@rapidmx/web-client 0.2.0

package/dist/apps/admin/mailboxes/[uid].js

@@ -0,0 +1,59 @@
+import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
+///////////////////////////////////////////////////////////////////////////////
+// Copyright (C) 2026 Jean-Philippe Steinmetz
+// SPDX-License-Identifier: MPL-2.0
+///////////////////////////////////////////////////////////////////////////////
+import { useEffect, useState } from "react";
+import { ApiRequestError } from "@rapidmx/react-shared/util/api.js";
+import { getMailbox, impersonateUser } from "@rapidmx/react-shared/mail/mailApi.js";
+import AdminShell from "../../shared/components/admin/layout/AdminShell.js";
+import ShareAccessCard from "../../shared/components/admin/mailboxes/ShareAccessCard.js";
+import ResourceSettingsCard from "../../shared/components/admin/mailboxes/ResourceSettingsCard.js";
+import Alert from "@rapidmx/react-shared/components/feedback/Alert.js";
+import Button from "@rapidmx/react-shared/components/buttons/Button.js";
+function formatBytes(bytes) {
+    if (bytes >= 1000000000)
+        return `${(bytes / 1000000000).toFixed(2)} GB`;
+    if (bytes >= 1000000)
+        return `${(bytes / 1000000).toFixed(1)} MB`;
+    if (bytes >= 1000)
+        return `${(bytes / 1000).toFixed(1)} KB`;
+    return `${bytes} B`;
+}
+export default function MailboxDetailPage(props) {
+    return (_jsx(AdminShell, { ...props, active: "mailboxes", children: _jsx(MailboxDetailContent, { uid: props.params.uid, impersonationBaseUrl: props.impersonationBaseUrl }) }));
+}
+function MailboxDetailContent({ uid, impersonationBaseUrl }) {
+    const [mailbox, setMailbox] = useState(null);
+    const [loading, setLoading] = useState(true);
+    const [error, setError] = useState(null);
+    const [impersonating, setImpersonating] = useState(false);
+    async function handleAccessMailbox(ownerUserUid) {
+        setImpersonating(true);
+        try {
+            await impersonateUser(impersonationBaseUrl ?? "", ownerUserUid);
+            window.location.href = "/";
+        }
+        catch (err) {
+            setError(err instanceof ApiRequestError ? err.message : "Could not access this mailbox.");
+            setImpersonating(false);
+        }
+    }
+    useEffect(() => {
+        setLoading(true);
+        setError(null);
+        getMailbox(uid)
+            .then(setMailbox)
+            .catch((err) => setError(err instanceof ApiRequestError ? err.message : "Could not load this mailbox."))
+            .finally(() => setLoading(false));
+    }, [uid]);
+    if (loading) {
+        return _jsx("p", { className: "text-sm text-text-muted", children: "Loading\u2026" });
+    }
+    if (error || !mailbox) {
+        return _jsx(Alert, { children: error ?? "Mailbox not found." });
+    }
+    const quarantineHref = `/admin/quarantine?mailboxUid=${encodeURIComponent(mailbox.uid)}`;
+    const ingestQueueHref = `/admin/ingest-queue?mailboxUid=${encodeURIComponent(mailbox.uid)}`;
+    return (_jsxs("div", { className: "max-w-3xl flex flex-col gap-5", children: [_jsxs("div", { className: "flex items-start justify-between gap-4", children: [_jsxs("div", { children: [_jsx("a", { href: "/admin", className: "text-sm text-primary-dark hover:underline", children: "\u2190 All mailboxes" }), _jsx("h1", { className: "text-xl font-bold tracking-tight mt-1", children: mailbox.primarySmtpAddress })] }), mailbox.ownerUserUid && (_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto shrink-0", loading: impersonating, disabled: impersonating, onClick: () => handleAccessMailbox(mailbox.ownerUserUid), children: "Access this mailbox" }))] }), _jsxs("div", { className: "bg-surface border border-border rounded-md p-6", children: [_jsxs("dl", { className: "grid grid-cols-1 sm:grid-cols-2 gap-x-6 gap-y-3 text-sm", children: [_jsx("dt", { className: "text-text-muted", children: "Display name" }), _jsx("dd", { children: mailbox.displayName }), _jsx("dt", { className: "text-text-muted", children: "Owner" }), _jsx("dd", { children: mailbox.ownerUserUid ?? "None (shared mailbox)" }), _jsx("dt", { className: "text-text-muted", children: "Timezone" }), _jsx("dd", { children: mailbox.timezone }), _jsx("dt", { className: "text-text-muted", children: "Quota" }), _jsxs("dd", { children: [formatBytes(mailbox.usedBytes), " / ", formatBytes(mailbox.quotaBytes)] }), _jsx("dt", { className: "text-text-muted", children: "Alias addresses" }), _jsx("dd", { children: mailbox.aliasAddresses.length > 0 ? mailbox.aliasAddresses.join(", ") : "None" }), mailbox.isResource && (_jsxs(_Fragment, { children: [_jsx("dt", { className: "text-text-muted", children: "Resource type" }), _jsx("dd", { className: "capitalize", children: mailbox.resourceType ?? "room" })] })), _jsx("dt", { className: "text-text-muted", children: "Created" }), _jsx("dd", { children: new Date(mailbox.dateCreated).toLocaleString() })] }), _jsxs("div", { className: "flex gap-4 mt-5 pt-5 border-t border-border text-sm font-medium", children: [_jsx("a", { href: quarantineHref, className: "text-primary-dark hover:underline", children: "View quarantine" }), _jsx("a", { href: ingestQueueHref, className: "text-primary-dark hover:underline", children: "View ingest queue" })] })] }), _jsx(ShareAccessCard, { mailboxUid: mailbox.uid }), mailbox.isResource && _jsx(ResourceSettingsCard, { mailbox: mailbox, onUpdate: setMailbox })] }));
+}

