@rapidmx/web-client 0.37.1 → 0.38.1

package/dist/apps/shared/components/admin/layout/AdminShell.js

@@ -6,7 +6,7 @@ import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 import "../../../styles/app.css";
 import { useEffect, useState } from "react";
 import { useRouter } from "@rapidrest/react/client";
-import { HiOutlineClipboardDocumentList, HiOutlineClock, HiOutlineCpuChip, HiOutlineDocumentArrowDown, HiOutlineDocumentCheck, HiOutlineGlobeAlt, HiOutlineInboxStack, HiOutlineKey, HiOutlineLockClosed, HiOutlinePaintBrush, HiOutlinePuzzlePiece, HiOutlineQueueList, HiOutlineRocketLaunch, HiOutlineShieldCheck, HiOutlineShieldExclamation, HiOutlineUserGroup, HiOutlineWrenchScrewdriver, HiOutlineBars3, HiOutlineChevronDoubleLeft, HiOutlineChevronDoubleRight, } from "react-icons/hi2";
+import { HiOutlineArrowPathRoundedSquare, HiOutlineClipboardDocumentList, HiOutlineClock, HiOutlineCpuChip, HiOutlineDocumentArrowDown, HiOutlineDocumentCheck, HiOutlineGlobeAlt, HiOutlineInboxStack, HiOutlineKey, HiOutlineLink, HiOutlineLockClosed, HiOutlinePaintBrush, HiOutlinePuzzlePiece, HiOutlineQueueList, HiOutlineRocketLaunch, HiOutlineShieldCheck, HiOutlineShieldExclamation, HiOutlineUserGroup, HiOutlineWrenchScrewdriver, HiOutlineBars3, HiOutlineChevronDoubleLeft, HiOutlineChevronDoubleRight, } from "react-icons/hi2";
 import { apiFetch, ApiRequestError } from "../../../../../lib/util/api.js";
 import { getSetupStatus } from "../../../../../lib/admin/setupApi.js";
 import { useSessionRefresh } from "../../../../../lib/auth/session.js";
@@ -80,6 +80,13 @@ const NAV_ITEMS = [
         label: "Signing Certificates",
         icon: HiOutlineDocumentCheck,
     },
+    { id: "integrations", href: "/admin/integrations", label: "Integrations", icon: HiOutlineLink },
+    {
+        id: "configurationEncryption",
+        href: "/admin/configuration-encryption",
+        label: "Configuration Encryption",
+        icon: HiOutlineArrowPathRoundedSquare,
+    },
     { id: "plugins", href: "/admin/plugins", label: "Plugins", icon: HiOutlinePuzzlePiece },
     { id: "diagnostics", href: "/admin/diagnostics", label: "Diagnostics", icon: HiOutlineCpuChip },
     { id: "branding", href: "/admin/branding", label: "Branding", icon: HiOutlinePaintBrush },

package/dist/apps/shared/components/admin/settings/CopyableValue.d.ts

@@ -0,0 +1,6 @@
+import React from "react";
+/** A value to type into a DNS provider's form, shown in full (long DKIM keys wrap) with a copy icon button beside it. */
+export default function CopyableValue({ value, copyLabel }: {
+    value: string;
+    copyLabel: string;
+}): React.JSX.Element;

package/dist/apps/shared/components/admin/settings/CopyableValue.js

@@ -0,0 +1,6 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import CopyIconButton from "../../../../../lib/components/buttons/CopyIconButton.js";
+/** A value to type into a DNS provider's form, shown in full (long DKIM keys wrap) with a copy icon button beside it. */
+export default function CopyableValue({ value, copyLabel }) {
+    return (_jsxs("div", { className: "flex items-start gap-2", children: [_jsx("code", { className: "flex-1 min-w-0 text-xs break-all", children: value }), _jsx(CopyIconButton, { value: value, label: copyLabel, className: "shrink-0" })] }));
+}

package/dist/apps/shared/components/admin/settings/DomainApexTxt.d.ts

@@ -0,0 +1,13 @@
+import React from "react";
+import { Domain } from "../../../../../lib/admin/domainsApi.js";
+export interface DomainApexTxtProps {
+    domain: Domain;
+    /** Called after a change was saved, so the page can load the domain and its checklist again. */
+    onChanged: () => void;
+}
+/**
+ * Whether RapidMX owns the domain's root TXT records to publish its SPF record there. A provider that owns a record set owns every value in it, so
+ * nothing is published there unless the administrator opts in with the values to keep; while it is managed, values added at the DNS host are removed, so
+ * this is the only place to edit them (spec 9.4). Shown for a domain a DNS provider publishes.
+ */
+export default function DomainApexTxt({ domain, onChanged }: DomainApexTxtProps): React.JSX.Element;

