keywright-server 0.0.1__py3-none-any.whl

keywright_server/web/templates/_hazards.html

@@ -0,0 +1,6 @@
+{# Destructive-operation flags on a request. `level` decides the tone: high/critical override standing access. #}
+{% set hz = hazards_of(req.detail) %}{% if hz %}{% set level = hazard_level(req.detail) %}
+<div class="hazard {{ level }}"><b>{% if hazard_blocks(level) %}⚠ Flagged destructive ({{ level }}){% else %}Flagged ({{ level }}){% endif %}</b>
+<ul>{% for h in hz %}<li><span class="pill {{ h.severity }}">{{ h.severity }}</span> {{ h.reason }}</li>{% endfor %}</ul>
+<div class="help">{% if hazard_blocks(level) %}Standing rules and timed grants do not cover this. It can be allowed once, for exactly the operation shown, or denied.{% else %}Runs under existing access; recorded in the audit log as flagged.{% endif %}</div></div>
+{% endif %}

keywright_server/web/templates/_icons.html

@@ -0,0 +1,19 @@
+{% macro icon(name) -%}
+<svg class="ui-icon" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.7" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true">
+{% if name == 'shield' %}<path d="m12 3 8 3v5c0 5-4 8-8 10-4-2-8-5-8-10V6l8-3Z"/><rect x="9" y="10" width="6" height="5" rx="1"/><path d="M10 10V8a2 2 0 0 1 4 0v2"/>
+{% elif name == 'dashboard' %}<rect x="3" y="3" width="7" height="7" rx="1"/><rect x="14" y="3" width="7" height="7" rx="1"/><rect x="3" y="14" width="7" height="7" rx="1"/><rect x="14" y="14" width="7" height="7" rx="1"/>
+{% elif name == 'requests' %}<rect x="4" y="3" width="16" height="18" rx="1"/><path d="M8 8h8M8 12h8M8 16h5"/>
+{% elif name == 'activity' %}<path d="M3 12h4l3-7 4 14 3-7h4"/>
+{% elif name == 'ssh' %}<rect x="3" y="4" width="18" height="16" rx="3"/><path d="m7 9 3 3-3 3m6 0h4"/>
+{% elif name == 'mcp' %}<rect x="8" y="8" width="8" height="8" rx="2"/><path d="M12 3v5m0 8v5M3 12h5m8 0h5M5 5l3 3m8 8 3 3M5 19l3-3m8-8 3-3"/>
+{% elif name == 'omada' %}<circle cx="12" cy="6" r="3"/><circle cx="6" cy="17" r="3"/><circle cx="18" cy="17" r="3"/><path d="m10.5 8.6-3 5.8m6-5.8 3 5.8M9 17h6"/>
+{% elif name == 'llm' %}<circle cx="12" cy="12" r="9"/><path d="M12 6.5v11M9.5 9.25h3.75a1.75 1.75 0 0 1 0 3.5h-2.5a1.75 1.75 0 0 0 0 3.5H14.5"/>
+{% elif name == 'search' %}<circle cx="10.5" cy="10.5" r="6.5"/><path d="m16 16 5 5"/>
+{% elif name == 'chevron' %}<path d="m9 5 7 7-7 7"/>
+{% elif name == 'more' %}<circle cx="5" cy="12" r="1"/><circle cx="12" cy="12" r="1"/><circle cx="19" cy="12" r="1"/>
+{% elif name == 'check' %}<circle cx="12" cy="12" r="9"/><path d="m8 12 3 3 5-6"/>
+{% elif name == 'deny' %}<circle cx="12" cy="12" r="9"/><path d="m6 6 12 12"/>
+{% elif name == 'warning' %}<path d="m12 3 10 18H2L12 3Zm0 6v5m0 3v.1"/>
+{% else %}<path d="m5 6 7 6-7 6V6Zm10 12h5"/>{% endif %}
+</svg>
+{%- endmacro %}

keywright_server/web/templates/_infrastructure_nav.html

@@ -0,0 +1,8 @@
+<div class="infra-nav" aria-label="Infrastructure views">
+<a href="/ui/resources" {{ 'aria-current=page' if request.url.path.startswith('/ui/resources') }}>Resources</a>
+<a href="/ui/inventory" {{ 'aria-current=page' if request.url.path == '/ui/inventory' or '/assets/' in request.url.path }}>Inventory</a>
+<a href="/ui/inventory/map" {{ 'aria-current=page' if request.url.path == '/ui/inventory/map' }}>Network map</a>
+<a href="/ui/inventory/topology" {{ 'aria-current=page' if request.url.path == '/ui/inventory/topology' }}>Topology</a>
+<a href="/ui/inventory/networks" {{ 'aria-current=page' if '/networks' in request.url.path }}>IP allocations</a>
+<a href="/ui/inventory/discovery" {{ 'aria-current=page' if request.url.path.startswith('/ui/inventory/discovery') }}>Discovery</a>
+</div>