package/dist/apps/admin/mailboxes/new/index.js

@@ -0,0 +1,93 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+///////////////////////////////////////////////////////////////////////////////
+// Copyright (C) 2026 Jean-Philippe Steinmetz
+// SPDX-License-Identifier: MPL-2.0
+///////////////////////////////////////////////////////////////////////////////
+import { useEffect, useState } from "react";
+import { ApiRequestError } from "@rapidmx/react-shared/util/api.js";
+import { createMailbox, listMailboxDomains } from "@rapidmx/react-shared/mail/mailApi.js";
+import AdminShell from "../../../shared/components/admin/layout/AdminShell.js";
+import Alert from "@rapidmx/react-shared/components/feedback/Alert.js";
+import Button from "@rapidmx/react-shared/components/buttons/Button.js";
+import FormField from "@rapidmx/react-shared/components/forms/FormField.js";
+const INPUT_CLASS = "w-full text-sm py-2.5 px-3 border border-border rounded-sm bg-surface text-text focus:outline-none focus:border-primary";
+const SELECT_CLASS = "text-sm py-2.5 px-3 border border-border rounded-sm bg-surface text-text focus:outline-none focus:border-primary";
+export default function NewMailboxPage(props) {
+    return (_jsx(AdminShell, { ...props, active: "mailboxes", children: _jsx(NewMailboxForm, {}) }));
+}
+function NewMailboxForm() {
+    const [primarySmtpAddress, setPrimarySmtpAddress] = useState("");
+    const [localPart, setLocalPart] = useState("");
+    const [domains, setDomains] = useState([]);
+    const [domain, setDomain] = useState("");
+    const [displayName, setDisplayName] = useState("");
+    const [ownerUserUid, setOwnerUserUid] = useState("");
+    const [timezone, setTimezone] = useState("UTC");
+    const [quotaGb, setQuotaGb] = useState(5);
+    const [isResource, setIsResource] = useState(false);
+    const [resourceType, setResourceType] = useState("room");
+    const [resourceCapacity, setResourceCapacity] = useState("");
+    const [autoAcceptBookings, setAutoAcceptBookings] = useState(false);
+    const [allowConflicts, setAllowConflicts] = useState(false);
+    const [bookingWindowDays, setBookingWindowDays] = useState("");
+    const [maxDurationMinutes, setMaxDurationMinutes] = useState("");
+    const [error, setError] = useState(null);
+    const [saving, setSaving] = useState(false);
+    // An empty `mail:domains` list (the default) means this server enforces no domain restriction —
+    // the address field stays free text, exactly as before. Once an admin configures at least one
+    // domain, every mailbox this server creates must be on one of them (enforced server-side too, in
+    // `BaseMailboxRoute.create()`), so the form switches to a local-part input + domain dropdown to
+    // make that restriction visible rather than let an admin discover it only via a rejected submit.
+    useEffect(() => {
+        listMailboxDomains()
+            .then((list) => {
+            setDomains(list);
+            setDomain(list[0] ?? "");
+        })
+            .catch(() => undefined);
+    }, []);
+    const constrained = domains.length > 0;
+    async function handleSubmit(e) {
+        e.preventDefault();
+        setError(null);
+        const address = constrained ? `${localPart.trim()}@${domain}` : primarySmtpAddress.trim();
+        if (constrained ? !localPart.trim() : !primarySmtpAddress.trim()) {
+            setError("A primary SMTP address is required.");
+            return;
+        }
+        if (!displayName.trim()) {
+            setError("A display name is required.");
+            return;
+        }
+        setSaving(true);
+        try {
+            // ownerUserUid left blank creates a true ownerless shared mailbox (e.g. support@example.com);
+            // delegates are then granted access from the mailbox's detail page. A resource mailbox is
+            // ownerless the same way — leave "Owner user uid" blank for one too.
+            const mailbox = await createMailbox({
+                primarySmtpAddress: address,
+                displayName: displayName.trim(),
+                ownerUserUid: ownerUserUid.trim() || undefined,
+                timezone,
+                quotaBytes: Math.round(quotaGb * 1000000000),
+                ...(isResource && {
+                    isResource: true,
+                    resourceType,
+                    resourceCapacity: resourceCapacity ? Number(resourceCapacity) : undefined,
+                    autoAcceptBookings,
+                    allowConflicts,
+                    bookingWindowDays: bookingWindowDays ? Number(bookingWindowDays) : undefined,
+                    maxDurationMinutes: maxDurationMinutes ? Number(maxDurationMinutes) : undefined,
+                }),
+            });
+            window.location.href = `/admin/mailboxes/${encodeURIComponent(mailbox.uid)}`;
+        }
+        catch (err) {
+            setError(err instanceof ApiRequestError ? err.message : "Could not create the mailbox.");
+        }
+        finally {
+            setSaving(false);
