@nauticana/sail 1.1.21 → 1.1.23

package/README.md

@@ -23,11 +23,12 @@ A shared Angular component library for building CRUD-based admin frontends. Prov
 | **Dashboard** | `DashboardShellComponent`, `DataCardComponent`, `LockedOverlayComponent`, `ActionCenterComponent`, `EntitySelectorComponent`, `VerificationFlowComponent` |
 | **Payout** | `PayoutProviderOnboardingComponent`, `PayoutBankInfoFormComponent` |
 | **Agency** | `AgencyClientsComponent`, `AgencyStatusBannerComponent`, `AgencyAcceptComponent`, `AgencyEarningsSummaryComponent`, `CommissionLedgerComponent`, `AgencyPayoutHistoryComponent`, `AgencyPayoutProfileComponent` |
+| **Notifications** | `NotificationCenterComponent`, `NotificationInboxService` |
 | **Payments / SCA** | `UserPaymentMethodsComponent`, `ScaConfirmComponent`, `ScaConfirmer` (port), `SCA_CONFIRMER` (token) |
-| **Services** | `BaseAuthService` (OTP / social / push / deleteAccount / logoutEverywhere / profile: `getProfile`, `updateProfile`, `request`+`confirmEmailChange`, `request`+`confirmPhoneChange`), `BillingService`, `AgencyService`, `BackendService`, `PayoutService`, `UserPaymentMethodService`, `loadScript()`, `authInterceptor`, `apiResponseInterceptor` |
+| **Services** | `BaseAuthService` (OTP / social / push / deleteAccount / logoutEverywhere / profile: `getProfile`, `updateProfile`, `request`+`confirmEmailChange`, `request`+`confirmPhoneChange`), `BillingService`, `AgencyService`, `BackendService`, `PayoutService`, `UserPaymentMethodService`, `NotificationInboxService`, `loadScript()`, `authInterceptor`, `apiResponseInterceptor` |
 | **Abstracts** | `BaseTable`, `BaseForm`, `BaseView`, `AbstractEditableView`, `BaseAsync`, `BaseRestService` |
 | **Config** | `SAIL_GUI_CONFIG`, `SailGuiConfig`, `configureRestUrls()` |
-| **Models** | `ApplicationData`, `TableDefinition`, `SiudAction`, `ApplicationMenu`, `ConstantValue`, `UserAccount`, `RestReport`, `ReportParam`, `TrustedDevice`, `PublicPlan`, `PlanPrice`, `PaymentMethod`, `Subscription`, `Invoice`, `CheckoutRequest`/`CheckoutResponse`, `PortalResponse`, `UsageMeter`, `ChargeResult`, `UserPaymentMethod`, `TableAction`, `ReusableAccount`, `PayoutOnboardingSession`, `BankInfoFormValue`, `CountryProfile`, `OtpRequest`/`OtpResponse`, `SignupConsent`, `ConsentState`, `ConsentOption`, `SocialProvider`, `PushPlatform`, 2FA types, etc. |
+| **Models** | `ApplicationData`, `TableDefinition`, `SiudAction`, `ApplicationMenu`, `ConstantValue`, `UserAccount`, `RestReport`, `ReportParam`, `TrustedDevice`, `PublicPlan`, `PlanPrice`, `PaymentMethod`, `Subscription`, `Invoice`, `CheckoutRequest`/`CheckoutResponse`, `PortalResponse`, `UsageMeter`, `ChargeResult`, `UserPaymentMethod`, `TableAction`, `ReusableAccount`, `PayoutOnboardingSession`, `BankInfoFormValue`, `CountryProfile`, `OtpRequest`/`OtpResponse`, `SignupConsent`, `ConsentState`, `ConsentOption`, `SocialProvider`, `PushPlatform`, `InboxMessage`/`InboxPage`, 2FA types, etc. |
 | **Decorators** | `@IsSailString()`, `@IsSailNumeric()` (class-validator based) |
 | **Utils** | `titleCase()`, `fromPriceLabel()`, `formatMinorCurrency()` |
 
@@ -342,6 +343,9 @@ Omit the URL to skip client-side policy checks. The server stays the authoritati
 | `POST /api/user/trusted-device/revoke` | Revoke a trusted device |
 | `POST /api/user/logout-everywhere` | Sign out of all devices — **requires re-auth** |
 | `DELETE /api/user/account` | Soft-delete the caller's account — **requires re-auth** |
+| `GET /api/notifications` | Notification inbox page — `?before=<id>&limit=<n>`, newest first (keel v1.2.71) |
+| `POST /api/notifications/mark_read` | Mark one message read — `{"id": "<id>"}` |
+| `POST /api/notifications/mark_all_read` | Mark the caller's whole inbox read |
 | `POST /api/push/register` | Register an FCM / APNs token |
 | `POST /api/push/revoke` | Revoke an FCM / APNs token |
 | `POST /api/billing/checkout` | Create provider-hosted checkout session — **JWT-gated, allowlist-validated** |
@@ -649,8 +653,56 @@ import { AgentStudioService, PromptLanguageEditorComponent, TurnStream } from '@
 | `TurnStream` | Per-turn stream state: `accept(frame)` accepts Scout's zero-based frames and drops frames already rendered, `cursor()` is the next sequence wanted for inclusive replay, a suspension frame (`approval_pending`, even when marked final) sets `awaiting_approval` without advancing the cursor so the resumed frame at the same sequence is accepted, `markReplayExpired()` + `acceptStoredResult(frame)` handle an expired replay window, `markCancelRequested()` holds `cancelling` until the final frame. |
 | `sail-turn-stream-view` | `TurnStream` + event list + status + cancel button (`cancelRequested`). |
 | `sail-decision-timeline` | Read-only decision chain of one request, grouped by category. |
+| `ConversationService` | Transport for Scout's conversation bridge: `submit`, `stream(requestId, turnStream)`, `cancel`. Mount point injected through `CONVERSATION_BASE_PATH`. |
+| `SseParser` | Incremental `text/event-stream` parser: `push(chunk)` returns whole events out of chunks that split anywhere, including between the CR and LF of a CRLF; `finish()` flushes what the closing body left pending. |
 
-Transport is app-owned: map your reply frames onto `TurnReplyFrame` and your audit rows onto `DecisionRecord`, then feed them in. Style the `.prompt-*`, `.release-*`, `.turn-*`, and `.decision-*` class hooks.
+Map your audit rows onto `DecisionRecord` to feed the timeline. Style the `.prompt-*`, `.release-*`, `.turn-*`, and `.decision-*` class hooks.
+
+### Conversation transport (v1.1.22)
+
+Scout `v0.7.1` fixed the wire contract, so the transport is no longer app-specific.
+`ConversationService` speaks it and feeds a `TurnStream`; the app supplies the mount
+point, the turn `input` payload, and its own renderers.