keywright_server/web/templates/_integration_style.html

@@ -0,0 +1,30 @@
+<style>
+.integration-page{max-width:820px;margin:0 auto}
+.integration-back{display:inline-flex;align-items:center;gap:6px;margin:4px 0 20px;color:var(--mut);font-size:13px}
+.integration-back .ui-icon{width:14px;height:14px;transform:rotate(180deg)}
+.integration-heading{display:flex;align-items:start;justify-content:space-between;gap:16px;margin-bottom:22px}
+.integration-heading h1{font-size:28px;margin-bottom:7px}.integration-heading p{margin:0;color:var(--mut);font-size:15px}
+.integration-search{display:flex;align-items:center;gap:12px;border:1px solid var(--line);background:var(--panel);border-radius:10px;padding:4px 14px;margin-bottom:28px}
+.integration-search .ui-icon{width:20px;height:20px;color:var(--mut);flex-shrink:0}
+.integration-search input[type=search]{width:100%;min-height:48px;border:0;background:transparent;color:var(--fg);font:inherit;font-size:16px;outline:none}
+.integration-search:focus-within{outline:2px solid var(--acc);outline-offset:2px}
+.integration-group{margin-bottom:28px}.integration-group h2{font-size:13px;color:var(--mut);font-weight:600;margin:0 0 10px;letter-spacing:.02em}
+.integration-list{border:1px solid var(--line);border-radius:12px;overflow:hidden;background:var(--panel)}
+.integration-choice{display:flex;align-items:center;gap:16px;padding:19px 20px;color:var(--fg);min-height:94px}
+.integration-choice+.integration-choice{border-top:1px solid var(--line)}
+.integration-choice:hover{background:var(--panel-raised);text-decoration:none}
+.integration-choice:focus-visible{outline:2px solid var(--acc);outline-offset:-3px;border-radius:8px}
+.integration-mark{display:flex;align-items:center;justify-content:center;flex:0 0 48px;width:48px;height:48px;border-radius:12px;background:var(--panel-raised);color:var(--acc)}
+.integration-mark .ui-icon{width:27px;height:27px}.integration-mark.notion{background:#fafafa;color:#191919;border:1px solid #c9c9c9;font:700 35px/1 Georgia,serif;border-radius:10px}
+.integration-mark.omada{background:#e1f5ef;color:#087b68}.integration-mark.shield{background:#e5ecff;color:#315f99}
+.integration-copy{flex:1;min-width:0}.integration-copy strong{display:block;font-size:16px;font-weight:600;line-height:1.3}.integration-copy p{margin:5px 0 0;color:var(--mut);font-size:13px}
+.integration-method{color:var(--mut);font-size:12px;white-space:nowrap}.integration-arrow{display:flex;color:var(--mut)}.integration-arrow .ui-icon{width:17px;height:17px}
+.integration-custom .integration-mark{width:40px;height:40px;flex-basis:40px;border-radius:9px}.integration-custom .integration-choice{min-height:80px;padding-top:15px;padding-bottom:15px}
+.integration-count{font-size:12px;color:var(--mut);margin:12px 0 0}.integration-empty{text-align:center;padding:30px 20px;border:1px dashed var(--line);border-radius:12px}.integration-empty p{color:var(--mut)}
+.integration-intro{display:flex;align-items:center;gap:16px;margin-bottom:24px}.integration-intro h1{margin:0 0 5px;font-size:25px}.integration-intro p{margin:0;color:var(--mut)}
+.integration-steps{display:flex;gap:20px;list-style:none;padding:0;margin:0 0 24px;color:var(--mut);font-size:13px}.integration-steps li{display:flex;align-items:center;gap:7px}.integration-steps span{border:1px solid var(--line);border-radius:50%;width:24px;height:24px;display:inline-flex;align-items:center;justify-content:center}.integration-steps [aria-current=step]{color:var(--fg)}.integration-steps [aria-current=step] span{background:var(--button-bg);border-color:var(--button-bg);color:var(--button-fg)}
+.integration-form>.card{padding:22px;border-radius:12px}.integration-form label{margin-top:15px}.integration-form .grid label{margin-top:0}.integration-form input[type=text],.integration-form input[type=password],.integration-form input[type=url],.integration-form select{min-height:42px;border-radius:6px}
+.integration-advanced{margin-top:22px;border-top:1px solid var(--line);padding-top:16px}.integration-advanced summary{cursor:pointer;font-weight:550;min-height:32px}.integration-actions{margin-top:22px;display:flex;align-items:center;gap:16px;flex-wrap:wrap}.integration-actions .btn{min-height:44px;padding:9px 18px;border-radius:7px}.integration-actions p{margin:0;color:var(--mut);font-size:12px}
+[data-integration][hidden],.integration-group[hidden],.integration-empty[hidden]{display:none}
+@media(max-width:600px){.integration-heading h1{font-size:25px}.integration-heading p{font-size:14px}.integration-choice{display:grid;grid-template-columns:48px minmax(0,1fr) 17px;padding:17px 14px;gap:7px 12px}.integration-mark{grid-row:1/3}.integration-copy{grid-column:2;grid-row:1}.integration-method{grid-column:2;grid-row:2;font-size:12px;white-space:normal}.integration-arrow{grid-column:3;grid-row:1/3}.integration-custom .integration-choice{grid-template-columns:40px minmax(0,1fr) 17px}.integration-form>.card{padding:17px}.integration-intro{align-items:flex-start}.integration-intro h1{font-size:23px}.integration-steps{gap:14px}.integration-actions .btn{width:100%}}
+</style>

keywright_server/web/templates/_inventory_forms.html

@@ -0,0 +1,36 @@
+{% macro field(name, label, values, fallback='', prefix='', type='text', required=false, help='', maxlength=160) %}
+<div><label for="{{ prefix }}{{ name }}">{{ label }}</label><input id="{{ prefix }}{{ name }}" name="{{ name }}" type="{{ type }}" value="{{ values.get(name, fallback) or '' }}" maxlength="{{ maxlength }}" {{ 'required' if required }} {% if help %}aria-describedby="{{ prefix }}{{ name }}-help"{% endif %}>{% if help %}<div class="help" id="{{ prefix }}{{ name }}-help">{{ help }}</div>{% endif %}</div>
+{% endmacro %}
+{% macro interface_form(asset, item, values, assets, media) %}
+{% set prefix=(item.id if item else 'new-interface') ~ '-' %}
+<form method="post" action="/ui/inventory/interfaces" class="inventory-form">
+<input type="hidden" name="id" value="{{ item.id if item else '' }}"><input type="hidden" name="asset_id" value="{{ asset.id }}">
+{{ field('name','Interface name',values,item.name if item else '',prefix,required=true,help='For example: eth0, wlan0, or vmbr0.') }}
+<div><label for="{{ prefix }}medium">Connection type</label><select id="{{ prefix }}medium" name="medium">{% for key,label in media.items() %}<option value="{{ key }}" {{ 'selected' if values.get('medium',item.medium if item else 'unknown')==key }}>{{ label }}</option>{% endfor %}</select></div>
+{{ field('mac','MAC address (optional)',values,item.mac if item else '',prefix) }}
+<div><label for="{{ prefix }}attached">Connected to (optional)</label><select id="{{ prefix }}attached" name="attached_to_id"><option value="">Not recorded</option>{% for target in assets if target.id!=asset.id %}<option value="{{ target.id }}" {{ 'selected' if values.get('attached_to_id',item.attached_to_id if item else '')==target.id }}>{{ target.name }}</option>{% endfor %}</select><div class="help">Switch, access point, or virtual bridge host.</div></div>
+{{ field('port','Port / SSID / bridge (optional)',values,item.port if item else '',prefix) }}
+<div class="full form-actions"><button class="btn">{{ 'Save interface' if item else 'Add interface' }}</button></div>
+</form>
+{% endmacro %}
+{% macro allocation_form(subnet,item,values,interfaces,asset_map,states) %}
+{% set prefix=(item.id if item else 'new-allocation') ~ '-' %}
+<form method="post" action="/ui/inventory/allocations" class="inventory-form">
+<input type="hidden" name="id" value="{{ item.id if item else '' }}"><input type="hidden" name="subnet_id" value="{{ subnet.id }}">
+{{ field('address','IP address',values,item.address if item else '',prefix,required=true) }}
+<div><label for="{{ prefix }}state">Allocation</label><select id="{{ prefix }}state" name="state">{% for key,label in states.items() %}<option value="{{ key }}" {{ 'selected' if values.get('state',item.state if item else 'reserved')==key }}>{{ label }}</option>{% endfor %}</select></div>
+<div><label for="{{ prefix }}interface">Device / interface</label><select id="{{ prefix }}interface" name="interface_id"><option value="">No interface (reservation or plan)</option>{% for iface in interfaces %}<option value="{{ iface.id }}" {{ 'selected' if values.get('interface_id',item.interface_id if item else '')==iface.id }}>{{ asset_map[iface.asset_id].name }} / {{ iface.name }}</option>{% endfor %}</select><div class="help">Required for assigned addresses. Add interfaces on the device’s inventory page.</div></div>
+{{ field('label','Owner / purpose',values,item.label if item else '',prefix,help='Required when there is no linked interface.') }}
+<div class="full"><label for="{{ prefix }}notes">Notes</label><textarea id="{{ prefix }}notes" name="notes" maxlength="4000">{{ values.get('notes',item.notes if item else '') }}</textarea></div>
+<div class="full form-actions"><button class="btn">{{ 'Save allocation' if item else 'Add allocation' }}</button></div>
+</form>
+{% endmacro %}
+{% macro remove(kind,id,next,label='Remove record') %}
+<form method="post" action="/ui/inventory/{{ kind }}/{{ id }}/delete" onsubmit="return confirm('Remove this inventory record? This does not change the device or network configuration.')"><input type="hidden" name="next" value="{{ next }}"><button class="btn sm bad" type="submit">{{ label }}</button></form>
+{% endmacro %}
+
+{% macro device_kind(id, kinds, selected, label='Device type') %}
+<div class="device-kind" data-device-kind><label for="{{ id }}">{{ label }}</label>
+<select id="{{ id }}" name="kind">{% for key, text in kinds.items() %}<option value="{{ key }}" {{ 'selected' if key==selected }}>{{ text }}</option>{% endfor %}</select>
+</div>
+{% endmacro %}

