@serve.zone/dcrouter 16.5.0 → 17.1.0

package/ts/opsserver/handlers/email-ops.handler.ts

@@ -134,7 +134,7 @@ export class EmailOpsHandler {
     if (this.isCachedEmailStoreAvailable()) {
       const cachedEmail = await CachedEmail.findById(emailId);
       if (cachedEmail) {
-        return this.mapCachedEmailToEmailDetail(cachedEmail);
+        return await this.mapCachedEmailToEmailDetail(cachedEmail);
       }
     }
     return null;
@@ -158,23 +158,34 @@ export class EmailOpsHandler {
       subject: doc.subject || '',
       timestamp: new Date(doc.acceptedAt || 0).toISOString(),
       messageId: doc.messageId || '',
-      size: this.formatSize(doc.rawContent?.length || 0),
+      size: this.formatSize(doc.rawContentSize || 0),
     };
   }
 
   /**
    * Map a CachedEmail row to catalog IEmailDetail format
    */
-  private mapCachedEmailToEmailDetail(doc: CachedEmail): interfaces.requests.IEmailDetail {
+  private async mapCachedEmailToEmailDetail(
+    doc: CachedEmail,
+  ): Promise<interfaces.requests.IEmailDetail> {
     const base = this.mapCachedEmailToEmail(doc);
-    const { headers, body } = this.parseRawEmail(doc.rawContent || '');
+    let rawContent = '';
+    try {
+      rawContent = (await this.opsServerRef.dcRouterRef.acceptedEmailSpool.readRawMessage(doc))
+        .toString('utf8');
+    } catch {
+      // Transaction history and delivery state remain available when a retained
+      // legacy row no longer has its raw payload.
+    }
+    const { headers, body } = this.parseRawEmail(rawContent);
     const session = this.parseCachedEmailSession(doc);
 
     return {
       ...base,
+      smtpTransactions: structuredClone(doc.smtpTransactions || []),
       toList: doc.to || [],
       cc: doc.cc || [],
-      smtpLog: [],
+      smtpLog: this.flattenSmtpTransactions(doc.smtpTransactions || []),
       connectionInfo: {
         sourceIp: session.remoteAddress || '',
         sourceHostname: session.clientHostname || '',
@@ -344,9 +355,10 @@ export class EmailOpsHandler {
 
     return {
       ...base,
+      smtpTransactions: structuredClone(item.smtpTransactions || []),
       toList,
       cc,
-      smtpLog: [],
+      smtpLog: this.flattenSmtpTransactions(item.smtpTransactions || []),
       connectionInfo: {
         sourceIp: '',
         sourceHostname: '',
@@ -393,6 +405,17 @@ export class EmailOpsHandler {
     }
   }
 
+  private flattenSmtpTransactions(
+    transactionsArg: interfaces.requests.ISmtpTransactionAttempt[],
+  ): interfaces.requests.ISmtpLogEntry[] {
+    return transactionsArg.flatMap((transaction) => transaction.transcript.map((entry) => ({
+      timestamp: new Date(entry.timestampMs).toISOString(),
+      direction: entry.direction,
+      command: entry.text,
+      responseCode: entry.responseCode,
+    })));
+  }
+
   /**
    * Format byte size to human-readable string
    */

package/ts/opsserver/handlers/index.ts

@@ -21,3 +21,4 @@ export * from './dns-record.handler.js';
 export * from './acme-config.handler.js';
 export * from './email-domain.handler.js';
 export * from './gatewayclient.handler.js';
+export * from './realtime.handler.js';

package/ts/opsserver/handlers/logs.handler.ts

@@ -193,7 +193,7 @@ export class LogsHandler {
 
   /**
    * Add a log destination to the base logger that pushes entries
-   * to all connected ops_dashboard TypedSocket clients.
+   * only to server-authenticated Ops UI realtime subscribers.
    *
    * Uses a module-level singleton so the destination is added only once,
    * even across OpsServer restart cycles. The destination reads
@@ -218,7 +218,7 @@ export class LogsHandler {
 
         let connections: any[];
         try {
-          connections = await typedsocket.findAllTargetConnectionsByTag('role', 'ops_dashboard');
+          connections = await opsServer.getAuthenticatedRealtimeConnections();
         } catch {
           return;
         }