+
+```ts
+providers: [{ provide: CONVERSATION_BASE_PATH, useValue: '/api/wingmate/' }]
+```
+
+```ts
+const stream = new TurnStream(requestId);
+this.conversation.submit({ request_id: requestId, conversation_id: conversationId, agent_id: 'wingmate', input })
+  .pipe(switchMap(() => this.conversation.stream(requestId, stream)), takeUntilDestroyed())
+  .subscribe({ error: (err) => this.onStreamError(err) });
+```
+
+| Method | Wire |
+|---|---|
+| `submit(request)` | `POST {base}turn` → `202 {request_id}`. Goes through `HttpClient`, so the interceptors apply. |
+| `stream(requestId, turnStream)` | `GET {base}turn/stream?request_id=&cursor=` as SSE. Reads from `turnStream.cursor()`, feeds every `event: turn` frame in, and emits the ones the stream accepted. Completes when the server closes the delivery; unsubscribing aborts the request. |
+| `cancel(requestId, reason?)` | `POST {base}turn/cancel` → `202`. Cancel is a request — call `turnStream.markCancelRequested()` and wait for the final frame. |
+
+Notes that decide whether an adoption is correct:
+
+- **The stream carries its own bearer.** `EventSource` cannot send an `Authorization`
+  header, so this is a `fetch` body reader. It reads the same `jwt` key the interceptor
+  reads and, on a `401`, rotates once through `BaseAuthService.refreshSession()` — the
+  shared, de-duplicated rotation — then retries. The interceptor's auth-loop circuit
+  breaker does **not** cover the stream.
+- **Reconnect is the same call.** `stream()` re-read from `stream.cursor()` resumes
+  exactly where the last accepted frame left off. A suspension frame
+  (`approval_pending`) does not advance the cursor, so reconnecting after the approval is
+  decided picks up the resumed frame at the same sequence.
+- **`410` is an expired replay window under a still-running turn.** No stored result
+  exists yet, which is why it is an error and not a frame. The service calls
+  `markReplayExpired()` and errors with a `ConversationStreamFailure` carrying status
+  `410`; calling `stream()` again later self-heals, because once the turn is terminal the
+  backend answers the same expired cursor with the stored final frame — delivered as an
+  ordinary `event: turn`, carrying the cursor it was asked with, so `accept()` takes it.
+- **`event: error`** carries `ConversationStreamError` (`status`, `detail`, `request_id`) —
+  a failure raised after the stream's `200` was committed. It surfaces as the same
+  `ConversationStreamFailure`.
+- Unknown `TurnEvent` kinds are dropped at the transport, and a frame missing
+  `request_id`, `sequence` or `events` is ignored rather than fed in.
 
 ## Agency / reseller UI (v1.1.14)
 
@@ -901,12 +953,12 @@ For backward compatibility, the older OAuth-code flow `BaseAuthService.loginWith
 Horizontal building blocks for an entitlement-aware dashboard. All are presentational (signals in, events out) and ship no CSS — the app styles the documented class hooks and supplies the metric data, chart, and action logic.
 
 - **`DashboardShellComponent`** (`sail-dashboard-shell`) — responsive card-grid layout. `[heading]` + a `[dashboardActions]` projection slot for the header; project cards into the default slot. Styles: `.dashboard-shell` / `.dashboard-header` / `.dashboard-grid`.
-- **`DataCardComponent`** (`sail-data-card`) — card chrome for one visualization with `[state]` ∈ `loading | ready | empty | error | locked | no-source`. The chart is supplied as an `<ng-template>` and instantiated **only** in `ready`, so during loading/error/locked/no-source it never exists (no hidden canvas). `description` (required) is the screen-reader text alternative; `[tableHeaders]`/`[tableRows]` render a visually-hidden (`.sr-only`) data table. Emits `upgrade`, `connect`, and `retry`.
+- **`DataCardComponent`** (`sail-data-card`) — card chrome for one visualization with `[state]` ∈ `loading | ready | empty | error | locked | no-source`. The chart is supplied as an `<ng-template>` and instantiated **only** in `ready`, so during loading/error/locked/no-source it never exists (no hidden canvas). `description` (required) is the screen-reader text alternative; `[tableHeaders]`/`[tableRows]` render a visually-hidden (`.sr-only`) data table. Emits `upgrade`, `connect`, and `retry`. `[connectLabel]="''"` renders the `no-source` state without a button — a source whose collector does not exist yet has nothing to connect.
 - **`LockedOverlayComponent`** (`sail-locked-overlay`) — entitlement gate. Wraps protected content given as an `<ng-template>`; when `[locked]` the template is never instantiated, so **no data exists behind the gate** (DOM, canvas, or network) — the strict free-tier rule. Emits `upgrade`.
-- **`NoSourceOverlayComponent`** (`sail-no-source-overlay`) — source-readiness gate. Takes `[sourceName]` and emits `connect`; while `[unavailable]`, its protected `<ng-template>` is never instantiated. Use this for included features whose provider is not connected or whose collector is unavailable—never show an upgrade prompt for this state.
+- **`NoSourceOverlayComponent`** (`sail-no-source-overlay`) — source-readiness gate. Takes `[sourceName]` and emits `connect`; while `[unavailable]`, its protected `<ng-template>` is never instantiated. Use this for included features whose provider is not connected or whose collector is unavailable—never show an upgrade prompt for this state. Set `[ctaLabel]="''"` when there is nothing to connect, and no button renders.
 - **`ActionCenterComponent`** (`sail-action-center`) — prioritized next-best-action list from `[actions]: ActionItem[]` (sorted by `priority`, done items show a check). Emits `act`.
 - **`EntitySelectorComponent`** (`sail-entity-selector`) — scope dropdown over `[entities]: EntityOption[]`; resolves `[selected]` or the first active entity and emits `selectionChange`.
-- **`VerificationFlowComponent`** (`sail-verification-flow`) — self-service request → enter-code → verified UI (a 2FA sibling), backend-agnostic: emits `requestVerification` / `confirmCode`, driven by `[step]` + `[errorMessage]` the host feeds back.
+- **`VerificationFlowComponent`** (`sail-verification-flow`) — self-service request → enter-code → verified UI (a 2FA sibling), backend-agnostic: emits `requestVerification` / `confirmCode`, driven by `[step]` + `[errorMessage]` the host feeds back. `[resendAfterSeconds]` holds `Resend code` for a cooldown and `[codeExpiresInSeconds]` blocks `Confirm` once the issued code expires; both default to `0`, which keeps the button always enabled and shows no expiry. Both countdowns restart when the component emits `requestVerification`. `[disabled]` blocks all actions while the host is processing one. `[errorMessage]` also renders in the `idle` step, so a failed send is reported where it happened.
 
 ```html
 <sail-data-card heading="Trends" [state]="state()" description="Weekly visibility trend" (upgrade)="goUpgrade()">
@@ -927,6 +979,106 @@ unless the backend sends
 `source.status` is `null` and a missing source is indistinguishable from an
 empty result.
 
+## Domain verification (v1.1.22)
+
+`DomainVerificationComponent` (`sail-domain-verification`) is the send-code → confirm
+flow for proving ownership of a domain: the domain field, the two steps, the resend
+cooldown, the expiry state and the errors. Every app that verifies a domain renders
+the same thing, so only the endpoints stay downstream.