+        }
+    }
+    return (_jsxs("div", { className: "max-w-xl", children: [_jsx("h1", { className: "text-xl font-bold uppercase tracking-wide mb-1", children: "New mailbox" }), _jsx("p", { className: "text-sm text-text-muted mb-5", children: "Leave \"Owner user uid\" blank to create a true ownerless shared mailbox (the Exchange \"shared mailbox\" concept) \u2014 access is then granted entirely to delegates afterward, not to a single owner. Set an owner to create a mailbox for a specific user instead." }), error && _jsx(Alert, { children: error }), _jsxs("form", { onSubmit: handleSubmit, className: "bg-surface border border-border rounded-md p-6", children: [constrained ? (_jsx(FormField, { label: "Local part", htmlFor: "localPart", children: _jsxs("div", { className: "flex gap-2 items-center", children: [_jsx("input", { id: "localPart", type: "text", className: INPUT_CLASS, value: localPart, onChange: (e) => setLocalPart(e.target.value), placeholder: "support" }), _jsx("span", { className: "text-text-muted shrink-0", children: "@" }), _jsx("select", { "aria-label": "Domain", className: SELECT_CLASS, value: domain, onChange: (e) => setDomain(e.target.value), children: domains.map((d) => (_jsx("option", { value: d, children: d }, d))) })] }) })) : (_jsx(FormField, { label: "Primary SMTP address", htmlFor: "primarySmtpAddress", children: _jsx("input", { id: "primarySmtpAddress", type: "email", className: INPUT_CLASS, value: primarySmtpAddress, onChange: (e) => setPrimarySmtpAddress(e.target.value), placeholder: "support@example.com" }) })), _jsx(FormField, { label: "Display name", htmlFor: "displayName", children: _jsx("input", { id: "displayName", type: "text", className: INPUT_CLASS, value: displayName, onChange: (e) => setDisplayName(e.target.value), placeholder: "Support" }) }), _jsx(FormField, { label: "Owner user uid (optional)", htmlFor: "ownerUserUid", children: _jsx("input", { id: "ownerUserUid", type: "text", className: INPUT_CLASS, value: ownerUserUid, onChange: (e) => setOwnerUserUid(e.target.value), placeholder: "Leave blank for a shared mailbox" }) }), _jsx(FormField, { label: "Timezone", htmlFor: "timezone", children: _jsx("input", { id: "timezone", type: "text", className: INPUT_CLASS, value: timezone, onChange: (e) => setTimezone(e.target.value), placeholder: "America/Los_Angeles" }) }), _jsx(FormField, { label: "Quota (GB)", htmlFor: "quotaGb", children: _jsx("input", { id: "quotaGb", type: "number", min: 1, step: 1, className: INPUT_CLASS, value: quotaGb, onChange: (e) => setQuotaGb(Number(e.target.value)) }) }), _jsxs("label", { className: "flex items-center gap-2 text-sm mb-4", children: [_jsx("input", { type: "checkbox", checked: isResource, onChange: (e) => setIsResource(e.target.checked) }), "This is a resource mailbox (a bookable room or piece of equipment)"] }), isResource && (_jsxs("div", { className: "border border-border rounded-sm p-4 mb-4 flex flex-col gap-4", children: [_jsx(FormField, { label: "Resource type", htmlFor: "resourceType", children: _jsxs("select", { id: "resourceType", className: SELECT_CLASS, value: resourceType, onChange: (e) => setResourceType(e.target.value), children: [_jsx("option", { value: "room", children: "Room" }), _jsx("option", { value: "equipment", children: "Equipment" })] }) }), _jsx(FormField, { label: "Capacity (optional)", htmlFor: "resourceCapacity", children: _jsx("input", { id: "resourceCapacity", type: "number", min: 0, step: 1, className: INPUT_CLASS, value: resourceCapacity, onChange: (e) => setResourceCapacity(e.target.value), placeholder: "Informational only" }) }), _jsxs("label", { className: "flex items-center gap-2 text-sm", children: [_jsx("input", { type: "checkbox", checked: autoAcceptBookings, onChange: (e) => setAutoAcceptBookings(e.target.checked) }), "Automatically accept booking requests"] }), _jsxs("label", { className: "flex items-center gap-2 text-sm", children: [_jsx("input", { type: "checkbox", checked: allowConflicts, onChange: (e) => setAllowConflicts(e.target.checked) }), "Allow conflicting bookings (skip conflict checking entirely)"] }), _jsx(FormField, { label: "Booking window, in days (optional)", htmlFor: "bookingWindowDays", children: _jsx("input", { id: "bookingWindowDays", type: "number", min: 0, step: 1, className: INPUT_CLASS, value: bookingWindowDays, onChange: (e) => setBookingWindowDays(e.target.value), placeholder: "No limit" }) }), _jsx(FormField, { label: "Maximum duration, in minutes (optional)", htmlFor: "maxDurationMinutes", children: _jsx("input", { id: "maxDurationMinutes", type: "number", min: 0, step: 1, className: INPUT_CLASS, value: maxDurationMinutes, onChange: (e) => setMaxDurationMinutes(e.target.value), placeholder: "No limit" }) })] })), _jsxs("div", { className: "flex gap-3 mt-2", children: [_jsx(Button, { type: "submit", loading: saving, disabled: saving, className: "!w-auto", children: "Create mailbox" }), _jsx("a", { href: "/admin", children: _jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", children: "Cancel" }) })] })] })] }));
+}

