@withbuddi/buddi 0.1.0-pre.29 → 0.1.0-pre.31

package/packages/gateway/dist/web/secrets.d.ts

@@ -22,7 +22,66 @@ export interface RouteReply {
     status: number;
     body: unknown;
 }
-/** `GET /api/secrets` — the page's one read: secrets, destinations, buddi's own keys. */
+/**
+ * What holds a secret by name: the thing whose row says "my credential is the
+ * owner secret called this". The page names a secret by it (a mailbox's
+ * address, a model account's label, a connection's name) instead of the
+ * generated name, and a secret nothing holds any more is "not used by
+ * anything" — a suggestion to remove it, never a removal.
+ */
+export type SecretUser = 
+/** `loginFailedAt`: the mail server turned the password down at that time (the Email page's own record), until a login works again. */
+{
+    kind: 'mailbox';
+    id: string;
+    address: string;
+    provider: string;
+    auth: 'app-password' | 'xoauth2';
+    loginFailedAt: string | null;
+} | {
+    kind: 'model-account';
+    id: string;
+    label: string;
+    auth: string;
+} | {
+    kind: 'connection';
+    id: string;
+    name: string;
+    variable: string | null;
+};
+/**
+ * Every row that names an owner secret as its credential, by secret name, and
+ * whether every lookup answered. A table that is not installed holds nothing;
+ * any other failure — a timeout, a lost connection — leaves `complete` false,
+ * because "nothing found" is then not an answer (`isUnused`).
+ */
+export declare function readSecretUsers(pool: Pick<Pool, 'query'>): Promise<{
+    users: Map<string, SecretUser[]>;
+    complete: boolean;
+}>;
+/** `readSecretUsers`, the users alone. */
+export declare function secretUsers(pool: Pick<Pool, 'query'>): Promise<Map<string, SecretUser[]>>;
+interface ListedSecret {
+    name: string;
+    bindings: Array<{
+        kind: string;
+        target: unknown;
+    }>;
+}
+/**
+ * Whether nothing can reach a secret any more: it has bindings, and every one
+ * of them is dead — a held kind whose mailbox, account or connection no longer
+ * names this secret, or a kind no installed plugin registers. A secret with no
+ * binding at all is unused only when it was never the owner's own: a name a
+ * mailbox, an account or a connection generated, or the old `.env` mailbox
+ * password. An owner's fresh secret with no binding is "not usable yet", a
+ * different sentence the page says itself.
+ *
+ * `complete` false — a lookup of what holds secrets failed — means nobody
+ * knows: never unused then, only confirmed absence counts.
+ */
+export declare function isUnused(secret: ListedSecret, users: readonly SecretUser[], registered: ReadonlySet<string>, complete?: boolean): boolean;
+/** `GET /api/secrets` — the page's one read: secrets, destinations, buddi's own keys, and what holds each secret. */
 export declare function listSecrets(deps: SecretsDeps): Promise<RouteReply>;
 /** `GET /api/secrets/uses` — the use log, whole or one secret's. */
 export declare function secretUses(deps: SecretsDeps, url: URL): Promise<RouteReply>;
@@ -30,4 +89,5 @@ export declare function secretUses(deps: SecretsDeps, url: URL): Promise<RouteRe
 export declare function secretsAct(deps: SecretsDeps, body: unknown, session: {
     id: string;
 }): Promise<RouteReply>;
+export {};
 //# sourceMappingURL=secrets.d.ts.map

package/packages/gateway/dist/web/secrets.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"secrets.d.ts","sourceRoot":"","sources":["../../src/web/secrets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC;AAC/B,OAAO,EAAmC,KAAK,YAAY,EAAE,KAAK,eAAe,EAAE,MAAM,aAAa,CAAC;AAEvG,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,IAAI,CAAC;IACX,QAAQ,EAAE,YAAY,CAAC;IACvB,GAAG,EAAE,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;IACjC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB;AAED,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,OAAO,CAAC;CACf;AAgCD,yFAAyF;AACzF,wBAAsB,WAAW,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAGxE;AAED,oEAAoE;AACpE,wBAAsB,UAAU,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,UAAU,CAAC,CAKjF;AAED,+DAA+D;AAC/D,wBAAsB,UAAU,CAC9B,IAAI,EAAE,WAAW,EACjB,IAAI,EAAE,OAAO,EACb,OAAO,EAAE;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,GACtB,OAAO,CAAC,UAAU,CAAC,CAOrB"}
+{"version":3,"file":"secrets.d.ts","sourceRoot":"","sources":["../../src/web/secrets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC;AAC/B,OAAO,EAAmC,KAAK,YAAY,EAAE,KAAK,eAAe,EAAE,MAAM,aAAa,CAAC;AAKvG,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,IAAI,CAAC;IACX,QAAQ,EAAE,YAAY,CAAC;IACvB,GAAG,EAAE,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;IACjC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB;AAED,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,OAAO,CAAC;CACf;AAgCD;;;;;;GAMG;AACH,MAAM,MAAM,UAAU;AACpB,uIAAuI;AACrI;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,cAAc,GAAG,SAAS,CAAC;IAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAClI;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAClE;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC;AAW9E;;;;;GAKG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC;IAAE,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAA;CAAE,CAAC,CAiDjI;AAED,0CAA0C;AAC1C,wBAAsB,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC,CAE/F;AAED,UAAU,YAAY;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CACpD;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,QAAQ,CAAC,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,SAAS,UAAU,EAAE,EAAE,UAAU,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE,QAAQ,UAAO,GAAG,OAAO,CAKtI;AAKD,qHAAqH;AACrH,wBAAsB,WAAW,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAiBxE;AAED,oEAAoE;AACpE,wBAAsB,UAAU,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,UAAU,CAAC,CAKjF;AAED,+DAA+D;AAC/D,wBAAsB,UAAU,CAC9B,IAAI,EAAE,WAAW,EACjB,IAAI,EAAE,OAAO,EACb,OAAO,EAAE;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,GACtB,OAAO,CAAC,UAAU,CAAC,CAOrB"}

package/packages/gateway/dist/web/secrets.js

@@ -1,4 +1,7 @@
 import { OWNER_AGENT_ID, SECRETS_QUERIES } from '@buddi/core';
+import { listAccounts } from '@buddi/tool-email';
+import { LEGACY_PASSWORD_VAR } from '../owner-secrets.js';
+import { mailProvider } from './recovery.js';
 const reply = (status, body) => ({ status, body });
 /** Writes from one session: the act route's own budget, reused here. */
 const lastWrite = new Map();
@@ -31,10 +34,115 @@ async function invoke(deps, tool, args, session) {
     return reply(400, { error: result.message });
 }
 const SETTINGS_TOOLS = new Set(['secrets.put', 'secrets.rename', 'secrets.rebind', 'secrets.delete', 'secrets.scrub_history']);
-/** `GET /api/secrets` — the page's one read: secrets, destinations, buddi's own keys. */
+/** The kinds whose target names the thing that holds the secret: the binding is alive only while that thing still points back. */
+const HELD_KINDS = new Set(['email.account', 'accounts.provider', 'mcp.env']);
+/** A table or schema that is not installed: a confirmed absence, not a failed lookup. */
+function notInstalled(err) {
+    const code = err?.code;
+    return code === '42P01' || code === '3F000';
+}
+/**
+ * Every row that names an owner secret as its credential, by secret name, and
+ * whether every lookup answered. A table that is not installed holds nothing;
+ * any other failure — a timeout, a lost connection — leaves `complete` false,
+ * because "nothing found" is then not an answer (`isUnused`).
