migrate to hatch

Even though it is not a case in the application, the interface could be
used externally

.github/workflows/docker.yml

@@ -26,6 +26,10 @@ jobs:
 
       - uses: docker/setup-buildx-action@v3
 
+      - name: Set image date
+        id: args
+        run: echo "::set-output name=date::$(date -d yesterday +'%Y-%m-%d')"
+
       - name: Login to docker hub
         uses: docker/login-action@v3
         with:
@@ -53,6 +57,8 @@ jobs:
       - name: Build an image and push
         uses: docker/build-push-action@v6
         with:
+          build-args: |
+            BUILD_DATE=${{ steps.args.outputs.date }}
           file: docker/Dockerfile
           push: true
           tags: ${{ steps.meta.outputs.tags }}

.github/workflows/setup.sh

@@ -12,11 +12,11 @@ pacman -Syyu --noconfirm
 # main dependencies
 pacman -S --noconfirm devtools git npm pyalpm python-bcrypt python-filelock python-inflection python-pyelftools python-requests python-systemd sudo
 # make dependencies
-pacman -S --noconfirm --asdeps base-devel python-build python-flit python-installer python-tox python-wheel
+pacman -S --noconfirm --asdeps base-devel python-build python-hatchling python-installer python-tox python-wheel
 # optional dependencies
 if [[ -z $MINIMAL_INSTALL ]]; then
     # web server
-    pacman -S --noconfirm python-aioauth-client python-aiohttp python-aiohttp-apispec-git python-aiohttp-cors python-aiohttp-jinja2 python-aiohttp-security python-aiohttp-session python-cryptography python-jinja
+    pacman -S --noconfirm python-aioauth-client python-aiohttp python-aiohttp-apispec-git python-aiohttp-cors python-aiohttp-jinja2 python-aiohttp-security python-aiohttp-session python-aiohttp-sse-git python-cryptography python-jinja
     # additional features
     pacman -S --noconfirm gnupg ipython python-boto3 python-cerberus python-matplotlib rsync
 fi

.readthedocs.yml

@@ -1,9 +1,9 @@
 version: 2
 
 build:
-  os: ubuntu-20.04
+  os: ubuntu-lts-latest
   tools:
-    python: "3.12"
+    python: "3.13"
   apt_packages:
     - graphviz
 

docker/Dockerfile

@@ -1,13 +1,15 @@
 # build image
 FROM archlinux:base AS build
 
+ARG BUILD_DATE
+
 # install environment
 ## create build user
 RUN useradd -m -d "/home/build" -s "/usr/bin/nologin" build
 
 ## extract container creation date and set mirror for this timestamp, set PKGEXT and refresh database next
-RUN echo "Server = https://archive.archlinux.org/repos/$(stat -c "%y" "/var/lib/pacman" | cut -d " " -f 1 | sed "s,-,/,g")/\$repo/os/\$arch" > "/etc/pacman.d/mirrorlist" && \
+RUN echo "Server = https://archive.archlinux.org/repos/${BUILD_DATE//-/\/}/\$repo/os/\$arch" > "/etc/pacman.d/mirrorlist" && \
-    pacman -Sy
+    pacman -Syyuu --noconfirm
 ## setup package cache
 RUN runuser -u build -- mkdir "/tmp/pkg" && \
     echo "PKGDEST=/tmp/pkg" >> "/etc/makepkg.conf" && \
@@ -29,17 +31,16 @@ RUN pacman -S --noconfirm --asdeps \
         python-filelock \
         python-inflection \
         python-pyelftools \
-        python-requests \
+        python-requests
-        && \
+RUN pacman -S --noconfirm --asdeps \
-    pacman -S --noconfirm --asdeps \
         base-devel \
         python-build \
-        python-flit \
+        python-hatchling \
         python-installer \
+        python-setuptools \
         python-tox \
-        python-wheel \
+        python-wheel
-        && \
+RUN pacman -S --noconfirm --asdeps \
-    pacman -S --noconfirm --asdeps \
         git \
         python-aiohttp \
         python-aiohttp-openmetrics \
@@ -48,9 +49,8 @@ RUN pacman -S --noconfirm --asdeps \
         python-cryptography \
         python-jinja \
         python-systemd \
-        rsync \
+        rsync
-        && \
+RUN runuser -u build -- install-aur-package \
-    runuser -u build -- install-aur-package \
         python-aioauth-client \
         python-sphinx-typlog-theme \
         python-webargs \
@@ -59,6 +59,7 @@ RUN pacman -S --noconfirm --asdeps \
         python-aiohttp-jinja2 \
         python-aiohttp-session \
         python-aiohttp-security \
+        python-aiohttp-sse-git \
         python-requests-unixsocket2
 
 # install ahriman
@@ -109,7 +110,7 @@ RUN cp "/etc/pacman.d/mirrorlist" "/etc/pacman.d/mirrorlist.orig" && \
     echo "Server = file:///var/cache/pacman/pkg" > "/etc/pacman.d/mirrorlist" && \
     cp "/etc/pacman.conf" "/etc/pacman.conf.orig" && \
     sed -i "s/SigLevel *=.*/SigLevel = Optional/g" "/etc/pacman.conf" && \
-    pacman -Sy
+    pacman -Syyuu --noconfirm
 ## install package and its optional dependencies
 RUN pacman -S --noconfirm ahriman
 RUN pacman -S --noconfirm --asdeps \

docker/install-aur-package.sh

@@ -7,8 +7,10 @@ for PACKAGE in "$@"; do
     # clone the remote source
     git clone https://aur.archlinux.org/"$PACKAGE".git "$BUILD_DIR"
     cd "$BUILD_DIR"
+    # FIXME monkey patch PKGBUILD for python
+    sed -i 's/python -m build/python -m build --skip-dependency-check/g' "PKGBUILD"
     # checkout to the image date
-    git checkout "$(git rev-list -1 --before="$(stat -c "%y" "/var/lib/pacman" | cut -d " " -f 1)" master)"
+    git checkout "$(git rev-list -1 --before="$BUILD_DATE" master)"
     # build and install the package
     makepkg --nocheck --noconfirm --install --rmdeps --syncdeps
     cd /

docs/ahriman.core.status.rst

@@ -12,6 +12,14 @@ ahriman.core.status.client module
    :no-undoc-members:
    :show-inheritance:
 
+ahriman.core.status.event\_bus module
+-------------------------------------
+
+.. automodule:: ahriman.core.status.event_bus
+   :members:
+   :no-undoc-members:
+   :show-inheritance:
+
 ahriman.core.status.local\_client module
 ----------------------------------------
 

docs/ahriman.web.middlewares.rst

@@ -12,6 +12,14 @@ ahriman.web.middlewares.auth\_handler module
    :no-undoc-members:
    :show-inheritance:
 
+ahriman.web.middlewares.etag\_handler module
+--------------------------------------------
+
+.. automodule:: ahriman.web.middlewares.etag_handler
+   :members:
+   :no-undoc-members:
+   :show-inheritance:
+
 ahriman.web.middlewares.exception\_handler module
 -------------------------------------------------
 

docs/ahriman.web.schemas.rst

@@ -92,6 +92,14 @@ ahriman.web.schemas.error\_schema module
    :no-undoc-members:
    :show-inheritance:
 
+ahriman.web.schemas.event\_bus\_filter\_schema module
+-----------------------------------------------------
+
+.. automodule:: ahriman.web.schemas.event_bus_filter_schema
+   :members:
+   :no-undoc-members:
+   :show-inheritance:
+
 ahriman.web.schemas.event\_schema module
 ----------------------------------------
 
@@ -356,6 +364,14 @@ ahriman.web.schemas.search\_schema module
    :no-undoc-members:
    :show-inheritance:
 
+ahriman.web.schemas.sse\_schema module
+--------------------------------------
+
+.. automodule:: ahriman.web.schemas.sse_schema
+   :members:
+   :no-undoc-members:
+   :show-inheritance:
+
 ahriman.web.schemas.status\_schema module
 -----------------------------------------
 

docs/ahriman.web.views.v1.auditlog.rst

@@ -4,6 +4,14 @@ ahriman.web.views.v1.auditlog package
 Submodules
 ----------
 
+ahriman.web.views.v1.auditlog.event\_bus module
+-----------------------------------------------
+
+.. automodule:: ahriman.web.views.v1.auditlog.event_bus
+   :members:
+   :no-undoc-members:
+   :show-inheritance:
+
 ahriman.web.views.v1.auditlog.events module
 -------------------------------------------
 

docs/architecture.rst

@@ -235,6 +235,18 @@ Remove packages
 
 This flow removes package from filesystem, updates repository database and also runs synchronization and reporting methods.
 
+Rollback packages
+^^^^^^^^^^^^^^^^^
+
+This flow restores a package to a previously built version:
+
+#. Load the current package definition from the repository database.
+#. Replace its version with the requested rollback target.
+#. Search the archive directory for built artifacts (packages and signatures) matching the target version.
+#. Add the found artifacts to the repository via the same path as ``package-add`` with ``PackageSource.Archive``.
+#. Trigger an immediate update to process the added packages.
+#. If ``--hold`` is enabled (the default), mark the package as held in the database to prevent automatic updates from overriding the rollback.
+
 Check outdated packages
 ^^^^^^^^^^^^^^^^^^^^^^^
 

docs/configuration.rst

@@ -180,10 +180,15 @@ Web server settings. This feature requires ``aiohttp`` libraries to be installed
 
 * ``address`` - optional address in form ``proto://host:port`` (``port`` can be omitted in case of default ``proto`` ports), will be used instead of ``http://{host}:{port}`` in case if set, string, optional. This option is required in case if ``OAuth`` provider is used.
 * ``autorefresh_intervals`` - enable page auto refresh options, space separated list of integers, optional. The first defined interval will be used as default. If no intervals set, the auto refresh buttons will be disabled. If first element of the list equals ``0``, auto refresh will be disabled by default.
+* ``cors_allow_headers`` - allowed CORS headers, space separated list of strings, optional.
+* ``cors_allow_methods`` - allowed CORS methods, space separated list of strings, optional.
+* ``cors_allow_origins`` - allowed CORS origins, space separated list of strings, optional, default ``*``.
+* ``cors_expose_headers`` - exposed CORS headers, space separated list of strings, optional.
 * ``enable_archive_upload`` - allow to upload packages via HTTP (i.e. call of ``/api/v1/service/upload`` uri), boolean, optional, default ``no``.
 * ``host`` - host to bind, string, optional.
 * ``index_url`` - full URL of the repository index page, string, optional.
 * ``max_body_size`` - max body size in bytes to be validated for archive upload, integer, optional. If not set, validation will be disabled.
+* ``max_queue_size`` - max queue size for server sent event streams, integer, optional, default ``0``. If set to ``0``, queue is unlimited.
 * ``port`` - port to bind, integer, optional.
 * ``service_only`` - disable status routes (including logs), boolean, optional, default ``no``.
 * ``static_path`` - path to directory with static files, string, required.
@@ -191,7 +196,7 @@ Web server settings. This feature requires ``aiohttp`` libraries to be installed
 * ``templates`` - path to templates directories, space separated list of paths, required.
 * ``unix_socket`` - path to the listening unix socket, string, optional. If set, server will create the socket on the specified address which can (and will) be used by application. Note, that unlike usual host/port configuration, unix socket allows to perform requests without authorization.
 * ``unix_socket_unsafe`` - set unsafe (o+w) permissions to unix socket, boolean, optional, default ``yes``. This option is enabled by default, because it is supposed that unix socket is created in safe environment (only web service is supposed to be used in unsafe), but it can be disabled by configuration.
-* ``wait_timeout`` - wait timeout in seconds, maximum amount of time to be waited before lock will be free, integer, optional.
+* ``wait_timeout`` - wait timeout in seconds, maximum amount of time to be waited before lock will be free, integer, optional. If set to ``0``, wait infinitely.
 
 ``archive`` group
 -----------------

docs/faq/backup.rst

@@ -33,3 +33,28 @@ The service provides several commands aim to do easy repository backup and resto
    .. code-block:: shell
 
       sudo -u ahriman ahriman repo-rebuild --from-database
+
+Package rollback
+================
+
+If the ``archive.keep_built_packages`` option is enabled, the service keeps previously built package files in the archive directory. These archives can be used to rollback a package to a previous successfully built version.
+
+#.
+   List available archive versions for a package:
+
+   .. code-block:: shell
+
+      ahriman package-archives ahriman
+
+#.
+   Rollback the package to the desired version:
+
+   .. code-block:: shell
+
+      sudo -u ahriman ahriman package-rollback ahriman 2.19.0-1
+
+   By default, the ``--hold`` flag is enabled, which prevents the package from being automatically updated on subsequent ``repo-update`` runs. To rollback without holding the package use:
+
+   .. code-block:: shell
+
+      sudo -u ahriman ahriman package-rollback ahriman 2.19.0-1 --no-hold

docs/requirements.txt

@@ -7,10 +7,13 @@ aiohttp==3.11.18
     #   ahriman (pyproject.toml)
     #   aiohttp-cors
     #   aiohttp-jinja2
+    #   aiohttp-sse
 aiohttp-cors==0.8.1
     # via ahriman (pyproject.toml)
 aiohttp-jinja2==1.6
     # via ahriman (pyproject.toml)
+aiohttp-sse==2.2.0
+    # via ahriman (pyproject.toml)
 aiosignal==1.3.2
     # via aiohttp
 alabaster==1.0.0

frontend/eslint.config.js

@@ -1,5 +1,6 @@
 import js from "@eslint/js";
 import stylistic from "@stylistic/eslint-plugin";
+import react from "eslint-plugin-react";
 import reactHooks from "eslint-plugin-react-hooks";
 import reactRefresh from "eslint-plugin-react-refresh";
 import simpleImportSort from "eslint-plugin-simple-import-sort";
@@ -8,7 +9,11 @@ import tseslint from "typescript-eslint";
 export default tseslint.config(
     { ignores: ["dist"] },
     {
-        extends: [js.configs.recommended, ...tseslint.configs.recommendedTypeChecked],
+        extends: [
+            js.configs.recommended,
+            react.configs.flat.recommended,
+            ...tseslint.configs.recommendedTypeChecked,
+        ],
         files: ["src/**/*.{ts,tsx}"],
         languageOptions: {
             parserOptions: {
@@ -17,13 +22,14 @@ export default tseslint.config(
             },
         },
         plugins: {
+            "@stylistic": stylistic,
             "react-hooks": reactHooks,
             "react-refresh": reactRefresh,
             "simple-import-sort": simpleImportSort,
-            "@stylistic": stylistic,
         },
         rules: {
             ...reactHooks.configs.recommended.rules,
+            "react/react-in-jsx-scope": "off",
             "react-refresh/only-export-components": ["warn", { allowConstantExport: true }],
 