package/dist/apps/shared/components/admin/settings/DomainApexTxt.js

@@ -0,0 +1,148 @@
+import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
+///////////////////////////////////////////////////////////////////////////////
+// Copyright (C) 2026 Jean-Philippe Steinmetz
+// SPDX-License-Identifier: MPL-2.0
+///////////////////////////////////////////////////////////////////////////////
+import { useEffect, useRef, useState } from "react";
+import { listDnsProviders } from "../../../../../lib/admin/dnsProvidersApi.js";
+import { getApexTxt, updateApexTxt } from "../../../../../lib/admin/domainsApi.js";
+import Button from "../../../../../lib/components/buttons/Button.js";
+import FormField from "../../../../../lib/components/forms/FormField.js";
+import Modal from "../../../../../lib/components/overlays/Modal.js";
+import Alert from "../ActionAlert.js";
+import { actionErrorMessage } from "../elevation.js";
+const INPUT_CLASS = "w-full text-sm font-mono py-2.5 px-3 border border-border rounded-sm bg-surface text-text focus:outline-none focus:border-primary";
+/** The values in a "values to keep" box: one per line, trimmed, blank lines dropped, each once. */
+function parseKeep(text) {
+    return [...new Set(text.split("\n").map((line) => line.trim()).filter(Boolean))];
+}
+/** What the values to keep start as: while managed the saved list; otherwise the suggestion from the live lookup plus the values kept before an opt-out,
+ * which are restored as plain records only after a few minutes and so are not at the root yet. */
+function startingKeep(view) {
+    return view.managed ? view.keep : [...new Set([...view.suggestedKeep, ...view.keep])];
+}
+/** TXT values, each in full (they can be long). */
+function Values({ label, values }) {
+    return (_jsx("ul", { "aria-label": label, className: "flex flex-col gap-1 mb-3", children: values.map((value) => (_jsx("li", { children: _jsx("code", { className: "text-xs break-all", children: value }) }, value))) }));
+}
+function Card({ children }) {
+    return (_jsxs("div", { className: "bg-surface border border-border rounded-md p-6", children: [_jsx("h2", { className: "text-sm font-bold uppercase tracking-wide mb-3", children: "Root TXT records" }), children] }));
+}
+/**
+ * Whether RapidMX owns the domain's root TXT records to publish its SPF record there. A provider that owns a record set owns every value in it, so
+ * nothing is published there unless the administrator opts in with the values to keep; while it is managed, values added at the DNS host are removed, so
+ * this is the only place to edit them (spec 9.4). Shown for a domain a DNS provider publishes.
+ */
+export default function DomainApexTxt({ domain, onChanged }) {
+    const [view, setView] = useState(null);
+    // Whether the view is what the server said when the page last asked: not while the opt-in dialog is waiting for the values at the root now.
+    const [fresh, setFresh] = useState(false);
+    // The type of the domain's provider, which decides what it can keep; null while unknown (then the server decides).
+    const [providerType, setProviderType] = useState(null);
+    const [loadError, setLoadError] = useState(null);
+    const [keepText, setKeepText] = useState("");
+    const [saving, setSaving] = useState(false);
+    const [saved, setSaved] = useState(false);
+    const [error, setError] = useState(null);
+    const [stopped, setStopped] = useState(false);
+    // Which confirmation is open: opting in (with what it will do), or stopping.
+    const [confirming, setConfirming] = useState(null);
+    // An Azure provider keeps one value per name, so the set holds the SPF record alone; rfc2136 can't keep an SPF value at all (the server's `providerKeepsTxt`).
+    const keepsNothing = providerType === "azure";
+    const cantManage = providerType === "rfc2136";
+    // The newest request, so an answer to an older one is dropped, and whether the keep list holds edits the server hasn't seen (a reload leaves them).
+    const latest = useRef(0);
+    const dirty = useRef(false);
+    function load(resetKeep = true) {
+        const request = ++latest.current;
+        setLoadError(null);
+        return getApexTxt(domain.uid)
+            .then((loaded) => {
+            if (request !== latest.current) {
+                return;
+            }
+            setView(loaded);
+            setFresh(true);
+            if (resetKeep && !dirty.current) {
+                setKeepText(startingKeep(loaded).join("\n"));
+            }
+            // The opt-in must not go on without knowing what is at the root.
+            if (loaded.lookupFailed) {
