, 401, { message: "token is required" });
-      if (!covers(forge.scopesOf.get(value) ?? [], "write:admin")) {
-        return json(res, 403, {
-          message: `token does not have at least one of required scope(s), required=[write:admin]`,
-        });
-      }
-      const login = decodeURIComponent(adminUser[1]);
-      if (login === "untouchable") return json(res, 403, { message: "user untouchable may not be edited" });
-      const patch = await body(req);
-      return json(res, 200, { login, is_admin: patch?.admin === true });
-    }
     return json(res, 404, { message: "no such route in the fake" });
   });
   return new Promise((resolve) => {
@@ -177,11 +110,7 @@ function fakeForge(): Promise<Forge> {
         url: `http://127.0.0.1:${port}`,
         get mints() { return forge.mints; },
         get lastScopes() { return forge.lastScopes; },
-        get pullState() { return forge.pullState; },
-        get pullTitle() { return forge.pullTitle; },
-        get branchDeleted() { return forge.branchDeleted; },
         tokens: forge.tokens,
-        scopesOf: forge.scopesOf,
         admins: forge.admins,
         close: () => new Promise((r) => server.close(() => r())),
       });
@@ -223,14 +152,14 @@ function minted(env: NodeJS.ProcessEnv, logs: string[]): GiteaClient {
 const forge = await fakeForge();
 after(() => forge.close());
 
-test("first start: mints with the admin account, keeps the token at 0600, asks for the tools' scopes only", async () => {
+test("first start: mints with the admin account, keeps the token at 0600, asks for two scopes only", async () => {
   const { env, file, logs } = await delivered(forge);
 
   const repos = await minted(env, logs).listRepos();
 
   assert.equal(repos[0]?.full_name, "novox/hq");
   assert.equal(forge.mints, 1);
-  assert.deepEqual(forge.lastScopes, ["write:repository", "write:issue", "read:user", "write:admin"]);
+  assert.deepEqual(forge.lastScopes, ["write:repository", "write:issue", "read:user"]);
   assert.deepEqual(forge.lastScopes, [...TOKEN_SCOPES]);
   const token = forge.tokens.get("mesh-tools")!;
   assert.equal(await readFile(file, "utf8"), token + "\n");
@@ -268,34 +197,6 @@ test("the forge rejects the kept token (its data was restored): minted afresh, o
   assert.ok(logs.some((l) => l.startsWith("the forge rejected the kept token")), logs.join("\n"));
 });
 
-test("a kept token from before write:admin: the forge refuses the admin route for the scope, the token is re-minted with the whole list, and the call goes through", async () => {
-  const { env, file, logs } = await delivered(forge);
-  const client = minted(env, logs);
-  await client.listRepos();
-  const before = forge.mints;
-  const old = forge.tokens.get("mesh-tools")!;
-  forge.scopesOf.set(old, ["write:repository", "write:issue", "read:user"]); // minted by the previous build
-
-  const user = await client.api<{ login: string; is_admin: boolean }>("/admin/users/mesh_novox_builder", {
-    method: "PATCH",
-    body: JSON.stringify({ admin: true }),
-  });
-
-  assert.equal(user.is_admin, true);
-  assert.equal(forge.mints, before + 1);
-  assert.deepEqual(forge.lastScopes, [...TOKEN_SCOPES]);
-  assert.notEqual(forge.tokens.get("mesh-tools"), old);
-  assert.equal(await readFile(file, "utf8"), forge.tokens.get("mesh-tools") + "\n");
-  assert.ok(logs.some((l) => l.startsWith("the forge rejected the kept token")), logs.join("\n"));
-  // A 403 that is not about scopes is the forge's answer, not a reason to mint.
-  const again = forge.mints;
-  await assert.rejects(
-    client.api("/admin/users/untouchable", { method: "PATCH", body: JSON.stringify({ admin: true }) }),
-    /403 .*untouchable/,
-  );
-  assert.equal(forge.mints, again);
-});
-
 test("the kept file is gone but the forge still holds a token by that name: replaced, not refused", async () => {
   const { env, file, logs } = await delivered(forge);
   await minted(env, logs).listRepos();
@@ -400,16 +301,6 @@ test("the tools register once there is a way to a token, and the first call mint
       "gitea_list_repos", "gitea_create_repo", "gitea_delete_repo",
       "gitea_list_issues", "gitea_get_issue", "gitea_create_issue", "gitea_close_issue", "gitea_add_comment",
       "gitea_list_pull_requests", "gitea_get_pull_request", "gitea_create_pull_request", "gitea_merge_pull_request",
-      "gitea_close_pull_request",
-      "gitea_reopen_pull_request",
-      "gitea_update_pull_request",
-      "gitea_pull_request_files",
-      "gitea_pull_request_diff",
-      "gitea_list_comments",
-      "gitea_reopen_issue",
-      "gitea_get_file",
-      "gitea_list_branches",
-      "gitea_delete_branch",
       "gitea_list_labels", "gitea_create_label",
       "gitea_api",
     ],
@@ -420,32 +311,3 @@ test("the tools register once there is a way to a token, and the first call mint
   assert.equal(result.repos.length, 1);
   assert.equal(forge.mints, before + 1);
 });
-
-// The forge's tools reach every action a review needs without a checkout and without the API
-// escape hatch: close a pull request whose work landed elsewhere, read its diff, its comments, a
-// file, the branches, and delete the branch left behind. Against the fake forge, through the
-// compiled tools, the way the console calls them.
-test("a pull request can be closed, read and cleaned up through the tools", async () => {
-  const { env } = await delivered(forge);
-  const tools = collectTools(env).find((c) => c.module === "gitea")!.tools;
-  const tool = (name: string) => tools.find((t) => t.name === name)!;
-  for (const name of ["gitea_close_pull_request", "gitea_reopen_pull_request", "gitea_update_pull_request", "gitea_pull_request_files",
-    "gitea_pull_request_diff", "gitea_list_comments", "gitea_reopen_issue", "gitea_get_file", "gitea_list_branches", "gitea_delete_branch"]) {
-    assert.ok(tool(name), `${name} is not a tool`);
-  }
-  const closed = (await tool("gitea_close_pull_request").run({ owner: "novox", repo: "hq", number: 223 })) as { pull: { state: string } };
-  assert.equal(closed.pull.state, "closed");
-  assert.equal(forge.pullState, "closed");
-  const renamed = (await tool("gitea_update_pull_request").run({ owner: "novox", repo: "hq", number: 223, title: "Superseded" })) as { pull: { title: string } };
-  assert.equal(renamed.pull.title, "Superseded");
-  const diff = (await tool("gitea_pull_request_diff").run({ owner: "novox", repo: "hq", number: 223 })) as { diff: string };
-  assert.match(diff.diff, /^diff --git/);
-  const comments = (await tool("gitea_list_comments").run({ owner: "novox", repo: "hq", number: 223 })) as { comments: { body: string }[] };
-  assert.equal(comments.comments[0].body, "landed elsewhere");
-  const file = (await tool("gitea_get_file").run({ owner: "novox", repo: "hq", path: "README.md" })) as { file: { content: string } };
-  assert.equal(file.file.content, "hello");
-  const branches = (await tool("gitea_list_branches").run({ owner: "novox", repo: "hq" })) as { branches: { name: string }[] };
-  assert.deepEqual(branches.branches.map((b) => b.name), ["main", "feat/x"]);
-  await tool("gitea_delete_branch").run({ owner: "novox", repo: "hq", branch: "feat/x" });
-  assert.equal(forge.branchDeleted, true);
-});

modules/gitea/token.ts

@@ -34,21 +34,15 @@ export const TOKEN_NAME = "mesh-tools";
  *                      It sits under the `user` category despite listing repositories, not `repository`
  *                      — confirmed against the running forge (1.27.3), which answered
  *                      `required=[read:user]` to a token carrying only the other two.
- *   write:admin      — /admin/users: the forge's own users are the mesh's to settle, such as making
- *                      the builder's login a site admin so every repository the mesh may build is
- *                      clonable (novox/hq 229). Nothing under /orgs or write:user.
- *
- * A token kept from before a scope was added lacks it: the forge answers such a call with
- * `403 token does not have at least one of required scope(s)`, and the client treats that like a
- * 401 — the source re-mints by name, with the whole list, and the call is retried once.
+ * Nothing under /admin, /orgs or write:user — the escape-hatch tool reaches only what these three cover.
  */
-export const TOKEN_SCOPES: readonly string[] = ["write:repository", "write:issue", "read:user", "write:admin"];
+export const TOKEN_SCOPES: readonly string[] = ["write:repository", "write:issue", "read:user"];
 
 /** Where a client's token comes from, and what to do when the forge says it is wrong. */
 export interface TokenSource {
   /** The token to authenticate with now; minted, read or configured. */
   current(): Promise<string>;
-  /** The forge answered 401 to `rejected`, or 403 for a scope it lacks. A fresh token, or a plain error when there is nothing to renew with. */
+  /** The forge answered 401 to `rejected`. A fresh token, or a plain error when there is nothing to renew with. */
   renew(rejected: string): Promise<string>;
 }
 
@@ -176,11 +170,6 @@ export class MintedToken implements TokenSource {
     return this.mint("the forge rejected the kept token — minting a fresh one");
   }
 
-  /** What the forge's scoped tokens say when a kept token predates a scope the tools now need. */
-  static lacksScope(status: number, body: string): boolean {
-    return status === 403 && /required scope/i.test(body);
-  }
-
   /** One mint at a time: concurrent first calls share it, rather than each minting its own. */
   private mint(why: string): Promise<string> {
     if (this.inflight === null) {

modules/gitea/tools/index.ts

@@ -254,131 +254,6 @@ export function getGiteaTools(gitea: GiteaClient): ToolDefinition[] {
       },
     },
 
-    {
-      name: "gitea_close_pull_request",
-      description: "Close a pull request without merging it — one whose work landed elsewhere, or was abandoned.",
-      input: {
-        owner: { type: "string", description: "the repository owner" },
-        repo: { type: "string", description: "the repository name" },
-        number: { type: "number", description: "the PR number" },
-      },
-      run: async (args) => ({
-        pull: await gitea.setPullState(String(args.owner), String(args.repo), Number(args.number), "closed"),
-      }),
-    },
-    {
-      name: "gitea_reopen_pull_request",
-      description: "Reopen a closed, unmerged pull request.",
-      input: {
-        owner: { type: "string", description: "the repository owner" },
-        repo: { type: "string", description: "the repository name" },
-        number: { type: "number", description: "the PR number" },
-      },
-      run: async (args) => ({
-        pull: await gitea.setPullState(String(args.owner), String(args.repo), Number(args.number), "open"),
-      }),
-    },
-    {
-      name: "gitea_update_pull_request",
-      description: "Change a pull request's title or body; a field not given is left as it is.",
-      input: {
-        owner: { type: "string", description: "the repository owner" },
-        repo: { type: "string", description: "the repository name" },
-        number: { type: "number", description: "the PR number" },
-        title: { type: "string", description: "the new title (optional)" },
-        body: { type: "string", description: "the new body, markdown (optional)" },
-      },
-      run: async (args) => ({
-        pull: await gitea.updatePullRequest(String(args.owner), String(args.repo), Number(args.number), {
-          title: args.title === undefined ? undefined : String(args.title),
-          body: args.body === undefined ? undefined : String(args.body),
-        }),
-      }),
-    },
-    {
-      name: "gitea_pull_request_files",
-      description: "The files a pull request changes, as paths from the repository's root (up to 100; says when there are more).",
-      input: {
-        owner: { type: "string", description: "the repository owner" },
-        repo: { type: "string", description: "the repository name" },
-        number: { type: "number", description: "the PR number" },
-      },
-      run: async (args) => gitea.listPullFiles(String(args.owner), String(args.repo), Number(args.number)),
-    },
-    {
-      name: "gitea_pull_request_diff",
-      description: "A pull request's unified diff, as text — for reviewing it without a checkout.",
-      input: {
-        owner: { type: "string", description: "the repository owner" },
-        repo: { type: "string", description: "the repository name" },
-        number: { type: "number", description: "the PR number" },
-      },
-      run: async (args) => ({
-        diff: await gitea.pullDiff(String(args.owner), String(args.repo), Number(args.number)),
-      }),
-    },
-    {
-      name: "gitea_list_comments",
-      description: "Every comment on an issue or pull request, oldest first.",
-      input: {
-        owner: { type: "string", description: "the repository owner" },
-        repo: { type: "string", description: "the repository name" },
-        number: { type: "number", description: "the issue or PR number" },
-      },
-      run: async (args) => ({
-        comments: await gitea.listComments(String(args.owner), String(args.repo), Number(args.number)),
-      }),
-    },
-    {
-      name: "gitea_reopen_issue",
-      description: "Reopen a closed issue.",
-      input: {
-        owner: { type: "string", description: "the repository owner" },
-        repo: { type: "string", description: "the repository name" },
-        number: { type: "number", description: "the issue number" },
-      },
-      run: async (args) => ({
-        issue: await gitea.setIssueState(String(args.owner), String(args.repo), Number(args.number), "open"),
-      }),
-    },
-
-    // ---- Contents and branches ----
-    {
-      name: "gitea_get_file",
-      description: "One file's contents from a repository, decoded, at a branch, tag or commit (default the repository's default branch).",
-      input: {
-        owner: { type: "string", description: "the repository owner" },
-        repo: { type: "string", description: "the repository name" },
-        path: { type: "string", description: "the file's path from the repository's root" },
-        ref: { type: "string", description: "branch, tag or commit (optional)" },
-      },
-      run: async (args) => ({
-        file: await gitea.getFile(String(args.owner), String(args.repo), String(args.path), args.ref ? String(args.ref) : undefined),
-      }),
-    },
-    {
-      name: "gitea_list_branches",
-      description: "Every branch of a repository with the commit it points at.",
-      input: {
-        owner: { type: "string", description: "the repository owner" },
-        repo: { type: "string", description: "the repository name" },
-      },
-      run: async (args) => ({ branches: await gitea.listBranches(String(args.owner), String(args.repo)) }),
-    },
-    {
-      name: "gitea_delete_branch",
-      description: "Delete a branch — a feature branch whose pull request was closed rather than merged. Refused by the forge for a protected branch.",
-      input: {
-        owner: { type: "string", description: "the repository owner" },
-        repo: { type: "string", description: "the repository name" },
-        branch: { type: "string", description: "the branch name" },
-      },
-      run: async (args) => {
-        await gitea.deleteBranch(String(args.owner), String(args.repo), String(args.branch));
-        return { deleted: true, branch: String(args.branch) };
-      },
-    },
-
     // ---- Labels ----
     {
       name: "gitea_list_labels",

modules/gitlab/Dockerfile

@@ -0,0 +1,24 @@
+# gitlab's runtime: the tool runtime, carrying this module's compiled code.
+#
+# **Built from this module's own directory and nothing else.** The sdk and the tool runtime are in
+# the base images, published like any other artifact — which is what makes this buildable by the
+# mesh from a repository and a path (novox/hq ADR 0069) rather than only on a workstation that
+# happens to have the siblings.
+#
+# Two bases, named rather than pinned (novox/hq issue 044): the image this is COMPILED in and the
+# image it RUNS in — the second must not carry a compiler. Declared in module.json's `build.on`.
+ARG BUILD_BASE
+ARG RUNTIME_BASE
+
+FROM ${BUILD_BASE} AS build
+WORKDIR /app/modules/gitlab
+COPY . .
+RUN node /app/node_modules/typescript/bin/tsc client.ts tools/index.ts \
+      --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist
+
+FROM ${RUNTIME_BASE}
+COPY --from=build /app/modules/gitlab/dist /app/modules/gitlab/dist
+# Every serve-time entrypoint, loaded by the runtime in serve mode: tools and events serve, and a
+# provider's provisioner runs its reconcile loop in the same process, with the broker connected —
+# the convention novox/hq issues 060/061 settled.
+ENV MESH_TOOL_MODULES=/app/modules/gitlab/dist/tools/index.js

modules/gitlab/module.json

@@ -2,43 +2,69 @@
   "module": "gitlab",
   "version": "1",
   "own-secrets": {
-    "token": "${dir:state}/token"
+    "token": "/var/lib/gitlab/token",
+    "broker": "/var/lib/mesh/gitlab/broker"
   },
   "resources": [
+    {
+      "id": "mesh-state",
+      "type": "directory",
+      "path": "/var/lib/mesh/gitlab",
+      "mode": "0700"
+    },
     {
       "id": "state",
       "type": "directory",
-      "mode": "0700",
-      "place": "."
+      "path": "/var/lib/gitlab",
+      "mode": "0700"
     },
     {
       "id": "config",
       "type": "file",
-      "path": "${dir:state}/config.json",
+      "path": "/var/lib/gitlab/config.json",
       "merge": "json",
       "content": "{}",
       "mode": "0600"
+    },
+    {
+      "id": "runtime",
+      "type": "container",
+      "name": "mesh-runtime-gitlab",
+      "network": "host",
+      "volumes": [
+        "/var/lib/gitlab/config.json:/run/config/config.json:ro",
+        "/var/lib/gitlab/token:/run/secrets/token:ro",
+        "/var/lib/mesh/gitlab/broker:/run/secrets/broker:ro"
+      ],
+      "env": {
+        "MESH_GITLAB_TOKEN_FILE": "/run/secrets/token",
+        "MESH_GITLAB_CONFIG_FILE": "/run/config/config.json",
+        "MESH_BROKER_FILE": "/run/secrets/broker"
+      },
+      "artifact": "runtime"
     }
   ],
   "capabilities": [
     "container-runtime"
   ],
   "build": {
+    "on": [
+      {
+        "arg": "BUILD_BASE",
+        "module": "mesh-tools",
+        "artifact": "build"
+      },
+      {
+        "arg": "RUNTIME_BASE",
+        "module": "mesh-tools",
+        "artifact": "runtime"
+      }
+    ],
     "artifacts": [
       {
-        "name": "tools",
-        "kind": "bundle",
-        "language": "typescript",
-        "entrypoints": [
-          "tools/index.js"
-        ],
-        "loads": [
-          "tools/index.js"
-        ],
-        "env": {
-          "MESH_GITLAB_TOKEN_FILE": "${dir:state}/token",
-          "MESH_GITLAB_CONFIG_FILE": "${dir:state}/config.json"
-        }
+        "name": "runtime",
+        "kind": "image",
+        "from": "Dockerfile"
       }
     ]
   }

modules/grafana/Dockerfile

@@ -0,0 +1,24 @@
+# grafana's runtime: the tool runtime, carrying this module's compiled code.
+#
+# **Built from this module's own directory and nothing else.** The sdk and the tool runtime are in
+# the base images, published like any other artifact — which is what makes this buildable by the
+# mesh from a repository and a path (novox/hq ADR 0069) rather than only on a workstation that
+# happens to have the siblings.
+#
+# Two bases, named rather than pinned (novox/hq issue 044): the image this is COMPILED in and the
+# image it RUNS in — the second must not carry a compiler. Declared in module.json's `build.on`.
+ARG BUILD_BASE
+ARG RUNTIME_BASE
+
+FROM ${BUILD_BASE} AS build
+WORKDIR /app/modules/grafana
+COPY . .
+RUN node /app/node_modules/typescript/bin/tsc client.ts index.ts tools/index.ts \
+      --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist
+
+FROM ${RUNTIME_BASE}
+COPY --from=build /app/modules/grafana/dist /app/modules/grafana/dist
+# Every serve-time entrypoint, loaded by the runtime in serve mode: tools and events serve, and a
+# provider's provisioner runs its reconcile loop in the same process, with the broker connected —
+# the convention novox/hq issues 060/061 settled.
+ENV MESH_TOOL_MODULES=/app/modules/grafana/dist/index.js,/app/modules/grafana/dist/tools/index.js

