@rapidmx/web-client 0.4.0 → 0.5.0

package/dist/apps/admin/ingest-queue/index.js

@@ -8,6 +8,8 @@ import { ApiRequestError } from "@rapidmx/react-shared/util/api.js";
 import { listIngestQueue } from "@rapidmx/react-shared/mail/mailApi.js";
 import AdminShell from "../../shared/components/admin/layout/AdminShell.js";
 import Alert from "@rapidmx/react-shared/components/feedback/Alert.js";
+import Button from "@rapidmx/react-shared/components/buttons/Button.js";
+const PAGE_SIZE = 25;
 export function readMailboxUid() {
     if (typeof window === "undefined")
         return null;
@@ -24,6 +26,7 @@ export default function IngestQueuePage(props) {
 }
 function IngestQueueContent() {
     const [mailboxUid, setMailboxUid] = useState(null);
+    const [page, setPage] = useState(0);
     const [entries, setEntries] = useState([]);
     const [loading, setLoading] = useState(true);
     const [error, setError] = useState(null);
@@ -34,15 +37,30 @@ function IngestQueueContent() {
         if (!mailboxUid) {
             return;
         }
+        // Paging quickly can leave an older page's response landing last - only the latest request's is applied.
+        let cancelled = false;
         setLoading(true);
         setError(null);
-        listIngestQueue(mailboxUid)
-            .then(setEntries)
-            .catch((err) => setError(err instanceof ApiRequestError ? err.message : "Could not load the ingest queue."))
-            .finally(() => setLoading(false));
-    }, [mailboxUid]);
+        listIngestQueue(mailboxUid, { page, limit: PAGE_SIZE })
+            .then((data) => {
+            if (!cancelled)
+                setEntries(data);
+        })
+            .catch((err) => {
+            if (!cancelled)
+                setError(err instanceof ApiRequestError ? err.message : "Could not load the ingest queue.");
+        })
+            .finally(() => {
+            if (!cancelled)
+                setLoading(false);
+        });
+        return () => {
+            cancelled = true;
+        };
+    }, [mailboxUid, page]);
+    const hasNextPage = entries.length === PAGE_SIZE;
     if (!mailboxUid) {
         return _jsx(Alert, { children: "No mailbox specified. Open a mailbox's detail page and choose \"View ingest queue\"." });
     }
-    return (_jsxs("div", { className: "max-w-4xl flex flex-col gap-4", children: [_jsxs("div", { children: [_jsx("a", { href: `/admin/mailboxes/${encodeURIComponent(mailboxUid)}`, className: "text-sm text-primary-dark hover:underline", children: "\u2190 Back to mailbox" }), _jsx("h1", { className: "text-xl font-bold uppercase tracking-wide mt-1", children: "Ingest queue" })] }), error && _jsx(Alert, { children: error }), loading ? (_jsx("p", { className: "text-sm text-text-muted", children: "Loading\u2026" })) : entries.length === 0 ? (_jsx("p", { className: "text-sm text-text-muted", children: "Nothing pending or failed for this mailbox." })) : (_jsx("div", { className: "overflow-x-auto", children: _jsxs("table", { className: "w-full text-sm border-collapse", children: [_jsx("thead", { children: _jsx("tr", { children: ["From", "To", "Received", "Status", "Error"].map((h) => (_jsx("th", { className: "text-left text-xs uppercase tracking-wide text-text-muted py-2 px-2.5 border-b border-border", children: h }, h))) }) }), _jsx("tbody", { children: entries.map((entry) => (_jsxs("tr", { children: [_jsx("td", { className: "py-2.5 px-2.5 border-b border-border", children: entry.envelopeFrom }), _jsx("td", { className: "py-2.5 px-2.5 border-b border-border", children: entry.envelopeTo.join(", ") }), _jsx("td", { className: "py-2.5 px-2.5 border-b border-border", children: new Date(entry.dateCreated).toLocaleString() }), _jsx("td", { className: "py-2.5 px-2.5 border-b border-border", children: _jsx("span", { className: `inline-block text-xs font-bold uppercase tracking-wide py-0.5 px-2 rounded-pill ${STATUS_STYLES[entry.status]}`, children: entry.status }) }), _jsx("td", { className: "py-2.5 px-2.5 border-b border-border text-text-muted", children: entry.errorMessage ?? "" })] }, entry.uid))) })] }) }))] }));
+    return (_jsxs("div", { className: "max-w-4xl flex flex-col gap-4", children: [_jsxs("div", { children: [_jsx("a", { href: `/admin/mailboxes/${encodeURIComponent(mailboxUid)}`, className: "text-sm text-primary-dark hover:underline", children: "\u2190 Back to mailbox" }), _jsx("h1", { className: "text-xl font-bold uppercase tracking-wide mt-1", children: "Ingest queue" })] }), error && _jsx(Alert, { children: error }), loading ? (_jsx("p", { className: "text-sm text-text-muted", children: "Loading\u2026" })) : entries.length === 0 ? (_jsx("p", { className: "text-sm text-text-muted", children: "Nothing pending or failed for this mailbox." })) : (_jsx("div", { className: "overflow-x-auto", children: _jsxs("table", { className: "w-full text-sm border-collapse", children: [_jsx("thead", { children: _jsx("tr", { children: ["From", "To", "Received", "Status", "Error"].map((h) => (_jsx("th", { className: "text-left text-xs uppercase tracking-wide text-text-muted py-2 px-2.5 border-b border-border", children: h }, h))) }) }), _jsx("tbody", { children: entries.map((entry) => (_jsxs("tr", { children: [_jsx("td", { className: "py-2.5 px-2.5 border-b border-border", children: entry.envelopeFrom }), _jsx("td", { className: "py-2.5 px-2.5 border-b border-border", children: entry.envelopeTo.join(", ") }), _jsx("td", { className: "py-2.5 px-2.5 border-b border-border", children: new Date(entry.dateCreated).toLocaleString() }), _jsx("td", { className: "py-2.5 px-2.5 border-b border-border", children: _jsx("span", { className: `inline-block text-xs font-bold uppercase tracking-wide py-0.5 px-2 rounded-pill ${STATUS_STYLES[entry.status]}`, children: entry.status }) }), _jsx("td", { className: "py-2.5 px-2.5 border-b border-border text-text-muted", children: entry.errorMessage ?? "" })] }, entry.uid))) })] }) })), _jsxs("div", { className: "flex gap-3 items-center", children: [_jsx(Button, { variant: "secondary", type: "button", className: "!w-auto", disabled: page === 0 || loading, onClick: () => setPage((p) => Math.max(0, p - 1)), children: "Previous" }), _jsxs("span", { className: "text-sm text-text-muted", children: ["Page ", page + 1] }), _jsx(Button, { variant: "secondary", type: "button", className: "!w-auto", disabled: !hasNextPage || loading, onClick: () => setPage((p) => p + 1), children: "Next" })] })] }));
 }