+                setConfirming((open) => (open === "in" ? null : open));
+            }
+        })
+            .catch((err) => {
+            if (request !== latest.current) {
+                return;
+            }
+            setView(null);
+            setConfirming(null);
+            setLoadError(actionErrorMessage(err, "Could not load the root TXT records."));
+        });
+    }
+    // Again when the domain was saved (its version moved), which is how a change made here arrives.
+    useEffect(() => {
+        void load();
+    }, [domain.uid, domain.dnsProviderUid, domain.version]);
+    useEffect(() => {
+        let current = true;
+        listDnsProviders()
+            .then((providers) => current && setProviderType(providers.find((provider) => provider.uid === domain.dnsProviderUid)?.type ?? null))
+            .catch(() => current && setProviderType(null));
+        return () => {
+            current = false;
+        };
+    }, [domain.dnsProviderUid]);
+    async function save(managed) {
+        setSaving(true);
+        setError(null);
+        setSaved(false);
+        setStopped(false);
+        try {
+            const keep = keepsNothing ? [] : parseKeep(keepText);
+            await updateApexTxt(domain.uid, managed ? { managed, keep } : { managed });
+            dirty.current = false;
+            if (managed) {
+                // An edit while managed leaves the domain as it was, so the view takes the new list itself; an opt-in arrives with the reloaded domain.
+                setView((current) => (current.managed ? { ...current, keep } : current));
+                setSaved(true);
+            }
+            else {
+                setStopped(true);
+            }
+            setConfirming(null);
+            onChanged();
+        }
+        catch (err) {
+            setError(actionErrorMessage(err, "Could not change the root TXT records."));
+        }
+        finally {
+            setSaving(false);
+        }
+    }
+    // The values removed are listed from what is at the root when the dialog opens, not when the page loaded; the keep list stays as it is.
+    function confirm(kind) {
+        setError(null);
+        setConfirming(kind);
+        if (kind === "in") {
+            setFresh(false);
+            void load(false);
+        }
+    }
+    if (loadError) {
+        return (_jsx(Card, { children: _jsx(Alert, { children: loadError }) }));
+    }
+    if (!view) {
+        return (_jsx(Card, { children: _jsx("p", { className: "text-sm text-text-muted", children: "Loading\u2026" }) }));
+    }
+    const keep = keepsNothing ? [] : parseKeep(keepText);
+    const removed = view.current.filter((value) => !keep.includes(value));
+    // What a stop restores, and what an earlier stop restored: the SPF value RapidMX published and the values it kept.
+    const published = [...(view.spf ? [view.spf] : []), ...view.keep];
+    const keepField = keepsNothing ? (_jsx("p", { className: "text-sm text-text-muted mb-3", children: "An Azure DNS provider keeps one value per name, so the root TXT records would hold the SPF record alone and RapidMX would remove every other value." })) : (_jsxs(FormField, { label: "Values to keep", htmlFor: "apexTxtKeep", children: [_jsx("textarea", { id: "apexTxtKeep", className: INPUT_CLASS, rows: Math.max(3, keep.length + 1), value: keepText, onChange: (e) => {
+                    dirty.current = true;
+                    setKeepText(e.target.value);
+                    setSaved(false);
+                } }), _jsx("p", { className: "text-xs text-text-muted mt-1", children: "One value per line, exactly as it is in the DNS (a site-verification record, for example)." })] }));
+    return (_jsxs(Card, { children: [error && confirming === null && _jsx(Alert, { children: error }), stopped && !view.managed && (_jsx("p", { className: "text-sm mb-3", children: "RapidMX no longer manages the root TXT records. The SPF record and the kept values are being restored as plain records; they are missing for a few minutes meanwhile." })), view.managed ? (_jsxs(_Fragment, { children: [_jsx("p", { className: "text-sm font-semibold mb-3", children: "Values added at your DNS host are removed within a minute; add them here." }), _jsx("p", { className: "text-sm text-text-muted mb-1", children: "RapidMX publishes this SPF record at the root, and the values to keep below:" }), _jsx(Values, { label: "Published SPF record", values: [view.spf] }), keepField, _jsxs("div", { className: "flex items-center gap-3", children: [_jsx(Button, { type: "button", className: "!w-auto", loading: saving, disabled: saving || keep.join("\n") === view.keep.join("\n"), onClick: () => save(true), children: "Save values to keep" }), _jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", disabled: saving, onClick: () => confirm("out"), children: "Stop managing" }), saved && _jsx("span", { className: "text-sm text-text-muted", children: "Saved." })] })] })) : cantManage ? (_jsxs(_Fragment, { children: [_jsx("p", { className: "text-sm text-text-muted mb-3", children: "An rfc2136 DNS provider can't keep the SPF value among the root TXT records, so RapidMX can't manage them. Add the SPF record and the other root TXT records at your DNS host." }), view.current.length > 0 && _jsx(Values, { label: "Current root TXT records", values: view.current })] })) : view.lookupFailed ? (_jsxs(_Fragment, { children: [_jsx("p", { className: "text-sm text-text-muted mb-3", children: "The root TXT records couldn't be looked up, and taking them over without knowing what is there would delete it. Try again in a moment." }), _jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", onClick: () => void load(), children: "Try again" })] })) : (_jsxs(_Fragment, { children: [_jsx("p", { className: "text-sm text-text-muted mb-3", children: "SPF is a TXT record at the root of the domain, shared with the verification records of other services. RapidMX publishes nothing there unless you opt in, and then it owns every value in the set: it publishes SPF and the values you keep, and removes the rest." }), view.current.length > 0 ? (_jsxs(_Fragment, { children: [_jsx("p", { className: "text-sm font-semibold mb-1", children: "At the root now" }), _jsx(Values, { label: "Current root TXT records", values: view.current })] })) : (_jsx("p", { className: "text-sm text-text-muted mb-3", children: "There are no TXT records at the root now." })), published.length > 0 && (_jsxs(_Fragment, { children: [_jsx("p", { className: "text-sm font-semibold mb-1", children: "Restored when RapidMX stopped managing them" }), _jsx(Values, { label: "Restored root TXT records", values: published })] })), keepField, _jsx(Button, { type: "button", className: "!w-auto", onClick: () => confirm("in"), children: "Manage the root TXT records" })] })), _jsxs(Modal, { open: confirming === "in", onClose: () => setConfirming(null), title: "Manage the root TXT records", children: [_jsxs("p", { className: "text-sm mb-3", children: ["RapidMX will publish an SPF record at the root of ", _jsx("strong", { children: domain.name }), " (yours if it already allows this domain's mail servers, otherwise ", _jsx("code", { className: "text-xs", children: "v=spf1 mx ~all" }), "), and these values:"] }), keep.length > 0 ? _jsx(Values, { label: "Values RapidMX will keep", values: keep }) : _jsx("p", { className: "text-sm text-text-muted mb-3", children: "(none)" }), _jsx("p", { className: "text-sm mb-1", children: "At the root now and not on that list, so removed (an SPF record is replaced by the one above):" }), removed.length > 0 ? (_jsx(Values, { label: "Values removed", values: removed })) : (_jsx("p", { className: "text-sm text-text-muted mb-3", children: "Nothing else is there to remove." })), !fresh && !error && _jsx("p", { className: "text-sm text-text-muted mb-3", children: "Checking what is at the root now\u2026" }), _jsx("p", { className: "text-sm mb-3", children: "Anything you add at your DNS host later is removed within a minute; add it here instead." }), error && _jsx(Alert, { children: error }), _jsxs("div", { className: "flex gap-3 justify-end mt-5", children: [_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", disabled: saving, onClick: () => setConfirming(null), children: "Cancel" }), _jsx(Button, { type: "button", className: "!w-auto", loading: saving, disabled: saving || !fresh, onClick: () => save(true), children: "Manage them" })] })] }), _jsxs(Modal, { open: confirming === "out", onClose: () => setConfirming(null), title: "Stop managing the root TXT records", children: [_jsx("p", { className: "text-sm mb-3", children: "RapidMX lets go of the set and restores these values as plain records you edit at your DNS host. The root TXT records are missing for a few minutes while this happens." }), _jsx(Values, { label: "Values restored", values: published }), error && _jsx(Alert, { children: error }), _jsxs("div", { className: "flex gap-3 justify-end mt-5", children: [_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", disabled: saving, onClick: () => setConfirming(null), children: "Cancel" }), _jsx(Button, { type: "button", className: "!w-auto", loading: saving, disabled: saving, onClick: () => save(false), children: "Stop managing" })] })] })] }));
+}

