@rapidmx/web-client 0.37.1 → 0.39.0

package/dist/apps/shared/components/admin/settings/DomainDnsSetup.js

@@ -4,16 +4,21 @@ import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-run
 // SPDX-License-Identifier: MPL-2.0
 ///////////////////////////////////////////////////////////////////////////////
 import { useEffect, useState } from "react";
+import { takeoverDnsRecords } from "../../../../../lib/admin/dnsProvidersApi.js";
 import { getDnsSetup, getDomain, verifyDomain } from "../../../../../lib/admin/domainsApi.js";
 import Alert from "../ActionAlert.js";
 import Button from "../../../../../lib/components/buttons/Button.js";
-import CopyIconButton from "../../../../../lib/components/buttons/CopyIconButton.js";
+import CopyableValue from "./CopyableValue.js";
+import Modal from "../../../../../lib/components/overlays/Modal.js";
 import { actionErrorMessage } from "../elevation.js";
+import { TypeMismatchNotice } from "../integrations/dnsProviderParts.js";
 const RECORD_TYPE_LABELS = {
     ownership: "Ownership (TXT)",
     mx: "MX",
     spf: "SPF",
     dkim: "DKIM",
+    dkim_next: "DKIM (new key)",
+    dkim_previous: "DKIM (previous key)",
     dmarc: "DMARC",
     openpgpkey_cname: "OpenPGP keys (CNAME)",
     autodiscover_cname: "Autodiscover (CNAME)",
@@ -25,6 +30,8 @@ const RECORD_TYPE_NAMES = {
     mx: "MX",
     spf: "SPF",
     dkim: "DKIM",
+    dkim_next: "new DKIM key",
+    dkim_previous: "previous DKIM key",
     dmarc: "DMARC",
     openpgpkey_cname: "OpenPGP keys CNAME",
     autodiscover_cname: "Autodiscover CNAME",
@@ -37,6 +44,13 @@ const RECORD_TYPE_HELP = {
     autodiscover_cname: "So EAS and Outlook clients can find this server automatically from just an email address. This hostname also needs to be covered by this server's TLS certificate.",
     autodiscover_srv: "Same purpose as the CNAME above, for clients that check DNS SRV instead - and, unlike the CNAME, needs no extra TLS certificate, since it points at a hostname already covered. Prefer this one when a second certificate is hard to obtain.",
 };
+/** Why a record is added by hand, shown under "Manual" in the Published column. */
+const MANUAL_REASONS = {
+    no_provider: "No DNS provider is assigned to this domain.",
+    kind_unsupported: "The DNS provider can't hold this kind of record.",
+    outside_zones: "This name is outside the zones of the DNS provider.",
+    apex_txt_unmanaged: "Shares the domain's root TXT records, which you opt in to manage below.",
+};
 /** An MX record's recommended value is `"<priority> <mail server>"` - two separate fields in a DNS provider's form. */
 function splitMxValue(value) {
     const match = /^(\d+)\s+(\S+)$/.exec(value.trim());
@@ -47,10 +61,6 @@ function splitSrvValue(value) {
     const match = /^(\d+)\s+(\d+)\s+(\d+)\s+(\S+)$/.exec(value.trim());
     return match ? { priority: match[1], weight: match[2], port: match[3], target: match[4] } : null;
 }
-/** A value to type into a DNS provider's form, shown in full (long DKIM keys wrap) with a copy icon button beside it. */
-function CopyableValue({ value, copyLabel }) {
-    return (_jsxs("div", { className: "flex items-start gap-2", children: [_jsx("code", { className: "flex-1 min-w-0 text-xs break-all", children: value }), _jsx(CopyIconButton, { value: value, label: copyLabel, className: "shrink-0" })] }));
-}
 /**
  * A domain's status, its ownership TXT record with "Verify now", and the DNS setup checklist - shared by the domain
  * detail page and the setup wizard.
@@ -62,6 +72,11 @@ export default function DomainDnsSetup({ uid, onLoaded }) {
     const [error, setError] = useState(null);
     const [verifying, setVerifying] = useState(false);
     const [verifyError, setVerifyError] = useState(null);
+    // The conflicting record the administrator is being asked to take over, the request in flight, why it failed, and the records whose takeover was queued.
+    const [takeOver, setTakeOver] = useState(null);
+    const [takingOver, setTakingOver] = useState(false);
+    const [takeOverError, setTakeOverError] = useState(null);
+    const [takeOverQueued, setTakeOverQueued] = useState([]);
     function reload(id) {
         setLoading(true);
         setError(null);
@@ -69,7 +84,7 @@ export default function DomainDnsSetup({ uid, onLoaded }) {
             .then(([d, checks]) => {
             setDomain(d);
             setDnsSetup(checks);
-            onLoaded?.(d);
+            onLoaded?.(d, checks);
         })
             .catch((err) => setError(actionErrorMessage(err, "Could not load this domain.")))
             .finally(() => setLoading(false));
@@ -88,7 +103,7 @@ export default function DomainDnsSetup({ uid, onLoaded }) {
             const [d, checks] = await Promise.all([getDomain(domain.uid), getDnsSetup(domain.uid)]);
             setDomain(d);
             setDnsSetup(checks);
-            onLoaded?.(d);
+            onLoaded?.(d, checks);
         }
         catch (err) {
             setVerifyError(actionErrorMessage(err, "Could not verify this domain."));
@@ -97,6 +112,23 @@ export default function DomainDnsSetup({ uid, onLoaded }) {
             setVerifying(false);
         }
     }
+    // The record is taken over through the provider the domain is assigned to (a conflict only exists with one). Only the DNS controller applies it, so
+    // the list shows the result some time later: "Check again" rather than a refresh that would still show the conflict.
