tapesmith 0.4.0__py3-none-any.whl

tapesmith/__init__.py

@@ -0,0 +1,28 @@
+"""Tapesmith: label studio for the Phomemo P12."""
+
+import os
+
+__version__ = "0.4.0"
+
+# Bis 0.2.x hieß die App "P12 Label" und las Umgebungsvariablen mit dem Präfix P12LABEL_.
+# Alte Namen gelten weiter als Rückfall: ist TAPESMITH_X nicht gesetzt, übernimmt es den Wert
+# von P12LABEL_X. Das geschieht einmal beim Import des Pakets, also vor jedem Lesezugriff.
+LEGACY_ENV_PREFIX = "P12LABEL_"
+ENV_PREFIX = "TAPESMITH_"
+
+
+def apply_legacy_env(environ=None) -> list[str]:
+    """Kopiert gesetzte `P12LABEL_*`-Variablen nach `TAPESMITH_*`, sofern dort nichts steht.
+    Gibt die übernommenen neuen Namen zurück."""
+    env = os.environ if environ is None else environ
+    taken = []
+    for key in list(env):
+        if key.upper().startswith(LEGACY_ENV_PREFIX):
+            new = ENV_PREFIX + key[len(LEGACY_ENV_PREFIX):].upper()
+            if new not in env:
+                env[new] = env[key]
+                taken.append(new)
+    return taken
+
+
+apply_legacy_env()

tapesmith/__main__.py

@@ -0,0 +1,28 @@
+"""`python -m tapesmith …`: Einstieg ohne eigene EXE.
+
+`install` und `uninstall` gehen direkt an Installer bzw. Deinstallation (ohne den restlichen
+CLI-Unterbau zu laden, so läuft die Deinstallation auch unter `pythonw.exe` ohne Konsole); alles
+andere ist die normale Kommandozeile (`tapesmith.cli`)."""
+
+from __future__ import annotations
+
+import sys
+
+
+def main(argv: list[str] | None = None) -> int:
+    args = list(sys.argv[1:] if argv is None else argv)
+    if args and args[0] == "install":
+        from tapesmith.install import installer
+
+        return installer.main(args[1:])
+    if args and args[0] == "uninstall":
+        from tapesmith.install import uninstaller
+
+        return uninstaller.main(args[1:])
+    from tapesmith import cli
+
+    return cli.main(args)
+
+
+if __name__ == "__main__":
+    sys.exit(main())