modules/grafana/module.json

@@ -5,7 +5,8 @@
     "alert.firing"
   ],
   "own-secrets": {
-    "admin": "${dir:mesh-state}/admin"
+    "admin": "/var/lib/grafana-module/admin.secret",
+    "broker": "/var/lib/mesh/grafana/broker"
   },
   "capabilities": [
     "container-runtime"
@@ -23,142 +24,103 @@
     {
       "id": "mesh-state",
       "type": "directory",
-      "mode": "0700",
-      "place": "mesh"
+      "path": "/var/lib/mesh/grafana",
+      "mode": "0700"
     },
     {
       "id": "state",
       "type": "directory",
-      "mode": "0700",
-      "place": "."
+      "path": "/var/lib/grafana-module",
+      "mode": "0700"
     },
     {
       "id": "data",
       "type": "directory",
+      "path": "/services/grafana/data",
       "mode": "0700",
       "owner": "472:472"
     },
     {
-      "id": "admin-secret",
+      "id": "server-env",
       "type": "file",
-      "path": "${dir:state}/admin.secret",
-      "mode": "0400",
-      "owner": "472:472",
-      "content": "${secret:admin}"
-    },
-    {
-      "id": "oidc-secret",
-      "type": "file",
-      "path": "${dir:state}/oidc-client.secret",
-      "mode": "0400",
-      "owner": "472:472",
-      "content": "${secret:oidc-client}"
-    },
-    {
-      "id": "oidc-env",
-      "type": "file",
-      "path": "${dir:state}/oidc.env",
-      "mode": "0644",
-      "content": "GF_SERVER_ROOT_URL=https://${bound:route:name}\nGF_AUTH_GENERIC_OAUTH_ENABLED=true\nGF_AUTH_GENERIC_OAUTH_NAME=Keycloak\nGF_AUTH_GENERIC_OAUTH_CLIENT_ID=${bound:oidc-client:as}\nGF_AUTH_GENERIC_OAUTH_CLIENT_SECRET__FILE=/run/secrets/oidc-client\nGF_AUTH_GENERIC_OAUTH_SCOPES=openid email profile roles\nGF_AUTH_GENERIC_OAUTH_AUTH_URL=${bound:oidc-client:issuer}${bound:oidc-client:authorization-path}\nGF_AUTH_GENERIC_OAUTH_TOKEN_URL=${bound:oidc-client:issuer}${bound:oidc-client:token-path}\nGF_AUTH_GENERIC_OAUTH_API_URL=${bound:oidc-client:issuer}${bound:oidc-client:userinfo-path}\nGF_AUTH_GENERIC_OAUTH_ROLE_ATTRIBUTE_PATH=contains(roles[*], 'admin') && 'Admin' || contains(realm_access.roles[*], 'admin') && 'Admin' || 'Viewer'\nGF_AUTH_GENERIC_OAUTH_USE_PKCE=true\nGF_AUTH_GENERIC_OAUTH_ALLOW_SIGN_UP=true\nGF_AUTH_GENERIC_OAUTH_ALLOW_ASSIGN_GRAFANA_ADMIN=true\n"
-    },
-    {
-      "id": "influxdb-secret",
-      "type": "file",
-      "path": "${dir:state}/influxdb-api.secret",
-      "mode": "0400",
-      "owner": "472:472",
-      "content": "${secret:influxdb-api}"
-    },
-    {
-      "id": "influxdb-datasource",
-      "type": "file",
-      "path": "${dir:state}/datasource-influxdb.yaml",
-      "mode": "0644",
-      "content": "apiVersion: 1\n# Written by the mesh from grafana's influxdb-api binding; grafana reads it at start. Its own name and\n# uid, so a data source somebody made in the UI is never overwritten, and read-only in the UI because\n# the mesh resets it. The password is read from the file the mesh delivers, never written here.\ndatasources:\n  - name: InfluxDB (mesh)\n    uid: mesh-influxdb-api\n    type: influxdb\n    access: proxy\n    url: ${bound:influxdb-api:scheme}://${bound:influxdb-api:at}:${bound:influxdb-api:port}\n    user: ${bound:influxdb-api:as}\n    isDefault: false\n    editable: false\n    jsonData:\n      dbName: ${bound:influxdb-api:bucket}\n      httpMode: POST\n    secureJsonData:\n      password: $__file{/run/secrets/influxdb-api}\n"
+      "path": "/var/lib/grafana-module/server.env",
+      "mode": "0600",
+      "content": "GF_SECURITY_ADMIN_PASSWORD=${secret:admin}\n"
     },
     {
       "id": "server",
       "type": "container",
       "name": "grafana",
-      "image": "grafana/grafana@sha256:ac461fb352abc50da10a51c7d02462e9c05488f11f53f14b3ad79a8145f638a0",
+      "image": "grafana/grafana@sha256:f772d434e8fab0049deb2b1b30abd43342bcfca1537614aa8d36080232cf4283",
       "ports": [
         "3000"
       ],
       "volumes": [
-        "${dir:data}:/var/lib/grafana",
-        "${dir:state}/admin.secret:/run/secrets/admin:ro",
-        "${dir:state}/oidc-client.secret:/run/secrets/oidc-client:ro",
-        "${dir:state}/influxdb-api.secret:/run/secrets/influxdb-api:ro",
-        "${dir:state}/datasource-influxdb.yaml:/etc/grafana/provisioning/datasources/mesh-influxdb.yaml:ro"
+        "/services/grafana/data:/var/lib/grafana"
       ],
-      "env": {
-        "GF_SECURITY_ADMIN_PASSWORD__FILE": "/run/secrets/admin"
-      },
       "env-file": [
-        "${dir:state}/oidc.env"
+        "/var/lib/grafana-module/server.env"
       ],
-      "restart-on": [
-        "oidc-env",
-        "oidc-secret",
-        "influxdb-datasource",
-        "influxdb-secret"
-      ]
+      "secrets-in-environment": "grafana honours GF_SECURITY_ADMIN_PASSWORD__FILE; convertible, awaiting a bed that exercises the admin password (assigned-grafana serves tools only)"
     },
     {
       "id": "runtime-config",
       "type": "file",
-      "path": "${dir:mesh-state}/config.json",
+      "path": "/var/lib/mesh/grafana/config.json",
       "mode": "0600",
-      "content": "{\n  \"user\": \"admin\",\n  \"password\": \"${secret:admin}\"\n}\n",
+      "content": "{}\n",
       "merge": "json"
+    },
+    {
+      "id": "runtime",
+      "type": "container",
+      "name": "mesh-grafana",
+      "network": "host",
+      "volumes": [
+        "/var/lib/mesh/grafana/broker:/run/secrets/broker:ro",
+        "/var/lib/mesh/grafana/config.json:/run/config/config.json:ro"
+      ],
+      "env": {
+        "MESH_BROKER_FILE": "/run/secrets/broker",
+        "MESH_GRAFANA_URL": "http://127.0.0.1:3000",
+        "MESH_GRAFANA_CONFIG_FILE": "/run/config/config.json"
+      },
+      "restart-on": [
+        "runtime-config"
+      ],
+      "artifact": "runtime"
     }
   ],
   "requires": [
-    "route",
-    "oidc-client",
-    "influxdb-api"
+    "route"
   ],
   "contributes": {
     "route": {
       "label": "grafana",
       "endpoint": "web"
-    },
-    "oidc-client": {
-      "label": "grafana",
-      "endpoint": "web",
-      "callback": "/login/generic_oauth"
-    },
-    "influxdb-api": {
-      "access": "read"
     }
   },
   "binds": {
-    "route": "${dir:state}/route.json",
-    "oidc-client": "${dir:state}/oidc.json",
-    "influxdb-api": "${dir:state}/influxdb.json"
-  },
-  "secrets": {
-    "oidc-client": "${dir:mesh-state}/oidc-client",
-    "influxdb-api": "${dir:mesh-state}/influxdb-api"
+    "route": "/var/lib/mesh/grafana/route.json"
   },
   "build": {
+    "on": [
+      {
+        "arg": "BUILD_BASE",
+        "module": "mesh-tools",
+        "artifact": "build"
+      },
+      {
+        "arg": "RUNTIME_BASE",
+        "module": "mesh-tools",
+        "artifact": "runtime"
+      }
+    ],
     "artifacts": [
       {
-        "name": "code",
-        "kind": "bundle",
-        "language": "typescript",
-        "entrypoints": [
-          "index.js",
-          "tools/index.js"
-        ],
-        "loads": [
-          "index.js",
-          "tools/index.js"
-        ],
-        "env": {
-          "MESH_GRAFANA_URL": "http://127.0.0.1:${port:3000}",
-          "MESH_GRAFANA_CONFIG_FILE": "${dir:mesh-state}/config.json"
-        }
+        "name": "runtime",
+        "kind": "image",
+        "from": "Dockerfile"
       }
     ]
   }

modules/hello-web/module.json

@@ -15,7 +15,7 @@
     }
   },
   "binds": {
-    "route": "${dir:state}/route.json"
+    "route": "/var/lib/hello-web/route.json"
   },
   "listens": [
     {
@@ -30,13 +30,13 @@
     {
       "id": "state",
       "type": "directory",
-      "mode": "0700",
-      "place": "."
+      "path": "/var/lib/hello-web",
+      "mode": "0700"
     },
     {
       "id": "page",
       "type": "file",
-      "path": "${dir:state}/index.html",
+      "path": "/var/lib/hello-web/index.html",
       "mode": "0644",
       "content": "hello from hello-web, routed by the mesh\n"
     },
@@ -54,7 +54,7 @@
         "8080"
       ],
       "volumes": [
-        "${dir:state}/index.html:/www/index.html:ro"
+        "/var/lib/hello-web/index.html:/www/index.html:ro"
       ],
       "args": [
         "sh",

modules/home-assistant/Dockerfile

@@ -0,0 +1,24 @@
+# home-assistant's runtime: the tool runtime, carrying this module's compiled code.
+#
+# **Built from this module's own directory and nothing else.** The sdk and the tool runtime are in
+# the base images, published like any other artifact — which is what makes this buildable by the
+# mesh from a repository and a path (novox/hq ADR 0069) rather than only on a workstation that
+# happens to have the siblings.
+#
+# Two bases, named rather than pinned (novox/hq issue 044): the image this is COMPILED in and the
+# image it RUNS in — the second must not carry a compiler. Declared in module.json's `build.on`.
+ARG BUILD_BASE
+ARG RUNTIME_BASE
+
+FROM ${BUILD_BASE} AS build
+WORKDIR /app/modules/home-assistant
+COPY . .
+RUN node /app/node_modules/typescript/bin/tsc client.ts index.ts tools/index.ts \
+      --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist
+
+FROM ${RUNTIME_BASE}
+COPY --from=build /app/modules/home-assistant/dist /app/modules/home-assistant/dist
+# Every serve-time entrypoint, loaded by the runtime in serve mode: tools and events serve, and a
+# provider's provisioner runs its reconcile loop in the same process, with the broker connected —
+# the convention novox/hq issues 060/061 settled.
+ENV MESH_TOOL_MODULES=/app/modules/home-assistant/dist/index.js,/app/modules/home-assistant/dist/tools/index.js

modules/home-assistant/module.json

@@ -9,7 +9,8 @@
     "state.changed"
   ],
   "own-secrets": {
-    "token": "${dir:mesh-state}/token"
+    "broker": "/var/lib/mesh/home-assistant/broker",
+    "token": "/var/lib/mesh/home-assistant/token"
   },
   "listens": [
     {
@@ -17,151 +18,98 @@
       "port": 8123,
       "protocol": "tcp",
       "from": "mesh",
-      "why": "the dashboard, the API and the companion apps"
-    },
-    {
-      "name": "sonos-events",
-      "port": 1400,
-      "protocol": "tcp",
-      "from": "mesh",
-      "why": "the Sonos integration's event callback: speakers push their state changes here"
-    },
-    {
-      "name": "webrtc",
-      "port": 18555,
-      "protocol": "tcp",
-      "from": "mesh",
-      "why": "the bundled go2rtc's WebRTC port, which camera streams to a browser use"
+      "why": "the dashboard and the API"
     }
   ],
   "resources": [
     {
       "id": "mesh-state",
       "type": "directory",
-      "mode": "0700",
-      "place": "mesh"
-    },
-    {
-      "id": "state",
-      "type": "directory",
-      "mode": "0700",
-      "place": "."
+      "path": "/var/lib/mesh/home-assistant",
+      "mode": "0700"
     },
     {
       "id": "config",
       "type": "directory",
-      "mode": "0700"
-    },
-    {
-      "id": "written",
-      "type": "directory",
-      "mode": "0700"
+      "path": "/services/home-assistant/config",
+      "mode": "0700",
+      "owner": "1000:1000"
     },
     {
       "id": "server",
       "type": "container",
       "name": "home-assistant",
-      "image": "ghcr.io/home-assistant/home-assistant@sha256:d8922685169707fd91e8b9729902d975f06157d005e422874d201e0261dda196",
+      "image": "ghcr.io/home-assistant/home-assistant@sha256:14931c6b13756317849f46da1d01b45937a1150db66c081cfe529d48215943fe",
       "network": "host",
       "env": {
         "TZ": "Etc/UTC"
       },
       "volumes": [
-        "${dir:config}:/config"
+        "/services/home-assistant/config:/config"
       ]
     },
     {
       "id": "runtime-config",
       "type": "file",
-      "path": "${dir:mesh-state}/config.json",
+      "path": "/var/lib/mesh/home-assistant/config.json",
       "mode": "0600",
       "content": "{}\n",
       "merge": "json"
     },
     {
-      "id": "provisions-env",
-      "type": "file",
-      "path": "${dir:state}/provisions.env",
-      "mode": "0600",
-      "content": "MESH_HOMEASSISTANT_URL=http://127.0.0.1:${port:8123}\nMESH_HOMEASSISTANT_TOKEN_FILE=${dir:mesh-state}/token\nMESH_PROVISIONS_DIR=${dir:state}\nMESH_WRITTEN_DIR=${dir:written}\n"
-    },
-    {
-      "id": "provisions",
-      "type": "process",
-      "name": "home-assistant-provisions",
-      "artifact": "code",
-      "run": [
-        "node",
-        "provisions/index.js"
-      ],
-      "run-once": true,
-      "env-file": [
-        "${dir:state}/provisions.env"
+      "id": "runtime",
+      "type": "container",
+      "name": "mesh-home-assistant",
+      "network": "host",
+      "volumes": [
+        "/var/lib/mesh/home-assistant/broker:/run/secrets/broker:ro",
+        "/var/lib/mesh/home-assistant/token:/run/secrets/token:ro",
+        "/var/lib/mesh/home-assistant/config.json:/run/config/config.json:ro",
+        "/services/home-assistant/config:/var/lib/home-assistant/config:ro"
       ],
+      "env": {
+        "MESH_BROKER_FILE": "/run/secrets/broker",
+        "MESH_HOMEASSISTANT_URL": "http://127.0.0.1:8123",
+        "MESH_HOMEASSISTANT_TOKEN_FILE": "/run/secrets/token",
+        "MESH_HOMEASSISTANT_CONFIG_FILE": "/run/config/config.json",
+        "MESH_HOMEASSISTANT_CONFIG_DIR": "/var/lib/home-assistant/config"
+      },
       "restart-on": [
-        "provisions-env",
-        "bound-mqtt-topic",
-        "secret-mqtt-topic",
-        "bound-sonarr-api",
-        "secret-sonarr-api",
-        "bound-radarr-api",
-        "secret-radarr-api",
-        "bound-lidarr-api",
-        "secret-lidarr-api"
-      ]
+        "runtime-config"
+      ],
+      "artifact": "runtime"
     }
   ],
   "requires": [
-    "lidarr-api",
-    "mqtt-topic",
-    "radarr-api",
-    "route",
-    "sonarr-api"
+    "route"
   ],
   "contributes": {
-    "mqtt-topic": {
-      "topics": [
-        "#"
-      ]
-    },
     "route": {
       "label": "home-assistant",
       "endpoint": "web"
     }
   },
   "binds": {
-    "route": "${dir:state}/route.json",
-    "mqtt-topic": "${dir:state}/mqtt-topic.json",
-    "sonarr-api": "${dir:state}/sonarr-api.json",
-    "radarr-api": "${dir:state}/radarr-api.json",
-    "lidarr-api": "${dir:state}/lidarr-api.json"
-  },
-  "secrets": {
-    "mqtt-topic": "${dir:state}/mqtt-topic.secret",
-    "sonarr-api": "${dir:state}/sonarr-api.secret",
-    "radarr-api": "${dir:state}/radarr-api.secret",
-    "lidarr-api": "${dir:state}/lidarr-api.secret"
+    "route": "/var/lib/mesh/home-assistant/route.json"
   },
   "build": {
+    "on": [
+      {
+        "arg": "BUILD_BASE",
+        "module": "mesh-tools",
+        "artifact": "build"
+      },
+      {
+        "arg": "RUNTIME_BASE",
+        "module": "mesh-tools",
+        "artifact": "runtime"
+      }
+    ],
     "artifacts": [
       {
-        "name": "code",
-        "kind": "bundle",
-        "language": "typescript",
-        "entrypoints": [
-          "index.js",
-          "tools/index.js",
-          "provisions/index.js"
-        ],
-        "loads": [
-          "index.js",
-          "tools/index.js"
-        ],
-        "env": {
-          "MESH_HOMEASSISTANT_URL": "http://127.0.0.1:${port:8123}",
-          "MESH_HOMEASSISTANT_TOKEN_FILE": "${dir:mesh-state}/token",
-          "MESH_HOMEASSISTANT_CONFIG_FILE": "${dir:mesh-state}/config.json"
-        }
+        "name": "runtime",
+        "kind": "image",
+        "from": "Dockerfile"
       }
     ]
   }

modules/home-assistant/package.json

@@ -1,14 +1,9 @@
 {
   "name": "@novox/module-home-assistant",
   "version": "0.1.0",
-  "description": "home-assistant \u2014 home automation platform. Its API client, tools and events live here (novox/hq ADR 0039).",
+  "description": "home-assistant — home automation platform. Its API client, tools and events live here (novox/hq ADR 0039).",
   "type": "module",
   "private": true,
-  "scripts": {
-    "build": "tsc client.ts index.ts tools/index.ts provisions/hass.ts provisions/probe.ts provisions/connections.ts provisions/mesh.ts provisions/index.ts --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist",
-    "typecheck": "tsc -p tsconfig.json",
-    "test": "node --test --experimental-strip-types 'test/*.test.ts'"
-  },
   "dependencies": {
     "@novox/mesh-sdk": "^0.1.0"
   },