keywright_server/web/templates/_inventory_style.html

@@ -0,0 +1,36 @@
+.infra-nav{display:flex;gap:16px;border-bottom:1px solid var(--line);margin:0 0 20px;overflow:auto}
+.infra-nav a{white-space:nowrap;padding:8px 0;color:var(--mut);border-bottom:2px solid transparent}
+.infra-nav a[aria-current=page]{color:var(--fg);border-color:var(--acc)}
+.inventory-filters{display:flex;gap:10px;align-items:end;flex-wrap:wrap;margin:16px 0}
+.inventory-filters>div{flex:1 1 140px}.inventory-filters>div:first-child{flex:2 1 220px}
+.inventory-filters label{margin-top:0}
+.inventory-form{display:grid;grid-template-columns:repeat(2,minmax(0,1fr));gap:0 16px;max-width:900px}
+.inventory-form .full{grid-column:1/-1}.inventory-form .form-actions{margin-top:16px}
+.inventory-table .mono{font-size:12px}.inventory-table td{vertical-align:middle}.inventory-table .group-label{background:var(--panel-raised);padding:8px}
+.inventory-table small{display:block;color:var(--mut);font-size:12px}
+.inventory-table a{overflow-wrap:anywhere}.inventory-section{margin-top:24px}
+.inventory-section>summary{cursor:pointer;font-weight:600;padding:10px 0}
+.inventory-heading{display:flex;gap:12px;align-items:center;justify-content:space-between;margin-bottom:8px}
+.inventory-heading h1,.inventory-heading h2{margin:0}.inventory-heading+.page-intro{margin-top:0}
+.inventory-facts{display:flex;flex-wrap:wrap;gap:8px 24px;color:var(--mut);margin:12px 0}
+.inventory-facts b{color:var(--fg);font-weight:600;font-variant-numeric:tabular-nums}
+.inventory-note{border-left:2px solid var(--line);padding:6px 12px;margin:12px 0;color:var(--mut);font-size:12px}
+.inventory-delete{margin-top:20px;padding-top:12px;border-top:1px solid var(--line)}
+.inventory-editor{padding:8px 0;border-top:1px solid var(--line)}.inventory-editor>summary{cursor:pointer;min-height:36px;padding:8px 0}
+.inventory-tree{border:1px solid var(--line);border-radius:var(--r);background:var(--panel)}
+.tree-row{display:grid;grid-template-columns:minmax(0,1fr) 130px 160px;gap:12px;align-items:center;padding:9px 12px;border-bottom:1px solid var(--line)}
+.tree-row:last-child{border-bottom:0}.tree-name{display:flex;align-items:center;gap:8px;padding-left:calc(min(var(--depth), 8)*18px);min-width:0}
+.tree-name a{overflow-wrap:anywhere}.tree-toggle{display:inline-flex;align-items:center;justify-content:center;width:28px;height:28px;flex-shrink:0;background:none;border:1px solid var(--line);border-radius:3px;color:var(--mut);cursor:pointer}
+.tree-spacer{width:28px;flex-shrink:0}.tree-meta{font-size:12px;color:var(--mut)}
+.allocation-range{font-family:ui-monospace,monospace;font-size:12px;overflow-wrap:anywhere}
+@media(max-width:900px){
+ .infra-nav{gap:14px;margin-bottom:16px}.infra-nav a{min-height:40px;font-size:12px}
+ .inventory-form{grid-template-columns:minmax(0,1fr)}.inventory-form .full{grid-column:1}
+ .inventory-filters{gap:8px}.inventory-filters>div:first-child{flex-basis:100%}
+ .inventory-heading{flex-wrap:wrap}.inventory-table .group-row{display:block;padding:8px 0!important}.inventory-table .group-label{display:block;border:0}
+ .tree-row{grid-template-columns:minmax(0,1fr) auto;gap:4px 8px}.tree-row>.tree-meta:last-child{grid-column:1/-1;padding-left:36px}
+ .tree-name{padding-left:calc(min(var(--depth), 4)*10px)}.tree-toggle{height:40px;width:32px}.tree-spacer{width:32px}
+}
+
+.resource-organize{margin-bottom:12px}.resource-organize label{margin:0}.resource-organize select{width:auto;max-width:180px;font-size:13px;padding:4px 8px}.resource-host{flex-basis:100%;font-size:12px}.resource-group-heading{padding:8px 14px;font-size:12px;font-weight:600;background:var(--panel-raised);border-bottom:1px solid var(--line)}
+@media(max-width:900px){.resource-organize select{font-size:16px;max-width:150px}.resource-organize{gap:6px}.resource-group-heading{padding:8px 12px}}

keywright_server/web/templates/_live.html

@@ -0,0 +1,10 @@
+{# Everything waiting on the human. The websocket replaces pieces of this by id, and replaces the
+   whole thing after a reconnect, so every id here has to stay stable. #}
+<h2 id="nudges-heading"{% if not nudges %} hidden{% endif %}>Needs you
+<span class="pill pending" data-count="nudges">{{ nudges|length }}</span></h2>
+<div id="nudge-list">{% for n in nudges %}{% include "_nudge_card.html" %}{% endfor %}</div>
+
+<h2>Pending requests <span class="pill" data-count="pending">{{ pending|length }}</span>
+<span class="live-state" id="live-state" hidden></span></h2>
+<div id="pending-list">{% for req in pending %}{% include "_request_card.html" %}{% endfor %}</div>
+<div class="card mut" id="pending-empty"{% if pending %} hidden{% endif %}>Nothing waiting.</div>

keywright_server/web/templates/_mail_nav.html

@@ -0,0 +1,5 @@
+<div class="row mail-tabs" aria-label="Mail navigation">
+<a class="btn {{ 'p' if request.url.path == '/ui/mail' }}" href="/ui/mail">Inbox</a>
+<a class="btn {{ 'p' if request.url.path == '/ui/mail/rules' }}" href="/ui/mail/rules">Email rules</a>
+<a class="btn {{ 'p' if request.url.path == '/ui/mail/settings' }}" href="/ui/mail/settings">Connection</a>
+</div>