package/dist/apps/admin/mailboxes/[uid].js

@@ -9,6 +9,7 @@ import { deleteMailbox, getMailbox, impersonateUser } from "@rapidmx/react-share
 import AdminShell from "../../shared/components/admin/layout/AdminShell.js";
 import ShareAccessCard from "../../shared/components/admin/mailboxes/ShareAccessCard.js";
 import ResourceSettingsCard from "../../shared/components/admin/mailboxes/ResourceSettingsCard.js";
+import EscrowScopeCard from "../../shared/components/admin/mailboxes/EscrowScopeCard.js";
 import Alert from "@rapidmx/react-shared/components/feedback/Alert.js";
 import Button from "@rapidmx/react-shared/components/buttons/Button.js";
 import Modal from "@rapidmx/react-shared/components/overlays/Modal.js";
@@ -28,22 +29,37 @@ function MailboxDetailContent({ uid, impersonationBaseUrl }) {
     const [mailbox, setMailbox] = useState(null);
     const [loading, setLoading] = useState(true);
     const [error, setError] = useState(null);
+    const [confirmingAccess, setConfirmingAccess] = useState(false);
     const [impersonating, setImpersonating] = useState(false);
+    const [accessError, setAccessError] = useState(null);
     const [confirmingDelete, setConfirmingDelete] = useState(false);
     const [deleting, setDeleting] = useState(false);
     const [deleteError, setDeleteError] = useState(null);
-    async function handleAccessMailbox(ownerUserUid) {
+    // Ignored while the action is under way (Escape/Close; Cancel is disabled then too), so its result or error
+    // can't land on a modal reopened afterwards.
+    function closeAccessModal() {
+        if (impersonating)
+            return;
+        setConfirmingAccess(false);
+        setAccessError(null);
+    }
+    // Only ever invoked from the access-confirmation modal below, which only renders for a loaded mailbox that has
+    // an owner. A failure stays in the modal rather than replacing the whole page.
+    async function handleAccessMailbox() {
         setImpersonating(true);
+        setAccessError(null);
         try {
-            await impersonateUser(impersonationBaseUrl ?? "", ownerUserUid);
+            await impersonateUser(impersonationBaseUrl ?? "", mailbox.ownerUserUid);
             window.location.href = "/";
         }
         catch (err) {
-            setError(err instanceof ApiRequestError ? err.message : "Could not access this mailbox.");
+            setAccessError(err instanceof ApiRequestError ? err.message : "Could not access this mailbox.");
             setImpersonating(false);
         }
     }
     function closeDeleteModal() {
+        if (deleting)
+            return;
         setConfirmingDelete(false);
     }
     // Only ever invoked from the delete-confirmation modal below, which itself only renders once
@@ -79,5 +95,5 @@ function MailboxDetailContent({ uid, impersonationBaseUrl }) {
     }
     const quarantineHref = `/admin/quarantine?mailboxUid=${encodeURIComponent(mailbox.uid)}`;
     const ingestQueueHref = `/admin/ingest-queue?mailboxUid=${encodeURIComponent(mailbox.uid)}`;
-    return (_jsxs("div", { className: "max-w-3xl flex flex-col gap-5", children: [_jsxs("div", { className: "flex items-start justify-between gap-4", children: [_jsxs("div", { children: [_jsx("a", { href: "/admin", className: "text-sm text-primary-dark hover:underline", children: "\u2190 All mailboxes" }), _jsx("h1", { className: "text-xl font-bold tracking-tight mt-1", children: mailbox.primarySmtpAddress })] }), _jsxs("div", { className: "flex gap-3 shrink-0", children: [mailbox.ownerUserUid && (_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", loading: impersonating, disabled: impersonating, onClick: () => handleAccessMailbox(mailbox.ownerUserUid), children: "Access this mailbox" })), _jsx(Button, { type: "button", variant: "secondary", className: "!w-auto !border-danger !text-danger hover:!border-danger hover:!text-danger", onClick: () => setConfirmingDelete(true), children: "Delete mailbox" })] })] }), _jsxs("div", { className: "bg-surface border border-border rounded-md p-6", children: [_jsxs("dl", { className: "grid grid-cols-1 sm:grid-cols-2 gap-x-6 gap-y-3 text-sm", children: [_jsx("dt", { className: "text-text-muted", children: "Display name" }), _jsx("dd", { children: mailbox.displayName }), _jsx("dt", { className: "text-text-muted", children: "Owner" }), _jsx("dd", { children: mailbox.ownerUserUid ?? "None (shared mailbox)" }), _jsx("dt", { className: "text-text-muted", children: "Timezone" }), _jsx("dd", { children: mailbox.timezone }), _jsx("dt", { className: "text-text-muted", children: "Quota" }), _jsxs("dd", { children: [formatBytes(mailbox.usedBytes), " / ", formatBytes(mailbox.quotaBytes)] }), _jsx("dt", { className: "text-text-muted", children: "Alias addresses" }), _jsx("dd", { children: mailbox.aliasAddresses.length > 0 ? mailbox.aliasAddresses.join(", ") : "None" }), mailbox.isResource && (_jsxs(_Fragment, { children: [_jsx("dt", { className: "text-text-muted", children: "Resource type" }), _jsx("dd", { className: "capitalize", children: mailbox.resourceType ?? "room" })] })), _jsx("dt", { className: "text-text-muted", children: "Created" }), _jsx("dd", { children: new Date(mailbox.dateCreated).toLocaleString() })] }), _jsxs("div", { className: "flex gap-4 mt-5 pt-5 border-t border-border text-sm font-medium", children: [_jsx("a", { href: quarantineHref, className: "text-primary-dark hover:underline", children: "View quarantine" }), _jsx("a", { href: ingestQueueHref, className: "text-primary-dark