+ */
+export async function readSecretUsers(pool) {
+    const users = new Map();
+    let complete = true;
+    const failed = (err) => {
+        if (!notInstalled(err))
+            complete = false;
+    };
+    const add = (name, user) => {
+        if (!name)
+            return;
+        users.set(name, [...(users.get(name) ?? []), user]);
+    };
+    try {
+        for (const account of await listAccounts(pool, { enabledOnly: false })) {
+            const user = { kind: 'mailbox', id: account.id, address: account.address, provider: mailProvider(account.imapHost), auth: account.authMode, loginFailedAt: account.loginFailedAt ?? null };
+            add(account.secretName, user);
+            // A mailbox the old `.env` named still falls back to `GMAIL_APP_PASSWORD`
+            // until its own password is set (`adoptEnvMailbox`, `missingMailboxes`).
+            if (account.addedVia === 'env' && account.secretName !== LEGACY_PASSWORD_VAR)
+                add(LEGACY_PASSWORD_VAR, user);
+        }
+    }
+    catch (err) {
+        // No email schema: no mailboxes here.
+        failed(err);
+    }
+    try {
+        const { rows } = await pool.query(`select id, label, auth, secret_ref from core.provider_accounts where not deleting`);
+        for (const row of rows)
+            add(row.secret_ref, { kind: 'model-account', id: row.id, label: row.label, auth: row.auth });
+    }
+    catch (err) {
+        // An installation that predates model accounts.
+        failed(err);
+    }
+    try {
+        const { rows } = await pool.query(`select id::text as id, name, vault_ref, env from mcp.connections`);
+        for (const row of rows) {
+            add(row.vault_ref, { kind: 'connection', id: row.id, name: row.name, variable: null });
+            if (!Array.isArray(row.env))
+                continue;
+            for (const entry of row.env) {
+                if (typeof entry.secretRef === 'string') {
+                    add(entry.secretRef, { kind: 'connection', id: row.id, name: row.name, variable: typeof entry.name === 'string' ? entry.name : null });
+                }
+            }
+        }
+    }
+    catch (err) {
+        // No connections table: nothing connected here.
+        failed(err);
+    }
+    return { users, complete };
+}
+/** `readSecretUsers`, the users alone. */
+export async function secretUsers(pool) {
+    return (await readSecretUsers(pool)).users;
+}
+/**
+ * Whether nothing can reach a secret any more: it has bindings, and every one
+ * of them is dead — a held kind whose mailbox, account or connection no longer
+ * names this secret, or a kind no installed plugin registers. A secret with no
+ * binding at all is unused only when it was never the owner's own: a name a
+ * mailbox, an account or a connection generated, or the old `.env` mailbox
+ * password. An owner's fresh secret with no binding is "not usable yet", a
+ * different sentence the page says itself.
+ *
+ * `complete` false — a lookup of what holds secrets failed — means nobody
+ * knows: never unused then, only confirmed absence counts.
+ */
+export function isUnused(secret, users, registered, complete = true) {
+    if (users.length > 0)
+        return false;
+    if (!complete)
+        return false;
+    if (secret.bindings.length === 0)
+        return GENERATED_NAME.test(secret.name) || secret.name === LEGACY_PASSWORD_VAR;
+    return secret.bindings.every((binding) => HELD_KINDS.has(binding.kind) || !registered.has(binding.kind));
+}
+/** The names buddi itself generates for a credential it keeps for a row. */
+const GENERATED_NAME = /^(PROVIDER_ACCOUNT_|CODEX_ACCOUNT_|ANTHROPIC_ACCOUNT_|OLLAMA_DEVICE_|MCP_TOKEN_|MCP_ENV_|MCP_CONNECTION_|EMAIL_[A-Z0-9_]+_[0-9a-f]{8}$)/;
+/** `GET /api/secrets` — the page's one read: secrets, destinations, buddi's own keys, and what holds each secret. */
 export async function listSecrets(deps) {
-    const result = await SECRETS_QUERIES[0].produce({}, { ...deps.ctx, db: deps.pool, now: deps.now ?? (() => new Date()) });
-    return reply(200, result);
+    const result = (await SECRETS_QUERIES[0].produce({}, { ...deps.ctx, db: deps.pool, now: deps.now ?? (() => new Date()) }));
+    const { users, complete } = await readSecretUsers(deps.pool);
+    const registered = new Set(result.destinations.map((d) => d.kind));
+    return reply(200, {
+        ...result,
+        secrets: result.secrets.map((secret) => {
+            const usedBy = users.get(secret.name) ?? [];
+            // `usageUnknown`: it would read as unused, but a lookup failed — the page
+            // says it couldn't check instead of offering Remove.