package/dist/apps/admin/quarantine/index.js

@@ -0,0 +1,66 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+///////////////////////////////////////////////////////////////////////////////
+// Copyright (C) 2026 Jean-Philippe Steinmetz
+// SPDX-License-Identifier: MPL-2.0
+///////////////////////////////////////////////////////////////////////////////
+import { useEffect, useState } from "react";
+import { ApiRequestError } from "@rapidmx/react-shared/util/api.js";
+import { listQuarantine, releaseQuarantineEntry } from "@rapidmx/react-shared/mail/mailApi.js";
+import AdminShell from "../../shared/components/admin/layout/AdminShell.js";
+import Alert from "@rapidmx/react-shared/components/feedback/Alert.js";
+import Button from "@rapidmx/react-shared/components/buttons/Button.js";
+const PAGE_SIZE = 25;
+export function readMailboxUid() {
+    if (typeof window === "undefined")
+        return null;
+    return new URLSearchParams(window.location.search).get("mailboxUid");
+}
+export default function QuarantinePage(props) {
+    return (_jsx(AdminShell, { ...props, active: "quarantine", children: _jsx(QuarantineContent, { userUid: props.userUid }) }));
+}
+function QuarantineContent({ userUid }) {
+    const [mailboxUid, setMailboxUid] = useState(null);
+    const [page, setPage] = useState(0);
+    const [entries, setEntries] = useState([]);
+    const [loading, setLoading] = useState(true);
+    const [error, setError] = useState(null);
+    const [releasing, setReleasing] = useState(null);
+    useEffect(() => {
+        setMailboxUid(readMailboxUid());
+    }, []);
+    function reload(uid) {
+        setLoading(true);
+        setError(null);
+        listQuarantine(uid, { page, limit: PAGE_SIZE })
+            .then(setEntries)
+            .catch((err) => setError(err instanceof ApiRequestError ? err.message : "Could not load quarantine."))
+            .finally(() => setLoading(false));
+    }
+    useEffect(() => {
+        if (mailboxUid) {
+            reload(mailboxUid);
+        }
+    }, [mailboxUid, page]);
+    const hasNextPage = entries.length === PAGE_SIZE;
+    // Only ever invoked from the "Release" button below, which itself only renders once `mailboxUid` is
+    // known and `AdminShell` has already confirmed `userUid` (children only render once authorized) — both
+    // non-null assertions reflect that real invariant, not an unchecked assumption.
+    async function handleRelease(entry) {
+        setReleasing(entry.uid);
+        setError(null);
+        try {
+            await releaseQuarantineEntry(entry.uid, entry.version, userUid);
+            reload(mailboxUid);
+        }
+        catch (err) {
+            setError(err instanceof ApiRequestError ? err.message : "Could not release this message.");
+        }
+        finally {
+            setReleasing(null);
+        }
+    }
+    if (!mailboxUid) {
+        return _jsx(Alert, { children: "No mailbox specified. Open a mailbox's detail page and choose \"View quarantine\"." });
+    }
+    return (_jsxs("div", { className: "max-w-4xl flex flex-col gap-4", children: [_jsxs("div", { children: [_jsx("a", { href: `/admin/mailboxes/${encodeURIComponent(mailboxUid)}`, className: "text-sm text-primary-dark hover:underline", children: "\u2190 Back to mailbox" }), _jsx("h1", { className: "text-xl font-bold uppercase tracking-wide mt-1", children: "Quarantine" })] }), error && _jsx(Alert, { children: error }), loading ? (_jsx("p", { className: "text-sm text-text-muted", children: "Loading\u2026" })) : entries.length === 0 ? (_jsx("p", { className: "text-sm text-text-muted", children: "Nothing quarantined for this mailbox." })) : (_jsx("div", { className: "overflow-x-auto", children: _jsxs("table", { className: "w-full text-sm border-collapse", children: [_jsx("thead", { children: _jsx("tr", { children: ["Reason", "Quarantined", "Status", ""].map((h) => (_jsx("th", { className: "text-left text-xs uppercase tracking-wide text-text-muted py-2 px-2.5 border-b border-border", children: h }, h))) }) }), _jsx("tbody", { children: entries.map((entry) => (_jsxs("tr", { children: [_jsx("td", { className: "py-2.5 px-2.5 border-b border-border", children: entry.reason }), _jsx("td", { className: "py-2.5 px-2.5 border-b border-border", children: new Date(entry.dateCreated).toLocaleString() }), _jsx("td", { className: "py-2.5 px-2.5 border-b border-border", children: entry.releasedAt ? (_jsx("span", { className: "text-xs font-bold uppercase tracking-wide py-0.5 px-2 rounded-pill bg-success text-white", children: "Released" })) : (_jsx("span", { className: "text-xs font-bold uppercase tracking-wide py-0.5 px-2 rounded-pill bg-surface-alt text-text-muted", children: "Held" })) }), _jsx("td", { className: "py-2.5 px-2.5 border-b border-border text-right", children: !entry.releasedAt && (_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", loading: releasing === entry.uid, disabled: releasing === entry.uid, onClick: () => handleRelease(entry), children: "Release" })) })] }, entry.uid))) })] }) })), _jsxs("div", { className: "flex gap-3 items-center mt-4", children: [_jsx(Button, { variant: "secondary", type: "button", className: "!w-auto", disabled: page === 0 || loading, onClick: () => setPage((p) => Math.max(0, p - 1)), children: "Previous" }), _jsxs("span", { className: "text-sm text-text-muted", children: ["Page ", page + 1] }), _jsx(Button, { variant: "secondary", type: "button", className: "!w-auto", disabled: !hasNextPage || loading, onClick: () => setPage((p) => p + 1), children: "Next" })] })] }));
+}