modules/home-assistant/provisions/connections.ts

@@ -1,486 +0,0 @@
-// How home-assistant's provisions step brings Home Assistant's integrations in line with what the
-// mesh bound: the MQTT integration to `mqtt-topic`, the Sonarr, Radarr and Lidarr integrations to
-// `sonarr-api`, `radarr-api` and `lidarr-api`. Pure logic over two seams — Home Assistant's config
-// flows (hass.ts) and the broker/apps — so it is tested against fakes (test/provisions.test.ts).
-//
-// The half that reads files and talks HTTP lives beside it (mesh.ts, hass.ts, probe.ts, index.ts).
-
-import { createHash } from "node:crypto";
-
-import type { Hass, SchemaField } from "./hass.js";
-import type { Probe } from "./probe.js";
-
-/** What the mesh wrote at `binds.<provision>` (the controller's binding document). */
-export interface Binding {
-  provision?: string;
-  from?: string;
-  at?: string;
-  as?: string;
-  serves?: Record<string, unknown>;
-}
-
-/** How one provision came out. Never carries a credential. */
-export type Outcome =
-  | { what: string; result: "unchanged"; note?: string }
-  | { what: string; result: "written"; fields: string[]; note?: string }
-  | { what: string; result: "equivalent"; note: string }
-  | { what: string; result: "refused"; problem: string };
-
-/** A port the binding serves, or undefined when it names none usable. */
-export function portOf(serves: Record<string, unknown> | undefined): number | undefined {
-  const port = Number(serves?.port);
-  return Number.isInteger(port) && port > 0 && port <= 65535 ? port : undefined;
-}
-
-/** A host as it goes into a URL: an IPv6 literal bracketed. */
-export function urlHost(host: string): string {
-  return host.includes(":") && !host.startsWith("[") ? `[${host}]` : host;
-}
-
-/**
- * What this step last wrote, per target, as a digest: the only way to know "already as the mesh
- * says" for a credential Home Assistant will not show back. A sha256 over the target and the values,
- * never the values; kept in the module's own placed directory.
- */
-export interface Marks {
-  get(name: string): Promise<string | undefined>;
-  set(name: string, digest: string): Promise<void>;
-}
-
-export function digest(...parts: (string | number)[]): string {
-  return createHash("sha256").update(parts.map(String).join("\u0000")).digest("hex");
-}
-
-/** An error as text with the credential taken out, raw and URL-encoded. */
-export function scrub(err: unknown, ...secrets: (string | undefined)[]): string {
-  let text = err instanceof Error ? err.message : String(err);
-  for (const s of secrets) {
-    if (!s) continue;
-    for (const form of new Set([s, encodeURIComponent(s)])) text = text.split(form).join("***");
-  }
-  return text;
-}
-
-/**
- * What a form would submit if a person pressed "submit" without touching it: each field's
- * suggested value (what Home Assistant pre-fills from the entry), else its default; a section's
- * fields nested under its name. The step lays only the connection fields over this, so every other
- * choice the entry carries is sent back exactly as Home Assistant showed it.
- */
-export function formValues(schema: readonly SchemaField[] | null | undefined): Record<string, unknown> {
-  const out: Record<string, unknown> = {};
-  for (const field of schema ?? []) {
-    if (Array.isArray(field.schema)) {
-      out[field.name] = formValues(field.schema);
-      continue;
-    }
-    const suggested = field.description?.suggested_value;
-    if (suggested !== undefined && suggested !== null) out[field.name] = suggested;
-    else if (field.default !== undefined) out[field.name] = field.default;
-  }
-  return out;
-}
-
-/** Whether a form has a field of this name at its top level. */
-export function hasField(schema: readonly SchemaField[] | null | undefined, name: string): boolean {
-  return (schema ?? []).some((f) => f.name === name);
-}
-
-// ---- MQTT ----
-
-// Home Assistant's MQTT integration, pointed at the broker the mesh bound — `mqtt-topic`.
-//
-// **Why a step.** Home Assistant keeps its broker, login and password in its MQTT config entry
-// (`.storage/core.config_entries`), not in a file the mesh could fill with `${bound:mqtt-topic:at}`.
-// So this reads the binding and the pair credential and makes the entry say the same thing, through
-// the MQTT integration's own reconfigure flow — the flow its "Reconfigure" button runs, which tests
-// the connection itself and saves nothing it could not connect with.
-//
-// **Only the connection, and only when it differs.** Broker, port, username, password. The protocol
-// version, client id, keepalive, TLS choices and discovery options the entry holds are sent back
-// exactly as Home Assistant pre-filled them. Whether the password already matches cannot be read
-// back (Home Assistant never shows a stored password), so the step keeps a digest of what it last
-// wrote: equal broker/port/username and an equal digest is "already as the mesh says".
-//
-// **Nothing loses its connection without someone seeing it.** Before Home Assistant is touched the
-// broker itself is asked whether it takes the delivered login (the provisioner creates it within
-// seconds of the grant): if not, nothing is written and the step fails saying why, and Home
-// Assistant keeps the login it has — the carried `luffy` on ace, which mosquitto keeps. If Home
-// Assistant's own connection test refuses the new settings, the flow saves nothing, and the step
-// fails with Home Assistant's reason. A login that may not subscribe to the discovery topics is said
-// as a warning: discovery would find nothing.
-
-export const MQTT_PROVISION = "mqtt-topic";
-/** Home Assistant's discovery prefix, subscribed to whenever discovery is on (the default). */
-export const DISCOVERY_FILTER = "homeassistant/#";
-
-export interface MqttWanted {
-  host: string;
-  port: number;
-  username: string;
-  password: string;
-}
-
-export type Wanted = { ok: true; want: MqttWanted } | { ok: false; problem: string };
-
-/** The broker, port and login the mesh says Home Assistant uses. */
-export function wantedMqtt(binding: Binding | undefined, credential: string | undefined): Wanted {
-  if (!binding) return { ok: false, problem: `no binding for ${MQTT_PROVISION} was delivered — the mesh writes it before this step runs` };
-  const host = typeof binding.at === "string" ? binding.at.trim() : "";
-  if (!host) return { ok: false, problem: `the ${MQTT_PROVISION} binding names no host (at)` };
-  const port = portOf(binding.serves);
-  if (port === undefined) return { ok: false, problem: `the ${MQTT_PROVISION} binding serves no usable port (${String(binding.serves?.port)})` };
-  const scheme = binding.serves?.scheme;
-  if (scheme !== undefined && scheme !== "mqtt") {
-    return { ok: false, problem: `the ${MQTT_PROVISION} binding serves scheme ${String(scheme)}; this step writes plain MQTT` };
-  }
-  const username = typeof binding.as === "string" ? binding.as.trim() : "";
-  if (!username) return { ok: false, problem: `the ${MQTT_PROVISION} binding names no login (as)` };
-  const password = (credential ?? "").replace(/\n$/, "");
-  if (!password) return { ok: false, problem: `the ${MQTT_PROVISION} credential is empty or was not delivered` };
-  return { ok: true, want: { host, port, username, password } };
-}
-
-export interface MqttDeps {
-  hass: Hass;
-  probe: Probe;
-  marks: Marks;
-}
-
-const markFor = (entryId: string, w: MqttWanted): string => digest("mqtt", entryId, w.host, w.port, w.username, w.password);
-
-/** Bring Home Assistant's MQTT entry in line with the mesh. Never throws: every failure is an outcome. */
-export async function reconcileMqtt(deps: MqttDeps, binding: Binding | undefined, credential: string | undefined): Promise<Outcome> {
-  const what = "mqtt";
-  const w = wantedMqtt(binding, credential);
-  if ("problem" in w) return { what, result: "refused", problem: w.problem };
-  const want = w.want;
-
-  // The broker first: a login it does not take is never written into Home Assistant.
-  let note: string | undefined;
-  try {
-    const probe = await deps.probe(want.host, want.port, want.username, want.password, DISCOVERY_FILTER);
-    if (probe.connack === 4 || probe.connack === 5) {
-      return {
-        what,
-        result: "refused",
-        problem:
-          `the broker at ${want.host}:${want.port} does not (yet) take the login ${want.username} with the delivered ` +
-          `password (CONNACK ${probe.connack}); mosquitto's provisioner creates it from the grant — nothing was ` +
-          `written, and Home Assistant keeps the broker login it has`,
-      };
-    }
-    if (probe.connack !== 0) {
-      return { what, result: "refused", problem: `the broker at ${want.host}:${want.port} answered CONNACK ${probe.connack}; nothing was written` };
-    }
-    if (probe.suback === 0x80) {
-      note =
-        `warning: ${want.username} may not subscribe to ${DISCOVERY_FILTER} — MQTT discovery will find nothing; ` +
-        `grant it with the mqtt-topic contribution's \`topics\``;
-    }
-  } catch (err) {
-    return {
-      what,
-      result: "refused",
-      problem: `the broker at ${want.host}:${want.port} could not be asked: ${scrub(err, want.password)}; nothing was written`,
-    };
-  }
-
-  try {
-    const entries = (await deps.hass.entries("mqtt")).filter((e) => e.domain === "mqtt");
-    if (entries.length > 1) {
-      return { what, result: "refused", problem: `Home Assistant has ${entries.length} MQTT entries; which one the mesh owns is not guessed` };
-    }
-    if (entries.length === 0) return await createEntry(deps, want, note);
-
-    const entry = entries[0];
-    const flow = await deps.hass.startFlow("mqtt", entry.entry_id);
-    if (flow.type !== "form" || !flow.flow_id || !flow.data_schema) {
-      if (flow.flow_id) await deps.hass.abortFlow(flow.flow_id);
-      return { what, result: "refused", problem: `Home Assistant's MQTT reconfigure flow answered ${flow.type}${flow.reason ? ` (${flow.reason})` : ""}` };
-    }
-    const current = formValues(flow.data_schema);
-    const fields: string[] = [];
-    if (String(current.broker ?? "") !== want.host) fields.push("broker");
-    if (Number(current.port ?? 0) !== want.port) fields.push("port");
-    if (String(current.username ?? "") !== want.username) fields.push("username");
-    if ((await deps.marks.get("mqtt")) !== markFor(entry.entry_id, want)) fields.push("password");
-    if (fields.length === 0) {
-      await deps.hass.abortFlow(flow.flow_id);
-      return note ? { what, result: "unchanged", note } : { what, result: "unchanged" };
-    }
-
-    const saved = await deps.hass.stepFlow(flow.flow_id, {
-      ...current,
-      broker: want.host,
-      port: want.port,
-      username: want.username,
-      password: want.password,
-    });
-    if (saved.type === "abort" && saved.reason === "reconfigure_successful") {
-      await deps.marks.set("mqtt", markFor(entry.entry_id, want));
-      return { what, result: "written", fields, ...(note ? { note } : {}) };
-    }
-    if (saved.flow_id) await deps.hass.abortFlow(saved.flow_id);
-    return {
-      what,
-      result: "refused",
-      problem:
-        `Home Assistant's own connection test refused ${want.username}@${want.host}:${want.port} ` +
-        `(${describe(saved)}); its MQTT entry is unchanged`,
-    };
-  } catch (err) {
-    return { what, result: "refused", problem: scrub(err, want.password) };
-  }
-}
-
-/** A fresh Home Assistant has no MQTT entry: made through the integration's user flow. */
-async function createEntry(deps: MqttDeps, want: MqttWanted, note?: string): Promise<Outcome> {
-  const what = "mqtt";
-  let flow = await deps.hass.startFlow("mqtt");
-  if (flow.type === "form" && flow.step_id !== "broker" && flow.flow_id) {
-    // Anything before the broker form (none outside the Supervisor) is not this step's to answer.
-    await deps.hass.abortFlow(flow.flow_id);
-    return { what, result: "refused", problem: `Home Assistant's MQTT user flow asked ${flow.step_id} before the broker` };
-  }
-  if (flow.type !== "form" || !flow.flow_id) {
-    return { what, result: "refused", problem: `Home Assistant's MQTT user flow answered ${describe(flow)}` };
-  }
-  const shown = formValues(flow.data_schema);
-  // A new entry's form has no value for its two certificate choices (a reconfigure pre-fills them
-  // from the entry): plain MQTT, so neither a CA nor a client certificate.
-  const other = (shown.other_settings ?? {}) as Record<string, unknown>;
-  if (flow.data_schema?.some((f) => f.name === "other_settings")) {
-    shown.other_settings = { set_ca_cert: "off", set_client_cert: false, ...other };
-  }
-  flow = await deps.hass.stepFlow(flow.flow_id, {
-    ...shown,
-    broker: want.host,
-    port: want.port,
-    username: want.username,
-    password: want.password,
-  });
-  if (flow.type === "create_entry") {
-    const id = (flow.result as { entry_id?: string } | undefined)?.entry_id;
-    if (id) await deps.marks.set("mqtt", markFor(id, want));
-    return { what, result: "written", fields: ["entry"], ...(note ? { note } : {}) };
-  }
-  if (flow.flow_id) await deps.hass.abortFlow(flow.flow_id);
-  return { what, result: "refused", problem: `Home Assistant refused a new MQTT entry for ${want.host}:${want.port} (${describe(flow)})` };
-}
-
-export function describe(r: { type: string; reason?: string; errors?: Record<string, string> | null }): string {
-  const errors = r.errors ? Object.entries(r.errors).map(([k, v]) => `${k}: ${v}`).join(", ") : "";
-  return [r.type, r.reason, errors].filter(Boolean).join(" — ");
-}
-
-// ---- Sonarr, Radarr, Lidarr ----
-
-// Home Assistant's Sonarr, Radarr and Lidarr integrations, pointed at the apps the mesh bound —
-// `sonarr-api`, `radarr-api`, `lidarr-api` (their providers: mesh-catalog #156).
-//
-// **What Home Assistant lets anyone change, and what it does not.** Each integration keeps a URL and
-// an API key in its config entry. None of the three has a reconfigure flow: Home Assistant changes
-// them only through the flow its UI runs —
-//   - a **user flow** makes a new entry (validated against the app);
-//   - a **reauth flow**, which Home Assistant starts by itself when the app refuses the key it holds,
-//     takes a new key (Sonarr) or a new URL and key (Radarr, Lidarr);
-//   - anything else — the URL of a working entry — only by removing the integration and adding it
-//     again, which throws away its entities' names, areas and history links. **This step never
-//     removes an entry.**
-// So, per app:
-//   1. The bound key is tried against the bound app first. Refused, nothing is written: until the
-//      operator accepts the app's own key for this pair, the mesh delivers a value it minted, which
-//      no Servarr app takes (novox/hq ADR 0092) — the failure names the `secret accept` that fixes it.
-//   2. No entry: one is made through the user flow.
-//   3. A reauth flow Home Assistant started for the entry: finished with the bound key (and URL,
-//      where the integration's reauth asks for one).
-//   4. An entry whose URL (read from the device the integration registered, `configuration_url`)
-//      is the bound one and which is loaded: already as the mesh says. The key needs no digest here:
-//      a Servarr app has one key, so an entry loaded against the app holds the key the app took.
-//   5. A working entry at a different URL that reaches **the same app** — the same process, by the
-//      app's own status (start time, data folder, version) — is left as it is and said: ace's entries
-//      say `127.0.0.1:<port>` and the binding says `ace.internal:<port>`, one Sonarr either way.
-//   6. Anything else is refused, loudly, with what the operator can do; nothing is removed.
-
-
-export interface ServarrApp {
-  /** The integration's domain, also the app. */
-  domain: "sonarr" | "radarr" | "lidarr";
-  /** The provision it is required as: the `requires`, `binds` and `secrets` key. */
-  provision: string;
-  /** The app's status endpoint: answers 401 to a wrong key, and says which process answered. */
-  statusPath: string;
-}
-
-export const APPS: readonly ServarrApp[] = [
-  { domain: "sonarr", provision: "sonarr-api", statusPath: "/api/v3/system/status" },
-  { domain: "radarr", provision: "radarr-api", statusPath: "/api/v3/system/status" },
-  { domain: "lidarr", provision: "lidarr-api", statusPath: "/api/v1/system/status" },
-];
-
-/** The HTTP the step needs toward the apps, so a test can stand fakes in. */
-export interface Http {
-  fetch(url: string, init?: { method?: string; headers?: Record<string, string> }): Promise<{ status: number; text(): Promise<string> }>;
-}
-
-export type AppWanted = { ok: true; url: string; key: string; from: string } | { ok: false; problem: string };
-
-/** The URL and key the mesh says Home Assistant uses for this app. */
-export function wantedApp(spec: ServarrApp, binding: Binding | undefined, credential: string | undefined): AppWanted {
-  if (!binding) return { ok: false, problem: `no binding for ${spec.provision} was delivered — the mesh writes it before this step runs` };
-  const at = typeof binding.at === "string" ? binding.at.trim() : "";
-  if (!at) return { ok: false, problem: `the ${spec.provision} binding names no host (at)` };
-  const port = portOf(binding.serves);
-  if (port === undefined) return { ok: false, problem: `the ${spec.provision} binding serves no usable port (${String(binding.serves?.port)})` };
-  const scheme = typeof binding.serves?.scheme === "string" && binding.serves.scheme ? binding.serves.scheme : "http";
-  if (scheme !== "http" && scheme !== "https") return { ok: false, problem: `the ${spec.provision} binding serves scheme ${scheme}` };
-  const base = typeof binding.serves?.["url-base"] === "string" ? String(binding.serves["url-base"]).trim().replace(/^\/+|\/+$/g, "") : "";
-  const key = (credential ?? "").trim();
-  if (!key) return { ok: false, problem: `the ${spec.provision} credential is empty or was not delivered` };
-  return {
-    ok: true,
-    url: `${scheme}://${urlHost(at)}:${port}${base ? `/${base}` : ""}`,
-    key,
-    from: typeof binding.from === "string" ? binding.from : "",
-  };
-}
-
-/** Two URLs naming the same place: scheme, host, port (explicit or default) and base path. */
-export function sameUrl(a: string | null | undefined, b: string): boolean {
-  if (!a) return false;
-  try {
-    const x = new URL(a);
-    const y = new URL(b);
-    const port = (u: URL) => u.port || (u.protocol === "https:" ? "443" : "80");
-    const path = (u: URL) => u.pathname.replace(/\/+$/, "");
-    return x.protocol === y.protocol && x.hostname.toLowerCase() === y.hostname.toLowerCase() && port(x) === port(y) && path(x) === path(y);
-  } catch {
-    return false;
-  }
-}
-
-type Status = { taken: true; status: Record<string, unknown> } | { taken: false };
-
-/** The app's status with this key: `taken: false` when it refuses the key; throws when it cannot be asked. */
-export async function appStatus(http: Http, spec: ServarrApp, url: string, key: string): Promise<Status> {
-  const res = await http.fetch(`${url.replace(/\/+$/, "")}${spec.statusPath}`, {
-    method: "GET",
-    headers: { "X-Api-Key": key, Accept: "application/json" },
-  });
-  if (res.status === 401 || res.status === 403) return { taken: false };
-  if (res.status < 200 || res.status >= 300) throw new Error(`${spec.domain} answered ${res.status} at ${spec.statusPath}`);
-  return { taken: true, status: JSON.parse(await res.text()) as Record<string, unknown> };
-}
-
-/** Whether two status answers came from one running app. */
-export function sameInstance(a: Record<string, unknown>, b: Record<string, unknown>): boolean {
-  const facts = ["startTime", "appData", "version"];
-  return facts.every((k) => a[k] !== undefined && a[k] !== null && a[k] === b[k]);
-}
-
-/** The remedy for a refused key, in the controller's words (ADR 0092). */
-export function acceptRemedy(spec: ServarrApp, from: string): string {
-  return (
-    `${spec.domain} refuses the ${spec.provision} credential the mesh delivered, so nothing was written into ` +
-    `Home Assistant. A Servarr app has one API key and the mesh cannot make it: accept ${spec.domain}'s own key ` +
-    `for this pair — \`secret accept <this node> home-assistant ${spec.provision} --provider ${from || "<its node>"} ` +
-    `--from <file holding ${spec.domain}'s ApiKey>\``
-  );
-}
-
-export interface ServarrDeps {
-  hass: Hass;
-  http: Http;
-}
-
-/** The input a Servarr form takes: what it shows, with the URL (where asked) and the key laid over. */
-function servarrInput(schema: readonly SchemaField[] | null | undefined, url: string, key: string): Record<string, unknown> {
-  const input = formValues(schema);
-  if (hasField(schema, "url")) input.url = url;
-  if (hasField(schema, "api_key")) input.api_key = key;
-  return input;
-}
-
-/** Bring Home Assistant's entry for one app in line with the mesh. Never throws. */
-export async function reconcileApp(deps: ServarrDeps, spec: ServarrApp, binding: Binding | undefined, credential: string | undefined): Promise<Outcome> {
-  const what = spec.domain;
-  const w = wantedApp(spec, binding, credential);
-  if ("problem" in w) return { what, result: "refused", problem: w.problem };
-
-  let bound: Status;
-  try {
-    bound = await appStatus(deps.http, spec, w.url, w.key);
-  } catch (err) {
-    return { what, result: "refused", problem: `${spec.domain} could not be asked at ${w.url}: ${scrub(err, w.key)}` };
-  }
-  if (!bound.taken) return { what, result: "refused", problem: acceptRemedy(spec, w.from) };
-
-  try {
-    const entries = (await deps.hass.entries(spec.domain)).filter((e) => e.domain === spec.domain);
-    if (entries.length > 1) {
-      return { what, result: "refused", problem: `Home Assistant has ${entries.length} ${spec.domain} entries; which one the mesh owns is not guessed` };
-    }
-
-    // No entry: made, through the integration's own user flow, which validates the key itself.
-    if (entries.length === 0) {
-      const flow = await deps.hass.startFlow(spec.domain);
-      if (flow.type !== "form" || !flow.flow_id) return { what, result: "refused", problem: `Home Assistant's ${spec.domain} user flow answered ${describe(flow)}` };
-      const made = await deps.hass.stepFlow(flow.flow_id, servarrInput(flow.data_schema, w.url, w.key));
-      if (made.type === "create_entry") return { what, result: "written", fields: ["entry"] };
-      if (made.flow_id) await deps.hass.abortFlow(made.flow_id);
-      return { what, result: "refused", problem: `Home Assistant refused a new ${spec.domain} entry at ${w.url} (${describe(made)})` };
-    }
-
-    const entry = entries[0];
-    if (entry.disabled_by) return { what, result: "unchanged", note: `the ${spec.domain} entry is disabled (by ${entry.disabled_by}); left alone` };
-
-    // A reauth Home Assistant started because the app refused its key: finished with the bound one.
-    const reauth = (await deps.hass.flowsInProgress()).find(
-      (f) => f.handler === spec.domain && f.context?.source === "reauth" && f.context?.entry_id === entry.entry_id,
-    );
-    if (reauth) {
-      let step = await deps.hass.stepFlow(reauth.flow_id, {}); // reauth_confirm: a confirmation, no fields
-      if (step.type === "form" && step.flow_id && step.step_id !== "reauth_confirm") {
-        const input = servarrInput(step.data_schema, w.url, w.key);
-        const fields = ["api_key", ...(hasField(step.data_schema, "url") ? ["url"] : [])];
-        step = await deps.hass.stepFlow(step.flow_id, input);
-        if (step.type === "abort" && step.reason === "reauth_successful") return { what, result: "written", fields };
-      }
-      return { what, result: "refused", problem: `Home Assistant's ${spec.domain} reauth did not take the bound key and URL (${describe(step)})` };
-    }
-
-    const device = (await deps.hass.devices()).find((d) => d.config_entries?.includes(entry.entry_id) && d.configuration_url);
-    const current = device?.configuration_url ?? undefined;
-    if (entry.state === "loaded" && sameUrl(current, w.url)) return { what, result: "unchanged" };
-
-    if (entry.state === "loaded" && current) {
-      let there: Status | undefined;
-      try {
-        there = await appStatus(deps.http, spec, current, w.key);
-      } catch {
-        there = undefined;
-      }
-      if (there?.taken && sameInstance(there.status, bound.status)) {
-        return {
-          what,
-          result: "equivalent",
-          note:
-            `Home Assistant reaches ${spec.domain} at ${current}, the same running app the mesh bound at ${w.url}; ` +
-            `Home Assistant has no way to change a working ${spec.domain} entry's URL short of removing it, so it is left as it is`,
-        };
-      }
-    }
-    return {
-      what,
-      result: "refused",
-      problem:
-        `Home Assistant's ${spec.domain} entry (${entry.state ?? "unknown state"}) points at ${current ?? "an unknown URL"}, ` +
-        `not the ${spec.domain} the mesh bound at ${w.url}. Home Assistant only lets a working entry's URL change by ` +
-        `removing and re-adding the integration, which this step never does: remove it in Home Assistant ` +
-        `(Settings → Devices & services → ${spec.domain}) and the next run adds it at the bound URL`,
-    };
-  } catch (err) {
-    return { what, result: "refused", problem: scrub(err, w.key) };
-  }
-}

modules/home-assistant/provisions/hass.ts

@@ -1,160 +0,0 @@
-// Home Assistant's own configuration API, as the provisions step uses it — the supported way to
-// change an integration's connection. Home Assistant keeps every integration in
-// `.storage/core.config_entries`, a file it owns and rewrites; the mesh may not write it, and it is
-// not a file the mesh could merge into. What Home Assistant offers instead is the same thing its UI
-// uses: **config flows** over REST (`/api/config/config_entries/flow`) — a user flow creates an
-// entry, a reconfigure flow changes one, a reauth flow (which Home Assistant starts itself when a
-// credential stops working) replaces its credential — each validated by the integration's own
-// connection test before anything is saved. The two things REST does not answer (which flows Home
-// Assistant has started, which device an entry made) come over its WebSocket API.
-//
-// Nothing here reads `.storage`. Authenticated with the module's accepted long-lived access token.
-
-/** A config entry as `GET /api/config/config_entries/entry` lists it — no data, no credentials. */
-export interface ConfigEntry {
-  entry_id: string;
-  domain: string;
-  title?: string;
-  source?: string;
-  state?: string;
-  disabled_by?: string | null;
-}
-
-/** One field of a flow's form, as Home Assistant serializes a voluptuous schema. */
-export interface SchemaField {
-  name: string;
-  type?: string;
-  required?: boolean;
-  optional?: boolean;
-  default?: unknown;
-  description?: { suggested_value?: unknown } | null;
-  /** A section (`type: "expandable"`) carries its own fields. */
-  schema?: SchemaField[];
-}
-
-/** What a flow answered: another form, an entry made, or the flow ended (abort). */
-export interface FlowResult {
-  type: string;
-  flow_id?: string;
-  handler?: string;
-  step_id?: string;
-  data_schema?: SchemaField[] | null;
-  errors?: Record<string, string> | null;
-  reason?: string;
-  result?: { entry_id?: string } | unknown;
-}
-
-/** A flow in progress that Home Assistant started itself (a reauth, a discovery). */
-export interface FlowProgress {
-  flow_id: string;
-  handler: string;
-  step_id?: string;
-  context?: { source?: string; entry_id?: string };
-}
-
-/** A device from the device registry; an integration names where its app is as configuration_url. */
-export interface DeviceEntry {
-  id: string;
-  config_entries?: string[];
-  configuration_url?: string | null;
-}
-
-export interface Hass {
-  entries(domain: string): Promise<ConfigEntry[]>;
-  /** A user flow for `handler`, or — given an entry — a reconfigure flow for it. */
-  startFlow(handler: string, entryId?: string): Promise<FlowResult>;
-  stepFlow(flowId: string, input: Record<string, unknown>): Promise<FlowResult>;
-  abortFlow(flowId: string): Promise<void>;
-  flowsInProgress(): Promise<FlowProgress[]>;
-  devices(): Promise<DeviceEntry[]>;
-}
-
-/** Home Assistant over HTTP: REST for entries and flows, one short WebSocket session per question. */
-export class HassApi implements Hass {
-  private readonly base: string;
-
-  constructor(url: string, private readonly token: string) {
-    this.base = url.replace(/\/$/, "");
-  }
-
-  private async rest(method: string, path: string, body?: unknown): Promise<unknown> {
-    const res = await fetch(`${this.base}${path}`, {
-      method,
-      headers: {
-        Authorization: `Bearer ${this.token}`,
-        Accept: "application/json",
-        ...(body !== undefined ? { "Content-Type": "application/json" } : {}),
-      },
-      body: body !== undefined ? JSON.stringify(body) : undefined,
-    });
-    const text = await res.text();
-    if (!res.ok) {
-      // Home Assistant's error text names fields, never echoes their values.
-      throw new Error(`Home Assistant ${method} ${path} answered ${res.status}${text ? `: ${text.slice(0, 200)}` : ""}`);
-    }
-    return text ? (JSON.parse(text) as unknown) : undefined;
-  }
-
-  async entries(domain: string): Promise<ConfigEntry[]> {
-    return ((await this.rest("GET", `/api/config/config_entries/entry?domain=${encodeURIComponent(domain)}`)) ??
-      []) as ConfigEntry[];
-  }
-
-  async startFlow(handler: string, entryId?: string): Promise<FlowResult> {
-    return (await this.rest("POST", "/api/config/config_entries/flow", {
-      handler,
-      show_advanced_options: true,
-      ...(entryId ? { entry_id: entryId } : {}),
-    })) as FlowResult;
-  }
-
-  async stepFlow(flowId: string, input: Record<string, unknown>): Promise<FlowResult> {
-    return (await this.rest("POST", `/api/config/config_entries/flow/${encodeURIComponent(flowId)}`, input)) as FlowResult;
-  }
-
-  async abortFlow(flowId: string): Promise<void> {
-    await this.rest("DELETE", `/api/config/config_entries/flow/${encodeURIComponent(flowId)}`).catch(() => undefined);
-  }
-
-  async flowsInProgress(): Promise<FlowProgress[]> {
-    return (await this.ws("config_entries/flow/progress")) as FlowProgress[];
-  }
-
-  async devices(): Promise<DeviceEntry[]> {
-    return (await this.ws("config/device_registry/list")) as DeviceEntry[];
-  }
-
-  /** One WebSocket command: connect, authenticate, ask, close. */
-  private ws(type: string): Promise<unknown> {
-    const url = `${this.base.replace(/^http/, "ws")}/api/websocket`;
-    return new Promise((resolve, reject) => {
-      const socket = new WebSocket(url);
-      const timer = setTimeout(() => {
-        socket.close();
-        reject(new Error(`Home Assistant's WebSocket did not answer ${type} within 30s`));
-      }, 30_000);
-      const done = (fn: () => void): void => {
-        clearTimeout(timer);
-        socket.close();
-        fn();
-      };
-      socket.onerror = () => done(() => reject(new Error(`Home Assistant's WebSocket at ${url} failed`)));
-      socket.onmessage = (event: { data: unknown }) => {
-        const msg = JSON.parse(String(event.data)) as {
-          type: string;
-          id?: number;
-          success?: boolean;
-          result?: unknown;
-          error?: { message?: string };
-        };
-        if (msg.type === "auth_required") socket.send(JSON.stringify({ type: "auth", access_token: this.token }));
-        else if (msg.type === "auth_invalid") done(() => reject(new Error("Home Assistant refused the token")));
-        else if (msg.type === "auth_ok") socket.send(JSON.stringify({ id: 1, type }));
-        else if (msg.type === "result" && msg.id === 1) {
-          if (msg.success) done(() => resolve(msg.result));
-          else done(() => reject(new Error(`Home Assistant ${type}: ${msg.error?.message ?? "failed"}`)));
-        }
-      };
-    });
-  }
-}