keywright_server/web/templates/_mail_style.html

@@ -0,0 +1,10 @@
+<style>
+.mail-tabs{margin-bottom:20px}.mail-heading{display:flex;align-items:center;justify-content:space-between;gap:16px;margin-bottom:14px}.mail-heading h1{margin:0}.mail-heading p{margin:4px 0 0}
+.mail-shell{display:grid;grid-template-columns:145px minmax(240px,340px) minmax(0,1fr);border:1px solid var(--line);background:var(--panel);min-height:580px;border-radius:var(--r);overflow:hidden}
+.mail-rail{padding:12px 8px;background:var(--panel-raised)}.mail-rail a{display:flex;justify-content:space-between;align-items:center;padding:9px 8px;margin:2px 0;color:var(--mut);border-radius:var(--r);gap:8px}.mail-rail a.active{background:var(--panel);color:var(--fg)}.mail-rail h2{font-size:11px;text-transform:uppercase;letter-spacing:.08em;padding:0 8px;margin:22px 0 8px}.mail-rail .mail-count{font-variant-numeric:tabular-nums}
+.mail-list{border-right:1px solid var(--line);min-width:0}.mail-search{padding:12px;border-bottom:1px solid var(--line);display:flex;gap:6px}.mail-search input{width:100%;margin:0}.mail-message{display:block;padding:16px 14px;border-bottom:1px solid var(--line);color:var(--fg);border-left:3px solid transparent}.mail-message:hover{background:var(--panel-raised);text-decoration:none}.mail-message.selected{border-left-color:var(--acc);background:var(--panel-raised)}.mail-sender{display:block;font-weight:600;white-space:nowrap;text-overflow:ellipsis;overflow:hidden}.mail-subject{margin:4px 0 8px;display:block;white-space:nowrap;text-overflow:ellipsis;overflow:hidden}.mail-meta{display:flex;flex-wrap:wrap;align-items:center;gap:6px;font-size:11px;color:var(--mut)}.mail-meta time{margin-left:auto}.mail-page{padding:12px;justify-content:space-between}
+.mail-reader{padding:24px;min-width:0}.mail-reader h2{font-size:20px;line-height:1.35;margin:0 0 16px}.mail-reader dl{display:grid;grid-template-columns:55px minmax(0,1fr);gap:6px 12px;margin:16px 0}.mail-reader dt{color:var(--mut)}.mail-reader dd{margin:0}.mail-body{white-space:pre-wrap;overflow-wrap:anywhere;font:14px/1.75 system-ui,sans-serif;background:transparent;padding:0;margin-top:24px;max-height:65vh;overflow:auto}.mail-result{padding:12px;border:1px solid var(--line);background:var(--panel-raised);margin:20px 0}.mail-result p{margin:8px 0}.mail-attachments{border-top:1px solid var(--line);padding-top:16px;margin-top:20px}.mail-attachment{display:flex;flex-wrap:wrap;align-items:center;justify-content:space-between;gap:8px;padding:9px 0}.mail-empty{padding:60px 24px;text-align:center;color:var(--mut)}.mail-empty strong{display:block;font-size:18px;color:var(--fg);margin-bottom:8px}.mail-config{max-width:720px}.mail-config .grid{grid-template-columns:1fr 1fr}.mail-config label{display:block}.mail-config input:not([type=checkbox]),.mail-config select{width:100%}.mail-rule{padding:16px;margin-bottom:10px}.mail-rule h2{margin:0}.mail-rule .row{justify-content:space-between}.mail-rule p{color:var(--mut);margin:8px 0}.mail-status-done{color:var(--ok);border-color:var(--ok)}.mail-status-failed{color:var(--bad);border-color:var(--bad)}.mail-status-pending,.mail-status-running,.mail-status-queued{color:var(--warn);border-color:var(--warn)}
+@media(max-width:1050px){.mail-shell{grid-template-columns:120px minmax(220px,290px) minmax(0,1fr)}.mail-reader{padding:18px}}
+@media(max-width:740px){.mail-shell{display:block;min-height:400px}.mail-rail{display:flex;overflow-x:auto;gap:6px;padding:8px}.mail-rail h2{display:none}.mail-rail a{white-space:nowrap;flex-shrink:0;padding:7px 9px}.mail-list{border-right:0}.mail-reader{border-top:1px solid var(--line);padding:18px}.mail-shell.has-selection .mail-list{display:none}.mail-reader-back{display:inline-flex!important;margin-bottom:16px}.mail-config .grid{grid-template-columns:1fr}.mail-heading{align-items:flex-start}}
+.mail-reader-back{display:none}
+</style>

keywright_server/web/templates/_network_map_script.html

@@ -0,0 +1,5 @@
+<script>
+{% include "_topology_layout.js" %}
+{% include "_topology_render.js" %}
+{% include "_topology_controller.js" %}
+</script>

keywright_server/web/templates/_nudge_card.html

@@ -0,0 +1,12 @@
+{# An agent asking for the human in the conversation. Nothing to decide: the answer happens in the
+   conversation, and this card only records that it is still owed. #}
+<article class="tile nudge-tile" id="nudge-{{ n.id }}" data-nudge="{{ n.id }}">
+<div class="tile-head"><span aria-hidden="true">💬</span><b>{{ n.agent.name }} needs you</b>
+<span class="tile-meta mut small"><time data-since="{{ n.created_at.isoformat() }}" datetime="{{ n.created_at.isoformat() }}">{{ n.created_at.strftime('%H:%M:%S') }}</time></span></div>
+<div class="nudge-message">“{{ n.message }}”</div>
+<div class="tile-quick">
+<form method="post" action="/ui/nudges/{{ n.id }}/dismiss"><input type="hidden" name="next" value="/ui">
+<button class="btn sm">Dismiss</button></form>
+<span class="small mut">{{ n.context or 'no location given' }}{% if n.session_id %} · session {{ n.session_id[:24] }}{% endif %}</span>
+</div>
+</article>

keywright_server/web/templates/_patterns.html

@@ -0,0 +1,6 @@
+{# patterns of a request, grouped by bundle when the request used bundles: expects req #}
+{% set groups = req.detail.bundles if req.detail and req.detail.bundles else {} %}
+{% set grouped = [] %}{% for name, pats in groups.items() %}{% for p in pats %}{% set _ = grouped.append(p) %}{% endfor %}{% endfor %}
+{% for name, pats in groups.items() %}<details class="bundle"><summary><b>bundle {{ name }}</b> <span class="mut small">({{ pats | length }} patterns)</span></summary>
+<div>{% for p in pats %}<code>{{ p }}</code><br>{% endfor %}</div></details>{% endfor %}
+{% for p in req.patterns %}{% if p not in grouped %}<code>{{ p }}</code><br>{% endif %}{% endfor %}

keywright_server/web/templates/_policy_preview_results.html

@@ -0,0 +1,13 @@
+<p>{{ preview.counts.changed }} changed · {{ preview.counts.unchanged }} unchanged · {{ preview.counts.inconclusive }} inconclusive</p>
+<p class="small mut">{{ preview.since.strftime('%Y-%m-%d %H:%M') }} to {{ preview.at.strftime('%Y-%m-%d %H:%M') }} UTC.
+{% if preview.limited %}Sample capped at the newest {{ preview.limit }} call records; older records are omitted.{% else %}{{ preview.rows|length }} call records in this window.{% endif %}
+Approval and execution records can describe the same call; these are not unique operation counts.</p>
+<p class="small">Compares each recorded call independently against current rules, active grants, resource settings and agent status. One-time grants are not spent or simulated across rows. This does not reconstruct historical policy, run tools, or check upstream availability, LLM budgets, approval cooldowns or semantic decisions. Incomplete evidence is inconclusive. No matches does not mean a rule is safe.</p>
+<table class="data-table" role="table"><thead><tr><th>Audit</th><th>Agent / tool</th><th>Current</th><th>With rule</th></tr></thead><tbody>
+{% for row in preview.rows %}<tr>
+<td data-label="Audit"><a href="/ui/audit?q=%23{{ row.id }}">#{{ row.id }}</a><div class="small mut">{{ row.ts.strftime('%m-%d %H:%M') }} UTC</div></td>
+<td data-label="Agent / tool">{{ row.agent }}<div class="small">{{ row.tool }}</div>{% if row.reason %}<div class="small mut">{{ row.reason }}</div>{% endif %}</td>
+<td data-label="Current">{{ preview.labels[row.before] }}</td>
+<td data-label="With rule">{% if row.changed %}<b>{{ preview.labels[row.after] }}</b>{% else %}{{ preview.labels[row.after] }}{% endif %}</td>
+</tr>{% endfor %}</tbody></table>
+{% if not preview.rows %}<p>No recent brokered call records for this agent scope.</p>{% endif %}