package/dist/apps/shared/components/admin/settings/DomainDkimRotation.d.ts

@@ -0,0 +1,15 @@
+import React from "react";
+import { DnsRecordCheck, Domain } from "../../../../../lib/admin/domainsApi.js";
+export interface DomainDkimRotationProps {
+    domain: Domain;
+    /** The domain's DNS checklist, which says how each record is published and carries the rotation's records. */
+    checks: DnsRecordCheck[];
+    /** Called after a change was made, so the page can load the domain and its checklist again. */
+    onChanged: () => void;
+}
+/**
+ * A domain's DKIM key rotation (spec 6.2): the active selector and its age, the phase with its next step, "Rotate now", "Key compromised", "Cancel rotation"
+ * and the pause of scheduled rotation, and, for a record the administrator publishes by hand, the record to add. Nothing is shown on a server without the
+ * rotation route.
+ */
+export default function DomainDkimRotation({ domain, checks, onChanged }: DomainDkimRotationProps): React.JSX.Element | null;

package/dist/apps/shared/components/admin/settings/DomainDkimRotation.js

@@ -0,0 +1,200 @@
+import { jsx as _jsx, Fragment as _Fragment, jsxs as _jsxs } from "react/jsx-runtime";
+///////////////////////////////////////////////////////////////////////////////
+// Copyright (C) 2026 Jean-Philippe Steinmetz
+// SPDX-License-Identifier: MPL-2.0
+///////////////////////////////////////////////////////////////////////////////
+import { useEffect, useRef, useState } from "react";
+import { cancelDkimRotation, getDkimRotation, rotateDkim, setDkimRotationPaused, } from "../../../../../lib/admin/domainsApi.js";
+import Button from "../../../../../lib/components/buttons/Button.js";
+import Modal from "../../../../../lib/components/overlays/Modal.js";
+import { ApiRequestError } from "../../../../../lib/util/api.js";
+import Alert from "../ActionAlert.js";
+import { actionErrorMessage } from "../elevation.js";
+import CopyableValue from "./CopyableValue.js";
+const DAY_MS = 24 * 60 * 60 * 1000;
+/** How long a manual domain's new record may stay unpublished before the panel reminds the administrator (spec 6.2). */
+const REMINDER_DAYS = 7;
+/** Why a domain's key doesn't rotate: restapi's own refusals of "Rotate now" (`DKIM_ROTATION_REFUSALS`). */
+const BLOCKER_MESSAGES = {
+    unsupported: "This deployment's DKIM key provider doesn't rotate keys.",
+    ses: "Outbound mail is signed by Amazon SES's Easy DKIM, which rotates its own keys.",
+    no_key: "This domain has no DKIM key yet.",
+    imported: "This domain's DKIM key was imported by hand, so RapidMX can't rotate it.",
+    unknown_key: "The DKIM key provider can't tell whether it holds this domain's key, so it isn't rotated.",
+};
+const REASON_MESSAGES = {
+    scheduled: "Started by the schedule.",
+    manual: "Started by an administrator.",
+    compromised: "Started because the key was reported compromised.",
+};
+/** Whole days from `iso` to `now`, never negative. */
+function daysSince(iso, now) {
+    return Math.max(0, Math.floor((now - new Date(iso).getTime()) / DAY_MS));
+}
+function formatDays(days) {
+    return days < 1 ? "less than a day" : days === 1 ? "1 day" : `${days} days`;
+}
+function formatDate(iso) {
+    return new Date(iso).toLocaleDateString();
+}
+/** Whether the administrator adds `check`'s record by hand: the checklist says so, or says nothing about how it is published. */
+function publishedByHand(check) {
+    return !check.publication || check.publication === "manual";
+}
+/** The record to add at the DNS host: its name and value to copy, and whether the live check sees it. */
+function RecordToPublish({ check, noun, showLive }) {
+    return (_jsxs("dl", { className: "grid grid-cols-[auto_1fr] items-start gap-x-4 gap-y-2 text-sm mb-3", children: [_jsx("dt", { className: "text-text-muted py-2", children: "Type" }), _jsx("dd", { className: "py-2", children: check.recordKind }), _jsx("dt", { className: "text-text-muted py-2", children: "Name / host" }), _jsx("dd", { className: "bg-surface-alt border border-border rounded-sm py-1.5 px-3", children: _jsx(CopyableValue, { value: check.recordName, copyLabel: `Copy name for the ${noun} record` }) }), _jsx("dt", { className: "text-text-muted py-2", children: "Value" }), _jsx("dd", { className: "bg-surface-alt border border-border rounded-sm py-1.5 px-3", children: _jsx(CopyableValue, { value: check.recommendedValue ?? "", copyLabel: `Copy value for the ${noun} record` }) }), showLive && (_jsxs(_Fragment, { children: [_jsx("dt", { className: "text-text-muted py-2", children: "Status" }), _jsx("dd", { className: "py-2", children: check.matches ? (_jsx("span", { className: "text-xs font-bold uppercase tracking-wide py-0.5 px-2 rounded-pill bg-success text-white", children: "Live" })) : (_jsx("span", { className: "text-xs font-bold uppercase tracking-wide py-0.5 px-2 rounded-pill bg-surface-alt text-text-muted", children: "Not found yet" })) })] }))] }));
+}
+/**
+ * A domain's DKIM key rotation (spec 6.2): the active selector and its age, the phase with its next step, "Rotate now", "Key compromised", "Cancel rotation"
+ * and the pause of scheduled rotation, and, for a record the administrator publishes by hand, the record to add. Nothing is shown on a server without the
+ * rotation route.
+ */
+export default function DomainDkimRotation({ domain, checks, onChanged }) {
+    // `undefined` while loading, `null` where the server has no rotation route (an older server).
+    const [view, setView] = useState(undefined);
+    // Set when the first read failed for a reason other than a missing route, so the card stays and offers to try again.
+    const [loadFailed, setLoadFailed] = useState(false);
+    const [busy, setBusy] = useState(false);
+    const [error, setError] = useState(null);
+    const [confirming, setConfirming] = useState(null);
+    const latest = useRef(0);
+    // Reads the rotation again; an answer to an older request is dropped. Only a 404 means the server has no rotation route; any other failure keeps what
+    // is shown, or, where nothing is shown yet, the card with a way to try again.
