@rapidmx/web-client 0.4.0 → 0.6.0

package/dist/apps/escrow/audit-log/index.js

@@ -14,7 +14,32 @@ const ACTION_LABELS = {
     "escrow_access_request.created": "Access request created",
     "escrow_access_request.approved": "Access request approved",
     "escrow_access_request.material_read": "Material read",
+    "matter_export.requested": "Matter export requested",
+    "matter_export.ready": "Matter export ready",
+    "matter_export.failed": "Matter export failed",
 };
+/** The label for an audit action - the raw action name for one this console doesn't know yet (a newer server). */
+export function actionLabel(action) {
+    return ACTION_LABELS[action] ?? action;
+}
+const VERIFICATION_FAILURES = {
+    link_mismatch: "An entry was deleted, inserted or reordered.",
+    hash_mismatch: "An entry was edited after it was written.",
+    unknown_algorithm: "An entry uses a hash algorithm this server doesn't recognize.",
+    algorithm_downgrade: "An unkeyed entry follows keyed ones, which suggests a forged entry.",
+    hmac_key_unavailable: "Audit key not configured: this server can't check keyed entries, so the chain couldn't be verified.",
+    truncated: "Entries missing at the end: entries were deleted from the end of the chain.",
+    head_mismatch: "The chain's head record doesn't match its last entry.",
+    head_mac_mismatch: "The chain's head record was forged or edited.",
+    head_missing: "The chain's head record is missing.",
+};
+/** Explains a failed chain verification by its `reason` (plus where it broke, when known). An unrecognized or missing
+ * reason (a newer or older server) reads as a generic failure. */
+export function describeVerificationFailure(result) {
+    const where = result.brokenAtSequence === undefined ? "" : ` (at sequence ${result.brokenAtSequence})`;
+    const known = result.reason === undefined ? undefined : VERIFICATION_FAILURES[result.reason];
+    return known ? `Chain integrity check failed${where}. ${known}` : `Chain integrity check failed${where}.`;
+}
 export default function EscrowAuditLogPage(props) {
     return (_jsx(EscrowShell, { ...props, active: "auditLog", children: _jsx(EscrowAuditLogContent, {}) }));
 }
@@ -62,5 +87,5 @@ function EscrowAuditLogContent() {
     }
     const hasNextPage = entries.length === PAGE_SIZE;
     return (_jsxs(_Fragment, { children: [_jsxs("div", { className: "flex items-center justify-between mb-5", children: [_jsx("h1", { className: "text-xl font-bold uppercase tracking-wide", children: "Escrow audit log" }), isTrustedAdmin && (_jsx(Button, { type: "button", className: "!w-auto", loading: verifying, disabled: verifying, onClick: handleVerify, children: "Verify chain integrity" }))] }), _jsx("p", { className: "text-sm text-text-muted mb-5", children: "Every escrow access lifecycle event visible to you \u2014 matters under a scope you hold. A trusted administrator sees every entry across every scope instead." }), verifyError && _jsx(Alert, { children: verifyError }), verifyResult &&
-                (verifyResult.valid ? (_jsx("div", { className: "mb-5 py-3 px-3.5 rounded-sm text-sm bg-success/10 text-success font-medium", children: "Chain verified \u2014 no tampering detected." })) : (_jsxs(Alert, { children: ["Chain integrity broken at sequence ", verifyResult.brokenAtSequence, "."] }))), error && _jsx(Alert, { children: error }), loading ? (_jsx("p", { className: "text-sm text-text-muted", children: "Loading\u2026" })) : entries.length === 0 ? (_jsx("p", { className: "text-sm text-text-muted", children: "No audit log entries visible to you