             // imports
@@ -33,7 +39,7 @@ export default tseslint.config(
             // core
             "curly": "error",
             "eqeqeq": "error",
-            "no-console": "error",
+            "no-console": ["warn", { allow: ["warn", "error"] }],
             "no-eval": "error",
 
             // stylistic
@@ -68,6 +74,7 @@ export default tseslint.config(
             "@typescript-eslint/consistent-type-imports": ["error", { prefer: "type-imports" }],
             "@typescript-eslint/explicit-function-return-type": ["error", { allowExpressions: true }],
             "@typescript-eslint/no-deprecated": "error",
+            "@typescript-eslint/no-floating-promises": "error",
             "@typescript-eslint/no-unused-vars": ["error", { argsIgnorePattern: "^_" }],
             "@typescript-eslint/prefer-nullish-coalescing": "error",
             "@typescript-eslint/prefer-optional-chain": "error",

frontend/package.json

@@ -5,11 +5,12 @@
         "@mui/icons-material": ">=7.3.0 <7.4.0",
         "@mui/material": ">=7.3.0 <7.4.0",
         "@mui/x-data-grid": ">=8.28.0 <8.29.0",
-        "@tanstack/react-query": ">=5.94.0 <5.95.0",
+        "@tanstack/react-query": ">=5.101.0 <5.102.0",
         "chart.js": ">=4.5.0 <4.6.0",
         "react": ">=19.2.0 <19.3.0",
         "react-chartjs-2": ">=5.3.0 <5.4.0",
         "react-dom": ">=19.2.0 <19.3.0",
+        "react-error-boundary": ">=6.1.0 <6.2.0",
         "react-syntax-highlighter": ">=16.1.0 <16.2.0"
     },
     "devDependencies": {
@@ -20,12 +21,13 @@
         "@types/react-syntax-highlighter": ">=15.5.0 <15.6.0",
         "@vitejs/plugin-react": ">=6.0.0 <6.1.0",
         "eslint": ">=9.39.0 <9.40.0",
-        "eslint-plugin-react-hooks": ">=7.0.0 <7.1.0",
+        "eslint-plugin-react": ">=7.37.0 <7.38.0",
+        "eslint-plugin-react-hooks": ">=7.1.0 <7.2.0",
         "eslint-plugin-react-refresh": ">=0.5.0 <0.6.0",
         "eslint-plugin-simple-import-sort": ">=12.1.0 <12.2.0",
         "typescript": ">=5.9.0 <5.10.0",
         "typescript-eslint": ">=8.57.0 <8.58.0",
-        "vite": ">=8.0.0 <8.1.0"
+        "vite": ">=8.1.0 <8.2.0"
     },
     "name": "ahriman-frontend",
     "private": true,

frontend/src/App.tsx

@@ -21,6 +21,7 @@ import { QueryClient, QueryClientProvider } from "@tanstack/react-query";
 import AppLayout from "components/layout/AppLayout";
 import { AuthProvider } from "contexts/AuthProvider";
 import { ClientProvider } from "contexts/ClientProvider";
+import { EventStreamProvider } from "contexts/EventStreamProvider";
 import { NotificationProvider } from "contexts/NotificationProvider";
 import { RepositoryProvider } from "contexts/RepositoryProvider";
 import { ThemeProvider } from "contexts/ThemeProvider";
@@ -30,7 +31,6 @@ const queryClient = new QueryClient({
     defaultOptions: {
         queries: {
             retry: 1,
-            staleTime: 30_000,
         },
     },
 });
@@ -42,7 +42,9 @@ export default function App(): React.JSX.Element {
                 <ClientProvider>
                     <AuthProvider>
                         <RepositoryProvider>
+                            <EventStreamProvider>
                                 <AppLayout />
+                            </EventStreamProvider>
                         </RepositoryProvider>
                     </AuthProvider>
                 </ClientProvider>

frontend/src/components/common/AutoRefreshControl.tsx

@@ -1,91 +0,0 @@
-/*
- * Copyright (c) 2021-2026 ahriman team.
- *
- * This file is part of ahriman
- * (see https://github.com/arcan1s/ahriman).
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program. If not, see <http://www.gnu.org/licenses/>.
- */
-import CheckIcon from "@mui/icons-material/Check";
-import TimerIcon from "@mui/icons-material/Timer";
-import TimerOffIcon from "@mui/icons-material/TimerOff";
-import { IconButton, ListItemIcon, ListItemText, Menu, MenuItem, Tooltip } from "@mui/material";
-import type { AutoRefreshInterval } from "models/AutoRefreshInterval";
-import React, { useState } from "react";
-
-interface AutoRefreshControlProps {
-    currentInterval: number;
-    intervals: AutoRefreshInterval[];
-    onIntervalChange: (interval: number) => void;
-}
-
-export default function AutoRefreshControl({
-    currentInterval,
-    intervals,
-    onIntervalChange,
-}: AutoRefreshControlProps): React.JSX.Element | null {
-    const [anchorEl, setAnchorEl] = useState<HTMLElement | null>(null);
-
-    if (intervals.length === 0) {
-        return null;
-    }
-
-    const enabled = currentInterval > 0;
-
-    return <>
-        <Tooltip title="Auto-refresh">
-            <IconButton
-                aria-label="Auto-refresh"
-                color={enabled ? "primary" : "default"}
-                onClick={event => setAnchorEl(event.currentTarget)}
-                size="small"
-            >
-                {enabled ? <TimerIcon fontSize="small" /> : <TimerOffIcon fontSize="small" />}
-            </IconButton>
-        </Tooltip>
-        <Menu
-            anchorEl={anchorEl}
-            onClose={() => setAnchorEl(null)}
-            open={Boolean(anchorEl)}
-        >
-            <MenuItem
-                onClick={() => {
-                    onIntervalChange(0);
-                    setAnchorEl(null);
-                }}
-                selected={!enabled}
-            >
-                <ListItemIcon>
-                    {!enabled && <CheckIcon fontSize="small" />}
-                </ListItemIcon>
-                <ListItemText>Off</ListItemText>
-            </MenuItem>
-            {intervals.map(interval =>
-                <MenuItem
-                    key={interval.interval}
-                    onClick={() => {
-                        onIntervalChange(interval.interval);
-                        setAnchorEl(null);
-                    }}
-                    selected={enabled && interval.interval === currentInterval}
-                >
-                    <ListItemIcon>
-                        {enabled && interval.interval === currentInterval && <CheckIcon fontSize="small" />}
-                    </ListItemIcon>
-                    <ListItemText>{interval.text}</ListItemText>
-                </MenuItem>,
-            )}
-        </Menu>
-    </>;
-}

frontend/src/components/common/ErrorBoundary.tsx

@@ -0,0 +1,55 @@
+/*
+ * Copyright (c) 2021-2026 ahriman team.
+ *
+ * This file is part of ahriman
+ * (see https://github.com/arcan1s/ahriman).
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ */
+import { Box, Button, Typography } from "@mui/material";
+import type React from "react";
+import type { FallbackProps } from "react-error-boundary";
+
+interface ErrorDetails {
+    message: string;
+    stack: string | undefined;
+}
+
+export default function ErrorFallback({ error }: FallbackProps): React.JSX.Element {
+
+    const details: ErrorDetails = error instanceof Error
+        ? { message: error.message, stack: error.stack }
+        : { message: String(error), stack: undefined };
+
+    return <Box role="alert" sx={{ color: "text.primary", minHeight: "100vh", p: 6 }}>
+        <Typography sx={{ fontWeight: 700 }} variant="h4">
+            Something went wrong
+        </Typography>
+
+        <Typography color="error" sx={{ fontFamily: "monospace", mt: 2 }}>
+            {details.message}
+        </Typography>
+
+        {details.stack && <Typography
+            component="pre"
+            sx={{ color: "text.secondary", fontFamily: "monospace", fontSize: "0.75rem", mt: 3, whiteSpace: "pre-wrap", wordBreak: "break-word" }}
+        >
+            {details.stack}
+        </Typography>}
+
+        <Box sx={{ display: "flex", gap: 2, mt: 4 }}>
+            <Button onClick={() => window.location.reload()} variant="outlined">Reload page</Button>
+        </Box>
+    </Box>;
+}

frontend/src/components/dialogs/PackageInfoDialog.tsx

@@ -32,27 +32,22 @@ import PkgbuildTab from "components/package/PkgbuildTab";
 import { type TabKey, tabs } from "components/package/TabKey";
 import { QueryKeys } from "hooks/QueryKeys";
 import { useAuth } from "hooks/useAuth";
-import { useAutoRefresh } from "hooks/useAutoRefresh";
 import { useClient } from "hooks/useClient";
 import { useNotification } from "hooks/useNotification";
 import { useRepository } from "hooks/useRepository";
-import type { AutoRefreshInterval } from "models/AutoRefreshInterval";
 import type { Dependencies } from "models/Dependencies";
 import type { PackageStatus } from "models/PackageStatus";
 import type { Patch } from "models/Patch";
 import React, { useState } from "react";
 import { StatusHeaderStyles } from "theme/StatusColors";
-import { defaultInterval } from "utils";
 
 interface PackageInfoDialogProps {
-    autoRefreshIntervals: AutoRefreshInterval[];
     onClose: () => void;
     open: boolean;
     packageBase: string | null;
 }
 
 export default function PackageInfoDialog({
-    autoRefreshIntervals,
     onClose,
     open,
     packageBase,
@@ -77,14 +72,11 @@ export default function PackageInfoDialog({
         onClose();
     };
 
-    const autoRefresh = useAutoRefresh("package-info-autoreload-button", defaultInterval(autoRefreshIntervals));
-
     const { data: packageData } = useQuery<PackageStatus[]>({
         enabled: open,
         queryFn: localPackageBase && currentRepository ?
             () => client.fetch.fetchPackage(localPackageBase, currentRepository) : skipToken,
         queryKey: localPackageBase && currentRepository ? QueryKeys.package(localPackageBase, currentRepository) : ["packages"],
-        refetchInterval: autoRefresh.interval > 0 ? autoRefresh.interval : false,
     });
 
     const { data: dependencies } = useQuery<Dependencies>({
@@ -182,7 +174,6 @@ export default function PackageInfoDialog({
                     {activeTab === "logs" && localPackageBase && currentRepository &&
                         <BuildLogsTab
                             packageBase={localPackageBase}
-                            refreshInterval={autoRefresh.interval}
                             repository={currentRepository}
                         />
                     }
@@ -207,11 +198,8 @@ export default function PackageInfoDialog({
         </DialogContent>
 
         <PackageInfoActions
-            autoRefreshInterval={autoRefresh.interval}
-            autoRefreshIntervals={autoRefreshIntervals}
             isAuthorized={isAuthorized}
             isHeld={status?.is_held ?? false}
-            onAutoRefreshIntervalChange={autoRefresh.setInterval}
             onHoldToggle={() => void handleHoldToggle()}
             onRefreshDatabaseChange={setRefreshDatabase}
             onRemove={() => void handleRemove()}

frontend/src/components/layout/AppLayout.tsx

@@ -69,7 +69,7 @@ export default function AppLayout(): React.JSX.Element {
             </Tooltip>
         </Box>
 
-        <PackageTable autoRefreshIntervals={info?.autorefresh_intervals ?? []} />
+        <PackageTable />
 
         <Footer
             docsEnabled={info?.docs_enabled ?? false}

frontend/src/components/package/BuildLogsTab.tsx

@@ -23,6 +23,7 @@ import { keepPreviousData, skipToken, useQuery } from "@tanstack/react-query";
 import CodeBlock from "components/common/CodeBlock";
 import { QueryKeys } from "hooks/QueryKeys";
 import { useAutoScroll } from "hooks/useAutoScroll";
+import { useBuildLogStream } from "hooks/useBuildLogStream";
 import { useClient } from "hooks/useClient";
 import type { LogRecord } from "models/LogRecord";
 import type { RepositoryId } from "models/RepositoryId";
@@ -37,7 +38,6 @@ interface Logs {
 
 interface BuildLogsTabProps {
     packageBase: string;
-    refreshInterval: number;
     repository: RepositoryId;
 }
 
@@ -50,10 +50,10 @@ function convertLogs(records: LogRecord[], filter?: (record: LogRecord) => boole
 
 export default function BuildLogsTab({
     packageBase,
-    refreshInterval,
     repository,
 }: BuildLogsTabProps): React.JSX.Element {
     const client = useClient();
+    useBuildLogStream(packageBase, repository);
     const [selectedVersionKey, setSelectedVersionKey] = useState<string | null>(null);
     const [anchorEl, setAnchorEl] = useState<HTMLElement | null>(null);
 
@@ -61,7 +61,6 @@ export default function BuildLogsTab({
         enabled: !!packageBase,
         queryFn: () => client.fetch.fetchPackageLogs(packageBase, repository),
         queryKey: QueryKeys.logs(packageBase, repository),
-        refetchInterval: refreshInterval > 0 ? refreshInterval : false,
     });
 
     // Build version selectors from all logs
@@ -117,7 +116,6 @@ export default function BuildLogsTab({
             )
             : skipToken,
         queryKey: QueryKeys.logsVersion(packageBase, repository, activeVersion?.version ?? "", activeVersion?.processId ?? ""),
-        refetchInterval: refreshInterval > 0 ? refreshInterval : false,
     });
 
     // Derive displayed logs: prefer fresh polled data when available

frontend/src/components/package/PackageDetailsGrid.tsx

@@ -98,7 +98,7 @@ export default function PackageDetailsGrid({ dependencies, pkg }: PackageDetails
             <Grid size={{ md: 5, xs: 8 }}>
                 <Typography variant="body2">
                     {aurUrl &&
-                        <Link href={aurUrl} rel="noopener noreferrer" target="_blank" underline="hover">AUR link</Link>
+                        <Link href={aurUrl} rel="noopener noreferrer" target="_blank" underline="hover">{aurUrl}</Link>
                     }
                 </Typography>
             </Grid>

frontend/src/components/package/PackageInfoActions.tsx

@@ -22,16 +22,11 @@ import PauseCircleIcon from "@mui/icons-material/PauseCircle";
 import PlayArrowIcon from "@mui/icons-material/PlayArrow";
 import PlayCircleIcon from "@mui/icons-material/PlayCircle";
 import { Button, Checkbox, DialogActions, FormControlLabel } from "@mui/material";
-import AutoRefreshControl from "components/common/AutoRefreshControl";
-import type { AutoRefreshInterval } from "models/AutoRefreshInterval";
 import type React from "react";
 
 interface PackageInfoActionsProps {
-    autoRefreshInterval: number;
-    autoRefreshIntervals: AutoRefreshInterval[];
     isAuthorized: boolean;
     isHeld: boolean;
-    onAutoRefreshIntervalChange: (interval: number) => void;
     onHoldToggle: () => void;
     onRefreshDatabaseChange: (checked: boolean) => void;
     onRemove: () => void;
@@ -40,11 +35,8 @@ interface PackageInfoActionsProps {
 }
 
 export default function PackageInfoActions({
-    autoRefreshInterval,
-    autoRefreshIntervals,
     isAuthorized,
     isHeld,
-    onAutoRefreshIntervalChange,
     onHoldToggle,
     onRefreshDatabaseChange,
     onRemove,
@@ -69,10 +61,5 @@ export default function PackageInfoActions({
                 </Button>
             </>
         }
-        <AutoRefreshControl
-            currentInterval={autoRefreshInterval}
-            intervals={autoRefreshIntervals}
-            onIntervalChange={onAutoRefreshIntervalChange}
-        />
     </DialogActions>;
 }

frontend/src/components/table/PackageTable.tsx

@@ -35,14 +35,9 @@ import PackageTableToolbar from "components/table/PackageTableToolbar";
 import StatusCell from "components/table/StatusCell";
 import { useDebounce } from "hooks/useDebounce";
 import { usePackageTable } from "hooks/usePackageTable";
-import type { AutoRefreshInterval } from "models/AutoRefreshInterval";
 import type { PackageRow } from "models/PackageRow";
 import React, { useMemo } from "react";
 
