Bring the console onto the contract the Go side now pins

internal/app/contract_test.go asserts the exact JSON key set of every admin
endpoint, and the console was reading fields that shape does not contain —
which is how a page can be entirely blank while the Go suite is green. The
types file is rewritten against the canonical shapes and every consumer is
fixed onto it.

The page bugs that came out of it:

The cache "Lookups" column read `count` and "Last seen" read `last_seen`; the
cache tracks a hit counter and a byte count per name and sends `hits`, so
there is no last-seen data to show at all. Lookups now reads hits, Last seen
is gone, and the row's bytes are shown. The "Size" card shows bytes_human,
with size as the entry-budget hint it actually is.

The Sources table read `item.enabled`, `item.rules`, `item.bytes`,
`item.updated_at` and `item.err`; those live under `item.meta`, so the table
was blank and the per-row toggle posted `name: undefined`. The refresh toast
counted the names echoed back and said "every source" for an empty list.

The dashboard read `qps` and `total_queries` where the server sends
`queries_per_sec` and `queries_total`, and rendered a `latency`/`p99` block
the dashboard response never contained. The `Partial<Dashboard>`-and-cast
that papered over this is gone. `blocked_pct` arrives as 0..100 from REST and
0..1 over SSE, so formatPercent is 0..100 only and a new formatFraction
handles the SSE frame.

Logs rendered `qtype` as a string; it is a number, with `qtype_name`
alongside, so there is a formatQtype that prefers the name. The Domains page
read `item.list` where the server sends `source`, and showed an Updated column
with no timestamp behind it.

Upstreams treated `healthcheck_interval` and `breaker_cooldown` as numbers of
seconds; they are duration strings now, so the page parses them like the
bootstrap refresh it already handled and the write payload no longer sends the
runtime health fields the server ignores. A group edit stripped the four
server-owned counters before writing, because config.Group would reject them.

`whoami.can_write` and `whoami.read_only` were fetched and never used, so a
read-only API key still showed every Save control. A single whoami fetch now
lives in a session provider behind the app shell, every write control is
gated on it, and a banner says why when the key is read-only. It fails open:
an unreachable probe must not lock an operator out of their own console.

Two server fixes the console work exposed, both pinned by the contract test:

POST /api/blocklists/refresh with a body that omits `names` answered
{"names": null}, and the console counts the names it gets back to build its
toast — so "refresh everything" said "0 sources". A nil slice now becomes an
empty one and the key set does not depend on the request.

blocklist.SourceMeta.duration was a raw time.Duration, so it went out as a
nanosecond count and the console divided by 1e6 to compensate — the only
duration on the wire that was not a duration string. It is a config.Duration
now, and formatDuration parses it like the others.

The contract test grew to cover what the first pass left out: the domain
check in all three of its shapes (match, miss, and an error delivered as 200),
the log clear, the settings validate in both the valid and the malformed case,
the settings save and reload, and the first SSE frame.

internal/api/handlers.go

@@ -95,6 +95,12 @@ func (s *Server) handleBlocklistRefresh(w http.ResponseWriter, r *http.Request)
 			return
 		}
 	}
+	if in.Names == nil {
+		// A nil slice marshals to null, and the console counts the names it
+		// gets back to build its toast — so "refresh everything" reported
+		// "0 sources". The key set must not depend on the request.
+		in.Names = []string{}
+	}
 	if err := s.hooks.RefreshBlocklists(r.Context(), in.Names); err != nil {
 		writeError(w, http.StatusInternalServerError, err.Error())
 		return