yet." })) : (_jsx("div", { className: "overflow-x-auto", children: _jsxs("table", { className: "w-full text-sm border-collapse", children: [_jsx("thead", { children: _jsx("tr", { children: ["Sequence", "Action", "Holder", "Mailbox", "Occurred"].map((h) => (_jsx("th", { className: "text-left text-xs uppercase tracking-wide text-text-muted py-2 px-2.5 border-b border-border", children: h }, h))) }) }), _jsx("tbody", { children: entries.map((entry) => (_jsxs("tr", { children: [_jsx("td", { className: "py-2.5 px-2.5 border-b border-border", children: entry.sequence }), _jsx("td", { className: "py-2.5 px-2.5 border-b border-border", children: ACTION_LABELS[entry.action] }), _jsx("td", { className: "py-2.5 px-2.5 border-b border-border", children: entry.holderUserUid }), _jsx("td", { className: "py-2.5 px-2.5 border-b border-border", children: entry.mailboxUid }), _jsx("td", { className: "py-2.5 px-2.5 border-b border-border", children: new Date(entry.occurredAt).toLocaleString() })] }, entry.uid))) })] }) })), _jsxs("div", { className: "flex gap-3 items-center mt-4", children: [_jsx(Button, { variant: "secondary", type: "button", className: "!w-auto", disabled: page === 0 || loading, onClick: () => setPage((p) => Math.max(0, p - 1)), children: "Previous" }), _jsxs("span", { className: "text-sm text-text-muted", children: ["Page ", page + 1] }), _jsx(Button, { variant: "secondary", type: "button", className: "!w-auto", disabled: !hasNextPage || loading, onClick: () => setPage((p) => p + 1), children: "Next" })] })] }));
+                (verifyResult.valid ? (_jsx("div", { className: "mb-5 py-3 px-3.5 rounded-sm text-sm bg-success/10 text-success font-medium", children: "Chain verified \u2014 no tampering detected." })) : (_jsx(Alert, { children: describeVerificationFailure(verifyResult) }))), error && _jsx(Alert, { children: error }), loading ? (_jsx("p", { className: "text-sm text-text-muted", children: "Loading\u2026" })) : entries.length === 0 ? (_jsx("p", { className: "text-sm text-text-muted", children: "No audit log entries visible to you yet." })) : (_jsx("div", { className: "overflow-x-auto", children: _jsxs("table", { className: "w-full text-sm border-collapse", children: [_jsx("thead", { children: _jsx("tr", { children: ["Sequence", "Action", "Holder", "Mailbox", "Occurred"].map((h) => (_jsx("th", { className: "text-left text-xs uppercase tracking-wide text-text-muted py-2 px-2.5 border-b border-border", children: h }, h))) }) }), _jsx("tbody", { children: entries.map((entry) => (_jsxs("tr", { children: [_jsx("td", { className: "py-2.5 px-2.5 border-b border-border", children: entry.sequence }), _jsx("td", { className: "py-2.5 px-2.5 border-b border-border", children: actionLabel(entry.action) }), _jsx("td", { className: "py-2.5 px-2.5 border-b border-border", children: entry.holderUserUid }), _jsx("td", { className: "py-2.5 px-2.5 border-b border-border", children: entry.mailboxUid }), _jsx("td", { className: "py-2.5 px-2.5 border-b border-border", children: new Date(entry.occurredAt).toLocaleString() })] }, entry.uid))) })] }) })), _jsxs("div", { className: "flex gap-3 items-center mt-4", children: [_jsx(Button, { variant: "secondary", type: "button", className: "!w-auto", disabled: page === 0 || loading, onClick: () => setPage((p) => Math.max(0, p - 1)), children: "Previous" }), _jsxs("span", { className: "text-sm text-text-muted", children: ["Page ", page + 1] }), _jsx(Button, { variant: "secondary", type: "button", className: "!w-auto", disabled: !hasNextPage || loading, onClick: () => setPage((p) => p + 1), children: "Next" })] })] }));
 }

