@rapidmx/web-client 0.37.0 → 0.38.1

package/dist/apps/admin/integrations/dns-providers/index.js

@@ -0,0 +1,68 @@
+import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
+///////////////////////////////////////////////////////////////////////////////
+// Copyright (C) 2026 Jean-Philippe Steinmetz
+// SPDX-License-Identifier: MPL-2.0
+///////////////////////////////////////////////////////////////////////////////
+import { useEffect, useState } from "react";
+import { getDnsControllerState, listDnsProviders, listDnsProviderTypes, } from "../../../../lib/admin/dnsProvidersApi.js";
+import Button from "../../../../lib/components/buttons/Button.js";
+import { ApiRequestError } from "../../../../lib/util/api.js";
+import AdminShell from "../../../shared/components/admin/layout/AdminShell.js";
+import IntegrationsLayout from "../../../shared/components/admin/integrations/IntegrationsLayout.js";
+import { Badge, dnsProviderStatus, formatTime, isStaleReport } from "../../../shared/components/admin/integrations/dnsProviderParts.js";
+import Alert from "../../../shared/components/admin/ActionAlert.js";
+import { actionErrorMessage } from "../../../shared/components/admin/elevation.js";
+export default function DnsProvidersPage(props) {
+    return (_jsx(AdminShell, { ...props, active: "integrations", children: _jsx(IntegrationsLayout, { active: "dnsProviders", children: _jsx(DnsProvidersList, {}) }) }));
+}
+/** What the DNS controller last said about itself, in a sentence: whether it works with this server, and when it last reported (a warning when that
+ * was too long ago: it may be down). */
+function ControllerNotice({ state }) {
+    const { handshake, lastReport } = state;
+    if (handshake && !handshake.compatible) {
+        return (_jsx(Alert, { children: `DNS controller ${handshake.controllerVersion} can't work with this server (${handshake.reason}). Nothing is published until matching versions are installed.` }));
+    }
+    // The last time it was heard from at all: a handshake after a report (a restart of either side) shows it alive.
+    const heard = [lastReport?.at, handshake?.at].reduce((latest, at) => (at && (!latest || Date.parse(at) > Date.parse(latest)) ? at : latest), undefined);
+    if (heard && isStaleReport(heard)) {
+        return (_jsx(Alert, { children: `The DNS controller hasn't been heard from since ${formatTime(heard)}; it may be down. Nothing is published or removed until it is back.` }));
+    }
+    let text;
+    if (lastReport) {
+        text = `DNS controller ${lastReport.controllerVersion}, last report ${formatTime(lastReport.at)}.`;
+    }
+    else if (handshake) {
+        text = `DNS controller ${handshake.controllerVersion} has connected and not reported yet.`;
+    }
+    else {
+        text = "The DNS controller hasn’t contacted this server yet, so nothing is published automatically.";
+    }
+    return _jsx("p", { className: "text-sm text-text-muted mb-4", children: text });
+}
+function DnsProvidersList() {
+    const [providers, setProviders] = useState(null);
+    const [types, setTypes] = useState([]);
+    const [controller, setController] = useState(null);
+    const [error, setError] = useState(null);
+    useEffect(() => {
+        Promise.all([listDnsProviders(), listDnsProviderTypes()])
+            .then(([loaded, loadedTypes]) => {
+            setProviders(loaded);
+            setTypes(loadedTypes);
+        })
+            .catch((err) => setError(
+        // A server from before DNS publishing has no such route.
+        err instanceof ApiRequestError && err.status === 404
+            ? "This server doesn't offer DNS providers yet. Upgrade it to manage them here."
+            : actionErrorMessage(err, "Could not load the DNS providers.")));
+        // The list stands without it: a server that can't say what the controller reported shows nothing about it.
+        getDnsControllerState()
+            .then(setController)
+            .catch(() => setController(null));
+    }, []);
+    return (_jsxs(_Fragment, { children: [_jsxs("div", { className: "flex items-center justify-between mb-3", children: [_jsx("h2", { className: "text-lg font-bold uppercase tracking-wide", children: "DNS providers" }), _jsx("a", { href: "/admin/integrations/dns-providers/new", children: _jsx(Button, { type: "button", className: "!w-auto", children: "+ New DNS provider" }) })] }), _jsx("p", { className: "text-sm text-text-muted mb-4 max-w-2xl", children: "The DNS hosting accounts this server publishes DNS records through: each domain\u2019s, and the server\u2019s own host names. A domain is assigned to one on its own page." }), controller && _jsx(ControllerNotice, { state: controller }), error && _jsx(Alert, { children: error }), !providers ? (!error && _jsx("p", { className: "text-sm text-text-muted", children: "Loading\u2026" })) : providers.length === 0 ? (_jsx("p", { className: "text-sm text-text-muted", children: "No DNS providers yet. Until one is added, every domain\u2019s records are published by hand, from the checklist on its page." })) : (_jsx("div", { className: "overflow-x-auto", children: _jsxs("table", { className: "w-full text-sm border-collapse", children: [_jsx("thead", { children: _jsx("tr", { children: ["Name", "Type", "Zones", "Status", "Domains", ""].map((h) => (_jsx("th", { className: "text-left text-xs uppercase tracking-wide text-text-muted py-2 px-2.5 border-b border-border", children: h }, h))) }) }), _jsx("tbody", { children: providers.map((provider) => {
+                                const spec = types.find((candidate) => candidate.type === provider.type);
+                                const status = dnsProviderStatus(provider);
+                                return (_jsxs("tr", { children: [_jsxs("td", { className: "py-2.5 px-2.5 border-b border-border", children: [provider.name, provider.origin === "installer" && _jsx(Badge, { children: "Added by the installer" })] }), _jsxs("td", { className: "py-2.5 px-2.5 border-b border-border", children: [spec?.label ?? provider.type, spec && !spec.tested && _jsx(Badge, { children: "Not yet live-tested" })] }), _jsx("td", { className: "py-2.5 px-2.5 border-b border-border", children: provider.zones.join(", ") }), _jsxs("td", { className: "py-2.5 px-2.5 border-b border-border", children: [status.label, status.error && _jsx("span", { className: "block text-xs text-danger", children: status.error })] }), _jsx("td", { className: "py-2.5 px-2.5 border-b border-border", children: provider.domainCount }), _jsx("td", { className: "py-2.5 px-2.5 border-b border-border text-right", children: _jsx("a", { href: `/admin/integrations/dns-providers/${encodeURIComponent(provider.uid)}`, className: "text-primary-dark hover:underline font-medium", children: "View" }) })] }, provider.uid));
+                            }) })] }) }))] }));
+}