internal/app/contract_test.go

@@ -1,7 +1,9 @@
 package app
 
 import (
+	"bufio"
 	"encoding/json"
+	"io"
 	"net/http"
 	"sort"
 	"strconv"
@@ -429,3 +431,156 @@ func TestConsoleWritePayloadsAreAccepted(t *testing.T) {
 		}
 	})
 }
+
+// TestRemainingEndpointKeySets covers the endpoints the first pass left out:
+// the domain check (which has three distinct shapes, one of them an error
+// delivered as 200), the log clear, the settings writes and the first SSE
+// frame. A key set the console reads but no test pins is a field that works
+// today and breaks the console the first time somebody tidies a struct.
+func TestRemainingEndpointKeySets(t *testing.T) {
+	h := newHarness(t, nil)
+
+	t.Run("domain check miss", func(t *testing.T) {
+		code, body := h.get("/api/domains/check?name=nothing.example.test")
+		if code != http.StatusOK {
+			t.Fatalf("GET /api/domains/check = %d: %s", code, body)
+		}
+		requireKeys(t, "GET /api/domains/check (no match)", keysOf(t, body),
+			wantKeys("action", "matched", "name", "query", "source"))
+	})
+
+	t.Run("domain check match", func(t *testing.T) {
+		code, body := h.get("/api/domains/check?name=ads.example.com")
+		if code != http.StatusOK {
+			t.Fatalf("GET /api/domains/check = %d: %s", code, body)
+		}
+		requireKeys(t, "GET /api/domains/check (match)", keysOf(t, body), wantKeys(
+			"action", "categories", "hits", "match_kind", "matched",
+			"matched_pattern", "name", "query", "rule", "source",
+		))
+	})
+
+	t.Run("logs clear", func(t *testing.T) {
+		code, body := h.do(http.MethodPost, "/api/logs/clear", "")
+		if code != http.StatusOK {
+			t.Fatalf("POST /api/logs/clear = %d: %s", code, body)
+		}
+		requireKeys(t, "POST /api/logs/clear", keysOf(t, body), wantKeys("ok"))
+	})
+
+	t.Run("settings validate", func(t *testing.T) {
+		// A document that is valid: the issue lists are present and empty.
+		code, body := h.do(http.MethodPost, "/api/settings/validate",
+			`{"config_yaml":"listen: 127.0.0.1:5353\n"}`)
+		if code != http.StatusOK {
+			t.Fatalf("POST /api/settings/validate = %d: %s", code, body)
+		}
+		requireKeys(t, "POST /api/settings/validate", keysOf(t, body),
+			wantKeys("errors", "ok", "warnings"))
+		// A malformed document is still a 200 with a populated `errors`: the
+		// console renders the field list, so the envelope is the same.
+		code, body = h.do(http.MethodPost, "/api/settings/validate", `{"config_yaml":"\t- :\n"}`)
+		if code != http.StatusOK {
+			t.Fatalf("POST /api/settings/validate (bad yaml) = %d: %s", code, body)
+		}
+		requireKeys(t, "POST /api/settings/validate (bad yaml)", keysOf(t, body),
+			wantKeys("errors", "ok", "warnings"))
+		var bad struct {
+			Errors []struct{ Field, Message string } `json:"errors"`
+		}
+		if err := json.Unmarshal(body, &bad); err != nil {
+			t.Fatal(err)
+		}
+		if len(bad.Errors) == 0 {
+			t.Errorf("a malformed document validated clean: %s", body)
+		}
+	})
+
+	t.Run("settings save and reload", func(t *testing.T) {
+		doc := h.OriginalConfig()
+		code, body := h.do(http.MethodPut, "/api/settings", `{"config_yaml":`+quote(doc)+`}`)
+		if code != http.StatusOK {
+			t.Fatalf("PUT /api/settings = %d: %s", code, body)
+		}
+		requireKeys(t, "PUT /api/settings", keysOf(t, body), wantKeys("ok", "version", "warnings"))
+		code, body = h.do(http.MethodPost, "/api/settings/reload", "")
+		if code != http.StatusOK {
+			t.Fatalf("POST /api/settings/reload = %d: %s", code, body)
+		}
+		requireKeys(t, "POST /api/settings/reload", keysOf(t, body), wantKeys("ok", "version"))
+	})
+
+	t.Run("log stream ready frame", func(t *testing.T) {
+		// The stream never ends, so read the first frame and hang up: the
+		// console only needs to know the stream opened and what it carries.
+		req, _ := http.NewRequest("GET", "http://"+h.api+"/api/logs/stream", nil)
+		req.Header.Set("X-API-Key", h.key)
+		res, err := http.DefaultClient.Do(req)
+		if err != nil {
+			t.Fatalf("GET /api/logs/stream: %v", err)
+		}
+		defer res.Body.Close()
+		if res.StatusCode != http.StatusOK {
+			t.Fatalf("GET /api/logs/stream = %d", res.StatusCode)
+		}
+		br := newLineReader(res.Body)
+		var event, data string
+		for range 2 {
+			line, err := br.readLine()
+			if err != nil {
+				t.Fatalf("read stream: %v", err)
+			}
+			switch {
+			case line == "":
+			case len(line) > 7 && line[:7] == "event: ":
+				event = line[7:]
+			case len(line) > 6 && line[:6] == "data: ":
+				data = line[6:]
+			}
+			if event != "" && data != "" {
+				break
+			}
+		}
+		if event != "ready" {
+			t.Fatalf("first event = %q, want ready", event)
+		}
+		requireKeys(t, "GET /api/logs/stream ready frame", keysOf(t, []byte(data)),
+			wantKeys("at", "version"))
+	})
+}
+
+// quote renders a Go string as a JSON string literal.
+func quote(s string) string {
+	b, err := json.Marshal(s)
+	if err != nil {
+		panic(err)
+	}
+	return string(b)
+}
+
+// lineReader reads \n-terminated lines off the SSE stream, which is what
+// bufio.Scanner would be for — except Scanner's default 64 KiB cap turns a long
+// data frame into "token too long" and the test would fail on payload size
+// rather than on the contract.
+type lineReader struct {
+	r   *bufio.Reader
+	buf []byte
+}
+
+func newLineReader(r io.Reader) *lineReader {
+	return &lineReader{r: bufio.NewReader(r), buf: make([]byte, 0, 4096)}
+}
+
+func (l *lineReader) readLine() (string, error) {
+	l.buf = l.buf[:0]
+	for {
+		chunk, isPrefix, err := l.r.ReadLine()
+		if err != nil {
+			return "", err
+		}
+		l.buf = append(l.buf, chunk...)
+		if !isPrefix {
+			return string(l.buf), nil
+		}
+	}
+}