package/dist/apps/admin/transport-rules/[uid].js

@@ -0,0 +1,87 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+///////////////////////////////////////////////////////////////////////////////
+// Copyright (C) 2026 Jean-Philippe Steinmetz
+// SPDX-License-Identifier: MPL-2.0
+///////////////////////////////////////////////////////////////////////////////
+import { useEffect, useState } from "react";
+import { ApiRequestError } from "@rapidmx/react-shared/util/api.js";
+import { getTransportRule, updateTransportRule, } from "@rapidmx/react-shared/admin/transportRulesApi.js";
+import AdminShell from "../../shared/components/admin/layout/AdminShell.js";
+import RuleBuilder from "../../shared/components/rules/RuleBuilder.js";
+import { TRANSPORT_RULE_ACTION_TYPES, TRANSPORT_RULE_CONDITION_FIELDS } from "./_transportRuleConfig.js";
+import Alert from "@rapidmx/react-shared/components/feedback/Alert.js";
+import Button from "@rapidmx/react-shared/components/buttons/Button.js";
+import FormField from "@rapidmx/react-shared/components/forms/FormField.js";
+const INPUT_CLASS = "w-full text-sm py-2.5 px-3 border border-border rounded-sm bg-surface text-text focus:outline-none focus:border-primary";
+export default function TransportRuleDetailPage(props) {
+    return (_jsx(AdminShell, { ...props, active: "transportRules", children: _jsx(TransportRuleDetailContent, { uid: props.params.uid }) }));
+}
+function TransportRuleDetailContent({ uid }) {
+    const [original, setOriginal] = useState(null);
+    const [name, setName] = useState("");
+    const [rule, setRule] = useState(null);
+    const [loading, setLoading] = useState(true);
+    const [error, setError] = useState(null);
+    const [saving, setSaving] = useState(false);
+    const [saved, setSaved] = useState(false);
+    useEffect(() => {
+        setLoading(true);
+        setError(null);
+        getTransportRule(uid)
+            .then((loaded) => {
+            setOriginal(loaded);
+            if (loaded) {
+                setName(loaded.name);
+                setRule({
+                    enabled: loaded.enabled,
+                    sequence: loaded.sequence,
+                    stopProcessingRules: loaded.stopProcessingRules,
+                    conditions: loaded.conditions,
+                    actions: loaded.actions,
+                });
+            }
+        })
+            .catch((err) => setError(err instanceof ApiRequestError ? err.message : "Could not load this transport rule."))
+            .finally(() => setLoading(false));
+    }, [uid]);
+    // Only ever invoked from the form below, which itself only renders once `original`/`rule` are
+    // loaded (the early returns above cover every other state) — the non-null assertions reflect that
+    // real invariant, not an unchecked assumption. Matches `QuarantineContent.handleRelease`'s and
+    // `DomainDetailContent.handleVerify`'s identical pattern.
+    async function handleSubmit(e) {
+        e.preventDefault();
+        setError(null);
+        if (!name.trim()) {
+            setError("A name is required.");
+            return;
+        }
+        setSaving(true);
+        setSaved(false);
+        try {
+            const updated = await updateTransportRule({
+                uid: original.uid,
+                version: original.version,
+                name: name.trim(),
+                ...rule,
+            });
+            setOriginal(updated);
+            setSaved(true);
+        }
+        catch (err) {
+            setError(err instanceof ApiRequestError ? err.message : "Could not save this transport rule.");
+        }
+        finally {
+            setSaving(false);
+        }
+    }
+    if (loading) {
+        return _jsx("p", { className: "text-sm text-text-muted", children: "Loading\u2026" });
+    }
+    if (error && !original) {
+        return _jsx(Alert, { children: error });
+    }
+    if (!original || !rule) {
+        return _jsx(Alert, { children: "Transport rule not found." });
+    }
+    return (_jsxs("div", { className: "max-w-3xl", children: [_jsx("a", { href: "/admin/transport-rules", className: "text-sm text-primary-dark hover:underline", children: "\u2190 All transport rules" }), _jsx("h1", { className: "text-xl font-bold tracking-tight mt-1 mb-5", children: original.name }), error && _jsx(Alert, { children: error }), saved && !error && (_jsx("div", { className: "mb-4 text-sm text-success font-medium", children: "Saved." })), _jsxs("form", { onSubmit: handleSubmit, className: "flex flex-col gap-5", children: [_jsx("div", { className: "bg-surface border border-border rounded-md p-6", children: _jsx(FormField, { label: "Name", htmlFor: "name", children: _jsx("input", { id: "name", type: "text", className: INPUT_CLASS, value: name, onChange: (e) => setName(e.target.value) }) }) }), _jsx(RuleBuilder, { value: rule, onChange: setRule, conditionFields: TRANSPORT_RULE_CONDITION_FIELDS, actionTypes: TRANSPORT_RULE_ACTION_TYPES }), _jsx("div", { children: _jsx(Button, { type: "submit", loading: saving, disabled: saving, className: "!w-auto", children: "Save changes" }) })] })] }));
+}

package/dist/apps/admin/transport-rules/_transportRuleConfig.js

@@ -0,0 +1,37 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+const FIELD_INPUT_CLASS = "w-full text-sm py-2 px-3 border border-border rounded-sm bg-surface text-text focus:outline-none focus:border-primary";
+export const TRANSPORT_RULE_CONDITION_FIELDS = [
+    { key: "fromContains", label: "From contains", kind: "list" },
+    { key: "subjectContains", label: "Subject contains", kind: "list" },
+    { key: "bodyContains", label: "Body contains", kind: "list" },
+    { key: "recipientContains", label: "Any recipient contains", kind: "list" },
+    { key: "anyRecipientExternal", label: "Any recipient is external", kind: "boolean" },
+    { key: "hasAttachment", label: "Has an attachment", kind: "boolean" },
+    { key: "attachmentNameContains", label: "Attachment filename contains", kind: "list" },
+];
+export const TRANSPORT_RULE_ACTION_TYPES = [
+    {
+        value: "reject",
+        label: "Reject the message",
+        createDefault: () => ({ type: "reject" }),
+        render: () => null,
+    },
+    {
+        value: "quarantine",
+        label: "Quarantine every recipient's copy",
+        createDefault: () => ({ type: "quarantine" }),
+        render: () => null,
+    },
+    {
+        value: "add_header",
+        label: "Add a header",
+        createDefault: () => ({ type: "add_header", headerName: "", headerValue: "" }),
+        render: (action, onChange) => (_jsxs("div", { className: "flex gap-2", children: [_jsx("input", { type: "text", "aria-label": "Header name", className: FIELD_INPUT_CLASS, placeholder: "X-Compliance-Flag", value: action.headerName ?? "", onChange: (e) => onChange({ ...action, headerName: e.target.value }) }), _jsx("input", { type: "text", "aria-label": "Header value", className: FIELD_INPUT_CLASS, placeholder: "reviewed", value: action.headerValue ?? "", onChange: (e) => onChange({ ...action, headerValue: e.target.value }) })] })),
+    },
+    {
+        value: "add_recipient",
+        label: "Deliver an additional copy to",
+        createDefault: () => ({ type: "add_recipient", recipientAddress: "" }),
+        render: (action, onChange) => (_jsx("input", { type: "email", "aria-label": "Recipient address", className: FIELD_INPUT_CLASS, placeholder: "compliance@example.com", value: action.recipientAddress ?? "", onChange: (e) => onChange({ ...action, recipientAddress: e.target.value }) })),
+    },
+];