+    function load() {
+        const id = ++latest.current;
+        return getDkimRotation(domain.uid).then((answer) => {
+            if (id === latest.current) {
+                setView(answer);
+                setLoadFailed(false);
+            }
+        }, (err) => {
+            if (id === latest.current) {
+                if (err instanceof ApiRequestError && err.status === 404) {
+                    setView((current) => current ?? null);
+                }
+                else {
+                    setLoadFailed(true);
+                }
+            }
+        });
+    }
+    // The domain's version moves with every change the rotation job makes, so the panel follows it.
+    useEffect(() => {
+        void load();
+    }, [domain.uid, domain.version]);
+    function card(children) {
+        return (_jsxs("div", { className: "bg-surface border border-border rounded-md p-6", children: [_jsx("h2", { className: "text-sm font-bold uppercase tracking-wide mb-3", children: "DKIM key rotation" }), children] }));
+    }
+    if (view === null || (view === undefined && !loadFailed)) {
+        return null;
+    }
+    if (!view) {
+        return card(_jsxs(_Fragment, { children: [_jsx(Alert, { children: "Could not load the DKIM rotation." }), _jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", onClick: () => void load(), children: "Reload the rotation" })] }));
+    }
+    async function run(action, fallback) {
+        setBusy(true);
+        setError(null);
+        try {
+            await action();
+            setConfirming(null);
+            await load();
+            onChanged();
+        }
+        catch (err) {
+            setError(actionErrorMessage(err, fallback));
+        }
+        finally {
+            setBusy(false);
+        }
+    }
+    const state = view.rotation ?? { phase: "idle" };
+    const phase = state.phase;
+    const blockerText = _jsx("p", { className: "text-sm text-text-muted mb-3", children: view.blocker ? BLOCKER_MESSAGES[view.blocker] : "This domain's DKIM key doesn't rotate." });
+    // A key that can't rotate offers nothing, unless a rotation is already in progress (the provider was swapped, the key re-imported): that one can still be
+    // seen and cancelled, though nothing new starts.
+    if (!view.rotatable && phase === "idle") {
+        return card(blockerText);
+    }
+    const rotatable = view.rotatable;
+    const next = state.next;
+    const now = Date.now();
+    // The active key is the new one from the switch on; before, since the last rotation or the domain's creation.
+    const activeSince = (phase === "switching" || phase === "overlap") && state.switchedAt ? state.switchedAt : (state.lastRotatedAt ?? domain.dateCreated);
+    const reason = phase === "pending" ? next?.reason : phase === "idle" ? undefined : state.reason;
+    // Once the key being replaced is reported compromised there is nothing more to report; an overlap is retired at once.
+    const canCompromise = rotatable && (phase === "idle" || phase === "overlap" || (phase === "pending" && next?.reason !== "compromised") || (phase === "switching" && state.reason !== "compromised"));
+    // An overlap finishes on its own.
+    const canCancel = phase === "pending" || phase === "switching";
+    const nextCheck = checks.find((check) => check.type === "dkim_next" && check.configured);
+    const previousCheck = checks.find((check) => check.type === "dkim_previous" && check.configured);
+    const retireAt = state.previous?.retireAt;
+    const retired = !!retireAt && new Date(retireAt).getTime() <= now;
+    const waitingDays = phase === "pending" && next && !next.liveSince ? daysSince(next.createdAt, now) : 0;
+    let step;
+    if (phase === "pending" && next) {
+        const selector = _jsx("code", { className: "text-xs", children: next.selector });
+        if (!next.publicKey) {
+            step = _jsxs(_Fragment, { children: ["Creating the new key (selector ", selector, ")."] });
+        }
+        else if (!next.liveSince) {
+            step = (_jsxs(_Fragment, { children: ["Waiting for the new record for ", selector, " to be live.", " ", next.reason === "compromised" ? "Signing switches to it as soon as it is." : "Signing keeps using the current key until then."] }));
+        }
+        else if (next.reason === "compromised") {
+            step = _jsxs(_Fragment, { children: ["The new record is live (since ", formatDate(next.liveSince), "). Signing switches to the new key next."] });
+        }
+        else {
+            step = (_jsxs(_Fragment, { children: ["The new record has been live since ", formatDate(next.liveSince), ". Signing switches to the new key once it has been live long enough for resolvers to drop any cached negative answer."] }));
+        }
+    }
+    else if (phase === "switching") {
+        step = _jsx(_Fragment, { children: "Switching: signing has moved to the new key, and the mail server hasn't confirmed it yet." });
+    }
+    else if (phase === "overlap") {
+        step = retireAt ? (_jsxs(_Fragment, { children: ["The old key retires on ", formatDate(retireAt), ". Mail signed with it that is still in transit keeps verifying until then."] })) : (_jsx(_Fragment, { children: "The old key retires shortly." }));
+    }
+    else {
+        step = _jsx(_Fragment, { children: "No rotation is in progress." });
+    }
+    const scheduleNote = phase !== "idle" ? null : state.paused ? (_jsx("p", { className: "text-sm text-text-muted mb-3", children: "Scheduled rotation is paused." })) : view.nextScheduledAt ? (_jsxs("p", { className: "text-sm text-text-muted mb-3", children: ["Next scheduled rotation: ", formatDate(view.nextScheduledAt), "."] })) : (_jsx("p", { className: "text-sm text-text-muted mb-3", children: "No rotation is scheduled." }));
+    // A record published by hand is shown to copy; one a provider publishes is only mentioned.
+    let records = null;
+    if (phase === "pending" && nextCheck && next?.publicKey) {
+        if (publishedByHand(nextCheck)) {