modules/home-assistant/provisions/index.ts

@@ -1,84 +0,0 @@
-// home-assistant's provisions step — run once by the host after Home Assistant starts, and again
-// whenever a binding or pair credential it reads changes (the container's `restart-on`, novox/hq
-// ADR 0099). It points Home Assistant's MQTT integration at the `mqtt-topic` broker and its Sonarr,
-// Radarr and Lidarr integrations at the `sonarr-api`, `radarr-api` and `lidarr-api` apps, through
-// Home Assistant's own config flows (connections.ts). It connects to no mesh broker.
-//
-// Exits non-zero when anything could not be put right, so the node reports the step failed and the
-// host runs it again on the next apply. Declared last in the manifest, so its failing gates nothing
-// else of home-assistant's (novox/hq ADR 0136). Never prints a key or password.
-
-import { join } from "node:path";
-
-import { APPS, MQTT_PROVISION, reconcileApp, reconcileMqtt, type Outcome } from "./connections.js";
-import { HassApi } from "./hass.js";
-import { marksIn, readBinding, readIfThere } from "./mesh.js";
-import { probeBroker } from "./probe.js";
-
-const dir = process.env.MESH_PROVISIONS_DIR ?? "/run/provisions";
-const url = process.env.MESH_HOMEASSISTANT_URL ?? "http://127.0.0.1:8123";
-const token = (await readIfThere(process.env.MESH_HOMEASSISTANT_TOKEN_FILE))?.trim() ?? "";
-const marks = marksIn(process.env.MESH_WRITTEN_DIR ?? "/var/lib/home-assistant-provisions");
-const waitSeconds = Number(process.env.MESH_HOMEASSISTANT_WAIT_SECONDS ?? "300");
-
-if (!token) {
-  console.error("[hass-provisions] no Home Assistant token — home-assistant's own `token` secret has not been accepted");
-  process.exit(1);
-}
-
-/** Home Assistant answers /api/ with 200 once it is up and the token is good. */
-async function ready(): Promise<boolean> {
-  const until = Date.now() + waitSeconds * 1000;
-  for (;;) {
-    try {
-      const res = await fetch(`${url.replace(/\/$/, "")}/api/`, { headers: { Authorization: `Bearer ${token}` } });
-      if (res.status === 200) return true;
-      if (res.status === 401 || res.status === 403) {
-        console.error("[hass-provisions] Home Assistant refuses the token — accept a long-lived access token it issued");
-        return false;
-      }
-    } catch {
-      // not listening yet
-    }
-    if (Date.now() >= until) return false;
-    await new Promise((r) => setTimeout(r, 3000));
-  }
-}
-
-if (!(await ready())) {
-  console.error(`[hass-provisions] Home Assistant did not answer at ${url} within ${waitSeconds}s`);
-  process.exit(1);
-}
-
-const hass = new HassApi(url, token);
-const read = async (p: string) => [await readBinding(join(dir, `${p}.json`)), await readIfThere(join(dir, `${p}.secret`))] as const;
-
-const outcomes: Outcome[] = [];
-{
-  const [binding, secret] = await read(MQTT_PROVISION);
-  outcomes.push(await reconcileMqtt({ hass, probe: probeBroker, marks }, binding, secret));
-}
-for (const spec of APPS) {
-  const [binding, secret] = await read(spec.provision);
-  outcomes.push(await reconcileApp({ hass, http: { fetch: (u, init) => fetch(u, init) } }, spec, binding, secret));
-}
-
-let failed = 0;
-for (const o of outcomes) {
-  switch (o.result) {
-    case "unchanged":
-      console.log(`[hass-provisions] ${o.what}: already as the mesh says${o.note ? ` — ${o.note}` : ""}`);
-      break;
-    case "written":
-      console.log(`[hass-provisions] ${o.what}: wrote ${o.fields.join(", ")}; Home Assistant's own test passed${o.note ? ` — ${o.note}` : ""}`);
-      break;
-    case "equivalent":
-      console.log(`[hass-provisions] ${o.what}: ${o.note}`);
-      break;
-    case "refused":
-      failed++;
-      console.error(`[hass-provisions] ${o.what}: ${o.problem}`);
-      break;
-  }
-}
-process.exitCode = failed > 0 ? 1 : 0;

modules/home-assistant/provisions/mesh.ts

@@ -1,42 +0,0 @@
-// What the mesh delivered to home-assistant's provisions step, and the step's own small memory.
-//
-// Per provision it requires, the mesh writes two files beside each other (the manifest's `binds` and
-// `secrets`): `<provision>.json`, the binding — where the provider is (`at`), what it serves (`port`,
-// `scheme`, …) and the login this module presents (`as`) — and `<provision>.secret`, the pair
-// credential. Nothing here guesses a host, a port or a key.
-
-import { mkdir, readFile, rename, writeFile } from "node:fs/promises";
-import { join } from "node:path";
-
-import type { Binding, Marks } from "./connections.js";
-
-/** A file the mesh wrote, or undefined when it is not there. */
-export async function readIfThere(path: string | undefined): Promise<string | undefined> {
-  if (!path) return undefined;
-  return readFile(path, "utf8").catch(() => undefined);
-}
-
-/** A binding file parsed, or undefined when absent or not JSON. */
-export async function readBinding(path: string): Promise<Binding | undefined> {
-  const raw = await readIfThere(path);
-  if (raw === undefined) return undefined;
-  try {
-    return JSON.parse(raw) as Binding;
-  } catch {
-    return undefined;
-  }
-}
-
-export function marksIn(dir: string): Marks {
-  return {
-    async get(name) {
-      return (await readIfThere(join(dir, `${name}.digest`)))?.trim() || undefined;
-    },
-    async set(name, value) {
-      await mkdir(dir, { recursive: true, mode: 0o700 });
-      const path = join(dir, `${name}.digest`);
-      await writeFile(`${path}.tmp`, `${value}\n`, { mode: 0o600 });
-      await rename(`${path}.tmp`, path);
-    },
-  };
-}

modules/home-assistant/provisions/probe.ts

@@ -1,117 +0,0 @@
-// Ask the broker, before Home Assistant is told anything, whether it takes the login and password
-// the mesh delivered — and whether that login may subscribe to Home Assistant's discovery topics.
-//
-// One MQTT 3.1.1 session: CONNECT (clean, a throwaway client id, so Home Assistant's own session is
-// never taken over), read the CONNACK, optionally SUBSCRIBE once and read the SUBACK, DISCONNECT.
-// No dependency: the handful of bytes MQTT needs for this are written here.
-
-import { randomBytes } from "node:crypto";
-import { connect } from "node:net";
-
-export interface ProbeResult {
-  /** 0 accepted; 4 bad username or password; 5 not authorised. */
-  connack: number;
-  /** The SUBACK return code for the filter asked about: 0–2 granted, 0x80 refused. */
-  suback?: number;
-}
-
-export type Probe = (host: string, port: number, username: string, password: string, subscribe?: string) => Promise<ProbeResult>;
-
-function str(v: string): Buffer {
-  const b = Buffer.from(v, "utf8");
-  const len = Buffer.alloc(2);
-  len.writeUInt16BE(b.length);
-  return Buffer.concat([len, b]);
-}
-
-function packet(type: number, body: Buffer): Buffer {
-  let remaining = body.length;
-  const lenBytes: number[] = [];
-  do {
-    let byte = remaining % 128;
-    remaining = Math.floor(remaining / 128);
-    if (remaining > 0) byte |= 0x80;
-    lenBytes.push(byte);
-  } while (remaining > 0);
-  return Buffer.concat([Buffer.from([type, ...lenBytes]), body]);
-}
-
-/** The first complete packet in `buf`: its type byte, its body, and how many bytes it took. */
-export function firstPacket(buf: Buffer): { type: number; body: Buffer; used: number } | undefined {
-  if (buf.length < 2) return undefined;
-  let length = 0;
-  let multiplier = 1;
-  let i = 1;
-  for (;;) {
-    if (i >= buf.length) return undefined;
-    const byte = buf[i++];
-    length += (byte & 0x7f) * multiplier;
-    if ((byte & 0x80) === 0) break;
-    multiplier *= 128;
-    if (i > 4) throw new Error("malformed MQTT remaining length");
-  }
-  if (buf.length < i + length) return undefined;
-  return { type: buf[0], body: buf.subarray(i, i + length), used: i + length };
-}
-
-export const probeBroker: Probe = (host, port, username, password, subscribe) => {
-  const connectBody = Buffer.concat([
-    str("MQTT"),
-    Buffer.from([4, 0xc2, 0, 10]), // level 4 (3.1.1); username + password + clean session; keepalive 10s
-    str(`mesh-probe-${randomBytes(6).toString("hex")}`),
-    str(username),
-    str(password),
-  ]);
-  return new Promise((resolve, reject) => {
-    const socket = connect({ host, port });
-    let buf = Buffer.alloc(0);
-    const result: ProbeResult = { connack: -1 };
-    const timer = setTimeout(() => {
-      socket.destroy();
-      reject(new Error(`no answer from the broker at ${host}:${port} within 10s`));
-    }, 10_000);
-    const finish = (): void => {
-      clearTimeout(timer);
-      if (result.connack === 0) socket.end(Buffer.from([0xe0, 0]));
-      else socket.destroy();
-      resolve(result);
-    };
-    socket.on("connect", () => socket.write(packet(0x10, connectBody)));
-    socket.on("data", (chunk) => {
-      buf = Buffer.concat([buf, chunk]);
-      for (;;) {
-        let p;
-        try {
-          p = firstPacket(buf);
-        } catch (err) {
-          clearTimeout(timer);
-          socket.destroy();
-          reject(err);
-          return;
-        }
-        if (!p) return;
-        buf = buf.subarray(p.used);
-        const kind = p.type >> 4;
-        if (kind === 2) {
-          result.connack = p.body[1] ?? -1;
-          if (result.connack !== 0 || !subscribe) return finish();
-          // SUBSCRIBE, packet id 1, one filter at QoS 0.
-          socket.write(packet(0x82, Buffer.concat([Buffer.from([0, 1]), str(subscribe), Buffer.from([0])])));
-        } else if (kind === 9) {
-          result.suback = p.body[2];
-          return finish();
-        }
-      }
-    });
-    socket.on("error", (err) => {
-      clearTimeout(timer);
-      reject(err);
-    });
-    socket.on("close", () => {
-      if (result.connack === -1) {
-        clearTimeout(timer);
-        reject(new Error(`the broker at ${host}:${port} closed the connection without answering`));
-      }
-    });
-  });
-};

modules/home-assistant/test/provisions.test.ts

@@ -1,293 +0,0 @@
-// What holds home-assistant's provisions step (provisions/*.ts): Home Assistant's MQTT entry is
-// made to use the broker, port and login the mesh bound — only after the broker takes that login,
-// through the reconfigure flow, keeping every other setting as Home Assistant pre-filled it, and not
-// again once it already says so; its Sonarr/Radarr/Lidarr entries are made, finished (reauth), left
-// alone when they already reach the bound app, and never removed; a key the app refuses (the mesh's
-// minted value before the operator accepts the app's) is never written.
-//
-// Home Assistant and the apps are fakes answering as the real ones do (flow shapes checked against
-// ghcr.io/home-assistant/home-assistant 2026.9.3, the build ace runs).
-
-import { test } from "node:test";
-import assert from "node:assert/strict";
-
-import type { ConfigEntry, DeviceEntry, FlowProgress, FlowResult, Hass, SchemaField } from "../provisions/hass.ts";
-
-import type { Binding, Marks } from "../provisions/connections.ts";
-import { APPS, formValues, reconcileApp, reconcileMqtt, sameUrl, type Http, type ServarrApp } from "../provisions/connections.ts";
-import type { Probe } from "../provisions/probe.ts";
-
-const PWD_NOT_CHANGED = "__**password_not_changed**__";
-const MINTED = "mesh-minted-password";
-
-function mqttBinding(): Binding {
-  return { provision: "mqtt-topic", from: "ace", at: "ace.internal", as: "mesh_ace_hass", serves: { scheme: "mqtt", port: 1883 } };
-}
-
-/** The MQTT reconfigure form as Home Assistant serializes it, pre-filled from an entry. */
-function brokerForm(data: Record<string, unknown>): SchemaField[] {
-  return [
-    { name: "broker", type: "string", required: true, description: { suggested_value: data.broker } },
-    { name: "port", type: "integer", required: true, default: 1883, description: { suggested_value: data.port } },
-    { name: "protocol", type: "select", required: true, default: "3.1.1", description: { suggested_value: data.protocol } },
-    { name: "username", type: "string", optional: true, description: { suggested_value: data.username } },
-    { name: "password", type: "string", optional: true, description: { suggested_value: data.password ? PWD_NOT_CHANGED : undefined } },
-    {
-      name: "other_settings",
-      type: "expandable",
-      required: true,
-      schema: [
-        { name: "keepalive", type: "integer", optional: true, description: { suggested_value: 60 } },
-        { name: "transport", type: "select", required: true, default: "tcp", description: { suggested_value: "tcp" } },
-        { name: "set_ca_cert", type: "select", required: true, description: { suggested_value: "off" } },
-        { name: "set_client_cert", type: "boolean", required: true, description: { suggested_value: false } },
-      ],
-    },
-  ];
-}
-
-interface FakeOpts {
-  entries?: Record<string, (ConfigEntry & { data: Record<string, unknown> })[]>;
-  /** What Home Assistant's own connection test accepts. */
-  accepts?: (data: Record<string, unknown>) => boolean;
-  reauth?: FlowProgress[];
-  devices?: DeviceEntry[];
-}
-
-function fakeHass(opts: FakeOpts = {}) {
-  const entries = opts.entries ?? {};
-  const calls: string[] = [];
-  const submitted: Record<string, unknown>[] = [];
-  const flows = new Map<string, { handler: string; entryId?: string; step: string; reauth?: boolean }>();
-  let n = 0;
-  const accepts = opts.accepts ?? (() => true);
-  const form = (id: string, step: string, schema: SchemaField[], errors?: Record<string, string>): FlowResult => ({
-    type: "form", flow_id: id, step_id: step, data_schema: schema, errors: errors ?? null,
-  });
-  const servarrUser: SchemaField[] = [
-    { name: "url", type: "string", required: true },
-    { name: "api_key", type: "string", required: true },
-    { name: "more_options", type: "expandable", required: true, schema: [{ name: "verify_ssl", type: "boolean", optional: true, default: false }] },
-  ];
-  const hass: Hass = {
-    async entries(domain) {
-      calls.push(`entries ${domain}`);
-      return (entries[domain] ?? []).map(({ data: _d, ...e }) => e);
-    },
-    async startFlow(handler, entryId) {
-      calls.push(`start ${handler}${entryId ? ` ${entryId}` : ""}`);
-      const id = `f${++n}`;
-      if (handler === "mqtt") {
-        const entry = entryId ? entries.mqtt.find((e) => e.entry_id === entryId) : undefined;
-        if (entryId && !entry) return { type: "abort", reason: "not_found" };
-        flows.set(id, { handler, entryId, step: "broker" });
-        return form(id, "broker", brokerForm(entry?.data ?? {}));
-      }
-      if (entryId) return { type: "abort", reason: "not_implemented" }; // no reconfigure for Servarr
-      flows.set(id, { handler, step: "user" });
-      return form(id, "user", servarrUser);
-    },
-    async stepFlow(flowId, input) {
-      calls.push(`step ${flowId}`);
-      const flow = flows.get(flowId);
-      if (!flow) throw new Error(`Home Assistant POST flow/${flowId} answered 404`);
-      if (flow.step === "reauth_confirm") {
-        flow.step = "user";
-        return form(flowId, "user", [
-          { name: "url", type: "string", required: true, default: "http://old:1" },
-          { name: "api_key", type: "string", optional: true },
-          { name: "verify_ssl", type: "boolean", optional: true, default: false },
-        ]);
-      }
-      submitted.push(input);
-      if (flow.handler === "mqtt") {
-        const entry = entries.mqtt?.find((e) => e.entry_id === flow.entryId);
-        const data = { ...input, ...(input.password === PWD_NOT_CHANGED ? { password: entry?.data.password } : {}) };
-        if (!accepts(data)) return form(flowId, "broker", brokerForm(data), { base: "cannot_connect" });
-        flows.delete(flowId);
-        if (entry) {
-          entry.data = data;
-          return { type: "abort", reason: "reconfigure_successful" };
-        }
-        (entries.mqtt ??= []).push({ entry_id: "new-mqtt", domain: "mqtt", state: "loaded", data });
-        return { type: "create_entry", result: { entry_id: "new-mqtt" } };
-      }
-      if (!accepts(input)) return form(flowId, "user", servarrUser, { base: "invalid_auth" });
-      flows.delete(flowId);
-      if (flow.reauth) return { type: "abort", reason: "reauth_successful" };
-      (entries[flow.handler] ??= []).push({ entry_id: `new-${flow.handler}`, domain: flow.handler, state: "loaded", data: input });
-      return { type: "create_entry", result: { entry_id: `new-${flow.handler}` } };
-    },
-    async abortFlow(flowId) {
-      calls.push(`abort ${flowId}`);
-      flows.delete(flowId);
-    },
-    async flowsInProgress() {
-      for (const f of opts.reauth ?? []) flows.set(f.flow_id, { handler: f.handler, entryId: f.context?.entry_id, step: "reauth_confirm", reauth: true });
-      return opts.reauth ?? [];
-    },
-    async devices() {
-      return opts.devices ?? [];
-    },
-  };
-  return { hass, calls, submitted, entries };
-}
-
-function memoryMarks(): Marks & { store: Map<string, string> } {
-  const store = new Map<string, string>();
-  return { store, get: async (k) => store.get(k), set: async (k, v) => void store.set(k, v) };
-}
-
-const takes = (suback = 0): Probe => async (_h, _p, user, pass) => ({ connack: user === "mesh_ace_hass" && pass === MINTED ? 0 : 5, suback });
-
-const aceMqttEntry = () => ({
-  entry_id: "7d1e", domain: "mqtt", state: "loaded",
-  data: { broker: "127.0.0.1", port: 1883, protocol: "5", username: "luffy", password: "luffys-password" },
-});
-
-test("mqtt: the broker is asked first; a login it does not take is never written", async () => {
-  const f = fakeHass({ entries: { mqtt: [aceMqttEntry()] } });
-  const out = await reconcileMqtt({ hass: f.hass, probe: async () => ({ connack: 5 }), marks: memoryMarks() }, mqttBinding(), MINTED);
-  assert.equal(out.result, "refused");
-  assert.match((out as { problem: string }).problem, /does not \(yet\) take the login mesh_ace_hass/);
-  assert.deepEqual(f.calls, []); // Home Assistant not even asked
-  assert.equal(f.entries.mqtt[0].data.username, "luffy");
-});
-
-test("mqtt: ace's entry (127.0.0.1, luffy) is moved to the bound broker and login, every other setting kept", async () => {
-  const f = fakeHass({ entries: { mqtt: [aceMqttEntry()] } });
-  const marks = memoryMarks();
-  const out = await reconcileMqtt({ hass: f.hass, probe: takes(), marks }, mqttBinding(), `${MINTED}\n`);
-  assert.deepEqual(out, { what: "mqtt", result: "written", fields: ["broker", "username", "password"] });
-  assert.deepEqual(f.entries.mqtt[0].data, {
-    broker: "ace.internal", port: 1883, protocol: "5", username: "mesh_ace_hass", password: MINTED,
-    other_settings: { keepalive: 60, transport: "tcp", set_ca_cert: "off", set_client_cert: false },
-  });
-  assert.ok(marks.store.get("mqtt"));
-  assert.ok(![...marks.store.values()].some((v) => v.includes(MINTED)));
-
-  // Run again: nothing differs, the flow is opened to read and closed without submitting.
-  const before = f.submitted.length;
-  const again = await reconcileMqtt({ hass: f.hass, probe: takes(), marks }, mqttBinding(), MINTED);
-  assert.deepEqual(again, { what: "mqtt", result: "unchanged" });
-  assert.equal(f.submitted.length, before);
-  assert.match(f.calls.at(-1) ?? "", /^abort /);
-});
-
-test("mqtt: a new password alone is written (the digest tells)", async () => {
-  const f = fakeHass({ entries: { mqtt: [aceMqttEntry()] } });
-  const marks = memoryMarks();
-  await reconcileMqtt({ hass: f.hass, probe: takes(), marks }, mqttBinding(), MINTED);
-  const rotated: Probe = async () => ({ connack: 0, suback: 0 });
-  const out = await reconcileMqtt({ hass: f.hass, probe: rotated, marks }, mqttBinding(), "rotated");
-  assert.deepEqual(out, { what: "mqtt", result: "written", fields: ["password"] });
-  assert.equal(f.entries.mqtt[0].data.password, "rotated");
-});
-
-test("mqtt: Home Assistant's own connection test refusing saves nothing and fails loudly", async () => {
-  const f = fakeHass({ entries: { mqtt: [aceMqttEntry()] }, accepts: () => false });
-  const marks = memoryMarks();
-  const out = await reconcileMqtt({ hass: f.hass, probe: takes(), marks }, mqttBinding(), MINTED);
-  assert.equal(out.result, "refused");
-  assert.match((out as { problem: string }).problem, /cannot_connect.*unchanged/);
-  assert.equal(f.entries.mqtt[0].data.username, "luffy");
-  assert.equal(marks.store.size, 0);
-});
-
-test("mqtt: a fresh Home Assistant gets an entry; a grant without the discovery topics is warned about", async () => {
-  const f = fakeHass();
-  const out = await reconcileMqtt({ hass: f.hass, probe: takes(0x80), marks: memoryMarks() }, mqttBinding(), MINTED);
-  assert.equal(out.result, "written");
-  assert.match((out as { note?: string }).note ?? "", /may not subscribe to homeassistant\/#/);
-  assert.equal(f.entries.mqtt[0].data.broker, "ace.internal");
-});
-
-test("mqtt: two entries, or a binding without a port, are refused rather than guessed", async () => {
-  const f = fakeHass({ entries: { mqtt: [aceMqttEntry(), { ...aceMqttEntry(), entry_id: "other" }] } });
-  assert.equal((await reconcileMqtt({ hass: f.hass, probe: takes(), marks: memoryMarks() }, mqttBinding(), MINTED)).result, "refused");
-  const noPort = { ...mqttBinding(), serves: {} };
-  assert.match(((await reconcileMqtt({ hass: f.hass, probe: takes(), marks: memoryMarks() }, noPort, MINTED)) as { problem: string }).problem, /no usable port/);
-});
-
-// ---- Servarr ----
-
-const SONARR = APPS.find((a) => a.domain === "sonarr") as ServarrApp;
-const RADARR = APPS.find((a) => a.domain === "radarr") as ServarrApp;
-const KEY = "the-apps-own-key";
-const servarrBinding = (port: number, at = "ace.internal"): Binding => ({ provision: "sonarr-api", from: "ace", at, as: "mesh_ace_hass", serves: { scheme: "http", port, "url-base": "" } });
-
-/** One running Sonarr, answering on several addresses (127.0.0.1 and ace.internal are one host). */
-function apps(instances: Record<string, { startTime: string }>): Http & { asked: string[] } {
-  const asked: string[] = [];
-  return {
-    asked,
-    async fetch(url, init) {
-      asked.push(url);
-      const u = new URL(url);
-      const inst = instances[`${u.hostname}:${u.port}`];
-      if (!inst) throw new Error("connect ECONNREFUSED");
-      if (init?.headers?.["X-Api-Key"] !== KEY) return { status: 401, text: async () => "" };
-      return { status: 200, text: async () => JSON.stringify({ version: "4.0.15", appData: "/config", startTime: inst.startTime }) };
-    },
-  };
-}
-const oneSonarr = () => apps({ "ace.internal:8989": { startTime: "t1" }, "127.0.0.1:8989": { startTime: "t1" } });
-const sonarrEntry = (state = "loaded") => ({ entry_id: "5a1d", domain: "sonarr", state, data: { url: "http://127.0.0.1:8989", api_key: KEY } });
-
-test("servarr: the mesh's minted key is never written; the remedy names the accept", async () => {
-  const f = fakeHass({ entries: { sonarr: [sonarrEntry()] } });
-  const out = await reconcileApp({ hass: f.hass, http: oneSonarr() }, SONARR, servarrBinding(8989), "minted-by-the-mesh");
-  assert.equal(out.result, "refused");
-  assert.match((out as { problem: string }).problem, /secret accept <this node> home-assistant sonarr-api --provider ace/);
-  assert.deepEqual(f.calls, []);
-});
-
-test("servarr: ace's entry at 127.0.0.1 reaches the same Sonarr the mesh bound at ace.internal — left, and said", async () => {
-  const f = fakeHass({ entries: { sonarr: [sonarrEntry()] }, devices: [{ id: "d", config_entries: ["5a1d"], configuration_url: "http://127.0.0.1:8989" }] });
-  const out = await reconcileApp({ hass: f.hass, http: oneSonarr() }, SONARR, servarrBinding(8989), KEY);
-  assert.equal(out.result, "equivalent");
-  assert.equal(f.submitted.length, 0);
-});
-
-test("servarr: an entry already at the bound URL is unchanged", async () => {
-  const f = fakeHass({ entries: { sonarr: [sonarrEntry()] }, devices: [{ id: "d", config_entries: ["5a1d"], configuration_url: "http://ace.internal:8989" }] });
-  assert.deepEqual(await reconcileApp({ hass: f.hass, http: oneSonarr() }, SONARR, servarrBinding(8989), KEY), { what: "sonarr", result: "unchanged" });
-});
-
-test("servarr: a working entry that reaches a different app is refused, and nothing is removed", async () => {
-  const f = fakeHass({ entries: { sonarr: [sonarrEntry()] }, devices: [{ id: "d", config_entries: ["5a1d"], configuration_url: "http://127.0.0.1:8989" }] });
-  const two = apps({ "ace.internal:8989": { startTime: "t1" }, "127.0.0.1:8989": { startTime: "another" } });
-  const out = await reconcileApp({ hass: f.hass, http: two }, SONARR, servarrBinding(8989), KEY);
-  assert.equal(out.result, "refused");
-  assert.match((out as { problem: string }).problem, /never does/);
-  assert.equal(f.entries.sonarr.length, 1);
-});
-
-test("servarr: no entry — one is made at the bound URL through the user flow", async () => {
-  const f = fakeHass({ entries: {} });
-  const out = await reconcileApp({ hass: f.hass, http: oneSonarr() }, SONARR, servarrBinding(8989), KEY);
-  assert.deepEqual(out, { what: "sonarr", result: "written", fields: ["entry"] });
-  assert.deepEqual(f.submitted[0], { url: "http://ace.internal:8989", api_key: KEY, more_options: { verify_ssl: false } });
-});
-
-test("servarr: a reauth Home Assistant started is finished with the bound URL and key", async () => {
-  const entry = { ...sonarrEntry("setup_error"), domain: "radarr", entry_id: "1955" };
-  const f = fakeHass({
-    entries: { radarr: [entry] },
-    reauth: [{ flow_id: "r1", handler: "radarr", step_id: "reauth_confirm", context: { source: "reauth", entry_id: "1955" } }],
-  });
-  const radarr = apps({ "ace.internal:7878": { startTime: "t" } });
-  const out = await reconcileApp({ hass: f.hass, http: radarr }, RADARR, { ...servarrBinding(7878), provision: "radarr-api" }, KEY);
-  assert.deepEqual(out, { what: "radarr", result: "written", fields: ["api_key", "url"] });
-  assert.deepEqual(f.submitted[0], { url: "http://ace.internal:7878", api_key: KEY, verify_ssl: false });
-});
-
-test("form values: suggested first, then default, sections nested", () => {
-  assert.deepEqual(formValues(brokerForm({ broker: "b", port: 1, protocol: "5", username: "u", password: "p" })), {
-    broker: "b", port: 1, protocol: "5", username: "u", password: PWD_NOT_CHANGED,
-    other_settings: { keepalive: 60, transport: "tcp", set_ca_cert: "off", set_client_cert: false },
-  });
-  assert.ok(sameUrl("http://ace.internal:8989/", "http://ace.internal:8989"));
-  assert.ok(sameUrl("http://ACE.internal", "http://ace.internal:80"));
-  assert.ok(!sameUrl("http://127.0.0.1:8989", "http://ace.internal:8989"));
-});