hover:underline", children: "View ingest queue" })] })] }), _jsx(ShareAccessCard, { mailboxUid: mailbox.uid }), mailbox.isResource && _jsx(ResourceSettingsCard, { mailbox: mailbox, onUpdate: setMailbox }), _jsxs(Modal, { open: confirmingDelete, onClose: closeDeleteModal, title: "Delete mailbox", children: [_jsxs("p", { className: "text-sm mb-5", children: ["Are you sure you want to delete ", _jsx("strong", { children: mailbox.primarySmtpAddress }), "? This permanently deletes the mailbox and everything in it, and cannot be undone. It fails if this mailbox is a custodian on an active legal hold."] }), deleteError && _jsx(Alert, { children: deleteError }), _jsxs("div", { className: "flex gap-3 justify-end mt-5", children: [_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", disabled: deleting, onClick: closeDeleteModal, children: "Cancel" }), _jsx(Button, { type: "button", className: "!w-auto !bg-none !bg-danger !border-danger hover:!bg-danger", loading: deleting, disabled: deleting, onClick: handleDelete, children: "Delete" })] })] })] }));
+    return (_jsxs("div", { className: "max-w-3xl flex flex-col gap-5", children: [_jsxs("div", { className: "flex items-start justify-between gap-4", children: [_jsxs("div", { children: [_jsx("a", { href: "/admin", className: "text-sm text-primary-dark hover:underline", children: "\u2190 All mailboxes" }), _jsx("h1", { className: "text-xl font-bold tracking-tight mt-1", children: mailbox.primarySmtpAddress })] }), _jsxs("div", { className: "flex gap-3 shrink-0", children: [mailbox.ownerUserUid && (_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", onClick: () => setConfirmingAccess(true), children: "Access this mailbox" })), _jsx(Button, { type: "button", variant: "secondary", className: "!w-auto !border-danger !text-danger hover:!border-danger hover:!text-danger", onClick: () => setConfirmingDelete(true), children: "Delete mailbox" })] })] }), _jsxs("div", { className: "bg-surface border border-border rounded-md p-6", children: [_jsxs("dl", { className: "grid grid-cols-1 sm:grid-cols-2 gap-x-6 gap-y-3 text-sm", children: [_jsx("dt", { className: "text-text-muted", children: "Display name" }), _jsx("dd", { children: mailbox.displayName }), _jsx("dt", { className: "text-text-muted", children: "Owner" }), _jsx("dd", { children: mailbox.ownerUserUid ?? "None (shared mailbox)" }), _jsx("dt", { className: "text-text-muted", children: "Timezone" }), _jsx("dd", { children: mailbox.timezone }), _jsx("dt", { className: "text-text-muted", children: "Quota" }), _jsxs("dd", { children: [formatBytes(mailbox.usedBytes), " / ", formatBytes(mailbox.quotaBytes)] }), _jsx("dt", { className: "text-text-muted", children: "Alias addresses" }), _jsx("dd", { children: mailbox.aliasAddresses.length > 0 ? mailbox.aliasAddresses.join(", ") : "None" }), mailbox.isResource && (_jsxs(_Fragment, { children: [_jsx("dt", { className: "text-text-muted", children: "Resource type" }), _jsx("dd", { className: "capitalize", children: mailbox.resourceType ?? "room" })] })), _jsx("dt", { className: "text-text-muted", children: "Created" }), _jsx("dd", { children: new Date(mailbox.dateCreated).toLocaleString() })] }), _jsxs("div", { className: "flex gap-4 mt-5 pt-5 border-t border-border text-sm font-medium", children: [_jsx("a", { href: quarantineHref, className: "text-primary-dark hover:underline", children: "View quarantine" }), _jsx("a", { href: ingestQueueHref, className: "text-primary-dark hover:underline", children: "View ingest queue" })] })] }), _jsx(ShareAccessCard, { mailboxUid: mailbox.uid, ownerUserUid: mailbox.ownerUserUid }), _jsx(EscrowScopeCard, { mailbox: mailbox, onUpdate: setMailbox }), mailbox.isResource && _jsx(ResourceSettingsCard, { mailbox: mailbox, onUpdate: setMailbox }), _jsxs(Modal, { open: confirmingAccess, onClose: closeAccessModal, title: "Access this mailbox", children: [_jsxs("p", { className: "text-sm mb-3", children: ["You\u2019ll be signed in as ", _jsx("strong", { className: "break-all", children: mailbox.ownerUserUid }), ", the owner of ", _jsx("strong", { className: "break-all", children: mailbox.primarySmtpAddress }), ", and see everything they can - and act as them, until you stop impersonating."] }), accessError && _jsx(Alert, { children: accessError }), _jsxs("div", { className: "flex gap-3 justify-end mt-5", children: [_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", disabled: impersonating, onClick: closeAccessModal, children: "Cancel" }), _jsx(Button, { type: "button", className: "!w-auto", loading: impersonating, disabled: impersonating, onClick: handleAccessMailbox, children: "Access mailbox" })] })] }), _jsxs(Modal, { open: confirmingDelete, onClose: closeDeleteModal, title: "Delete mailbox", children: [_jsxs("p", { className: "text-sm mb-5", children: ["Are you sure you want to delete ", _jsx("strong", { children: mailbox.primarySmtpAddress }), "? This permanently deletes the mailbox and everything in it, and cannot be undone. It fails if this mailbox is a custodian on an active legal hold."] }), deleteError && _jsx(Alert, { children: deleteError }), _jsxs("div", { className: "flex gap-3 justify-end mt-5", children: [_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", disabled: deleting, onClick: closeDeleteModal, children: "Cancel" }), _jsx(Button, { type: "button", className: "!w-auto !bg-none !bg-danger !border-danger hover:!bg-danger", loading: deleting, disabled: deleting, onClick: handleDelete, children: "Delete" })] })] })] }));
 }