+
+The endpoints reach it through the `DOMAIN_VERIFIER` port — sail ships no
+implementation and knows none of the paths:
+
+```ts
+export interface DomainVerifier {
+  requestVerification(domain: string): Observable<unknown>;
+  confirm(domain: string, code: string): Observable<unknown>;
+}
+```
+
+```ts
+// app config — any service with those two methods satisfies the port
+providers: [{ provide: DOMAIN_VERIFIER, useExisting: RegistrationService }]
+```
+
+```html
+<sail-domain-verification
+  [domain]="domainUrl()"
+  [resendAfterSeconds]="60"
+  [codeExpiresInSeconds]="900"
+  (domainChange)="form.controls.domainUrl.setValue($event)"
+  (verified)="domainVerified.set(true)" />
+```
+
+| Input / output | Meaning |
+|---|---|
+| `[domain]` | Initial value; the component keeps its own editable copy. |
+| `[label]` | Field label, default `Domain`. |
+| `[resendAfterSeconds]` | Resend cooldown, default `60`. |
+| `[codeExpiresInSeconds]` | Code lifetime; `0` (default) shows no expiry. Pass the backend's TTL when it publishes one. |
+| `(domainChange)` | Every edit, so the host form stays in sync. |
+| `(verified)` | Fires once with the proven domain. |
+
+Editing the domain returns the flow to `idle`: a code is bound to the domain it was
+issued for. The component is unstyled — style `.domain-verification`,
+`.domain-verification-field`, `.domain-verification-verified` and the
+`.verification-*` hooks of the step UI it composes.
+
+## Notification inbox (v1.1.23)
+
+`NotificationInboxService` is the stateful client for keel's `InboxHandler` (keel
+**v1.2.71+**). `NotificationCenterComponent` (`sail-notification-center`) renders it;
+the app handles what each message means through `(selected)`.
+
+The default routes match keel. Override the three `notifications*URL` values through
+`configureRestUrls` only when the handler is mounted elsewhere.
+
+```ts
+const inbox = inject(NotificationInboxService);
+inbox.load().subscribe();          // newest page, replaces the cache
+inbox.loadMore().subscribe();      // the page older than the last cached message
+inbox.markRead(id).subscribe();
+inbox.markAllRead().subscribe();
+inbox.reset();                     // on logout — the cache is per-session
+```
+
+```ts
+readonly unread = inject(NotificationInboxService).unreadCount;   // Signal<number>
+```
+
+| Member | Meaning |
+|---|---|
+| `messages` | `Signal<InboxMessage[]>`, newest first. |
+| `unreadCount` | `Signal<number>` across the whole inbox, not just the loaded page. |
+| `hasMore` | `Signal<boolean>` — the last page came back full, so older messages may exist. |
+| `load(limit)` / `loadMore(limit)` | Default 20; keel caps a page at 100 and the client clamps to match. |
+
+Message ids are server-side `BIGINT`s serialized as strings. Both mark-read routes
+return `204`, so the service updates its cache locally. Call `load()` to pick up new
+messages and `reset()` on logout.
+
+```html
+<sail-notification-center
+  heading="Notifications"
+  [pageSize]="20"
+  (selected)="open($event)" />
+```
+
+| Input / output | Meaning |
+|---|---|
+| `[pageSize]` | Messages per request, default 20. |
+| `[heading]` | Rendered as an `<h2>` with the unread count; empty (default) when the page has its own heading. |
+| `[emptyMessage]`, `[markAllLabel]`, `[markReadLabel]`, `[loadMoreLabel]` | Configurable labels. |
+| `[dateFormat]` | Angular `DatePipe` format for each timestamp, default `short`. |
+| `[selectable]` | `false` renders messages as static text, default `true`. |
+| `[markReadOnSelect]` | Selecting an unread message also marks it read, default `true`. |
+| `(selected)` | The chosen `InboxMessage` — route on its `type` / `data` yourself. |
+
+Ships no CSS — style
+`.notification-center`, `.notification-center__{head,title,unread,error,loading,empty,list,more}`,
+`.notification-item`, `.notification-item--unread` and
+`.notification-item__{select,static,title,body,time,read}`.
+
 ## Grouped review actions and diffs (v1.1.19)
 
 `GroupedBulkActionComponent` (`sail-grouped-bulk-action`) groups eligible rows

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nauticana/sail",
-  "version": "1.1.21",
+  "version": "1.1.23",
   "description": "Metadata-driven Angular component library for CRUD admin frontends backed by the keel Go backend. Tables, forms, navigation, OTP/2FA/social auth, billing, payout onboarding.",
   "main": "src/index.ts",
   "exports": {

package/src/agent/component/turn_stream_view.ts

@@ -7,9 +7,9 @@ import { TurnStream } from '../service/turn_stream';
 import { TurnEventListComponent } from './turn_event_list';
 
 /**
- * One turn's stream: its events, its status, and a cancel request. The app owns the transport
- * and the cancel call; on `cancelRequested` it sends the request and calls
- * `stream.markCancelRequested()`. Selector: <sail-turn-stream-view>.
+ * One turn's stream: its events, its status, and a cancel request. The host owns the cancel
+ * call; on `cancelRequested` it sends it — through `ConversationService.cancel` or its own
+ * transport — and calls `stream.markCancelRequested()`. Selector: <sail-turn-stream-view>.
  */
 @Component({
   selector: 'sail-turn-stream-view',

package/src/agent/index.ts

@@ -2,10 +2,13 @@ export * from './model/agent_studio';
 export * from './model/turn_event';
 export * from './model/reply_frame';
 export * from './model/decision';
+export * from './model/conversation';
 export * from './service/agent_studio.service';
 export * from './service/turn_stream';
+export * from './service/conversation.service';
 export * from './util/studio_errors';
 export * from './util/turn_timeline';
+export * from './util/sse';
 export * from './component/prompt_section_editor';
 export * from './component/prompt_language_editor';
 export * from './component/release_sections';

package/src/agent/model/conversation.ts

@@ -0,0 +1,35 @@
+import { InjectionToken } from '@angular/core';
+
+/** One asynchronous turn, as Scout's conversation bridge takes it. */
+export interface ConversationTurnRequest {
+  request_id: string;
+  conversation_id: string;
+  agent_id: string;
+  /** Opaque product payload; the backend forwards it to the agent unread. */
+  input: unknown;
+}
+
+export interface ConversationTurnAccepted {
+  request_id: string;
+}
+
+/** Data of an SSE `error` event: a failure raised after the stream's 200 was committed. */
+export interface ConversationStreamError {
+  status: number;
+  detail: string;
+  request_id?: string;
+}
+
+/** Error thrown into `ConversationService.stream()`; status 410 is an expired replay window. */
+export class ConversationStreamFailure extends Error {
+  constructor(readonly status: number, readonly detail: string, readonly requestId?: string) {
+    super(detail);
+    this.name = 'ConversationStreamFailure';
+  }
+}
+
+/** Where the app mounts Scout's ConversationHandler, e.g. '/api/wingmate/'. */
+export const CONVERSATION_BASE_PATH = new InjectionToken<string>('SailConversationBasePath', {
+  providedIn: 'root',
+  factory: () => '/api/conversation/',
+});

package/src/agent/model/reply_frame.ts

@@ -3,8 +3,8 @@ import { TurnEvent } from './turn_event';
 export const TURN_ERROR_CANCELED = 'canceled';
 
 /**
- * One reply frame as sail consumes it. The backend's reply type fixes no JSON names, so the
- * app's transport adapter maps its own wire shape onto this one.