-interface PackageTableProps {
-    autoRefreshIntervals: AutoRefreshInterval[];
-}
-
 function createListColumn(
     field: keyof PackageRow,
     headerName: string,
@@ -59,8 +54,8 @@ function createListColumn(
     };
 }
 
-export default function PackageTable({ autoRefreshIntervals }: PackageTableProps): React.JSX.Element {
+export default function PackageTable(): React.JSX.Element {
-    const table = usePackageTable(autoRefreshIntervals);
+    const table = usePackageTable();
     const apiRef = useGridApiRef();
     const debouncedSearch = useDebounce(table.searchText, 300);
 
@@ -118,11 +113,6 @@ export default function PackageTable({ autoRefreshIntervals }: PackageTableProps
                 onRemoveClick: () => void table.handleRemove(),
                 onUpdateClick: () => void table.handleUpdate(),
             }}
-            autoRefresh={{
-                autoRefreshIntervals,
-                currentInterval: table.autoRefreshInterval,
-                onIntervalChange: table.onAutoRefreshIntervalChange,
-            }}
             isAuthorized={table.isAuthorized}
             hasSelection={table.selectionModel.length > 0}
             onSearchChange={table.setSearchText}
@@ -175,7 +165,6 @@ export default function PackageTable({ autoRefreshIntervals }: PackageTableProps
         <PackageRebuildDialog onClose={() => table.setDialogOpen(null)} open={table.dialogOpen === "rebuild"} />
         <KeyImportDialog onClose={() => table.setDialogOpen(null)} open={table.dialogOpen === "keyImport"} />
         <PackageInfoDialog
-            autoRefreshIntervals={autoRefreshIntervals}
             onClose={() => table.setSelectedPackage(null)}
             open={table.selectedPackage !== null}
             packageBase={table.selectedPackage}

frontend/src/components/table/PackageTableToolbar.tsx

@@ -30,18 +30,10 @@ import ReplayIcon from "@mui/icons-material/Replay";
 import SearchIcon from "@mui/icons-material/Search";
 import VpnKeyIcon from "@mui/icons-material/VpnKey";
 import { Box, Button, Divider, IconButton, InputAdornment, Menu, MenuItem, TextField, Tooltip } from "@mui/material";
-import AutoRefreshControl from "components/common/AutoRefreshControl";
-import type { AutoRefreshInterval } from "models/AutoRefreshInterval";
 import type { BuildStatus } from "models/BuildStatus";
 import React, { useState } from "react";
 import { StatusColors } from "theme/StatusColors";
 
-export interface AutoRefreshProps {
-    autoRefreshIntervals: AutoRefreshInterval[];
-    currentInterval: number;
-    onIntervalChange: (interval: number) => void;
-}
-
 export interface ToolbarActions {
     onAddClick: () => void;
     onDashboardClick: () => void;
@@ -56,7 +48,6 @@ export interface ToolbarActions {
 
 interface PackageTableToolbarProps {
     actions: ToolbarActions;
-    autoRefresh: AutoRefreshProps;
     hasSelection: boolean;
     isAuthorized: boolean;
     onSearchChange: (text: string) => void;
@@ -66,7 +57,6 @@ interface PackageTableToolbarProps {
 
 export default function PackageTableToolbar({
     actions,
-    autoRefresh,
     hasSelection,
     isAuthorized,
     onSearchChange,
@@ -143,12 +133,6 @@ export default function PackageTableToolbar({
             reload
         </Button>
 
-        <AutoRefreshControl
-            currentInterval={autoRefresh.currentInterval}
-            intervals={autoRefresh.autoRefreshIntervals}
-            onIntervalChange={autoRefresh.onIntervalChange}
-        />
-
         <Box sx={{ flexGrow: 1 }} />
 
         <TextField

frontend/src/contexts/EventStreamProvider.tsx

@@ -17,8 +17,16 @@
  * You should have received a copy of the GNU General Public License
  * along with this program. If not, see <http://www.gnu.org/licenses/>.
  */
-export interface AutoRefreshInterval {
+import { useQueryClient } from "@tanstack/react-query";
-    interval: number;
+import { useEventStream } from "hooks/useEventStream";
-    is_active: boolean;
+import { useRepository } from "hooks/useRepository";
-    text: string;
+import type { ReactNode } from "react";
+
+export function EventStreamProvider({ children }: { children: ReactNode }): ReactNode {
+    const queryClient = useQueryClient();
+    const { currentRepository } = useRepository();
+
+    useEventStream(queryClient, currentRepository);
+
+    return children;
 }

frontend/src/hooks/useAutoRefresh.ts

@@ -1,49 +0,0 @@
-/*
- * Copyright (c) 2021-2026 ahriman team.
- *
- * This file is part of ahriman
- * (see https://github.com/arcan1s/ahriman).
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program. If not, see <http://www.gnu.org/licenses/>.
- */
-import { useLocalStorage } from "hooks/useLocalStorage";
-import { type Dispatch, type SetStateAction, useEffect, useState } from "react";
-
-interface AutoRefreshResult {
-    interval: number;
-    setInterval: Dispatch<SetStateAction<number>>;
-    setPaused: Dispatch<SetStateAction<boolean>>;
-}
-
-export function useAutoRefresh(key: string, defaultInterval: number): AutoRefreshResult {
-    const storageKey = `ahriman-${key}`;
-    const [interval, setInterval] = useLocalStorage<number>(storageKey, defaultInterval);
-    const [paused, setPaused] = useState(false);
-
-    // Apply defaultInterval when it becomes available (e.g. after info endpoint loads)
-    // but only if the user hasn't explicitly set a preference
-    useEffect(() => {
-        if (defaultInterval > 0 && window.localStorage.getItem(storageKey) === null) {
-            setInterval(defaultInterval);
-        }
-    }, [storageKey, defaultInterval, setInterval]);
-
-    const effectiveInterval = paused ? 0 : interval;
-
-    return {
-        interval: effectiveInterval,
-        setInterval,
-        setPaused,
-    };
-}

frontend/src/hooks/useBuildLogStream.ts

@@ -0,0 +1,96 @@
+/*
+ * Copyright (c) 2021-2026 ahriman team.
+ *
+ * This file is part of ahriman
+ * (see https://github.com/arcan1s/ahriman).
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ */
+import type { QueryClient } from "@tanstack/react-query";
+import { useQueryClient } from "@tanstack/react-query";
+import { buildEventStreamUrl } from "hooks/useEventStream";
+import { useNotification } from "hooks/useNotification";
+import type { LogRecord } from "models/LogRecord";
+import type { RepositoryId } from "models/RepositoryId";
+import { useEffect } from "react";
+
+interface BuildLogEvent {
+    created: number;
+    message: string;
+    process_id: string;
+    version: string;
+}
+
+function appendLogRecord(existing: LogRecord[] | undefined, record: LogRecord): LogRecord[] {
+    return [...existing ?? [], record];
+}
+
+function invalidateLogs(queryClient: QueryClient, repository: RepositoryId, packageBase: string): void {
+    void queryClient.invalidateQueries({ queryKey: ["logs", repository.key, packageBase] });
+}
+
+export function useBuildLogStream(packageBase: string, repository: RepositoryId): void {
+    const queryClient = useQueryClient();
+    const { showError } = useNotification();
+
+    useEffect(() => {
+        const source = new EventSource(buildEventStreamUrl(repository, ["build-log"], packageBase));
+        let needsRefresh = false;
+
+        source.addEventListener("error", () => {
+            needsRefresh = true;
+        });
+
+        source.addEventListener("open", () => {
+            if (needsRefresh) {
+                invalidateLogs(queryClient, repository, packageBase);
+                needsRefresh = false;
+            }
+        });
+
+        source.addEventListener("build-log", (event: MessageEvent<string>) => {
+            let data: BuildLogEvent;
+            try {
+                data = JSON.parse(event.data) as BuildLogEvent;
+            } catch {
+                showError("Live updates failed", "Could not parse build log event; refreshing logs.");
+                invalidateLogs(queryClient, repository, packageBase);
+                return;
+            }
+
+            const record: LogRecord = {
+                created: data.created,
+                message: data.message,
+                process_id: data.process_id,
+                version: data.version,
+            };
+
+            // Append to the all-logs cache
+            queryClient.setQueryData<LogRecord[]>(
+                ["logs", repository.key, packageBase],
+                existing => appendLogRecord(existing, record),
+            );
+
+            // Append to the version-specific cache
+            queryClient.setQueryData<LogRecord[]>(
+                ["logs", repository.key, packageBase, record.version, record.process_id],
+                existing => appendLogRecord(existing, record),
+            );
+        });
+
+        return () => {
+            source.close();
+        };
+    }, [queryClient, packageBase, repository, showError]);
+}

frontend/src/hooks/useEventStream.ts

@@ -0,0 +1,127 @@
+/*
+ * Copyright (c) 2021-2026 ahriman team.
+ *
+ * This file is part of ahriman
+ * (see https://github.com/arcan1s/ahriman).
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ */
+import type { QueryClient } from "@tanstack/react-query";
+import { useNotification } from "hooks/useNotification";
+import type { RepositoryId } from "models/RepositoryId";
+import { useEffect } from "react";
+
+const GLOBAL_EVENT_TYPES = [
+    "package-held",
+    "package-outdated",
+    "package-removed",
+    "package-status-changed",
+    "package-update-failed",
+    "package-updated",
+    "service-status-changed",
+] as const;
+
+function invalidateForEvent(
+    queryClient: QueryClient,
+    repositoryKey: string,
+    eventType: string,
+    objectId?: string,
+): void {
+    switch (eventType) {
+        case "package-status-changed":
+        case "package-updated":
+        case "package-removed":
+        case "package-held":
+            void queryClient.invalidateQueries({ queryKey: ["packages", repositoryKey] });
+            void queryClient.invalidateQueries({ queryKey: ["status", repositoryKey] });
+            if (objectId) {
+                void queryClient.invalidateQueries({ queryKey: ["packages", repositoryKey, objectId] });
+                void queryClient.invalidateQueries({ queryKey: ["events", repositoryKey, objectId] });
+            }
+            break;
+        case "service-status-changed":
+            void queryClient.invalidateQueries({ queryKey: ["status", repositoryKey] });
+            break;
+        case "package-outdated":
+        case "package-update-failed":
+            void queryClient.invalidateQueries({ queryKey: ["packages", repositoryKey] });
+            if (objectId) {
+                void queryClient.invalidateQueries({ queryKey: ["packages", repositoryKey, objectId] });
+            }
+            break;
+    }
+}
+
+function invalidateRepository(queryClient: QueryClient, repositoryKey: string): void {
+    void queryClient.invalidateQueries({ queryKey: ["packages", repositoryKey] });
+    void queryClient.invalidateQueries({ queryKey: ["status", repositoryKey] });
+    void queryClient.invalidateQueries({ queryKey: ["events", repositoryKey] });
+}
+
+export function buildEventStreamUrl(
+    repository: RepositoryId,
+    events?: readonly string[],
+    objectId?: string,
+): string {
+    const params = new URLSearchParams(repository.toQuery());
+    if (events) {
+        for (const event of events) {
+            params.append("event", event);
+        }
+    }
+    if (objectId) {
+        params.set("object_id", objectId);
+    }
+    return `/api/v1/events/stream?${params.toString()}`;
+}
+
+export function useEventStream(queryClient: QueryClient, repository: RepositoryId | null): void {
+    const { showError } = useNotification();
+
+    useEffect(() => {
+        if (!repository) {
+            return;
+        }
+
+        const source = new EventSource(buildEventStreamUrl(repository, GLOBAL_EVENT_TYPES));
+        let needsRefresh = false;
+
+        source.addEventListener("error", () => {
+            needsRefresh = true;
+        });
+
+        source.addEventListener("open", () => {
+            if (needsRefresh) {
+                invalidateRepository(queryClient, repository.key);
+                needsRefresh = false;
+            }
+        });
+
+        for (const eventType of GLOBAL_EVENT_TYPES) {
+            source.addEventListener(eventType, (event: MessageEvent<string>) => {
+                try {
+                    const data = JSON.parse(event.data) as { object_id?: string };
+                    invalidateForEvent(queryClient, repository.key, eventType, data.object_id ?? undefined);
+                } catch {
+                    showError("Live updates failed", "Could not parse server event; refreshing data.");
+                    invalidateRepository(queryClient, repository.key);
+                }
+            });
+        }
+
+        return () => {
+            source.close();
+        };
+    }, [queryClient, repository, showError]);
+}

frontend/src/hooks/usePackageData.ts

@@ -20,46 +20,37 @@
 import { skipToken, useQuery } from "@tanstack/react-query";
 import { QueryKeys } from "hooks/QueryKeys";
 import { useAuth } from "hooks/useAuth";
-import { useAutoRefresh } from "hooks/useAutoRefresh";
 import { useClient } from "hooks/useClient";
 import { useRepository } from "hooks/useRepository";
-import type { AutoRefreshInterval } from "models/AutoRefreshInterval";
 import type { BuildStatus } from "models/BuildStatus";
 import { PackageRow } from "models/PackageRow";
 import { useMemo } from "react";
-import { defaultInterval } from "utils";
 
 export interface UsePackageDataResult {
-    autoRefresh: ReturnType<typeof useAutoRefresh>;
     isAuthorized: boolean;
     isLoading: boolean;
     rows: PackageRow[];
     status: BuildStatus | undefined;
 }
 
-export function usePackageData(autoRefreshIntervals: AutoRefreshInterval[]): UsePackageDataResult {
+export function usePackageData(): UsePackageDataResult {
     const client = useClient();
     const { currentRepository } = useRepository();
     const { isAuthorized } = useAuth();
 