+            const usageUnknown = !complete && isUnused(secret, usedBy, registered, true);
+            return { ...secret, usedBy, unused: isUnused(secret, usedBy, registered, complete), ...(usageUnknown ? { usageUnknown } : {}) };
+        }),
+    });
 }
 /** `GET /api/secrets/uses` — the use log, whole or one secret's. */
 export async function secretUses(deps, url) {

package/packages/gateway/dist/web/secrets.js.map

@@ -1 +1 @@
-{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../../src/web/secrets.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,cAAc,EAAE,eAAe,EAA2C,MAAM,aAAa,CAAC;AAcvG,MAAM,KAAK,GAAG,CAAC,MAAc,EAAE,IAAa,EAAc,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;AAEhF,wEAAwE;AACxE,MAAM,SAAS,GAAG,IAAI,GAAG,EAAkB,CAAC;AAC5C,SAAS,gBAAgB,CAAC,OAAe,EAAE,EAAU;IACnD,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACzC,IAAI,EAAE,GAAG,IAAI,GAAG,KAAK;QAAE,OAAO,IAAI,CAAC;IACnC,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAC3B,IAAI,SAAS,CAAC,IAAI,GAAG,KAAK,EAAE,CAAC;QAC3B,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,SAAS;YAAE,IAAI,EAAE,GAAG,IAAI,GAAG,MAAM;gBAAE,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACrF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,oFAAoF;AACpF,KAAK,UAAU,MAAM,CAAC,IAAiB,EAAE,IAAY,EAAE,IAAa,EAAE,OAAe;IACnF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAC3C,IAAI,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;QAC/C,OAAO,KAAK,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,8DAA8D,EAAE,CAAC,CAAC;IAC/F,CAAC;IACD,kFAAkF;IAClF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,IAAI,EAAE,EAAE,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,cAAc,EAAE,EAAE,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,EAAqB,CAAC,CAAC;IAC7I,IAAI,MAAM,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IAC5D,IAAI,MAAM,CAAC,MAAM,KAAK,cAAc;QAAE,OAAO,KAAK,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IACnF,IAAI,MAAM,CAAC,MAAM,KAAK,cAAc;QAAE,OAAO,KAAK,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IACnF,OAAO,KAAK,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,aAAa,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,uBAAuB,CAAC,CAAC,CAAC;AAE/H,yFAAyF;AACzF,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAiB;IACjD,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,CAAC,CAAE,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,EAAqB,CAAC,CAAC;IAC7I,OAAO,KAAK,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;AAC5B,CAAC;AAED,oEAAoE;AACpE,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAAiB,EAAE,GAAQ;IAC1D,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,SAAS,CAAC;IACvD,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC;IAC3D,MAAM,IAAI,GAAG,eAAe,CAAC,CAAC,CAAE,CAAC;IACjC,OAAO,KAAK,CAAC,GAAG,EAAE,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,EAAqB,CAAC,CAAC,CAAC;AACpL,CAAC;AAED,+DAA+D;AAC/D,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,IAAiB,EACjB,IAAa,EACb,OAAuB;IAEvB,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC,CAAC;IACtG,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,IAA0C,CAAC;IAClE,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1D,OAAO,KAAK,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,sDAAsD,EAAE,CAAC,CAAC;IACvF,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;AAC9C,CAAC"}
+{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../../src/web/secrets.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,cAAc,EAAE,eAAe,EAA2C,MAAM,aAAa,CAAC;AACvG,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAc7C,MAAM,KAAK,GAAG,CAAC,MAAc,EAAE,IAAa,EAAc,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;AAEhF,wEAAwE;AACxE,MAAM,SAAS,GAAG,IAAI,GAAG,EAAkB,CAAC;AAC5C,SAAS,gBAAgB,CAAC,OAAe,EAAE,EAAU;IACnD,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACzC,IAAI,EAAE,GAAG,IAAI,GAAG,KAAK;QAAE,OAAO,IAAI,CAAC;IACnC,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAC3B,IAAI,SAAS,CAAC,IAAI,GAAG,KAAK,EAAE,CAAC;QAC3B,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,SAAS;YAAE,IAAI,EAAE,GAAG,IAAI,GAAG,MAAM;gBAAE,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACrF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,oFAAoF;AACpF,KAAK,UAAU,MAAM,CAAC,IAAiB,EAAE,IAAY,EAAE,IAAa,EAAE,OAAe;IACnF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAC3C,IAAI,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;QAC/C,OAAO,KAAK,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,8DAA8D,EAAE,CAAC,CAAC;IAC/F,CAAC;IACD,kFAAkF;IAClF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,IAAI,EAAE,EAAE,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,cAAc,EAAE,EAAE,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,EAAqB,CAAC,CAAC;IAC7I,IAAI,MAAM,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IAC5D,IAAI,MAAM,CAAC,MAAM,KAAK,cAAc;QAAE,OAAO,KAAK,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IACnF,IAAI,MAAM,CAAC,MAAM,KAAK,cAAc;QAAE,OAAO,KAAK,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IACnF,OAAO,KAAK,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,aAAa,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,uBAAuB,CAAC,CAAC,CAAC;AAe/H,kIAAkI;AAClI,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,eAAe,EAAE,mBAAmB,EAAE,SAAS,CAAC,CAAC,CAAC;AAE9E,yFAAyF;AACzF,SAAS,YAAY,CAAC,GAAY;IAChC,MAAM,IAAI,GAAI,GAAiC,EAAE,IAAI,CAAC;IACtD,OAAO,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,OAAO,CAAC;AAC9C,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAAyB;IAC7D,MAAM,KAAK,GAAG,IAAI,GAAG,EAAwB,CAAC;IAC9C,IAAI,QAAQ,GAAG,IAAI,CAAC;IACpB,MAAM,MAAM,GAAG,CAAC,GAAY,EAAQ,EAAE;QACpC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC;YAAE,QAAQ,GAAG,KAAK,CAAC;IAC3C,CAAC,CAAC;IACF,MAAM,GAAG,GAAG,CAAC,IAA+B,EAAE,IAAgB,EAAQ,EAAE;QACtE,IAAI,CAAC,IAAI;YAAE,OAAO;QAClB,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;IACtD,CAAC,CAAC;IACF,IAAI,CAAC;QACH,KAAK,MAAM,OAAO,IAAI,MAAM,YAAY,CAAC,IAAY,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;YAC/E,MAAM,IAAI,GAAe,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,QAAQ,EAAE,