+ * One reply frame as sail consumes it. `ConversationService` validates Scout's standard wire
+ * shape; app-specific transports can map their own reply shape onto this one.
  */
 export interface TurnReplyFrame {
   request_id: string;

package/src/agent/service/conversation.service.ts

@@ -0,0 +1,180 @@
+import { Injectable, inject } from '@angular/core';
+import { Observable, Subscriber, firstValueFrom } from 'rxjs';
+import { BaseAuthService } from '../../service/auth.service';
+import { BaseRestService } from '../../service/base_rest.service';
+import {
+  CONVERSATION_BASE_PATH,
+  ConversationStreamError,
+  ConversationStreamFailure,
+  ConversationTurnAccepted,
+  ConversationTurnRequest,
+} from '../model/conversation';
+import { TurnReplyFrame } from '../model/reply_frame';
+import { isKnownTurnEvent } from '../model/turn_event';
+import { SseParser, ServerSentEvent } from '../util/sse';
+import { TurnStream } from './turn_stream';
+
+const REPLAY_EXPIRED = 410;
+
+/**
+ * Transport for Scout's conversation bridge: `POST {base}turn`,
+ * `GET {base}turn/stream` as SSE, `POST {base}turn/cancel`. Submit and cancel go through
+ * `HttpClient` (and so through sail's interceptors); the stream cannot, because
+ * `EventSource` sends no `Authorization` header — it is a `fetch` body reader that carries
+ * the bearer itself and rotates it through `BaseAuthService.refreshSession()` once on a 401.
+ *
+ * The interceptor's auth-loop circuit breaker does not cover the stream.
+ */
+@Injectable({ providedIn: 'root' })
+export class ConversationService extends BaseRestService {
+  private readonly auth = inject(BaseAuthService, { optional: true });
+  private readonly basePath = normalizeBasePath(inject(CONVERSATION_BASE_PATH));
+
+  submit(request: ConversationTurnRequest): Observable<ConversationTurnAccepted> {
+    return this.http.post<ConversationTurnAccepted>(this.conversationUrl('turn'), request);
+  }
+
+  /** Cancel is a request: the turn stays open until its final frame arrives. */
+  cancel(requestId: string, reason?: string): Observable<ConversationTurnAccepted> {
+    return this.http.post<ConversationTurnAccepted>(this.conversationUrl('turn/cancel'), {
+      request_id: requestId,
+      reason,
+    });
+  }
+
+  /**
+   * Read the reply stream from `stream.cursor()` into `stream`, emitting every accepted frame
+   * and completing when the server closes the delivery. Unsubscribing aborts the request; a
+   * reconnect — after a drop or a resolved approval — calls this again unchanged.
+   */
+  stream(requestId: string, stream: TurnStream): Observable<TurnReplyFrame> {
+    return new Observable<TurnReplyFrame>((subscriber) => {
+      const controller = new AbortController();
+      this.read(requestId, stream, controller.signal, subscriber).then(
+        () => subscriber.complete(),
+        (err: unknown) => { if (!controller.signal.aborted) subscriber.error(err); },
+      );
+      return () => controller.abort();
+    });
+  }
+
+  private async read(
+    requestId: string,
+    stream: TurnStream,
+    signal: AbortSignal,
+    subscriber: Subscriber<TurnReplyFrame>,
+  ): Promise<void> {
+    let response = await this.open(requestId, stream.cursor(), signal, localStorage.getItem('jwt'));
+    if (response.status === 401 && this.auth) {
+      const token = await firstValueFrom(this.auth.refreshSession());
+      response = await this.open(requestId, stream.cursor(), signal, token);
+    }
+    if (response.status === REPLAY_EXPIRED) {
+      // The window is gone and the turn has not finished, so no stored result exists yet;
+      // streaming again once it is terminal delivers that result instead.
+      stream.markReplayExpired();
+      throw new ConversationStreamFailure(REPLAY_EXPIRED, await failureDetail(response), requestId);
+    }
+    if (!response.ok || !response.body) {
+      throw new ConversationStreamFailure(response.status, await failureDetail(response), requestId);
+    }
+    // A 200 that is not the event stream (a proxy's error page, a login redirect) would
+    // otherwise parse to nothing and complete the turn silently.
+    if (!response.headers.get('Content-Type')?.includes('text/event-stream')) {
+      throw new ConversationStreamFailure(response.status, 'conversation stream did not return text/event-stream', requestId);
+    }
+
+    const reader = response.body.getReader();
+    const decoder = new TextDecoder();
+    const parser = new SseParser();
+    for (;;) {
+      const { done, value } = await reader.read();
+      if (done) {
+        for (const event of parser.push(decoder.decode())) {
+          this.dispatch(event, requestId, stream, subscriber);
+        }
+        for (const event of parser.finish()) {
+          this.dispatch(event, requestId, stream, subscriber);
+        }
+        return;
+      }
+      for (const event of parser.push(decoder.decode(value, { stream: true }))) {
+        this.dispatch(event, requestId, stream, subscriber);
+      }
+    }
+  }
+
+  private dispatch(
+    event: ServerSentEvent,
+    requestId: string,
+    stream: TurnStream,
+    subscriber: Subscriber<TurnReplyFrame>,
+  ): void {
+    if (event.event === 'error') {
+      const failure = parseJson<ConversationStreamError>(event.data);
+      const status = failure?.status ?? 0;
+      if (status === REPLAY_EXPIRED) stream.markReplayExpired();
+      throw new ConversationStreamFailure(
+        status,
+        failure?.detail ?? 'conversation stream failed',
+        failure?.request_id ?? requestId,
+      );
+    }
+    if (event.event !== 'turn') return;
+    const frame = toFrame(parseJson(event.data));
+    // A stored result answering an expired cursor arrives on this channel too, carrying the
+    // sequence it was asked with, so accept() takes it like any other frame.