package/dist/apps/admin/quarantine/index.js

@@ -9,6 +9,7 @@ import { listQuarantine, releaseQuarantineEntry } from "@rapidmx/react-shared/ma
 import AdminShell from "../../shared/components/admin/layout/AdminShell.js";
 import Alert from "@rapidmx/react-shared/components/feedback/Alert.js";
 import Button from "@rapidmx/react-shared/components/buttons/Button.js";
+import Modal from "@rapidmx/react-shared/components/overlays/Modal.js";
 const PAGE_SIZE = 25;
 export function readMailboxUid() {
     if (typeof window === "undefined")
@@ -24,7 +25,9 @@ function QuarantineContent({ userUid }) {
     const [entries, setEntries] = useState([]);
     const [loading, setLoading] = useState(true);
     const [error, setError] = useState(null);
-    const [releasing, setReleasing] = useState(null);
+    const [releaseTarget, setReleaseTarget] = useState(null);
+    const [releasing, setReleasing] = useState(false);
+    const [releaseError, setReleaseError] = useState(null);
     useEffect(() => {
         setMailboxUid(readMailboxUid());
     }, []);
@@ -42,25 +45,31 @@ function QuarantineContent({ userUid }) {
         }
     }, [mailboxUid, page]);
     const hasNextPage = entries.length === PAGE_SIZE;
-    // Only ever invoked from the "Release" button below, which itself only renders once `mailboxUid` is
-    // known and `AdminShell` has already confirmed `userUid` (children only render once authorized) — both
-    // non-null assertions reflect that real invariant, not an unchecked assumption.
-    async function handleRelease(entry) {
-        setReleasing(entry.uid);
-        setError(null);
+    function closeReleaseModal() {
+        setReleaseTarget(null);
+        setReleaseError(null);
+    }
+    // Only ever invoked from the confirmation modal below, which only renders once `releaseTarget` is set, once
+    // `mailboxUid` is known, and once `AdminShell` has confirmed `userUid` (children only render once authorized).
+    // `releaseQuarantineEntry()` still sends its own `releasedAt`/`releasedByUserUid`; the server now stamps both
+    // itself and ignores the client's values, so what's displayed afterwards comes from the reloaded list.
+    async function handleRelease() {
+        setReleasing(true);
+        setReleaseError(null);
         try {
-            await releaseQuarantineEntry(entry.uid, entry.version, userUid);
+            await releaseQuarantineEntry(releaseTarget.uid, releaseTarget.version, userUid);
+            closeReleaseModal();
             reload(mailboxUid);
         }
         catch (err) {
-            setError(err instanceof ApiRequestError ? err.message : "Could not release this message.");
+            setReleaseError(err instanceof ApiRequestError ? err.message : "Could not mark this message released.");
         }
         finally {
-            setReleasing(null);
+            setReleasing(false);
         }
     }
     if (!mailboxUid) {
         return _jsx(Alert, { children: "No mailbox specified. Open a mailbox's detail page and choose \"View quarantine\"." });
     }
-    return (_jsxs("div", { className: "max-w-4xl flex flex-col gap-4", children: [_jsxs("div", { children: [_jsx("a", { href: `/admin/mailboxes/${encodeURIComponent(mailboxUid)}`, className: "text-sm text-primary-dark hover:underline", children: "\u2190 Back to mailbox" }), _jsx("h1", { className: "text-xl font-bold uppercase tracking-wide mt-1", children: "Quarantine" })] }), error && _jsx(Alert, { children: error }), loading ? (_jsx("p", { className: "text-sm text-text-muted", children: "Loading\u2026" })) : entries.length === 0 ? (_jsx("p", { className: "text-sm text-text-muted", children: "Nothing quarantined for this mailbox." })) : (_jsx("div", { className: "overflow-x-auto", children: _jsxs("table", { className: "w-full text-sm border-collapse", children: [_jsx("thead", { children: _jsx("tr", { children: ["Reason", "Quarantined", "Status", ""].map((h) => (_jsx("th", { className: "text-left text-xs uppercase tracking-wide text-text-muted py-2 px-2.5 border-b border-border", children: h }, h))) }) }), _jsx("tbody", { children: entries.map((entry) => (_jsxs("tr", { children: [_jsx("td", { className: "py-2.5 px-2.5 border-b border-border", children: entry.reason }), _jsx("td", { className: "py-2.5 px-2.5 border-b border-border", children: new Date(entry.dateCreated).toLocaleString() }), _jsx("td", { className: "py-2.5 px-2.5 border-b border-border", children: entry.releasedAt ? (_jsx("span", { className: "text-xs font-bold uppercase tracking-wide py-0.5 px-2 rounded-pill bg-success text-white", children: "Released" })) : (_jsx("span", { className: "text-xs font-bold uppercase tracking-wide py-0.5 px-2 rounded-pill bg-surface-alt text-text-muted", children: "Held" })) }), _jsx("td", { className: "py-2.5 px-2.5 border-b border-border text-right", children: !entry.releasedAt && (_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", loading: releasing === entry.uid, disabled: releasing === entry.uid, onClick: () => handleRelease(entry), children: "Release" })) })] }, entry.uid))) })] }) })), _jsxs("div", { className: "flex gap-3 items-center mt-4", children: [_jsx(Button, { variant: "secondary", type: "button", className: "!w-auto", disabled: page === 0 || loading, onClick: () => setPage((p) => Math.max(0, p - 1)), children: "Previous" }), _jsxs("span", { className: "text-sm text-text-muted", children: ["Page ", page + 1] }), _jsx(Button, { variant: "secondary", type: "button", className: "!w-auto", disabled: !hasNextPage || loading, onClick: () => setPage((p) => p + 1), children: "Next" })] })] }));
+    return (_jsxs("div", { className: "max-w-4xl flex flex-col gap-4", children: [_jsxs("div", { children: [_jsx("a", { href: `/admin/mailboxes/${encodeURIComponent(mailboxUid)}`, className: "text-sm text-primary-dark hover:underline", children: "\u2190 Back to mailbox" }), _jsx("h1", { className: "text-xl font-bold uppercase tracking-wide mt-1", children: "Quarantine" })] }), error && _jsx(Alert, { children: error }), loading ? (_jsx("p", { className: "text-sm text-text-muted", children: "Loading\u2026" })) : entries.length === 0 ? (_jsx("p", { className: "text-sm text-text-muted", children: "Nothing quarantined for this mailbox." })) : (_jsx("div", { className: "overflow-x-auto", children: _jsxs("table", { className: "w-full text-sm border-collapse", children: [_jsx("thead", { children: _jsx("tr", { children: ["Reason", "Quarantined", "Status", ""].map((h) => (_jsx("th", { className: "text-left text-xs uppercase tracking-wide text-text-muted py-2 px-2.5 border-b border-border", children: h }, h))) }) }), _jsx("tbody", { children: entries.map((entry) => (_jsxs("tr", { children: [_jsx("td", { className: "py-2.5 px-2.5 border-b border-border", children: entry.reason }), _jsx("td", { className: "py-2.5 px-2.5 border-b border-border", children: new Date(entry.dateCreated).toLocaleString() }), _jsx("td", { className: "py-2.5 px-2.5 border-b border-border", children: entry.releasedAt ? (_jsx("span", { className: "text-xs font-bold uppercase tracking-wide py-0.5 px-2 rounded-pill bg-success text-white", children: "Released" })) : (_jsx("span", { className: "text-xs font-bold uppercase tracking-wide py-0.5 px-2 rounded-pill bg-surface-alt text-text-muted", children: "Held" })) }), _jsx("td", { className: "py-2.5 px-2.5 border-b border-border text-right", children: !entry.releasedAt && (_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", onClick: () => setReleaseTarget(entry), children: "Mark released" })) })] }, entry.uid))) })] }) })), _jsxs("div", { className: "flex gap-3 items-center mt-4", children: [_jsx(Button, { variant: "secondary", type: "button", className: "!w-auto", disabled: page === 0 || loading, onClick: () => setPage((p) => Math.max(0, p - 1)), children: "Previous" }), _jsxs("span", { className: "text-sm text-text-muted", children: ["Page ", page + 1] }), _jsx(Button, { variant: "secondary", type: "button", className: "!w-auto", disabled: !hasNextPage || loading, onClick: () => setPage((p) => p + 1), children: "Next" })] }), _jsxs(Modal, { open: releaseTarget !== null, onClose: closeReleaseModal, title: "Mark message released", children: [_jsxs("dl", { className: "grid grid-cols-[auto_1fr] gap-x-4 gap-y-1 text-sm mb-4", children: [_jsx("dt", { className: "text-text-muted", children: "Reason" }), _jsx("dd", { children: releaseTarget?.reason }), _jsx("dt", { className: "text-text-muted", children: "Quarantined" }), _jsx("dd", { children: releaseTarget && new Date(releaseTarget.dateCreated).toLocaleString() }), _jsx("dt", { className: "text-text-muted", children: "Message" }), _jsx("dd", { className: "break-all", children: releaseTarget?.originalMessageUid ?? "Not delivered to the mailbox" })] }), _jsx("p", { className: "text-sm mb-4", children: "This only records the entry as released (with you as the releaser). It does not deliver the message - if it\u2019s infected or unwanted, leave it held." }), releaseError && _jsx(Alert, { children: releaseError }), _jsxs("div", { className: "flex gap-3 justify-end", children: [_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", disabled: releasing, onClick: closeReleaseModal, children: "Cancel" }), _jsx(Button, { type: "button", className: "!w-auto", loading: releasing, disabled: releasing, onClick: handleRelease, children: "Mark released" })] })] })] }));
 }