+    async function handleTakeOver() {
+        setTakingOver(true);
+        setTakeOverError(null);
+        try {
+            await takeoverDnsRecords(domain.dnsProviderUid, domain.uid, [takeOver.type]);
+            setTakeOverQueued((queued) => [...queued, takeOver.type]);
+            setTakeOver(null);
+        }
+        catch (err) {
+            setTakeOverError(actionErrorMessage(err, "Could not queue the takeover."));
+        }
+        finally {
+            setTakingOver(false);
+        }
+    }
     if (loading) {
         return _jsx("p", { className: "text-sm text-text-muted", children: "Loading\u2026" });
     }
@@ -106,7 +138,28 @@ export default function DomainDnsSetup({ uid, onLoaded }) {
     const ownership = dnsSetup.find((c) => c.type === "ownership");
     const ownershipValue = ownership?.recommendedValue ?? `rapidmx-domain-verification=${domain.verificationToken}`;
     const ownershipName = ownership?.recordName || domain.name;
-    return (_jsxs("div", { className: "flex flex-col gap-5", children: [_jsxs("div", { className: "bg-surface border border-border rounded-md p-6", children: [_jsxs("dl", { className: "grid grid-cols-1 sm:grid-cols-2 gap-x-6 gap-y-3 text-sm", children: [_jsx("dt", { className: "text-text-muted", children: "Enabled" }), _jsx("dd", { children: domain.enabled ? "Yes" : "No" }), _jsx("dt", { className: "text-text-muted", children: "Verification" }), _jsx("dd", { children: domain.verified ? (_jsx("span", { className: "text-xs font-bold uppercase tracking-wide py-0.5 px-2 rounded-pill bg-success text-white", children: "Verified" })) : (_jsx("span", { className: "text-xs font-bold uppercase tracking-wide py-0.5 px-2 rounded-pill bg-surface-alt text-text-muted", children: "Unverified" })) }), _jsx("dt", { className: "text-text-muted", children: "Last checked" }), _jsx("dd", { children: domain.lastCheckedAt ? new Date(domain.lastCheckedAt).toLocaleString() : "Never" }), domain.aliasOf && (_jsxs(_Fragment, { children: [_jsx("dt", { className: "text-text-muted", children: "Alias of" }), _jsxs("dd", { children: [domain.aliasOf, " ", _jsx("span", { className: "text-xs text-text-muted", children: "(no mailboxes of its own)" })] })] }))] }), !domain.verified && (_jsxs("div", { className: "mt-5 pt-5 border-t border-border", children: [_jsxs("p", { className: "text-sm mb-2", children: ["Add the following TXT record to ", _jsx("strong", { children: domain.name }), " to prove ownership, then verify:"] }), _jsxs("dl", { className: "grid grid-cols-[auto_1fr] items-start gap-x-4 gap-y-2 text-sm", children: [_jsx("dt", { className: "text-text-muted py-2", children: "Type" }), _jsx("dd", { className: "py-2", children: "TXT" }), _jsx("dt", { className: "text-text-muted py-2", children: "Name / host" }), _jsx("dd", { className: "bg-surface-alt border border-border rounded-sm py-1.5 px-3", children: _jsx(CopyableValue, { value: ownershipName, copyLabel: "Copy name for the ownership TXT record" }) }), _jsx("dt", { className: "text-text-muted py-2", children: "Value" }), _jsx("dd", { className: "bg-surface-alt border border-border rounded-sm py-1.5 px-3", children: _jsx(CopyableValue, { value: ownershipValue, copyLabel: "Copy value for the ownership TXT record" }) })] }), verifyError && (_jsx("div", { className: "mt-3", children: _jsx(Alert, { children: verifyError }) })), _jsx(Button, { type: "button", className: "!w-auto mt-3", loading: verifying, disabled: verifying, onClick: handleVerify, children: verifyError ? "Try again" : "Verify now" })] }))] }), dnsSetup.length > 0 && (_jsxs("div", { className: "bg-surface border border-border rounded-md p-6", children: [_jsx("h2", { className: "text-sm font-bold uppercase tracking-wide mb-3", children: "DNS setup checklist" }), _jsx("div", { className: "overflow-x-auto", children: _jsxs("table", { className: "w-full text-sm border-collapse", children: [_jsx("thead", { children: _jsx("tr", { children: ["Record", "Status", "Name / host", "Recommended value"].map((h) => (_jsx("th", { className: "text-left text-xs uppercase tracking-wide text-text-muted py-2 px-2.5 border-b border-border", children: h }, h))) }) }), _jsx("tbody", { children: dnsSetup.map((check) => (_jsxs("tr", { children: [_jsxs("td", { className: "py-2.5 px-2.5 border-b border-border", children: [RECORD_TYPE_LABELS[check.type], _jsxs("div", { className: "text-xs text-text-muted", children: ["Type: ", check.recordKind] }), RECORD_TYPE_HELP[check.type] && (_jsx("div", { className: "text-xs text-text-muted mt-1 max-w-xs", children: RECORD_TYPE_HELP[check.type] }))] }), _jsx("td", { className: "py-2.5 px-2.5 border-b border-border", children: !check.configured ? (_jsx("span", { className: "text-xs text-text-muted", children: "Not configured" })) : check.matches ? (_jsx("span", { className: "text-xs font-bold uppercase tracking-wide py-0.5 px-2 rounded-pill bg-success text-white", children: "Live" })) : (_jsx("span", { className: "text-xs font-bold uppercase tracking-wide py-0.5 px-2 rounded-pill bg-surface-alt text-text-muted", children: "Not found" })) }), _jsx("td", { className: "py-2.5 px-2.5 border-b border-border text-text-muted min-w-[10rem]", children: check.recordName ? (_jsx(CopyableValue, { value: check.recordName, copyLabel: `Copy name for the ${RECORD_TYPE_NAMES[check.type]} record` })) : (_jsx("code", { className: "text-xs", children: "\u2014" })) }), _jsx("td", { className: "py-2.5 px-2.5 border-b border-border text-text-muted", children: check.recommendedValue ? (_jsx(DnsRecordValue, { check: check, value: check.recommendedValue })) : (_jsx("code", { className: "text-xs", children: "\u2014" })) })] }, check.type))) })] }) }), _jsxs("p", { className: "text-xs text-text-muted mt-3", children: ["Some DNS providers want the name relative to the domain (for example ", _jsx("code", { children: "@" }), " for the domain itself) rather than the full name."] })] }))] }));
+    // A server that doesn't publish says nothing about how a record gets published, so the column stays out.