+    if (frame && stream.accept(frame)) subscriber.next(frame);
+  }
+
+  private open(requestId: string, cursor: number, signal: AbortSignal, token: string | null): Promise<Response> {
+    const query = new URLSearchParams({ request_id: requestId, cursor: String(cursor) });
+    return fetch(`${this.conversationUrl('turn/stream')}?${query}`, {
+      signal,
+      headers: {
+        Accept: 'text/event-stream',
+        ...(token ? { Authorization: `Bearer ${token}` } : {}),
+      },
+    });
+  }
+
+  private conversationUrl(path: string): string {
+    return this.url(this.basePath + path);
+  }
+}
+
+function normalizeBasePath(base: string): string {
+  return '/' + base.trim().replace(/^\/+|\/+$/g, '') + '/';
+}
+
+function parseJson<T>(raw: string): T | undefined {
+  try {
+    return JSON.parse(raw) as T;
+  } catch {
+    return undefined;
+  }
+}
+
+/** Unknown event kinds are dropped here so `TurnStream.events()` stays typed as it reads. */
+function toFrame(value: unknown): TurnReplyFrame | undefined {
+  if (!value || typeof value !== 'object') return undefined;
+  const frame = value as Partial<TurnReplyFrame>;
+  if (typeof frame.request_id !== 'string' || typeof frame.sequence !== 'number' || !Array.isArray(frame.events)) {
+    return undefined;
+  }
+  return {
+    ...frame,
+    request_id: frame.request_id,
+    conversation_id: typeof frame.conversation_id === 'string' ? frame.conversation_id : '',
+    sequence: frame.sequence,
+    events: frame.events.filter(isKnownTurnEvent),
+    final: frame.final === true,
+  };
+}
+
+async function failureDetail(response: Response): Promise<string> {
+  const body = await response.text().catch(() => '');
+  const problem = parseJson<{ detail?: string; title?: string; error?: string }>(body);
+  const detail = problem?.detail ?? problem?.title ?? problem?.error ?? body;
+  return detail || `HTTP ${response.status}`;
+}

package/src/agent/service/turn_stream.ts

@@ -5,9 +5,9 @@ import { TurnEvent } from '../model/turn_event';
 const terminalStatuses: ReadonlySet<TurnStreamStatus> = new Set(['completed', 'canceled', 'failed']);
 
 /**
- * Client-side state of one turn's reply stream. Transport stays the app's: it feeds frames to
- * `accept`, reconnects from `cursor()`, and reports an expired replay window. One instance per
- * turn; not injectable.
+ * Client-side state of one turn's reply stream. `ConversationService` or an app-specific
+ * transport feeds frames to `accept`, reconnects from `cursor()`, and reports an expired replay
+ * window. One instance per turn; not injectable.
  */
 export class TurnStream {
   private readonly frames = signal<TurnReplyFrame[]>([]);

package/src/agent/util/sse.ts

@@ -0,0 +1,63 @@
+export interface ServerSentEvent {
+  event: string;
+  data: string;
+}
+
+/**
+ * Incremental `text/event-stream` parser. A fetch body reader hands it decoded chunks —
+ * which split anywhere — and it returns only whole events.
+ */
+export class SseParser {
+  private buffer = '';
+  private pendingCarriageReturn = false;
+
+  push(chunk: string): ServerSentEvent[] {
+    // An empty chunk must not resolve a pending CR: the LF completing it may still be coming.
+    if (!chunk) return [];
+    if (this.pendingCarriageReturn) {
+      this.buffer += '\n';
+      this.pendingCarriageReturn = false;
+      if (chunk.startsWith('\n')) chunk = chunk.slice(1);
+    }
+    if (chunk.endsWith('\r')) {
+      this.pendingCarriageReturn = true;
+      chunk = chunk.slice(0, -1);
+    }
+    this.buffer += chunk.replace(/\r\n?/g, '\n');
+    return this.drain();
+  }
+
+  /** Resolve a final standalone carriage return when the response body closes. */
+  finish(): ServerSentEvent[] {
+    if (this.pendingCarriageReturn) {
+      this.buffer += '\n';
+      this.pendingCarriageReturn = false;
+    }
+    return this.drain();
+  }
+
+  private drain(): ServerSentEvent[] {
+    const events: ServerSentEvent[] = [];
+    for (let end = this.buffer.indexOf('\n\n'); end !== -1; end = this.buffer.indexOf('\n\n')) {
+      const event = parseBlock(this.buffer.slice(0, end));
+      this.buffer = this.buffer.slice(end + 2);
+      if (event) events.push(event);
+    }
+    return events;
+  }
+}
+
+function parseBlock(block: string): ServerSentEvent | undefined {
+  let event = 'message';
+  const data: string[] = [];
+  for (const line of block.split(/\r\n|\r|\n/)) {
+    if (!line || line.startsWith(':')) continue;
+    const colon = line.indexOf(':');
+    const field = colon === -1 ? line : line.slice(0, colon);
+    const raw = colon === -1 ? '' : line.slice(colon + 1);
+    const value = raw.startsWith(' ') ? raw.slice(1) : raw;
+    if (field === 'event') event = value;
+    else if (field === 'data') data.push(value);
+  }
+  return data.length ? { event, data: data.join('\n') } : undefined;
+}

package/src/component/dashboard/data_card.html

@@ -37,7 +37,9 @@
       <div class="data-card-no-source" role="group" [attr.aria-label]="(heading() || 'Insight') + ' — source unavailable'">
         <p class="no-source-name">{{ sourceName() }}</p>
         <p class="no-source-message">{{ noSourceMessage() }}</p>
-        <button matButton="elevated" type="button" class="primary" (click)="connect.emit()">{{ connectLabel() }}</button>
+        @if (connectLabel()) {
+          <button matButton="elevated" type="button" class="primary" (click)="connect.emit()">{{ connectLabel() }}</button>
+        }
       </div>
     }
   }

package/src/component/dashboard/no_source_overlay.html

@@ -2,7 +2,9 @@
   <div class="no-source-overlay" role="group" [attr.aria-label]="sourceName() + ' — source unavailable'">
     <p class="no-source-name">{{ sourceName() }}</p>
     <p class="no-source-message">{{ message() }}</p>
-    <button matButton="elevated" type="button" class="primary" (click)="connect.emit()">{{ ctaLabel() }}</button>
+    @if (ctaLabel()) {
+      <button matButton="elevated" type="button" class="primary" (click)="connect.emit()">{{ ctaLabel() }}</button>
+    }
   </div>
 } @else if (content(); as tpl) {
   <ng-container [ngTemplateOutlet]="tpl"></ng-container>

package/src/component/dashboard/verification_flow.html

@@ -7,7 +7,9 @@
       <p class="verification-intro">
         Verify ownership@if (target()) { of {{ target() }} } to unlock trusted features.
       </p>
-      <button matButton="elevated" type="button" class="primary" (click)="requestVerification.emit()">
+      @if (errorMessage()) { <p class="verification-error" role="alert">{{ errorMessage() }}</p> }
+      <button matButton="elevated" type="button" class="primary"
+              [disabled]="disabled()" (click)="request()">
         Start verification
       </button>
     }
@@ -17,15 +19,26 @@
         <mat-label>Verification code</mat-label>
         <input matInput #codeInput name="code" autocomplete="one-time-code"
                [value]="code()" (input)="code.set(codeInput.value)"
-               [disabled]="step() === 'verifying'">
+               [disabled]="disabled() || step() === 'verifying'">
       </mat-form-field>
       @if (errorMessage()) { <p class="verification-error" role="alert">{{ errorMessage() }}</p> }
+      @if (expired()) {
+        <p class="verification-expiry verification-expiry--expired" role="status">
+          That code expired. Request a new one.