tapesmith/apitokens.py

@@ -0,0 +1,190 @@
+"""API-Token-Speicher: nur Hash auf der Platte, Klartext genau einmal beim Anlegen.
+
+Die Datei (`access/tokens.json`) wird bei geänderter mtime neu gelesen, damit eine Änderung per
+CLI sofort im laufenden Druckdienst wirkt (mehrere `TokenStore`-Instanzen auf derselben Datei).
+"""
+
+from __future__ import annotations
+
+import hashlib
+import hmac
+import json
+import logging
+import re
+import secrets
+import threading
+from dataclasses import dataclass
+from datetime import datetime
+from pathlib import Path
+
+from tapesmith import fileutil, paths
+from tapesmith.i18n import N_, _t
+
+ROLES = ("admin", "drucken", "familie")
+ROLE_LABELS = {"admin": N_("Verwaltung"), "drucken": N_("Drucken"), "familie": N_("Familie")}
+
+_NAME_RE = re.compile(r"^[\w .-]{1,40}$")
+_SECRET_FORM_RE = re.compile(r"^p12_([0-9a-f]{8})_[A-Za-z0-9_-]{20,}$")
+
+log = logging.getLogger(__name__)
+
+
+@dataclass(frozen=True)
+class TokenInfo:
+    id: str
+    name: str
+    role: str
+    created: str
+    last_used: str | None
+
+    def to_json(self) -> dict:
+        return {
+            "id": self.id,
+            "name": self.name,
+            "role": self.role,
+            "role_label": _t(ROLE_LABELS[self.role]),
+            "created": self.created,
+            "last_used": self.last_used,
+            "hint": f"p12_{self.id}_…",
+        }
+
+
+def _entry_to_info(entry: dict) -> TokenInfo:
+    return TokenInfo(entry["id"], entry["name"], entry["role"], entry["created"],
+                     entry.get("last_used"))
+
+
+class TokenStore:
+    def __init__(self, path: Path | None = None, *, now=datetime.now,
+                 touch_interval_s: float = 600.0) -> None:
+        self.path = Path(path) if path is not None else paths.app_dir() / "access" / "tokens.json"
+        self._now = now
+        self._touch_interval_s = touch_interval_s
+        self._lock = threading.Lock()
+        self._mtime: float | None = None
+        self._tokens: list[dict] = []
+
+    # ---------- Laden/Speichern ----------
+
+    def _load_if_changed(self) -> None:
+        try:
+            mtime = self.path.stat().st_mtime
+        except FileNotFoundError:
+            self._mtime = None
+            self._tokens = []
+            return
+        if mtime == self._mtime:
+            return
+        try:
+            data = json.loads(self.path.read_text(encoding="utf-8"))
+        except (OSError, json.JSONDecodeError) as exc:
+            raise ValueError(_t("Token-Datei {path} ist beschädigt: {exc}", path=self.path, exc=exc)) from exc
+        self._tokens = list(data.get("tokens", []))
+        self._mtime = mtime
+
+    def _save(self) -> None:
+        data = {"version": 1, "tokens": self._tokens}
+        fileutil.atomic_write_text(self.path, json.dumps(data, indent=2, ensure_ascii=False))
+        self._mtime = self.path.stat().st_mtime
+
+    def _find_entry(self, id_or_name: str) -> dict | None:
+        for entry in self._tokens:
+            if entry["id"] == id_or_name:
+                return entry
+        matches = [e for e in self._tokens if e["name"].casefold() == id_or_name.casefold()]
+        if len(matches) > 1:
+            raise ValueError(_t("Mehrere Tokens mit dem Namen '{id_or_name}'", id_or_name=id_or_name))
+        return matches[0] if matches else None
+
+    # ---------- öffentliche API ----------
+
+    def create(self, name: str, role: str) -> tuple[TokenInfo, str]:
+        if role not in ROLES:
+            raise ValueError(_t("Rolle '{role}' unbekannt: erlaubt {items}", role=role, items=', '.join(ROLES)))