modules/home-assistant/tsconfig.json

@@ -8,14 +8,5 @@
     "skipLibCheck": true,
     "noEmit": true
   },
-  "include": [
-    "client.ts",
-    "index.ts",
-    "tools/index.ts",
-    "provisions/hass.ts",
-    "provisions/probe.ts",
-    "provisions/connections.ts",
-    "provisions/mesh.ts",
-    "provisions/index.ts"
-  ]
+  "include": ["client.ts", "index.ts", "tools/index.ts"]
 }

modules/icecast/Dockerfile

@@ -0,0 +1,24 @@
+# icecast's runtime: the tool runtime, carrying this module's compiled code.
+#
+# **Built from this module's own directory and nothing else.** The sdk and the tool runtime are in
+# the base images, published like any other artifact — which is what makes this buildable by the
+# mesh from a repository and a path (novox/hq ADR 0069) rather than only on a workstation that
+# happens to have the siblings.
+#
+# Two bases, named rather than pinned (novox/hq issue 044): the image this is COMPILED in and the
+# image it RUNS in — the second must not carry a compiler. Declared in module.json's `build.on`.
+ARG BUILD_BASE
+ARG RUNTIME_BASE
+
+FROM ${BUILD_BASE} AS build
+WORKDIR /app/modules/icecast
+COPY . .
+RUN node /app/node_modules/typescript/bin/tsc client.ts index.ts tools/index.ts \
+      --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist
+
+FROM ${RUNTIME_BASE}
+COPY --from=build /app/modules/icecast/dist /app/modules/icecast/dist
+# Every serve-time entrypoint, loaded by the runtime in serve mode: tools and events serve, and a
+# provider's provisioner runs its reconcile loop in the same process, with the broker connected —
+# the convention novox/hq issues 060/061 settled.
+ENV MESH_TOOL_MODULES=/app/modules/icecast/dist/index.js,/app/modules/icecast/dist/tools/index.js

modules/icecast/module.json

@@ -28,6 +28,9 @@
     "stream.started",
     "stream.stopped"
   ],
+  "own-secrets": {
+    "broker": "/var/lib/mesh/icecast/broker"
+  },
   "listens": [
     {
       "name": "stream",
@@ -41,8 +44,8 @@
     {
       "id": "mesh-state",
       "type": "directory",
-      "mode": "0700",
-      "place": "mesh"
+      "path": "/var/lib/mesh/icecast",
+      "mode": "0700"
     },
     {
       "id": "state",
@@ -88,30 +91,49 @@
     {
       "id": "runtime-config",
       "type": "file",
-      "path": "${dir:mesh-state}/config.json",
+      "path": "/var/lib/mesh/icecast/config.json",
       "mode": "0600",
       "content": "{}\n",
       "merge": "json"
+    },
+    {
+      "id": "runtime",
+      "type": "container",
+      "name": "mesh-icecast",
+      "network": "icecast",
+      "volumes": [
+        "/var/lib/mesh/icecast/broker:/run/secrets/broker:ro",
+        "/var/lib/mesh/icecast/config.json:/run/config/config.json:ro"
+      ],
+      "env": {
+        "MESH_BROKER_FILE": "/run/secrets/broker",
+        "MESH_ICECAST_URL": "http://icecast:8000",
+        "MESH_ICECAST_CONFIG_FILE": "/run/config/config.json"
+      },
+      "restart-on": [
+        "runtime-config"
+      ],
+      "artifact": "runtime"
     }
   ],
   "build": {
+    "on": [
+      {
+        "arg": "BUILD_BASE",
+        "module": "mesh-tools",
+        "artifact": "build"
+      },
+      {
+        "arg": "RUNTIME_BASE",
+        "module": "mesh-tools",
+        "artifact": "runtime"
+      }
+    ],
     "artifacts": [
       {
-        "name": "code",
-        "kind": "bundle",
-        "language": "typescript",
-        "entrypoints": [
-          "index.js",
-          "tools/index.js"
-        ],
-        "loads": [
-          "index.js",
-          "tools/index.js"
-        ],
-        "env": {
-          "MESH_ICECAST_URL": "http://127.0.0.1:${port:8000}",
-          "MESH_ICECAST_CONFIG_FILE": "${dir:mesh-state}/config.json"
-        }
+        "name": "runtime",
+        "kind": "image",
+        "from": "Dockerfile"
       }
     ]
   }

modules/influxdb/Dockerfile

@@ -0,0 +1,24 @@
+# influxdb's runtime: the tool runtime, carrying this module's compiled code.
+#
+# **Built from this module's own directory and nothing else.** The sdk and the tool runtime are in
+# the base images, published like any other artifact — which is what makes this buildable by the
+# mesh from a repository and a path (novox/hq ADR 0069) rather than only on a workstation that
+# happens to have the siblings.
+#
+# Two bases, named rather than pinned (novox/hq issue 044): the image this is COMPILED in and the
+# image it RUNS in — the second must not carry a compiler. Declared in module.json's `build.on`.
+ARG BUILD_BASE
+ARG RUNTIME_BASE
+
+FROM ${BUILD_BASE} AS build
+WORKDIR /app/modules/influxdb
+COPY . .
+RUN node /app/node_modules/typescript/bin/tsc client.ts grants.ts provisioner/index.ts tools/index.ts \
+      --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist
+
+FROM ${RUNTIME_BASE}
+COPY --from=build /app/modules/influxdb/dist /app/modules/influxdb/dist
+# Every serve-time entrypoint, loaded by the runtime in serve mode: tools and events serve, and a
+# provider's provisioner runs its reconcile loop in the same process, with the broker connected —
+# the convention novox/hq issues 060/061 settled.
+ENV MESH_TOOL_MODULES=/app/modules/influxdb/dist/tools/index.js,/app/modules/influxdb/dist/provisioner/index.js

modules/influxdb/module.json

@@ -11,6 +11,7 @@
     "container-runtime"
   ],
   "own-secrets": {
+    "broker": "/var/lib/mesh/influxdb/broker",
     "admin": "${dir:state}/admin.secret",
     "admin-token": "${dir:state}/admin-token.secret"
   },
@@ -41,8 +42,8 @@
     {
       "id": "mesh-state",
       "type": "directory",
-      "mode": "0700",
-      "place": "mesh"
+      "path": "/var/lib/mesh/influxdb",
+      "mode": "0700"
     },
     {
       "id": "state",
@@ -95,10 +96,33 @@
     {
       "id": "runtime-config",
       "type": "file",
-      "path": "${dir:mesh-state}/config.json",
+      "path": "/var/lib/mesh/influxdb/config.json",
       "mode": "0600",
       "content": "{}\n",
       "merge": "json"
+    },
+    {
+      "id": "runtime",
+      "type": "container",
+      "name": "mesh-influxdb",
+      "network": "host",
+      "volumes": [
+        "/var/lib/mesh/influxdb/broker:/run/secrets/broker:ro",
+        "/var/lib/mesh/influxdb/config.json:/run/config/config.json:ro",
+        "${dir:state}/admin-token.secret:/run/secrets/admin-token:ro",
+        "${dir:grants}:${dir:grants}:ro"
+      ],
+      "env": {
+        "MESH_BROKER_FILE": "/run/secrets/broker",
+        "MESH_INFLUXDB_URL": "http://127.0.0.1:${port:8086}",
+        "MESH_INFLUXDB_CONFIG_FILE": "/run/config/config.json",
+        "MESH_INFLUXDB_TOKEN_FILE": "/run/secrets/admin-token",
+        "MESH_RECEIVES": "${dir:grants}/mesh.json"
+      },
+      "restart-on": [
+        "runtime-config"
+      ],
+      "artifact": "runtime"
     }
   ],
   "requires": [
@@ -111,25 +135,23 @@
     }
   },
   "build": {
+    "on": [
+      {
+        "arg": "BUILD_BASE",
+        "module": "mesh-tools",
+        "artifact": "build"
+      },
+      {
+        "arg": "RUNTIME_BASE",
+        "module": "mesh-tools",
+        "artifact": "runtime"
+      }
+    ],
     "artifacts": [
       {
-        "name": "code",
-        "kind": "bundle",
-        "language": "typescript",
-        "entrypoints": [
-          "tools/index.js",
-          "provisioner/index.js"
-        ],
-        "loads": [
-          "tools/index.js",
-          "provisioner/index.js"
-        ],
-        "env": {
-          "MESH_INFLUXDB_URL": "http://127.0.0.1:${port:8086}",
-          "MESH_INFLUXDB_CONFIG_FILE": "${dir:mesh-state}/config.json",
-          "MESH_INFLUXDB_TOKEN_FILE": "${dir:state}/admin-token.secret",
-          "MESH_RECEIVES": "${dir:grants}/mesh.json"
-        }
+        "name": "runtime",
+        "kind": "image",
+        "from": "Dockerfile"
       }
     ]
   }

modules/invoicing/module.json

@@ -26,13 +26,13 @@
     }
   },
   "binds": {
-    "mongodb-database": "${dir:state}/database.json",
-    "s3-bucket": "${dir:state}/store.json",
-    "route": "${dir:state}/route.json"
+    "mongodb-database": "/var/lib/invoicing/database.json",
+    "s3-bucket": "/var/lib/invoicing/store.json",
+    "route": "/var/lib/invoicing/route.json"
   },
   "secrets": {
-    "mongodb-database": "${dir:state}/database.secret",
-    "s3-bucket": "${dir:state}/store.secret"
+    "mongodb-database": "/var/lib/invoicing/database.secret",
+    "s3-bucket": "/var/lib/invoicing/store.secret"
   },
   "listens": [
     {
@@ -54,21 +54,21 @@
     {
       "id": "mesh-state",
       "type": "directory",
-      "mode": "0700",
-      "place": "mesh"
+      "path": "/var/lib/mesh/invoicing",
+      "mode": "0700"
     },
     {
       "id": "state",
       "type": "directory",
-      "mode": "0700",
-      "place": "."
+      "path": "/var/lib/invoicing",
+      "mode": "0700"
     },
     {
       "id": "api-env",
       "type": "file",
-      "path": "${dir:state}/api.env",
+      "path": "/var/lib/invoicing/api.env",
       "mode": "0600",
-      "content": "NODE_ENV=production\nPORT=9000\nMONGO_URL=mongodb://${bound:mongodb-database:as}:${secret:mongodb-database}@${bound:mongodb-database:at}:${bound:mongodb-database:port}/${bound:mongodb-database:as}?authSource=${bound:mongodb-database:as}\nMONGO_DB=${bound:mongodb-database:as}\nMINIO_BUCKET=${bound:s3-bucket:bucket}\nMINIO_ENDPOINT=${bound:s3-bucket:at}\nMINIO_PORT=${bound:s3-bucket:port}\nMINIO_ACCESSKEY=${bound:s3-bucket:as}\nMINIO_SECRET=${secret:s3-bucket}\n"
+      "content": "NODE_ENV=production\nPORT=9000\nMONGO_URL=mongodb://${bound:mongodb-database:as}:${secret:mongodb-database}@${bound:mongodb-database:at}:${bound:mongodb-database:port}/${bound:mongodb-database:as}?authSource=${bound:mongodb-database:as}\nMONGO_DB=${bound:mongodb-database:as}\nMINIO_BUCKET=mesh-novox-invoice\nMINIO_ENDPOINT=${bound:s3-bucket:at}\nMINIO_PORT=${bound:s3-bucket:port}\nMINIO_ACCESSKEY=${bound:s3-bucket:as}\nMINIO_SECRET=${secret:s3-bucket}\n"
     },
     {
       "id": "net",
@@ -103,7 +103,7 @@
         "GID": "2201"
       },
       "env-file": [
-        "${dir:state}/api.env"
+        "/var/lib/invoicing/api.env"
       ],
       "ports": [
         "9000"

modules/jackett/Dockerfile

@@ -0,0 +1,24 @@
+# jackett's runtime: the tool runtime, carrying this module's compiled code.
+#
+# **Built from this module's own directory and nothing else.** The sdk and the tool runtime are in
+# the base images, published like any other artifact — which is what makes this buildable by the
+# mesh from a repository and a path (novox/hq ADR 0069) rather than only on a workstation that
+# happens to have the siblings.
+#
+# Two bases, named rather than pinned (novox/hq issue 044): the image this is COMPILED in and the
+# image it RUNS in — the second must not carry a compiler. Declared in module.json's `build.on`.
+ARG BUILD_BASE
+ARG RUNTIME_BASE
+
+FROM ${BUILD_BASE} AS build
+WORKDIR /app/modules/jackett
+COPY . .
+RUN node /app/node_modules/typescript/bin/tsc client.ts tools/index.ts \
+      --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist
+
+FROM ${RUNTIME_BASE}
+COPY --from=build /app/modules/jackett/dist /app/modules/jackett/dist
+# Every serve-time entrypoint, loaded by the runtime in serve mode: tools and events serve, and a
+# provider's provisioner runs its reconcile loop in the same process, with the broker connected —
+# the convention novox/hq issues 060/061 settled.
+ENV MESH_TOOL_MODULES=/app/modules/jackett/dist/tools/index.js

modules/jackett/client.ts

@@ -0,0 +1,136 @@
+// The Jackett API client — jackett's own code, living in the module (novox/hq ADR 0039). Jackett is
+// an indexer proxy: it normalises many torrent trackers behind one Torznab surface. This client
+// talks its /api/v2.0 REST API, and only jackett's tools import it.
+
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+
+export interface JackettIndexer {
+  id: string;
+  name: string;
+  type: string; // "public" | "private" | "semi-public"
+  configured: boolean;
+  siteLink?: string;
+  lastError?: string;
+}
+
+export interface JackettResult {
+  title: string;
+  tracker: string;
+  category?: string;
+  size: number;
+  seeders?: number;
+  peers?: number;
+  publishDate?: string;
+  link?: string;
+}
+
+/** The settings-merged config the mesh delivers (novox/hq ADR 0046): { url, apiKey, token, password, user, ... }. */
+function meshConfig(file?: string): Record<string, string> {
+  if (!file) return {};
+  try { return JSON.parse(readFileSync(file, "utf8")) as Record<string, string>; }
+  catch { return {}; }
+}
+
+export class JackettClient {
+  readonly baseUrl: string;
+
+  constructor(
+    url: string,
+    private readonly apiKey: string,
+  ) {
+    this.baseUrl = url.replace(/\/$/, "");
+  }
+
+  /**
+   * Build from the module's resolved environment. Jackett's REST API is keyed, so both the URL and
+   * the key must be present. The key is read from the settings-merged config or MESH_JACKETT_API_KEY,
+   * or, failing those, discovered from Jackett's own ServerConfig.json under MESH_JACKETT_CONFIG_DIR
+   * — the file Jackett writes it to, as sonarr/radarr read theirs from config.xml — so a running
+   * server needs no key configured by hand and no secret has to be put in an assignment. Without a
+   * URL or key there is nothing to talk to, so this throws and the module contributes no tools
+   * rather than failing half-configured.
+   */
+  static fromEnv(env: NodeJS.ProcessEnv = process.env): JackettClient {
+    const cfg = meshConfig(env.MESH_JACKETT_CONFIG_FILE);
+    const url = cfg.url ?? env.MESH_JACKETT_URL;
+    const apiKey = cfg.apiKey ?? env.MESH_JACKETT_API_KEY
+      ?? JackettClient.detectApiKey(env.MESH_JACKETT_CONFIG_DIR ?? "/config");
+    if (!url) throw new Error("no Jackett URL — set MESH_JACKETT_URL");
+    if (!apiKey) throw new Error("no Jackett API key — set MESH_JACKETT_API_KEY or make the config dir readable");
+    return new JackettClient(url, apiKey);
+  }
+
+  /** Discover the API key from Jackett's ServerConfig.json (the linuxserver image keeps it at
+   *  <config>/Jackett/ServerConfig.json), falling back to null. */
+  static detectApiKey(configDir: string): string | null {
+    for (const file of [join(configDir, "Jackett", "ServerConfig.json"), join(configDir, "ServerConfig.json")]) {
+      if (!existsSync(file)) continue;
+      try {
+        const key = (JSON.parse(readFileSync(file, "utf8")) as { APIKey?: unknown }).APIKey;
+        if (typeof key === "string" && key) return key;
+      } catch { /* unreadable or mid-write: try the next, then give up */ }
+    }
+    return null;
+  }
+
+  private async get(path: string, params: Record<string, string> = {}): Promise<any> {
+    const url = new URL(`${this.baseUrl}${path}`);
+    url.searchParams.set("apikey", this.apiKey);
+    for (const [k, v] of Object.entries(params)) url.searchParams.set(k, v);
+    const res = await fetch(url.toString(), { headers: { Accept: "application/json" } });
+    if (!res.ok) throw new Error(`Jackett API ${path}: ${res.status} ${await res.text()}`);
+    return res.json();
+  }
+
+  /**
+   * The configured indexers Jackett proxies. `configured=false` also lists the ones not set up.
+   * Read from the Torznab `t=indexers` feed, not /api/v2.0/indexers: that one is the web UI's and
+   * wants a login cookie (it answers an API-key request with a redirect), while the Torznab feed is
+   * what the key is for. The feed carries no last error, so `lastError` stays unset.
+   */
+  async getIndexers(configuredOnly = true): Promise<JackettIndexer[]> {
+    const url = new URL(`${this.baseUrl}/api/v2.0/indexers/all/results/torznab/api`);
+    url.searchParams.set("apikey", this.apiKey);
+    url.searchParams.set("t", "indexers");
+    url.searchParams.set("configured", configuredOnly ? "true" : "false");
+    const res = await fetch(url.toString(), { headers: { Accept: "application/xml" } });
+    if (!res.ok) throw new Error(`Jackett API torznab t=indexers: ${res.status} ${await res.text()}`);
+    const xml = await res.text();
+    // Torznab reports failures (a wrong key among them) as 200 with an <error> body.
+    const err = xml.match(/<error code="(\d+)" description="([^"]*)"/);
+    if (err) throw new Error(`Jackett API torznab t=indexers: error ${err[1]} ${err[2]}`);
+    const text = (block: string, tag: string) =>
+      block.match(new RegExp(`<${tag}>([^<]*)</${tag}>`))?.[1];
+    const out: JackettIndexer[] = [];
+    for (const m of xml.matchAll(/<indexer id="([^"]+)" configured="([^"]+)">([\s\S]*?)<\/indexer>/g)) {
+      out.push({
+        id: m[1],
+        name: text(m[3], "title") ?? m[1],
+        type: text(m[3], "type") ?? "unknown",
+        configured: m[2] === "true",
+        siteLink: text(m[3], "link"),
+      });
+    }
+    return out;
+  }
+
+  /**
+   * A Torznab search across one indexer, or the "all" aggregate. Jackett returns a normalised JSON
+   * result set regardless of the underlying tracker, which is the whole point of the proxy.
+   */
+  async search(query: string, indexer = "all", limit = 25): Promise<JackettResult[]> {
+    const raw = await this.get(`/api/v2.0/indexers/${encodeURIComponent(indexer)}/results`, { Query: query });
+    const results = Array.isArray(raw?.Results) ? raw.Results : [];
+    return results.slice(0, limit).map((r: any) => ({
+      title: r.Title,
+      tracker: r.Tracker ?? r.TrackerId ?? "unknown",
+      category: Array.isArray(r.CategoryDesc) ? r.CategoryDesc.join(", ") : r.CategoryDesc,
+      size: r.Size ?? 0,
+      seeders: r.Seeders,
+      peers: r.Peers,
+      publishDate: r.PublishDate,
+      link: r.Link ?? r.Details,
+    }));
+  }
+}