package/ts/opsserver/handlers/realtime.handler.ts

@@ -0,0 +1,222 @@
+import * as plugins from '../../plugins.js';
+import type { OpsServer } from '../classes.opsserver.js';
+import * as interfaces from '../../../ts_interfaces/index.js';
+import { requireOpsAuth } from '../helpers/auth.js';
+
+const REALTIME_TAG_PREFIX = 'dcrouterOpsRealtime:user:';
+
+export const getOpsRealtimeUserTag = (userIdArg: string): string => {
+  return REALTIME_TAG_PREFIX + encodeURIComponent(userIdArg);
+};
+
+const createInitialRevisions = (): interfaces.requests.IOpsRealtimeRevisionMap => {
+  return Object.fromEntries(
+    interfaces.requests.opsRealtimeResources.map((resource) => [resource, 1]),
+  ) as unknown as interfaces.requests.IOpsRealtimeRevisionMap;
+};
+
+export class OpsRealtimeRevisionClock {
+  public readonly serverEpoch: string;
+  private revisions = createInitialRevisions();
+
+  constructor(serverEpochArg = plugins.uuid.v4()) {
+    this.serverEpoch = serverEpochArg;
+  }
+
+  public getRevisions(): interfaces.requests.IOpsRealtimeRevisionMap {
+    return { ...this.revisions };
+  }
+
+  public invalidate(
+    resourceArg: interfaces.requests.TOpsRealtimeResource,
+    optionsArg: {
+      changedIds?: string[];
+      reason?: string;
+      timestamp?: number;
+    } = {},
+  ): interfaces.requests.IOpsRealtimeInvalidation {
+    const revision = this.revisions[resourceArg] + 1;
+    this.revisions[resourceArg] = revision;
+    return {
+      resource: resourceArg,
+      revision,
+      changedIds: optionsArg.changedIds?.length
+        ? Array.from(new Set(optionsArg.changedIds))
+        : undefined,
+      reason: optionsArg.reason,
+      timestamp: optionsArg.timestamp ?? Date.now(),
+    };
+  }
+
+  public getCatchup(
+    knownServerEpochArg?: string,
+    knownRevisionsArg: Partial<interfaces.requests.IOpsRealtimeRevisionMap> = {},
+  ): interfaces.requests.IOpsRealtimeInvalidation[] {
+    const epochChanged = knownServerEpochArg !== this.serverEpoch;
+    return interfaces.requests.opsRealtimeResources
+      .filter((resource) => epochChanged || (knownRevisionsArg[resource] ?? 0) < this.revisions[resource])
+      .map((resource) => ({
+        resource,
+        revision: this.revisions[resource],
+        timestamp: Date.now(),
+        reason: epochChanged ? 'initial-catchup' : 'revision-catchup',
+      }));
+  }
+}
+
+interface IWebSocketPeerForRealtime {
+  id: string;
+  tags: Set<string>;
+}
+
+interface IRealtimeInvalidationOptions {
+  changedIds?: string[];
+  reason?: string;
+}
+
+export class RealtimeHandler {
+  public typedrouter = new plugins.typedrequest.TypedRouter();
+  public readonly revisionClock = new OpsRealtimeRevisionClock();
+
+  private subscribedUserIds = new Set<string>();
+  private pendingInvalidations = new Map<
+    interfaces.requests.TOpsRealtimeResource,
+    interfaces.requests.IOpsRealtimeInvalidation
+  >();
+  private pushScheduled = false;
+  private stopped = false;
+
+  constructor(private opsServerRef: OpsServer) {
+    this.opsServerRef.viewRouter.addTypedRouter(this.typedrouter);
+    this.registerHandlers();
+  }
+
+  public invalidate(
+    resourcesArg:
+      | interfaces.requests.TOpsRealtimeResource
+      | interfaces.requests.TOpsRealtimeResource[],
+    optionsArg: IRealtimeInvalidationOptions = {},
+  ): void {
+    if (this.stopped) return;
+    const resources = Array.isArray(resourcesArg) ? resourcesArg : [resourcesArg];
+    for (const resource of new Set(resources)) {
+      const invalidation = this.revisionClock.invalidate(resource, optionsArg);
+      const existing = this.pendingInvalidations.get(resource);
+      this.pendingInvalidations.set(resource, {
+        ...invalidation,
+        changedIds: Array.from(new Set([