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,QAAQ,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,IAAI,EAAE,CAAC;YACvM,GAAG,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;YAC9B,0EAA0E;YAC1E,yEAAyE;YACzE,IAAI,OAAO,CAAC,QAAQ,KAAK,KAAK,IAAI,OAAO,CAAC,UAAU,KAAK,mBAAmB;gBAAE,GAAG,CAAC,mBAAmB,EAAE,IAAI,CAAC,CAAC;QAC/G,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,sCAAsC;QACtC,MAAM,CAAC,GAAG,CAAC,CAAC;IACd,CAAC;IACD,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAC/B,mFAAmF,CACpF,CAAC;QACF,KAAK,MAAM,GAAG,IAAI,IAAI;YAAE,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IACvH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,gDAAgD;QAChD,MAAM,CAAC,GAAG,CAAC,CAAC;IACd,CAAC;IACD,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAC/B,kEAAkE,CACnE,CAAC;QACF,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;YACvF,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,SAAS;YACtC,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,GAAqC,EAAE,CAAC;gBAC9D,IAAI,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;oBACxC,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;gBACzI,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,gDAAgD;QAChD,MAAM,CAAC,GAAG,CAAC,CAAC;IACd,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;AAC7B,CAAC;AAED,0CAA0C;AAC1C,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAyB;IACzD,OAAO,CAAC,MAAM,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;AAC7C,CAAC;AAOD;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,QAAQ,CAAC,MAAoB,EAAE,KAA4B,EAAE,UAA+B,EAAE,QAAQ,GAAG,IAAI;IAC3H,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACnC,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5B,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,KAAK,mBAAmB,CAAC;IACjH,OAAO,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;AAC3G,CAAC;AAED,4EAA4E;AAC5E,MAAM,cAAc,GAAG,yIAAyI,CAAC;AAEjK,qHAAqH;AACrH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAiB;IACjD,MAAM,MAAM,GAAG,CAAC,MAAM,eAAe,CAAC,CAAC,CAAE,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,EAAqB,CAAC,CAG5I,CAAC;IACF,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7D,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACnE,OAAO,KAAK,CAAC,GAAG,EAAE;QAChB,GAAG,MAAM;QACT,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;YACrC,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YAC5C,0EAA0E;YAC1E,qDAAqD;YACrD,MAAM,YAAY,GAAG,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC;YAC7E,OAAO,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QAClI,CAAC,CAAC;KACH,CAAC,CAAC;AACL,CAAC;AAED,oEAAoE;AACpE,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAAiB,EAAE,GAAQ;IAC1D,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,SAAS,CAAC;IACvD,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC;IAC3D,MAAM,IAAI,GAAG,eAAe,CAAC,CAAC,CAAE,CAAC;IACjC,OAAO,KAAK,CAAC,GAAG,EAAE,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,EAAqB,CAAC,CAAC,CAAC;AACpL,CAAC;AAED,+DAA+D;AAC/D,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,IAAiB,EACjB,IAAa,EACb,OAAuB;IAEvB,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC,CAAC;IACtG,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,IAA0C,CAAC;IAClE,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1D,OAAO,KAAK,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,sDAAsD,EAAE,CAAC,CAAC;IACvF,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;AAC9C,CAAC"}

package/packages/gateway/dist/web/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/web/server.ts"],"names":[],"mappings":"AAsDA,OAAO,EAAyB,KAAK,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAC/E,OAAO,EAAwB,KAAK,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAmBtF,OAAO,EAQL,KAAK,eAAe,EAErB,MAAM,eAAe,CAAC;AAWvB,OAAO,EAAsC,KAAK,MAAM,EAAuB,MAAM,WAAW,CAAC;AAEjG,OAAO,KAAK,EAAE,YAAY,EAAE,UAAU,EAAY,eAAe,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AACrG,OAAO,EAA4H,KAAK,YAAY,EAAE,MAAM,aAAa,CAAC;AAC1K,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC;AAC/B,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,EAAiB,KAAK,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAyBzE,OAAO,EAKL,OAAO,EAKP,KAAK,WAAW,EACjB,MAAM,WAAW,CAAC;AAEnB,OAAO,EAAE,UAAU,EAAuC,MAAM,cAAc,CAAC;AAC/E,OAAO,EAAoD,KAAK,SAAS,EAAE,MAAM,aAAa,CAAC;AAC/F,OAAO,EAcL,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACpB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAqB,KAAK,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAqC3E,OAAO,EAIL,KAAK,YAAY,EAClB,MAAM,eAAe,CAAC;AAcvB,OAAO,EAcL,KAAK,aAAa,EACnB,MAAM,cAAc,CAAC;AAKtB,OAAO,EAAsB,KAAK,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAE/E,OAAO,EAA0C,KAAK,QAAQ,EAAE,MAAM,aAAa,CAAC;AAqCpF,qFAAqF;AACrF,eAAO,MAAM,eAAe,QAAS,CAAC;AACtC,MAAM,WAAW,aAAa;IAC5B;;;OAGG;IACH,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,sFAAsF;IACtF,UAAU,CAAC,EAAE,QAAQ,CAAC;IACtB,gFAAgF;IAChF,OAAO,CAAC,EAAE,iBAAiB,CAAC;IAC5B,IAAI,EAAE,IAAI,CAAC;IACX,QAAQ,EAAE,YAAY,CAAC;IACvB,OAAO,EAAE,YAAY,CAAC;IACtB,GAAG,EAAE,eAAe,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,IAAI,CAAC;IAChB,MAAM,EAAE,SAAS,CAAC;IAClB,6EAA6E;IAC7E,KAAK,EAAE,MAAM,CAAC;IACd,6CAA6C;IAC7C,IAAI,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;IAC9B;;;OAGG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,GAAG,SAAS,CAAC;IACpC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC;;;OAGG;IACH,OAAO,CAAC,EAAE,aAAa,GAAG,SAAS,CAAC;IACpC;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,eAAe,GAAG,SAAS,CAAC;IACvC;;;;OAIG;IACH,WAAW,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,SAAS,CAAC;IACpE,iEAAiE;IACjE,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B;;;OAGG;IACH,WAAW,CAAC,EAAE,kBAAkB,GAAG,SAAS,CAAC;IAC7C;;;OAGG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,GAAG,SAAS,CAAC;IACjE;;;;;OAKG;IACH,UAAU,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACjC,GAAG,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC,GAAG,SAAS,CAAC;IAC3C;;;;;;;;OAQG;IACH,IAAI,CAAC,EAAE,IAAI,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,GAAG,UAAU,GAAG,KAAK,GAAG,KAAK,GAAG,UAAU,GAAG,KAAK,CAAC,CAAC;