+    const showPublished = dnsSetup.some((c) => c.publication);
+    const openpgpkey = dnsSetup.find((c) => c.type === "openpgpkey_cname");
+    return (_jsxs("div", { className: "flex flex-col gap-5", children: [_jsxs("div", { className: "bg-surface border border-border rounded-md p-6", children: [_jsxs("dl", { className: "grid grid-cols-1 sm:grid-cols-2 gap-x-6 gap-y-3 text-sm", children: [_jsx("dt", { className: "text-text-muted", children: "Enabled" }), _jsx("dd", { children: domain.enabled ? "Yes" : "No" }), _jsx("dt", { className: "text-text-muted", children: "Verification" }), _jsx("dd", { children: domain.verified ? (_jsx("span", { className: "text-xs font-bold uppercase tracking-wide py-0.5 px-2 rounded-pill bg-success text-white", children: "Verified" })) : (_jsx("span", { className: "text-xs font-bold uppercase tracking-wide py-0.5 px-2 rounded-pill bg-surface-alt text-text-muted", children: "Unverified" })) }), _jsx("dt", { className: "text-text-muted", children: "Last checked" }), _jsx("dd", { children: domain.lastCheckedAt ? new Date(domain.lastCheckedAt).toLocaleString() : "Never" }), domain.aliasOf && (_jsxs(_Fragment, { children: [_jsx("dt", { className: "text-text-muted", children: "Alias of" }), _jsxs("dd", { children: [domain.aliasOf, " ", _jsx("span", { className: "text-xs text-text-muted", children: "(no mailboxes of its own)" })] })] }))] }), !domain.verified && (_jsxs("div", { className: "mt-5 pt-5 border-t border-border", children: [_jsxs("p", { className: "text-sm mb-2", children: ["Add the following TXT record to ", _jsx("strong", { children: domain.name }), " to prove ownership, then verify:"] }), _jsxs("dl", { className: "grid grid-cols-[auto_1fr] items-start gap-x-4 gap-y-2 text-sm", children: [_jsx("dt", { className: "text-text-muted py-2", children: "Type" }), _jsx("dd", { className: "py-2", children: "TXT" }), _jsx("dt", { className: "text-text-muted py-2", children: "Name / host" }), _jsx("dd", { className: "bg-surface-alt border border-border rounded-sm py-1.5 px-3", children: _jsx(CopyableValue, { value: ownershipName, copyLabel: "Copy name for the ownership TXT record" }) }), _jsx("dt", { className: "text-text-muted py-2", children: "Value" }), _jsx("dd", { className: "bg-surface-alt border border-border rounded-sm py-1.5 px-3", children: _jsx(CopyableValue, { value: ownershipValue, copyLabel: "Copy value for the ownership TXT record" }) })] }), verifyError && (_jsx("div", { className: "mt-3", children: _jsx(Alert, { children: verifyError }) })), _jsx(Button, { type: "button", className: "!w-auto mt-3", loading: verifying, disabled: verifying, onClick: handleVerify, children: verifyError ? "Try again" : "Verify now" })] }))] }), dnsSetup.length > 0 && (_jsxs("div", { className: "bg-surface border border-border rounded-md p-6", children: [_jsx("h2", { className: "text-sm font-bold uppercase tracking-wide mb-3", children: "DNS setup checklist" }), openpgpkey?.configured && !openpgpkey.matches && (_jsxs("div", { role: "note", "aria-label": "OpenPGP key host warning", className: "text-sm rounded-sm py-3 px-3.5 mb-3 bg-warning text-warning-contrast", children: [openpgpkey.recordName, " doesn't resolve to this deployment yet. Until it does, other people's OpenPGP apps can't find your users' keys (Web Key Directory), and this server can't get a certificate for it.", openpgpkey.publication === "pending" && " It is being published automatically."] })), takeOverQueued.length > 0 && (_jsxs("p", { className: "text-sm mb-3", children: ["Takeover queued for the ", takeOverQueued.map((type) => RECORD_TYPE_NAMES[type]).join(", "), " record. The DNS controller overwrites it shortly, and it shows as published here once it is live. If it stays in conflict, the result of the takeover is under Operations on", " ", _jsx("a", { href: `/admin/integrations/dns-providers/${encodeURIComponent(domain.dnsProviderUid)}`, className: "text-primary-dark hover:underline", children: "the DNS provider's page" }), ".", " ", _jsx("button", { type: "button", className: "font-semibold underline", onClick: () => {
+                                    setTakeOverQueued([]);
+                                    void reload(uid);
+                                }, children: "Check again" })] })), _jsx("div", { className: "overflow-x-auto", children: _jsxs("table", { className: "w-full text-sm border-collapse", children: [_jsx("thead", { children: _jsx("tr", { children: ["Record", "Status", ...(showPublished ? ["Published"] : []), "Name / host", "Recommended value"].map((h) => (_jsx("th", { className: "text-left text-xs uppercase tracking-wide text-text-muted py-2 px-2.5 border-b border-border", children: h }, h))) }) }), _jsx("tbody", { children: dnsSetup.map((check) => (_jsxs("tr", { children: [_jsxs("td", { className: "py-2.5 px-2.5 border-b border-border", children: [RECORD_TYPE_LABELS[check.type], _jsxs("div", { className: "text-xs text-text-muted", children: ["Type: ", check.recordKind] }), RECORD_TYPE_HELP[check.type] && (_jsx("div", { className: "text-xs text-text-muted mt-1 max-w-xs", children: RECORD_TYPE_HELP[check.type] })), check.legacyApex && (_jsxs("div", { className: "text-xs text-text-muted mt-1 max-w-xs", children: ["Found at the domain's root (the old location). Publish it at ", _jsx("strong", { children: check.recordName }), "; the root value can then be removed."] }))] }), _jsx("td", { className: "py-2.5 px-2.5 border-b border-border", children: !check.configured ? (_jsx("span", { className: "text-xs text-text-muted", children: "Not configured" })) : check.matches ? (_jsx("span", { className: "text-xs font-bold uppercase tracking-wide py-0.5 px-2 rounded-pill bg-success text-white", children: "Live" })) : (_jsx("span", { className: "text-xs font-bold uppercase tracking-wide py-0.5 px-2 rounded-pill bg-surface-alt text-text-muted", children: "Not found" })) }), showPublished && (_jsx("td", { className: "py-2.5 px-2.5 border-b border-border", children: _jsx(PublishedCell, { check: check, queued: takeOverQueued.includes(check.type), onTakeOver: () => {