+        if not isinstance(name, str) or not _NAME_RE.match(name):
+            raise ValueError(
+                _t("Token-Name {name!r} ungültig: 1..40 Zeichen (Buchstaben, Ziffern, Leerzeichen, ._-)", name=name))
+        with self._lock:
+            self._load_if_changed()
+            for entry in self._tokens:
+                if entry["name"].casefold() == name.casefold():
+                    raise ValueError(_t("Token-Name '{name}' ist schon vergeben", name=name))
+            token_id = secrets.token_hex(4)
+            plaintext = f"p12_{token_id}_{secrets.token_urlsafe(32)}"
+            created = self._now().isoformat()
+            entry = {
+                "id": token_id,
+                "name": name,
+                "role": role,
+                "hash": "sha256:" + hashlib.sha256(plaintext.encode("utf-8")).hexdigest(),
+                "created": created,
+                "last_used": None,
+            }
+            self._tokens.append(entry)
+            self._save()
+            return _entry_to_info(entry), plaintext
+
+    def list(self) -> list[TokenInfo]:
+        with self._lock:
+            self._load_if_changed()
+            entries = sorted(self._tokens, key=lambda e: e["created"])
+            return [_entry_to_info(e) for e in entries]
+
+    def find(self, id_or_name: str) -> TokenInfo | None:
+        with self._lock:
+            self._load_if_changed()
+            entry = self._find_entry(id_or_name)
+            return _entry_to_info(entry) if entry is not None else None
+
+    def revoke(self, id_or_name: str) -> TokenInfo:
+        with self._lock:
+            self._load_if_changed()
+            entry = self._find_entry(id_or_name)
+            if entry is None:
+                raise KeyError(id_or_name)
+            self._tokens.remove(entry)
+            self._save()
+            return _entry_to_info(entry)
+
+    def verify(self, secret: str) -> TokenInfo | None:
+        if not isinstance(secret, str) or not secret:
+            return None
+        match = _SECRET_FORM_RE.match(secret)
+        if not match:
+            return None
+        token_id = match.group(1)
+        with self._lock:
+            try:
+                self._load_if_changed()
+            except ValueError as exc:
+                log.warning("Token-Datei nicht lesbar, Dienst läuft weiter: %s", exc)
+                return None
+            entry = None
+            for candidate in self._tokens:
+                if candidate["id"] == token_id:
+                    entry = candidate
+                    break
+            if entry is None:
+                return None
+            candidate_hash = "sha256:" + hashlib.sha256(secret.encode("utf-8")).hexdigest()
+            if not hmac.compare_digest(candidate_hash, entry["hash"]):
+                return None
+            self._touch(entry)
+            return _entry_to_info(entry)
+
+    def _touch(self, entry: dict) -> None:
+        """Schreibt `last_used` höchstens alle `touch_interval_s`; Schreibfehler werden ignoriert."""
+        now = self._now()
+        last_used = entry.get("last_used")
+        if last_used:
+            try:
+                elapsed = (now - datetime.fromisoformat(last_used)).total_seconds()
+            except ValueError:
+                elapsed = self._touch_interval_s
+            if elapsed < self._touch_interval_s:
+                return
+        entry["last_used"] = now.isoformat()
+        try:
+            self._save()
+        except OSError:
+            pass