-    const autoRefresh = useAutoRefresh("table-autoreload-button", defaultInterval(autoRefreshIntervals));
-
     const { data: packages = [], isLoading } = useQuery({
         queryFn: currentRepository ? () => client.fetch.fetchPackages(currentRepository) : skipToken,
         queryKey: currentRepository ? QueryKeys.packages(currentRepository) : ["packages"],
-        refetchInterval: autoRefresh.interval > 0 ? autoRefresh.interval : false,
     });
 
     const { data: status } = useQuery({
         queryFn: currentRepository ? () => client.fetch.fetchServerStatus(currentRepository) : skipToken,
         queryKey: currentRepository ? QueryKeys.status(currentRepository) : ["status"],
-        refetchInterval: autoRefresh.interval > 0 ? autoRefresh.interval : false,
     });
 
     const rows = useMemo(() => packages.map(descriptor => new PackageRow(descriptor)), [packages]);
 
     return {
-        autoRefresh,
         isLoading,
         isAuthorized,
         rows,

frontend/src/hooks/usePackageTable.ts

@@ -21,13 +21,10 @@ import type { GridFilterModel } from "@mui/x-data-grid";
 import { usePackageActions } from "hooks/usePackageActions";
 import { usePackageData } from "hooks/usePackageData";
 import { useTableState } from "hooks/useTableState";
-import type { AutoRefreshInterval } from "models/AutoRefreshInterval";
 import type { BuildStatus } from "models/BuildStatus";
 import type { PackageRow } from "models/PackageRow";
-import { useEffect } from "react";
 
 export interface UsePackageTableResult {
-    autoRefreshInterval: number;
     columnVisibility: Record<string, boolean>;
     dialogOpen: "dashboard" | "add" | "rebuild" | "keyImport" | null;
     filterModel: GridFilterModel;
@@ -37,7 +34,6 @@ export interface UsePackageTableResult {
     handleUpdate: () => Promise<void>;
     isAuthorized: boolean;
     isLoading: boolean;
-    onAutoRefreshIntervalChange: (interval: number) => void;
     paginationModel: { page: number; pageSize: number };
     rows: PackageRow[];
     searchText: string;
@@ -53,23 +49,14 @@ export interface UsePackageTableResult {
     status: BuildStatus | undefined;
 }
 
-export function usePackageTable(autoRefreshIntervals: AutoRefreshInterval[]): UsePackageTableResult {
+export function usePackageTable(): UsePackageTableResult {
-    const { rows, isLoading, isAuthorized, status, autoRefresh } = usePackageData(autoRefreshIntervals);
+    const { rows, isLoading, isAuthorized, status } = usePackageData();
     const tableState = useTableState();
     const actions = usePackageActions(tableState.selectionModel, tableState.setSelectionModel);
 
-    // Pause auto-refresh when dialog is open
-    const isDialogOpen = tableState.dialogOpen !== null || tableState.selectedPackage !== null;
-    const setPaused = autoRefresh.setPaused;
-    useEffect(() => {
-        setPaused(isDialogOpen);
-    }, [isDialogOpen, setPaused]);
-
     return {
-        autoRefreshInterval: autoRefresh.interval,
         isLoading,
         isAuthorized,
-        onAutoRefreshIntervalChange: autoRefresh.setInterval,
         rows,
         status,
         ...actions,

frontend/src/main.tsx

@@ -21,11 +21,18 @@ import "chartSetup";
 import "utils";
 
 import App from "App";
+import ErrorFallback from "components/common/ErrorBoundary";
 import { StrictMode } from "react";
 import { createRoot } from "react-dom/client";
+import { ErrorBoundary } from "react-error-boundary";
 
 createRoot(document.getElementById("root")!).render(
     <StrictMode>
+        <ErrorBoundary
+            FallbackComponent={ErrorFallback}
+            onError={(error, info) => console.error("Uncaught error:", error, info.componentStack)}
+        >
             <App />
+        </ErrorBoundary>
     </StrictMode>,
 );

frontend/src/models/InfoResponse.ts

@@ -18,12 +18,10 @@
  * along with this program. If not, see <http://www.gnu.org/licenses/>.
  */
 import type { AuthInfo } from "models/AuthInfo";
-import type { AutoRefreshInterval } from "models/AutoRefreshInterval";
 import type { RepositoryId } from "models/RepositoryId";
 
 export interface InfoResponse {
     auth: AuthInfo;
-    autorefresh_intervals: AutoRefreshInterval[];
     docs_enabled: boolean;
     index_url?: string;
     repositories: RepositoryId[];

frontend/src/utils.ts

@@ -17,8 +17,6 @@
  * You should have received a copy of the GNU General Public License
  * along with this program. If not, see <http://www.gnu.org/licenses/>.
  */
-import type { AutoRefreshInterval } from "models/AutoRefreshInterval";
-
 export const DETAIL_TABLE_PROPS = {
     density: "compact" as const,
     disableColumnSorting: true,
@@ -27,10 +25,6 @@ export const DETAIL_TABLE_PROPS = {
     sx: { height: 400, mt: 1 },
 };
 
-export function defaultInterval(intervals: AutoRefreshInterval[]): number {
-    return intervals.find(interval => interval.is_active)?.interval ?? 0;
-}
-
 declare global {
     interface Array<T> {
         unique(): T[];

frontend/tsconfig.json

@@ -4,18 +4,18 @@
         "baseUrl": "src",
         "isolatedModules": true,
         "jsx": "react-jsx",
-        "lib": ["ES2020", "DOM", "DOM.Iterable"],
+        "lib": ["ESNext", "DOM", "DOM.Iterable"],
         "module": "ESNext",
         "moduleResolution": "bundler",
         "noEmit": true,
         "noFallthroughCasesInSwitch": true,
-        "noUncheckedIndexedAccess": true,
+        "noImplicitOverride": true,
         "noUnusedLocals": true,
         "noUnusedParameters": true,
         "resolveJsonModule": true,
         "skipLibCheck": true,
         "strict": true,
-        "target": "ES2020",
+        "target": "ESNext",
         "useDefineForClassFields": true
     },
     "include": ["src"]

package/archlinux/PKGBUILD

@@ -9,7 +9,7 @@ arch=('any')
 url="https://ahriman.readthedocs.io/"
 license=('GPL-3.0-or-later')
 depends=('devtools>=1:1.0.0' 'git' 'pyalpm' 'python-bcrypt' 'python-filelock' 'python-inflection' 'python-pyelftools' 'python-requests')
-makedepends=('npm' 'python-build' 'python-flit' 'python-installer' 'python-wheel')
+makedepends=('npm' 'python-build' 'python-hatchling' 'python-installer' 'python-wheel')
 source=("https://github.com/arcan1s/ahriman/releases/download/$pkgver/$pkgbase-$pkgver.tar.gz"
         "$pkgbase.sysusers"
         "$pkgbase.tmpfiles")
@@ -77,7 +77,7 @@ package_ahriman-triggers() {
 package_ahriman-web() {
     pkgname='ahriman-web'
     pkgdesc="ArcH linux ReposItory MANager, web server"
-    depends=("$pkgbase-core=$pkgver" 'python-aiohttp-cors' 'python-aiohttp-jinja2')
+    depends=("$pkgbase-core=$pkgver" 'python-aiohttp-cors' 'python-aiohttp-jinja2' 'python-aiohttp-sse-git')
     optdepends=('python-aioauth-client: OAuth2 authorization support'
                 'python-aiohttp-apispec>=3.0.0: autogenerated API documentation'
                 'python-aiohttp-openmetrics: HTTP metrics support'

package/share/ahriman/settings/ahriman.ini.d/00-web.ini

@@ -30,6 +30,14 @@ allow_read_only = yes
 ; If no intervals set, auto refresh will be disabled. 0 can only be the first element and will disable auto refresh
 ; by default.
 autorefresh_intervals = 5 1 10 30 60
+; Allowed CORS headers. By default everything is allowed.
+;cors_allow_headers =
+; Allowed CORS methods. By default everything is allowed.
+;cors_allow_methods =
+; Allowed CORS origins.
+;cors_allow_origins = *
+; Exposed CORS headers. By default everything is exposed.
+;cors_expose_headers =
 ; Enable file upload endpoint used by some triggers.
 ;enable_archive_upload = no
 ; Address to bind the server.
@@ -38,6 +46,8 @@ host = 127.0.0.1
 ;index_url =
 ; Max file size in bytes which can be uploaded to the server. Requires ${web:enable_archive_upload} to be enabled.
 ;max_body_size =
+; Max event queue size used for server sent event endpoints (0 is infinite)
+;max_queue_size = 0
 ; Port to listen. Must be set, if the web service is enabled.
 ;port =
 ; Disable status (e.g. package status, logs, etc) endpoints. Useful for build only modes.

pyproject.toml

@@ -1,6 +1,6 @@
 [build-system]
-requires = ["flit_core"]
+requires = ["hatchling"]
-build-backend = "flit_core.buildapi"
+build-backend = "hatchling.build"
 
 [project]
 name = "ahriman"
@@ -8,8 +8,7 @@ name = "ahriman"
 description = "ArcH linux ReposItory MANager"
 readme = "README.md"
 
-# Actually we are using features from the latest python, however, ubuntu, which is used for CI doesn't have it
+requires-python = ">=3.13"
-requires-python = ">=3"
 
 license = {file = "COPYING"}
 authors = [
@@ -58,6 +57,7 @@ web = [
     "aiohttp",
     "aiohttp_cors",
     "aiohttp_jinja2",
+    "aiohttp_sse",
 ]
 web-auth = [
     "ahriman[web]",
@@ -112,21 +112,32 @@ tests = [
     "pytest-spec",
 ]
 
-[tool.flit.sdist]
+[tool.hatch.version]
+path = "src/ahriman/__init__.py"
+
+[tool.hatch.build.targets.sdist]
 include = [
-    "AUTHORS",
+    "/AUTHORS",
-    "CONTRIBUTING.md",
+    "/CONTRIBUTING.md",
-    "SECURITY.md",
+    "/COPYING",
-    "package",
+    "/README.md",
-    "frontend",
+    "/SECURITY.md",
-    "subpackages.py",
+    "/frontend",
-    "web.png",
+    "/package",
+    "/pyproject.toml",
+    "/src",
+    "/subpackages.py",
+    "/web.png",
 ]
 exclude = [
-    "package/archlinux",
+    "/package/archlinux",
-    "frontend/node_modules",
+    "/frontend/node_modules",
-    "frontend/package-lock.json",
+    "/frontend/package-lock.json",
 ]
 
-[tool.flit.external-data]
+[tool.hatch.build.targets.wheel]
-directory = "package"
+packages = ["src/ahriman"]
+
+[tool.hatch.build.targets.wheel.shared-data]
+"package/lib" = "lib"
+"package/share" = "share"

src/ahriman/core/alpm/pkgbuild_parser.py

@@ -104,7 +104,7 @@ class PkgbuildParser(shlex.shlex):
 
         # ignore substitution and extend bash symbols
         self.wordchars += "${}#:+-@!"
-        # in case of default behaviour, it will ignore, for example, segment part of url outside of quotes
+        # in case of default behavior, it will ignore, for example, segment part of url outside of quotes
         self.commenters = ""
 
     @staticmethod

src/ahriman/core/alpm/remote/aur.py

@@ -72,7 +72,7 @@ class AUR(Remote):
         parse RPC response to package list
 
         Args:
-            response(dict[str, Any]): RPC response json
+            response(dict[str, Any]): RPC response JSON
 
         Returns:
             list[AURPackage]: list of parsed packages

src/ahriman/core/alpm/remote/official.py

@@ -74,7 +74,7 @@ class Official(Remote):
         parse RPC response to package list
 
         Args:
-            response(dict[str, Any]): RPC response json
+            response(dict[str, Any]): RPC response JSON
 
         Returns:
             list[AURPackage]: list of parsed packages

src/ahriman/core/alpm/remote/official_syncdb.py

@@ -32,7 +32,7 @@ class OfficialSyncdb(Official):
     updates.
 
     This approach also has limitations, because we don't require superuser rights (neither going to download database
-    separately), the database file might be outdated and must be handled manually (or kind of). This behaviour might be
+    separately), the database file might be outdated and must be handled manually (or kind of). This behavior might be
     changed in the future.
 
     Still we leave search function based on the official repositories RPC.

src/ahriman/core/auth/auth.py

@@ -50,13 +50,13 @@ class Auth(LazyLogging):
     @property
     def auth_control(self) -> str:
         """
-        This workaround is required to make different behaviour for login interface.
+        This workaround is required to make different behavior for login interface.
         In case of internal authentication it must provide an interface (modal form) to log in with button sends POST
-        request. But for an external providers behaviour can be different: e.g. OAuth provider requires sending GET
+        request. But for an external providers behavior can be different: e.g. OAuth provider requires sending GET
         request to external resource
 
         Returns:
-            str: login control as html code to insert
+            str: login control as HTML code to insert
         """
         return "<button type=\"button\" class=\"btn btn-link\" data-bs-toggle=\"modal\" data-bs-target=\"#login-modal\" style=\"text-decoration: none\"><i class=\"bi bi-box-arrow-in-right\"></i> login</button>"
 

src/ahriman/core/auth/helpers.py

@@ -30,7 +30,13 @@ except ImportError:
 from typing import Any
 
 
-__all__ = ["authorized_userid", "check_authorized", "forget", "remember"]
+__all__ = [
+    "authorized_userid",
+    "check_authorized",
+    "forget",
+    "get_session",
+    "remember",
+]
 
 
 async def authorized_userid(*args: Any, **kwargs: Any) -> Any:

src/ahriman/core/auth/oauth.py

@@ -62,10 +62,10 @@ class OAuth(Mapping):
     @property
     def auth_control(self) -> str:
         """
-        get authorization html control
+        get authorization HTML control
 
         Returns:
-            str: login control as html code to insert
+            str: login control as HTML code to insert
         """
         return "<a class=\"nav-link\" href=\"/api/v1/login\" title=\"login via OAuth2\"><i class=\"bi bi-box-arrow-in-right\"></i> login</a>"
 

src/ahriman/core/build_tools/package_archive.py

@@ -72,17 +72,17 @@ class PackageArchive:
             if not PackageArchive.is_elf(binary_file):
                 return []
 
-            elf_file = ELFFile(binary_file)  # type: ignore[no-untyped-call]
+            elf_file = ELFFile(binary_file)
             dynamic_section = next(
-                (section for section in elf_file.iter_sections()  # type: ignore[no-untyped-call]
+                (section for section in elf_file.iter_sections()
                  if isinstance(section, DynamicSection)),
                 None)
             if dynamic_section is None:
                 return []
 
             return [
-                tag.needed
+                tag.needed  # type: ignore[attr-defined]
-                for tag in dynamic_section.iter_tags()  # type: ignore[no-untyped-call]
+                for tag in dynamic_section.iter_tags()
                 if tag.entry.d_tag == "DT_NEEDED"
             ]
 

src/ahriman/core/build_tools/sources.py

@@ -416,7 +416,7 @@ class Sources(LazyLogging):
         else:
             patch.write(sources_dir / "PKGBUILD")
 