+                                                        setTakeOverError(null);
+                                                        setTakeOver(check);
+                                                    } }) })), _jsx("td", { className: "py-2.5 px-2.5 border-b border-border text-text-muted min-w-[10rem]", children: check.recordName ? (_jsx(CopyableValue, { value: check.recordName, copyLabel: `Copy name for the ${RECORD_TYPE_NAMES[check.type]} record` })) : (_jsx("code", { className: "text-xs", children: "\u2014" })) }), _jsx("td", { className: "py-2.5 px-2.5 border-b border-border text-text-muted", children: check.recommendedValue ? (_jsx(DnsRecordValue, { check: check, value: check.recommendedValue })) : (_jsx("code", { className: "text-xs", children: "\u2014" })) })] }, check.type))) })] }) }), _jsxs("p", { className: "text-xs text-text-muted mt-3", children: ["Some DNS providers want the name relative to the domain (for example ", _jsx("code", { children: "@" }), " for the domain itself) rather than the full name."] })] })), _jsx(Modal, { open: takeOver !== null, onClose: () => setTakeOver(null), title: "Take over this record", children: takeOver && (_jsxs(_Fragment, { children: [_jsxs("p", { className: "text-sm mb-3", children: ["Taking over overwrites the record at ", _jsx("code", { className: "text-xs break-all", children: takeOver.recordName }), " with the value below. From then on RapidMX manages it, and whatever relied on the old value stops getting it."] }), _jsxs("dl", { className: "text-sm flex flex-col gap-1 mb-3", children: [_jsx("dt", { className: "text-text-muted", children: "Existing value" }), _jsx("dd", { children: takeOver.actualValue ? _jsx("code", { className: "text-xs break-all", children: takeOver.actualValue }) : "(none found)" }), _jsx("dt", { className: "text-text-muted mt-2", children: "New value" }), _jsx("dd", { children: _jsx("code", { className: "text-xs break-all", children: takeOver.recommendedValue }) })] }), takeOverError && _jsx(Alert, { children: takeOverError }), _jsxs("div", { className: "flex gap-3 justify-end mt-5", children: [_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", disabled: takingOver, onClick: () => setTakeOver(null), children: "Cancel" }), _jsx(Button, { type: "button", className: "!w-auto", loading: takingOver, disabled: takingOver, onClick: handleTakeOver, children: "Take over" })] })] })) })] }));
+}
+/** How a record is published, for the Published column: automatically (with its state; for a conflict also the value in the way and the takeover), or
+ * by hand, with the reason. */
+function PublishedCell({ check, queued, onTakeOver }) {
+    if (!check.publication) {
+        return _jsx("span", { className: "text-xs text-text-muted", children: "\u2014" });
+    }
+    if (check.publication === "manual") {
+        return (_jsxs(_Fragment, { children: [_jsx("span", { className: "text-xs font-bold uppercase tracking-wide py-0.5 px-2 rounded-pill bg-surface-alt text-text-muted", children: "Manual" }), check.manualReason && _jsx("div", { className: "text-xs text-text-muted mt-1 max-w-xs", children: MANUAL_REASONS[check.manualReason] })] }));
+    }
+    const state = check.publication;
+    return (_jsxs(_Fragment, { children: [_jsxs("span", { className: `text-xs font-bold uppercase tracking-wide py-0.5 px-2 rounded-pill ${state === "published" ? "bg-success text-white" : state === "conflict" ? "bg-danger-bg text-danger" : "bg-surface-alt text-text-muted"}`, children: ["Automatic: ", state] }), state === "conflict" && check.conflictReason === "type_mismatch" && _jsx(TypeMismatchNotice, { existing: check.existing }), state === "conflict" && check.conflictReason !== "type_mismatch" && (_jsxs("div", { className: "text-xs mt-1 max-w-xs", children: [check.actualValue ? (_jsxs(_Fragment, { children: ["Not published by RapidMX, and in the way: ", _jsx("code", { className: "break-all", children: check.actualValue })] })) : ("A record is there that this deployment doesn't own."), check.type !== "spf" && (_jsx("div", { className: "mt-1.5", children: _jsx(Button, { type: "button", variant: "secondary", className: "!w-auto !py-1", "aria-label": `Take over ${RECORD_TYPE_NAMES[check.type]}`, disabled: queued, onClick: onTakeOver, children: queued ? "Queued" : "Take over" }) }))] }))] }));
 }
 /** The value cell of a checklist row: an MX value as its two form fields (priority and mail server), a SRV value as
  * its four form fields (priority, weight, port and target), anything else whole. */

package/dist/apps/shared/components/admin/setup/SetupWizard.js

@@ -176,6 +176,9 @@ function DomainStep({ domains, onCreated }) {
     const [name, setName] = useState("");
     const [error, setError] = useState(null);
     const [saving, setSaving] = useState(false);
+    // The installation adds the domains it was installed with before anyone signs in: they're shown as already added.