package/dist/apps/admin/integrations/dns-providers/new/index.d.ts

@@ -0,0 +1,3 @@
+import React from "react";
+import { AdminShellProps } from "../../../../shared/components/admin/layout/AdminShell.js";
+export default function NewDnsProviderPage(props: Omit<AdminShellProps, "active">): React.JSX.Element;

package/dist/apps/admin/integrations/dns-providers/new/index.js

@@ -0,0 +1,31 @@
+import { jsx as _jsx, Fragment as _Fragment, jsxs as _jsxs } from "react/jsx-runtime";
+///////////////////////////////////////////////////////////////////////////////
+// Copyright (C) 2026 Jean-Philippe Steinmetz
+// SPDX-License-Identifier: MPL-2.0
+///////////////////////////////////////////////////////////////////////////////
+import { useEffect, useState } from "react";
+import { useRouter } from "@rapidrest/react/client";
+import { createDnsProvider, listDnsProviderTypes } from "../../../../../lib/admin/dnsProvidersApi.js";
+import AdminShell from "../../../../shared/components/admin/layout/AdminShell.js";
+import DnsProviderForm from "../../../../shared/components/admin/integrations/DnsProviderForm.js";
+import IntegrationsLayout from "../../../../shared/components/admin/integrations/IntegrationsLayout.js";
+import Alert from "../../../../shared/components/admin/ActionAlert.js";
+import { actionErrorMessage } from "../../../../shared/components/admin/elevation.js";
+export default function NewDnsProviderPage(props) {
+    return (_jsx(AdminShell, { ...props, active: "integrations", children: _jsx(IntegrationsLayout, { active: "dnsProviders", children: _jsx(NewDnsProviderContent, {}) }) }));
+}
+function NewDnsProviderContent() {
+    const { navigate } = useRouter();
+    const [types, setTypes] = useState(null);
+    const [error, setError] = useState(null);
+    useEffect(() => {
+        listDnsProviderTypes()
+            .then(setTypes)
+            .catch((err) => setError(actionErrorMessage(err, "Could not load the DNS provider types.")));
+    }, []);
+    async function handleSave(input) {
+        const created = await createDnsProvider(input);
+        void navigate(`/admin/integrations/dns-providers/${encodeURIComponent(created.uid)}`);
+    }
+    return (_jsxs(_Fragment, { children: [_jsx("h2", { className: "text-lg font-bold uppercase tracking-wide mb-1", children: "New DNS provider" }), _jsx("p", { className: "text-sm text-text-muted mb-5 max-w-2xl", children: "A DNS hosting account this server can publish records through. Prefer credentials scoped to these zones alone." }), error ? (_jsx(Alert, { children: error })) : !types ? (_jsx("p", { className: "text-sm text-text-muted", children: "Loading\u2026" })) : (_jsx(DnsProviderForm, { types: types, submitLabel: "Create DNS provider", onSave: handleSave }))] }));
+}

package/dist/apps/admin/integrations/dns-resolver/index.d.ts

@@ -0,0 +1,3 @@
+import React from "react";
+import { AdminShellProps } from "../../../shared/components/admin/layout/AdminShell.js";
+export default function DnsResolverPage(props: Omit<AdminShellProps, "active">): React.JSX.Element;

package/dist/apps/admin/integrations/dns-resolver/index.js

@@ -0,0 +1,6 @@
+import { jsx as _jsx } from "react/jsx-runtime";
+import DnsResolverForm from "../../../shared/components/admin/integrations/DnsResolverForm.js";
+import IntegrationSectionPage from "../../../shared/components/admin/integrations/IntegrationSectionPage.js";
+export default function DnsResolverPage(props) {
+    return (_jsx(IntegrationSectionPage, { ...props, area: "dnsResolver", children: (settings, onChange) => _jsx(DnsResolverForm, { settings: settings, onChange: onChange }) }));
+}

package/dist/apps/admin/integrations/giphy/index.d.ts

@@ -0,0 +1,3 @@
+import React from "react";
+import { AdminShellProps } from "../../../shared/components/admin/layout/AdminShell.js";
+export default function GiphyPage(props: Omit<AdminShellProps, "active">): React.JSX.Element;

package/dist/apps/admin/integrations/giphy/index.js

@@ -0,0 +1,6 @@
+import { jsx as _jsx } from "react/jsx-runtime";
+import GiphyForm from "../../../shared/components/admin/integrations/GiphyForm.js";
+import IntegrationSectionPage from "../../../shared/components/admin/integrations/IntegrationSectionPage.js";
+export default function GiphyPage(props) {
+    return (_jsx(IntegrationSectionPage, { ...props, area: "giphy", children: (settings, onChange) => _jsx(GiphyForm, { settings: settings, onChange: onChange }) }));
+}

package/dist/apps/admin/integrations/index.d.ts

@@ -0,0 +1,4 @@
+import React from "react";
+import { AdminShellProps } from "../../shared/components/admin/layout/AdminShell.js";
+/** The Integrations overview: each third-party service this deployment can use, with what it is for. */
+export default function IntegrationsPage(props: Omit<AdminShellProps, "active">): React.JSX.Element;

package/dist/apps/admin/integrations/index.js

@@ -0,0 +1,7 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import AdminShell from "../../shared/components/admin/layout/AdminShell.js";
+import IntegrationsLayout, { INTEGRATION_AREAS } from "../../shared/components/admin/integrations/IntegrationsLayout.js";
+/** The Integrations overview: each third-party service this deployment can use, with what it is for. */
+export default function IntegrationsPage(props) {
+    return (_jsx(AdminShell, { ...props, active: "integrations", children: _jsxs(IntegrationsLayout, { children: [_jsx("p", { className: "text-sm text-text-muted mb-5 max-w-2xl", children: "The services this server works with. A setting saved here takes effect at once and overrides the deployment\u2019s configuration until it is reset." }), _jsx("ul", { "aria-label": "Integration areas", className: "grid gap-3 sm:grid-cols-2", children: INTEGRATION_AREAS.map((area) => (_jsx("li", { children: _jsxs("a", { href: area.href, className: "block h-full border border-border rounded-sm bg-surface p-4 hover:border-primary", children: [_jsx("span", { className: "block font-semibold text-primary-dark", children: area.label }), _jsx("span", { className: "block text-sm text-text-muted mt-1", children: area.description })] }) }, area.id))) })] }) }));
+}