package/dist/apps/admin/transport-rules/[uid].js

@@ -8,7 +8,7 @@ import { ApiRequestError } from "@rapidmx/react-shared/util/api.js";
 import { getTransportRule, updateTransportRule, } from "@rapidmx/react-shared/admin/transportRulesApi.js";
 import AdminShell from "../../shared/components/admin/layout/AdminShell.js";
 import RuleBuilder from "../../shared/components/rules/RuleBuilder.js";
-import { TRANSPORT_RULE_ACTION_TYPES, TRANSPORT_RULE_CONDITION_FIELDS } from "./_transportRuleConfig.js";
+import { checkRuleConditions, NO_CONDITIONS_BLOCKED_MESSAGE, NoConditionsConfirmModal, TRANSPORT_RULE_ACTION_TYPES, TRANSPORT_RULE_CONDITION_FIELDS, } from "./_transportRuleConfig.js";
 import Alert from "@rapidmx/react-shared/components/feedback/Alert.js";
 import Button from "@rapidmx/react-shared/components/buttons/Button.js";
 import FormField from "@rapidmx/react-shared/components/forms/FormField.js";
@@ -24,6 +24,8 @@ function TransportRuleDetailContent({ uid }) {
     const [error, setError] = useState(null);
     const [saving, setSaving] = useState(false);
     const [saved, setSaved] = useState(false);
+    const [showValidation, setShowValidation] = useState(false);
+    const [confirmingNoConditions, setConfirmingNoConditions] = useState(false);
     useEffect(() => {
         setLoading(true);
         setError(null);
@@ -55,6 +57,20 @@ function TransportRuleDetailContent({ uid }) {
             setError("A name is required.");
             return;
         }
+        const check = checkRuleConditions(rule);
+        if (check === "blocked") {
+            setShowValidation(true);
+            setError(NO_CONDITIONS_BLOCKED_MESSAGE);
+            return;
+        }
+        if (check === "confirm") {
+            setConfirmingNoConditions(true);
+            return;
+        }
+        await save();
+    }
+    async function save() {
+        setConfirmingNoConditions(false);
         setSaving(true);
         setSaved(false);
         try {
@@ -83,5 +99,5 @@ function TransportRuleDetailContent({ uid }) {
     if (!original || !rule) {
         return _jsx(Alert, { children: "Transport rule not found." });
     }
-    return (_jsxs("div", { className: "max-w-3xl", children: [_jsx("a", { href: "/admin/transport-rules", className: "text-sm text-primary-dark hover:underline", children: "\u2190 All transport rules" }), _jsx("h1", { className: "text-xl font-bold tracking-tight mt-1 mb-5", children: original.name }), error && _jsx(Alert, { children: error }), saved && !error && (_jsx("div", { className: "mb-4 text-sm text-success font-medium", children: "Saved." })), _jsxs("form", { onSubmit: handleSubmit, className: "flex flex-col gap-5", children: [_jsx("div", { className: "bg-surface border border-border rounded-md p-6", children: _jsx(FormField, { label: "Name", htmlFor: "name", children: _jsx("input", { id: "name", type: "text", className: INPUT_CLASS, value: name, onChange: (e) => setName(e.target.value) }) }) }), _jsx(RuleBuilder, { value: rule, onChange: setRule, conditionFields: TRANSPORT_RULE_CONDITION_FIELDS, actionTypes: TRANSPORT_RULE_ACTION_TYPES }), _jsx("div", { children: _jsx(Button, { type: "submit", loading: saving, disabled: saving, className: "!w-auto", children: "Save changes" }) })] })] }));
+    return (_jsxs("div", { className: "max-w-3xl", children: [_jsx("a", { href: "/admin/transport-rules", className: "text-sm text-primary-dark hover:underline", children: "\u2190 All transport rules" }), _jsx("h1", { className: "text-xl font-bold tracking-tight mt-1 mb-5", children: original.name }), error && _jsx(Alert, { children: error }), saved && !error && (_jsx("div", { className: "mb-4 text-sm text-success font-medium", children: "Saved." })), _jsxs("form", { onSubmit: handleSubmit, className: "flex flex-col gap-5", children: [_jsx("div", { className: "bg-surface border border-border rounded-md p-6", children: _jsx(FormField, { label: "Name", htmlFor: "name", children: _jsx("input", { id: "name", type: "text", className: INPUT_CLASS, value: name, onChange: (e) => setName(e.target.value) }) }) }), _jsx(RuleBuilder, { value: rule, onChange: setRule, conditionFields: TRANSPORT_RULE_CONDITION_FIELDS, actionTypes: TRANSPORT_RULE_ACTION_TYPES, showValidation: showValidation }), _jsx("div", { children: _jsx(Button, { type: "submit", loading: saving, disabled: saving, className: "!w-auto", children: "Save changes" }) })] }), _jsx(NoConditionsConfirmModal, { open: confirmingNoConditions, onCancel: () => setConfirmingNoConditions(false), onConfirm: () => void save() })] }));
 }

package/dist/apps/admin/transport-rules/_transportRuleConfig.js

@@ -1,4 +1,23 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import Button from "@rapidmx/react-shared/components/buttons/Button.js";
+import Modal from "@rapidmx/react-shared/components/overlays/Modal.js";
+import { hasConditions } from "../../shared/components/rules/RuleBuilder.js";
+/** Refused outright when a rule has no conditions: it would reject or quarantine every message the server receives. */
+export const NO_CONDITIONS_BLOCKED_MESSAGE = "Add at least one condition. A rule without conditions that rejects or quarantines mail would do so for every message.";
+/**
+ * How a save should proceed given a rule's conditions: `"ok"` with at least one condition, `"blocked"` with none and a
+ * reject/quarantine action, or `"confirm"` with none and only other actions (which then apply to every message).
+ */
+export function checkRuleConditions(rule) {
+    if (hasConditions(rule.conditions)) {
+        return "ok";
+    }
+    return rule.actions.some((action) => action.type === "reject" || action.type === "quarantine") ? "blocked" : "confirm";
+}
+/** Asks before saving a rule with no conditions whose actions will run on every message. */
+export function NoConditionsConfirmModal({ open, onCancel, onConfirm }) {
+    return (_jsxs(Modal, { open: open, onClose: onCancel, title: "Apply to every message?", children: [_jsx("p", { className: "text-sm mb-5", children: "This rule has no conditions, so its actions will run on every message this server receives or sends." }), _jsxs("div", { className: "flex gap-3 justify-end", children: [_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", onClick: onCancel, children: "Cancel" }), _jsx(Button, { type: "button", className: "!w-auto", onClick: onConfirm, children: "Save anyway" })] })] }));
+}
 const FIELD_INPUT_CLASS = "w-full text-sm py-2 px-3 border border-border rounded-sm bg-surface text-text focus:outline-none focus:border-primary";
 export const TRANSPORT_RULE_CONDITION_FIELDS = [
     { key: "fromContains", label: "From contains", kind: "list" },