+    const seeded = domains.filter((domain) => domain.origin === "seed");
+    const added = domains.filter((domain) => domain.origin !== "seed");
     async function handleSubmit(e) {
         e.preventDefault();
         setError(null);
@@ -195,7 +198,12 @@ function DomainStep({ domains, onCreated }) {
             setSaving(false);
         }
     }
-    return (_jsxs("div", { className: "flex flex-col gap-5 max-w-3xl", children: [domains.map((domain) => (_jsxs("div", { className: "flex flex-col gap-3", children: [_jsx("h3", { className: "text-base font-bold", children: domain.name }), _jsx(DomainDnsSetup, { uid: domain.uid })] }, domain.uid))), error && _jsx(Alert, { children: error }), _jsxs("form", { onSubmit: handleSubmit, className: CARD_CLASS, children: [_jsx(FormField, { label: domains.length === 0 ? "Domain name" : "Add another domain", htmlFor: "setupDomainName", children: _jsx("input", { id: "setupDomainName", type: "text", className: INPUT_CLASS, value: name, onChange: (e) => setName(e.target.value), placeholder: "example.com" }) }), _jsx(Button, { type: "submit", loading: saving, disabled: saving, className: "!w-auto", children: "Add domain" })] })] }));
+    return (_jsxs("div", { className: "flex flex-col gap-5 max-w-3xl", children: [seeded.length > 0 && (_jsxs("section", { "aria-labelledby": "setupSeededDomains", className: "flex flex-col gap-5", children: [_jsxs("div", { className: "flex flex-col gap-1", children: [_jsx("h3", { id: "setupSeededDomains", className: "text-sm font-bold uppercase tracking-wide", children: "Added from your installation" }), _jsx("p", { className: "text-sm text-text-muted", children: "Your installation already added these domains. Publish the DNS records for each one." })] }), seeded.map((domain) => (_jsx(DomainPanel, { domain: domain, grouped: true }, domain.uid)))] })), seeded.length > 0 && added.length > 0 ? (_jsxs("section", { "aria-labelledby": "setupAddedDomains", className: "flex flex-col gap-5", children: [_jsx("h3", { id: "setupAddedDomains", className: "text-sm font-bold uppercase tracking-wide", children: "Domains you added" }), added.map((domain) => (_jsx(DomainPanel, { domain: domain, grouped: true }, domain.uid)))] })) : (added.map((domain) => _jsx(DomainPanel, { domain: domain }, domain.uid))), error && _jsx(Alert, { children: error }), _jsxs("form", { onSubmit: handleSubmit, className: CARD_CLASS, children: [_jsx(FormField, { label: domains.length === 0 ? "Domain name" : "Add another domain", htmlFor: "setupDomainName", children: _jsx("input", { id: "setupDomainName", type: "text", className: INPUT_CLASS, value: name, onChange: (e) => setName(e.target.value), placeholder: "example.com" }) }), _jsx(Button, { type: "submit", loading: saving, disabled: saving, className: "!w-auto", children: "Add domain" })] })] }));
+}
+// `grouped`: the panel sits under a region's own heading, so its domain heading is one level lower.
+function DomainPanel({ domain, grouped = false }) {
+    const Heading = grouped ? "h4" : "h3";
+    return (_jsxs("div", { className: "flex flex-col gap-3", children: [_jsx(Heading, { className: "text-base font-bold", children: domain.name }), _jsx(DomainDnsSetup, { uid: domain.uid })] }));
 }
 function MailboxesStep({ userUid, domain }) {
     const client = useApiClient();

package/dist/lib/admin/configKeysApi.d.ts

@@ -0,0 +1,96 @@
+/**
+ * Typed wrappers over `@rapidmx/restapi`'s `BaseConfigKeyRoute` (mounted at `system/config-keys`): the keyring that encrypts the credentials, API keys and
+ * tokens saved in the console, and the rotation of its keys. `GET` needs a trusted role; both writes a trusted role and an elevated token. Never any key
+ * material: a key is its `kid`, its age and how many values it encrypts.
+ */
+import { ApiClient } from "../util/api.js";
+/** Where a rotation is (restapi `ConfigKeyRotationPhase`). */
+export type ConfigKeyRotationPhase = "adding" | "activating" | "reencrypting" | "retiring" | "done" | "failed";
+/** One key of the ring (restapi `PublicConfigKey`). */
+export interface ConfigKeyInfo {
+    kid: string;
+    /** ISO 8601. */
+    createdAt: string;
+    /** Whether the server copy that answered encrypts with it. */
+    active: boolean;
+    /** The values encrypted with it at the end of the last re-encryption pass; left out until one has counted. */
+    envelopes?: number;
+}
+/** The current or last rotation (restapi `PublicConfigKeyRotation`). */
+export interface ConfigKeyRotation {
+    /** The new key, once it is in the keyring. */
+    kid?: string;
+    /** The keys it replaces. */
+    previousKids: string[];
+    compromised: boolean;
+    requestedBy: string;
+    requestedAt: string;
+    phase: ConfigKeyRotationPhase;
+    activationStartedAt?: string;
+    /** The server copies (pod name and process id) that haven't yet loaded the new key while it is `activating`, and, once activated, those that don't yet
+     * encrypt with it. */
+    waitingFor?: string[];
+    activatedAt?: string;
+    /** Set by "Activate anyway", with the copies that hadn't loaded the key then. */
+    activationForced?: {
+        by: string;
+        at: string;
+        staleCopies: string[];
+    };
+    finishedAt?: string;
+    /** What failed (a keyring write refused, for example), never a value. */
+    lastError?: string;
+    /** Why the new key is still not active and what resolves it, once the wait has gone on past `config_encryption:activation:warn_minutes`. */
+    warning?: string;
+}
+/** A saved value the last re-encryption pass couldn't decrypt: named by record and field, never its value. */
