Take the catalogue's composition rules into the node-engine

ADR 0593 §7: the composer with its refusals leaves mesh-sdk, so mesh-sdk carries no composition rule. The catalogue functions only the node-engine's composition reaches (Resolve, Resolution's Compose, Declaration, DataItems, LeftOut, Rules and the rest, the settings, placeholder and template refusals, the rendering helpers) are copied with their tests into internal/compose/resolution; a method of a mesh-sdk shape becomes a function taking it first. The composition calls its own copies, and the captured catalogue its tests read lives here now, shared by mesh-compose's tests. Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL
2026-11-02 19:15:55 +01:00
parent be0226b624
commit d68e241724
686 changed files with 35703 additions and 80 deletions
@@ -0,0 +1,106 @@
+{
+  "module": "step-ca",
+  "version": "1",
+  "capabilities": [
+    "container-runtime"
+  ],
+  "provides": [
+    {
+      "name": "internal-acme-ca",
+      "scope": "mesh"
+    }
+  ],
+  "serves": {
+    "internal-acme-ca": {
+      "path": "/acme/acme/directory",
+      "roots": "/roots.pem"
+    }
+  },
+  "listens": [
+    {
+      "name": "acme",
+      "port": 9000,
+      "protocol": "tcp",
+      "from": "mesh",
+      "why": "the ACME directory and step-ca API; a proxy on any node reaches it here over the mesh to obtain certificates, and its single listen is what the consumer is told the port is"
+    }
+  ],
+  "own-secrets": {
+    "password": "${dir:mesh-state}/password"
+  },
+  "data": {
+    "own": [
+      {
+        "id": "home",
+        "path": "${dir:home}",
+        "class": "valuable",
+        "why": "the mesh's certificate authority: its keys and its database of what it issued"
+      }
+    ]
+  },
+  "resources": [
+    {
+      "id": "mesh-state",
+      "type": "directory",
+      "mode": "0700",
+      "place": "mesh",
+      "unknown": "program"
+    },
+    {
+      "id": "home",
+      "type": "directory",
+      "mode": "0700",
+      "owner": "1000:1000",
+      "place": ".",
+      "unknown": "program"
+    },
+    {
+      "id": "config",
+      "type": "file",
+      "path": "${dir:mesh-state}/config.json",
+      "mode": "0644",
+      "template": "files/config.json",
+      "takes-config": [],
+      "merge": "json"
+    },
+    {
+      "id": "init-env",
+      "type": "file",
+      "path": "${dir:mesh-state}/init.env",
+      "mode": "0600",
+      "template": "files/init.env"
+    },
+    {
+      "id": "server",
+      "type": "container",
+      "name": "step-ca",
+      "image": "smallstep/step-ca@sha256:a2b17872915c193259b75a5474c398326f41bd199f0842093e52cf4182bc8270",
+      "health": {
+        "kind": "runtime"
+      },
+      "network": "host",
+      "env-file": [
+        "${dir:mesh-state}/init.env"
+      ],
+      "env": {
+        "DOCKER_STEPCA_INIT_NAME": "Mesh Internal CA",
+        "DOCKER_STEPCA_INIT_ACME": "true",
+        "DOCKER_STEPCA_INIT_REMOTE_MANAGEMENT": "false"
+      },
+      "volumes": [
+        "${dir:home}:/home/step",
+        "${dir:mesh-state}:/run/mesh:ro"
+      ],
+      "secrets-in-environment": "the entrypoint honours DOCKER_STEPCA_INIT_PASSWORD_FILE; convertible, awaiting a bed that proves it"
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      }
+    ]
+  }
+}