-    def read(self, sources_dir: Path, commit_sha: str, path: Path) -> str:
+    def read(self, sources_dir: Path, commit_sha: str, path: Path) -> str | None:
         """
         read file content from the specified commit
 
@@ -426,6 +426,10 @@ class Sources(LazyLogging):
             path(Path): path to file inside the repository
 
         Returns:
-            str: file content at specified commit
+            str | None: file content at specified commit if available
         """
+        try:
             return check_output(*self.git(), "show", f"{commit_sha}:{path}", cwd=sources_dir, logger=self.logger)
+        except CalledProcessError:
+            self.logger.exception("failed to read file %s at %s", path, commit_sha)
+            return None

src/ahriman/core/configuration/configuration.py

@@ -72,7 +72,7 @@ class Configuration(configparser.RawConfigParser):
     def __init__(self, allow_no_value: bool = False, allow_multi_key: bool = True) -> None:
         """
         Args:
-            allow_no_value(bool, optional): copies :class:`configparser.RawConfigParser` behaviour. In case if it is set
+            allow_no_value(bool, optional): copies :class:`configparser.RawConfigParser` behavior. In case if it is set
                 to ``True``, the keys without values will be allowed (Default value = False)
             allow_multi_key(bool, optional): if set to ``False``, then the default dictionary class will be used to
                 store keys internally. Otherwise, the special implementation will be used, which supports arrays
@@ -80,7 +80,7 @@ class Configuration(configparser.RawConfigParser):
         """
         configparser.RawConfigParser.__init__(
             self,
-            dict_type=ConfigurationMultiDict if allow_multi_key else dict,  # type: ignore[arg-type]
+            dict_type=ConfigurationMultiDict if allow_multi_key else dict,
             allow_no_value=allow_no_value,
             strict=False,
             empty_lines_in_values=not allow_multi_key,

src/ahriman/core/configuration/schema.py

@@ -358,6 +358,38 @@ CONFIGURATION_SCHEMA: ConfigurationSchema = {
                     "min": 0,
                 },
             },
+            "cors_allow_headers": {
+                "type": "list",
+                "coerce": "list",
+                "schema": {
+                    "type": "string",
+                    "empty": False,
+                },
+            },
+            "cors_allow_methods": {
+                "type": "list",
+                "coerce": "list",
+                "schema": {
+                    "type": "string",
+                    "empty": False,
+                },
+            },
+            "cors_allow_origins": {
+                "type": "list",
+                "coerce": "list",
+                "schema": {
+                    "type": "string",
+                    "empty": False,
+                },
+            },
+            "cors_expose_headers": {
+                "type": "list",
+                "coerce": "list",
+                "schema": {
+                    "type": "string",
+                    "empty": False,
+                },
+            },
             "enable_archive_upload": {
                 "type": "boolean",
                 "coerce": "boolean",

src/ahriman/core/configuration/shell_template.py

@@ -150,6 +150,6 @@ class ShellTemplate(Template):
                         break
 
         kwargs.update(mapping)
-        substituted = dict(generator(kwargs))
+        kwargs.update(dict(generator(kwargs)))
 
-        return self.safe_substitute(kwargs | substituted)
+        return self.safe_substitute(kwargs)

src/ahriman/core/database/operations/changes_operations.py

@@ -81,7 +81,7 @@ class ChangesOperations(Operations):
                 values
                 (:package_base, :last_commit_sha, :changes, :pkgbuild, :repository)
                 on conflict (package_base, repository) do update set
-                last_commit_sha = :last_commit_sha, changes = :changes, pkgbuild = :pkgbuild
+                last_commit_sha = :last_commit_sha, changes = :changes, pkgbuild = coalesce(:pkgbuild, pkgbuild)
                 """,
                 {
                     "package_base": package_base,

src/ahriman/core/http/sync_http_client.py

@@ -171,7 +171,7 @@ class SyncHttpClient(LazyLogging):
             headers(dict[str, str] | None, optional): request headers (Default value = None)
             params(list[tuple[str, str]] | None, optional): request query parameters (Default value = None)
             data(Any | None, optional): request raw data parameters (Default value = None)
-            json(dict[str, Any] | None, optional): request json parameters (Default value = None)
+            json(dict[str, Any] | None, optional): request JSON parameters (Default value = None)
             files(dict[str, MultipartType] | None, optional): multipart upload (Default value = None)
             stream(bool | None, optional): handle response as stream (Default value = None)
             session(requests.Session | None, optional): session object if any (Default value = None)

src/ahriman/core/report/console.py

@@ -27,7 +27,7 @@ from ahriman.models.result import Result
 
 class Console(Report):
     """
-    html report generator
+    HTML report generator
 
     Attributes:
         use_utf(bool): print utf8 symbols instead of ASCII

src/ahriman/core/report/html.py

@@ -27,10 +27,10 @@ from ahriman.models.result import Result
 
 class HTML(Report, JinjaTemplate):
     """
-    html report generator
+    HTML report generator
 
     Attributes:
-        report_path(Path): output path to html report
+        report_path(Path): output path to HTML report
         template(Path | str): name or path to template for full package list
     """
 

src/ahriman/core/report/report.py

@@ -71,7 +71,7 @@ class Report(LazyLogging):
         Args:
             repository_id(RepositoryId): repository unique identifier
             configuration(Configuration): configuration instance
-            target(str): target to generate report aka section name (e.g. html)
+            target(str): target to generate report aka section name (e.g. HTML)
 
         Returns:
             Report: client according to current settings

src/ahriman/core/status/event_bus.py

@@ -0,0 +1,136 @@
+#
+# Copyright (c) 2021-2026 ahriman team.
+#
+# This file is part of ahriman
+# (see https://github.com/arcan1s/ahriman).
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program. If not, see <http://www.gnu.org/licenses/>.
+#
+import uuid
+
+from asyncio import Lock, Queue, QueueFull, QueueShutDown
+from dataclasses import dataclass
+from typing import Any
+
+from ahriman.core.log import LazyLogging
+from ahriman.models.event import EventType
+
+
+SSEvent = tuple[str, dict[str, Any]]
+
+
+@dataclass(frozen=True)
+class _Subscription:
+    """
+    internal event bus subscription record
+
+    Attributes:
+        topics(list[EventType] | None): event type filter, ``None`` means all
+        object_id(str | None): object identifier filter, ``None`` means all
+        queue(Queue[SSEvent]): per-subscriber event queue
+    """
+
+    topics: list[EventType] | None
+    object_id: str | None
+    queue: Queue[SSEvent]
+
+
+class EventBus(LazyLogging):
+    """
+    event bus implementation
+
+    Attributes:
+        max_size(int): maximum size of queue
+    """
+
+    def __init__(self, max_size: int) -> None:
+        """
+        Args:
+            max_size(int): maximum size of queue
+        """
+        self.max_size = max_size
+
+        self._lock = Lock()
+        self._subscribers: dict[str, _Subscription] = {}
+
+    async def broadcast(self, event_type: EventType, object_id: str | None, **kwargs: Any) -> None:
+        """
+        broadcast event to all subscribers
+
+        Args:
+            event_type(EventType): event type
+            object_id(str | None): object identifier (e.g. package base)
+            **kwargs(Any): additional event data
+        """
+        event: dict[str, Any] = {"object_id": object_id}
+        event.update(kwargs)
+
+        async with self._lock:
+            snapshot = list(self._subscribers.items())
+
+        for subscriber_id, subscription in snapshot:
+            if subscription.topics is not None and event_type not in subscription.topics:
+                continue
+            if subscription.object_id is not None and object_id != subscription.object_id:
+                continue
+
+            try:
+                subscription.queue.put_nowait((event_type, event))
+            except QueueFull:
+                self.logger.warning("discard message to slow subscriber %s", subscriber_id)
+            except QueueShutDown:
+                pass
+
+    async def shutdown(self) -> None:
+        """
+        gracefully shutdown all subscribers
+        """
+        async with self._lock:
+            for subscription in self._subscribers.values():
+                subscription.queue.shutdown()
+            self._subscribers.clear()
+
+    async def subscribe(self, topics: list[EventType] | None = None,
+                        object_id: str | None = None) -> tuple[str, Queue[SSEvent]]:
+        """
+        register new subscriber
+
+        Args:
+            topics(list[EventType] | None, optional): list of event types to filter by. If ``None`` is set,
+                all events will be delivered (Default value = None)
+            object_id(str | None, optional): object identifier to filter by. If ``None`` is set,
+                events for all objects will be delivered (Default value = None)
+
+        Returns:
+            tuple[str, Queue[SSEvent]]: subscriber identifier and associated queue
+        """
+        subscriber_id = str(uuid.uuid4())
+        queue: Queue[SSEvent] = Queue(self.max_size)
+
+        async with self._lock:
+            self._subscribers[subscriber_id] = _Subscription(topics=topics, object_id=object_id, queue=queue)
+
+        return subscriber_id, queue
+
+    async def unsubscribe(self, subscriber_id: str) -> None:
+        """
+        unsubscribe from events
+
+        Args:
+            subscriber_id(str): subscriber unique identifier
+        """
+        async with self._lock:
+            subscription = self._subscribers.pop(subscriber_id, None)
+        if subscription is not None:
+            subscription.queue.shutdown()

src/ahriman/core/status/watcher.py

@@ -17,15 +17,16 @@
 # You should have received a copy of the GNU General Public License
 # along with this program. If not, see <http://www.gnu.org/licenses/>.
 #
-from collections.abc import Callable
+# pylint: disable=too-many-public-methods
+from asyncio import Lock
 from dataclasses import replace
-from threading import Lock
+from typing import Self
-from typing import Any, Self
 
 from ahriman.core.exceptions import UnknownPackageError
 from ahriman.core.log import LazyLogging
 from ahriman.core.repository.package_info import PackageInfo
 from ahriman.core.status import Client
+from ahriman.core.status.event_bus import EventBus
 from ahriman.models.build_status import BuildStatus, BuildStatusEnum
 from ahriman.models.changes import Changes
 from ahriman.models.dependencies import Dependencies
@@ -41,51 +42,74 @@ class Watcher(LazyLogging):
 
     Attributes:
         client(Client): reporter instance
+        event_bus(EventBus): event bus instance
         package_info(PackageInfo): package info instance
         status(BuildStatus): daemon status
     """
 
-    def __init__(self, client: Client, package_info: PackageInfo) -> None:
+    def __init__(self, client: Client, package_info: PackageInfo, event_bus: EventBus) -> None:
         """
         Args:
             client(Client): reporter instance
             package_info(PackageInfo): package info instance
+            event_bus(EventBus): event bus instance
         """
         self.client = client
         self.package_info = package_info
+        self.event_bus = event_bus
 
         self._lock = Lock()
         self._known: dict[str, tuple[Package, BuildStatus]] = {}
         self.status = BuildStatus()
 
-    @property
+    async def event_add(self, event: Event) -> None:
-    def packages(self) -> list[tuple[Package, BuildStatus]]:
         """
-        get current known packages list
+        create new event
+
+        Args:
+            event(Event): audit log event
+        """
+        self.client.event_add(event)
+
+    async def event_get(self, event: str | EventType | None, object_id: str | None,
+                        from_date: int | float | None = None, to_date: int | float | None = None,
+                        limit: int = -1, offset: int = 0) -> list[Event]:
+        """
+        retrieve list of events
+
+        Args:
+            event(str | EventType | None): filter by event type
+            object_id(str | None): filter by event object
+            from_date(int | float | None, optional): minimal creation date, inclusive (Default value = None)
+            to_date(int | float | None, optional): maximal creation date, exclusive (Default value = None)
+            limit(int, optional): limit records to the specified count, -1 means unlimited (Default value = -1)
+            offset(int, optional): records offset (Default value = 0)
 
         Returns:
-            list[tuple[Package, BuildStatus]]: list of packages together with their statuses
+            list[Event]: list of audit log events
         """
-        with self._lock:
+        return self.client.event_get(event, object_id, from_date, to_date, limit, offset)
-            return list(self._known.values())
 
-    event_add: Callable[[Event], None]
+    async def load(self) -> None:
-
-    event_get: Callable[[str | EventType | None, str | None, int | None, int | None, int, int], list[Event]]
-
-    def load(self) -> None:
         """
         load packages from local database
         """
-        with self._lock:
+        async with self._lock:
             self._known = {
                 package.base: (package, status)
                 for package, status in self.client.package_get(None)
             }
 
-    logs_rotate: Callable[[int], None]
+    async def logs_rotate(self, keep_last_records: int) -> None:
+        """
+        remove older logs from storage
 
-    def package_archives(self, package_base: str) -> list[Package]:
+        Args:
+            keep_last_records(int): number of last records to keep
+        """
+        self.client.logs_rotate(keep_last_records)
+
+    async def package_archives(self, package_base: str) -> list[Package]:
         """
         get known package archives
 
@@ -97,15 +121,51 @@ class Watcher(LazyLogging):
         """
         return self.package_info.package_archives(package_base)
 
-    package_changes_get: Callable[[str], Changes]
+    async def package_changes_get(self, package_base: str) -> Changes:
+        """
+        get package changes
 
-    package_changes_update: Callable[[str, Changes], None]
+        Args:
+            package_base(str): package base to retrieve
 
-    package_dependencies_get: Callable[[str], Dependencies]
+        Returns:
+            Changes: package changes if available and empty object otherwise
+        """
+        return self.client.package_changes_get(package_base)
 
-    package_dependencies_update: Callable[[str, Dependencies], None]
+    async def package_changes_update(self, package_base: str, changes: Changes) -> None:
+        """
+        update package changes
 
-    def package_get(self, package_base: str) -> tuple[Package, BuildStatus]:
+        Args:
+            package_base(str): package base to update
+            changes(Changes): changes descriptor
+        """
+        self.client.package_changes_update(package_base, changes)
+
+    async def package_dependencies_get(self, package_base: str) -> Dependencies:
+        """
+        get package dependencies
+
+        Args:
+            package_base(str): package base to retrieve
+
+        Returns:
+            list[Dependencies]: package implicit dependencies if available
+        """
+        return self.client.package_dependencies_get(package_base)
+
+    async def package_dependencies_update(self, package_base: str, dependencies: Dependencies) -> None:
+        """
+        update package dependencies
+
+        Args:
+            package_base(str): package base to update
+            dependencies(Dependencies): dependencies descriptor
+        """
+        self.client.package_dependencies_update(package_base, dependencies)
+
+    async def package_get(self, package_base: str) -> tuple[Package, BuildStatus]:
         """
         get current package base build status
 