keywright_server/web/templates/_request_card.html

@@ -0,0 +1,46 @@
+{# One pending request as a tile: who, what, how urgent, and the two or three answers most likely
+   to be right. Everything a decision could turn on is one tap away, never more. Rendered on page
+   load and again over the websocket, so it must not touch `request` or `flash`. #}
+{% set level = hazard_level(req.detail) %}{% set flagged = hazard_blocks(level) %}
+{% set ops = operations(req.detail) %}
+<article class="tile req-tile{{ ' flagged' if flagged }}" id="req-{{ req.id }}" data-request="{{ req.id }}">
+<details class="tile-open">
+<summary>
+<div class="tile-head"><span class="tile-dot" aria-hidden="true"></span><b>{{ req.agent.name }}</b>
+{% if level %}<span class="pill {{ level }}">{{ 'destructive' if flagged else 'flagged' }} · {{ level }}</span>{% endif %}
+{% if req.semantic and req.semantic.status == 'ok' %}<span class="pill {{ 'ok' if req.semantic.verdict == 'safe' else 'high' if req.semantic.verdict == 'unsafe' else 'medium' if req.semantic.verdict == 'unclear' else '' }}">Jev · {{ req.semantic.verdict }}</span>{% elif req.semantic %}<span class="pill">Jev · no verdict</span>{% endif %}
+<span class="tile-meta mut small"><span class="tile-times"><time data-since="{{ req.created_at.isoformat() }}" datetime="{{ req.created_at.isoformat() }}">{{ req.created_at.strftime('%H:%M:%S') }}</time>{% if req.expires_at %} · <span data-until="{{ req.expires_at.isoformat() }}">expires {{ req.expires_at.strftime('%H:%M') }}</span>{% endif %}</span>
+<span class="tile-chevron" aria-hidden="true">▾</span></span></div>
+{% if ops %}{% set lines = operation_line(ops[0][1]).split('\n') %}
+{# Never shortened: the tile carries approve buttons, so what it shows has to be all of it. A
+   pathological command scrolls inside the tile rather than pushing those buttons off the screen. #}
+<div class="tile-line mono">{{ lines[0] }}</div>
+{% for extra in lines[1:] %}<div class="tile-line mono tile-cont">{{ extra.strip() }}</div>{% endfor %}
+{% if ops|length > 1 %}<div class="small mut">and {{ ops|length - 1 }} more operation{{ '' if ops|length == 2 else 's' }} in this request</div>{% endif %}
+{% else %}<div class="tile-line mono">{% for p in req.patterns[:2] %}{{ p }}{{ ' ' }}{% endfor %}{% if req.patterns|length > 2 %}<span class="mut">+{{ req.patterns|length - 2 }} more</span>{% endif %}</div>{% endif %}
+{% if req.reason %}<div class="tile-reason small">“{{ req.reason }}”</div>{% endif %}
+</summary>
+<div class="tile-body">
+{% include "_hazards.html" %}
+{% if req.semantic %}<div class="tile-field"><div class="tile-label">Jev</div>{% include "_semantic.html" %}</div>{% endif %}
+<div class="tile-field"><div class="tile-label">Permission scopes</div>{% include "_patterns.html" %}</div>
+{% if ops %}<div class="tile-field"><div class="tile-label">Operation{{ '' if ops|length == 1 else 's' }}</div>
+{% for pats, op in ops %}{% with constraints=op %}{% include "_constraints.html" %}{% endwith %}{% endfor %}</div>{% endif %}
+<div class="tile-field small mut">session {{ (req.session_id or 'none')[:24] }} · <a href="/ui/requests/{{ req.id }}">{{ req.id }}</a></div>
+{% with next='/ui', in_detail=true %}{% include "_decide.html" %}{% endwith %}
+</div>
+</details>
+<form method="post" action="/ui/requests/{{ req.id }}/decide" class="tile-quick">
+<input type="hidden" name="next" value="/ui">
+{% if flagged %}<input type="hidden" name="extent" value="exact">
+<button class="btn ok sm" name="scope" value="once">Allow once (exact)</button>
+<button class="btn bad sm" name="scope" value="deny">Deny</button>
+<span class="small mut">Destructive · open to read the flags</span>
+{% else %}
+<button class="btn ok sm" name="scope" value="once">Allow once</button>
+<button class="btn sm" name="scope" value="ttl">1 hour</button>
+<button class="btn bad sm" name="scope" value="deny">Deny</button>
+<span class="small mut">Open for other durations, broader scope, or a deny reason</span>
+{% endif %}
+</form>
+</article>

keywright_server/web/templates/_semantic.html

@@ -0,0 +1,10 @@
+{# Jev's verdict on a request: the one-line reading, then every answer so the human can see why.
+   Advisory in shadow mode; under trust an eligible verdict has already approved the request once. #}
+{% set v = req.semantic %}{% if v %}
+<div class="semantic {{ v.verdict }}"><b>{{ jev_line(v) }}</b>
+{% if v.status == 'ok' %}<ul class="small">
+<li>category <b>{{ v.summary.category }}</b> ({{ '%.2f' % v.summary.category_confidence }}) · reversibility {{ v.summary.reversibility }} ({{ '%.2f' % v.summary.reversibility_confidence }}){% if v.summary.task_fit is not none %} · reason fits {{ '%.2f' % v.summary.task_fit }}{% else %} · no reason given, truthfulness not checked{% endif %}</li>
+<li>{% for k, p in v.summary.effects.items() %}<span class="pill {{ ('high' if k not in ('modifies_state', 'persistent_change') and not (k == 'deletes_data' and v.operation == 'put') else 'medium') if p >= 0.5 else 'medium' if p > 0.15 else 'ok' }}">{{ jev_effect_words[k] }} {{ '%.2f' % p }}</span> {% endfor %}</li>
+<li class="mut">{% if v.auto.eligible %}{{ 'would auto-approve under trust' if v.mode != 'trust' else 'auto-approved' }}{% else %}not auto-approvable: {{ v.auto.blocked_by | join(', ') }}{% endif %} · {{ v.model }} · {{ v.latency_ms }} ms{% if v.usage %} · {{ v.usage.input_tokens }} tokens in{% endif %}{% if v.omitted %} · omitted: {{ v.omitted | join(', ') }}{% endif %}</li>
+</ul>{% else %}<div class="small mut">{{ v.status }}{% if v.reason %}: {{ v.reason }}{% endif %} · the decision is yours as usual</div>{% endif %}
+</div>{% endif %}