internal/blocklist/manager.go

@@ -149,7 +149,7 @@ func (m *Manager) RefreshAll(ctx context.Context) (State, error) {
 			}
 			b.NoteSource(SourceMeta{
 				Name: "inline:block", Format: string(FormatPlain), Rules: len(rules),
-				Bytes: st.Bytes, UpdatedAt: start, Duration: time.Since(start), Enabled: true,
+				Bytes: st.Bytes, UpdatedAt: start, Duration: config.Duration(time.Since(start)), Enabled: true,
 			})
 		} else {
 			errs["inline:block"] = err.Error()
@@ -163,7 +163,7 @@ func (m *Manager) RefreshAll(ctx context.Context) (State, error) {
 			}
 			b.NoteSource(SourceMeta{
 				Name: "inline:allow", Format: string(FormatPlain), Rules: len(rules),
-				Bytes: st.Bytes, UpdatedAt: start, Duration: time.Since(start), Enabled: true,
+				Bytes: st.Bytes, UpdatedAt: start, Duration: config.Duration(time.Since(start)), Enabled: true,
 			})
 		} else {
 			errs["inline:allow"] = err.Error()
@@ -191,7 +191,7 @@ func (m *Manager) RefreshAll(ctx context.Context) (State, error) {
 		}
 		b.NoteSource(SourceMeta{
 			Name: name, Format: string(FormatRPZ), Rules: len(rules), Bytes: st.Bytes,
-			UpdatedAt: start, Duration: time.Since(start), Enabled: true, Path: pattern,
+			UpdatedAt: start, Duration: config.Duration(time.Since(start)), Enabled: true, Path: pattern,
 		})
 	}
 
@@ -371,7 +371,7 @@ func (m *Manager) loadOne(ctx context.Context, cfg *config.Config, l config.List
 		ETag:       etag,
 		LastMod:    lastMod,
 		UpdatedAt:  start,
-		Duration:   time.Since(start),
+		Duration:   config.Duration(time.Since(start)),
 		Enabled:    true,
 		URL:        l.URL,
 		Path:       path,

internal/blocklist/set.go

@@ -16,6 +16,8 @@ import (
 	"strings"
 	"sync/atomic"
 	"time"
+
+	"git.k8s-git-k6n.net/mats/fancy-dns/internal/config"
 )
 
 // Action is what to do with a matched name.
@@ -196,20 +198,24 @@ type RuleCounts struct {
 
 // SourceMeta describes one contributing source.
 type SourceMeta struct {
-	Name       string        `json:"name"`
-	Format     string        `json:"format"`
-	Rules      int           `json:"rules"`
-	Bytes      int64         `json:"bytes"`
-	ETag       string        `json:"etag"`
-	LastMod    string        `json:"last_mod"`
-	UpdatedAt  time.Time     `json:"updated_at"`
-	Duration   time.Duration `json:"duration"`
-	Err        string        `json:"err"`
-	Enabled    bool          `json:"enabled"`
-	URL        string        `json:"url"`
-	Path       string        `json:"path"`
-	Stale      bool          `json:"stale"`
-	HTTPStatus int           `json:"http_status"`
+	Name      string    `json:"name"`
+	Format    string    `json:"format"`
+	Rules     int       `json:"rules"`
+	Bytes     int64     `json:"bytes"`
+	ETag      string    `json:"etag"`
+	LastMod   string    `json:"last_mod"`
+	UpdatedAt time.Time `json:"updated_at"`
+	// Duration is a duration STRING on the wire, like every other duration the
+	// API serves: a raw time.Duration marshals as a nanosecond count, and the
+	// console was dividing by 1e6 to compensate for a number nobody else on
+	// the wire sends.
+	Duration   config.Duration `json:"duration"`
+	Err        string          `json:"err"`
+	Enabled    bool            `json:"enabled"`
+	URL        string          `json:"url"`
+	Path       string          `json:"path"`
+	Stale      bool            `json:"stale"`
+	HTTPStatus int             `json:"http_status"`
 }
 
 // Builder accumulates rules and produces a Set.

internal/web/dist/.gitkeep

@@ -1 +0,0 @@
-Build artifacts land here: run `make web` (npm ci && npm run build) then rebuild the binary.

internal/web/dist/index.html

@@ -5,7 +5,7 @@
     <link rel="icon" type="image/svg+xml" href="./favicon.svg" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <title>web</title>
-    <script type="module" crossorigin src="./assets/index-BVuSgjZf.js"></script>
+    <script type="module" crossorigin src="./assets/index-DHEE03zK.js"></script>
     <link rel="stylesheet" crossorigin href="./assets/index-CZ8p4VMZ.css">
   </head>
   <body>