+          ...(existing?.changedIds || []),
+          ...(invalidation.changedIds || []),
+        ])),
+      });
+    }
+    this.schedulePush();
+  }
+
+  public async getAuthenticatedConnections(): Promise<
+    plugins.typedsocket.ISmartServeConnectionWrapper[]
+  > {
+    const typedsocket = this.opsServerRef.server?.typedserver?.typedsocket;
+    if (!typedsocket) return [];
+
+    const connections = new Map<string, plugins.typedsocket.ISmartServeConnectionWrapper>();
+    for (const userId of Array.from(this.subscribedUserIds)) {
+      const userConnections = await typedsocket.findAllTargetConnectionsByTag(
+        getOpsRealtimeUserTag(userId),
+      );
+      if (userConnections.length === 0) {
+        this.subscribedUserIds.delete(userId);
+        continue;
+      }
+      for (const connection of userConnections) {
+        connections.set(connection.peer.id, connection);
+      }
+    }
+    return Array.from(connections.values());
+  }
+
+  public cleanup(): void {
+    this.stopped = true;
+    this.pendingInvalidations.clear();
+    this.subscribedUserIds.clear();
+  }
+
+  private registerHandlers(): void {
+    this.typedrouter.addTypedHandler(
+      new plugins.typedrequest.TypedHandler<interfaces.requests.IReq_SubscribeOpsRealtime>(
+        'subscribeOpsRealtime',
+        async (dataArg, toolsArg) => {
+          const auth = await requireOpsAuth(this.opsServerRef, dataArg);
+          if (auth.type !== 'identity') {
+            throw new plugins.typedrequest.TypedResponseError(
+              'Realtime UI subscriptions require a user identity',
+            );
+          }
+
+          const peer = toolsArg?.localData?.peer as IWebSocketPeerForRealtime | undefined;
+          if (!peer?.id || !peer.tags) {
+            throw new plugins.typedrequest.TypedResponseError(
+              'Realtime subscriptions require a WebSocket connection',
+            );
+          }
+
+          for (const tag of Array.from(peer.tags)) {
+            if (tag.startsWith(REALTIME_TAG_PREFIX)) {
+              peer.tags.delete(tag);
+            }
+          }
+          peer.tags.add(getOpsRealtimeUserTag(auth.userId));
+          this.subscribedUserIds.add(auth.userId);
+
+          return {
+            serverEpoch: this.revisionClock.serverEpoch,
+            revisions: this.revisionClock.getRevisions(),
+            invalidations: this.revisionClock.getCatchup(
+              dataArg.knownServerEpoch,
+              dataArg.knownRevisions,
+            ),
+          };
+        },
+      ),
+    );
+  }
+
+  private schedulePush(): void {
+    if (this.pushScheduled) return;
+    this.pushScheduled = true;
+    queueMicrotask(() => {
+      this.pushScheduled = false;
+      void this.flushPushes();
+    });
+  }
+
+  private async flushPushes(): Promise<void> {
+    if (this.stopped || this.pendingInvalidations.size === 0) return;
+    const invalidations = Array.from(this.pendingInvalidations.values());
+    this.pendingInvalidations.clear();
+
+    let connections: plugins.typedsocket.ISmartServeConnectionWrapper[];
+    try {
+      connections = await this.getAuthenticatedConnections();
+    } catch {
+      return;
+    }
+
+    const typedsocket = this.opsServerRef.server?.typedserver?.typedsocket;
+    if (!typedsocket) return;
+
+    await Promise.allSettled(
+      connections.map(async (connection) => {
+        const request =
+          typedsocket.createTypedRequest<interfaces.requests.IReq_PushOpsRealtimeInvalidation>(
+            'pushOpsRealtimeInvalidation',
+            connection,
+          );
+        await request.fire({
+          serverEpoch: this.revisionClock.serverEpoch,
+          invalidations,
+        });
+      }),
+    );
+  }
+}