package/dist/apps/admin/transport-rules/index.js

@@ -0,0 +1,32 @@
+import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
+///////////////////////////////////////////////////////////////////////////////
+// Copyright (C) 2026 Jean-Philippe Steinmetz
+// SPDX-License-Identifier: MPL-2.0
+///////////////////////////////////////////////////////////////////////////////
+import { useEffect, useState } from "react";
+import { ApiRequestError } from "@rapidmx/react-shared/util/api.js";
+import { listTransportRules } from "@rapidmx/react-shared/admin/transportRulesApi.js";
+import AdminShell from "../../shared/components/admin/layout/AdminShell.js";
+import Alert from "@rapidmx/react-shared/components/feedback/Alert.js";
+import Button from "@rapidmx/react-shared/components/buttons/Button.js";
+const PAGE_SIZE = 25;
+export default function TransportRulesPage(props) {
+    return (_jsx(AdminShell, { ...props, active: "transportRules", children: _jsx(TransportRulesContent, {}) }));
+}
+function TransportRulesContent() {
+    const [page, setPage] = useState(0);
+    const [rules, setRules] = useState([]);
+    const [loading, setLoading] = useState(true);
+    const [error, setError] = useState(null);
+    useEffect(() => {
+        setLoading(true);
+        setError(null);
+        listTransportRules({ page, limit: PAGE_SIZE })
+            .then(setRules)
+            .catch((err) => setError(err instanceof ApiRequestError ? err.message : "Could not load transport rules."))
+            .finally(() => setLoading(false));
+    }, [page]);
+    const hasNextPage = rules.length === PAGE_SIZE;
+    const sorted = [...rules].sort((a, b) => a.sequence - b.sequence);
+    return (_jsxs(_Fragment, { children: [_jsxs("div", { className: "flex items-center justify-between mb-5", children: [_jsx("h1", { className: "text-xl font-bold uppercase tracking-wide", children: "Transport rules" }), _jsx("a", { href: "/admin/transport-rules/new", children: _jsx(Button, { type: "button", className: "!w-auto", children: "+ New transport rule" }) })] }), error && _jsx(Alert, { children: error }), loading ? (_jsx("p", { className: "text-sm text-text-muted", children: "Loading\u2026" })) : sorted.length === 0 ? (_jsx("p", { className: "text-sm text-text-muted", children: "No transport rules yet." })) : (_jsx("div", { className: "overflow-x-auto", children: _jsxs("table", { className: "w-full text-sm border-collapse", children: [_jsx("thead", { children: _jsx("tr", { children: ["Sequence", "Name", "Enabled", "Actions", ""].map((h) => (_jsx("th", { className: "text-left text-xs uppercase tracking-wide text-text-muted py-2 px-2.5 border-b border-border", children: h }, h))) }) }), _jsx("tbody", { children: sorted.map((rule) => (_jsxs("tr", { children: [_jsx("td", { className: "py-2.5 px-2.5 border-b border-border", children: rule.sequence }), _jsx("td", { className: "py-2.5 px-2.5 border-b border-border", children: rule.name }), _jsx("td", { className: "py-2.5 px-2.5 border-b border-border", children: rule.enabled ? "Yes" : "No" }), _jsx("td", { className: "py-2.5 px-2.5 border-b border-border", children: rule.actions.length }), _jsx("td", { className: "py-2.5 px-2.5 border-b border-border text-right", children: _jsx("a", { href: `/admin/transport-rules/${encodeURIComponent(rule.uid)}`, className: "text-primary-dark hover:underline font-medium", children: "View" }) })] }, rule.uid))) })] }) })), _jsxs("div", { className: "flex gap-3 items-center mt-4", children: [_jsx(Button, { variant: "secondary", type: "button", className: "!w-auto", disabled: page === 0 || loading, onClick: () => setPage((p) => Math.max(0, p - 1)), children: "Previous" }), _jsxs("span", { className: "text-sm text-text-muted", children: ["Page ", page + 1] }), _jsx(Button, { variant: "secondary", type: "button", className: "!w-auto", disabled: !hasNextPage || loading, onClick: () => setPage((p) => p + 1), children: "Next" })] })] }));
+}

package/dist/apps/admin/transport-rules/new/index.js

@@ -0,0 +1,50 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+///////////////////////////////////////////////////////////////////////////////
+// Copyright (C) 2026 Jean-Philippe Steinmetz
+// SPDX-License-Identifier: MPL-2.0
+///////////////////////////////////////////////////////////////////////////////
+import { useState } from "react";
+import { ApiRequestError } from "@rapidmx/react-shared/util/api.js";
+import { createTransportRule, } from "@rapidmx/react-shared/admin/transportRulesApi.js";
+import AdminShell from "../../../shared/components/admin/layout/AdminShell.js";
+import RuleBuilder from "../../../shared/components/rules/RuleBuilder.js";
+import { TRANSPORT_RULE_ACTION_TYPES, TRANSPORT_RULE_CONDITION_FIELDS } from "../_transportRuleConfig.js";
+import Alert from "@rapidmx/react-shared/components/feedback/Alert.js";
+import Button from "@rapidmx/react-shared/components/buttons/Button.js";
+import FormField from "@rapidmx/react-shared/components/forms/FormField.js";
+const INPUT_CLASS = "w-full text-sm py-2.5 px-3 border border-border rounded-sm bg-surface text-text focus:outline-none focus:border-primary";
+export default function NewTransportRulePage(props) {
+    return (_jsx(AdminShell, { ...props, active: "transportRules", children: _jsx(NewTransportRuleForm, {}) }));
+}
+function NewTransportRuleForm() {
+    const [name, setName] = useState("");
+    const [rule, setRule] = useState({
+        enabled: true,
+        sequence: 0,
+        stopProcessingRules: false,
+        conditions: {},
+        actions: [],
+    });
+    const [error, setError] = useState(null);
+    const [saving, setSaving] = useState(false);
+    async function handleSubmit(e) {
+        e.preventDefault();
+        setError(null);
+        if (!name.trim()) {
+            setError("A name is required.");
+            return;
+        }
+        setSaving(true);
+        try {
+            const created = await createTransportRule({ name: name.trim(), ...rule });
+            window.location.href = `/admin/transport-rules/${encodeURIComponent(created.uid)}`;
+        }
+        catch (err) {
+            setError(err instanceof ApiRequestError ? err.message : "Could not create the transport rule.");
+        }
+        finally {
+            setSaving(false);
+        }
+    }
+    return (_jsxs("div", { className: "max-w-3xl", children: [_jsx("h1", { className: "text-xl font-bold uppercase tracking-wide mb-1", children: "New transport rule" }), _jsx("p", { className: "text-sm text-text-muted mb-5", children: "Evaluated once per SMTP transaction, before any message is resolved to an individual mailbox." }), error && _jsx(Alert, { children: error }), _jsxs("form", { onSubmit: handleSubmit, className: "flex flex-col gap-5", children: [_jsx("div", { className: "bg-surface border border-border rounded-md p-6", children: _jsx(FormField, { label: "Name", htmlFor: "name", children: _jsx("input", { id: "name", type: "text", className: INPUT_CLASS, value: name, onChange: (e) => setName(e.target.value), placeholder: "Flag external senders" }) }) }), _jsx(RuleBuilder, { value: rule, onChange: setRule, conditionFields: TRANSPORT_RULE_CONDITION_FIELDS, actionTypes: TRANSPORT_RULE_ACTION_TYPES }), _jsxs("div", { className: "flex gap-3", children: [_jsx(Button, { type: "submit", loading: saving, disabled: saving, className: "!w-auto", children: "Create transport rule" }), _jsx("a", { href: "/admin/transport-rules", children: _jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", children: "Cancel" }) })] })] })] }));
+}