modules/jackett/module.json

@@ -0,0 +1,131 @@
+{
+  "module": "jackett",
+  "version": "1",
+  "provides": [
+    {
+      "name": "jackett-api",
+      "scope": "mesh"
+    }
+  ],
+  "serves": {
+    "jackett-api": {
+      "scheme": "http",
+      "port": 9117,
+      "url-base": ""
+    }
+  },
+  "capabilities": [
+    "container-runtime"
+  ],
+  "listens": [
+    {
+      "name": "web",
+      "port": 9117,
+      "protocol": "tcp",
+      "from": "mesh",
+      "why": "the indexer proxy: its web UI, and the Torznab feeds the *arr apps search through, which other modules reach as jackett-api"
+    }
+  ],
+  "resources": [
+    {
+      "id": "mesh-state",
+      "type": "directory",
+      "path": "/var/lib/mesh/jackett",
+      "mode": "0700"
+    },
+    {
+      "id": "state",
+      "type": "directory",
+      "mode": "0700",
+      "place": "."
+    },
+    {
+      "id": "config",
+      "type": "directory",
+      "mode": "0700",
+      "owner": "1000:1000"
+    },
+    {
+      "id": "server",
+      "type": "container",
+      "name": "jackett",
+      "image": "lscr.io/linuxserver/jackett@sha256:7b19f4f6ac33d855ca9226600ecbd096ee678f66da28b13a7c09980b035ff583",
+      "env": {
+        "PUID": "1000",
+        "PGID": "1000",
+        "TZ": "Etc/UTC"
+      },
+      "ports": [
+        "9117"
+      ],
+      "volumes": [
+        "${dir:config}:/config"
+      ]
+    },
+    {
+      "id": "runtime-config",
+      "type": "file",
+      "path": "${dir:state}/config.json",
+      "mode": "0600",
+      "content": "{}\n",
+      "merge": "json"
+    },
+    {
+      "id": "runtime",
+      "type": "container",
+      "name": "mesh-jackett",
+      "network": "host",
+      "volumes": [
+        "/var/lib/mesh/jackett/broker:/run/secrets/broker:ro",
+        "${dir:state}/config.json:/run/config/config.json:ro",
+        "${dir:config}:/var/lib/jackett/config:ro"
+      ],
+      "env": {
+        "MESH_BROKER_FILE": "/run/secrets/broker",
+        "MESH_JACKETT_URL": "http://127.0.0.1:${port:9117}",
+        "MESH_JACKETT_CONFIG_FILE": "/run/config/config.json",
+        "MESH_JACKETT_CONFIG_DIR": "/var/lib/jackett/config"
+      },
+      "restart-on": [
+        "runtime-config"
+      ],
+      "artifact": "runtime"
+    }
+  ],
+  "own-secrets": {
+    "broker": "/var/lib/mesh/jackett/broker"
+  },
+  "requires": [
+    "route"
+  ],
+  "contributes": {
+    "route": {
+      "label": "indexers",
+      "endpoint": "web"
+    }
+  },
+  "binds": {
+    "route": "${dir:state}/route.json"
+  },
+  "build": {
+    "on": [
+      {
+        "arg": "BUILD_BASE",
+        "module": "mesh-tools",
+        "artifact": "build"
+      },
+      {
+        "arg": "RUNTIME_BASE",
+        "module": "mesh-tools",
+        "artifact": "runtime"
+      }
+    ],
+    "artifacts": [
+      {
+        "name": "runtime",
+        "kind": "image",
+        "from": "Dockerfile"
+      }
+    ]
+  }
+}

modules/jackett/package.json

@@ -0,0 +1,14 @@
+{
+  "name": "@novox/module-jackett",
+  "version": "0.1.0",
+  "description": "jackett — indexer proxy. Its API client and tools live here (novox/hq ADR 0039).",
+  "type": "module",
+  "private": true,
+  "dependencies": {
+    "@novox/mesh-sdk": "^0.1.0"
+  },
+  "devDependencies": {
+    "@types/node": "^22.0.0",
+    "typescript": "^5.6.0"
+  }
+}

modules/jackett/tools/index.ts

@@ -0,0 +1,48 @@
+// jackett's tools — its own code (novox/hq ADR 0039), importing jackett's client. Jackett has
+// nothing worth watching (an indexer proxy answers queries; it has no timeline of its own), so it
+// is a tools-only module: no events entrypoint, no broker. What is useful is asking it things.
+
+import { registerModuleTools, type ToolDefinition } from "@novox/mesh-sdk/tools";
+import { JackettClient } from "../client.js";
+
+export function getJackettTools(jackett: JackettClient): ToolDefinition[] {
+  return [
+    {
+      name: "jackett_indexers",
+      description: "List the indexers Jackett proxies, with their type and site.",
+      input: { all: { type: "boolean", description: "include indexers not yet configured (default false)" } },
+      run: async (args) => {
+        const indexers = await jackett.getIndexers(!args.all);
+        return { count: indexers.length, indexers };
+      },
+    },
+    {
+      name: "jackett_search",
+      description: "Torznab search across Jackett's indexers, returning normalised torrent results.",
+      input: {
+        query: { type: "string", description: "the search query" },
+        indexer: { type: "string", description: 'an indexer id, or "all" to aggregate (default "all")' },
+        limit: { type: "number", description: "max results (default 25)" },
+      },
+      run: async (args) => {
+        const query = String(args.query);
+        const results = await jackett.search(
+          query,
+          args.indexer ? String(args.indexer) : "all",
+          args.limit ? Number(args.limit) : 25,
+        );
+        return { query, count: results.length, results };
+      },
+    },
+  ];
+}
+
+// Only exposed when Jackett is configured; otherwise jackett contributes no tools rather than
+// failing the whole runtime.
+registerModuleTools("jackett", (env) => {
+  try {
+    return getJackettTools(JackettClient.fromEnv(env));
+  } catch {
+    return [];
+  }
+});

modules/jackett/tsconfig.json

@@ -8,5 +8,5 @@
     "skipLibCheck": true,
     "noEmit": true
   },
-  "include": ["http.ts", "tools/index.ts"]
+  "include": ["client.ts", "tools/index.ts"]
 }

modules/jira/Dockerfile

@@ -0,0 +1,24 @@
+# jira's runtime: the tool runtime, carrying this module's compiled code.
+#
+# **Built from this module's own directory and nothing else.** The sdk and the tool runtime are in
+# the base images, published like any other artifact — which is what makes this buildable by the
+# mesh from a repository and a path (novox/hq ADR 0069) rather than only on a workstation that
+# happens to have the siblings.
+#
+# Two bases, named rather than pinned (novox/hq issue 044): the image this is COMPILED in and the
+# image it RUNS in — the second must not carry a compiler. Declared in module.json's `build.on`.
+ARG BUILD_BASE
+ARG RUNTIME_BASE
+
+FROM ${BUILD_BASE} AS build
+WORKDIR /app/modules/jira
+COPY . .
+RUN node /app/node_modules/typescript/bin/tsc client.ts tools/index.ts \
+      --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist
+
+FROM ${RUNTIME_BASE}
+COPY --from=build /app/modules/jira/dist /app/modules/jira/dist
+# Every serve-time entrypoint, loaded by the runtime in serve mode: tools and events serve, and a
+# provider's provisioner runs its reconcile loop in the same process, with the broker connected —
+# the convention novox/hq issues 060/061 settled.
+ENV MESH_TOOL_MODULES=/app/modules/jira/dist/tools/index.js

modules/jira/module.json

@@ -2,43 +2,69 @@
   "module": "jira",
   "version": "1",
   "own-secrets": {
-    "token": "${dir:state}/token"
+    "token": "/var/lib/jira/token",
+    "broker": "/var/lib/mesh/jira/broker"
   },
   "resources": [
+    {
+      "id": "mesh-state",
+      "type": "directory",
+      "path": "/var/lib/mesh/jira",
+      "mode": "0700"
+    },
     {
       "id": "state",
       "type": "directory",
-      "mode": "0700",
-      "place": "."
+      "path": "/var/lib/jira",
+      "mode": "0700"
     },
     {
       "id": "config",
       "type": "file",
-      "path": "${dir:state}/config.json",
+      "path": "/var/lib/jira/config.json",
       "merge": "json",
       "content": "{}",
       "mode": "0600"
+    },
+    {
+      "id": "runtime",
+      "type": "container",
+      "name": "mesh-runtime-jira",
+      "network": "host",
+      "volumes": [
+        "/var/lib/jira/config.json:/run/config/config.json:ro",
+        "/var/lib/jira/token:/run/secrets/token:ro",
+        "/var/lib/mesh/jira/broker:/run/secrets/broker:ro"
+      ],
+      "env": {
+        "MESH_JIRA_TOKEN_FILE": "/run/secrets/token",
+        "MESH_JIRA_CONFIG_FILE": "/run/config/config.json",
+        "MESH_BROKER_FILE": "/run/secrets/broker"
+      },
+      "artifact": "runtime"
     }
   ],
   "capabilities": [
     "container-runtime"
   ],
   "build": {
+    "on": [
+      {
+        "arg": "BUILD_BASE",
+        "module": "mesh-tools",
+        "artifact": "build"
+      },
+      {
+        "arg": "RUNTIME_BASE",
+        "module": "mesh-tools",
+        "artifact": "runtime"
+      }
+    ],
     "artifacts": [
       {
-        "name": "tools",
-        "kind": "bundle",
-        "language": "typescript",
-        "entrypoints": [
-          "tools/index.js"
-        ],
-        "loads": [
-          "tools/index.js"
-        ],
-        "env": {
-          "MESH_JIRA_TOKEN_FILE": "${dir:state}/token",
-          "MESH_JIRA_CONFIG_FILE": "${dir:state}/config.json"
-        }
+        "name": "runtime",
+        "kind": "image",
+        "from": "Dockerfile"
       }
     ]
   }

modules/keycloak/Dockerfile

@@ -0,0 +1,30 @@
+# keycloak's runtime: the tool runtime, carrying this module's compiled code.
+#
+# **Built from this module's own directory and nothing else.** The sdk and the tool runtime are in
+# the base images, published like any other artifact — which is what makes this buildable by the
+# mesh from a repository and a path (novox/hq ADR 0069) rather than only on a workstation that
+# happens to have the siblings.
+#
+# Two bases, named rather than pinned (novox/hq issue 044): the image this is COMPILED in and the
+# image it RUNS in — the second must not carry a compiler. Declared in module.json's `build.on`.
+ARG BUILD_BASE
+ARG RUNTIME_BASE
+
+FROM ${BUILD_BASE} AS build
+# Compiled under /app/modules so `@novox/mesh-sdk` resolves upward into the base's own
+# node_modules — the module is compiled against exactly the sdk it will run against. The compiler
+# is invoked by its real path: node_modules/.bin entries are launcher symlinks the base image
+# resolved away.
+WORKDIR /app/modules/keycloak
+COPY . .
+RUN node /app/node_modules/typescript/bin/tsc client.ts index.ts tools/index.ts \
+      --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist
+
+FROM ${RUNTIME_BASE}
+COPY --from=build /app/modules/keycloak/dist /app/modules/keycloak/dist
+# Every serve-time entrypoint, loaded by the runtime in serve mode: tools and events serve, and a
+# provider's provisioner runs its reconcile loop in the same process, with the broker connected —
+# the convention novox/hq issues 060/061 settled. A container that instead ran only its
+# provisioner (`run`) served no tools and emitted no events; a container that named no command
+# ran no provisioner at all.
+ENV MESH_TOOL_MODULES=/app/modules/keycloak/dist/index.js,/app/modules/keycloak/dist/tools/index.js

modules/keycloak/client.ts

@@ -12,45 +12,6 @@ function meshConfig(file?: string): Record<string, string> {
   catch { return {}; }
 }
 
-/** A secret file's value, trailing newline trimmed; undefined when unset or unreadable. */
-function secretFile(file?: string): string | undefined {
-  if (!file) return undefined;
-  try { return readFileSync(file, "utf8").replace(/\n$/, "") || undefined; }
-  catch { return undefined; }
-}
-
-/** A client as the admin API represents it — only the fields this module reads or writes are typed;
- *  the rest travel through untouched, so an update never drops what somebody else set. */
-export interface ClientRepresentation {
-  id?: string;
-  clientId: string;
-  name?: string;
-  enabled?: boolean;
-  protocol?: string;
-  publicClient?: boolean;
-  clientAuthenticatorType?: string;
-  secret?: string;
-  rootUrl?: string;
-  baseUrl?: string;
-  redirectUris?: string[];
-  webOrigins?: string[];
-  standardFlowEnabled?: boolean;
-  implicitFlowEnabled?: boolean;
-  directAccessGrantsEnabled?: boolean;
-  serviceAccountsEnabled?: boolean;
-  attributes?: Record<string, string>;
-  protocolMappers?: ProtocolMapperRepresentation[];
-  [other: string]: unknown;
-}
-
-export interface ProtocolMapperRepresentation {
-  id?: string;
-  name: string;
-  protocol: string;
-  protocolMapper: string;
-  config: Record<string, string>;
-}
-
 export class KeycloakClient {
   readonly baseUrl: string;
   readonly defaultRealm: string;
@@ -79,13 +40,8 @@ export class KeycloakClient {
     const cfg = meshConfig(env.MESH_KEYCLOAK_CONFIG_FILE);
     const url = cfg.url ?? env.MESH_KEYCLOAK_URL ?? `http://127.0.0.1:${env.KEYCLOAK_PORT ?? "8080"}`;
     const adminUser = cfg.user ?? env.MESH_KEYCLOAK_ADMIN ?? env.KEYCLOAK_ADMIN ?? "admin";
-    // The admin password reaches the runtime as a file (novox/hq ADR 0086): the module's own `admin`
-    // secret, mounted read-only. The environment forms stay for a co-located server that has them.
-    const adminPass = cfg.password ?? secretFile(env.MESH_KEYCLOAK_PASSWORD_FILE)
-      ?? env.MESH_KEYCLOAK_PASSWORD ?? env.KEYCLOAK_ADMIN_PASSWORD;
-    if (!adminPass) {
-      throw new Error("no Keycloak admin password — set MESH_KEYCLOAK_PASSWORD_FILE (or MESH_KEYCLOAK_PASSWORD)");
-    }
+    const adminPass = cfg.password ?? env.MESH_KEYCLOAK_PASSWORD ?? env.KEYCLOAK_ADMIN_PASSWORD;
+    if (!adminPass) throw new Error("no Keycloak admin password — set MESH_KEYCLOAK_PASSWORD");
     const realm = cfg.realm ?? env.MESH_KEYCLOAK_REALM ?? "master";
     return new KeycloakClient(url, adminUser, adminPass, realm);
   }
@@ -203,50 +159,6 @@ export class KeycloakClient {
     return client.id as string;
   }
 
-  /** The one client with exactly this clientId, or undefined. The admin API's `clientId` filter is an
-   *  exact match unless `search=true` is asked for. */
-  async findClient(realm: string, clientId: string): Promise<ClientRepresentation | undefined> {
-    const found = await this.request<ClientRepresentation[]>(
-      `/${realm}/clients?clientId=${encodeURIComponent(clientId)}`);
-    return found.find((c) => c.clientId === clientId);
-  }
-
-  async createClientFrom(realm: string, rep: ClientRepresentation): Promise<void> {
-    await this.request(`/${realm}/clients`, { method: "POST", body: JSON.stringify(rep) });
-  }
-
-  /** Replace a client's representation, addressed by its internal id. */
-  async updateClient(realm: string, id: string, rep: ClientRepresentation): Promise<void> {
-    await this.request(`/${realm}/clients/${id}`, { method: "PUT", body: JSON.stringify(rep) });
-  }
-
-  async deleteClientById(realm: string, id: string): Promise<void> {
-    await this.request(`/${realm}/clients/${id}`, { method: "DELETE" });
-  }
-
-  async clientSecretById(realm: string, id: string): Promise<string | undefined> {
-    const result = await this.request<{ value?: string }>(`/${realm}/clients/${id}/client-secret`);
-    return result.value;
-  }
-
-  async listClientMappers(realm: string, id: string): Promise<ProtocolMapperRepresentation[]> {
-    return this.request(`/${realm}/clients/${id}/protocol-mappers/models`);
-  }
-
-  async addClientMapper(realm: string, id: string, mapper: ProtocolMapperRepresentation): Promise<void> {
-    await this.request(`/${realm}/clients/${id}/protocol-mappers/models`, {
-      method: "POST",
-      body: JSON.stringify(mapper),
-    });
-  }
-
-  async updateClientMapper(realm: string, id: string, mapper: ProtocolMapperRepresentation): Promise<void> {
-    await this.request(`/${realm}/clients/${id}/protocol-mappers/models/${mapper.id}`, {
-      method: "PUT",
-      body: JSON.stringify(mapper),
-    });
-  }
-
   async deleteClient(realm: string, clientId: string): Promise<void> {
     await this.request(`/${realm}/clients/${await this.resolveClientId(realm, clientId)}`, { method: "DELETE" });
   }