+            records = (_jsxs("div", { className: "mb-3", children: [_jsx("p", { className: "text-sm font-semibold mb-2", children: nextCheck.matches ? "The record you published is live." : "Publish this record to finish rotating" }), _jsx(RecordToPublish, { check: nextCheck, noun: "new DKIM key", showLive: true }), waitingDays >= REMINDER_DAYS && !nextCheck.matches && (_jsxs("div", { role: "note", className: "text-sm rounded-sm py-3 px-3.5 bg-warning text-warning-contrast", children: ["This record has been waiting for ", waitingDays, " days. Signing doesn't switch until it is live, so add it at your DNS host, or cancel the rotation."] }))] }));
+        }
+        else if (nextCheck.publication === "conflict") {
+            records = _jsx("p", { className: "text-sm text-text-muted mb-3", children: "The DNS provider can't publish this record while another one is in the way; see the checklist above." });
+        }
+        else {
+            records = _jsx("p", { className: "text-sm text-text-muted mb-3", children: "This record is published automatically by the DNS provider." });
+        }
+    }
+    else if ((phase === "switching" || phase === "overlap") && previousCheck && publishedByHand(previousCheck)) {
+        records = (_jsxs("div", { className: "mb-3", children: [_jsx("p", { className: "text-sm font-semibold mb-2", children: retired
+                        ? "The old key has retired: you may now remove this record."
+                        : phase === "overlap" && retireAt
+                            ? `Keep this record published until ${formatDate(retireAt)}, then you may remove it.`
+                            : "Keep this record published until the old key retires." }), _jsx(RecordToPublish, { check: previousCheck, noun: "previous DKIM key", showLive: false })] }));
+    }
+    const compromisedText = phase === "overlap"
+        ? "The old record and key are removed now, without waiting for the overlap to end. Mail signed with the old key that is still in transit may then fail DKIM."
+        : phase === "switching"
+            ? "The old record is removed as soon as the mail server confirms the switch, with no overlap. Mail signed with the old key that is still in transit may then fail DKIM."
+            : "Signing moves to the new key as soon as its record is live (the publish wait is skipped), and the old record is removed as soon as the mail server confirms the switch, with no overlap. Mail signed with the old key that is still in transit may then fail DKIM.";
+    const cancelText = phase === "switching"
+        ? "Signing goes back to the previous key, and the new key is deleted. The cancel is refused if the previous key is gone or the mail server can't be pointed back at it. The next scheduled rotation counts from now."
+        : "The new key is deleted and its record is no longer published. Signing stays with the current key. The next scheduled rotation counts from now.";
+    // The refusal a dialog shows belongs to it, so it goes with it rather than moving to the card.
+    function closeDialog() {
+        if (!busy) {
+            setConfirming(null);
+            setError(null);
+        }
+    }
+    function openDialog(which) {
+        setError(null);
+        setConfirming(which);
+    }
+    return (_jsxs(_Fragment, { children: [card(_jsxs(_Fragment, { children: [!rotatable && blockerText, domain.dkimSelector && (_jsxs("p", { className: "text-sm mb-3", children: ["Active selector ", _jsx("code", { className: "text-xs", children: domain.dkimSelector }), ", in use for ", formatDays(daysSince(activeSince, now)), "."] })), _jsx("p", { className: "text-sm mb-1", children: step }), reason && _jsx("p", { className: "text-sm text-text-muted mb-3", children: REASON_MESSAGES[reason] }), scheduleNote, state.lastError && _jsx(Alert, { children: state.lastError }), records, error && confirming === null && _jsx(Alert, { children: error }), _jsxs("div", { className: "flex flex-wrap items-center gap-3", children: [rotatable && phase === "idle" && (_jsx(Button, { type: "button", className: "!w-auto", disabled: busy, onClick: () => void run(() => rotateDkim(domain.uid), "Could not start the rotation."), children: "Rotate now" })), canCompromise && (_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto !border-danger !text-danger hover:!border-danger hover:!text-danger", disabled: busy, onClick: () => openDialog("compromised"), children: "Key compromised: rotate now" })), canCancel && (_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", disabled: busy, onClick: () => openDialog("cancel"), children: "Cancel rotation" })), rotatable && (_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", disabled: busy, onClick: () => void run(() => setDkimRotationPaused(domain.uid, !state.paused), state.paused ? "Could not resume scheduled rotation." : "Could not pause scheduled rotation."), children: state.paused ? "Resume scheduled rotation" : "Pause scheduled rotation" }))] })] })), _jsxs(Modal, { open: confirming === "compromised", onClose: closeDialog, title: "Key compromised", children: [_jsx("p", { className: "text-sm mb-3", children: compromisedText }), error && _jsx(Alert, { children: error }), _jsxs("div", { className: "flex gap-3 justify-end mt-5", children: [_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", disabled: busy, onClick: closeDialog, children: "Back" }), _jsx(Button, { type: "button", className: "!w-auto", loading: busy, disabled: busy, onClick: () => void run(() => rotateDkim(domain.uid, { compromised: true }), "Could not rotate the key."), children: "Confirm" })] })] }), _jsxs(Modal, { open: confirming === "cancel", onClose: closeDialog, title: "Cancel rotation", children: [_jsx("p", { className: "text-sm mb-3", children: cancelText }), error && _jsx(Alert, { children: error }), _jsxs("div", { className: "flex gap-3 justify-end mt-5", children: [_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", disabled: busy, onClick: closeDialog, children: "Back" }), _jsx(Button, { type: "button", className: "!w-auto", loading: busy, disabled: busy, onClick: () => void run(() => cancelDkimRotation(domain.uid), "Could not cancel the rotation."), children: "Confirm" })] })] })] }));
+}