+export interface ConfigKeyUnreadable {
+    record: string;
+    uid: string;
+    field: string;
+    /** The key the envelope names. */
+    kid: string;
+}
+export interface ConfigKeyReencryption {
+    targetKid: string;
+    /** Whether the last pass saw every row and saved every change. */
+    complete: boolean;
+    startedAt: string;
+    finishedAt?: string;
+    unreadable?: ConfigKeyUnreadable[];
+}
+/** The plugin secret settings' encryption (spec 5.7). */
+export interface PluginSecretsState {
+    /** When the first encryption run completed; until then secret settings are saved in plain text. */
+    encryptedAt?: string;
+    waitingForRollout?: boolean;
+    checkedAt?: string;
+    /** Why the run is still waiting (old pods, or the pods can't be listed). */
+    reason?: string;
+}
+/** What `GET /system/config-keys` and both writes answer (restapi `PublicConfigKeys`). */
+export interface ConfigKeys {
+    /** Whether a rotation can be started: the keyring is in a store the server can write, and the server copies can be coordinated. */
+    available: boolean;
+    activeKid: string | null;
+    keys: ConfigKeyInfo[];
+    /** When the values were last counted. */
+    countedAt: string | null;
+    rotation: ConfigKeyRotation | null;
+    reencryption: ConfigKeyReencryption | null;
+    pluginSecrets: PluginSecretsState | null;
+}
+/** `client`, given by every function below, is an explicit `ApiClient` from `createApiClient()` (e.g. one
+ * account of a multi-account app) to call instead of the default global `apiFetch()` - see `withClient()`'s
+ * own doc comment in `util/api.ts`. Omitted (the default), every function here behaves exactly as before. */
+export declare function getConfigKeys(client?: ApiClient): Promise<ConfigKeys>;
+/** Starts a rotation of the configuration key. With `compromised`, it also marks a rotation already running as compromised. Needs an elevated token. A 409
+ * (one is running) carries its progress: see `configKeysOfRefusal()`. */
+export declare function rotateConfigKey(input?: {
+    compromised?: boolean;
+}, client?: ApiClient): Promise<ConfigKeys>;
+/** "Activate anyway": makes the rotation's new key the one that encrypts before every server copy has loaded it. A 409 (the rotation isn't waiting to be
+ * activated, or `kid` isn't its key) carries its progress. Needs an elevated token. */
+export declare function activateConfigKey(kid: string, client?: ApiClient): Promise<ConfigKeys>;
+/** The keyring's state a 409 carries as its body (a rotation already running, or not waiting to be activated), `undefined` for any other failure. */
+export declare function configKeysOfRefusal(err: unknown): ConfigKeys | undefined;

package/dist/lib/admin/configKeysApi.js

@@ -0,0 +1,34 @@
+///////////////////////////////////////////////////////////////////////////////
+// Copyright (C) 2026 Jean-Philippe Steinmetz
+// SPDX-License-Identifier: MPL-2.0
+///////////////////////////////////////////////////////////////////////////////
+/**
+ * Typed wrappers over `@rapidmx/restapi`'s `BaseConfigKeyRoute` (mounted at `system/config-keys`): the keyring that encrypts the credentials, API keys and
+ * tokens saved in the console, and the rotation of its keys. `GET` needs a trusted role; both writes a trusted role and an elevated token. Never any key
+ * material: a key is its `kid`, its age and how many values it encrypts.
+ */
+import { ApiRequestError, withClient } from "../util/api.js";
+/** `client`, given by every function below, is an explicit `ApiClient` from `createApiClient()` (e.g. one
+ * account of a multi-account app) to call instead of the default global `apiFetch()` - see `withClient()`'s
+ * own doc comment in `util/api.ts`. Omitted (the default), every function here behaves exactly as before. */
+export function getConfigKeys(client) {
+    return withClient(client, "/system/config-keys");
+}
+/** Starts a rotation of the configuration key. With `compromised`, it also marks a rotation already running as compromised. Needs an elevated token. A 409
+ * (one is running) carries its progress: see `configKeysOfRefusal()`. */
+export function rotateConfigKey(input = {}, client) {
+    return withClient(client, "/system/config-keys/rotate", { method: "POST", body: JSON.stringify(input) });
+}
+/** "Activate anyway": makes the rotation's new key the one that encrypts before every server copy has loaded it. A 409 (the rotation isn't waiting to be
+ * activated, or `kid` isn't its key) carries its progress. Needs an elevated token. */
+export function activateConfigKey(kid, client) {
+    return withClient(client, "/system/config-keys/activate", { method: "POST", body: JSON.stringify({ kid }) });
+}
+/** The keyring's state a 409 carries as its body (a rotation already running, or not waiting to be activated), `undefined` for any other failure. */
+export function configKeysOfRefusal(err) {
+    if (!(err instanceof ApiRequestError) || err.status !== 409) {
+        return undefined;
+    }
+    const body = err.details;
+    return body && typeof body === "object" && Array.isArray(body.keys) ? body : undefined;
+}

package/dist/lib/admin/dnsProvidersApi.d.ts

@@ -0,0 +1,172 @@
+/**
+ * Typed wrappers over `@rapidmx/restapi`'s `BaseDnsProviderRoute` (mounted at `system/dns-providers`): the DNS provider configs the server publishes
+ * domain records through, the provider types the console's form is built from, the operations the DNS controller runs for a config, and what the
+ * controller last said about itself. Reads need a trusted role; every write a trusted role and an elevated token. Credentials are write-only.