+        </p>
+      } @else if (expiresIn() > 0) {
+        <p class="verification-expiry" aria-live="polite">Code expires in {{ expiresIn() }}s.</p>
+      }
       <div class="verification-actions">
         <button matButton="elevated" type="button" class="primary"
-                [disabled]="step() === 'verifying' || !code().trim()" (click)="submit()">
+                [disabled]="disabled() || step() === 'verifying' || !code().trim() || expired()" (click)="submit()">
           @if (step() === 'verifying') { Verifying… } @else { Confirm }
         </button>
-        <button matButton type="button" (click)="requestVerification.emit()">Resend code</button>
+        @if (resendIn() > 0) {
+          <span class="verification-resend" aria-live="polite">Resend code in {{ resendIn() }}s</span>
+        } @else {
+          <button matButton type="button" [disabled]="disabled()" (click)="request()">Resend code</button>
+        }
       </div>
     }
   }

package/src/component/dashboard/verification_flow.ts

@@ -1,4 +1,7 @@
-import { ChangeDetectionStrategy, Component, ViewEncapsulation, input, output, signal } from '@angular/core';
+import {
+  ChangeDetectionStrategy, Component, DestroyRef, ViewEncapsulation,
+  inject, input, output, signal,
+} from '@angular/core';
 import { MatButtonModule } from '@angular/material/button';
 import { MatFormFieldModule } from '@angular/material/form-field';
 import { MatInputModule } from '@angular/material/input';
@@ -18,19 +21,71 @@ import { VerificationStep } from '../../model/dashboard';
   imports: [MatButtonModule, MatFormFieldModule, MatInputModule],
 })
 export class VerificationFlowComponent {
+  private readonly destroyRef = inject(DestroyRef);
+
   readonly step = input<VerificationStep>('idle');
   readonly errorMessage = input<string>('');
   /** The email/phone/identifier being verified, shown in the copy. */
   readonly target = input<string>('');
+  /** Seconds before `Resend code` re-enables; 0 leaves it always enabled. */
+  readonly resendAfterSeconds = input(0);
+  /** Seconds the issued code stays valid; 0 shows no expiry and never blocks confirm. */
+  readonly codeExpiresInSeconds = input(0);
+  /** Prevent interaction while the host is processing a request. */
+  readonly disabled = input(false);
+
   readonly requestVerification = output<void>();
   readonly confirmCode = output<string>();
 
   readonly code = signal('');
+  readonly resendIn = signal(0);
+  readonly expiresIn = signal(0);
+  readonly expired = signal(false);
+
+  private timer: ReturnType<typeof setInterval> | null = null;
+
+  constructor() {
+    this.destroyRef.onDestroy(() => this.clearTimer());
+  }
 
   submit(): void {
     const c = this.code().trim();
-    if (c) {
+    if (c && !this.expired() && !this.disabled()) {
       this.confirmCode.emit(c);
     }
   }
+
+  /** Both the first request and a resend restart the countdowns, as the OTP input does. */
+  request(): void {
+    if (this.disabled()) return;
+    this.requestVerification.emit();
+    this.startCountdowns();
+  }
+
+  private startCountdowns(): void {
+    this.clearTimer();
+    this.code.set('');
+    this.expired.set(false);
+    this.resendIn.set(this.resendAfterSeconds());
+    this.expiresIn.set(this.codeExpiresInSeconds());
+    if (this.resendIn() > 0 || this.expiresIn() > 0) {
+      this.timer = setInterval(() => this.tick(), 1000);
+    }
+  }
+
+  private tick(): void {
+    if (this.resendIn() > 0) this.resendIn.update((s) => s - 1);
+    if (this.expiresIn() > 0) {
+      this.expiresIn.update((s) => s - 1);
+      if (this.expiresIn() === 0) this.expired.set(true);
+    }
+    if (this.resendIn() === 0 && this.expiresIn() === 0) this.clearTimer();
+  }
+
+  private clearTimer(): void {
+    if (this.timer) {
+      clearInterval(this.timer);
+      this.timer = null;
+    }
+  }
 }

package/src/component/notification/notification_center.html

@@ -0,0 +1,60 @@
+<section class="notification-center" [attr.aria-busy]="loading()">
+  <div class="notification-center__head">
+    @if (heading()) {
+      <h2 class="notification-center__title">
+        {{ heading() }}
+        @if (unreadCount()) { <span class="notification-center__unread">{{ unreadCount() }}</span> }
+      </h2>
+    }
+    @if (unreadCount()) {
+      <button matButton type="button" [disabled]="loading()" (click)="markAllRead()">{{ markAllLabel() }}</button>
+    }
+  </div>
+
+  @if (errorMessage()) {
+    <p class="notification-center__error" role="alert">{{ errorMessage() }}</p>
+  }
+
+  @if (loading() && !messages().length) {
+    <div class="notification-center__loading">
+      <mat-spinner diameter="28" aria-label="Loading notifications"></mat-spinner>
+    </div>
+  }
+
+  @if (empty()) {
+    <p class="notification-center__empty">{{ emptyMessage() }}</p>
+  } @else if (messages().length) {
+    <ul class="notification-center__list">
+      @for (message of messages(); track message.id) {
+        <li class="notification-item" [class.notification-item--unread]="!message.readAt">
+          @if (selectable()) {
+            <button class="notification-item__select" type="button" [disabled]="loading()" (click)="select(message)">
+              <span class="notification-item__title">{{ message.title }}</span>
+              <span class="notification-item__body">{{ message.body }}</span>
+              <time class="notification-item__time" [attr.datetime]="message.createdAt">{{ message.createdAt | date: dateFormat() }}</time>
+            </button>
+          } @else {
+            <div class="notification-item__static">
+              <span class="notification-item__title">{{ message.title }}</span>
+              <span class="notification-item__body">{{ message.body }}</span>
+              <time class="notification-item__time" [attr.datetime]="message.createdAt">{{ message.createdAt | date: dateFormat() }}</time>
+            </div>
+          }
+          @if (!message.readAt) {
+            <button matIconButton type="button" class="notification-item__read"
+                    [attr.aria-label]="markReadLabel() + ': ' + message.title"
+                    [disabled]="loading()" (click)="markRead(message)">
+              <mat-icon>done</mat-icon>
+            </button>
+          }
+        </li>
+      }
+    </ul>
+
+    @if (hasMore()) {
+      <button matButton type="button" class="notification-center__more" [disabled]="loading()" (click)="loadMore()">
+        {{ loadMoreLabel() }}
+      </button>
+    }
+  }
+</section>

package/src/component/notification/notification_center.ts

@@ -0,0 +1,69 @@
+import { ChangeDetectionStrategy, Component, OnInit, ViewEncapsulation, computed, inject, input, output } from '@angular/core';
+import { DatePipe } from '@angular/common';
+import { MatButtonModule } from '@angular/material/button';
+import { MatIconModule } from '@angular/material/icon';
+import { MatProgressSpinnerModule } from '@angular/material/progress-spinner';
+import { BaseAsync } from '../abstract/base_async';
+import { NotificationInboxService, INBOX_DEFAULT_PAGE_SIZE } from '../../service/notification_inbox.service';
+import { InboxMessage } from '../../model/notification';
+
+/** In-app inbox over keel's `InboxHandler`; message routing stays with the app. */
+@Component({
+  selector: 'sail-notification-center',
+  templateUrl: './notification_center.html',
+  changeDetection: ChangeDetectionStrategy.OnPush,
+  encapsulation: ViewEncapsulation.None,
+  imports: [DatePipe, MatButtonModule, MatIconModule, MatProgressSpinnerModule],
+})
+export class NotificationCenterComponent extends BaseAsync implements OnInit {
+  readonly pageSize = input(INBOX_DEFAULT_PAGE_SIZE);
+  readonly heading = input('');
+  readonly emptyMessage = input('You have no notifications.');
+  readonly markAllLabel = input('Mark all as read');
+  readonly markReadLabel = input('Mark as read');
+  readonly loadMoreLabel = input('Load older');
+  readonly dateFormat = input('short');
+  readonly selectable = input(true);
+  readonly markReadOnSelect = input(true);
+
+  readonly selected = output<InboxMessage>();
+
+  private readonly inbox = inject(NotificationInboxService);
+
+  readonly messages = this.inbox.messages;
+  readonly unreadCount = this.inbox.unreadCount;
+  readonly hasMore = this.inbox.hasMore;
+  readonly empty = computed(() => !this.loading() && !this.errorMessage() && this.messages().length === 0);
+
+  ngOnInit(): void {
+    this.reload();
+  }
+
+  reload(): void {
+    this.run(this.inbox.load(this.pageSize()), () => undefined, 'Could not load your notifications.');
+  }
+
+  loadMore(): void {
+    this.run(this.inbox.loadMore(this.pageSize()), () => undefined, 'Could not load older notifications.');
+  }
+
+  select(message: InboxMessage): void {
+    // Not via run(): the app may navigate away on select, and teardown would cancel the POST.