modules/keycloak/module.json

@@ -1,12 +1,6 @@
 {
   "module": "keycloak",
   "version": "1",
-  "provides": [
-    {
-      "name": "oidc-client",
-      "scope": "mesh"
-    }
-  ],
   "requires": [
     "postgres-database",
     "route"
@@ -21,11 +15,11 @@
     }
   },
   "binds": {
-    "postgres-database": "${dir:state}/database.json",
-    "route": "${dir:state}/route.json"
+    "postgres-database": "/var/lib/keycloak/database.json",
+    "route": "/var/lib/keycloak/route.json"
   },
   "secrets": {
-    "postgres-database": "${dir:state}/database.secret"
+    "postgres-database": "/var/lib/keycloak/database.secret"
   },
   "capabilities": [
     "container-runtime"
@@ -47,52 +41,34 @@
       "why": "anything the mesh runs that authenticates a person"
     }
   ],
-  "serves": {
-    "oidc-client": {
-      "authorization-path": "/protocol/openid-connect/auth",
-      "token-path": "/protocol/openid-connect/token",
-      "userinfo-path": "/protocol/openid-connect/userinfo",
-      "issuer": "${setting:issuer}"
-    }
-  },
-  "receives": {
-    "oidc-client": "${dir:grants}/mesh.json"
-  },
-  "grants": {
-    "oidc-client": "${dir:grants}"
-  },
   "own-secrets": {
-    "admin": "${dir:state}/admin.secret"
+    "admin": "/var/lib/keycloak/admin.secret",
+    "broker": "/var/lib/mesh/keycloak/broker"
   },
   "resources": [
     {
       "id": "mesh-state",
       "type": "directory",
-      "mode": "0700",
-      "place": "mesh"
+      "path": "/var/lib/mesh/keycloak",
+      "mode": "0700"
     },
     {
       "id": "state",
       "type": "directory",
-      "mode": "0700",
-      "place": "."
-    },
-    {
-      "id": "grants",
-      "type": "directory",
+      "path": "/var/lib/keycloak",
       "mode": "0700"
     },
     {
       "id": "admin-env",
       "type": "file",
-      "path": "${dir:state}/admin.env",
+      "path": "/var/lib/keycloak/admin.env",
       "mode": "0600",
       "content": "KEYCLOAK_ADMIN=admin\nKEYCLOAK_ADMIN_PASSWORD=${secret:admin}\n"
     },
     {
       "id": "database-env",
       "type": "file",
-      "path": "${dir:state}/database.env",
+      "path": "/var/lib/keycloak/database.env",
       "mode": "0600",
       "content": "KC_DB_URL=jdbc:postgresql://${bound:postgres-database:at}:${bound:postgres-database:port}/${bound:postgres-database:as}\nKC_DB_USERNAME=${bound:postgres-database:as}\nKC_DB_PASSWORD=${secret:postgres-database}\n"
     },
@@ -102,10 +78,10 @@
       "name": "keycloak"
     },
     {
-      "id": "hostname",
+      "id": "hostname-env",
       "type": "file",
-      "path": "${dir:state}/hostname.env",
-      "mode": "0644",
+      "path": "/var/lib/keycloak/hostname.env",
+      "mode": "0600",
       "content": "KC_HOSTNAME=https://${bound:route:name}\n"
     },
     {
@@ -124,49 +100,61 @@
         "KC_PROXY_HEADERS": "xforwarded"
       },
       "env-file": [
-        "${dir:state}/admin.env",
-        "${dir:state}/database.env",
-        "${dir:state}/hostname.env"
+        "/var/lib/keycloak/admin.env",
+        "/var/lib/keycloak/database.env",
+        "/var/lib/keycloak/hostname.env"
       ],
       "ports": [
         "8080"
       ],
-      "secrets-in-environment": "KC_DB_PASSWORD is convertible through a generated keycloak.conf (db-password=); KEYCLOAK_ADMIN_PASSWORD is env-only before Keycloak 26; not yet converted",
-      "restart-on": [
-        "hostname"
-      ]
+      "secrets-in-environment": "KC_DB_PASSWORD is convertible through a generated keycloak.conf (db-password=); KEYCLOAK_ADMIN_PASSWORD is env-only before Keycloak 26; not yet converted"
     },
     {
       "id": "runtime-config",
       "type": "file",
-      "path": "${dir:mesh-state}/config.json",
+      "path": "/var/lib/mesh/keycloak/config.json",
       "mode": "0600",
       "content": "{}\n",
       "merge": "json"
+    },
+    {
+      "id": "runtime",
+      "type": "container",
+      "name": "mesh-keycloak",
+      "network": "host",
+      "volumes": [
+        "/var/lib/mesh/keycloak/broker:/run/secrets/broker:ro",
+        "/var/lib/mesh/keycloak/config.json:/run/config/config.json:ro"
+      ],
+      "env": {
+        "MESH_BROKER_FILE": "/run/secrets/broker",
+        "MESH_KEYCLOAK_URL": "http://127.0.0.1:${port:8080}",
+        "MESH_KEYCLOAK_CONFIG_FILE": "/run/config/config.json"
+      },
+      "restart-on": [
+        "runtime-config"
+      ],
+      "artifact": "runtime"
     }
   ],
   "build": {
+    "on": [
+      {
+        "arg": "BUILD_BASE",
+        "module": "mesh-tools",
+        "artifact": "build"
+      },
+      {
+        "arg": "RUNTIME_BASE",
+        "module": "mesh-tools",
+        "artifact": "runtime"
+      }
+    ],
     "artifacts": [
       {
-        "name": "code",
-        "kind": "bundle",
-        "language": "typescript",
-        "entrypoints": [
-          "index.js",
-          "tools/index.js",
-          "provisioner/index.js"
-        ],
-        "loads": [
-          "index.js",
-          "tools/index.js",
-          "provisioner/index.js"
-        ],
-        "env": {
-          "MESH_KEYCLOAK_URL": "http://127.0.0.1:${port:8080}",
-          "MESH_KEYCLOAK_CONFIG_FILE": "${dir:mesh-state}/config.json",
-          "MESH_KEYCLOAK_PASSWORD_FILE": "${dir:state}/admin.secret",
-          "MESH_RECEIVES": "${dir:grants}/mesh.json"
-        }
+        "name": "runtime",
+        "kind": "image",
+        "from": "Dockerfile"
       }
     ]
   }

modules/keycloak/oidc.ts

@@ -1,185 +0,0 @@
-// What the `oidc-client` provision means in Keycloak: one confidential OpenID Connect client per
-// consumer, in the realm this module serves, under the name and secret the mesh gave both ends.
-// The provisioner (provisioner/index.ts) is the sdk harness calling these; they are here, apart from
-// it, so they can be exercised against a fake admin API without a broker or a contributions file.
-//
-// **The client id and the secret are the mesh's, not Keycloak's (novox/hq ADR 0048).** The mesh
-// derives the consumer's identity (`as`, e.g. `mesh_ace_grafana`) and hands it to both ends — the
-// consumer names it as its client id through `${bound:oidc-client:as}` — and mints the secret, which
-// this sets as the client's secret. Keycloak generates neither.
-//
-// **Where the consumer's browser comes back to is the consumer's to say.** Its contribution carries
-// `callback` (a path, e.g. `/login/generic_oauth`) and the `label`/`endpoint` of the endpoint it is
-// reached on; the mesh composes that endpoint's names into `name` (public) and `internal-name`
-// (private network) exactly as it does for a route (novox/hq ADR 0056, 0138), so the redirect URI
-// registered here is built from the same names the proxy serves the consumer under.
-//
-// **Only what the mesh made is touched.** A client this module creates carries the attribute
-// `mesh.provisioned=true`, and its id starts with the mesh's own prefix. A client with the same id
-// that lacks the mark is somebody else's: it is refused, never adopted, never updated, never deleted.
-
-import type { ClientRepresentation, KeycloakClient, ProtocolMapperRepresentation } from "./client.js";
-
-/** The attribute marking a client as the mesh's own work. */
-export const MARK = "mesh.provisioned";
-
-/** The mapper every mesh client carries: realm roles as a flat `roles` claim in the id token, the
- *  access token and userinfo — what a consumer maps its own roles from (grafana's role path reads
- *  `roles[*]`), and what the predecessor added to its hand-made clients by hand. */
-export const ROLES_MAPPER: ProtocolMapperRepresentation = {
-  name: "realm roles",
-  protocol: "openid-connect",
-  protocolMapper: "oidc-usermodel-realm-role-mapper",
-  config: {
-    "claim.name": "roles",
-    "jsonType.label": "String",
-    multivalued: "true",
-    "id.token.claim": "true",
-    "access.token.claim": "true",
-    "userinfo.token.claim": "true",
-  },
-};
-
-/** One consumer, as the harness hands it over. */
-export interface OidcGrant {
-  readonly as: string;
-  readonly password: string;
-  readonly values: Readonly<Record<string, unknown>>;
-  readonly consumer?: string;
-}
-
-/** The realm named by an issuer URL — `https://id.example/realms/Novox` is realm `Novox`. The issuer is
- *  the one value an assignment sets (it is also what consumers are served), so the realm is read
- *  out of it rather than set a second time where the two could disagree. */
-export function realmOf(issuer: string): string {
-  let path: string;
-  try {
-    path = new URL(issuer).pathname;
-  } catch {
-    throw new Error(`the issuer ${JSON.stringify(issuer)} is not a URL`);
-  }
-  const m = /\/realms\/([^/]+)\/?$/.exec(path);
-  if (!m) throw new Error(`the issuer ${JSON.stringify(issuer)} does not end in /realms/<realm>`);
-  return decodeURIComponent(m[1]);
-}
-
-/** The redirect URIs a consumer's contribution asks for: its callback under each name the mesh
- *  composed for its endpoint. Refused when there is nothing to register — a client that accepts no
- *  redirect is a client nobody can log in through, and one that accepts any is worse. */
-export function redirectsOf(values: Readonly<Record<string, unknown>>): { root: string; redirects: string[] } {
-  const callback = values.callback;
-  if (typeof callback !== "string" || !callback.startsWith("/")) {
-    throw new Error(`contributes no callback path (\`callback\`, starting with "/"): ${JSON.stringify(callback)}`);
-  }
-  const names: string[] = [];
-  for (const key of ["name", "internal-name"]) {
-    const n = values[key];
-    if (typeof n === "string" && n.trim() !== "" && !names.includes(n.trim())) names.push(n.trim());
-  }
-  if (names.length === 0) {
-    throw new Error("has no name the mesh composed (`name` / `internal-name`) — contribute a `label` and the `endpoint` it is reached on");
-  }
-  return { root: `https://${names[0]}`, redirects: names.map((n) => `https://${n}${callback}`) };
-}
-
-/** The fields the mesh owns on a client it made. Everything else on the client is left as found. */
-function wanted(g: OidcGrant): ClientRepresentation {
-  const { root, redirects } = redirectsOf(g.values);
-  return {
-    clientId: g.as,
-    name: g.as,
-    description: `made by the mesh for ${g.consumer ? `a module on ${g.consumer}` : "a consumer"} — do not edit; it is reset`,
-    enabled: true,
-    protocol: "openid-connect",
-    publicClient: false,
-    clientAuthenticatorType: "client-secret",
-    secret: g.password,
-    rootUrl: root,
-    baseUrl: root,
-    redirectUris: redirects,
-    standardFlowEnabled: true,
-    implicitFlowEnabled: false,
-    directAccessGrantsEnabled: false,
-    serviceAccountsEnabled: false,
-  };
-}
-
-function sameSet(a: readonly string[] | undefined, b: readonly string[]): boolean {
-  const x = [...(a ?? [])].sort();
-  const y = [...b].sort();
-  return x.length === y.length && x.every((v, i) => v === y[i]);
-}
-
-function marked(c: ClientRepresentation): boolean {
-  return c.attributes?.[MARK] === "true";
-}
-
-export class OidcClients {
-  constructor(private readonly kc: KeycloakClient, readonly realm: string) {}
-
-  /** Create the consumer's client, or bring the mesh's existing one back to what the grant says.
-   *  Returns whether it was newly created. Idempotent: applying the same grant twice changes nothing
-   *  the second time beyond re-asserting it. */
-  async ensure(g: OidcGrant): Promise<"created" | "updated"> {
-    const want = wanted(g);
-    const found = await this.kc.findClient(this.realm, g.as);
-    if (found && !marked(found)) {
-      throw new Error(
-        `realm ${this.realm} already has a client ${g.as} the mesh did not make — left alone; ` +
-          `delete or rename it if the mesh should own that id`);
-    }
-    if (!found) {
-      await this.kc.createClientFrom(this.realm, {
-        ...want,
-        attributes: { [MARK]: "true" },
-        protocolMappers: [ROLES_MAPPER],
-      });
-      return "created";
-    }
-    // Overlay what the mesh owns on what is there, so a field Keycloak added or an operator set on a
-    // field the mesh does not own survives the update.
-    await this.kc.updateClient(this.realm, found.id!, {
-      ...found,
-      ...want,
-      attributes: { ...(found.attributes ?? {}), [MARK]: "true" },
-    });
-    await this.ensureMapper(found.id!);
-    return "updated";
-  }
-
-  private async ensureMapper(id: string): Promise<void> {
-    const mappers = await this.kc.listClientMappers(this.realm, id);
-    const have = mappers.find((m) => m.name === ROLES_MAPPER.name);
-    if (!have) {
-      await this.kc.addClientMapper(this.realm, id, ROLES_MAPPER);
-      return;
-    }
-    const drifted =
-      have.protocolMapper !== ROLES_MAPPER.protocolMapper ||
-      Object.entries(ROLES_MAPPER.config).some(([k, v]) => have.config?.[k] !== v);
-    if (drifted) {
-      await this.kc.updateClientMapper(this.realm, id, { ...ROLES_MAPPER, id: have.id });
-    }
-  }
-
-  /** Whether Keycloak still holds this consumer's client exactly as the grant says: present, the
-   *  mesh's, enabled, confidential, with the mesh's secret and the redirects asked for. Reads only. */
-  async holds(g: OidcGrant): Promise<boolean> {
-    const want = wanted(g);
-    const found = await this.kc.findClient(this.realm, g.as);
-    if (!found || !marked(found) || found.enabled === false || found.publicClient) return false;
-    if (!sameSet(found.redirectUris, want.redirectUris!)) return false;
-    const mappers = await this.kc.listClientMappers(this.realm, found.id!);
-    if (!mappers.some((m) => m.name === ROLES_MAPPER.name)) return false;
-    return (await this.kc.clientSecretById(this.realm, found.id!)) === g.password;
-  }
-
-  /** Withdraw a consumer's client — only one the mesh made. Returns what happened, for the log. */
-  async remove(as: string): Promise<"removed" | "absent" | "not ours"> {
-    const found = await this.kc.findClient(this.realm, as);
-    if (!found) return "absent";
-    if (!marked(found)) return "not ours";
-    await this.kc.deleteClientById(this.realm, found.id!);
-    return "removed";
-  }
-}

modules/keycloak/package.json

@@ -1,15 +1,11 @@
 {
   "name": "@novox/module-keycloak",
   "version": "0.1.0",
-  "description": "keycloak — identity and access; provides the mesh oidc-client interface. Its admin API client, provisioner, tools and events live here (novox/hq ADR 0039).",
+  "description": "keycloak — identity and access. Its admin API client, tools and events live here (novox/hq ADR 0039).",
   "type": "module",
   "private": true,
-  "scripts": {
-    "build": "tsc client.ts oidc.ts index.ts provisioner/index.ts tools/index.ts --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist",
-    "test": "npm run build && node --test --experimental-strip-types 'test/*.test.ts'"
-  },
   "dependencies": {
-    "@novox/mesh-sdk": "^0.1.1"
+    "@novox/mesh-sdk": "^0.1.0"
   },
   "devDependencies": {
     "@types/node": "^22.0.0",

modules/keycloak/provisioner/index.ts

@@ -1,73 +0,0 @@
-// keycloak's provisioner — the adapter that makes keycloak a provider of the mesh `oidc-client`
-// interface. The reconcile loop, the contributions file and reading the mesh's minted secret are the
-// sdk harness's; this writes only the per-service half: how Keycloak creates, checks and removes a
-// consumer's client (novox/hq ADR 0039/0040/0048). What a client is, and which ones are the mesh's,
-// is in ../oidc.ts.
-//
-// The `oidc-client` interface: a consumer logs people in through the realm this module serves, as
-// the confidential client `as` with the secret the mesh minted, and is redirected back to the
-// callback it contributed under the names the mesh composed for its endpoint. What it is served —
-// the issuer and the endpoint paths under it — is in the manifest's `serves`, settled with the
-// assignment's settings.
-//
-// **The realm is read out of the issuer**, the one value an assignment sets (settings reach both the
-// served facts and this module's config.json): a realm set in one place and an issuer in another
-// would let the consumer be told one realm while its client is made in another.
-
-import { runProvisioner, type Provision } from "@novox/mesh-sdk/provisioner";
-import { emit } from "@novox/mesh-sdk/events";
-import { readFileSync } from "node:fs";
-import { KeycloakClient } from "../client.js";
-import { OidcClients, realmOf } from "../oidc.js";
-
-/** The issuer this assignment serves, from the settings-merged config the mesh delivers. */
-function issuer(): string {
-  const file = process.env.MESH_KEYCLOAK_CONFIG_FILE;
-  let cfg: Record<string, unknown> = {};
-  if (file) {
-    try {
-      cfg = JSON.parse(readFileSync(file, "utf8")) as Record<string, unknown>;
-    } catch {
-      // Absent or unreadable: fall through to the environment, and refuse below if that is empty too.
-    }
-  }
-  const said = typeof cfg.issuer === "string" ? cfg.issuer : process.env.MESH_KEYCLOAK_ISSUER;
-  if (!said) throw new Error("no issuer — the module's config.json carries none and MESH_KEYCLOAK_ISSUER is unset");
-  return said;
-}
-
-const clients = new OidcClients(KeycloakClient.fromEnv(), realmOf(issuer()));
-
-/** Emit a lifecycle event without letting a broker hiccup fail the provisioning itself. */
-async function announce(type: string, body: Record<string, string>): Promise<void> {
-  try {
-    await emit(type, body);
-  } catch (err) {
-    console.error(`[provisioner:oidc-client] emit ${type} failed: ${err}`);
-  }
-}
-
-runProvisioner("oidc-client", {
-  async create(p: Provision): Promise<void> {
-    const done = await clients.ensure(p);
-    if (done === "created") {
-      console.log(`[provisioner:oidc-client] created client ${p.as} in realm ${clients.realm}`);
-      await announce("client.created", { realm: clients.realm, clientId: p.as, consumer: p.consumer ?? "" });
-    }
-  },
-
-  async remove(p: { as: string }): Promise<void> {
-    const done = await clients.remove(p.as);
-    if (done === "not ours") {
-      console.error(`[provisioner:oidc-client] ${p.as}: a client of that id exists that the mesh did not make — left alone`);
-    } else if (done === "removed") {
-      console.log(`[provisioner:oidc-client] removed client ${p.as} from realm ${clients.realm}`);
-    }
-  },
-
-  // Asked every minute by the harness: whether Keycloak still holds this consumer's client exactly as
-  // the mesh gave it, so a client deleted or edited behind the mesh's back is made again (hq issue 120).
-  async holds(p: Provision): Promise<boolean> {
-    return clients.holds(p);
-  },
-});

modules/keycloak/test/oidc.test.ts

@@ -1,239 +0,0 @@
-// What holds keycloak to the `oidc-client` provision (oidc.ts): one confidential client per consumer,
-// under the id and secret the mesh gave, redirecting only to the consumer's own callback under the
-// names the mesh composed; made once and brought back on every apply; and a client the mesh did not
-// make — same id or not — never adopted, changed or deleted.
-//
-// Keycloak is a fake: the admin routes the module touches, answering with the status codes and the
-// shapes Keycloak gives. Run against the compiled module (npm test builds first), the way the runtime
-// loads it.
-
-import { test, after } from "node:test";
-import assert from "node:assert/strict";
-import { createServer, type IncomingMessage, type ServerResponse } from "node:http";
-import { randomUUID } from "node:crypto";
-
-import { KeycloakClient } from "../dist/client.js";
-import { MARK, OidcClients, ROLES_MAPPER, realmOf, redirectsOf } from "../dist/oidc.js";
-
-type Client = Record<string, any>;
-
-/** The realm's clients, by internal id, and what the fake was asked. */
-const realm = "Novox";
-const clients = new Map<string, Client>();
-const calls: string[] = [];
-
-function body(req: IncomingMessage): Promise<any> {
-  return new Promise((resolve) => {
-    let raw = "";
-    req.on("data", (c) => (raw += c));
-    req.on("end", () => resolve(raw ? JSON.parse(raw) : undefined));
-  });
-}
-
-function send(res: ServerResponse, status: number, value?: unknown): void {
-  res.writeHead(status, { "Content-Type": "application/json" });
-  res.end(value === undefined ? "" : JSON.stringify(value));
-}
-
-const server = createServer(async (req, res) => {
-  const url = new URL(req.url!, "http://fake");
-  calls.push(`${req.method} ${url.pathname}`);
-  if (url.pathname === "/realms/master/protocol/openid-connect/token") {
-    return send(res, 200, { access_token: "t", expires_in: 300 });
-  }
-  const base = `/admin/realms/${realm}/clients`;
-  if (!url.pathname.startsWith(base)) return send(res, 404, { error: "Realm not found." });
-  const rest = url.pathname.slice(base.length).split("/").filter(Boolean);
-  if (rest.length === 0 && req.method === "GET") {
-    const want = url.searchParams.get("clientId");
-    return send(res, 200, [...clients.values()].filter((c) => !want || c.clientId === want));
-  }
-  if (rest.length === 0 && req.method === "POST") {
-    const rep = await body(req);
-    if ([...clients.values()].some((c) => c.clientId === rep.clientId)) {
-      return send(res, 409, { errorMessage: `Client ${rep.clientId} already exists` });
-    }
-    const id = randomUUID();
-    const mappers = (rep.protocolMappers ?? []).map((m: Client) => ({ ...m, id: randomUUID() }));
-    clients.set(id, { ...rep, id, protocolMappers: mappers });
-    return send(res, 201);
-  }
-  const c = clients.get(rest[0]);
-  if (!c) return send(res, 404, { error: "Could not find client" });
-  if (rest.length === 1 && req.method === "PUT") {
-    // Keycloak ignores protocolMappers on a client update: they have their own endpoints.
-    const rep = await body(req);
-    clients.set(c.id, { ...rep, id: c.id, protocolMappers: c.protocolMappers });
-    return send(res, 204);
-  }
-  if (rest.length === 1 && req.method === "DELETE") {
-    clients.delete(c.id);
-    return send(res, 204);
-  }
-  if (rest[1] === "client-secret" && req.method === "GET") {
-    return send(res, 200, { type: "secret", value: c.secret });
-  }
-  if (rest[1] === "protocol-mappers") {
-    if (req.method === "GET") return send(res, 200, c.protocolMappers ?? []);
-    if (req.method === "POST") {
-      c.protocolMappers = [...(c.protocolMappers ?? []), { ...(await body(req)), id: randomUUID() }];
-      return send(res, 201);
-    }
-    if (req.method === "PUT") {
-      const m = await body(req);
-      c.protocolMappers = c.protocolMappers.map((x: Client) => (x.id === rest[4] ? m : x));
-      return send(res, 204);
-    }
-  }
-  send(res, 405);
-});
-await new Promise<void>((r) => server.listen(0, "127.0.0.1", r));
-after(() => server.close());
-const port = (server.address() as { port: number }).port;
-
-const oidc = new OidcClients(new KeycloakClient(`http://127.0.0.1:${port}`, "admin", "pw"), realm);
-
-/** Grafana on ace, as the mesh hands it to the provisioner. */
-function grafana(secret = "s3cret", values: Record<string, unknown> = {}) {
-  return {
-    as: "mesh_ace_grafana",
-    password: secret,
-    consumer: "ace",
-    values: {
-      label: "grafana", endpoint: "web", port: 20010, callback: "/login/generic_oauth",
-      name: "grafana.zurag.be", "internal-name": "grafana.ace.internal", ...values,
-    },
-  };
-}
-
-function only(clientId: string): Client {
-  const found = [...clients.values()].filter((c) => c.clientId === clientId);
-  assert.equal(found.length, 1, `exactly one client ${clientId}, found ${found.length}`);
-  return found[0];
-}
-
-test("the realm is read out of the issuer, and an issuer that names none is refused", () => {
-  assert.equal(realmOf("https://keycloak.novox.be/realms/Novox"), "Novox");
-  assert.equal(realmOf("https://keycloak.novox.be/realms/Novox/"), "Novox");
-  assert.equal(realmOf("http://127.0.0.1:18500/realms/master"), "master");
-  assert.throws(() => realmOf("https://keycloak.novox.be"), /realms/);
-  assert.throws(() => realmOf("keycloak"), /not a URL/);
-});
-
-test("the redirect is the consumer's callback under every name the mesh composed for it", () => {
-  assert.deepEqual(redirectsOf(grafana().values), {
-    root: "https://grafana.zurag.be",
-    redirects: ["https://grafana.zurag.be/login/generic_oauth", "https://grafana.ace.internal/login/generic_oauth"],
-  });
-  // A route reaching only the private network has only the internal name, and that is enough.
-  assert.deepEqual(redirectsOf({ callback: "/cb", "internal-name": "x.ace.internal" }).redirects,
-    ["https://x.ace.internal/cb"]);
-  assert.throws(() => redirectsOf({ name: "grafana.zurag.be" }), /callback/);
-  assert.throws(() => redirectsOf({ name: "grafana.zurag.be", callback: "login" }), /callback/);
-  assert.throws(() => redirectsOf({ callback: "/cb" }), /label/);
-});
-
-test("a consumer is given one confidential client, under its id and the mesh's secret", async () => {
-  clients.clear();
-  assert.equal(await oidc.ensure(grafana()), "created");
-  const c = only("mesh_ace_grafana");
-  assert.equal(c.publicClient, false);
-  assert.equal(c.clientAuthenticatorType, "client-secret");
-  assert.equal(c.secret, "s3cret");
-  assert.equal(c.enabled, true);
-  assert.equal(c.standardFlowEnabled, true);
-  assert.equal(c.directAccessGrantsEnabled, false);
-  assert.equal(c.implicitFlowEnabled, false);
-  assert.deepEqual(c.redirectUris, [
-    "https://grafana.zurag.be/login/generic_oauth", "https://grafana.ace.internal/login/generic_oauth"]);
-  assert.equal(c.attributes[MARK], "true");
-  assert.deepEqual(c.protocolMappers.map((m: Client) => m.name), [ROLES_MAPPER.name]);
-  assert.equal(await oidc.holds(grafana()), true);
-});
-
-test("applying the same grant again makes no second client", async () => {
-  clients.clear();
-  await oidc.ensure(grafana());
-  assert.equal(await oidc.ensure(grafana()), "updated");
-  assert.equal(await oidc.ensure(grafana()), "updated");
-  only("mesh_ace_grafana");
-  assert.equal(only("mesh_ace_grafana").protocolMappers.length, 1, "the roles mapper is not added twice");
-});
-
-test("a new secret or a moved name is applied in place, and what the mesh does not own survives", async () => {
-  clients.clear();
-  await oidc.ensure(grafana());
-  const id = only("mesh_ace_grafana").id;
-  // Something the mesh does not own, set on the client after it was made.
-  clients.get(id)!.consentRequired = true;
-  clients.get(id)!.attributes["post.logout.redirect.uris"] = "+";
-
-  assert.equal(await oidc.holds(grafana("rotated")), false, "a rotated secret is not held until applied");
-  await oidc.ensure(grafana("rotated", { name: "dash.zurag.be" }));
-  const c = only("mesh_ace_grafana");
-  assert.equal(c.id, id, "updated, not replaced");
-  assert.equal(c.secret, "rotated");
-  assert.deepEqual(c.redirectUris, [
-    "https://dash.zurag.be/login/generic_oauth", "https://grafana.ace.internal/login/generic_oauth"]);
-  assert.equal(c.rootUrl, "https://dash.zurag.be");
-  assert.equal(c.consentRequired, true);
-  assert.equal(c.attributes["post.logout.redirect.uris"], "+");
-  assert.equal(c.attributes[MARK], "true");
-  assert.equal(await oidc.holds(grafana("rotated", { name: "dash.zurag.be" })), true);
-});
-
-test("a client lost or edited behind the mesh's back is not held, and is made whole again", async () => {
-  clients.clear();
-  await oidc.ensure(grafana());
-  const c = only("mesh_ace_grafana");
-  c.redirectUris = ["*"];
-  assert.equal(await oidc.holds(grafana()), false, "a widened redirect is not what the mesh gave");
-  await oidc.ensure(grafana());
-  assert.equal(await oidc.holds(grafana()), true);
-
-  only("mesh_ace_grafana").protocolMappers = [];
-  assert.equal(await oidc.holds(grafana()), false, "a client without its roles mapper is not held");
-  await oidc.ensure(grafana());
-  assert.equal(await oidc.holds(grafana()), true);
-
-  clients.clear();
-  assert.equal(await oidc.holds(grafana()), false);
-});
-
-test("a client of the same id the mesh did not make is refused, and left exactly as it was", async () => {
-  clients.clear();
-  clients.set("theirs", { id: "theirs", clientId: "mesh_ace_grafana", secret: "their-secret", redirectUris: ["*"] });
-  const before = JSON.stringify(clients.get("theirs"));
-  const writes = calls.length;
-  await assert.rejects(oidc.ensure(grafana()), /did not make/);
-  assert.equal(JSON.stringify(clients.get("theirs")), before);
-  assert.ok(calls.slice(writes).every((c) => c.startsWith("GET") || c.startsWith("POST /realms/master")),
-    `only reads were made: ${calls.slice(writes).join(", ")}`);
-  assert.equal(await oidc.holds(grafana()), false);
-  assert.equal(await oidc.remove("mesh_ace_grafana"), "not ours");
-  assert.ok(clients.has("theirs"), "a client the mesh did not make is never deleted");
-});
-
-test("the predecessor's hand-made client is never touched: the mesh's has its own id", async () => {
-  clients.clear();
-  clients.set("hal", { id: "hal", clientId: "grafana", secret: "old", redirectUris: ["https://grafana.zurag.be/*"] });
-  await oidc.ensure(grafana());
-  assert.equal(clients.get("hal")!.secret, "old");
-  only("mesh_ace_grafana");
-  assert.equal(await oidc.remove("grafana"), "not ours");
-  assert.ok(clients.has("hal"));
-});
-
-test("a withdrawn consumer's client is removed, and an absent one is not an error", async () => {
-  clients.clear();
-  await oidc.ensure(grafana());
-  assert.equal(await oidc.remove("mesh_ace_grafana"), "removed");
-  assert.equal([...clients.values()].length, 0);
-  assert.equal(await oidc.remove("mesh_ace_grafana"), "absent");
-});
-
-test("a contribution with no callback makes no client at all", async () => {
-  clients.clear();
-  await assert.rejects(oidc.ensure({ ...grafana(), values: { name: "grafana.zurag.be" } }), /callback/);
-  assert.equal(clients.size, 0);
-});