tapesmith/archive.py

@@ -0,0 +1,220 @@
+"""Git-Archiv der Drucke: jeder erfolgreiche Druck wird (wenn `archive.dir` gesetzt
+ist) als JSON plus 1-Bit-PNG unter `<archive.dir>\\JJJJ\\` abgelegt. Sensible Drucke bekommen
+kein PNG und im JSON werden verdächtige Werte zusätzlich maskiert. Ein optionaler Git-Commit
+läuft nur nach bestandenem Secret-Scan, niemals `push`.
+
+`archive_hook` wird vom Druckdienst und vom Direktdruck nach jedem Druck aufgerufen;
+ein Fehler beim Archivieren darf den Druck selbst nie scheitern lassen.
+"""
+
+from __future__ import annotations
+
+import json
+import re
+import subprocess
+from collections.abc import Callable, Sequence
+from dataclasses import dataclass
+from io import BytesIO
+from pathlib import Path
+from typing import Any
+
+from PIL import Image
+
+from tapesmith import __version__
+from tapesmith.device.profile import DeviceProfile, load_profile
+from tapesmith.export import head_to_landscape
+from tapesmith.fileutil import atomic_write_bytes, atomic_write_text
+from tapesmith.history import HistoryEntry, HistoryStore
+from tapesmith.templates.fill import REDACTED
+from tapesmith.i18n import N_, _t
+
+ArchiveHook = Callable[[Any], list[str]]                        # Any = pipeline.PrintOutcome
+GitRunner = Callable[[list[str], Path], tuple[int, str, str]]
+
+_UMLAUT = {"ä": "ae", "ö": "oe", "ü": "ue", "ß": "ss", "Ä": "ae", "Ö": "oe", "Ü": "ue"}
+_SLUG_MAX = 40
+_NON_SLUG = re.compile(r"[^a-z0-9]+")
+_SECRET_KEY = re.compile(r"(?i)(password|passwort|pw|pin|token|secret|key)")
+_ARCHIVE_EXTS = ("*.json", "*.txt", "*.md", "*.csv")
+
+
+@dataclass(frozen=True)
+class SecretFinding:
+    kind: str            # z. B. "privater Schlüssel", "Passwort/Token-Zuweisung", "WLAN-Passwort", …
+    excerpt: str         # maskiert: erste 4 Zeichen + "…"
+
+
+SECRET_PATTERNS: tuple[tuple[str, re.Pattern], ...] = (
+    (N_("privater Schlüssel"), re.compile(r"-----BEGIN [A-Z ]*PRIVATE KEY-----")),
+    (N_("Passwort/Token-Zuweisung"), re.compile(
+        r'(?i)\b(?:password|passwort|kennwort|pass|pwd|token|secret|api[_-]?key)\b'
+        r'["\']?\s*[:=]\s*["\']?(?!•)([^\s"\',;]{4,})')),
+    (N_("WLAN-Passwort"), re.compile(r"WIFI:[^\n]*?P:(?!;)([^;]+);")),
+    ("GitHub-Token", re.compile(r"gh[pousr]_[A-Za-z0-9]{30,}")),
+    (N_("AWS-Schlüssel"), re.compile(r"AKIA[0-9A-Z]{16}")),
+    ("JWT", re.compile(r"eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.")),
+)
+
+
+def _mask(value: str) -> str:
+    return f"{value[:4]}…"
+
+
+def scan_secrets(text: str) -> list[SecretFinding]:
+    """Alle verdächtigen Muster in `text`; REDACTED-Werte (`templates.fill.REDACTED`) zählen
+    nicht (die Muster schließen sie per negativem Lookahead aus)."""
+    findings: list[SecretFinding] = []
+    for kind, pattern in SECRET_PATTERNS:
+        for match in pattern.finditer(text):
+            value = match.group(1) if match.groups() else match.group(0)
+            findings.append(SecretFinding(kind=_t(kind), excerpt=_mask(value)))
+    return findings
+
+
+def scan_path(path: Path) -> list[tuple[Path, SecretFinding]]:
+    """Secret-Scan über eine einzelne Datei oder rekursiv über `*.json`/`*.txt`/`*.md`/`*.csv`
+    eines Ordners. Unlesbare Dateien werden übersprungen, nie eine Ausnahme."""
+    path = Path(path)
+    if path.is_file():
+        files = [path]
+    else:
+        files = sorted({f for pattern in _ARCHIVE_EXTS for f in path.rglob(pattern)})
+    results: list[tuple[Path, SecretFinding]] = []
+    for file in files:
+        try:
+            text = file.read_text(encoding="utf-8")
+        except (OSError, UnicodeDecodeError):
+            continue
+        for finding in scan_secrets(text):
+            results.append((file, finding))
+    return results
+
+
+def _slug(text: str) -> str:
+    for umlaut, ascii_ in _UMLAUT.items():
+        text = text.replace(umlaut, ascii_)
+    text = _NON_SLUG.sub("-", text.lower()).strip("-")
+    return (text or "label")[:_SLUG_MAX].strip("-") or "label"
+
+
+def entry_record(entry: HistoryEntry) -> dict:
+    """JSON-Datensatz für das Archiv: bei sensiblen Einträgen wird jeder Wert, dessen
+    Schlüsselname nach einem Geheimnis aussieht und der nicht schon REDACTED ist, zusätzlich
+    maskiert (der Verlauf maskiert Vorlagenwerte bereits; das hier ist ein zweites Netz für
+    freie Werte wie Zwischenablage-Text). Der Titel bleibt unverändert."""
+    values = dict(entry.values)
+    if entry.sensitive:
+        values = {k: (REDACTED if (_SECRET_KEY.search(k) and v != REDACTED) else v)
+                  for k, v in values.items()}
+    return {
+        "id": entry.id,
+        "created": entry.created.isoformat(),
+        "source": entry.source,