keywright_server/web/templates/_topology_controller.js

@@ -0,0 +1,217 @@
+/* Page state, camera, input and snapshot refresh. Discovery remains server-owned. */
+(()=>{
+'use strict';
+const $=id=>document.getElementById(id),T=KeywrightTopology,V=KeywrightTopologyView;
+let graph=JSON.parse($('net-data').textContent),loadedAt=Date.now(),busy=false,lastAttempt=0;
+if(!graph.sources.length){$('net-freshness').textContent='No controller connected';return;}
+const surface=$('network-svg'),scene=$('net-scene'),renderer=new V.Renderer(scene);
+const ui={expanded:new Set(),pages:new Map(),selected:'',branch:'',status:''};
+let mobile=matchMedia('(max-width: 700px)').matches,model,geometry,layoutKey='',camera={x:0,y:0,s:1},size={w:1,h:1};
+let returnFocus=null,searchTimer=0,animation=0;
+const date=v=>v?new Date(v).toLocaleString():'Not yet collected';
+function el(tag,text,cls){const n=document.createElement(tag);if(text!==undefined)n.textContent=text;if(cls)n.className=cls;return n;}
+function button(text,action,cls='btn'){const b=el('button',text,cls);b.type='button';b.onclick=action;return b;}
+function error(message){$('net-error').textContent=message;$('net-error').hidden=!message;}
+function setCamera(next){camera=next;scene.setAttribute('transform',`translate(${camera.x} ${camera.y}) scale(${camera.s})`);$('net-scale').textContent=Math.round(camera.s*100)+'%';}
+function moveCamera(next,animate=false){
+ cancelAnimationFrame(animation);
+ if(!animate||matchMedia('(prefers-reduced-motion: reduce)').matches){setCamera(next);return;}
+ const start={...camera},at=performance.now();
+ function frame(now){const t=Math.min(1,(now-at)/180),ease=1-(1-t)**3;setCamera({x:start.x+(next.x-start.x)*ease,y:start.y+(next.y-start.y)*ease,s:start.s+(next.s-start.s)*ease});if(t<1)animation=requestAnimationFrame(frame);}
+ animation=requestAnimationFrame(frame);
+}
+function focusBounds(b,animate=true){
+ // Automatic camera operations never shrink labels below their designed size.
+ const s=Math.max(1,Math.min(1.15,(size.w-24)/b.width,(size.h-32)/b.height));
+ const x=size.w/2-(b.x+b.width/2)*s;
+ const y=b.height*s>size.h-32?16-b.y*s:size.h/2-(b.y+b.height/2)*s;
+ moveCamera({x,y,s},animate);
+ $('net-view-note').textContent=b.width*s>size.w||b.height*s>size.h?'Pan to explore · labels stay at readable size':'Drag to pan · pinch or use + / − to zoom';
+}
+function zoom(factor,anchor={x:size.w/2,y:size.h/2}){
+ const s=Math.max(.45,Math.min(4,camera.s*factor)),ratio=s/camera.s;
+ moveCamera({s,x:anchor.x-(anchor.x-camera.x)*ratio,y:anchor.y-(anchor.y-camera.y)*ratio});
+}
+function rebuild(force=false){
+ model=T.normalize(graph,$('net-site').value);
+ for(const id of ui.expanded)if(!model.groups.has(id))ui.expanded.delete(id);
+ if(ui.selected&&!model.nodes.has(ui.selected)&&!model.groups.has(ui.selected))ui.selected='';
+ if(ui.branch&&!model.groups.has(ui.branch)){ui.branch='';closeDetails(false);}
+ const key=JSON.stringify([model.signature,mobile,[...ui.expanded].sort(),[...ui.pages].sort()]);
+ if(force||key!==layoutKey){geometry=T.layout(model,{mobile,...ui});layoutKey=key;}
+ renderer.draw(model,geometry,ui);branchBar();counts();deviceList();searchResults(false);
+ $('net-map-empty').hidden=!!model.nodes.size;
+ if(!$('net-details').hidden&&ui.selected)details(ui.selected,false);
+}
+function defaults(){
+ ui.expanded.clear();ui.pages.clear();ui.branch='';ui.selected='';closeDetails(false);rebuild(true);
+ // Expand only clusters that fit comfortably; dense networks keep an honest overview.
+ if(!mobile){for(const [id,g] of model.groups){if(!g.clients.length)continue;ui.expanded.add(id);const trial=T.layout(model,{mobile,...ui});if(trial.bounds.width>size.w-32||trial.bounds.height>size.h-32)ui.expanded.delete(id);}rebuild();}
+ focusBounds(geometry.bounds,false);
+}
+function overview(){ui.expanded.clear();ui.branch='';ui.selected='';closeDetails(false);rebuild();focusBounds(geometry.bounds);}
+function branchBar(){
+ const group=model.groups.get(ui.branch),bar=$('net-branch');bar.hidden=!group;
+ if(!group){$('net-path').textContent='Infrastructure overview · select a switch or AP to explore';return;}
+ const block=geometry.blocks.get(ui.branch),total=block.total;
+ $('net-branch-name').textContent=group.node.name;
+ $('net-page').textContent=total?(ui.expanded.has(ui.branch)?`${block.page*block.pageSize+1}–${Math.min(total,(block.page+1)*block.pageSize)} of ${total} clients`:`${total} clients collapsed`):'No directly connected clients';
+ $('net-prev').disabled=!ui.expanded.has(ui.branch)||block.page===0;
+ $('net-next').disabled=!ui.expanded.has(ui.branch)||(block.page+1)*block.pageSize>=total;
+ $('net-collapse').disabled=!total;$('net-collapse').textContent=ui.expanded.has(ui.branch)?'Collapse clients':'Expand clients';
+ $('net-show-details').disabled=group.synthetic;
+ const path=[],seen=new Set();let id=ui.selected||ui.branch;
+ while(id&&!seen.has(id)){seen.add(id);path.unshift(model.nodes.get(id)?.name||model.groups.get(id)?.node.name||'Unknown');id=model.groupOf.get(id)||model.parent.get(id);}
+ $('net-path').textContent=path.join(' › ');
+}
+function select(id,showDetails=false){
+ if(!model.nodes.has(id)&&!model.groups.has(id))return;
+ ui.selected=id;const group=model.groups.has(id)?id:model.groupOf.get(id);ui.branch=group||'';
+ if(group){
+  ui.expanded.add(group);
+  if(group!==id)ui.pages.set(group,Math.floor(model.groups.get(group).clients.indexOf(id)/(mobile?8:10)));
+ }
+ rebuild();
+ const rect=geometry.positions.get(id);
+ focusBounds(group===id?geometry.clusterBounds.get(id):rect||geometry.bounds);
+ if(group!==id||showDetails)details(id,true);else closeDetails(false);
+}
+function closeDetails(restore=true){$('net-details').hidden=true;if(restore&&returnFocus?.isConnected)returnFocus.focus({preventScroll:true});}
+function revealAboveSheet(id){
+ if(!matchMedia('(max-width: 900px)').matches||$('net-details').hidden)return;
+ const p=geometry.positions.get(id);if(!p)return;
+ const canvas=surface.getBoundingClientRect(),sheet=$('net-details').getBoundingClientRect();
+ const top=Math.max(canvas.top,document.querySelector('.site-header')?.getBoundingClientRect().bottom||0);
+ const bottom=Math.min(canvas.bottom,sheet.top-12);