IAC/F;;;OAGG;IACH,SAAS,CAAC,EAAE,iBAAiB,CAAC;IAC9B;;;OAGG;IACH,SAAS,CAAC,EAAE;QACV,KAAK,CAAC,EAAE,cAAc,CAAC;QACvB,IAAI,CAAC,EAAE,MAAM,OAAO,CAAC;YAAE,SAAS,EAAE,OAAO,CAAC;YAAC,IAAI,EAAE,gBAAgB,GAAG,IAAI,CAAA;SAAE,CAAC,CAAC;KAC7E,GAAG,SAAS,CAAC;CACf;AAED,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,gFAAgF;IAChF,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ;;;;OAIG;IACH,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,qDAAqD;IACrD,IAAI,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC3B,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED;;;;;;GAMG;AACH,oHAAoH;AACpH,eAAO,MAAM,aAAa,oBAAoB,CAAC;AA4D/C,wBAAgB,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAE7D;AAED,wDAAwD;AACxD,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAEnE;AAED,yDAAyD;AACzD,eAAO,MAAM,YAAY,MAAM,CAAC;AAEhC,8EAA8E;AAC9E,eAAO,MAAM,qBAAqB,KAAK,CAAC;AAExC,+DAA+D;AAC/D,eAAO,MAAM,kBAAkB,KAAK,CAAC;AACrC,eAAO,MAAM,sBAAsB,QAAS,CAAC;AAE7C,wBAAgB,YAAY,CAAC,IAAI,EAAE,aAAa,GAAG,MAAM,CAg/FxD;AAED;;;GAGG;AACH,wBAAsB,cAAc,CAClC,IAAI,EAAE,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,GAAG;IAAE,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GACtD,OAAO,CAAC,SAAS,CAAC,CA6DpB"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/web/server.ts"],"names":[],"mappings":"AAsDA,OAAO,EAAyB,KAAK,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAC/E,OAAO,EAAwB,KAAK,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAmBtF,OAAO,EAQL,KAAK,eAAe,EAErB,MAAM,eAAe,CAAC;AAYvB,OAAO,EAAsC,KAAK,MAAM,EAAuB,MAAM,WAAW,CAAC;AAEjG,OAAO,KAAK,EAAE,YAAY,EAAE,UAAU,EAAY,eAAe,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AACrG,OAAO,EAA0K,KAAK,YAAY,EAAE,MAAM,aAAa,CAAC;AAExN,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC;AAC/B,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,EAAiB,KAAK,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAyBzE,OAAO,EAKL,OAAO,EAKP,KAAK,WAAW,EACjB,MAAM,WAAW,CAAC;AAEnB,OAAO,EAAE,UAAU,EAAuC,MAAM,cAAc,CAAC;AAC/E,OAAO,EAAoD,KAAK,SAAS,EAAE,MAAM,aAAa,CAAC;AAC/F,OAAO,EAcL,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACpB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAqB,KAAK,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAuC3E,OAAO,EAIL,KAAK,YAAY,EAClB,MAAM,eAAe,CAAC;AAcvB,OAAO,EAcL,KAAK,aAAa,EACnB,MAAM,cAAc,CAAC;AAKtB,OAAO,EAAsB,KAAK,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAE/E,OAAO,EAA0C,KAAK,QAAQ,EAAE,MAAM,aAAa,CAAC;AAyCpF,qFAAqF;AACrF,eAAO,MAAM,eAAe,QAAS,CAAC;AACtC,MAAM,WAAW,aAAa;IAC5B;;;OAGG;IACH,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,sFAAsF;IACtF,UAAU,CAAC,EAAE,QAAQ,CAAC;IACtB,gFAAgF;IAChF,OAAO,CAAC,EAAE,iBAAiB,CAAC;IAC5B,IAAI,EAAE,IAAI,CAAC;IACX,QAAQ,EAAE,YAAY,CAAC;IACvB,OAAO,EAAE,YAAY,CAAC;IACtB,GAAG,EAAE,eAAe,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,IAAI,CAAC;IAChB,MAAM,EAAE,SAAS,CAAC;IAClB,6EAA6E;IAC7E,KAAK,EAAE,MAAM,CAAC;IACd,6CAA6C;IAC7C,IAAI,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;IAC9B;;;OAGG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,GAAG,SAAS,CAAC;IACpC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC;;;OAGG;IACH,OAAO,CAAC,EAAE,aAAa,GAAG,SAAS,CAAC;IACpC;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,eAAe,GAAG,SAAS,CAAC;IACvC;;;;OAIG;IACH,WAAW,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,SAAS,CAAC;IACpE,iEAAiE;IACjE,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B;;;OAGG;IACH,WAAW,CAAC,EAAE,kBAAkB,GAAG,SAAS,CAAC;IAC7C;;;OAGG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,GAAG,SAAS,CAAC;IACjE;;;;;OAKG;IACH,UAAU,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACjC,GAAG,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC,GAAG,SAAS,CAAC;IAC3C;;;;;;;;OAQG;IACH,IAAI,CAAC,EAAE,IAAI,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,GAAG,UAAU,GAAG,KAAK,GAAG,KAAK,GAAG,UAAU,GAAG,KAAK,CAAC,CAAC;IAC/F;;;OAGG;IACH,SAAS,CAAC,EAAE,iBAAiB,CAAC;IAC9B;;;OAGG;IACH,SAAS,CAAC,EAAE;QACV,KAAK,CAAC,EAAE,cAAc,CAAC;QACvB,IAAI,CAAC,EAAE,MAAM,OAAO,CAAC;YAAE,SAAS,EAAE,OAAO,CAAC;YAAC,IAAI,EAAE,gBAAgB,GAAG,IAAI,CAAA;SAAE,CAAC,CAAC;KAC7E,GAAG,SAAS,CAAC;CACf;AAED,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,gFAAgF;IAChF,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ;;;;OAIG;IACH,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,qDAAqD;IACrD,IAAI,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC3B,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED;;;;;;GAMG;AACH,oHAAoH;AACpH,eAAO,MAAM,aAAa,oBAAoB,CAAC;AAwE/C,wBAAgB,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAE7D;AAED,wDAAwD;AACxD,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAEnE;AAED,yDAAyD;AACzD,eAAO,MAAM,YAAY,MAAM,CAAC;AAEhC,8EAA8E;AAC9E,eAAO,MAAM,qBAAqB,KAAK,CAAC;AAExC,+DAA+D;AAC/D,eAAO,MAAM,kBAAkB,KAAK,CAAC;AACrC,eAAO,MAAM,sBAAsB,QAAS,CAAC;AAE7C,wBAAgB,YAAY,CAAC,IAAI,EAAE,aAAa,GAAG,MAAM,CAumGxD;AAED;;;GAGG;AACH,wBAAsB,cAAc,CAClC,IAAI,EAAE,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,GAAG;IAAE,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GACtD,OAAO,CAAC,SAAS,CAAC,CA+DpB"}

package/packages/gateway/dist/web/server.js

@@ -61,11 +61,12 @@ import { mlxhBaseUrl, probeMlxh } from '../mlxh.js';
 import { OnboardingRefusal, WEB_ONBOARDING_STEPS, WEB_ONBOARDING_SURFACE, claimOpeningTurn, createFirstAgent, probeOllama, readOnboarding, rebindBrain, updateFirstAgent, withFirstRunFacts, readFirstAgentPersona } from './onboarding.js';
 import { TakeOnRefusal, readTakeOn, startTakeOn } from './take-on.js';
 import { TelegramWebError, saveTelegramToken, telegramBot, telegramDevices, telegramPairing, telegramStatus, unpairTelegramDevice, } from './telegram.js';
-import { PAGE_ROUTE, sendPageFile, actOnPage, listPageDescriptors, runPageQuery, } from './pages.js';
+import { PAGE_ROUTE, sendPageFile, actOnPage, actRateLimited, listPageDescriptors, runPageQuery, } from './pages.js';
 import { listSecrets, secretUses, secretsAct } from './secrets.js';
 import { sayRoute, transcribeRoute } from './speech.js';
 import { createServer } from 'node:http';