package/dist/apps/shared/components/admin/settings/DomainDnsProvider.d.ts

@@ -0,0 +1,12 @@
+import React from "react";
+import { Domain } from "../../../../../lib/admin/domainsApi.js";
+export interface DomainDnsProviderProps {
+    domain: Domain;
+    /** Called after the assignment was saved, so the page can load the domain and its checklist again. */
+    onChanged: () => void;
+}
+/**
+ * The domain's DNS provider: "Manual", where the administrator adds the records by hand, or the provider config whose external-dns instance publishes
+ * them. Nothing is shown on a server without DNS providers.
+ */
+export default function DomainDnsProvider({ domain, onChanged }: DomainDnsProviderProps): React.JSX.Element | null;

package/dist/apps/shared/components/admin/settings/DomainDnsProvider.js

@@ -0,0 +1,70 @@
+import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
+///////////////////////////////////////////////////////////////////////////////
+// Copyright (C) 2026 Jean-Philippe Steinmetz
+// SPDX-License-Identifier: MPL-2.0
+///////////////////////////////////////////////////////////////////////////////
+import { useEffect, useState } from "react";
+import { listDnsProviders } from "../../../../../lib/admin/dnsProvidersApi.js";
+import { assignDnsProvider } from "../../../../../lib/admin/domainsApi.js";
+import Button from "../../../../../lib/components/buttons/Button.js";
+import FormField from "../../../../../lib/components/forms/FormField.js";
+import Alert from "../ActionAlert.js";
+import { actionErrorMessage } from "../elevation.js";
+const INPUT_CLASS = "w-full text-sm py-2.5 px-3 border border-border rounded-sm bg-surface text-text focus:outline-none focus:border-primary disabled:opacity-55";
+/** The length of the longest zone of `provider` that covers `name` (the name itself or a name under it), 0 when none does. */
+function coveringZoneLength(name, provider) {
+    return Math.max(0, ...provider.zones.filter((zone) => name === zone || name.endsWith(`.${zone}`)).map((zone) => zone.length));
+}
+/** The providers the select offers: only the one whose zone covers the domain most specifically, since the server accepts no other (another config's
+ * zone nested under the parent's is left out of the parent's external-dns instance), and the one assigned now, whatever it covers. */
+function offeredProviders(domain, providers) {
+    const lengths = providers.map((provider) => coveringZoneLength(domain.name, provider));
+    const longest = Math.max(0, ...lengths);
+    return providers.filter((provider, i) => (longest > 0 && lengths[i] === longest) || provider.uid === domain.dnsProviderUid);
+}
+/**
+ * The domain's DNS provider: "Manual", where the administrator adds the records by hand, or the provider config whose external-dns instance publishes
+ * them. Nothing is shown on a server without DNS providers.
+ */
+export default function DomainDnsProvider({ domain, onChanged }) {
+    // `undefined` while loading, `null` where the server has no DNS providers (an older server): then there is nothing to choose.
+    const [providers, setProviders] = useState(undefined);
+    const [selected, setSelected] = useState(domain.dnsProviderUid ?? "");
+    const [saving, setSaving] = useState(false);
+    const [error, setError] = useState(null);
+    const [saved, setSaved] = useState(false);
+    useEffect(() => {
+        listDnsProviders()
+            .then(setProviders)
+            .catch(() => setProviders(null));
+    }, [domain.uid]);
+    useEffect(() => {
+        setSelected(domain.dnsProviderUid ?? "");
+    }, [domain.dnsProviderUid]);
+    if (!providers) {
+        return null;
+    }
+    async function handleSave() {
+        setSaving(true);
+        setError(null);
+        setSaved(false);
+        try {
+            await assignDnsProvider(domain.uid, selected || null);
+            setSaved(true);
+            onChanged();
+        }
+        catch (err) {
+            setError(actionErrorMessage(err, "Could not change the DNS provider."));
+        }
+        finally {
+            setSaving(false);
+        }
+    }
+    const assigned = domain.dnsProviderUid ?? "";
+    const offered = offeredProviders(domain, providers);
+    const locked = !!domain.apexTxt?.managed;
+    return (_jsxs("div", { className: "bg-surface border border-border rounded-md p-6", children: [_jsx("h2", { className: "text-sm font-bold uppercase tracking-wide mb-3", children: "DNS provider" }), offered.length === 0 && !assigned ? (_jsxs("p", { className: "text-sm text-text-muted", children: ["No DNS provider covers ", domain.name, ". To have its DNS records published automatically, add one under", " ", _jsx("a", { href: "/admin/integrations/dns-providers", className: "text-primary-dark hover:underline", children: "DNS providers" }), " ", "with a zone that includes it. Until then, add the records below at your DNS host."] })) : (_jsxs(_Fragment, { children: [_jsx("p", { className: "text-sm text-text-muted mb-3", children: "Choose the DNS provider that publishes this domain's records, or add them yourself at your DNS host." }), error && _jsx(Alert, { children: error }), _jsx(FormField, { label: "DNS provider", htmlFor: "dnsProviderUid", children: _jsxs("select", { id: "dnsProviderUid", className: INPUT_CLASS, value: selected, disabled: locked, onChange: (e) => {
+                                setSelected(e.target.value);
+                                setSaved(false);
+                            }, children: [_jsx("option", { value: "", children: "Manual: I publish the records myself" }), offered.map((provider) => (_jsx("option", { value: provider.uid, children: provider.name + (provider.enabled ? "" : " (disabled)") }, provider.uid))), assigned && !providers.some((provider) => provider.uid === assigned) && (_jsxs("option", { value: assigned, children: [assigned, " (no longer exists)"] }))] }) }), locked && (_jsx("p", { className: "text-sm text-text-muted mb-3", children: "RapidMX manages this domain's root TXT records through its provider. Stop managing the root TXT records first, then change the provider." })), assigned && selected !== assigned && (_jsx("p", { className: "text-sm text-text-muted mb-3", children: "Saving removes the records the current provider published for this domain from your DNS, until the new provider has published them (or you have added them yourself)." })), _jsxs("div", { className: "flex items-center gap-3", children: [_jsx(Button, { type: "button", className: "!w-auto", "aria-label": "Save DNS provider", loading: saving, disabled: saving || locked || selected === assigned, onClick: handleSave, children: "Save" }), saved && _jsx("span", { className: "text-sm text-text-muted", children: "Saved." })] })] }))] }));
+}

package/dist/apps/shared/components/admin/settings/DomainDnsSetup.d.ts

@@ -1,9 +1,9 @@
 import React from "react";
-import { Domain } from "../../../../../lib/admin/domainsApi.js";
+import { DnsRecordCheck, Domain } from "../../../../../lib/admin/domainsApi.js";
 export interface DomainDnsSetupProps {
     uid: string;
-    /** Called with the domain every time it's (re)loaded - e.g. after "Verify now". */
-    onLoaded?: (domain: Domain) => void;
+    /** Called with the domain and its checklist every time they are (re)loaded - e.g. after "Verify now". */
+    onLoaded?: (domain: Domain, checks: DnsRecordCheck[]) => void;
 }
 /**
  * A domain's status, its ownership TXT record with "Verify now", and the DNS setup checklist - shared by the domain