package/dist/apps/shared/components/admin/distributionLists/MemberListCard.js

@@ -0,0 +1,64 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+///////////////////////////////////////////////////////////////////////////////
+// Copyright (C) 2026 Jean-Philippe Steinmetz
+// SPDX-License-Identifier: MPL-2.0
+///////////////////////////////////////////////////////////////////////////////
+import { useState } from "react";
+import { ApiRequestError } from "@rapidmx/react-shared/util/api.js";
+import { updateDistributionList } from "@rapidmx/react-shared/admin/distributionListsApi.js";
+import Alert from "@rapidmx/react-shared/components/feedback/Alert.js";
+import Button from "@rapidmx/react-shared/components/buttons/Button.js";
+/**
+ * Lets an admin view and edit a distribution list's members — same load/inline-add-row/per-row-remove
+ * interaction shape as `ShareAccessCard`, but against a plain `memberAddresses: string[]` field on the
+ * `DistributionList` itself via read-modify-write `PUT`, not a separate ACL endpoint (a distribution
+ * list has no per-record ACL to speak of — see `BaseDistributionListRoute`'s own doc comment).
+ */
+export default function MemberListCard({ list, onUpdate }) {
+    const [newAddress, setNewAddress] = useState("");
+    const [saving, setSaving] = useState(false);
+    const [error, setError] = useState(null);
+    async function handleAdd(e) {
+        e.preventDefault();
+        const address = newAddress.trim();
+        if (!address || list.memberAddresses.includes(address)) {
+            return;
+        }
+        setSaving(true);
+        setError(null);
+        try {
+            const updated = await updateDistributionList({
+                uid: list.uid,
+                version: list.version,
+                memberAddresses: [...list.memberAddresses, address],
+            });
+            setNewAddress("");
+            onUpdate(updated);
+        }
+        catch (err) {
+            setError(err instanceof ApiRequestError ? err.message : "Could not add this member.");
+        }
+        finally {
+            setSaving(false);
+        }
+    }
+    async function handleRemove(address) {
+        setSaving(true);
+        setError(null);
+        try {
+            const updated = await updateDistributionList({
+                uid: list.uid,
+                version: list.version,
+                memberAddresses: list.memberAddresses.filter((a) => a !== address),
+            });
+            onUpdate(updated);
+        }
+        catch (err) {
+            setError(err instanceof ApiRequestError ? err.message : "Could not remove this member.");
+        }
+        finally {
+            setSaving(false);
+        }
+    }
+    return (_jsxs("div", { className: "bg-surface border border-border rounded-md p-6", children: [_jsx("h2", { className: "text-base font-bold uppercase tracking-wide mb-1", children: "Members" }), _jsx("p", { className: "text-sm text-text-muted mb-4", children: "Each address may resolve to an internal mailbox, a nested distribution list, or a genuinely external address relayed out." }), error && _jsx(Alert, { children: error }), _jsxs("ul", { className: "flex flex-col gap-2 mb-4", children: [list.memberAddresses.length === 0 && (_jsx("li", { className: "text-sm text-text-muted", children: "No members yet." })), list.memberAddresses.map((address) => (_jsxs("li", { className: "flex items-center justify-between gap-3 py-2 px-3 border border-border rounded-sm", children: [_jsx("div", { className: "text-sm font-medium", children: address }), _jsx("button", { type: "button", onClick: () => handleRemove(address), disabled: saving, className: "text-sm text-danger hover:underline disabled:opacity-55", children: "Remove" })] }, address)))] }), _jsxs("form", { onSubmit: handleAdd, className: "flex gap-2", children: [_jsx("input", { type: "text", value: newAddress, onChange: (e) => setNewAddress(e.target.value), placeholder: "Member address to add", className: "flex-1 text-sm py-2 px-3 border border-border rounded-sm bg-surface text-text focus:outline-none focus:border-primary" }), _jsx(Button, { type: "submit", loading: saving, disabled: saving, className: "!w-auto", children: "Add" })] })] }));
+}