package/dist/apps/admin/integrations/plugin-registry/index.d.ts

@@ -0,0 +1,3 @@
+import React from "react";
+import { AdminShellProps } from "../../../shared/components/admin/layout/AdminShell.js";
+export default function PluginRegistryPage(props: Omit<AdminShellProps, "active">): React.JSX.Element;

package/dist/apps/admin/integrations/plugin-registry/index.js

@@ -0,0 +1,6 @@
+import { jsx as _jsx } from "react/jsx-runtime";
+import PluginRegistryForm from "../../../shared/components/admin/integrations/PluginRegistryForm.js";
+import IntegrationSectionPage from "../../../shared/components/admin/integrations/IntegrationSectionPage.js";
+export default function PluginRegistryPage(props) {
+    return (_jsx(IntegrationSectionPage, { ...props, area: "pluginRegistry", children: (settings, onChange) => _jsx(PluginRegistryForm, { settings: settings, onChange: onChange }) }));
+}

package/dist/apps/admin/integrations/signing-ca/index.d.ts

@@ -0,0 +1,3 @@
+import React from "react";
+import { AdminShellProps } from "../../../shared/components/admin/layout/AdminShell.js";
+export default function SigningCaPage(props: Omit<AdminShellProps, "active">): React.JSX.Element;

package/dist/apps/admin/integrations/signing-ca/index.js

@@ -0,0 +1,6 @@
+import { jsx as _jsx } from "react/jsx-runtime";
+import SigningCaForm from "../../../shared/components/admin/integrations/SigningCaForm.js";
+import IntegrationSectionPage from "../../../shared/components/admin/integrations/IntegrationSectionPage.js";
+export default function SigningCaPage(props) {
+    return (_jsx(IntegrationSectionPage, { ...props, area: "signingCa", children: (settings, onChange) => _jsx(SigningCaForm, { settings: settings, onChange: onChange }) }));
+}

package/dist/apps/admin/integrations/stun/index.d.ts

@@ -0,0 +1,3 @@
+import React from "react";
+import { AdminShellProps } from "../../../shared/components/admin/layout/AdminShell.js";
+export default function StunPage(props: Omit<AdminShellProps, "active">): React.JSX.Element;

package/dist/apps/admin/integrations/stun/index.js

@@ -0,0 +1,6 @@
+import { jsx as _jsx } from "react/jsx-runtime";
+import StunForm from "../../../shared/components/admin/integrations/StunForm.js";
+import IntegrationSectionPage from "../../../shared/components/admin/integrations/IntegrationSectionPage.js";
+export default function StunPage(props) {
+    return (_jsx(IntegrationSectionPage, { ...props, area: "stun", children: (settings, onChange) => _jsx(StunForm, { settings: settings, onChange: onChange }) }));
+}

package/dist/apps/shared/components/admin/configEncryption/ConfigKeysManager.d.ts

@@ -0,0 +1,9 @@
+import React from "react";
+/** How often the progress of a rotation in progress is read again. The server's job looks at a rotation every 30 seconds, and the copies report every 30. */
+export declare const POLL_MS = 10000;
+/**
+ * The configuration keyring's console (spec 5.5, 10.5, 14): the keys with their age and how many saved values each encrypts, "Rotate configuration key" and
+ * "Key compromised", a rotation's progress with the server copies it waits for, the warning once the wait has gone on too long and "Activate anyway", the plugin
+ * secret settings' encryption, and the reminders to back up the keyring and, after a compromise, to replace the credentials at their providers.
+ */
+export default function ConfigKeysManager(): React.JSX.Element;