@@ -119,18 +179,12 @@ class Watcher(LazyLogging):
             UnknownPackageError: if no package found
         """
         try:
-            with self._lock:
+            async with self._lock:
                 return self._known[package_base]
         except KeyError:
             raise UnknownPackageError(package_base) from None
 
-    package_logs_add: Callable[[LogRecord], None]
+    async def package_hold_update(self, package_base: str, *, enabled: bool) -> None:
-
-    package_logs_get: Callable[[str, str | None, str | None, int, int], list[LogRecord]]
-
-    package_logs_remove: Callable[[str, str | None], None]
-
-    def package_hold_update(self, package_base: str, *, enabled: bool) -> None:
         """
         update package hold status
 
@@ -138,29 +192,98 @@ class Watcher(LazyLogging):
             package_base(str): package base name
             enabled(bool): new hold status
         """
-        package, status = self.package_get(package_base)
+        package, status = await self.package_get(package_base)
-        with self._lock:
+        async with self._lock:
             self._known[package_base] = (package, replace(status, is_held=enabled))
         self.client.package_hold_update(package_base, enabled=enabled)
 
-    package_patches_get: Callable[[str, str | None], list[PkgbuildPatch]]
+        await self.event_bus.broadcast(EventType.PackageHeld, package_base, is_held=enabled)
 
-    package_patches_remove: Callable[[str, str], None]
+    async def package_logs_add(self, log_record: LogRecord) -> None:
+        """
+        post log record
 
-    package_patches_update: Callable[[str, PkgbuildPatch], None]
+        Args:
+            log_record(LogRecord): log record
+        """
+        self.client.package_logs_add(log_record)
 
-    def package_remove(self, package_base: str) -> None:
+        await self.event_bus.broadcast(EventType.BuildLog, log_record.log_record_id.package_base, **log_record.view())
+
+    async def package_logs_get(self, package_base: str, version: str | None = None, process_id: str | None = None,
+                               limit: int = -1, offset: int = 0) -> list[LogRecord]:
+        """
+        get package logs
+
+        Args:
+            package_base(str): package base
+            version(str | None, optional): package version to search (Default value = None)
+            process_id(str | None, optional): process identifier to search (Default value = None)
+            limit(int, optional): limit records to the specified count, -1 means unlimited (Default value = -1)
+            offset(int, optional): records offset (Default value = 0)
+
+        Returns:
+            list[LogRecord]: package logs
+        """
+        return self.client.package_logs_get(package_base, version, process_id, limit, offset)
+
+    async def package_logs_remove(self, package_base: str, version: str | None) -> None:
+        """
+        remove package logs
+
+        Args:
+            package_base(str): package base
+            version(str | None): package version to remove logs. If ``None`` is set, all logs will be removed
+        """
+        self.client.package_logs_remove(package_base, version)
+
+    async def package_patches_get(self, package_base: str, variable: str | None) -> list[PkgbuildPatch]:
+        """
+        get package patches
+
+        Args:
+            package_base(str): package base to retrieve
+            variable(str | None): optional filter by patch variable
+
+        Returns:
+            list[PkgbuildPatch]: list of patches for the specified package
+        """
+        return self.client.package_patches_get(package_base, variable)
+
+    async def package_patches_remove(self, package_base: str, variable: str | None) -> None:
+        """
+        remove package patch
+
+        Args:
+            package_base(str): package base to update
+            variable(str | None): patch name. If ``None`` is set, all patches will be removed
+        """
+        self.client.package_patches_remove(package_base, variable)
+
+    async def package_patches_update(self, package_base: str, patch: PkgbuildPatch) -> None:
+        """
+        create or update package patch
+
+        Args:
+            package_base(str): package base to update
+            patch(PkgbuildPatch): package patch
+        """
+        self.client.package_patches_update(package_base, patch)
+
+    async def package_remove(self, package_base: str) -> None:
         """
         remove package base from known list if any
 
         Args:
             package_base(str): package base
         """
-        with self._lock:
+        async with self._lock:
             self._known.pop(package_base, None)
         self.client.package_remove(package_base)
 
-    def package_status_update(self, package_base: str, status: BuildStatusEnum) -> None:
+        await self.event_bus.broadcast(EventType.PackageRemoved, package_base)
+
+    async def package_status_update(self, package_base: str, status: BuildStatusEnum) -> None:
         """
         update package status
 
@@ -168,12 +291,14 @@ class Watcher(LazyLogging):
             package_base(str): package base to update
             status(BuildStatusEnum): new build status
         """
-        package, current_status = self.package_get(package_base)
+        package, current_status = await self.package_get(package_base)
-        with self._lock:
+        async with self._lock:
             self._known[package_base] = (package, BuildStatus(status, is_held=current_status.is_held))
         self.client.package_status_update(package_base, status)
 
-    def package_update(self, package: Package, status: BuildStatusEnum) -> None:
+        await self.event_bus.broadcast(EventType.PackageStatusChanged, package_base, status=status.value)
+
+    async def package_update(self, package: Package, status: BuildStatusEnum) -> None:
         """
         update package
 
@@ -181,12 +306,32 @@ class Watcher(LazyLogging):
             package(Package): package description
             status(BuildStatusEnum): new build status
         """
-        with self._lock:
+        async with self._lock:
             _, current_status = self._known.get(package.base, (package, BuildStatus()))
             self._known[package.base] = (package, BuildStatus(status, is_held=current_status.is_held))
         self.client.package_update(package, status)
 
-    def status_update(self, status: BuildStatusEnum) -> None:
+        await self.event_bus.broadcast(
+            EventType.PackageUpdated, package.base, status=status.value, version=package.version,
+        )
+
+    async def packages(self) -> list[tuple[Package, BuildStatus]]:
+        """
+        get current known packages list
+
+        Returns:
+            list[tuple[Package, BuildStatus]]: list of packages together with their statuses
+        """
+        async with self._lock:
+            return list(self._known.values())
+
+    async def shutdown(self) -> None:
+        """
+        gracefully shutdown watcher
+        """
+        await self.event_bus.shutdown()
+
+    async def status_update(self, status: BuildStatusEnum) -> None:
         """
         update service status
 
@@ -195,6 +340,8 @@ class Watcher(LazyLogging):
         """
         self.status = BuildStatus(status)
 
+        await self.event_bus.broadcast(EventType.ServiceStatusChanged, None, status=status.value)
+
     def __call__(self, package_base: str | None) -> Self:
         """
         extract client for future calls
@@ -204,24 +351,11 @@ class Watcher(LazyLogging):
 
         Returns:
             Self: instance of self to pass calls to the client
-        """
-        if package_base is not None:
-            _ = self.package_get(package_base)
-        return self
-
-    def __getattr__(self, item: str) -> Any:
-        """
-        proxy methods for reporter client
-
-        Args:
-            item(str): property name
-
-        Returns:
-            Any: attribute by its name
 
         Raises:
-            AttributeError: in case if no such attribute found
+            UnknownPackageError: if no package found
         """
-        if (method := getattr(self.client, item, None)) is not None:
+        # keep check here instead of calling package_get to keep this method synchronized
-            return method
+        if package_base is not None and package_base not in self._known:
-        raise AttributeError(f"'{self.__class__.__qualname__}' object has no attribute '{item}'")
+            raise UnknownPackageError(package_base)
+        return self

src/ahriman/core/triggers/trigger.py

@@ -34,7 +34,7 @@ class Trigger(LazyLogging):
 
     Attributes:
         CONFIGURATION_SCHEMA(ConfigurationSchema): (class attribute) configuration schema template
-        REQUIRES_REPOSITORY(bool): (class attribute) either trigger requires loaded repository or not
+        REQUIRES_REPOSITORY(bool): (class attribute) either trigger requires a repository to be loaded or not
         configuration(Configuration): configuration instance
         repository_id(RepositoryId): repository unique identifier
 

src/ahriman/core/upload/http_upload.py

@@ -41,7 +41,7 @@ class HttpUpload(SyncHttpClient):
             str: calculated checksum of the file
         """
         with path.open("rb") as local_file:
-            md5 = hashlib.md5(local_file.read())  # nosec
+            md5 = hashlib.md5(local_file.read(), usedforsecurity=False)
             return md5.hexdigest()
 
     @staticmethod

src/ahriman/core/upload/s3.py

@@ -62,9 +62,7 @@ class S3(Upload):
     @staticmethod
     def calculate_etag(path: Path, chunk_size: int) -> str:
         """
-        calculate amazon s3 etag
+        calculate amazon s3 etag. Credits to https://teppen.io/2018/10/23/aws_s3_verify_etags/
-        credits to https://teppen.io/2018/10/23/aws_s3_verify_etags/
-        For this method we have to define nosec because it is out of any security context and provided by AWS
 
         Args:
             path(Path): path to local file
@@ -76,14 +74,17 @@ class S3(Upload):
         md5s = []
         with path.open("rb") as local_file:
             for chunk in iter(lambda: local_file.read(chunk_size), b""):
-                md5s.append(hashlib.md5(chunk))  # nosec
+                md5s.append(hashlib.md5(chunk, usedforsecurity=False))
 
         # in case if there is only one chunk it must be just this checksum
-        # and checksum of joined digest otherwise (including empty list)
+        if len(md5s) == 1:
-        checksum = md5s[0] if len(md5s) == 1 else hashlib.md5(b"".join(md5.digest() for md5 in md5s))  # nosec
+            return md5s[0].hexdigest()
-        # in case if there are more than one chunk it should be appended with amount of chunks
+
+        # otherwise it is checksum of joined digest (including empty list)
+        md5 = hashlib.md5(b"".join(md5.digest() for md5 in md5s), usedforsecurity=False)
+        # in case if there are more (exactly) than one chunk it should be appended with amount of chunks
         suffix = f"-{len(md5s)}" if len(md5s) > 1 else ""
-        return f"{checksum.hexdigest()}{suffix}"
+        return f"{md5.hexdigest()}{suffix}"
 
     @staticmethod
     def files_remove(local_files: dict[Path, str], remote_objects: dict[Path, Any]) -> None:

src/ahriman/core/utils.py

@@ -231,13 +231,13 @@ def check_user(root: Path, *, unsafe: bool) -> None:
 
 def dataclass_view(instance: Any) -> dict[str, Any]:
     """
-    convert dataclass instance to json object
+    convert dataclass instance to JSON object
 
     Args:
         instance(Any): dataclass instance
 
     Returns:
-        dict[str, Any]: json representation of the dataclass with empty field removed
+        dict[str, Any]: JSON representation of the dataclass with empty field removed
     """
     return asdict(instance, dict_factory=lambda fields: {key: value for key, value in fields if value is not None})
 
@@ -287,15 +287,15 @@ def filelock(path: Path) -> Iterator[FileLock]:
 
 def filter_json(source: T, known_fields: Iterable[str] | None = None) -> T:
     """
-    recursively filter json object removing ``None`` values and optionally filtering by known fields
+    recursively filter JSON object removing ``None`` values and optionally filtering by known fields
 
     Args:
-        source(T): raw json object (dict, list, or scalar)
+        source(T): raw JSON object (dict, list, or scalar)
         known_fields(Iterable[str] | None, optional): list of fields which have to be known for the target object
             (Default value = None)
 
     Returns:
-        T: json without ``None`` values
+        T: JSON without ``None`` values
 
     Examples:
         This wrapper is mainly used for the dataclasses, thus the flow must be something like this::

src/ahriman/models/aur_package.py

@@ -62,7 +62,7 @@ class AURPackage:
     Examples:
         Mainly this class must be used from class methods instead of default :func:`__init__()`::
 
-            >>> package = AURPackage.from_json(metadata)  # load package from json dump
+            >>> package = AURPackage.from_json(metadata)  # load package from JSON dump
             >>> # ...or alternatively...
             >>> package = AURPackage.from_repo(metadata)  # load package from official repository RPC
             >>> # properties of the class are built based on ones from AUR RPC, thus additional method is required
@@ -175,7 +175,7 @@ class AURPackage:
         construct package descriptor from official repository RPC properties
 
         Args:
-            dump(dict[str, Any]): json dump body
+            dump(dict[str, Any]): JSON dump body
 
         Returns:
             Self: AUR package descriptor

src/ahriman/models/build_status.py

@@ -89,7 +89,7 @@ class BuildStatus:
 
     def view(self) -> dict[str, Any]:
         """
-        generate json status view
+        generate JSON status view
 
         Returns:
             dict[str, Any]: json-friendly dictionary

src/ahriman/models/changes.py

@@ -41,10 +41,10 @@ class Changes:
     @classmethod
     def from_json(cls, dump: dict[str, Any]) -> Self:
         """
-        construct changes from the json dump
+        construct changes from the JSON dump
 
         Args:
-            dump(dict[str, Any]): json dump body
+            dump(dict[str, Any]): JSON dump body
 
         Returns:
             Self: changes object
@@ -55,7 +55,7 @@ class Changes:
 
     def view(self) -> dict[str, Any]:
         """
-        generate json change view
+        generate JSON change view
 
         Returns:
             dict[str, Any]: json-friendly dictionary

src/ahriman/models/counters.py

@@ -49,10 +49,10 @@ class Counters:
     @classmethod
     def from_json(cls, dump: dict[str, Any]) -> Self:
         """
-        construct counters from json dump
+        construct counters from JSON dump
 
         Args:
-            dump(dict[str, Any]): json dump body
+            dump(dict[str, Any]): JSON dump body
 
         Returns:
             Self: status counters

src/ahriman/models/event.py

@@ -28,16 +28,24 @@ class EventType(StrEnum):
     predefined event types
 
     Attributes:
+        BuildLog(EventType): new build log line
+        PackageHeld(EventType): package hold status has been changed
         PackageOutdated(EventType): package has been marked as out-of-date
         PackageRemoved(EventType): package has been removed
+        PackageStatusChanged(EventType): package build status has been changed
         PackageUpdateFailed(EventType): package update has been failed
         PackageUpdated(EventType): package has been updated
+        ServiceStatusChanged(EventType): service status has been changed
     """
 
+    BuildLog = "build-log"
+    PackageHeld = "package-held"
     PackageOutdated = "package-outdated"
     PackageRemoved = "package-removed"
+    PackageStatusChanged = "package-status-changed"
     PackageUpdateFailed = "package-update-failed"
     PackageUpdated = "package-updated"
+    ServiceStatusChanged = "service-status-changed"
 
 
 class Event:
@@ -72,10 +80,10 @@ class Event:
     @classmethod
     def from_json(cls, dump: dict[str, Any]) -> Self:
         """
-        construct event from the json dump
+        construct event from the JSON dump
 
         Args:
-            dump(dict[str, Any]): json dump body
+            dump(dict[str, Any]): JSON dump body
 