+    if (this.markReadOnSelect() && !message.readAt) {
+      this.inbox.markRead(message.id).subscribe({
+        error: (err) => this.setError(err, 'Could not mark that notification read.'),
+      });
+    }
+    this.selected.emit(message);
+  }
+
+  markRead(message: InboxMessage): void {
+    if (message.readAt) return;
+    this.run(this.inbox.markRead(message.id), () => undefined, 'Could not mark that notification read.');
+  }
+
+  markAllRead(): void {
+    if (!this.unreadCount()) return;
+    this.run(this.inbox.markAllRead(), () => undefined, 'Could not mark your notifications read.');
+  }
+}

package/src/component/verification/domain_verification.html

@@ -0,0 +1,23 @@
+<div class="domain-verification" [attr.data-step]="step()">
+  <div class="domain-verification-field">
+    <mat-form-field appearance="outline">
+      <mat-label>{{ label() }}</mat-label>
+      <input matInput #domainField type="text" name="domain" inputmode="url" autocomplete="url"
+             [value]="domain()" (input)="onDomainInput(domainField.value)"
+             [disabled]="isVerified() || loading()">
+    </mat-form-field>
+    @if (isVerified()) {
+      <mat-icon class="domain-verification-verified" aria-hidden="true">verified</mat-icon>
+    }
+  </div>
+
+  <sail-verification-flow
+    [step]="step()"
+    [target]="domain()"
+    [errorMessage]="errorMessage()"
+    [disabled]="loading() || !domain().trim()"
+    [resendAfterSeconds]="resendAfterSeconds()"
+    [codeExpiresInSeconds]="codeExpiresInSeconds()"
+    (requestVerification)="request()"
+    (confirmCode)="confirm($event)" />
+</div>

package/src/component/verification/domain_verification.ts

@@ -0,0 +1,85 @@
+import {
+  ChangeDetectionStrategy, Component, ViewEncapsulation,
+  computed, effect, inject, input, output, signal, untracked,
+} from '@angular/core';
+import { MatFormFieldModule } from '@angular/material/form-field';
+import { MatIconModule } from '@angular/material/icon';
+import { MatInputModule } from '@angular/material/input';
+import { VerificationStep } from '../../model/dashboard';
+import { DOMAIN_VERIFIER } from '../../service/domain_verifier';
+import { BaseAsync } from '../abstract/base_async';
+import { VerificationFlowComponent } from '../dashboard/verification_flow';
+
+/**
+ * Domain-ownership verification: the domain field plus the send-code → confirm steps,
+ * driven against the injected `DOMAIN_VERIFIER`. The app owns the endpoints, the page
+ * shell and the styling; `verified` fires once with the domain that was proven.
+ *
+ * Selector: <sail-domain-verification>
+ */
+@Component({
+  selector: 'sail-domain-verification',
+  templateUrl: './domain_verification.html',
+  changeDetection: ChangeDetectionStrategy.OnPush,
+  encapsulation: ViewEncapsulation.None,
+  imports: [MatFormFieldModule, MatIconModule, MatInputModule, VerificationFlowComponent],
+})
+export class DomainVerificationComponent extends BaseAsync {
+  private readonly verifier = inject(DOMAIN_VERIFIER);
+
+  readonly domainInput = input('', { alias: 'domain' });
+  readonly label = input('Domain');
+  readonly resendAfterSeconds = input(60);
+  readonly codeExpiresInSeconds = input(0);
+
+  readonly domainChange = output<string>();
+  readonly verified = output<string>();
+
+  readonly domain = signal('');
+  readonly step = signal<VerificationStep>('idle');
+  readonly isVerified = computed(() => this.step() === 'verified');
+
+  constructor() {
+    super();
+    effect(() => {
+      const value = this.domainInput();
+      if (value === untracked(this.domain)) return;
+      this.domain.set(value);
+      this.step.set('idle');
+      this.clearMessages();
+    });
+  }
+
+  protected onDomainInput(value: string): void {
+    this.domain.set(value);
+    this.step.set('idle');   // a code is bound to the domain it was issued for
+    this.clearMessages();
+    this.domainChange.emit(value);
+  }
+
+  protected request(): void {
+    const domain = this.domain().trim();
+    if (!domain || this.isVerified() || this.loading()) return;
+    this.run(
+      this.verifier.requestVerification(domain),
+      () => this.step.set('requested'),
+      'Could not send the verification code.',
+      () => this.step.set('idle'),
+    );
+  }
+
+  protected confirm(code: string): void {
+    const domain = this.domain().trim();
+    if (!domain || this.isVerified() || this.loading()) return;
+    this.step.set('verifying');
+    this.run(
+      this.verifier.confirm(domain, code),
+      () => {
+        this.step.set('verified');
+        this.verified.emit(domain);
+      },
+      'Verification failed.',
+      () => this.step.set('error'),
+    );
+  }
+}

package/src/index.ts

@@ -4,6 +4,7 @@ export * from './model/auth';
 export * from './model/common';
 export * from './model/dashboard';
 export * from './model/oauth_connection';
+export * from './model/notification';
 export * from './model/agency';
 export * from './model/decorator';
 export * from './component/abstract/base_table';
@@ -14,6 +15,8 @@ export * from './component/dashboard/no_source_overlay';
 export * from './component/dashboard/action_center';
 export * from './component/dashboard/entity_selector';
 export * from './component/dashboard/verification_flow';
+export * from './component/verification/domain_verification';
+export * from './component/notification/notification_center';
 export * from './component/oauth_connection/oauth_connection_panel';
 export * from './component/abstract/base_form';
 export * from './component/abstract/base_view';
@@ -68,10 +71,12 @@ export * from './component/payment/user_payment_methods';
 export * from './component/payment/sca_confirm';
 export * from './service/auth.service';
 export * from './service/sca_confirmer';
+export * from './service/domain_verifier';
 export * from './service/billing.service';
 export * from './service/payout.service';
 export * from './service/agency.service';
 export * from './service/oauth_connection.service';
+export * from './service/notification_inbox.service';
 export * from './service/user_payment_method.service';
 export * from './service/script_loader';
 export * from './service/auth.interceptor';

package/src/model/notification.ts

@@ -0,0 +1,20 @@
+/** In-app notification returned by keel's `InboxHandler`. */
+export interface InboxMessage {
+  /** Server-side `BIGINT`, serialized as a string to preserve precision. */
+  id: string;
+  /** App-defined category (keel `notification_type`); '' when the sender set none. */
+  type: string;
+  title: string;
+  body: string;
+  /** Sender payload the app routes on (`{}` when the sender supplied none). */
+  data: Record<string, string>;
+  /** ISO timestamp, or null while unread. */
+  readAt: string | null;
+  createdAt: string;
+}
+
+/** One page of the caller's inbox, newest first, plus the whole-inbox unread total. */
+export interface InboxPage {
+  messages: InboxMessage[];
+  unreadCount: number;
+}

package/src/service/domain_verifier.ts

@@ -0,0 +1,20 @@
+import { InjectionToken } from '@angular/core';
+import { Observable } from 'rxjs';
+
+/**
+ * Port for proving ownership of a domain: issue a code, then confirm it.