package/dist/apps/shared/components/admin/configEncryption/ConfigKeysManager.js

@@ -0,0 +1,187 @@
+import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
+///////////////////////////////////////////////////////////////////////////////
+// Copyright (C) 2026 Jean-Philippe Steinmetz
+// SPDX-License-Identifier: MPL-2.0
+///////////////////////////////////////////////////////////////////////////////
+import { useEffect, useRef, useState } from "react";
+import { activateConfigKey, configKeysOfRefusal, getConfigKeys, rotateConfigKey, } from "../../../../../lib/admin/configKeysApi.js";
+import Button from "../../../../../lib/components/buttons/Button.js";
+import Modal from "../../../../../lib/components/overlays/Modal.js";
+import { ApiRequestError } from "../../../../../lib/util/api.js";
+import Alert from "../ActionAlert.js";
+import { actionErrorMessage } from "../elevation.js";
+import { Badge, formatTime } from "../integrations/dnsProviderParts.js";
+import { activeKidOf, ageText, isRunning } from "./keyringParts.js";
+/** How often the progress of a rotation in progress is read again. The server's job looks at a rotation every 30 seconds, and the copies report every 30. */
+export const POLL_MS = 10000;
+function copiesText(count) {
+    return count === 1 ? "1 copy" : `${count} copies`;
+}
+/** The server copies a rotation is waiting for, one per line. */
+function CopyList({ label, copies }) {
+    return (_jsx("ul", { "aria-label": label, className: "list-disc pl-5 text-sm mb-3", children: copies.map((copy) => (_jsx("li", { children: _jsx("code", { className: "text-xs", children: copy }) }, copy))) }));
+}
+function Note({ children }) {
+    return (_jsx("div", { role: "note", className: "text-sm rounded-sm py-3 px-3.5 mb-3 bg-warning text-warning-contrast", children: children }));
+}
+function Card({ title, children }) {
+    return (_jsxs("div", { className: "bg-surface border border-border rounded-md p-6 mb-5", children: [_jsx("h2", { className: "text-sm font-bold uppercase tracking-wide mb-3", children: title }), children] }));
+}
+/**
+ * The configuration keyring's console (spec 5.5, 10.5, 14): the keys with their age and how many saved values each encrypts, "Rotate configuration key" and
+ * "Key compromised", a rotation's progress with the server copies it waits for, the warning once the wait has gone on too long and "Activate anyway", the plugin
+ * secret settings' encryption, and the reminders to back up the keyring and, after a compromise, to replace the credentials at their providers.
+ */
+export default function ConfigKeysManager() {
+    const [keys, setKeys] = useState(null);
+    // `true` where the server has no key route (an older server).
+    const [missing, setMissing] = useState(false);
+    const [loadError, setLoadError] = useState(null);
+    // The failure of a read after the first, which leaves what is shown as it was.
+    const [refreshError, setRefreshError] = useState(null);
+    // The copies that were waiting when "Activate anyway" was opened: the dialog names what the administrator was shown, not what a later read says.
+    const [staleCopies, setStaleCopies] = useState([]);
+    const [busy, setBusy] = useState(false);
+    const [error, setError] = useState(null);
+    // What the server's refusal of a stale request taught: the progress shown is the rotation's, not the one the administrator expected.
+    const [notice, setNotice] = useState(null);
+    const [confirming, setConfirming] = useState(null);
+    // Counts every finished read, so a failed poll is tried again too.
+    const [reads, setReads] = useState(0);
+    const latest = useRef(0);
+    // Whether a read has been answered: a missing route then means an older pod answered, not that the server has none.
+    const loaded = useRef(false);
+    // Reads the keyring's state; an answer to an older request is dropped. The failure of the first read replaces the page; a later one is noted above it.
+    function load() {
+        const id = ++latest.current;
+        return getConfigKeys()
+            .then((answer) => {
+            if (id === latest.current) {
+                loaded.current = true;
+                setKeys(answer);
+                setLoadError(null);
+                setRefreshError(null);
+            }
+        }, (err) => {
+            if (id !== latest.current) {
+                return;
+            }
+            if (loaded.current) {
+                setRefreshError(actionErrorMessage(err, "The server did not answer."));
+            }
+            else if (err instanceof ApiRequestError && err.status === 404) {
+                setMissing(true);
+            }
+            else {
+                setLoadError(actionErrorMessage(err, "Could not load the configuration keys."));
+            }
+        })
+            .then(() => setReads((count) => count + 1));
+    }
+    useEffect(() => {
+        void load();
+        // A read still on its way when the page is left must not set state.
+        return () => void latest.current++;
+    }, []);
+    const rotation = keys?.rotation;
+    const running = isRunning(rotation);
+    // While a rotation runs the copies and the server's job move it along, so the page follows.
+    useEffect(() => {
+        if (!running) {
+            return;
+        }
+        const timer = setTimeout(() => void load(), POLL_MS);
+        return () => clearTimeout(timer);
+    }, [running, reads]);
+    if (missing) {
+        return (_jsx("p", { className: "text-sm text-text-muted", children: "This server doesn\u2019t offer configuration encryption yet. Upgrade it to manage its keys here." }));
+    }
+    if (!keys) {
+        return loadError ? (_jsxs(_Fragment, { children: [_jsx(Alert, { children: loadError }), _jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", onClick: () => void load(), children: "Try again" })] })) : (_jsx("p", { className: "text-sm text-text-muted", children: "Loading\u2026" }));
+    }
+    async function run(action, fallback, refused) {
+        setBusy(true);
+        setError(null);
+        setNotice(null);
+        try {
+            const answer = await action();
+            // Drops a read that was on its way before this change.
+            latest.current++;
+            loaded.current = true;
+            setKeys(answer);
+            setRefreshError(null);
+            setConfirming(null);
+        }
+        catch (err) {
+            // A 409 carries the rotation as it is: the request was for a state it is no longer in.
+            const current = configKeysOfRefusal(err);
+            if (current) {
+                latest.current++;
+                loaded.current = true;
+                setKeys(current);
+                setRefreshError(null);
+                setConfirming(null);
+                setNotice(refused);
+            }
+            else {
+                setError(actionErrorMessage(err, fallback));
+            }
+        }
+        finally {
+            setBusy(false);
+        }
+    }
+    // The refusal a dialog shows belongs to it, so it goes with it rather than moving to the card.
+    function closeDialog() {
+        if (!busy) {
+            setConfirming(null);
+            setError(null);
+        }
+    }
+    function openDialog(which) {
+        setError(null);
+        setStaleCopies(waiting);
+        setConfirming(which);
+    }
+    const now = Date.now();
+    const newKid = rotation?.kid;
+    const waiting = rotation?.waitingFor ?? [];
+    const counted = keys.keys.some((key) => key.envelopes !== undefined);
+    const earlier = keys.keys.filter((key) => key.kid !== newKid).reduce((sum, key) => sum + (key.envelopes ?? 0), 0);
+    const onNew = keys.keys.filter((key) => key.kid === newKid).reduce((sum, key) => sum + (key.envelopes ?? 0), 0);
+    const unreadable = keys.reencryption?.unreadable ?? [];
+    const activeKid = activeKidOf(keys);
+    // A compromised rotation that failed: starting again from the plain button would drop the compromise.
+    const failedCompromised = rotation?.phase === "failed" && rotation.compromised;
+    let step;
+    switch (rotation?.phase) {
+        case "adding":
+            step = _jsx("p", { className: "text-sm mb-3", children: "Adding the new key to the keyring." });
+            break;
+        case "activating":
+            step =
+                waiting.length > 0 ? (_jsxs(_Fragment, { children: [_jsx("p", { className: "text-sm mb-2", children: `Waiting for ${copiesText(waiting.length)} to load the new key` }), _jsx(CopyList, { label: "Copies that haven't loaded the new key", copies: waiting }), _jsx("p", { className: "text-sm text-text-muted mb-3", children: "Nothing breaks while it waits: the current key keeps encrypting, and the new one is used as soon as every copy has it." })] })) : (_jsx("p", { className: "text-sm mb-3", children: "Activating the new key." }));
+            break;
+        case "reencrypting":
+            step = (_jsxs(_Fragment, { children: [_jsx("p", { className: "text-sm mb-2", children: "Re-encrypting saved values with the new key." }), counted && (_jsx("p", { className: "text-sm text-text-muted mb-3", children: `${earlier === 1 ? "1 value is" : `${earlier} values are`} still on an earlier key; ${onNew} ${onNew === 1 ? "is" : "are"} on the new one.` })), waiting.length > 0 && (_jsxs(_Fragment, { children: [_jsx("p", { className: "text-sm mb-2", children: `Waiting for ${copiesText(waiting.length)} to start using the new key` }), _jsx(CopyList, { label: "Copies that don't yet use the new key", copies: waiting }), rotation?.activationForced && (_jsx("p", { className: "text-sm text-text-muted mb-3", children: "The key was activated before every copy had loaded it, so values are re-encrypted only once these copies have loaded it or are replaced." }))] }))] }));