         Returns:
             Self: event object
@@ -102,7 +110,7 @@ class Event:
 
     def view(self) -> dict[str, Any]:
         """
-        generate json event view
+        generate JSON event view
 
         Returns:
             dict[str, Any]: json-friendly dictionary

src/ahriman/models/internal_status.py

@@ -50,10 +50,10 @@ class InternalStatus:
     @classmethod
     def from_json(cls, dump: dict[str, Any]) -> Self:
         """
-        construct internal status from json dump
+        construct internal status from JSON dump
 
         Args:
-            dump(dict[str, Any]): json dump body
+            dump(dict[str, Any]): JSON dump body
 
         Returns:
             Self: internal status
@@ -70,7 +70,7 @@ class InternalStatus:
 
     def view(self) -> dict[str, Any]:
         """
-        generate json status view
+        generate JSON status view
 
         Returns:
             dict[str, Any]: json-friendly dictionary

src/ahriman/models/log_record.py

@@ -41,11 +41,11 @@ class LogRecord:
     @classmethod
     def from_json(cls, package_base: str, dump: dict[str, Any]) -> Self:
         """
-        construct log record from the json dump
+        construct log record from the JSON dump
 
         Args:
             package_base(str): package base for which log record belongs
-            dump(dict[str, Any]): json dump body
+            dump(dict[str, Any]): JSON dump body
 
         Returns:
             Self: log record object
@@ -63,7 +63,7 @@ class LogRecord:
 
     def view(self) -> dict[str, Any]:
         """
-        generate json log record view
+        generate JSON log record view
 
         Returns:
             dict[str, Any]: json-friendly dictionary

src/ahriman/models/package.py

@@ -50,11 +50,11 @@ class Package(LazyLogging):
         version(str): package full version
 
     Examples:
-        Different usages of this class may generate different (incomplete) data, e.g. if instantiating class from json::
+        Different usages of this class may generate different (incomplete) data, e.g. if instantiating class from JSON::
 
             >>> package = Package.from_json(dump)
 
-        it will contain every data available in the json body. Otherwise, if generate package from local archive::
+        it will contain every data available in the JSON body. Otherwise, if generate package from local archive::
 
             >>> package = Package.from_archive(local_path, pacman)
 
@@ -273,10 +273,10 @@ class Package(LazyLogging):
     @classmethod
     def from_json(cls, dump: dict[str, Any]) -> Self:
         """
-        construct package properties from json dump
+        construct package properties from JSON dump
 
         Args:
-            dump(dict[str, Any]): json dump body
+            dump(dict[str, Any]): JSON dump body
 
         Returns:
             Self: package properties
@@ -396,7 +396,7 @@ class Package(LazyLogging):
 
     def view(self) -> dict[str, Any]:
         """
-        generate json package view
+        generate JSON package view
 
         Returns:
             dict[str, Any]: json-friendly dictionary

src/ahriman/models/package_description.py

@@ -49,7 +49,7 @@ class PackageDescription:
 
     Examples:
         Unlike the :class:`ahriman.models.package.Package` class, this implementation only holds properties.
-        The recommended way to deal with it is to read data based on the source type - either json or
+        The recommended way to deal with it is to read data based on the source type - either JSON or
         :class:`pyalpm.Package` instance::
 
             >>> description = PackageDescription.from_json(dump)
@@ -126,10 +126,10 @@ class PackageDescription:
     @classmethod
     def from_json(cls, dump: dict[str, Any]) -> Self:
         """
-        construct package properties from json dump
+        construct package properties from JSON dump
 
         Args:
-            dump(dict[str, Any]): json dump body
+            dump(dict[str, Any]): JSON dump body
 
         Returns:
             Self: package properties
@@ -169,7 +169,7 @@ class PackageDescription:
 
     def view(self) -> dict[str, Any]:
         """
-        generate json package view
+        generate JSON package view
 
         Returns:
             dict[str, Any]: json-friendly dictionary

src/ahriman/models/pkgbuild_patch.py

@@ -87,10 +87,10 @@ class PkgbuildPatch:
     @classmethod
     def from_json(cls, dump: dict[str, Any]) -> Self:
         """
-        construct patch descriptor from the json dump
+        construct patch descriptor from the JSON dump
 
         Args:
-            dump(dict[str, Any]): json dump body
+            dump(dict[str, Any]): JSON dump body
 
         Returns:
             Self: patch object
@@ -125,7 +125,7 @@ class PkgbuildPatch:
                     # the source value looks like shell array, remove brackets and parse with shlex
                     return shlex.split(shell_array[1:-1])
                 case json_array if json_array.startswith("[") and json_array.endswith("]"):
-                    # json (aka python) array, parse with json parser instead
+                    # JSON (aka python) array, parse with JSON parser instead
                     parsed: list[str] = json.loads(json_array)
                     return parsed
                 case variable:
@@ -220,7 +220,7 @@ class PkgbuildPatch:
 
     def view(self) -> dict[str, Any]:
         """
-        generate json patch view
+        generate JSON patch view
 
         Returns:
             dict[str, Any]: json-friendly dictionary

src/ahriman/models/remote_source.py

@@ -74,10 +74,10 @@ class RemoteSource:
     @classmethod
     def from_json(cls, dump: dict[str, Any]) -> Self:
         """
-        construct remote source from the json dump (or database row)
+        construct remote source from the JSON dump (or database row)
 
         Args:
-            dump(dict[str, Any]): json dump body
+            dump(dict[str, Any]): JSON dump body
 
         Returns:
             Self: remote source
@@ -102,7 +102,7 @@ class RemoteSource:
 
     def view(self) -> dict[str, Any]:
         """
-        generate json package remote view
+        generate JSON package remote view
 
         Returns:
             dict[str, Any]: json-friendly dictionary

src/ahriman/models/report_settings.py

@@ -28,10 +28,10 @@ class ReportSettings(StrEnum):
 
     Attributes:
         Disabled(ReportSettings): option which generates no report for testing purpose
-        HTML(ReportSettings): html report generation
+        HTML(ReportSettings): HTML report generation
         Email(ReportSettings): email report generation
         Console(ReportSettings): print result to console
-        Telegram(ReportSettings): markdown report to telegram channel
+        Telegram(ReportSettings): Markdown report to telegram channel
         RSS(ReportSettings): RSS report generation
         RemoteCall(ReportSettings): remote ahriman server call
     """

src/ahriman/models/repository_id.py

@@ -70,7 +70,7 @@ class RepositoryId:
 
     def view(self) -> dict[str, Any]:
         """
-        generate json package view
+        generate JSON package view
 
         Returns:
             dict[str, Any]: json-friendly dictionary

src/ahriman/models/repository_stats.py

@@ -38,10 +38,10 @@ class RepositoryStats:
     @classmethod
     def from_json(cls, dump: dict[str, Any]) -> Self:
         """
-        construct counters from json dump
+        construct counters from JSON dump
 
         Args:
-            dump(dict[str, Any]): json dump body
+            dump(dict[str, Any]): JSON dump body
 
         Returns:
             Self: status counters

src/ahriman/models/worker.py

@@ -45,7 +45,7 @@ class Worker:
 
     def view(self) -> dict[str, Any]:
         """
-        generate json patch view
+        generate JSON worker view
 
         Returns:
             dict[str, Any]: json-friendly dictionary

src/ahriman/web/cors.py

@@ -21,26 +21,34 @@ import aiohttp_cors
 
 from aiohttp.web import Application
 
+from ahriman.core.configuration import Configuration
+
 
 __all__ = ["setup_cors"]
 
 
-def setup_cors(application: Application) -> aiohttp_cors.CorsConfig:
+def setup_cors(application: Application, configuration: Configuration) -> aiohttp_cors.CorsConfig:
     """
     setup CORS for the web application
 
     Args:
         application(Application): web application instance
+        configuration(Configuration): configuration instance
 
     Returns:
         aiohttp_cors.CorsConfig: generated CORS configuration
     """
+    allow_headers = configuration.getlist("web", "cors_allow_headers", fallback=[]) or "*"
+    allow_methods = configuration.getlist("web", "cors_allow_methods", fallback=[]) or "*"
+    expose_headers = configuration.getlist("web", "cors_expose_headers", fallback=[]) or "*"
+
     cors = aiohttp_cors.setup(application, defaults={
-        "*": aiohttp_cors.ResourceOptions(  # type: ignore[no-untyped-call]
+        origin: aiohttp_cors.ResourceOptions(  # type: ignore[no-untyped-call]
-            expose_headers="*",
+            expose_headers=expose_headers,
-            allow_headers="*",
+            allow_headers=allow_headers,
-            allow_methods="*",
+            allow_methods=allow_methods,
         )
+        for origin in configuration.getlist("web", "cors_allow_origins", fallback=["*"])
     })
     for route in application.router.routes():
         cors.add(route)

src/ahriman/web/middlewares/etag_handler.py

@@ -0,0 +1,61 @@
+#
+# Copyright (c) 2021-2026 ahriman team.
+#
+# This file is part of ahriman
+# (see https://github.com/arcan1s/ahriman).
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program. If not, see <http://www.gnu.org/licenses/>.
+#
+import hashlib
+
+from aiohttp import ETag
+from aiohttp.typedefs import Middleware
+from aiohttp.web import HTTPNotModified, Request, Response, StreamResponse, middleware
+
+from ahriman.web.middlewares import HandlerType
+
+
+__all__ = ["etag_handler"]
+
+
+def etag_handler() -> Middleware:
+    """
+    middleware to handle ETag header for conditional requests. It computes ETag from the response body
+    and returns 304 Not Modified if the client sends a matching ``If-None-Match`` header
+
+    Returns:
+        Middleware: built middleware
+
+    Raises:
+        HTTPNotModified: if content matches ``If-None-Match`` header sent
+    """
+    @middleware
+    async def handle(request: Request, handler: HandlerType) -> StreamResponse:
+        response = await handler(request)
+
+        if not isinstance(response, Response) or not isinstance(response.body, bytes):
+            return response
+
+        if request.method not in ("GET", "HEAD"):
+            return response
+
+        etag = ETag(value=hashlib.md5(response.body, usedforsecurity=False).hexdigest())
+        response.etag = etag
+
+        if request.if_none_match is not None and etag in request.if_none_match:
+            raise HTTPNotModified(headers={"ETag": response.headers["ETag"]})
+
+        return response
+
+    return handle

src/ahriman/web/middlewares/exception_handler.py

@@ -42,13 +42,13 @@ __all__ = ["exception_handler"]
 
 def _is_templated_unauthorized(request: Request) -> bool:
     """
-    check if the request is eligible for rendering html template
+    check if the request is eligible for rendering HTML template
 
     Args:
         request(Request): source request to check
 
     Returns:
-        bool: ``True`` in case if response should be rendered as html and ``False`` otherwise
+        bool: ``True`` in case if response should be rendered as HTML and ``False`` otherwise
     """
     return request.path in ("/api/v1/login", "/api/v1/logout") \
         and "application/json" not in request.headers.getall("accept", [])

src/ahriman/web/schemas/__init__.py

@@ -28,6 +28,7 @@ from ahriman.web.schemas.configuration_schema import ConfigurationSchema
 from ahriman.web.schemas.counters_schema import CountersSchema
 from ahriman.web.schemas.dependencies_schema import DependenciesSchema
 from ahriman.web.schemas.error_schema import ErrorSchema
+from ahriman.web.schemas.event_bus_filter_schema import EventBusFilterSchema
 from ahriman.web.schemas.event_schema import EventSchema
 from ahriman.web.schemas.event_search_schema import EventSearchSchema
 from ahriman.web.schemas.file_schema import FileSchema
@@ -61,6 +62,7 @@ from ahriman.web.schemas.repository_id_schema import RepositoryIdSchema
 from ahriman.web.schemas.repository_stats_schema import RepositoryStatsSchema
 from ahriman.web.schemas.rollback_schema import RollbackSchema
 from ahriman.web.schemas.search_schema import SearchSchema
+from ahriman.web.schemas.sse_schema import SSESchema
 from ahriman.web.schemas.status_schema import StatusSchema
 from ahriman.web.schemas.update_flags_schema import UpdateFlagsSchema
 from ahriman.web.schemas.worker_schema import WorkerSchema

src/ahriman/web/schemas/event_bus_filter_schema.py

@@ -0,0 +1,37 @@
+#
+# Copyright (c) 2021-2026 ahriman team.
+#
+# This file is part of ahriman
+# (see https://github.com/arcan1s/ahriman).
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program. If not, see <http://www.gnu.org/licenses/>.
+#
+from ahriman.models.event import EventType
+from ahriman.web.apispec import fields
+from ahriman.web.schemas.repository_id_schema import RepositoryIdSchema
+
+
+class EventBusFilterSchema(RepositoryIdSchema):
+    """
+    request event bus filter schema
+    """
+
+    event = fields.List(fields.String(), metadata={
+        "description": "Event type filter",
+        "example": [EventType.PackageUpdated],
+    })
+    object_id = fields.String(metadata={
+        "description": "Object identifier filter",
+        "example": "ahriman",
+    })

src/ahriman/web/schemas/sse_schema.py

@@ -0,0 +1,35 @@
+#
+# Copyright (c) 2021-2026 ahriman team.
+#
+# This file is part of ahriman
+# (see https://github.com/arcan1s/ahriman).
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program. If not, see <http://www.gnu.org/licenses/>.
+#
+from ahriman.models.event import EventType
+from ahriman.web.apispec import Schema, fields
+
+
+class SSESchema(Schema):
+    """
+    response SSE schema
+    """
+
+    event = fields.String(required=True, metadata={
+        "description": "Event type",
+        "example": EventType.PackageUpdated,
+    })
+    data = fields.Dict(keys=fields.String(), values=fields.Raw(), metadata={
+        "description": "Event data",
+    })

src/ahriman/web/server_info.py

@@ -39,7 +39,7 @@ async def server_info(view: BaseView) -> dict[str, Any]:
         view(BaseView): view of the request
 
     Returns:
-        dict[str, Any]: server info as a json response
+        dict[str, Any]: server info as a JSON response
     """
     autorefresh_intervals = [
         {

src/ahriman/web/views/api/docs.py

@@ -57,7 +57,7 @@ class DocsView(BaseView):
     @aiohttp_jinja2.template("api.jinja2")
     async def get(self) -> dict[str, Any]:
         """
-        return static docs html
+        return static docs HTML
 
         Returns:
             dict[str, Any]: parameters for jinja template

src/ahriman/web/views/api/swagger.py

@@ -60,7 +60,7 @@ class SwaggerView(BaseView):
         get api specification
 
         Returns:
-            Response: 200 with json api specification
+            Response: 200 with JSON api specification
         """
         spec = self.request.app["swagger_dict"]
         is_body_parameter: Callable[[dict[str, str]], bool] = lambda p: p["in"] == "body" or p["in"] == "formData"

src/ahriman/web/views/base.py

@@ -169,7 +169,7 @@ class BaseView(View, CorsViewMixin):
         filter and convert data and return :class:`aiohttp.web.Response` object
 