+ if(bottom-top>80)moveCamera({...camera,y:(top+bottom)/2-canvas.top-(p.y+p.height/2)*camera.s});
+}
+function details(id,focus){
+ const n=model.nodes.get(id);if(!n)return;
+ const box=$('net-details');box.hidden=false;$('net-detail-title').textContent=n.name;
+ const body=$('net-detail-body');body.replaceChildren(el('p',n.virtual?'Recorded connection · not monitored':V.states[n.state]||'Unknown','pill'));
+ const dl=el('dl');
+ const fields=[['Connected to',n.attachment_label||'Not reported'],['Connection source',n.attachment_source||'Not reported'],['Connection',n.hub&&n.medium==='wifi'?'Mesh Wi-Fi':({wifi:'Wi-Fi',wired:'Wired'})[n.medium]||'Unspecified'],['Port / SSID',n.port||'Not reported'],['IP address',n.addresses.join(', ')||'Not reported'],['MAC',n.mac||'Not reported'],['Site',n.site||n.site_id||'Not reported'],['Device',n.model||n.role],['Last observed',date(n.last_observed)],['First observed',date(n.first_observed)],['Source state',n.source_status||'Unknown']];
+ for(const [key,value] of fields)dl.append(el('dt',key),el('dd',value));body.append(dl);
+ if(n.uplink_note&&!n.attachment)body.append(el('p',n.uplink_note,'help'));
+ if(n.missing)body.append(el('p','Absent from the latest successful refresh. This is its last recorded connection.','help'));
+ if(n.unreviewed)body.append(el('p','Unreviewed in inventory. DHCP reservation status is unknown.','help'));
+ for(const [url,label] of [[n.review_url,'Review observation'],[n.asset_url,'Open inventory record']])if(url?.startsWith('/ui/')){const a=el('a',label,'btn');a.href=url;body.append(a);}
+ if(focus){returnFocus=renderer.nodeElements.get(id)||document.activeElement;$('net-detail-close').focus({preventScroll:true});requestAnimationFrame(()=>revealAboveSheet(id));}
+}
+function matches(n,q){return [n.name,n.mac,...n.addresses,n.port,n.site,n.model].join(' ').toLowerCase().includes(q);}
+function statusMatch(n){return !ui.status||ui.status==='unreviewed'&&n.unreviewed||ui.status==='inactive'&&['inactive','missing'].includes(n.state)||ui.status==='unknown'&&['unknown','stale'].includes(n.state)||n.state===ui.status;}
+function counts(){
+ const ns=[...model.nodes.values()].filter(n=>!n.virtual),count={};ns.forEach(n=>count[n.state]=(count[n.state]||0)+1);
+ const values=[['',ns.length,'All'],['online',count.online||0,'Online'],['inactive',(count.inactive||0)+(count.missing||0),'Inactive / missing'],['old',count.old||0,'24h+'],['unknown',(count.unknown||0)+(count.stale||0),'Unknown / stale'],['unreviewed',ns.filter(n=>n.unreviewed).length,'Unreviewed']];
+ const active=document.activeElement?.dataset?.status;
+ $('net-counts').replaceChildren(...values.map(([state,value,label])=>{const b=button(`${value} ${label}`,()=>{ui.status=state;renderer.emphasize(model,ui);counts();deviceList();},'net-status-button '+state);b.setAttribute('aria-pressed',String(ui.status===state));b.dataset.status=state;return b;}));
+ if(active!==undefined)[...$('net-counts').children].find(n=>n.dataset.status===active)?.focus({preventScroll:true});
+}
+function deviceList(){
+ const q=$('net-search').value.trim().toLowerCase(),nodes=[...model.nodes.values()].filter(n=>matches(n,q)&&statusMatch(n)).sort((a,b)=>a.name.localeCompare(b.name));
+ $('net-list-summary').textContent=`Device list · ${nodes.length} matching`;
+ const body=$('net-list');body.replaceChildren();
+ for(const n of nodes){const row=el('tr'),name=el('td');name.dataset.label='Device';name.append(button(n.name,()=>{select(n.id,true);surface.scrollIntoView({block:'center'});},'net-list-button'));row.append(name);
+ for(const [key,value] of [['State',(V.states[n.state]||'Unknown')+(n.unreviewed?' · Unreviewed':'')],['Connected to',n.attachment_label||'Not reported'],['IP address',n.addresses.join(', ')||'—']]){const td=el('td',value);td.dataset.label=key;row.append(td);}body.append(row);}
+ $('net-empty-list').hidden=!!nodes.length;
+}
+function searchResults(auto){
+ const q=$('net-search').value.trim().toLowerCase(),box=$('net-search-results');box.replaceChildren();box.hidden=!q;
+ if(!q)return;
+ const matchesList=[...model.nodes.values()].filter(n=>matches(n,q)).sort((a,b)=>a.name.localeCompare(b.name));
+ box.append(el('p',`${matchesList.length} matching devices${matchesList.length>8?' · refine your search or use the device list':''}`,'help'));
+ for(const n of matchesList.slice(0,8))box.append(button(n.name,()=>{select(n.id,true);box.hidden=true;surface.scrollIntoView({block:'center'});},'net-search-result'));
+ if(auto&&matchesList.length===1){select(matchesList[0].id);box.hidden=true;surface.scrollIntoView({block:'center'});}
+}
+function sites(){
+ const current=$('net-site').value,unique=new Map();graph.nodes.forEach(n=>unique.set(n.site_id,n.site||n.site_id));
+ $('net-site').replaceChildren(new Option('All sites',''));[...unique].sort((a,b)=>a[1].localeCompare(b[1])).forEach(([id,name])=>$('net-site').add(new Option(name,id)));
+ if(unique.has(current))$('net-site').value=current;
+}
+function freshness(){
+ const elapsed=Date.now()-loadedAt,age=graph.last_success?Math.max(0,new Date(graph.generated_at)-new Date(graph.last_success)+elapsed):Infinity;
+ if(graph.fresh&&(age>graph.fresh_seconds*1000||elapsed>graph.fresh_seconds*1000)){graph.fresh=false;graph.nodes.forEach(n=>n.state='stale');rebuild();}
+ $('net-freshness').textContent=(graph.fresh?'Current snapshot':'Snapshot not current')+' · Refreshed '+date(graph.last_success)+(graph.configuration_changed?' · Controller configuration changed':'');
+}
+function accept(data){const empty=!graph.nodes.length;graph=data;loadedAt=Date.now();sites();rebuild();if(empty)defaults();freshness();}
+async function readCached(){
+ const response=await fetch('/ui/inventory/map/data?source='+encodeURIComponent(graph.source),{headers:{Accept:'application/json'}});
+ if(!response.ok||response.redirected)throw new Error('Unable to load observations. Sign in again or reload this page.');accept(await response.json());
+}
+async function refresh(){
+ if(busy||!graph.source)return;busy=true;lastAttempt=Date.now();$('net-refresh').disabled=true;$('net-refresh').textContent='Refreshing…';error('');
+ try{
+  const response=await fetch('/ui/inventory/map/refresh',{method:'POST',body:new URLSearchParams({resource_id:graph.source}),headers:{Accept:'application/json'}});