+            break;
+        case "retiring":
+            step = _jsx("p", { className: "text-sm mb-3", children: "Removing the old key from the keyring." });
+            break;
+        case "failed":
+            step = _jsx("p", { className: "text-sm mb-3", children: "The last rotation failed." });
+            break;
+        case "done":
+            step = (_jsx("p", { className: "text-sm mb-3", children: rotation.finishedAt
+                    ? `The last rotation finished ${formatTime(rotation.finishedAt)}.`
+                    : "The last rotation has finished." }));
+            break;
+        default:
+            step = _jsx("p", { className: "text-sm mb-3", children: "No rotation is in progress." });
+    }
+    return (_jsxs(_Fragment, { children: [_jsx("p", { className: "text-sm text-text-muted mb-5 max-w-2xl", children: "The credentials, API keys and tokens saved in this console, and the secret settings of plugins, are encrypted with these keys, so a copy of the database alone shows none of them. A key is only ever replaced by an administrator, here." }), _jsxs(Card, { title: "Keys", children: [refreshError && (_jsxs(Alert, { children: ["Couldn\u2019t refresh the progress; what is shown may be out of date, and it is tried again every few seconds. ", refreshError] })), _jsx("div", { className: "overflow-x-auto", children: _jsxs("table", { className: "w-full text-sm border-collapse mb-3", children: [_jsx("thead", { children: _jsx("tr", { children: ["Key", "Created", "Age", "Values"].map((h) => (_jsx("th", { className: "text-left text-xs uppercase tracking-wide text-text-muted py-2 px-2.5 border-b border-border", children: h }, h))) }) }), _jsx("tbody", { children: keys.keys.map((key) => (_jsxs("tr", { children: [_jsxs("td", { className: "py-2.5 px-2.5 border-b border-border", children: [_jsx("code", { className: "text-xs", children: key.kid }), key.kid === activeKid && _jsx(Badge, { children: "Active" })] }), _jsx("td", { className: "py-2.5 px-2.5 border-b border-border", children: new Date(key.createdAt).toLocaleDateString() }), _jsx("td", { className: "py-2.5 px-2.5 border-b border-border", children: ageText(key.createdAt, now) }), _jsx("td", { className: "py-2.5 px-2.5 border-b border-border", children: key.envelopes ?? "Not counted yet" })] }, key.kid))) })] }) }), keys.countedAt && (_jsxs("p", { className: "text-xs text-text-muted", children: ["Values were last counted ", formatTime(keys.countedAt), "."] }))] }), _jsxs(Card, { title: "Rotation", children: [!keys.available && (_jsx(Alert, { children: "Keys can\u2019t be rotated on this server: its keyring isn\u2019t kept where the server can change it, or its copies can\u2019t be coordinated. See the deployment\u2019s configuration encryption settings." })), step, running && (_jsx("p", { className: "text-sm text-text-muted mb-3", children: `Started ${formatTime(rotation.requestedAt)}${rotation.compromised ? ", reported as a key compromise" : ""}.` })), rotation?.warning && _jsx(Note, { children: rotation.warning }), rotation?.lastError && _jsx(Alert, { children: rotation.lastError }), rotation?.compromised && (_jsx(Note, { children: "Because the keyring may have been exposed, replace the credentials saved here at their providers (DNS provider tokens, the Giphy key, registry tokens, plugin secrets), then enter the new ones. A keyring exposed together with a copy of the database has exposed the saved values themselves; rotating the key doesn\u2019t undo that." })), failedCompromised && (_jsx(Note, { children: "The failed rotation was reported as a key compromise. Starting again with \u201CRotate configuration key\u201D doesn\u2019t carry that over: use \u201CKey compromised: rotate now\u201D to keep it." })), rotation?.phase === "done" && (_jsx(Note, { children: "Back up the keyring again now. A copy taken before this rotation doesn\u2019t have the new key, so it can\u2019t read the values saved after it." })), notice && (_jsx("p", { role: "status", className: "text-sm text-text-muted mb-3", children: notice })), error && confirming === null && _jsx(Alert, { children: error }), _jsxs("div", { className: "flex flex-wrap items-center gap-3", children: [!running && (_jsx(Button, { type: "button", className: "!w-auto", disabled: busy || !keys.available, onClick: () => void run(() => rotateConfigKey(), "Could not start the rotation.", "A rotation was already in progress; its progress is shown."), children: "Rotate configuration key" })), (!running || !rotation.compromised) && (_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto !border-danger !text-danger hover:!border-danger hover:!text-danger", disabled: busy || !keys.available, onClick: () => openDialog("compromised"), children: "Key compromised: rotate now" })), rotation?.phase === "activating" && newKid && (_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", disabled: busy, onClick: () => openDialog("activate"), children: "Activate anyway" }))] }), _jsxs("p", { className: "text-xs text-text-muted mt-4", children: ["A database backup can\u2019t be read without the keyring: back up the keyring with it (the Secret ending in ", _jsx("code", { children: "-config-keyring" }), ", or its OpenBao entry), and keep each keyring backup as long as the database backups it serves."] })] }), unreadable.length > 0 && (_jsxs(Card, { title: "Values that can't be read", children: [_jsx("p", { className: "text-sm mb-2", children: "These saved values couldn\u2019t be decrypted with any key in the keyring (a database restored with an older keyring, for example). Enter each again where it is set." }), _jsx("p", { className: "text-sm text-text-muted mb-2", children: keys.reencryption?.finishedAt
+                            ? `This list was made by the re-encryption pass that finished ${formatTime(keys.reencryption.finishedAt)}; only a later pass updates it, so a value entered again stays listed until then.`
+                            : "This list was made by the last re-encryption pass; only a later pass updates it, so a value entered again stays listed until then." }), _jsx("ul", { className: "list-disc pl-5 text-sm", children: unreadable.map((item) => (_jsx("li", { children: `${item.record} ${item.uid}, ${item.field} (key ${item.kid})` }, `${item.record}/${item.uid}/${item.field}`))) })] })), _jsx(Card, { title: "Plugin secret settings", children: keys.pluginSecrets?.encryptedAt ? (_jsx("p", { className: "text-sm", children: `Encrypted since ${formatTime(keys.pluginSecrets.encryptedAt)}.` })) : (_jsxs(_Fragment, { children: [_jsx("p", { className: "text-sm mb-2", children: "Not encrypted yet. Secret settings of plugins are saved as plain text until every server pod runs this release and the first encryption run has finished." }), keys.pluginSecrets?.reason && (_jsx("p", { className: "text-sm text-text-muted", children: keys.pluginSecrets.reason }))] })) }), _jsxs(Modal, { open: confirming === "compromised", onClose: closeDialog, title: "Key compromised", children: [_jsx("p", { className: "text-sm mb-3", children: running
+                            ? "The rotation in progress is marked as a key compromise: the old key is removed as soon as every saved value has moved to the new one, with no waiting."
+                            : "A new key is created and every saved value is re-encrypted with it, and the old key is removed as soon as nothing uses it." }), _jsx("p", { className: "text-sm mb-3", children: "If the keyring was exposed together with a copy of the database, the saved values were exposed too: afterwards, replace the credentials at their providers and enter the new ones here." }), error && _jsx(Alert, { children: error }), _jsxs("div", { className: "flex gap-3 justify-end mt-5", children: [_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", disabled: busy, onClick: closeDialog, children: "Back" }), _jsx(Button, { type: "button", className: "!w-auto", loading: busy, disabled: busy, onClick: () => void run(() => rotateConfigKey({ compromised: true }), "Could not start the rotation.", "A rotation was already in progress and is already marked as a key compromise; its progress is shown."), children: "Rotate now" })] })] }), _jsxs(Modal, { open: confirming === "activate", onClose: closeDialog, title: "Activate the new key anyway", children: [staleCopies.length > 0 ? (_jsxs(_Fragment, { children: [_jsx("p", { className: "text-sm mb-2", children: "The new key encrypts from now on, before every server copy has loaded it. These copies still encrypt with the old key, which every copy can read, but they can\u2019t read values saved with the new key until they are replaced:" }), _jsx(CopyList, { label: "Copies that will not be able to read new values", copies: staleCopies }), _jsx("p", { className: "text-sm mb-3", children: "Saved values are re-encrypted only once those copies are gone or have loaded the key. Do this only if they are being replaced." })] })) : (_jsx("p", { className: "text-sm mb-3", children: "No copy is waiting for the new key now; it is activated on its own within a moment, so there is nothing to force." })), error && _jsx(Alert, { children: error }), _jsxs("div", { className: "flex gap-3 justify-end mt-5", children: [_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", disabled: busy, onClick: closeDialog, children: "Back" }), _jsx(Button, { type: "button", className: "!w-auto", loading: busy, disabled: busy || !newKid, onClick: () => void run(() => activateConfigKey(newKid), "Could not activate the new key.", "The new key is no longer waiting to be activated; the rotation's progress is shown."), children: "Activate anyway" })] })] })] }));
+}