-import { getAction, idleRolloverMs, inRecovery, listPendingActions, isJobState, parseAgentFile, setSentinelEnabled, snoozeFinding } from '@buddi/core';
+import { getAction, idleRolloverMs, inRecovery, listMissions, listPendingActions, isJobState, parseAgentFile, setSentinelEnabled, snoozeFinding, snoozeFindings, unmuteFindings } from '@buddi/core';
+import { actOnAlerts, askPrompt, findingsForAsk, muteAlert } from './alerts.js';
 import { connectionsOf } from '@buddi/tool-mcp';
 import { CONNECTIONS_CALLBACK_PATH, connectionsRoute } from './connections.js';
 import { browserHost } from '../browser-host.js';
@@ -93,7 +94,7 @@ import { retryHref, sendSignedOut, wantsSignedOutPage } from './signed-out.js';
 import { extensionEndpoint } from './extension.js';
 import { REMOTE_HAND_SOCKET_PATH, RemoteHandEndpoint } from './remote-hand.js';
 import { csrfCookieName, CSRF_HEADER, sessionCookieName, requestPort, BodyTooLargeError, first, cookieHeader, parseCookies, parseUrl, readJsonBody, remoteKey, requestOrigin, requestScope, sendEmpty, sendJson, sendText, } from './http.js';
-import { boundedLimit, readAgents, readApprovals, readConversation, readConversations, readEventKinds, readEvents, readJobs, readMissions, readOverview, setGlanceHidden, readOffers, readReminders, readSentinels, toApprovalView, } from './read.js';
+import { boundedLimit, readAgents, readApprovals, readConversation, readConversations, readEventKinds, readEvents, readJobs, readJobFailures, readMissions, readOverview, setGlanceHidden, setHomeDismissed, readOffers, readReminders, readSentinels, toApprovalView, } from './read.js';
 import { RateLimiter, SessionStore, } from './sessions.js';
 import { supervisorCall } from './service.js';
 import { backupJobRoute, createBackupRoute, discardUpload, listBackups, passphraseRoute, receiveUpload, restoreRoute, scheduleRoute, verifyBackupRoute, } from './backups.js';
@@ -109,16 +110,17 @@ import { readFacts, webSettingsStore } from '../tips/facts.js';
 import { dismissAgentOffer, isPendingAccept, raiseAgentOffers, readAgentOffers, readTeammates } from './agent-offers.js';
 import { currentVersion, upgradeJobRoute, upgradeRoute, versionCheckRoute, versionRoute, } from './version.js';
 import { leaveRecoveryMode, readRecoveryView } from './recovery.js';
+import { readNeedsYou } from './needs-you.js';
 import { readRail, setRailPageHidden } from './rail.js';
 import { BUILD_MISSING, serveAsset, serveShellAtRoot } from './static.js';
-import { StreamBudget, resumeCursor, streamConversation } from './stream.js';
+import { StreamBudget, frame, resumeCursor, streamConversation } from './stream.js';
 import { ensureWebToken, verifyTicket } from './token.js';
 import { MAX_UPLOAD_BYTES, readUpload } from './upload.js';
 import { LOCKED_BODY, LockUnavailable, allowedWhileLocked, clientOf, createLock } from './lock.js';
 import { matchApiRoute, TOKEN_REFUSALS } from './api-routes.js';
 import { apiTokensRoute, bearerOf, verifyApiToken } from './api-tokens.js';
 import { LockImageRefusal, MAX_LOCK_IMAGE_BYTES, normaliseLockImage } from './lock-image.js';
-import { cancelJobFromWeb, cancelReminderFromWeb, decideApprovalFromWeb, retryJobFromWeb, setMissionEnabledFromWeb, setPausedFromWeb, setScheduleFromWeb, dismissOfferFromWeb, dismissOffersFromWeb, takeOfferFromWeb, } from './write.js';
+import { cancelJobFromWeb, cancelReminderFromWeb, decideApprovalFromWeb, retryJobFromWeb, retryJobsFromWeb, dismissJobsFromWeb, undismissJobsFromWeb, setMissionEnabledFromWeb, setPausedFromWeb, setScheduleFromWeb, dismissOfferFromWeb, dismissOffersFromWeb, takeOfferFromWeb, } from './write.js';
 /** How often approvals past their expiry are swept, and waiting delegations told. */
 export const EXPIRY_SWEEP_MS = 60_000;
 /**
@@ -137,6 +139,16 @@ const WEB_CHATS = new WeakMap();
  * it down, and a caller that built a bare `createWebApp` is unaffected.
  */
 const PREVIEW_APPS = new WeakMap();
+/**
+ * What a dashboard says to its open pages just before it closes: one
+ * `closing` frame on every live stream, naming the restart or stop the page
+ * itself asked for when it was one (`for`), so a page another device or the
+ * CLI restarted under draws "Restarting buddi" rather than errors, and
+ * reloads once the next process answers `/_buddi/ready` with a new `boot`.
+ */
+const CLOSING_SAYS = new WeakMap();
+/** How long a closing frame may take to reach the pages before the sockets go. */
+const CLOSING_FLUSH_MS = 250;
 /** The chat surface this server is running, if any. */
 /** The most of a text file a preview shows; the download has the whole. */
 const PREVIEW_TEXT_BYTES = 100_000;
@@ -302,8 +314,33 @@ export function createWebApp(deps) {
      * stream are asked again, so one left idle past the delay is locked and cut
      * off even if its page never says a word.
      */
-    const lock = createLock({ pool: deps.pool, sessions, now: deps.now, get timezone() { return deps.timezone; }, widgets, log });
+    /*
+     * What needs the owner, counted once (web/needs-you.ts): Home's counts, the
+     * rail's badge and the lock screen all read this, so they agree.
+     */
+    const needsYou = () => readNeedsYou({
+        pool: deps.pool,
+        registry: deps.registry,
+        now: deps.now(),
+        agentOffers: async () => (await readAgentOffers({
+            registry: deps.registry, ctx: deps.ctx, now: deps.now, log, pool: deps.pool, agentIds: () => deps.catalog.list().map((a) => a.id),
+        })).offers,
+        signals: async () => {
+            const service = deps.connections ?? connectionsOf(deps.registry.manifests());
+            return service ? service.signals() : [];
+        },
+        recoveryActive: () => inRecovery(deps.pool),
+    });
+    const lock = createLock({ pool: deps.pool, sessions, now: deps.now, get timezone() { return deps.timezone; }, widgets, needsYou, log });
     const openStreams = new Map();
+    /*
+     * This process's boot: answered by `/_buddi/ready`, so a page that watches a
+     * restart can tell the process that went from the one that came back.