+  if(response.redirected||!response.headers.get('content-type')?.includes('application/json'))throw new Error('Your session may have expired. Sign in again or reload this page.');
+  const data=await response.json();if(data.nodes)accept(data);
+  if(!response.ok){if(response.status===409){await readCached();error(data.error);return;}throw new Error(data.error||'Refresh failed. Previous observations have been retained.');}
+ }catch(e){error(e.message);if(graph.fresh){graph.fresh=false;graph.nodes.forEach(n=>n.state='stale');rebuild();}freshness();}
+ finally{busy=false;$('net-refresh').disabled=false;$('net-refresh').textContent='Refresh now';}
+}
+// Pointer gestures share one camera. Pinch is anchored to the fingers' midpoint.
+const pointers=new Map();let gesture=null,suppressClick=false;
+function point(e){const r=surface.getBoundingClientRect();return {x:e.clientX-r.left,y:e.clientY-r.top};}
+function beginGesture(){
+ const ps=[...pointers.values()];if(!ps.length){gesture=null;return;}
+ gesture={camera:{...camera},points:ps.map(p=>({...p})),moved:false};
+}
+surface.addEventListener('pointerdown',e=>{
+ if(e.button!==0)return;cancelAnimationFrame(animation);pointers.set(e.pointerId,point(e));surface.setPointerCapture(e.pointerId);beginGesture();suppressClick=false;
+});
+surface.addEventListener('pointermove',e=>{
+ if(!pointers.has(e.pointerId)||!gesture)return;pointers.set(e.pointerId,point(e));
+ const ps=[...pointers.values()],start=gesture.points,c=gesture.camera;
+ if(ps.length>=2&&start.length>=2){
+  const midpoint=a=>({x:(a[0].x+a[1].x)/2,y:(a[0].y+a[1].y)/2}),a=midpoint(start),b=midpoint(ps);
+  const distance=a=>Math.hypot(a[0].x-a[1].x,a[0].y-a[1].y);
+  const s=Math.max(.45,Math.min(4,c.s*distance(ps)/Math.max(1,distance(start))));
+  setCamera({s,x:b.x-(a.x-c.x)*s/c.s,y:b.y-(a.y-c.y)*s/c.s});gesture.moved=true;suppressClick=true;
+ }else{
+  const dx=ps[0].x-start[0].x,dy=ps[0].y-start[0].y;
+  if(Math.hypot(dx,dy)>4||gesture.moved){gesture.moved=true;suppressClick=true;setCamera({s:c.s,x:c.x+dx,y:c.y+dy});}
+ }
+});
+function endPointer(e){
+ if(!pointers.has(e.pointerId))return;
+ // Capture retargets pointerup: use hit testing to distinguish a node tap from panning.
+ const tap=e.type==='pointerup'&&!suppressClick&&pointers.size===1;
+ pointers.delete(e.pointerId);if(surface.hasPointerCapture(e.pointerId))surface.releasePointerCapture(e.pointerId);
+ if(tap){const n=document.elementFromPoint(e.clientX,e.clientY)?.closest('[data-action="select"]');if(n)select(n.dataset.id);}
+ beginGesture();
+}
+surface.addEventListener('pointerup',endPointer);surface.addEventListener('pointercancel',endPointer);
+surface.addEventListener('lostpointercapture',e=>{pointers.delete(e.pointerId);beginGesture();});
+surface.addEventListener('click',e=>{if(e.detail===0){const n=e.target.closest('[data-action="select"]');if(n)select(n.dataset.id);}});
+surface.addEventListener('keydown',e=>{
+ const node=e.target.closest('[data-action="select"]');
+ if(node&&(e.key==='Enter'||e.key===' ')){e.preventDefault();select(node.dataset.id);return;}
+ const delta={ArrowLeft:[40,0],ArrowRight:[-40,0],ArrowUp:[0,40],ArrowDown:[0,-40]}[e.key];
+ if(delta){e.preventDefault();moveCamera({...camera,x:camera.x+delta[0],y:camera.y+delta[1]});}
+ else if(e.key==='+'||e.key==='='){e.preventDefault();zoom(1.2);}else if(e.key==='-'){e.preventDefault();zoom(1/1.2);}
+});
+surface.addEventListener('wheel',e=>{if(e.ctrlKey||e.metaKey){e.preventDefault();zoom(Math.exp(-e.deltaY*.008),point(e));}},{passive:false});
+$('net-zoom-in').onclick=()=>zoom(1.2);$('net-zoom-out').onclick=()=>zoom(1/1.2);
+$('net-fit').onclick=()=>focusBounds(ui.branch?geometry.clusterBounds.get(ui.branch):geometry.bounds);
+$('net-overview').onclick=overview;$('net-reset').onclick=()=>{ui.status='';$('net-search').value='';defaults();};
+$('net-collapse').onclick=()=>{ui.selected=ui.branch;closeDetails(false);if(ui.expanded.has(ui.branch))ui.expanded.delete(ui.branch);else ui.expanded.add(ui.branch);rebuild();focusBounds(geometry.clusterBounds.get(ui.branch));};
+function page(delta){const b=geometry.blocks.get(ui.branch);ui.pages.set(ui.branch,b.page+delta);ui.selected=ui.branch;closeDetails(false);rebuild();focusBounds(geometry.clusterBounds.get(ui.branch));}
+$('net-prev').onclick=()=>page(-1);$('net-next').onclick=()=>page(1);
+$('net-show-details').onclick=()=>{ui.selected=ui.branch;details(ui.branch,true);renderer.emphasize(model,ui);};
+$('net-detail-close').onclick=()=>closeDetails();document.addEventListener('keydown',e=>{if(e.key==='Escape'){closeDetails();$('net-search-results').hidden=true;}});
+$('net-search').addEventListener('input',()=>{clearTimeout(searchTimer);deviceList();searchResults(false);searchTimer=setTimeout(()=>searchResults(true),350);});
+$('net-search').addEventListener('keydown',e=>{if(e.key==='Enter'){clearTimeout(searchTimer);const q=e.target.value.trim().toLowerCase(),n=[...model.nodes.values()].find(n=>matches(n,q));if(q&&n){select(n.id,true);$('net-search-results').hidden=true;surface.scrollIntoView({block:'center'});}}});
+$('net-site').onchange=()=>{ui.status='';defaults();};
+$('net-source').onchange=()=>{location.href='/ui/inventory/map?source='+encodeURIComponent($('net-source').value);};
+$('net-refresh').onclick=refresh;
+function tick(){freshness();if(!document.hidden&&$('net-auto').checked&&!busy&&Date.now()-lastAttempt>=graph.refresh_seconds*1000)refresh();}
+$('net-auto').onchange=()=>{if($('net-auto').checked)tick();};
+function resize(){
+ const rect=surface.getBoundingClientRect(),next={w:rect.width,h:rect.height};if(next.w===size.w&&next.h===size.h)return;
+ const first=size.w===1,wasMobile=mobile;mobile=matchMedia('(max-width: 700px)').matches;size=next;
+ surface.setAttribute('viewBox',`0 0 ${size.w} ${size.h}`);
+ if(first||wasMobile!==mobile)defaults();else focusBounds(ui.branch?geometry.clusterBounds.get(ui.branch):geometry.bounds,false);
+}
+sites();resize();new ResizeObserver(resize).observe(surface);
+lastAttempt=graph.fresh?Date.now():0;freshness();if(graph.error)error(graph.error);
+setInterval(tick,1000);document.addEventListener('visibilitychange',()=>{if(!document.hidden)tick();});
+})();