package/dist/apps/admin/transport-rules/index.js

@@ -10,6 +10,24 @@ import AdminShell from "../../shared/components/admin/layout/AdminShell.js";
 import Alert from "@rapidmx/react-shared/components/feedback/Alert.js";
 import Button from "@rapidmx/react-shared/components/buttons/Button.js";
 const PAGE_SIZE = 25;
+/** The server's largest page (`limit` is capped at 1000). */
+const FETCH_PAGE_SIZE = 1000;
+/**
+ * Every transport rule, in evaluation order. `listTransportRules()` can't ask the server to sort, and sorting one
+ * server page at a time would order rules only within that page - so every page is fetched and sorted here (an
+ * organisation has few transport rules). Ties keep a stable order by name.
+ */
+async function listAllTransportRules() {
+    const all = [];
+    for (let page = 0;; page++) {
+        const batch = await listTransportRules({ page, limit: FETCH_PAGE_SIZE });
+        all.push(...batch);
+        if (batch.length < FETCH_PAGE_SIZE) {
+            break;
+        }
+    }
+    return all.sort((a, b) => a.sequence - b.sequence || a.name.localeCompare(b.name));
+}
 export default function TransportRulesPage(props) {
     return (_jsx(AdminShell, { ...props, active: "transportRules", children: _jsx(TransportRulesContent, {}) }));
 }
@@ -19,14 +37,12 @@ function TransportRulesContent() {
     const [loading, setLoading] = useState(true);
     const [error, setError] = useState(null);
     useEffect(() => {
-        setLoading(true);
-        setError(null);
-        listTransportRules({ page, limit: PAGE_SIZE })
+        listAllTransportRules()
             .then(setRules)
             .catch((err) => setError(err instanceof ApiRequestError ? err.message : "Could not load transport rules."))
             .finally(() => setLoading(false));
-    }, [page]);
-    const hasNextPage = rules.length === PAGE_SIZE;
-    const sorted = [...rules].sort((a, b) => a.sequence - b.sequence);
+    }, []);
+    const hasNextPage = (page + 1) * PAGE_SIZE < rules.length;
+    const sorted = rules.slice(page * PAGE_SIZE, (page + 1) * PAGE_SIZE);
     return (_jsxs(_Fragment, { children: [_jsxs("div", { className: "flex items-center justify-between mb-5", children: [_jsx("h1", { className: "text-xl font-bold uppercase tracking-wide", children: "Transport rules" }), _jsx("a", { href: "/admin/transport-rules/new", children: _jsx(Button, { type: "button", className: "!w-auto", children: "+ New transport rule" }) })] }), error && _jsx(Alert, { children: error }), loading ? (_jsx("p", { className: "text-sm text-text-muted", children: "Loading\u2026" })) : sorted.length === 0 ? (_jsx("p", { className: "text-sm text-text-muted", children: "No transport rules yet." })) : (_jsx("div", { className: "overflow-x-auto", children: _jsxs("table", { className: "w-full text-sm border-collapse", children: [_jsx("thead", { children: _jsx("tr", { children: ["Sequence", "Name", "Enabled", "Actions", ""].map((h) => (_jsx("th", { className: "text-left text-xs uppercase tracking-wide text-text-muted py-2 px-2.5 border-b border-border", children: h }, h))) }) }), _jsx("tbody", { children: sorted.map((rule) => (_jsxs("tr", { children: [_jsx("td", { className: "py-2.5 px-2.5 border-b border-border", children: rule.sequence }), _jsx("td", { className: "py-2.5 px-2.5 border-b border-border", children: rule.name }), _jsx("td", { className: "py-2.5 px-2.5 border-b border-border", children: rule.enabled ? "Yes" : "No" }), _jsx("td", { className: "py-2.5 px-2.5 border-b border-border", children: rule.actions.length }), _jsx("td", { className: "py-2.5 px-2.5 border-b border-border text-right", children: _jsx("a", { href: `/admin/transport-rules/${encodeURIComponent(rule.uid)}`, className: "text-primary-dark hover:underline font-medium", children: "View" }) })] }, rule.uid))) })] }) })), _jsxs("div", { className: "flex gap-3 items-center mt-4", children: [_jsx(Button, { variant: "secondary", type: "button", className: "!w-auto", disabled: page === 0 || loading, onClick: () => setPage((p) => Math.max(0, p - 1)), children: "Previous" }), _jsxs("span", { className: "text-sm text-text-muted", children: ["Page ", page + 1] }), _jsx(Button, { variant: "secondary", type: "button", className: "!w-auto", disabled: !hasNextPage || loading, onClick: () => setPage((p) => p + 1), children: "Next" })] })] }));
 }