+     * Random, and nothing else: it says which run this is, not when or where.
+     */
+    const boot = randomUUID();
+    /** Set when a page asked the supervisor to restart or stop this process: what the closing frame says. */
+    let goingAway;
     /*
      * The session a live API token acts through: minted on its first request,
      * kept in memory only, one per token (and scope), so a stream budget or a
@@ -572,6 +609,31 @@ export function createWebApp(deps) {
     if (chat)
         WEB_CHATS.set(server, chat);
     PREVIEW_APPS.set(server, previews);
+    CLOSING_SAYS.set(server, async () => {
+        const said = frame('closing', goingAway === undefined ? {} : { for: goingAway });
+        const flushed = [];
+        for (const { responses } of openStreams.values()) {
+            for (const res of responses) {
+                if (res.writableEnded || res.destroyed)
+                    continue;
+                // Ended, not just written: an ended response is flushed before its
+                // socket goes, where a frame still queued would be dropped with it.
+                flushed.push(new Promise((resolve) => {
+                    try {
+                        res.end(said, () => resolve());
+                    }
+                    catch {
+                        resolve();
+                    }
+                }));
+            }
+        }
+        if (flushed.length === 0)
+            return;
+        let timer;
+        await Promise.race([Promise.all(flushed), new Promise((resolve) => { timer = setTimeout(resolve, CLOSING_FLUSH_MS); })]);
+        clearTimeout(timer);
+    });
     // "Your browser": the only path this server ever upgrades. Attached here
     // rather than in `startWebServer` so every caller, tests included, has it.
     extension.attach(server);
@@ -594,7 +656,7 @@ export function createWebApp(deps) {
             const challenge = url.searchParams.get('challenge') ?? '';
             if (!/^[a-f0-9]{64}$/.test(challenge))
                 return sendEmpty(res, 400);
-            return sendJson(res, 200, { proof: createHmac('sha256', deps.token).update(`buddi-ready-v1:${challenge}`).digest('hex') });
+            return sendJson(res, 200, { proof: createHmac('sha256', deps.token).update(`buddi-ready-v1:${challenge}`).digest('hex'), boot }, { 'Cache-Control': 'no-store' });
         }
         // A remote socket or proxy metadata can only earn remote access. It
         // decides how long a session minted now lives, and it must keep matching
@@ -1311,6 +1373,8 @@ export function createWebApp(deps) {
                         // Every surface's runs (Telegram, the queue, the terminal), not only
                         // this dashboard's; a chat send still being set up counts too.
                         running: Math.max(runningAgentRuns(), chat?.runningCount ?? 0),
+                        // What needs the owner, by the one rule: Home's counts and the rail's badge.
+                        needsYou: await needsYou(),
                     });
                 case '/api/events':
                     return sendJson(res, 200, await readEvents(deps.pool, {
@@ -1335,8 +1399,16 @@ export function createWebApp(deps) {
                         kind: q.get('kind') ?? undefined,
                         limit: boundedLimit(q.get('limit')),
                         offset: Math.max(0, Math.min(Number(q.get('offset') ?? 0) || 0, 100_000)),
+                        failed: q.get('failed') === 'open' || q.get('failed') === 'dismissed' ? q.get('failed') : undefined,
+                        hideDismissed: q.get('dismissed') === '0',
                     }));
                 }
+                // Failed jobs grouped by what broke them: the ones still asking, and
+                // the dismissed ones (by the owner, or quiet after 14 days) apart.
+                case '/api/jobs/failures': {
+                    const names = new Map(deps.catalog.list().map((a) => [a.id, a.name]));
+                    return sendJson(res, 200, await readJobFailures(deps.pool, now, (id) => names.get(id) ?? null));
+                }
                 case '/api/approvals': {
                     const approvals = await readApprovals(deps.pool, now, boundedLimit(q.get('limit'), 50));
                     return sendJson(res, 200, { pending: approvals.pending.map(a => ({ ...a, ...permissionScopes(a.tool) })),
@@ -1358,7 +1430,7 @@ export function createWebApp(deps) {
                         },
                     });
                 case '/api/notifications':
-                    return reply(res, await listNotificationsRoute(deps.pool, q.get('limit')));
+                    return reply(res, await listNotificationsRoute(deps.pool, q.get('limit'), { needs: q.get('needs') === '1', offset: q.get('offset') }));
                 case '/api/notifications/settings':
                     return reply(res, await notificationSettingsRoute(deps.pool, 'GET'));
                 case '/api/notifications/focus':
@@ -1368,7 +1440,7 @@ export function createWebApp(deps) {
                         reminders: await readReminders(deps.pool, boundedLimit(q.get('limit'))),
                     });
                 case '/api/sentinels':
-                    return sendJson(res, 200, await readSentinels(deps.pool, deps.registry, boundedLimit(q.get('limit'), 50)));
+                    return sendJson(res, 200, await readSentinels(deps.pool, deps.registry, deps.now()));
                 case '/api/chat/agents':
                     return sendJson(res, 200, readChatAgents(deps.catalog, await avatarVersions(deps.pool)));
                 // Which agents are waiting on the owner. One small query, and the only
@@ -2267,14 +2339,64 @@ export function createWebApp(deps) {
                 return sendJson(res, 400, { error: 'Expected agentId and conversationId.' });
             return sendJson(res, 200, { stopped: host.stop(deps.ctx.ownerId, body.agentId, body.conversationId) });
         }
+        /*
+         * Alerts (alerts.ts): the owner's verbs on what the watchers found. Snooze
+         * one ("Not now" for a week with `days`, "Not needed" without), several at
+         * once (Clear all, and its Undo), silence a subject or a kind, run what a
+         * finding declared, or ask the agent that answers for it.