package/dist/apps/shared/components/admin/configEncryption/keyringParts.d.ts

@@ -0,0 +1,10 @@
+import type { ConfigKeyRotation, ConfigKeys } from "../../../../../lib/admin/configKeysApi.js";
+/** Whole days from `iso` to `now`, as the age of a key. */
+export declare function ageText(iso: string, now: number): string;
+/**
+ * The key the deployment encrypts with. A key's own `active` is only what the copy that answered encrypts with, which differs between copies while they
+ * reload the keyring, so once the rotation has activated its new key that is the one, and before then it is the one the copy reports other than the new key.
+ */
+export declare function activeKidOf(keys: ConfigKeys): string | null;
+/** Whether `rotation` is still going: a finished or failed one is only shown. */
+export declare function isRunning(rotation: ConfigKeyRotation | null | undefined): rotation is ConfigKeyRotation;

package/dist/apps/shared/components/admin/configEncryption/keyringParts.js

@@ -0,0 +1,26 @@
+const DAY_MS = 24 * 60 * 60 * 1000;
+/** Whole days from `iso` to `now`, as the age of a key. */
+export function ageText(iso, now) {
+    const days = Math.max(0, Math.floor((now - new Date(iso).getTime()) / DAY_MS));
+    return days < 1 ? "less than a day" : days === 1 ? "1 day" : `${days} days`;
+}
+/**
+ * The key the deployment encrypts with. A key's own `active` is only what the copy that answered encrypts with, which differs between copies while they
+ * reload the keyring, so once the rotation has activated its new key that is the one, and before then it is the one the copy reports other than the new key.
+ */
+export function activeKidOf(keys) {
+    const rotation = keys.rotation;
+    if (rotation?.kid && rotation.activatedAt) {
+        return rotation.kid;
+    }
+    if (rotation?.kid && (rotation.phase === "adding" || rotation.phase === "activating")) {
+        return (keys.keys.find((key) => key.active && key.kid !== rotation.kid)?.kid ??
+            keys.keys.find((key) => key.kid !== rotation.kid)?.kid ??
+            null);
+    }
+    return keys.keys.find((key) => key.active)?.kid ?? keys.activeKid;
+}
+/** Whether `rotation` is still going: a finished or failed one is only shown. */
+export function isRunning(rotation) {
+    return !!rotation && rotation.phase !== "done" && rotation.phase !== "failed";
+}