+ */
+import { ApiClient } from "../util/api.js";
+import type { DnsConflictReason, DnsExistingRecord, DnsManualReason, DnsPublicationState, DnsRecordType } from "./domainsApi.js";
+import type { SecretMask } from "./integrationsApi.js";
+export type DnsProviderType = "cloudflare" | "route53" | "rfc2136" | "google" | "azure";
+export type DnsProviderOptionValue = string | number | boolean | string[];
+export type DnsProviderOptionKind = "string" | "string-list" | "integer" | "boolean" | "enum";
+/** One non-secret option of a provider type (restapi `DnsProviderTypeInfo["options"]`). */
+export interface DnsProviderOptionSpec {
+    key: string;
+    label: string;
+    kind: DnsProviderOptionKind;
+    required: boolean;
+    /** What a value left out is saved as. */
+    default?: string | number | boolean;
+    /** The choices of an `enum`. */
+    values?: string[];
+    min?: number;
+    max?: number;
+    maxItems?: number;
+    description: string;
+    format?: string;
+}
+/** One credential field of a provider type: saved encrypted on the config, never shown again. */
+export interface DnsProviderSecretFieldSpec {
+    key: string;
+    label: string;
+    /** Always needed. One needed only in some configurations says when in `description`. */
+    required: boolean;
+    /** A file's content (Google's service-account JSON) rather than a token. */
+    multiLine?: boolean;
+    description: string;
+    format?: string;
+}
+/** What `GET /system/dns-providers/types` answers per type. */
+export interface DnsProviderTypeInfo {
+    type: DnsProviderType;
+    label: string;
+    externalDnsProvider: string;
+    /** Whether the type has been tested against the real service; the console marks the others "not yet live-tested". */
+    tested: boolean;
+    options: DnsProviderOptionSpec[];
+    secretFields: DnsProviderSecretFieldSpec[];
+    unsupportedRecordKinds: ("MX" | "SRV")[];
+    notes: string[];
+}
+/** What the DNS controller last reported about a config's external-dns instance; every field optional. */
+export interface DnsProviderStatus {
+    reportedAt?: string;
+    readyReplicas?: number;
+    image?: string;
+    lastRolloutAt?: string;
+    lastSyncAt?: string;
+    registryErrors?: number;
+    sourceErrors?: number;
+    providerErrors?: number;
+    ownerMismatchRecords?: number;
+    lastError?: string;
+}
+/** A provider config as the server shows it (restapi `PublicDnsProvider`): its credentials only as masks, one per key saved. */
+export interface DnsProvider {
+    uid: string;
+    name: string;
+    type: DnsProviderType;
+    zones: string[];
+    options: Record<string, DnsProviderOptionValue>;
+    credentials: Record<string, SecretMask>;
+    origin?: "installer" | "console";
+    enabled: boolean;
+    allowTakeover: boolean;
+    status?: DnsProviderStatus;
+    /** The domains assigned to this config. */
+    domainCount: number;
+    version: number;
+    dateCreated?: string;
+    dateModified?: string;
+}
+/** What a create or an update sends. `credentials` is write-only: a string sets a field, `null` clears it, leaving it out keeps it. */
+export interface DnsProviderInput {
+    name?: string;
+    /** Create only: a config's type never changes. */
+    type?: DnsProviderType;
+    zones?: string[];
+    options?: Record<string, DnsProviderOptionValue>;
+    credentials?: Record<string, string | null>;
+    enabled?: boolean;
+    allowTakeover?: boolean;
+    /** Update only: the version the change was made against; a newer one is a 409. */
+    version?: number;
+}
+export type DnsOperationType = "test" | "takeover" | "restore";
+export type DnsOperationState = "queued" | "running" | "succeeded" | "failed";
+/** One operation the DNS controller runs for a config (restapi `PublicDnsOperation`). */
+export interface DnsOperation {
+    uid: string;
+    type: DnsOperationType;
+    providerUid: string;
+    domainUid?: string;
+    /** `hosts-<provider uid>` for the takeover of the deployment's own host names, which has no domain. */
+    endpointSetId?: string;
+    state: DnsOperationState;
+    /** The controller's result, or why the operation was cancelled (`Cancelled: ...`). */
+    message?: string;
+    requestedBy?: string;
+    startedAt?: string;
+    finishedAt?: string;
+    dateCreated?: string;
+}
+/** What one status report of the controller is remembered by. */
+export interface DnsControllerReport {
+    controllerVersion: string;
+    desiredStateVersion?: number;
+    leaseHolder: boolean;
+    leaseIdentity: string;
+    at: string;
+}
+/** What `GET /system/dns-providers/controller` answers: what the DNS controller last said about itself, `null` for what it never said. */
+export interface DnsControllerState {
+    handshake: {
+        controllerVersion: string;
+        apiVersions: string[];
+        compatible: boolean;
+        selected?: string;
+        reason?: string;
+        at: string;
+    } | null;
+    lastReport: DnsControllerReport | null;
+    lastStandbyReport: DnsControllerReport | null;
+}
+/** `client`, given by every function below, is an explicit `ApiClient` from `createApiClient()` (e.g. one
+ * account of a multi-account app) to call instead of the default global `apiFetch()` - see `withClient()`'s
+ * own doc comment in `util/api.ts`. Omitted (the default), every function here behaves exactly as before. */
+export declare function listDnsProviders(client?: ApiClient): Promise<DnsProvider[]>;
+export declare function listDnsProviderTypes(client?: ApiClient): Promise<DnsProviderTypeInfo[]>;
+export declare function getDnsControllerState(client?: ApiClient): Promise<DnsControllerState>;
+export declare function getDnsProvider(uid: string, client?: ApiClient): Promise<DnsProvider>;
+export declare function createDnsProvider(input: DnsProviderInput, client?: ApiClient): Promise<DnsProvider>;
+export declare function updateDnsProvider(uid: string, input: DnsProviderInput, client?: ApiClient): Promise<DnsProvider>;
+/** Refused (409) while a domain is assigned to the config or a restore through it is still to run. */
+export declare function deleteDnsProvider(uid: string, client?: ApiClient): Promise<void>;
+/** Queues a credentials test the DNS controller runs; answers the queued operation. */
+export declare function testDnsProvider(uid: string, client?: ApiClient): Promise<DnsOperation>;