+         */
         const alert = /^\/api\/alerts\/([^/]+)\/snooze$/.exec(path);
         if (alert) {
             if (typeof body.snoozed !== 'boolean')
                 return sendJson(res, 400, { error: '`snoozed` must be true or false' });
-            const finding = await snoozeFinding(deps.pool, decodeURIComponent(alert[1]), body.snoozed, deps.now());
+            const days = typeof body.days === 'number' && Number.isFinite(body.days) && body.days > 0 && body.days <= 90 ? body.days : null;
+            const until = body.snoozed && days !== null ? new Date(deps.now().getTime() + days * 86_400_000) : null;
+            const finding = await snoozeFinding(deps.pool, decodeURIComponent(alert[1]), body.snoozed, deps.now(), until);
             if (!finding)
                 return sendJson(res, 404, { error: 'No open alert has that key.' });
-            return sendJson(res, 200, { key: finding.key, snoozedAt: finding.snoozedAt ? finding.snoozedAt.toISOString() : null });
+            return sendJson(res, 200, {
+                key: finding.key,
+                snoozedAt: finding.snoozedAt ? finding.snoozedAt.toISOString() : null,
+                snoozedUntil: finding.snoozedUntil ? finding.snoozedUntil.toISOString() : null,
+            });
+        }
+        if (path === '/api/alerts/snooze') {
+            const keys = Array.isArray(body.keys) ? body.keys.filter((k) => typeof k === 'string').slice(0, 500) : null;
+            if (keys === null || typeof body.snoozed !== 'boolean')
+                return sendJson(res, 400, { error: 'Send `{ keys: string[], snoozed: boolean, days? }`.' });
+            const days = typeof body.days === 'number' && Number.isFinite(body.days) && body.days > 0 && body.days <= 90 ? body.days : null;
+            const until = body.snoozed && days !== null ? new Date(deps.now().getTime() + days * 86_400_000) : null;
+            return sendJson(res, 200, { keys: await snoozeFindings(deps.pool, keys, body.snoozed, deps.now(), until) });
+        }
+        if (path === '/api/alerts/mute')
+            return reply(res, await muteAlert(deps.pool, body, deps.now()));
+        const unmute = /^\/api\/alerts\/mutes\/([^/]+)\/remove$/.exec(path);
+        if (unmute) {
+            const removed = await unmuteFindings(deps.pool, decodeURIComponent(unmute[1]));
+            return removed ? sendJson(res, 200, { removed: true }) : sendJson(res, 404, { error: 'Nothing is silenced under that id.' });
+        }
+        if (path === '/api/alerts/act') {
+            if (actRateLimited(session.id, deps.now().getTime()))
+                return sendJson(res, 429, { error: 'Too many writes from this page. Wait a moment and try again.' });
+            return reply(res, await actOnAlerts({ pool: deps.pool, registry: deps.registry, ctx: deps.ctx, now: deps.now }, body, session));
+        }
+        if (path === '/api/alerts/ask') {
+            const keys = Array.isArray(body.keys) ? body.keys.filter((k) => typeof k === 'string') : [];
+            const findings = await findingsForAsk(deps.pool, keys);
+            if (findings.length === 0)
+                return sendJson(res, 404, { error: 'No alert has those keys.' });
+            if (!chat)
+                return sendJson(res, 503, { error: 'Chat is not running in this process.' });
+            // The agent that answers for them, else whoever runs the wake mission.
+            const wake = (await listMissions(deps.pool)).find((m) => m.id === 'sentinel-wake');
+            const agentId = findings.find((f) => f.agentId !== null && deps.catalog.get(f.agentId) !== undefined)?.agentId ?? wake?.agentId ?? null;
+            if (agentId === null)
+                return sendJson(res, 409, { error: 'No agent answers for this alert yet.' });
+            const { label, prompt } = askPrompt(findings);
+            const sent = await chat.send({ agentId, text: prompt, offer: { id: `alert:${findings[0].key}`.slice(0, 200), label, brief: true } });
+            if (!sent.ok)
+                return sendJson(res, sent.status, { error: sent.error });
+            return sendJson(res, 200, { agentId, conversationId: sent.conversationId, runId: sent.runId });
         }
         /*
          * A watcher, switched off or back on. Off means it does not run: it raises
@@ -2302,6 +2424,11 @@ export function createWebApp(deps) {
             const state = await setSentinelEnabled(deps.pool, sentinelId, body.enabled, deps.now());
             return sendJson(res, 200, { sentinelId: state.sentinelId, enabled: state.enabled });
         }
+        /* One thing on Home closed until it changes (the digest's ×, a notice's Not now), or shown again. */
+        if (path === '/api/home/dismiss') {
+            const result = await setHomeDismissed(deps.pool, body.slot, body.token === undefined ? undefined : body.token);
+            return sendJson(res, result.status, result.body);
+        }
         /* One Home glance, hidden or shown again (Home's ×, Settings → Appearance). */
         const glanceHidden = /^\/api\/home\/glances\/([^/]+)\/hidden$/.exec(path);
         if (glanceHidden) {
@@ -2530,8 +2657,10 @@ export function createWebApp(deps) {
             }
             const outcome = await leaveRecoveryMode({ pool: deps.pool, env: deps.env ?? process.env, log }, deps.ctx.ownerId, { dropPending: body.dropPending !== false, keepGrants: keep }, now);
             if (socket) {
+                goingAway = 'restart';
                 res.once('finish', () => {
                     void supervisorCall(socket, '/restart', 'POST').catch((err) => {
+                        goingAway = undefined;
                         log(`web: supervisor restart after leaving recovery failed: ${err instanceof Error ? err.message : String(err)}`);
                     });
                 });
@@ -2571,8 +2700,10 @@ export function createWebApp(deps) {
                     return sendJson(res, 503, { error: 'The supervisor is not answering on its control socket. Run buddi in a terminal.' });
                 }
             }
+            goingAway = action === 'stop' ? 'stop' : 'restart';
             res.once('finish', () => {
                 void supervisorCall(socket, `/${action}`, 'POST').catch((err) => {
+                    goingAway = undefined;
                     log(`web: supervisor ${action} failed: ${err instanceof Error ? err.message : String(err)}`);
                 });
             });
@@ -3013,6 +3144,14 @@ export function createWebApp(deps) {
                 return sendJson(res, 400, { error: change });
             return finish(res, setAgentEngineFromWeb({ catalog: deps.catalog, env: deps.env ?? process.env }, decodeURIComponent(engine[1]), change));
         }
+        // Failed jobs in bulk — by ids, by cause group, or every one still asking.
+        // Dismiss keeps them on record and out of the footer's count.
+        if (path === '/api/jobs/dismiss')
+            return finish(res, await dismissJobsFromWeb(writeDeps, body));
+        if (path === '/api/jobs/undismiss')
+            return finish(res, await undismissJobsFromWeb(writeDeps, body));
+        if (path === '/api/jobs/retry')
+            return finish(res, await retryJobsFromWeb(writeDeps, body));
         const job = /^\/api\/jobs\/([^/]+)\/(retry|cancel)$/.exec(path);
         if (job) {
             const jobId = decodeURIComponent(job[1]);
@@ -3276,6 +3415,8 @@ export async function startWebServer(deps) {
         close: async () => {
             if (expirySweep)
                 clearInterval(expirySweep);
+            // Said before anything closes, while the streams can still carry it.
+            await CLOSING_SAYS.get(server)?.();
             // Both listeners, both awaited. A preview socket still open is a port
             // still held, and the next thing to want it — the next test, the
             // gateway coming back up — finds it taken.