package/dist/apps/shared/components/admin/diagnostics/DiagnosticsManager.js

@@ -8,9 +8,11 @@ import { HiOutlineArrowDownTray, HiOutlineArrowPath } from "react-icons/hi2";
 import Button from "../../../../../lib/components/buttons/Button.js";
 import { getDiagnosticsInformation, getDiagnosticsMetrics, getDiagnosticsRuntime, getDiagnosticsVersions, } from "./diagnosticsApi.js";
 import { saveTextFile, timestampedFilename } from "./download.js";
+import { activeKidOf } from "../configEncryption/keyringParts.js";
 import { describeError } from "./format.js";
 import InformationPanel from "./InformationPanel.js";
 import { loadInstalledPlugins } from "./InstalledPlugins.js";
+import { loadKeyring } from "./KeyringCard.js";
 import LogsPanel from "./LogsPanel.js";
 import RuntimePanel from "./RuntimePanel.js";
 import SystemPanel from "./SystemPanel.js";
@@ -39,6 +41,7 @@ export default function DiagnosticsManager({ createLogSocket, saveFile = saveTex
     const information = useDiagnosticsResource(getDiagnosticsInformation, reloadKey, "Could not read the server's environment and configuration.");
     const runtime = useDiagnosticsResource(getDiagnosticsRuntime, reloadKey, "Could not read the runtime.");
     const plugins = useDiagnosticsResource(loadInstalledPlugins, reloadKey, "Could not read the installed plugins.");
+    const keyring = useDiagnosticsResource(loadKeyring, reloadKey, "Could not read the configuration keyring.");
     const polling = useMetricsPolling(tab === "system");
     const logStream = useLogStream({ createSocket: createLogSocket });
     const logsOpened = useRef(false);
@@ -49,7 +52,7 @@ export default function DiagnosticsManager({ createLogSocket, saveFile = saveTex
             startLogs();
         }
     }, [tab]);
-    const refreshing = versions.loading || information.loading || runtime.loading || plugins.loading;
+    const refreshing = versions.loading || information.loading || runtime.loading || plugins.loading || keyring.loading;
     function handleTabKeyDown(event) {
         const index = TABS.findIndex((item) => item.id === tab);
         let next;
@@ -73,8 +76,8 @@ export default function DiagnosticsManager({ createLogSocket, saveFile = saveTex
         document.getElementById(tabId(TABS[next].id))?.focus();
     }
     /**
-     * Saves the versions, the environment and configuration (the server has already withheld every secret), the runtime and the
-     * latest metrics sample (asking for one if the System tab has not sampled): no logs.
+     * Saves the versions, the environment and configuration (the server has already withheld every secret), the runtime, the
+     * keyring's key ids, ages and counts and the latest metrics sample (asking for one if the System tab has not sampled): no logs.
      */
     async function downloadReport() {
         setPreparingReport(true);
@@ -101,17 +104,30 @@ export default function DiagnosticsManager({ createLogSocket, saveFile = saveTex
                     status: plugins.data.status ?? null,
                 }
                 : null,
+            // The key ids, when each was made and how many values it encrypts: never anything of a key itself, which the server doesn't send.
+            keyring: keyring.data
+                ? {
+                    activeKid: activeKidOf({ ...keyring.data, keys: keyring.data.keys ?? [] }),
+                    countedAt: keyring.data.countedAt ?? null,
+                    keys: (keyring.data.keys ?? []).map(({ kid, createdAt, envelopes }) => ({ kid, createdAt, envelopes })),
+                    rotationPhase: keyring.data.rotation?.phase ?? null,
+                    // As of the re-encryption pass that made the list: a value entered again stays counted until a later pass.
+                    unreadableValues: keyring.data.reencryption?.unreadable?.length ?? 0,
+                    unreadableAsOf: keyring.data.reencryption?.finishedAt ?? null,
+                }
+                : null,
             metrics: metrics ?? null,
             errors: {
                 versions: versions.error ?? null,
                 information: information.error ?? null,
                 runtime: runtime.error ?? null,
                 plugins: plugins.error ?? null,
+                keyring: keyring.error ?? null,
                 metrics: metricsError ?? null,
             },
         };
         saveFile(timestampedFilename("rapidmx-diagnostics", "json", generatedAt), `${JSON.stringify(report, null, 2)}\n`, "application/json");
         setPreparingReport(false);
     }
-    return (_jsxs(_Fragment, { children: [_jsxs("div", { className: "mb-5 flex flex-wrap items-center justify-between gap-3", children: [_jsx("h1", { className: "text-xl font-bold uppercase tracking-wide", children: "Diagnostics" }), _jsxs("div", { className: "flex flex-wrap items-center gap-2", children: [_jsxs(Button, { type: "button", variant: "secondary", className: "!w-auto", disabled: refreshing, onClick: () => setReloadKey(reloadKey + 1), children: [_jsx(HiOutlineArrowPath, { size: 16, "aria-hidden": "true", className: "mr-1 inline" }), "Refresh"] }), _jsxs(Button, { type: "button", className: "!w-auto", loading: preparingReport, onClick: () => void downloadReport(), children: [_jsx(HiOutlineArrowDownTray, { size: 16, "aria-hidden": "true", className: "mr-1 inline" }), "Download diagnostics report"] })] })] }), _jsx("div", { role: "tablist", "aria-label": "Diagnostics sections", className: "mb-5 flex gap-1 overflow-x-auto rounded-lg bg-surface-alt p-1", children: TABS.map((item) => (_jsx("button", { type: "button", role: "tab", id: tabId(item.id), "aria-selected": item.id === tab, "aria-controls": panelId(item.id), tabIndex: item.id === tab ? 0 : -1, onClick: () => setTab(item.id), onKeyDown: handleTabKeyDown, className: `flex-1 whitespace-nowrap rounded-md px-4 py-2 text-sm font-medium ${item.id === tab ? "bg-surface text-text shadow-card" : "text-text-muted hover:text-text"}`, children: item.label }, item.id))) }), _jsxs("div", { role: "tabpanel", id: panelId(tab), "aria-labelledby": tabId(tab), children: [tab === "information" && _jsx(InformationPanel, { versions: versions, plugins: plugins, information: information }), tab === "runtime" && _jsx(RuntimePanel, { runtime: runtime }), tab === "system" && _jsx(SystemPanel, { polling: polling }), tab === "logs" && _jsx(LogsPanel, { stream: logStream, saveFile: saveFile })] })] }));
+    return (_jsxs(_Fragment, { children: [_jsxs("div", { className: "mb-5 flex flex-wrap items-center justify-between gap-3", children: [_jsx("h1", { className: "text-xl font-bold uppercase tracking-wide", children: "Diagnostics" }), _jsxs("div", { className: "flex flex-wrap items-center gap-2", children: [_jsxs(Button, { type: "button", variant: "secondary", className: "!w-auto", disabled: refreshing, onClick: () => setReloadKey(reloadKey + 1), children: [_jsx(HiOutlineArrowPath, { size: 16, "aria-hidden": "true", className: "mr-1 inline" }), "Refresh"] }), _jsxs(Button, { type: "button", className: "!w-auto", loading: preparingReport, onClick: () => void downloadReport(), children: [_jsx(HiOutlineArrowDownTray, { size: 16, "aria-hidden": "true", className: "mr-1 inline" }), "Download diagnostics report"] })] })] }), _jsx("div", { role: "tablist", "aria-label": "Diagnostics sections", className: "mb-5 flex gap-1 overflow-x-auto rounded-lg bg-surface-alt p-1", children: TABS.map((item) => (_jsx("button", { type: "button", role: "tab", id: tabId(item.id), "aria-selected": item.id === tab, "aria-controls": panelId(item.id), tabIndex: item.id === tab ? 0 : -1, onClick: () => setTab(item.id), onKeyDown: handleTabKeyDown, className: `flex-1 whitespace-nowrap rounded-md px-4 py-2 text-sm font-medium ${item.id === tab ? "bg-surface text-text shadow-card" : "text-text-muted hover:text-text"}`, children: item.label }, item.id))) }), _jsxs("div", { role: "tabpanel", id: panelId(tab), "aria-labelledby": tabId(tab), children: [tab === "information" && _jsx(InformationPanel, { versions: versions, plugins: plugins, information: information, keyring: keyring }), tab === "runtime" && _jsx(RuntimePanel, { runtime: runtime }), tab === "system" && _jsx(SystemPanel, { polling: polling }), tab === "logs" && _jsx(LogsPanel, { stream: logStream, saveFile: saveFile })] })] }));
 }