+ *
+ * sail ships no implementation — the endpoints, their paths and their payloads are
+ * the app's. Register one at composition time:
+ *
+ *   { provide: DOMAIN_VERIFIER, useExisting: RegistrationService }
+ *
+ * Both methods may emit any body; `DomainVerificationComponent` reads only success
+ * or failure, and reports the failure through `errorDetail()`.
+ */
+export interface DomainVerifier {
+  requestVerification(domain: string): Observable<unknown>;
+  confirm(domain: string, code: string): Observable<unknown>;
+}
+
+export const DOMAIN_VERIFIER = new InjectionToken<DomainVerifier>('SailDomainVerifier');

package/src/service/notification_inbox.service.ts

@@ -0,0 +1,78 @@
+import { Injectable, Signal, signal } from '@angular/core';
+import { HttpParams } from '@angular/common/http';
+import { Observable, tap } from 'rxjs';
+import { BaseRestService } from './base_rest.service';
+import { RestURL } from './rest_url';
+import { InboxMessage, InboxPage } from '../model/notification';
+
+export const INBOX_MAX_PAGE_SIZE = 100;
+export const INBOX_DEFAULT_PAGE_SIZE = 20;
+
+/** Stateful client for keel's `InboxHandler` (v1.2.71+). Call `reset()` on logout. */
+@Injectable({ providedIn: 'root' })
+export class NotificationInboxService extends BaseRestService {
+  private readonly cached = signal<InboxMessage[]>([]);
+  private readonly unread = signal(0);
+  private readonly older = signal(false);
+
+  readonly messages: Signal<InboxMessage[]> = this.cached.asReadonly();
+  readonly unreadCount: Signal<number> = this.unread.asReadonly();
+  readonly hasMore: Signal<boolean> = this.older.asReadonly();
+
+  load(limit = INBOX_DEFAULT_PAGE_SIZE): Observable<InboxPage> {
+    return this.fetch('', limit).pipe(tap((page) => this.cached.set(page.messages)));
+  }
+
+  loadMore(limit = INBOX_DEFAULT_PAGE_SIZE): Observable<InboxPage> {
+    const loaded = this.cached();
+    const oldest = loaded.length ? loaded[loaded.length - 1].id : '';
+    return this.fetch(oldest, limit).pipe(
+      tap((page) => this.cached.update((rows) => {
+        const ids = new Set(rows.map((message) => message.id));
+        return rows.concat(page.messages.filter((message) => !ids.has(message.id)));
+      })),
+    );
+  }
+
+  markRead(id: string): Observable<void> {
+    return this.http.post<void>(this.url(RestURL.notificationsMarkReadURL), { id }).pipe(
+      tap(() => {
+        const wasUnread = this.cached().some((m) => m.id === id && !m.readAt);
+        this.cached.update((rows) => rows.map((m) => (m.id === id ? { ...m, readAt: m.readAt ?? nowIso() } : m)));
+        if (wasUnread) this.unread.update((n) => Math.max(0, n - 1));
+      }),
+    );
+  }
+
+  markAllRead(): Observable<void> {
+    return this.http.post<void>(this.url(RestURL.notificationsMarkAllReadURL), {}).pipe(
+      tap(() => {
+        this.cached.update((rows) => rows.map((m) => (m.readAt ? m : { ...m, readAt: nowIso() })));
+        this.unread.set(0);
+      }),
+    );
+  }
+
+  reset(): void {
+    this.cached.set([]);
+    this.unread.set(0);
+    this.older.set(false);
+  }
+
+  private fetch(before: string, limit: number): Observable<InboxPage> {
+    const requested = Number.isFinite(limit) ? Math.trunc(limit) : INBOX_DEFAULT_PAGE_SIZE;
+    const size = Math.min(Math.max(1, requested), INBOX_MAX_PAGE_SIZE);
+    let params = new HttpParams().set('limit', size);
+    if (before) params = params.set('before', before);
+    return this.http.get<InboxPage>(this.url(RestURL.notificationsURL), { params }).pipe(
+      tap((page) => {
+        this.unread.set(page.unreadCount);
+        this.older.set(page.messages.length >= size);
+      }),
+    );
+  }
+}
+
+function nowIso(): string {
+  return new Date().toISOString();
+}

package/src/service/rest_url.ts

@@ -46,6 +46,10 @@ export const RestURL = {
   profileEmailConfirmURL: '/api/user/profile/email/confirm',
   profilePhoneURL:        '/api/user/profile/phone',
   profilePhoneConfirmURL: '/api/user/profile/phone/confirm',
+  // Notification inbox (keel InboxHandler, v1.2.71+).
+  notificationsURL:            '/api/notifications',
+  notificationsMarkReadURL:    '/api/notifications/mark_read',
+  notificationsMarkAllReadURL: '/api/notifications/mark_all_read',
   pushRegisterURL:     '/api/push/register',
   pushRevokeURL:       '/api/push/revoke',
   // Payout — keel/payout endpoints. keel mounts PayoutHandler.Routes(prefix)