package/ts/opsserver/handlers/remoteingress.handler.ts

@@ -70,6 +70,10 @@ export class RemoteIngressHandler {
                 mailHostname: dataArg.mailHostname,
               },
             ));
+            this.opsServerRef.invalidateRealtime?.(['edges', 'emailDomains', 'dns', 'routes'], {
+              changedIds: [edge.id],
+              reason: 'remote-ingress-created',
+            });
             return { success: true, edge };
           } catch (err: unknown) {
             return {
@@ -100,6 +104,12 @@ export class RemoteIngressHandler {
             throw err;
           });
 
+          if (deleted) {
+            this.opsServerRef.invalidateRealtime?.(['edges', 'emailDomains', 'dns', 'routes'], {
+              changedIds: [dataArg.id],
+              reason: 'remote-ingress-deleted',
+            });
+          }
           return {
             success: deleted,
             message: deleted ? undefined : 'Edge not found or RemoteIngress not configured',
@@ -155,6 +165,10 @@ export class RemoteIngressHandler {
           if (!result) {
             return { success: false, edge: null as any, message: failureMessage };
           }
+          this.opsServerRef.invalidateRealtime?.(['edges', 'emailDomains', 'dns', 'routes'], {
+            changedIds: [dataArg.id],
+            reason: 'remote-ingress-updated',
+          });
           return {
             success: true,
             edge: result,
@@ -184,6 +198,10 @@ export class RemoteIngressHandler {
             return { success: false, secret: '' };
           }
 
+          this.opsServerRef.invalidateRealtime?.('edges', {
+            changedIds: [dataArg.id],
+            reason: 'remote-ingress-secret-regenerated',
+          });
           return { success: true, secret };
         },
       ),
@@ -252,6 +270,9 @@ export class RemoteIngressHandler {
               updates,
               auth.userId,
             );
+            this.opsServerRef.invalidateRealtime?.(['edges', 'emailDomains', 'dns', 'routes'], {
+              reason: 'remote-ingress-hub-settings-updated',
+            });
             return { success: true, settings };
           } catch (err: unknown) {
             return { success: false, message: (err as Error).message };

package/ts/opsserver/handlers/route-management.handler.ts

@@ -68,6 +68,10 @@ export class RouteManagementHandler {
             return { success: false, message: 'Route management not initialized' };
           }
           const id = await manager.createRoute(dataArg.route, userId, dataArg.enabled ?? true, dataArg.metadata);
+          this.opsServerRef.invalidateRealtime?.('routes', {
+            changedIds: [id],
+            reason: 'route-created',
+          });
           return { success: true, routeId: id };
         },
       ),
@@ -88,6 +92,12 @@ export class RouteManagementHandler {
             enabled: dataArg.enabled,
             metadata: dataArg.metadata,
           });
+          if (result.success) {
+            this.opsServerRef.invalidateRealtime?.('routes', {
+              changedIds: [dataArg.id],
+              reason: 'route-updated',
+            });
+          }
           return result;
         },
       ),
@@ -103,7 +113,14 @@ export class RouteManagementHandler {
           if (!manager) {
             return { success: false, message: 'Route management not initialized' };
           }
-          return manager.deleteRoute(dataArg.id);
+          const result = await manager.deleteRoute(dataArg.id);
+          if (result.success) {
+            this.opsServerRef.invalidateRealtime?.('routes', {
+              changedIds: [dataArg.id],
+              reason: 'route-deleted',
+            });
+          }
+          return result;
         },
       ),
     );
@@ -118,7 +135,14 @@ export class RouteManagementHandler {
           if (!manager) {
             return { success: false, message: 'Route management not initialized' };
           }
-          return manager.toggleRoute(dataArg.id, dataArg.enabled);
+          const result = await manager.toggleRoute(dataArg.id, dataArg.enabled);
+          if (result.success) {
+            this.opsServerRef.invalidateRealtime?.('routes', {
+              changedIds: [dataArg.id],
+              reason: 'route-toggled',
+            });
+          }
+          return result;
         },
       ),
     );
@@ -138,6 +162,10 @@ export class RouteManagementHandler {
               userId,
               dataArg.enabled ?? true,
             );
+            this.opsServerRef.invalidateRealtime?.('routes', {
+              changedIds: [routeId],
+              reason: 'lets-encrypt-forward-created',
+            });
             return { success: true, routeId };
           } catch (error) {
             return { success: false, message: (error as Error).message };
@@ -156,11 +184,18 @@ export class RouteManagementHandler {
             return { success: false, message: 'Route management not initialized' };
           }
           try {
-            return await manager.updateLetsEncryptHttp01Forward(
+            const result = await manager.updateLetsEncryptHttp01Forward(
               dataArg.id,
               dataArg.config,
               dataArg.enabled,
             );
+            if (result.success) {
+              this.opsServerRef.invalidateRealtime?.('routes', {
+                changedIds: [dataArg.id],
+                reason: 'lets-encrypt-forward-updated',
+              });
+            }
+            return result;
           } catch (error) {
             return { success: false, message: (error as Error).message };
           }
@@ -177,7 +212,14 @@ export class RouteManagementHandler {
           if (!manager) {
             return { success: false, message: 'Route management not initialized' };
           }
-          return await manager.deleteLetsEncryptHttp01Forward(dataArg.id);
+          const result = await manager.deleteLetsEncryptHttp01Forward(dataArg.id);
+          if (result.success) {
+            this.opsServerRef.invalidateRealtime?.('routes', {
+              changedIds: [dataArg.id],
+              reason: 'lets-encrypt-forward-deleted',
+            });
+          }
+          return result;
         },
       ),
     );