package/dist/apps/admin/transport-rules/new/index.js

@@ -8,7 +8,7 @@ import { ApiRequestError } from "@rapidmx/react-shared/util/api.js";
 import { createTransportRule, } from "@rapidmx/react-shared/admin/transportRulesApi.js";
 import AdminShell from "../../../shared/components/admin/layout/AdminShell.js";
 import RuleBuilder from "../../../shared/components/rules/RuleBuilder.js";
-import { TRANSPORT_RULE_ACTION_TYPES, TRANSPORT_RULE_CONDITION_FIELDS } from "../_transportRuleConfig.js";
+import { checkRuleConditions, NO_CONDITIONS_BLOCKED_MESSAGE, NoConditionsConfirmModal, TRANSPORT_RULE_ACTION_TYPES, TRANSPORT_RULE_CONDITION_FIELDS, } from "../_transportRuleConfig.js";
 import Alert from "@rapidmx/react-shared/components/feedback/Alert.js";
 import Button from "@rapidmx/react-shared/components/buttons/Button.js";
 import FormField from "@rapidmx/react-shared/components/forms/FormField.js";
@@ -27,6 +27,8 @@ function NewTransportRuleForm() {
     });
     const [error, setError] = useState(null);
     const [saving, setSaving] = useState(false);
+    const [showValidation, setShowValidation] = useState(false);
+    const [confirmingNoConditions, setConfirmingNoConditions] = useState(false);
     async function handleSubmit(e) {
         e.preventDefault();
         setError(null);
@@ -34,6 +36,20 @@ function NewTransportRuleForm() {
             setError("A name is required.");
             return;
         }
+        const check = checkRuleConditions(rule);
+        if (check === "blocked") {
+            setShowValidation(true);
+            setError(NO_CONDITIONS_BLOCKED_MESSAGE);
+            return;
+        }
+        if (check === "confirm") {
+            setConfirmingNoConditions(true);
+            return;
+        }
+        await create();
+    }
+    async function create() {
+        setConfirmingNoConditions(false);
         setSaving(true);
         try {
             const created = await createTransportRule({ name: name.trim(), ...rule });
@@ -46,5 +62,5 @@ function NewTransportRuleForm() {
             setSaving(false);
         }
     }
-    return (_jsxs("div", { className: "max-w-3xl", children: [_jsx("h1", { className: "text-xl font-bold uppercase tracking-wide mb-1", children: "New transport rule" }), _jsx("p", { className: "text-sm text-text-muted mb-5", children: "Evaluated once per SMTP transaction, before any message is resolved to an individual mailbox." }), error && _jsx(Alert, { children: error }), _jsxs("form", { onSubmit: handleSubmit, className: "flex flex-col gap-5", children: [_jsx("div", { className: "bg-surface border border-border rounded-md p-6", children: _jsx(FormField, { label: "Name", htmlFor: "name", children: _jsx("input", { id: "name", type: "text", className: INPUT_CLASS, value: name, onChange: (e) => setName(e.target.value), placeholder: "Flag external senders" }) }) }), _jsx(RuleBuilder, { value: rule, onChange: setRule, conditionFields: TRANSPORT_RULE_CONDITION_FIELDS, actionTypes: TRANSPORT_RULE_ACTION_TYPES }), _jsxs("div", { className: "flex gap-3", children: [_jsx(Button, { type: "submit", loading: saving, disabled: saving, className: "!w-auto", children: "Create transport rule" }), _jsx("a", { href: "/admin/transport-rules", children: _jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", children: "Cancel" }) })] })] })] }));
+    return (_jsxs("div", { className: "max-w-3xl", children: [_jsx("h1", { className: "text-xl font-bold uppercase tracking-wide mb-1", children: "New transport rule" }), _jsx("p", { className: "text-sm text-text-muted mb-5", children: "Evaluated once per SMTP transaction, before any message is resolved to an individual mailbox." }), error && _jsx(Alert, { children: error }), _jsxs("form", { onSubmit: handleSubmit, className: "flex flex-col gap-5", children: [_jsx("div", { className: "bg-surface border border-border rounded-md p-6", children: _jsx(FormField, { label: "Name", htmlFor: "name", children: _jsx("input", { id: "name", type: "text", className: INPUT_CLASS, value: name, onChange: (e) => setName(e.target.value), placeholder: "Flag external senders" }) }) }), _jsx(RuleBuilder, { value: rule, onChange: setRule, conditionFields: TRANSPORT_RULE_CONDITION_FIELDS, actionTypes: TRANSPORT_RULE_ACTION_TYPES, showValidation: showValidation }), _jsxs("div", { className: "flex gap-3", children: [_jsx(Button, { type: "submit", loading: saving, disabled: saving, className: "!w-auto", children: "Create transport rule" }), _jsx("a", { href: "/admin/transport-rules", children: _jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", children: "Cancel" }) })] })] }), _jsx(NoConditionsConfirmModal, { open: confirmingNoConditions, onCancel: () => setConfirmingNoConditions(false), onConfirm: () => void create() })] }));
 }

package/dist/apps/escrow/_layout.js

@@ -1,10 +1,10 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
-import { CUSTOM_STYLESHEET_LINK_ID } from "@rapidmx/react-shared/branding/useBranding.js";
+/** Unlike the other apps, never links the admin-configured custom stylesheet: the escrow console handles escrow
+ * key material, so no admin-supplied CSS is loaded on it. */
 export default function Layout({ children, branding }) {
     const title = branding?.title || branding?.companyName
         ? `${branding?.title || branding?.companyName}: Escrow Console`
         : "RapidMX: Escrow Console";
     const iconHref = branding?.iconUrl || branding?.logoUrl || "/images/logo.svg";
-    const stylesheetHref = branding?.stylesheetUrl;
-    return (_jsxs("html", { lang: "en", children: [_jsxs("head", { children: [_jsx("meta", { charSet: "utf-8" }), _jsx("meta", { name: "viewport", content: "width=device-width, initial-scale=1" }), _jsx("title", { children: title }), _jsx("link", { rel: "icon", type: "image/svg+xml", href: iconHref }), _jsx("link", { rel: "alternate icon", href: "/favicon.ico" }), _jsx("link", { rel: "preconnect", href: "https://fonts.googleapis.com" }), _jsx("link", { rel: "preconnect", href: "https://fonts.gstatic.com", crossOrigin: "anonymous" }), _jsx("link", { rel: "stylesheet", href: "https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700;800&display=swap" }), stylesheetHref && _jsx("link", { rel: "stylesheet", href: stylesheetHref, id: CUSTOM_STYLESHEET_LINK_ID })] }), _jsx("body", { children: children })] }));
+    return (_jsxs("html", { lang: "en", children: [_jsxs("head", { children: [_jsx("meta", { charSet: "utf-8" }), _jsx("meta", { name: "viewport", content: "width=device-width, initial-scale=1" }), _jsx("title", { children: title }), _jsx("link", { rel: "icon", type: "image/svg+xml", href: iconHref }), _jsx("link", { rel: "alternate icon", href: "/favicon.ico" }), _jsx("link", { rel: "preconnect", href: "https://fonts.googleapis.com" }), _jsx("link", { rel: "preconnect", href: "https://fonts.gstatic.com", crossOrigin: "anonymous" }), _jsx("link", { rel: "stylesheet", href: "https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700;800&display=swap" })] }), _jsx("body", { children: children })] }));
 }