package/dist/apps/shared/components/admin/diagnostics/InformationPanel.d.ts

@@ -1,4 +1,5 @@
 import React from "react";
+import type { ConfigKeys } from "../../../../../lib/admin/configKeysApi.js";
 import type { DiagnosticsInformation, DiagnosticsVersions } from "./diagnosticsApi.js";
 import type { DiagnosticsResource } from "./useDiagnosticsResource.js";
 import { InstalledPluginsData } from "./InstalledPlugins.js";
@@ -6,10 +7,13 @@ export interface InformationPanelProps {
     versions: DiagnosticsResource<DiagnosticsVersions>;
     plugins: DiagnosticsResource<InstalledPluginsData>;
     information: DiagnosticsResource<DiagnosticsInformation>;
+    /** `null` when the server has no keyring route. */
+    keyring: DiagnosticsResource<ConfigKeys | null>;
 }
 /**
- * The Information tab: the server, the install's other containers, the installed plugins, the server's environment variables and
- * configuration (secrets withheld by the server), and every installed package. The environment and configuration come from their
- * own request, so a server that predates them leaves the rest of the tab working and says so in their place.
+ * The Information tab: the server, the install's other containers (DNS publishing's among them), the installed plugins, the server's environment
+ * variables and configuration (secrets withheld by the server), what the Integrations pages saved as a source of its own, the configuration keyring and
+ * every installed package. The environment and configuration come from their own request, and so does the keyring, so a server that predates them
+ * leaves the rest of the tab working and says so in their place.
  */
-export default function InformationPanel({ versions, plugins, information }: InformationPanelProps): React.JSX.Element;
+export default function InformationPanel({ versions, plugins, information, keyring }: InformationPanelProps): React.JSX.Element;

package/dist/apps/shared/components/admin/diagnostics/InformationPanel.js

@@ -2,15 +2,17 @@ import { jsx as _jsx, Fragment as _Fragment, jsxs as _jsxs } from "react/jsx-run
 import Alert from "../ActionAlert.js";
 import ComponentsTable from "./ComponentsTable.js";
 import InstalledPlugins from "./InstalledPlugins.js";
+import KeyringCard from "./KeyringCard.js";
 import PackagesTable from "./PackagesTable.js";
 import ServerVersionCard from "./ServerVersionCard.js";
 import SettingsTable from "./SettingsTable.js";
 /**
- * The Information tab: the server, the install's other containers, the installed plugins, the server's environment variables and
- * configuration (secrets withheld by the server), and every installed package. The environment and configuration come from their
- * own request, so a server that predates them leaves the rest of the tab working and says so in their place.
+ * The Information tab: the server, the install's other containers (DNS publishing's among them), the installed plugins, the server's environment
+ * variables and configuration (secrets withheld by the server), what the Integrations pages saved as a source of its own, the configuration keyring and
+ * every installed package. The environment and configuration come from their own request, and so does the keyring, so a server that predates them
+ * leaves the rest of the tab working and says so in their place.
  */
-export default function InformationPanel({ versions, plugins, information }) {
+export default function InformationPanel({ versions, plugins, information, keyring }) {
     const { data, error, loading } = versions;
-    return (_jsxs("div", { className: "space-y-6", children: [error && _jsx(Alert, { children: error }), !data && loading && _jsx("p", { className: "text-sm text-text-muted", children: "Loading\u2026" }), data && (_jsxs(_Fragment, { children: [_jsx(ServerVersionCard, { server: data.server }), _jsx(ComponentsTable, { components: data.components ?? [], kubernetes: data.kubernetes ?? { available: false } }), _jsx(InstalledPlugins, { data: plugins.data, error: plugins.error, loading: plugins.loading }), information.error && _jsx(Alert, { children: information.error }), !information.data && information.loading && _jsx("p", { className: "text-sm text-text-muted", children: "Loading the environment\u2026" }), information.data && (_jsxs(_Fragment, { children: [_jsx(SettingsTable, { id: "diagnostics-environment", title: "Environment variables", description: "The server process's environment. Every variable shows its value except those on the server's list of hidden settings, whose value is withheld by the server and never sent.", settings: information.data.environment ?? [] }), _jsx(SettingsTable, { id: "diagnostics-configuration", title: "Configuration", description: "The effective settings the server runs with: the environment, saved plugin settings and defaults combined. Settings on the server's list of hidden settings, such as passwords, tokens and keys, are withheld by the server and never sent, and so are the credentials in URLs.", settings: information.data.configuration ?? [] })] })), _jsx(PackagesTable, { packages: data.packages ?? [] })] }))] }));
+    return (_jsxs("div", { className: "space-y-6", children: [error && _jsx(Alert, { children: error }), !data && loading && _jsx("p", { className: "text-sm text-text-muted", children: "Loading\u2026" }), data && (_jsxs(_Fragment, { children: [_jsx(ServerVersionCard, { server: data.server }), _jsx(ComponentsTable, { components: data.components ?? [], kubernetes: data.kubernetes ?? { available: false } }), _jsx(InstalledPlugins, { data: plugins.data, error: plugins.error, loading: plugins.loading }), information.error && _jsx(Alert, { children: information.error }), !information.data && information.loading && _jsx("p", { className: "text-sm text-text-muted", children: "Loading the environment\u2026" }), information.data && (_jsxs(_Fragment, { children: [_jsx(SettingsTable, { id: "diagnostics-environment", title: "Environment variables", description: "The server process's environment. Every variable shows its value except those on the server's list of hidden settings, whose value is withheld by the server and never sent.", settings: information.data.environment ?? [] }), _jsx(SettingsTable, { id: "diagnostics-configuration", title: "Configuration", description: "The effective settings the server runs with: the environment, saved plugin settings, what the Integrations pages saved and defaults combined. Settings on the server's list of hidden settings, such as passwords, tokens and keys, are withheld by the server and never sent, and so are the credentials in URLs.", settings: information.data.configuration ?? [] }), information.data.integrations && (_jsx(SettingsTable, { id: "diagnostics-integrations", title: "Integrations", description: "Saved in the Integrations pages of the admin console and applied without a restart. Each of these overrides the deployment's own value of the same name above. A secret shows only that it is set.", settings: information.data.integrations, secrets: "set", emptyText: "Nothing is saved in the Integrations pages." }))] }))] })), _jsx(KeyringCard, { keyring: keyring }), data && _jsx(PackagesTable, { packages: data.packages ?? [] })] }));
 }