package/ts/opsserver/handlers/stats.handler.ts

@@ -562,10 +562,8 @@ export class StatsHandler {
         const emailLike = item.processingResult;
         const recipients = Array.isArray(emailLike?.to)
           ? emailLike.to
-          : Array.isArray(emailLike?.email?.to)
-            ? emailLike.email.to
-            : [];
-        const subject = emailLike?.subject || emailLike?.email?.subject || '';
+          : [];
+        const subject = emailLike?.subject || '';
         return {
           id: item.id,
           recipient: recipients[0] || '',

package/ts/paths.ts

@@ -10,18 +10,9 @@ export const distServe = plugins.path.join(packageDir, './dist_serve');
 // Default base for all dcrouter data (always user-writable)
 export const dcrouterHomeDir = plugins.path.join(plugins.os.homedir(), '.serve.zone', 'dcrouter');
 
-// Configure data directory with environment variable or default to ~/.serve.zone/dcrouter/data
-const DEFAULT_DATA_PATH = plugins.path.join(dcrouterHomeDir, 'data');
-export const dataDir = process.env.DATA_DIR
-  ? process.env.DATA_DIR
-  : DEFAULT_DATA_PATH;
-
 // Default TsmDB path for CacheDb
 export const defaultTsmDbPath = plugins.path.join(dcrouterHomeDir, 'tsmdb');
 
-// DNS records directory (only surviving MTA directory reference)
-export const dnsRecordsDir = plugins.path.join(dataDir, 'dns');
-
 /**
  * Resolve all data paths from a given baseDir.
  * When no baseDir is provided, falls back to ~/.serve.zone/dcrouter.
@@ -34,21 +25,5 @@ export function resolvePaths(baseDir?: string) {
     dcrouterHomeDir: root,
     dataDir: resolvedDataDir,
     defaultTsmDbPath: plugins.path.join(root, 'tsmdb'),
-    dnsRecordsDir: plugins.path.join(resolvedDataDir, 'dns'),
   };
 }
-
-/**
- * Ensure only the data directories that are actually used exist.
- */
-export function ensureDataDirectories(resolvedPaths: ReturnType<typeof resolvePaths>) {
-  plugins.fsUtils.ensureDirSync(resolvedPaths.dataDir);
-  plugins.fsUtils.ensureDirSync(resolvedPaths.dnsRecordsDir);
-}
-
-/**
- * Legacy wrapper — delegates to ensureDataDirectories with module-level defaults.
- */
-export function ensureDirectories() {
-  ensureDataDirectories(resolvePaths());
-}

package/ts/plugins.ts

@@ -54,6 +54,7 @@ export {
 import * as projectinfo from '@push.rocks/projectinfo';
 import * as qenv from '@push.rocks/qenv';
 import * as smartacme from '@push.rocks/smartacme';
+import * as smartbucket from '@push.rocks/smartbucket';
 import * as smartchallenge from '@push.rocks/smartchallenge';
 import * as smartdata from '@push.rocks/smartdata';
 import * as smartdns from '@push.rocks/smartdns';
@@ -76,7 +77,7 @@ import * as smartrx from '@push.rocks/smartrx';
 import * as smartunique from '@push.rocks/smartunique';
 import * as taskbuffer from '@push.rocks/taskbuffer';
 
-export { projectinfo, qenv, smartacme, smartchallenge, smartdata, smartdns, smartfs, smartguard, smartjwt, smartlog, smartmetrics, smartmcp, smartdb, smartmta, smartnetwork, smartpath, smartproxy, smartpromise, smartradius, smartrequest, smartrx, smartunique, smartvpn, taskbuffer };
+export { projectinfo, qenv, smartacme, smartbucket, smartchallenge, smartdata, smartdns, smartfs, smartguard, smartjwt, smartlog, smartmetrics, smartmcp, smartdb, smartmta, smartnetwork, smartpath, smartproxy, smartpromise, smartradius, smartrequest, smartrx, smartunique, smartvpn, taskbuffer };
 