         Args:
-            data(dict[str, Any] | list[Any]): response in json format
+            data(dict[str, Any] | list[Any]): response in JSON format
             **kwargs(Any): keyword arguments for :func:`aiohttp.web.json_response` function
 
         Returns:
@@ -209,8 +209,8 @@ class BaseView(View, CorsViewMixin):
             HTTPBadRequest: if supplied parameters are invalid
         """
         try:
-            limit = int(self.request.query.get("limit", default=-1))
+            limit = int(self.request.query.get("limit", -1))
-            offset = int(self.request.query.get("offset", default=0))
+            offset = int(self.request.query.get("offset", 0))
         except ValueError as ex:
             raise HTTPBadRequest(reason=str(ex))
 

src/ahriman/web/views/v1/auditlog/event_bus.py

@@ -0,0 +1,164 @@
+#
+# Copyright (c) 2021-2026 ahriman team.
+#
+# This file is part of ahriman
+# (see https://github.com/arcan1s/ahriman).
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program. If not, see <http://www.gnu.org/licenses/>.
+#
+import json
+
+from aiohttp.web import HTTPBadRequest, Request, Response, StreamResponse
+from aiohttp_sse import EventSourceResponse, sse_response
+from asyncio import Queue, QueueShutDown, wait_for
+from typing import ClassVar
+
+from ahriman.core.status.event_bus import SSEvent
+from ahriman.models.event import EventType
+from ahriman.models.user_access import UserAccess
+from ahriman.web.apispec.decorators import apidocs
+from ahriman.web.schemas import EventBusFilterSchema, SSESchema
+from ahriman.web.views.base import BaseView
+
+
+class EventBusView(BaseView):
+    """
+    event bus SSE view
+
+    Attributes:
+        READ_EVENTS(set[EventType]): (class attribute) events which are allowed for read-only users
+    """
+
+    READ_EVENTS: ClassVar[set[EventType]] = {
+        EventType.PackageHeld,
+        EventType.PackageOutdated,
+        EventType.PackageRemoved,
+        EventType.PackageStatusChanged,
+        EventType.PackageUpdateFailed,
+        EventType.PackageUpdated,
+        EventType.ServiceStatusChanged,
+    }
+    ROUTES = ["/api/v1/events/stream"]
+
+    @classmethod
+    async def get_permission(cls, request: Request) -> UserAccess:
+        """
+        retrieve user permission from the request
+
+        Args:
+            request(Request): request object
+
+        Returns:
+            UserAccess: extracted permission
+        """
+        if request.method.upper() not in ("GET", "HEAD"):
+            return await BaseView.get_permission(request)
+
+        permission = UserAccess.Full
+        try:
+            topics = cls(request)._topics()
+        except HTTPBadRequest:
+            topics = None
+
+        if topics is not None and set(topics).issubset(cls.READ_EVENTS):
+            permission = UserAccess.Read
+
+        return permission
+
+    @staticmethod
+    async def _run(response: EventSourceResponse, queue: Queue[SSEvent]) -> None:
+        """
+        read events from queue and send them to the client
+
+        Args:
+            response(EventSourceResponse): SSE response instance
+            queue(Queue[SSEvent]): subscriber queue
+        """
+        while response.is_connected():
+            try:
+                event_type, data = await wait_for(queue.get(), timeout=response.ping_interval)
+            except TimeoutError:
+                continue
+            except QueueShutDown:
+                break
+
+            await response.send(json.dumps(data), event=event_type)
+
+    def _topics(self) -> list[EventType] | None:
+        """
+        parse event filter from request query
+
+        Returns:
+            list[EventType] | None: event filter if any
+
+        Raises:
+            HTTPBadRequest: if invalid event type is supplied
+        """
+        if self.request.query is None:
+            return None
+
+        try:
+            return [EventType(event) for event in self.request.query.getall("event", [])] or None
+        except ValueError as ex:
+            raise HTTPBadRequest(reason=str(ex))
+
+    @apidocs(
+        tags=["Audit log"],
+        summary="Live updates",
+        description="Stream live updates via SSE. Read-only users may subscribe only when all requested event filters "
+                    "belong to read-safe package and service status events; build log or unfiltered streams require "
+                    "full access. Streams are live-only and do not replay missed events after reconnect.",
+        permission=UserAccess.Full,
+        error_400_enabled=True,
+        error_404_description="Repository is unknown",
+        schema=SSESchema(many=True),
+        query_schema=EventBusFilterSchema,
+    )
+    async def get(self) -> StreamResponse:
+        """
+        subscribe on updates
+
+        Returns:
+            StreamResponse: 200 with streaming updates
+        """
+        topics = self._topics()
+        object_id = self.request.query.get("object_id")
+        event_bus = self.service().event_bus
+
+        async with sse_response(self.request) as response:
+            subscription_id, queue = await event_bus.subscribe(topics, object_id=object_id)
+
+            try:
+                await self._run(response, queue)
+            except (ConnectionResetError, QueueShutDown):
+                pass
+            finally:
+                await event_bus.unsubscribe(subscription_id)
+
+        return response
+
+    async def head(self) -> StreamResponse:
+        """
+        HEAD method implementation based on the result of GET method
+
+        Returns:
+            StreamResponse: generated response for the request
+        """
+        self._topics()
+        self.service()
+
+        return Response(headers={
+            "Cache-Control": "no-cache",
+            "Content-Type": "text/event-stream",
+        })

src/ahriman/web/views/v1/auditlog/events.py

@@ -67,7 +67,7 @@ class EventsView(BaseView):
         except ValueError as ex:
             raise HTTPBadRequest(reason=str(ex))
 
-        events = self.service().event_get(event, object_id, from_date, to_date, limit, offset)
+        events = await self.service().event_get(event, object_id, from_date, to_date, limit, offset)
         response = [event.view() for event in events]
 
         return self.json_response(response)
@@ -94,6 +94,6 @@ class EventsView(BaseView):
         except Exception as ex:
             raise HTTPBadRequest(reason=str(ex))
 
-        self.service().event_add(event)
+        await self.service().event_add(event)
 
         raise HTTPNoContent

src/ahriman/web/views/v1/packages/archives.py

@@ -60,6 +60,6 @@ class Archives(StatusViewGuard, BaseView):
         """
         package_base = self.request.match_info["package"]
 
-        archives = self.service(package_base=package_base).package_archives(package_base)
+        archives = await self.service(package_base=package_base).package_archives(package_base)
 
         return self.json_response([archive.view() for archive in archives])

src/ahriman/web/views/v1/packages/changes.py

@@ -63,7 +63,7 @@ class ChangesView(StatusViewGuard, BaseView):
         """
         package_base = self.request.match_info["package"]
 
-        changes = self.service(package_base=package_base).package_changes_get(package_base)
+        changes = await self.service(package_base=package_base).package_changes_get(package_base)
 
         return self.json_response(changes.view())
 
@@ -97,6 +97,6 @@ class ChangesView(StatusViewGuard, BaseView):
             raise HTTPBadRequest(reason=str(ex))
 
         changes = Changes(last_commit_sha, change, pkgbuild)
-        self.service().package_changes_update(package_base, changes)
+        await self.service().package_changes_update(package_base, changes)
 
         raise HTTPNoContent

src/ahriman/web/views/v1/packages/dependencies.py

@@ -63,7 +63,7 @@ class DependenciesView(StatusViewGuard, BaseView):
         """
         package_base = self.request.match_info["package"]
 
-        dependencies = self.service(package_base=package_base).package_dependencies_get(package_base)
+        dependencies = await self.service(package_base=package_base).package_dependencies_get(package_base)
 
         return self.json_response(dependencies.view())
 
@@ -95,6 +95,6 @@ class DependenciesView(StatusViewGuard, BaseView):
         except Exception as ex:
             raise HTTPBadRequest(reason=str(ex))
 
-        self.service(package_base=package_base).package_dependencies_update(package_base, dependencies)
+        await self.service(package_base=package_base).package_dependencies_update(package_base, dependencies)
 
         raise HTTPNoContent

src/ahriman/web/views/v1/packages/hold.py

@@ -68,7 +68,7 @@ class HoldView(StatusViewGuard, BaseView):
             raise HTTPBadRequest(reason=str(ex))
 
         try:
-            self.service().package_hold_update(package_base, enabled=is_held)
+            await self.service().package_hold_update(package_base, enabled=is_held)
         except UnknownPackageError:
             raise HTTPNotFound(reason=f"Package {package_base} is unknown")
 

src/ahriman/web/views/v1/packages/logs.py

@@ -62,7 +62,7 @@ class LogsView(StatusViewGuard, BaseView):
         """
         package_base = self.request.match_info["package"]
         version = self.request.query.get("version")
-        self.service().package_logs_remove(package_base, version)
+        await self.service().package_logs_remove(package_base, version)
 
         raise HTTPNoContent
 
@@ -89,8 +89,8 @@ class LogsView(StatusViewGuard, BaseView):
         package_base = self.request.match_info["package"]
 
         try:
-            _, status = self.service().package_get(package_base)
+            _, status = await self.service().package_get(package_base)
-            logs = self.service(package_base=package_base).package_logs_get(package_base, None, None, -1, 0)
+            logs = await self.service(package_base=package_base).package_logs_get(package_base, None, None, -1, 0)
         except UnknownPackageError:
             raise HTTPNotFound(reason=f"Package {package_base} is unknown")
 
@@ -127,6 +127,6 @@ class LogsView(StatusViewGuard, BaseView):
         except Exception as ex:
             raise HTTPBadRequest(reason=str(ex))
 
-        self.service().package_logs_add(log_record)
+        await self.service().package_logs_add(log_record)
 
         raise HTTPNoContent

src/ahriman/web/views/v1/packages/package.py

@@ -66,7 +66,7 @@ class PackageView(StatusViewGuard, BaseView):
             HTTPNoContent: on success response
         """
         package_base = self.request.match_info["package"]
-        self.service().package_remove(package_base)
+        await self.service().package_remove(package_base)
 
         raise HTTPNoContent
 
@@ -94,7 +94,7 @@ class PackageView(StatusViewGuard, BaseView):
         repository_id = self.repository_id()
 
         try:
-            package, status = self.service(repository_id).package_get(package_base)
+            package, status = await self.service(repository_id).package_get(package_base)
         except UnknownPackageError:
             raise HTTPNotFound(reason=f"Package {package_base} is unknown")
 
@@ -137,9 +137,9 @@ class PackageView(StatusViewGuard, BaseView):
 
         try:
             if package is None:
-                self.service().package_status_update(package_base, status)
+                await self.service().package_status_update(package_base, status)
             else:
-                self.service().package_update(package, status)
+                await self.service().package_update(package, status)
         except UnknownPackageError:
             raise HTTPBadRequest(reason=f"Package {package_base} is unknown, but no package body set")
 

src/ahriman/web/views/v1/packages/packages.py

@@ -67,7 +67,7 @@ class PackagesView(StatusViewGuard, BaseView):
         stop = offset + limit if limit >= 0 else None
 
         repository_id = self.repository_id()
-        packages = self.service(repository_id).packages
+        packages = await self.service(repository_id).packages()
 
         comparator: Callable[[tuple[Package, BuildStatus]], Comparable] = lambda items: items[0].base
         response = [
@@ -95,6 +95,6 @@ class PackagesView(StatusViewGuard, BaseView):
         Raises:
             HTTPNoContent: on success response
         """
-        self.service().load()
+        await self.service().load()
 
         raise HTTPNoContent

src/ahriman/web/views/v1/packages/patch.py

@@ -57,7 +57,7 @@ class PatchView(StatusViewGuard, BaseView):
         package_base = self.request.match_info["package"]
         variable = self.request.match_info["patch"]
 
-        self.service().package_patches_remove(package_base, variable)
+        await self.service().package_patches_remove(package_base, variable)
 
         raise HTTPNoContent
 
@@ -83,7 +83,7 @@ class PatchView(StatusViewGuard, BaseView):
         package_base = self.request.match_info["package"]
         variable = self.request.match_info["patch"]
 
-        patches = self.service().package_patches_get(package_base, variable)
+        patches = await self.service().package_patches_get(package_base, variable)
 
         selected = next((patch for patch in patches if patch.key == variable), None)
         if selected is None:

src/ahriman/web/views/v1/packages/patches.py

@@ -57,7 +57,7 @@ class PatchesView(StatusViewGuard, BaseView):
             Response: 200 with package patches on success
         """
         package_base = self.request.match_info["package"]
-        patches = self.service().package_patches_get(package_base, None)
+        patches = await self.service().package_patches_get(package_base, None)
 
         response = [patch.view() for patch in patches]
         return self.json_response(response)
@@ -88,6 +88,6 @@ class PatchesView(StatusViewGuard, BaseView):
         except Exception as ex:
             raise HTTPBadRequest(reason=str(ex))
 
-        self.service().package_patches_update(package_base, PkgbuildPatch.parse(key, value))
+        await self.service().package_patches_update(package_base, PkgbuildPatch.parse(key, value))
 
         raise HTTPNoContent

src/ahriman/web/views/v1/service/logs.py

@@ -59,6 +59,6 @@ class LogsView(BaseView):
         except Exception as ex:
             raise HTTPBadRequest(reason=str(ex))
 
-        self.service().logs_rotate(keep_last_records)
+        await self.service().logs_rotate(keep_last_records)
 
         raise HTTPNoContent

src/ahriman/web/views/v1/status/status.py

@@ -62,7 +62,7 @@ class StatusView(StatusViewGuard, BaseView):
             Response: 200 with service status object
         """
         repository_id = self.repository_id()
-        packages = self.service(repository_id).packages
+        packages = await self.service(repository_id).packages()
         counters = Counters.from_packages(packages)
         stats = RepositoryStats.from_packages([package for package, _ in packages])
 
@@ -101,6 +101,6 @@ class StatusView(StatusViewGuard, BaseView):
         except Exception as ex:
             raise HTTPBadRequest(reason=str(ex))
 
-        self.service().status_update(status)
+        await self.service().status_update(status)
 
         raise HTTPNoContent

src/ahriman/web/views/v2/packages/logs.py

@@ -67,7 +67,7 @@ class LogsView(StatusViewGuard, BaseView):
         version = self.request.query.get("version", None)
         process = self.request.query.get("process_id", None)
 
-        logs = self.service(package_base=package_base).package_logs_get(package_base, version, process, limit, offset)
+        logs = await self.service(package_base=package_base).package_logs_get(package_base, version, process, limit, offset)
 
         head = self.request.query.get("head", "false")
         # pylint: disable=protected-access