+        "kind": entry.kind,
+        "title": entry.title,
+        "template": entry.template,
+        "values": values,
+        "length_mm": entry.length_mm,
+        "tape_mm": entry.tape_mm,
+        "copies": entry.copies,
+        "chained": entry.chained,
+        "status": entry.status,
+        "sensitive": entry.sensitive,
+        "app_version": __version__,
+    }
+
+
+def _save_png(path: Path, image: Image.Image) -> None:
+    buf = BytesIO()
+    image.save(buf, "PNG")
+    atomic_write_bytes(path, buf.getvalue())
+
+
+def archive_entry(entry: HistoryEntry, head: Image.Image | None, directory: Path,
+                  profile: DeviceProfile) -> list[Path]:
+    """Legt einen Verlaufseintrag unter `directory/JJJJ/` ab: immer die JSON, dazu ein
+    1-Bit-Querformat-PNG, wenn ein Kopfbild vorliegt und der Eintrag nicht sensibel ist."""
+    year_dir = Path(directory) / f"{entry.created.year}"
+    base = f"{entry.created:%Y-%m-%d_%H%M%S}_{entry.id:05d}_{_slug(entry.title)}"
+    json_path = year_dir / f"{base}.json"
+    atomic_write_text(json_path, json.dumps(entry_record(entry), indent=2, ensure_ascii=False, sort_keys=True))
+    paths = [json_path]
+    if head is not None and not entry.sensitive:
+        png_path = year_dir / f"{base}.png"
+        _save_png(png_path, head_to_landscape(head, profile).convert("1"))
+        paths.append(png_path)
+    return paths
+
+
+def _default_git_runner(argv: list[str], cwd: Path) -> tuple[int, str, str]:
+    result = subprocess.run(argv, cwd=str(cwd), capture_output=True, text=True)
+    return result.returncode, result.stdout, result.stderr
+
+
+def git_commit(files: Sequence[Path], directory: Path, message: str, *,
+              runner: GitRunner | None = None) -> str | None:
+    """Committet `files` (relativ zu `directory`), niemals `push`. Vorher ein Secret-Scan über
+    alle `.json`-Dateien: ein Treffer verhindert den Commit. Rückgabe `None` bei Erfolg, sonst
+    ein deutscher Hinweis."""
+    directory = Path(directory)
+    run = runner if runner is not None else _default_git_runner
+
+    for file in files:
+        file = Path(file)
+        if file.suffix != ".json":
+            continue
+        try:
+            text = file.read_text(encoding="utf-8")
+        except OSError:
+            continue
+        findings = scan_secrets(text)
+        if findings:
+            return _t("Nicht committet: {kind} in {file}", kind=findings[0].kind, file=file)
+
+    rc, _out, _err = run(["git", "rev-parse", "--is-inside-work-tree"], directory)
+    if rc != 0:
+        return _t("Kein Git-Repo: {directory}", directory=directory)
+
+    rel = [Path(f).relative_to(directory).as_posix() for f in files]
+    rc, out, err = run(["git", "add", "--", *rel], directory)
+    if rc != 0:
+        return _t("Git-Commit fehlgeschlagen: {strip}", strip=(err or out).strip())
+    rc, out, err = run(["git", "commit", "-m", message, "--", *rel], directory)
+    if rc != 0:
+        return _t("Git-Commit fehlgeschlagen: {strip}", strip=(err or out).strip())
+    return None
+
+
+def archive_hook(cfg: dict, *, history_factory: Callable[[], HistoryStore] = HistoryStore,
+                 profile_loader: Callable[[], DeviceProfile] | None = None,
+                 git_runner: GitRunner | None = None) -> ArchiveHook | None:
+    """Baut den Archiv-Hook aus der Konfiguration; `None`, wenn `archive.dir` fehlt (Default wie
+    in `SECTION_DEFAULTS`: `{"dir": None, "git_commit": False}`). Der Hook fängt jede Ausnahme,
+    denn ein Druck darf nie am Archiv scheitern."""
+    archive_cfg = cfg.get("archive") or {}
+    directory = archive_cfg.get("dir")
+    if not directory:
+        return None
+    directory = Path(directory)
+    do_commit = bool(archive_cfg.get("git_commit", False))
+
+    def hook(outcome) -> list[str]:
+        if outcome.status != "ok" or outcome.history_id is None:
+            return []
+        try:
+            with history_factory() as store:
+                entry = store.get(outcome.history_id)
+                head = store.head_image(outcome.history_id)
+            profile = profile_loader() if profile_loader is not None else load_profile()
+            files = archive_entry(entry, head, directory, profile)
+            notes: list[str] = []
+            if do_commit:
+                message = f"Label #{entry.id}: {entry.title}"
+                result = git_commit(files, directory, message, runner=git_runner)
+                if result is not None:
+                    notes.append(result)
+            return notes
+        except Exception as exc:  # noqa: BLE001 (ein Druck darf nie am Archiv scheitern)
+            return [_t("Archiv: {exc}", exc=exc)]
+
+    return hook