package/dist/apps/shared/components/admin/layout/AdminShell.js

@@ -0,0 +1,94 @@
+import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
+///////////////////////////////////////////////////////////////////////////////
+// Copyright (C) 2026 Jean-Philippe Steinmetz
+// SPDX-License-Identifier: MPL-2.0
+///////////////////////////////////////////////////////////////////////////////
+import "../../../styles/app.css";
+import { useEffect, useState } from "react";
+import { HiOutlineClipboardDocumentList, HiOutlineGlobeAlt, HiOutlineInboxStack, HiOutlinePaintBrush, HiOutlineQueueList, HiOutlineShieldCheck, HiOutlineShieldExclamation, HiOutlineUserGroup, } from "react-icons/hi2";
+import { apiFetch, ApiRequestError } from "@rapidmx/react-shared/util/api.js";
+import { useRedirectIfUnauthenticated } from "@rapidmx/react-shared/auth/session.js";
+import useBranding from "@rapidmx/react-shared/branding/useBranding.js";
+import Alert from "@rapidmx/react-shared/components/feedback/Alert.js";
+import BottomTabBar from "@rapidmx/react-shared/components/navigation/BottomTabBar.js";
+import { BrandingFooter, BrandingHeader } from "../../layout/BrandingChrome.js";
+import UserMenu from "../../layout/UserMenu.js";
+/** Sections shown in the persistent icon rail / mobile tab bar — every admin area reachable from
+ * anywhere in the console. Deliberately excludes `quarantine`/`ingestQueue`: those are scoped to a
+ * single mailbox and only ever reached via links on that mailbox's own detail page (see
+ * `apps/admin/mailboxes/[uid].tsx`), not global navigation destinations. */
+const NAV_ITEMS = [
+    { id: "mailboxes", href: "/admin", label: "Mailboxes", icon: HiOutlineInboxStack },
+    { id: "domains", href: "/admin/domains", label: "Domains", icon: HiOutlineGlobeAlt },
+    { id: "auditLog", href: "/admin/audit-log", label: "Audit Log", icon: HiOutlineClipboardDocumentList },
+    {
+        id: "distributionLists",
+        href: "/admin/distribution-lists",
+        label: "Distribution Lists",
+        icon: HiOutlineUserGroup,
+    },
+    {
+        id: "transportRules",
+        href: "/admin/transport-rules",
+        label: "Transport Rules",
+        icon: HiOutlineShieldCheck,
+    },
+    { id: "branding", href: "/admin/branding", label: "Branding", icon: HiOutlinePaintBrush },
+];
+/** Mailbox-scoped sections — not part of the global nav rail/tab bar (see `NAV_ITEMS` above), but
+ * still need an entry here so the header can resolve a label for them when they're the active page. */
+const MAILBOX_SCOPED_ITEMS = [
+    { id: "quarantine", href: "/admin/quarantine", label: "Quarantine", icon: HiOutlineShieldExclamation },
+    { id: "ingestQueue", href: "/admin/ingest-queue", label: "Ingest Queue", icon: HiOutlineQueueList },
+];
+const ALL_ITEMS = [...NAV_ITEMS, ...MAILBOX_SCOPED_ITEMS];
+/**
+ * Gates every `apps/admin` page behind the `admin` trusted role. Uses `GET /api/admin/release-notes` (any
+ * `BaseAdminRoute` endpoint works — this one is side-effect-free) purely as a canary: a 200 means the
+ * caller's JWT carries a trusted role, a 403 means it doesn't. There is no local step-up/elevation flow
+ * (that would need a cross-origin call to auth-server's own elevation endpoint — not wired up yet).
+ */
+export default function AdminShell({ active, userUid, authServerUrl, children }) {
+    const [status, setStatus] = useState("checking");
+    const [error, setError] = useState(null);
+    const { branding, iconSrc } = useBranding();
+    useRedirectIfUnauthenticated(userUid, authServerUrl);
+    useEffect(() => {
+        if (!userUid) {
+            return;
+        }
+        apiFetch("/admin/release-notes")
+            .then(() => setStatus("authorized"))
+            .catch((err) => {
+            if (err instanceof ApiRequestError && (err.status === 403 || err.status === 401)) {
+                setStatus("denied");
+                return;
+            }
+            setError(err instanceof ApiRequestError ? err.message : "Could not verify administrator access.");
+            setStatus("error");
+        });
+    }, [userUid]);
+    function handleSignOut() {
+        window.location.href = authServerUrl ?? "/";
+    }
+    let content;
+    if (!userUid || status === "checking") {
+        content = _jsx("div", { className: "min-h-screen" });
+    }
+    else if (status === "denied") {
+        content = (_jsx("div", { className: "min-h-screen flex items-center justify-center p-8", children: _jsx("div", { className: "w-full max-w-md", children: _jsx(Alert, { children: "You do not have administrator access." }) }) }));
+    }
+    else if (status === "error") {
+        content = (_jsx("div", { className: "min-h-screen flex items-center justify-center p-8", children: _jsx("div", { className: "w-full max-w-md", children: _jsx(Alert, { children: error }) }) }));
+    }
+    else {
+        const activeItem = ALL_ITEMS.find((item) => item.id === active);
+        content = (_jsx("div", { className: "min-h-screen flex flex-col bg-surface-alt", children: _jsxs("div", { className: "flex-1 flex min-h-0", children: [_jsxs("nav", { "aria-label": "Admin sections", className: "hidden md:flex w-16 shrink-0 bg-surface border-r border-border flex-col items-center py-3 gap-1", children: [_jsx("img", { src: iconSrc, width: "96", height: "96", alt: "", className: "mb-3" }), NAV_ITEMS.map(({ id, href, label, icon: Icon }) => (_jsx("a", { href: href, "aria-label": label, "aria-current": id === active ? "page" : undefined, title: label, className: [
+                                    "w-10 h-10 flex items-center justify-center rounded-sm",
+                                    id === active
+                                        ? "bg-primary/10 text-primary-dark"
+                                        : "text-text-muted hover:bg-surface-alt hover:text-text",
+                                ].join(" "), children: _jsx(Icon, { size: 20, "aria-hidden": "true" }) }, id)))] }), _jsx(BottomTabBar, { apps: NAV_ITEMS, active: active }), _jsxs("div", { className: "flex-1 flex flex-col min-w-0", children: [_jsxs("header", { className: "h-16 shrink-0 bg-surface border-b border-border flex items-center justify-between gap-4 px-6", children: [_jsx("span", { className: "font-display font-bold text-lg uppercase tracking-wide", children: activeItem?.label }), _jsx(UserMenu, { userUid: userUid, authServerUrl: authServerUrl, onSignOut: handleSignOut })] }), _jsx("div", { className: "flex-1 pb-14 md:pb-0", children: _jsx("main", { className: "max-w-6xl mx-auto px-6 py-8", children: children }) })] })] }) }));
+    }
+    return (_jsxs(_Fragment, { children: [_jsx(BrandingHeader, { branding: branding }), content, _jsx(BrandingFooter, { branding: branding })] }));
+}