modules/keycloak/tsconfig.json

@@ -8,5 +8,5 @@
     "skipLibCheck": true,
     "noEmit": true
   },
-  "include": ["client.ts", "oidc.ts", "index.ts", "provisioner/index.ts", "tools/index.ts"]
+  "include": ["client.ts", "index.ts", "tools/index.ts"]
 }

modules/lab/module.json

@@ -1,93 +0,0 @@
-{
-  "module": "lab",
-  "version": "1",
-  "capabilities": [
-    "container-runtime",
-    "virtualisation"
-  ],
-  "resources": [
-    {
-      "id": "state",
-      "type": "directory",
-      "mode": "0700",
-      "place": "."
-    },
-    {
-      "id": "work",
-      "type": "directory",
-      "path": "/var/lib/mesh-lab-runs",
-      "mode": "0700"
-    },
-    {
-      "id": "runtime-env",
-      "type": "file",
-      "path": "${dir:state}/lab.env",
-      "mode": "0600",
-      "content": "MESH_LAB_FORGE=${setting:forge}\n"
-    },
-    {
-      "id": "git",
-      "type": "package",
-      "package": "git"
-    },
-    {
-      "id": "make",
-      "type": "package",
-      "package": "make"
-    },
-    {
-      "id": "python",
-      "type": "package",
-      "package": "python"
-    },
-    {
-      "id": "file",
-      "type": "package",
-      "package": "file"
-    },
-    {
-      "id": "iproute2",
-      "type": "package",
-      "package": "iproute2"
-    },
-    {
-      "id": "sudo",
-      "type": "package",
-      "package": "sudo"
-    },
-    {
-      "id": "npm",
-      "type": "package",
-      "package": "npm"
-    },
-    {
-      "id": "go",
-      "type": "package",
-      "package": "go"
-    },
-    {
-      "id": "incus",
-      "type": "package",
-      "package": "incus"
-    }
-  ],
-  "build": {
-    "artifacts": [
-      {
-        "name": "code",
-        "kind": "bundle",
-        "language": "typescript",
-        "entrypoints": [
-          "tools/index.js"
-        ],
-        "loads": [
-          "tools/index.js"
-        ],
-        "env": {
-          "MESH_LAB_WORK": "${dir:work}",
-          "MESH_LAB_ENV_FILE": "${dir:state}/lab.env"
-        }
-      }
-    ]
-  }
-}

modules/lab/package.json

@@ -1,9 +0,0 @@
-{
-  "name": "@novox/module-lab",
-  "version": "0.1.0",
-  "description": "lab — the lab, as a module: runs beds against the forge's branches when the mesh asks (novox/hq ADR 0172).",
-  "type": "module",
-  "private": true,
-  "dependencies": { "@novox/mesh-sdk": "^0.1.0" },
-  "devDependencies": { "@types/node": "^22.0.0", "typescript": "^5.6.0" }
-}

modules/lab/tools/index.ts

@@ -1,108 +0,0 @@
-// lab's tools — the lab, as the mesh asks for it (novox/hq ADR 0172). They run on the machine the
-// lab is assigned to, and only there: a bed raises virtual machines on that machine's virtualisation.
-
-import { spawnSync } from "node:child_process";
-import { readFileSync } from "node:fs";
-import { registerModuleTools, type ToolDefinition } from "@novox/mesh-sdk/tools";
-import { listRuns, readStatus, REPOSITORIES, running, start, stop, tail } from "./runs.js";
-
-export function getLabTools(env: NodeJS.ProcessEnv): ToolDefinition[] {
-  const work = env.MESH_LAB_WORK ?? "/var/lib/mesh-lab-runs";
-  // The forge is an operator's setting, which reaches a file and never a bundle's words (novox/hq
-  // ADR 0192): read from the env-file the mesh fills, at each call, so a changed setting is used
-  // without restarting the runtime. MESH_LAB_FORGE itself still wins, for a hand-run instance.
-  const forgeOf = (): string => (env.MESH_LAB_FORGE ?? wordIn(env.MESH_LAB_ENV_FILE, "MESH_LAB_FORGE")).replace(/\/+$/, "");
-  return [
-    {
-      name: "lab_check",
-      description: "Whether this machine can run the lab's beds: the lab's own check, against the forge's main branch.",
-      input: {},
-      run: async () => {
-        const forge = forgeOf();
-        if (!forge) return { ok: false, output: "the lab's forge is not set: settings for lab, {\"forge\": \"<url>\"}" };
-        const dir = `${work}/check`;
-        spawnSync("rm", ["-rf", dir]);
-        const clone = spawnSync("git", ["clone", "--quiet", "--depth", "1", `${forge}/novox/mesh-lab.git`, dir], { encoding: "utf8" });
-        if (clone.status !== 0) return { ok: false, output: clone.stderr };
-        spawnSync("npm", ["ci", "--no-audit", "--no-fund", "--loglevel=error"], { cwd: dir, encoding: "utf8" });
-        const check = spawnSync("node", ["--experimental-strip-types", "src/cli.ts", "check"], { cwd: dir, encoding: "utf8" });
-        return { ok: check.status === 0, output: `${check.stdout}${check.stderr}`.trim() };
-      },
-    },
-    {
-      name: "lab_run",
-      description:
-        "Run the lab's beds against branches on the forge: fresh checkouts of every repository the lab builds, " +
-        "side by side, then the suite on the named test files. Answers at once with the run's id; lab_status " +
-        "and lab_log follow it. One run at a time.",
-      input: {
-        tests: { type: "string", description: "the bed test files, comma-separated, relative to mesh-lab (e.g. test/integration/mesh.test.ts)" },
-        refs: {
-          type: "string",
-          description: `a JSON object of repository to branch, for any of ${REPOSITORIES.join(", ")}; the rest run main`,
-        },
-      },
-      run: async (args) => {
-        const forge = forgeOf();
-        if (!forge) return { started: false, reason: "the lab's forge is not set: settings for lab, {\"forge\": \"<url>\"}" };
-        const tests = String(args.tests ?? "").split(",").map((s) => s.trim()).filter(Boolean);
-        if (tests.length === 0) return { started: false, reason: "name at least one bed test file" };
-        let refs: Record<string, string> = {};
-        if (args.refs) {
-          try {
-            refs = JSON.parse(String(args.refs)) as Record<string, string>;
-          } catch {
-            return { started: false, reason: "refs is not a JSON object of repository to branch" };
-          }
-        }
-        const stranger = Object.keys(refs).filter((r) => !REPOSITORIES.includes(r));
-        if (stranger.length > 0) return { started: false, reason: `the lab does not build ${stranger.join(", ")}` };
-        const busy = running(work);
-        if (busy) return { started: false, reason: `${busy.id} is still ${busy.state}; one run at a time`, running: busy };
-        return { started: true, run: start(work, forge, tests, refs) };
-      },
-    },
-    {
-      name: "lab_status",
-      description: "A run's state, the commits it tested and how it ended — or every run, newest first, when no id is given.",
-      input: { id: { type: "string", description: "the run's id (optional)" } },
-      run: async (args) => {
-        if (args.id) return readStatus(work, String(args.id)) ?? { found: false, id: String(args.id) };
-        return { runs: listRuns(work).slice(0, 10) };
-      },
-    },
-    {
-      name: "lab_log",
-      description: "The last lines of a run's log.",
-      input: {
-        id: { type: "string", description: "the run's id" },
-        lines: { type: "number", description: "how many lines from the end (default 200)" },
-      },
-      run: async (args) => ({ id: String(args.id), log: tail(work, String(args.id), Number(args.lines ?? 200)) }),
-    },
-    {
-      name: "lab_stop",
-      description: "Stop a run and everything it started.",
-      input: { id: { type: "string", description: "the run's id" } },
-      run: async (args) => stop(work, String(args.id)) ?? { found: false, id: String(args.id) },
-    },
-  ];
-}
-
-/** One word from an env-file (`KEY=value` lines), or "" when the file or the word is absent. */
-export function wordIn(file: string | undefined, word: string): string {
-  if (!file) return "";
-  let text: string;
-  try {
-    text = readFileSync(file, "utf8");
-  } catch {
-    return "";
-  }
-  for (const line of text.split("\n")) {
-    const at = line.indexOf("=");
-    if (at > 0 && line.slice(0, at).trim() === word) return line.slice(at + 1).trim();
-  }
-  return "";
-}
-
-registerModuleTools("lab", (env) => getLabTools(env));

modules/lab/tools/runs.ts

@@ -1,175 +0,0 @@
-// A lab run: fresh checkouts of the named branches, side by side, then the lab's suite on the named
-// beds (novox/hq ADR 0172).
-//
-// **A run is a detached script with its own process group**, so it outlives the tool call that started
-// it and `stop` ends everything it started. It writes what it is doing to a status file beside its log,
-// and that file is the whole of what the tools read back: a runtime that restarts mid-run still answers
-// for it, and says it was lost rather than pretending it is still going.
-
-import { spawn } from "node:child_process";
-import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from "node:fs";
-import { join } from "node:path";
-
-/** The repositories a lab run checks out, side by side, as the lab expects its siblings. */
-export const REPOSITORIES = ["mesh-lab", "mesh-controller", "mesh-host", "mesh-catalog", "mesh-tools", "mesh-sdk"];
-
-export interface RunStatus {
-  id: string;
-  state: "checking-out" | "building" | "running" | "passed" | "failed" | "stopped" | "lost";
-  started: string;
-  ended?: string;
-  tests: string[];
-  refs: Record<string, string>;
-  commits?: Record<string, string>;
-  exit?: number;
-  pid?: number;
-}
-
-export function runDir(work: string, id: string): string {
-  return join(work, id);
-}
-
-function statusPath(work: string, id: string): string {
-  return join(runDir(work, id), "status.json");
-}
-
-export function readStatus(work: string, id: string): RunStatus | undefined {
-  try {
-    const s = JSON.parse(readFileSync(statusPath(work, id), "utf8")) as RunStatus;
-    // A run whose process is gone while its status still says it is going was lost — the runtime or
-    // the machine restarted under it. Said, rather than left reading as running for ever.
-    if (!["passed", "failed", "stopped", "lost"].includes(s.state) && s.pid && !alive(s.pid)) {
-      s.state = "lost";
-    }
-    return s;
-  } catch {
-    return undefined;
-  }
-}
-
-function alive(pid: number): boolean {
-  try {
-    process.kill(pid, 0);
-    return true;
-  } catch {
-    return false;
-  }
-}
-
-export function listRuns(work: string): RunStatus[] {
-  if (!existsSync(work)) return [];
-  return readdirSync(work)
-    .filter((d) => d.startsWith("run-"))
-    .map((id) => readStatus(work, id))
-    .filter((s): s is RunStatus => !!s)
-    .sort((a, b) => b.started.localeCompare(a.started));
-}
-
-/** The run still going, if any: one at a time, because two would contend for the same machine. */
-export function running(work: string): RunStatus | undefined {
-  return listRuns(work).find((s) => !["passed", "failed", "stopped", "lost"].includes(s.state));
-}
-
-const shellQuote = (s: string) => `'${s.replace(/'/g, `'\\''`)}'`;
-
-/**
- * The script one run executes. Every step writes its state first, so a run that dies says where.
- *
- * The environment is the one the lab's README describes for a run against sibling checkouts, pointed
- * at this run's own tree, so what is built and claimed is exactly what was checked out.
- */
-export function script(work: string, id: string, forge: string, tests: string[], refs: Record<string, string>): string {
-  const dir = runDir(work, id);
-  const setState = (state: string) =>
-    `node -e ${shellQuote(
-      `const f=${JSON.stringify(join(dir, "status.json"))};const s=JSON.parse(require("fs").readFileSync(f,"utf8"));s.state=${JSON.stringify(state)};require("fs").writeFileSync(f,JSON.stringify(s,null,2))`,
-    )}`;
-  const clones = REPOSITORIES.map((repo) => {
-    const ref = refs[repo] ?? "main";
-    return [
-      `git clone --quiet --depth 50 --branch ${shellQuote(ref)} ${shellQuote(`${forge}/novox/${repo}.git`)} ${shellQuote(join(dir, repo))}`,
-      `echo "${repo} $(git -C ${shellQuote(join(dir, repo))} rev-parse HEAD)" >> ${shellQuote(join(dir, "commits.txt"))}`,
-    ].join("\n");
-  }).join("\n");
-  const bin = join(dir, "bin");
-  return `set -euo pipefail
-cd ${shellQuote(dir)}
-${setState("checking-out")}
-${clones}
-node -e ${shellQuote(
-    `const fs=require("fs");const f=${JSON.stringify(join(dir, "status.json"))};const s=JSON.parse(fs.readFileSync(f,"utf8"));s.commits=Object.fromEntries(fs.readFileSync(${JSON.stringify(join(dir, "commits.txt"))},"utf8").trim().split("\\n").map(l=>l.split(" ")));fs.writeFileSync(f,JSON.stringify(s,null,2))`,
-  )}
-${setState("building")}
-# The @novox scope resolves from the mesh's own package registry on the forge, as the build machine
-# resolves it; nothing else is asked of it.
-printf '%s\n' ${shellQuote(`@novox:registry=${forge}/api/packages/novox/npm/`)} > ${shellQuote(join(dir, ".npmrc"))}
-export NPM_CONFIG_USERCONFIG=${shellQuote(join(dir, ".npmrc"))}
-for repo in mesh-sdk mesh-tools mesh-lab; do (cd ${shellQuote(dir)}/$repo && npm ci --no-audit --no-fund --loglevel=error); done
-(cd ${shellQuote(dir)}/mesh-sdk && npm run build --if-present)
-(cd ${shellQuote(dir)}/mesh-tools && npm run build --if-present)
-mkdir -p ${shellQuote(bin)}
-for p in postgres-provisioner objectstore-provisioner route-proxy; do
-  (cd ${shellQuote(dir)}/mesh-controller && CGO_ENABLED=0 go build -o ${shellQuote(bin)}/$p ./examples/$p)
-done
-export MESH_LAB_HOST_BINARY=${shellQuote(join(dir, "mesh-host", "mesh-host"))}
-export MESH_LAB_BUNDLE=${shellQuote(join(dir, "mesh-host", "examples", "foundation-first-node-nats.lock"))}
-export MESH_LAB_MODULES=${shellQuote(join(dir, "mesh-controller", "examples", "modules"))}
-export MESH_LAB_BUILDER=${shellQuote(join(dir, "mesh-controller", "build", "mesh-builder"))}
-export MESH_LAB_BOOTSTRAP_BINARY=${shellQuote(join(dir, "mesh-host", "mesh-bootstrap"))}
-export MESH_LAB_CATALOG=${shellQuote(join(dir, "mesh-catalog", "modules"))}
-export MESH_LAB_PROVISIONER=${shellQuote(join(bin, "postgres-provisioner"))}
-export MESH_LAB_OBJECTSTORE_PROVISIONER=${shellQuote(join(bin, "objectstore-provisioner"))}
-export MESH_LAB_ROUTE_PROXY=${shellQuote(join(bin, "route-proxy"))}
-${setState("running")}
-cd ${shellQuote(join(dir, "mesh-lab"))}
-node --experimental-strip-types src/cli.ts suite ${tests.map(shellQuote).join(" ")}
-`;
-}
-
-/** start begins a run and returns at once with its status. */
-export function start(work: string, forge: string, tests: string[], refs: Record<string, string>): RunStatus {
-  const id = `run-${new Date().toISOString().replace(/[:.]/g, "-")}`;
-  const dir = runDir(work, id);
-  mkdirSync(dir, { recursive: true });
-  const status: RunStatus = { id, state: "checking-out", started: new Date().toISOString(), tests, refs };
-  writeFileSync(statusPath(work, id), JSON.stringify(status, null, 2));
-  writeFileSync(join(dir, "run.sh"), script(work, id, forge, tests, refs), { mode: 0o700 });
-
-  // The wrapper records how the run ended, then removes the checkouts and keeps the log and status: a
-  // run's tree is its own, and the next run starts from fresh ones (novox/hq ADR 0172).
-  const wrapper = `bash ${shellQuote(join(dir, "run.sh"))} > ${shellQuote(join(dir, "run.log"))} 2>&1; code=$?
-node -e ${shellQuote(
-    `const f=${JSON.stringify(statusPath(work, id))};const s=JSON.parse(require("fs").readFileSync(f,"utf8"));if(s.state!=="stopped"){s.state=process.argv[1]==="0"?"passed":"failed"};s.exit=Number(process.argv[1]);s.ended=new Date().toISOString();require("fs").writeFileSync(f,JSON.stringify(s,null,2))`,
-  )} "$code"
-cd ${shellQuote(dir)} && rm -rf ${REPOSITORIES.map(shellQuote).join(" ")} bin`;
-  const child = spawn("bash", ["-c", wrapper], { detached: true, stdio: "ignore" });
-  child.unref();
-  status.pid = child.pid;
-  writeFileSync(statusPath(work, id), JSON.stringify(status, null, 2));
-  return status;
-}
-
-/** stop ends a run and everything it started, by its process group. */
-export function stop(work: string, id: string): RunStatus | undefined {
-  const s = readStatus(work, id);
-  if (!s || !s.pid) return s;
-  if (["passed", "failed", "stopped", "lost"].includes(s.state)) return s;
-  s.state = "stopped";
-  writeFileSync(statusPath(work, id), JSON.stringify(s, null, 2));
-  try {
-    process.kill(-s.pid, "SIGTERM");
-  } catch {
-    // Already gone between the read and the kill.
-  }
-  return s;
-}
-
-/** tail is the last lines of a run's log. */
-export function tail(work: string, id: string, lines: number): string {
-  try {
-    const all = readFileSync(join(runDir(work, id), "run.log"), "utf8").split("\n");
-    return all.slice(-Math.max(1, lines)).join("\n");
-  } catch {
-    return "";
-  }
-}