package/dist/apps/escrow/audit-log/index.js

@@ -14,7 +14,32 @@ const ACTION_LABELS = {
     "escrow_access_request.created": "Access request created",
     "escrow_access_request.approved": "Access request approved",
     "escrow_access_request.material_read": "Material read",
+    "matter_export.requested": "Matter export requested",
+    "matter_export.ready": "Matter export ready",
+    "matter_export.failed": "Matter export failed",
 };
+/** The label for an audit action - the raw action name for one this console doesn't know yet (a newer server). */
+export function actionLabel(action) {
+    return ACTION_LABELS[action] ?? action;
+}
+const VERIFICATION_FAILURES = {
+    link_mismatch: "An entry was deleted, inserted or reordered.",
+    hash_mismatch: "An entry was edited after it was written.",
+    unknown_algorithm: "An entry uses a hash algorithm this server doesn't recognize.",
+    algorithm_downgrade: "An unkeyed entry follows keyed ones, which suggests a forged entry.",
+    hmac_key_unavailable: "Audit key not configured: this server can't check keyed entries, so the chain couldn't be verified.",
+    truncated: "Entries missing at the end: entries were deleted from the end of the chain.",
+    head_mismatch: "The chain's head record doesn't match its last entry.",
+    head_mac_mismatch: "The chain's head record was forged or edited.",
+    head_missing: "The chain's head record is missing.",
+};
+/** Explains a failed chain verification by its `reason` (plus where it broke, when known). An unrecognized or missing
+ * reason (a newer or older server) reads as a generic failure. */
+export function describeVerificationFailure(result) {
+    const where = result.brokenAtSequence === undefined ? "" : ` (at sequence ${result.brokenAtSequence})`;
+    const known = result.reason === undefined ? undefined : VERIFICATION_FAILURES[result.reason];
+    return known ? `Chain integrity check failed${where}. ${known}` : `Chain integrity check failed${where}.`;
+}
 export default function EscrowAuditLogPage(props) {
     return (_jsx(EscrowShell, { ...props, active: "auditLog", children: _jsx(EscrowAuditLogContent, {}) }));
 }
@@ -62,5 +87,5 @@ function EscrowAuditLogContent() {
     }
     const hasNextPage = entries.length === PAGE_SIZE;
     return (_jsxs(_Fragment, { children: [_jsxs("div", { className: "flex items-center justify-between mb-5", children: [_jsx("h1", { className: "text-xl font-bold uppercase tracking-wide", children: "Escrow audit log" }), isTrustedAdmin && (_jsx(Button, { type: "button", className: "!w-auto", loading: verifying, disabled: verifying, onClick: handleVerify, children: "Verify chain integrity" }))] }), _jsx("p", { className: "text-sm text-text-muted mb-5", children: "Every escrow access lifecycle event visible to you \u2014 matters under a scope you hold. A trusted administrator sees every entry across every scope instead." }), verifyError && _jsx(Alert, { children: verifyError }), verifyResult &&
-                (verifyResult.valid ? (_jsx("div", { className: "mb-5 py-3 px-3.5 rounded-sm text-sm bg-success/10 text-success font-medium", children: "Chain verified \u2014 no tampering detected." })) : (_jsxs(Alert, { children: ["Chain integrity broken at sequence ", verifyResult.brokenAtSequence, "."] }))), error && _jsx(Alert, { children: error }), loading ? (_jsx("p", { className: "text-sm text-text-muted", children: "Loading\u2026" })) : entries.length === 0 ? (_jsx("p", { className: "text-sm text-text-muted", children: "No audit log entries visible to you yet." })) : (_jsx("div", { className: "overflow-x-auto", children: _jsxs("table", { className: "w-full text-sm border-collapse", children: [_jsx("thead", { children: _jsx("tr", { children: ["Sequence", "Action", "Holder", "Mailbox", "Occurred"].map((h) => (_jsx("th", { className: "text-left text-xs uppercase tracking-wide text-text-muted py-2 px-2.5 border-b border-border", children: h }, h))) }) }), _jsx("tbody", { children: entries.map((entry) => (_jsxs("tr", { children: [_jsx("td", { className: "py-2.5 px-2.5 border-b border-border", children: entry.sequence }), _jsx("td", { className: "py-2.5 px-2.5 border-b border-border", children: ACTION_LABELS[entry.action] }), _jsx("td", { className: "py-2.5 px-2.5 border-b border-border", children: entry.holderUserUid }), _jsx("td", { className: "py-2.5 px-2.5 border-b border-border", children: entry.mailboxUid }), _jsx("td", { className: "py-2.5 px-2.5 border-b border-border", children: new Date(entry.occurredAt).toLocaleString() })] }, entry.uid))) })] }) })), _jsxs("div", { className: "flex gap-3 items-center mt-4", children: [_jsx(Button, { variant: "secondary", type: "button", className: "!w-auto", disabled: page === 0 || loading, onClick: () => setPage((p) => Math.max(0, p - 1)), children: "Previous" }), _jsxs("span", { className: "text-sm text-text-muted", children: ["Page ", page + 1] }), _jsx(Button, { variant: "secondary", type: "button", className: "!w-auto", disabled: !hasNextPage || loading, onClick: () => setPage((p) => p + 1), children: "Next" })] })] }));
+                (verifyResult.valid ? (_jsx("div", { className: "mb-5 py-3 px-3.5 rounded-sm text-sm bg-success/10 text-success font-medium", children: "Chain verified \u2014 no tampering detected." })) : (_jsx(Alert, { children: describeVerificationFailure(verifyResult) }))), error && _jsx(Alert, { children: error }), loading ? (_jsx("p", { className: "text-sm text-text-muted", children: "Loading\u2026" })) : entries.length === 0 ? (_jsx("p", { className: "text-sm text-text-muted", children: "No audit log entries visible to you yet." })) : (_jsx("div", { className: "overflow-x-auto", children: _jsxs("table", { className: "w-full text-sm border-collapse", children: [_jsx("thead", { children: _jsx("tr", { children: ["Sequence", "Action", "Holder", "Mailbox", "Occurred"].map((h) => (_jsx("th", { className: "text-left text-xs uppercase tracking-wide text-text-muted py-2 px-2.5 border-b border-border", children: h }, h))) }) }), _jsx("tbody", { children: entries.map((entry) => (_jsxs("tr", { children: [_jsx("td", { className: "py-2.5 px-2.5 border-b border-border", children: entry.sequence }), _jsx("td", { className: "py-2.5 px-2.5 border-b border-border", children: actionLabel(entry.action) }), _jsx("td", { className: "py-2.5 px-2.5 border-b border-border", children: entry.holderUserUid }), _jsx("td", { className: "py-2.5 px-2.5 border-b border-border", children: entry.mailboxUid }), _jsx("td", { className: "py-2.5 px-2.5 border-b border-border", children: new Date(entry.occurredAt).toLocaleString() })] }, entry.uid))) })] }) })), _jsxs("div", { className: "flex gap-3 items-center mt-4", children: [_jsx(Button, { variant: "secondary", type: "button", className: "!w-auto", disabled: page === 0 || loading, onClick: () => setPage((p) => Math.max(0, p - 1)), children: "Previous" }), _jsxs("span", { className: "text-sm text-text-muted", children: ["Page ", page + 1] }), _jsx(Button, { variant: "secondary", type: "button", className: "!w-auto", disabled: !hasNextPage || loading, onClick: () => setPage((p) => p + 1), children: "Next" })] })] }));
 }