 // Define SmartLog types for use in error handling
 export type TLogLevel = 'error' | 'warn' | 'info' | 'success' | 'debug';
@@ -101,71 +102,3 @@ import * as uuid from 'uuid';
 export {
   uuid,
 }
-
-// Filesystem utilities
-export const fsUtils = {
-  /**
-   * Ensure a directory exists, creating it recursively if needed (sync)
-   */
-  ensureDirSync: (dirPath: string): void => {
-    fs.mkdirSync(dirPath, { recursive: true });
-  },
-
-  /**
-   * Ensure a directory exists, creating it recursively if needed (async)
-   */
-  ensureDir: async (dirPath: string): Promise<void> => {
-    await fs.promises.mkdir(dirPath, { recursive: true });
-  },
-
-  /**
-   * Write JSON content to a file synchronously
-   */
-  toFsSync: (content: any, filePath: string): void => {
-    const data = typeof content === 'string' ? content : JSON.stringify(content, null, 2);
-    fs.writeFileSync(filePath, data);
-  },
-
-  /**
-   * Write JSON content to a file asynchronously
-   */
-  toFs: async (content: any, filePath: string): Promise<void> => {
-    const data = typeof content === 'string' ? content : JSON.stringify(content, null, 2);
-    await fs.promises.writeFile(filePath, data);
-  },
-
-  /**
-   * Check if a file or directory exists
-   */
-  fileExistsSync: (filePath: string): boolean => {
-    return fs.existsSync(filePath);
-  },
-
-  /**
-   * Check if a file or directory exists (async)
-   */
-  fileExists: async (filePath: string): Promise<boolean> => {
-    try {
-      await fs.promises.access(filePath);
-      return true;
-    } catch {
-      return false;
-    }
-  },
-
-  /**
-   * Read a JSON file synchronously
-   */
-  toObjectSync: <T = any>(filePath: string): T => {
-    const content = fs.readFileSync(filePath, 'utf8');
-    return JSON.parse(content) as T;
-  },
-
-  /**
-   * Read a JSON file asynchronously
-   */
-  toObject: async <T = any>(filePath: string): Promise<T> => {
-    const content = await fs.promises.readFile(filePath, 'utf8');
-    return JSON.parse(content) as T;
-  },
-};

package/ts_web/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@serve.zone/dcrouter',
-  version: '16.5.0',
+  version: '17.1.0',
   description: 'A multifaceted routing service handling mail and SMS delivery functions.'
 }

package/ts_web/appstate/certificates.ts

@@ -3,6 +3,7 @@ import type * as servezoneInterfaces from '@serve.zone/interfaces';
 import * as interfaces from '../../ts_interfaces/index.js';
 import { appState } from './shared.js';
 import { getActionContext } from './login.js';
+import { captureRealtimeTicket, isRealtimeTicketCurrent } from './realtime.js';
 
 export interface ICertificateState {
   certificates: interfaces.requests.ICertificateInfo[];
@@ -31,6 +32,7 @@ export const fetchCertificateOverviewAction = certificateStatePart.createAction(
   const context = getActionContext();
   const currentState = statePartArg.getState()!;
   if (!context.identity) return currentState;
+  const ticket = captureRealtimeTicket('certificates');
 
   try {
     const request = new plugins.domtools.plugins.typedrequest.TypedRequest<
@@ -40,8 +42,10 @@ export const fetchCertificateOverviewAction = certificateStatePart.createAction(
     const response = await request.fire({
       identity: context.identity,
     });
+    if (!isRealtimeTicketCurrent(ticket)) return statePartArg.getState()!;
 
     return {
+      ...statePartArg.getState()!,
       certificates: response.certificates,
       summary: response.summary,
       isLoading: false,
@@ -49,8 +53,9 @@ export const fetchCertificateOverviewAction = certificateStatePart.createAction(
       lastUpdated: Date.now(),
     };
   } catch (error) {
+    if (!isRealtimeTicketCurrent(ticket)) return statePartArg.getState()!;
     return {
-      ...currentState,
+      ...statePartArg.getState()!,
       isLoading: false,
       error: error instanceof Error ? error.message : 'Failed to fetch certificate overview',
     };