tapesmith/automation/__init__.py

@@ -0,0 +1 @@
+"""Automatisierung im Druckdienst: Fassade für Addons und Kanäle (Hotfolder, MQTT, Telegram, MCP)."""

tapesmith/automation/facade.py

@@ -0,0 +1,131 @@
+"""Fassade `LabelFacade`: ein schmaler, stabiler Zugang zum Druckdienst für Addons.
+
+Hotfolder, MQTT, Telegram und MCP drucken nur über diese Klasse. Sie nutzt denselben Weg wie die
+Web-API (`webapi.labels`), damit Vorschau = Druck gilt und Fehldruckschutz, Kontingente, Verlauf,
+Warteschlange und Restmeter überall gleich wirken. Jede Druck- und Vorschau-Methode verlangt die
+Quelle des Auftrags (`origin`, einer aus `jobs.SOURCES`).
+"""
+
+from __future__ import annotations
+
+import base64
+import re
+from collections.abc import Callable, Sequence
+from pathlib import Path
+
+from tapesmith import config as config_mod
+from tapesmith.ipc import codec, pipe
+from tapesmith.jobs import SOURCES
+from tapesmith.templates import store
+from tapesmith.templates.model import TemplateError
+from tapesmith.webapi import convert, datajson, labels
+from tapesmith.webapi.context import ApiContext
+from tapesmith.webapi.events import EventBroker
+from tapesmith.webapi.labels import LabelNotPrintable
+from tapesmith.webapi.printing import options_from_json
+from tapesmith.webapi.routes_templates import template_summary_json
+from tapesmith.i18n import _t
+
+__all__ = ["LabelFacade", "LabelNotPrintable"]
+
+# Nur reine Vorlagennamen (wie `routes_templates._find_or_404`): nie Pfade laden.
+_NAME_RE = re.compile(r"^[A-Za-z0-9._-]{1,64}$")
+
+
+def _check_origin(origin: str) -> str:
+    if origin not in SOURCES:
+        raise ValueError(_t("Unbekannte Quelle '{origin}' (erlaubt: {items})", origin=origin, items=', '.join(SOURCES)))
+    return origin
+
+
+class LabelFacade:
+    """Zugang der Addons zum Druckdienst (drucken, Vorschau, Status, Warteschlange, Verlauf)."""
+
+    def __init__(self, service, *, ctx: ApiContext | None = None):
+        if ctx is None:
+            ctx = ApiContext(service=service, home_key=pipe.home_key(), token="", broker=EventBroker(),
+                             static_dir=Path("."), port=0)
+        self.service = service
+        self.ctx = ctx
+
+    @classmethod
+    def from_ctx(cls, ctx: ApiContext) -> LabelFacade:
+        return cls(ctx.service, ctx=ctx)
+
+    # ---------- Konfiguration ----------
+
+    def config(self) -> dict:
+        """Aktuelle Konfiguration (bei jedem Aufruf frisch)."""
+        return self.ctx.config()
+
+    # ---------- Labels ----------
+
+    def render(self, source: dict, options: dict | None = None, *, origin: str) -> dict:
+        """`RenderJson` (Vorschau nur bei druckbaren Labels)."""
+        _check_origin(origin)
+        opts = options_from_json(options)
+        return labels.render_json(self.ctx, labels.resolve(self.ctx, source, origin=origin), opts)
+
+    def print(self, source: dict, options: dict | None = None, *, origin: str) -> dict:
+        """`OutcomeJson`; `LabelNotPrintable` (ValueError), wenn die Quelle nicht druckbar ist."""
+        _check_origin(origin)
+        return labels.print_source(self.ctx, source, options_from_json(options), origin=origin)
+
+    def preview_png(self, source: dict, options: dict | None = None, *, origin: str,
+                    raster: bool = False) -> bytes:
+        """PNG der Vorschau (`design_png`, mit `raster=True` das 1-Bit-Rasterbild)."""
+        _check_origin(origin)
+        opts = options_from_json(options)
+        resolved = labels.resolve(self.ctx, source, origin=origin)
+        out = labels.render_json(self.ctx, resolved, opts)
+        preview = out.get("preview")
+        if not out.get("ok") or not preview:
+            raise LabelNotPrintable(resolved)
+        return base64.b64decode(preview["raster_png" if raster else "design_png"])
+
+    def template_summaries(self, names: Sequence[str] | None = None) -> list[dict]:
+        """`TemplateSummary` aller Vorlagen oder der genannten (in dieser Reihenfolge, Unbekannte fehlen)."""
+        favs = set(config_mod.gui_setting(self.config(), "favorites"))
+        if names is None:
+            return [template_summary_json(t, favs) for t in store.list_templates()]
+        out: list[dict] = []
+        for name in names:
+            if not isinstance(name, str) or not _NAME_RE.match(name):
+                continue
+            try:
+                template = store.find_template(name)
+            except TemplateError:
+                continue
+            out.append(template_summary_json(template, favs))
+        return out
+
+    # ---------- Zustand ----------
+
+    def status(self) -> dict:
+        """`StatusJson` aus dem Cache des Dienstes (kein Druckerkontakt)."""
+        report = self.service.status(fresh=False)
+        return convert.status_json(report, now=self.ctx.now(), mac=self.config().get("mac"))
+
+    def state(self) -> dict:
+        return codec.encode_state(self.service.state())
+
+    def queue(self, include_done: bool = False) -> dict:
+        return self.service.queue_snapshot(include_done=include_done)
+
+    def cancel_queued(self, job_id: int) -> bool:
+        return bool(self.service.queue_cancel(job_id))
+
+    def history(self, limit: int = 20, query: str = "") -> list[dict]:
+        history = self.service.history
+        return [datajson.history_entry_json(e, history) for e in history.search(query, limit)]
+
+    def remaining_m(self) -> float | None:
+        remaining = self.service.rolls.remaining_mm()
+        return None if remaining is None else remaining / 1000
+
+    def verified(self) -> tuple[str, ...]:
+        return tuple(self.ctx.profile().verified)
+
+    def subscribe(self, fn: Callable[[str, dict], None]) -> None:
+        """Ereignisse des Dienstes (`job`, `status`, `queue` …) an `fn(event, data)`."""
+        self.service.add_emitter(fn)