+/** Queues the takeover of a domain's records that this deployment doesn't own yet: the DNS controller overwrites them with the wanted values. `records`
+ * are the record types to take over, all the domain publishes through the config when left out; never the root TXT set (`spf`). Answers the queued
+ * operation. */
+export declare function takeoverDnsRecords(uid: string, domainUid: string, records?: DnsRecordType[], client?: ApiClient): Promise<DnsOperation>;
+/** Queues the takeover of the deployment's own host names (`mail.<domain>`, `auth.<domain>` and the like) that this config publishes and that something
+ * else created: the DNS controller overwrites them with the wanted values. `records` are the host names to take over, all the config publishes when left
+ * out; a host whose records of another type are in the way (`type_mismatch`) is left out, or refused when named. Answers the queued operation. */
+export declare function takeoverDnsHosts(uid: string, records?: string[], client?: ApiClient): Promise<DnsOperation>;
+/** Why a host name isn't published automatically: a domain record's reasons, or no public address or no mail host to point at. */
+export type DnsHostManualReason = DnsManualReason | "no_addresses" | "no_target";
+/** How one record of the deployment's own host names is published (`GET /system/dns-providers/hosts`, restapi `DnsRecordPublication`). */
+export interface DnsHostPublication {
+    type: string;
+    recordName: string;
+    recordKind: "A" | "AAAA" | "CNAME" | "MX" | "TXT" | "SRV";
+    state: DnsPublicationState;
+    manualReason?: DnsHostManualReason;
+    conflictReason?: DnsConflictReason;
+    existing?: DnsExistingRecord[];
+    /** The config that publishes it, which a takeover names. */
+    providerUid?: string;
+}
+/** The publication of each of the deployment's own host names, looked up live. Needs a trusted role; a server without DNS publishing answers 404. */
+export declare function listDnsHostPublications(client?: ApiClient): Promise<DnsHostPublication[]>;
+/** The config's latest operations, newest first. */
+export declare function listDnsProviderOperations(uid: string, client?: ApiClient): Promise<DnsOperation[]>;

package/dist/lib/admin/dnsProvidersApi.js

@@ -0,0 +1,70 @@
+///////////////////////////////////////////////////////////////////////////////
+// Copyright (C) 2026 Jean-Philippe Steinmetz
+// SPDX-License-Identifier: MPL-2.0
+///////////////////////////////////////////////////////////////////////////////
+/**
+ * Typed wrappers over `@rapidmx/restapi`'s `BaseDnsProviderRoute` (mounted at `system/dns-providers`): the DNS provider configs the server publishes
+ * domain records through, the provider types the console's form is built from, the operations the DNS controller runs for a config, and what the
+ * controller last said about itself. Reads need a trusted role; every write a trusted role and an elevated token. Credentials are write-only.
+ */
+import { withClient } from "../util/api.js";
+const BASE = "/system/dns-providers";
+/** The path of the config `uid`. */
+function providerPath(uid) {
+    return `${BASE}/${encodeURIComponent(uid)}`;
+}
+/** `client`, given by every function below, is an explicit `ApiClient` from `createApiClient()` (e.g. one
+ * account of a multi-account app) to call instead of the default global `apiFetch()` - see `withClient()`'s
+ * own doc comment in `util/api.ts`. Omitted (the default), every function here behaves exactly as before. */
+export function listDnsProviders(client) {
+    return withClient(client, BASE);
+}
+export function listDnsProviderTypes(client) {
+    return withClient(client, `${BASE}/types`);
+}
+export function getDnsControllerState(client) {
+    return withClient(client, `${BASE}/controller`);
+}
+export function getDnsProvider(uid, client) {
+    return withClient(client, providerPath(uid));
+}
+export function createDnsProvider(input, client) {
+    return withClient(client, BASE, { method: "POST", body: JSON.stringify(input) });
+}
+export function updateDnsProvider(uid, input, client) {
+    return withClient(client, providerPath(uid), { method: "PUT", body: JSON.stringify(input) });
+}
+/** Refused (409) while a domain is assigned to the config or a restore through it is still to run. */
+export function deleteDnsProvider(uid, client) {
+    return withClient(client, providerPath(uid), { method: "DELETE" });
+}
+/** Queues a credentials test the DNS controller runs; answers the queued operation. */
+export function testDnsProvider(uid, client) {
+    return withClient(client, `${providerPath(uid)}/test`, { method: "POST" });
+}
+/** Queues the takeover of a domain's records that this deployment doesn't own yet: the DNS controller overwrites them with the wanted values. `records`
+ * are the record types to take over, all the domain publishes through the config when left out; never the root TXT set (`spf`). Answers the queued
+ * operation. */
+export function takeoverDnsRecords(uid, domainUid, records, client) {
+    return withClient(client, `${providerPath(uid)}/takeover`, {
+        method: "POST",
+        body: JSON.stringify({ domainUid, ...(records ? { records } : {}) }),
+    });
+}
+/** Queues the takeover of the deployment's own host names (`mail.<domain>`, `auth.<domain>` and the like) that this config publishes and that something
+ * else created: the DNS controller overwrites them with the wanted values. `records` are the host names to take over, all the config publishes when left
+ * out; a host whose records of another type are in the way (`type_mismatch`) is left out, or refused when named. Answers the queued operation. */
+export function takeoverDnsHosts(uid, records, client) {
+    return withClient(client, `${providerPath(uid)}/takeover`, {
+        method: "POST",
+        body: JSON.stringify({ hosts: true, ...(records ? { records } : {}) }),
+    });
+}
+/** The publication of each of the deployment's own host names, looked up live. Needs a trusted role; a server without DNS publishing answers 404. */
+export function listDnsHostPublications(client) {
+    return withClient(client, `${BASE}/hosts`);
+}
+/** The config's latest operations, newest first. */
+export function listDnsProviderOperations(uid, client) {
+    return withClient(client, `${providerPath(uid)}/operations`);
+}