package/dist/apps/escrow/index.d.ts

@@ -0,0 +1,3 @@
+import React from "react";
+import { EscrowShellProps } from "../shared/components/escrow/layout/EscrowShell.js";
+export default function MattersPage(props: Omit<EscrowShellProps, "active">): React.JSX.Element;

package/dist/apps/escrow/matters/[uid].d.ts

@@ -0,0 +1,7 @@
+import React from "react";
+import { EscrowShellProps } from "../../shared/components/escrow/layout/EscrowShell.js";
+export default function MatterDetailPage(props: Omit<EscrowShellProps, "active"> & {
+    params: {
+        uid: string;
+    };
+}): React.JSX.Element;

package/dist/apps/escrow/matters/[uid].js

@@ -3,7 +3,7 @@ import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-run
 // Copyright (C) 2026 Jean-Philippe Steinmetz
 // SPDX-License-Identifier: MPL-2.0
 ///////////////////////////////////////////////////////////////////////////////
-import { useEffect, useState } from "react";
+import { useEffect, useRef, useState } from "react";
 import { ApiRequestError } from "@rapidmx/react-shared/util/api.js";
 import { closeMatter, getMatter } from "@rapidmx/react-shared/admin/mattersApi.js";
 import { approveAccessRequest, createAccessRequest, denyAccessRequest, getAccessRequestMaterial, listAccessRequests, } from "@rapidmx/react-shared/admin/escrowAccessRequestsApi.js";
@@ -11,35 +11,44 @@ import { createMatterExportRequest, listMatterExportRequests, matterExportReques
 import { searchMatter } from "@rapidmx/react-shared/admin/matterSearchApi.js";
 import { parseSearchQuery } from "@rapidmx/react-shared/search/queryGrammar.js";
 import EscrowShell from "../../shared/components/escrow/layout/EscrowShell.js";
+import { LoadMoreButton, usePagedList } from "../../shared/components/admin/usePagedList.js";
 import Alert from "@rapidmx/react-shared/components/feedback/Alert.js";
 import Button from "@rapidmx/react-shared/components/buttons/Button.js";
 import FormField from "@rapidmx/react-shared/components/forms/FormField.js";
 import Modal from "@rapidmx/react-shared/components/overlays/Modal.js";
 const INPUT_CLASS = "w-full text-sm py-2.5 px-3 border border-border rounded-sm bg-surface text-text focus:outline-none focus:border-primary";
-// `BaseEscrowAccessRequestRoute.find()` always returns every request under every scope the caller holds
-// (it unconditionally overwrites any `matterId` filter with its own held-scopes-derived one — see
-// `escrowAccessRequestsApi.ts`'s own doc comment) — there is no server-side way to ask for just this one
-// matter's requests. This page fetches a generously-sized single page and filters client-side instead of
-// paginating a second, matter-scoped list UI on top of an already-scoped one; a holder with more than this
-// many *total* in-flight requests across every matter they hold is not the common case this v1 targets.
-const REQUESTS_FETCH_LIMIT = 200;
+/** Request statuses still waiting or running - shown as a neutral in-progress badge, never as success. Includes
+ * restapi's `processing` (exports/imports) and `in_progress` (an erasure that is running). */
+const IN_PROGRESS_STATUSES = new Set(["pending", "processing", "in_progress"]);
 function statusBadgeClass(status) {
-    if (status === "denied" || status === "failed")
+    if (status === "failed" || status === "denied")
         return "bg-danger-bg text-danger";
-    if (status === "pending")
+    if (IN_PROGRESS_STATUSES.has(status))
         return "bg-surface-alt text-text-muted";
     return "bg-success text-white";
 }
+/** A status as shown on its badge (`in_progress` -> `in progress`). */
+function statusLabel(status) {
+    return status.replace(/_/g, " ");
+}
 export default function MatterDetailPage(props) {
     return (_jsx(EscrowShell, { ...props, active: "matters", children: _jsx(MatterDetailContent, { uid: props.params.uid }) }));
 }
+function formatDateRange(matter) {
+    return `${new Date(matter.dateRangeStart).toLocaleDateString()} – ${new Date(matter.dateRangeEnd).toLocaleDateString()}`;
+}
 function MatterDetailContent({ uid }) {
     const [matter, setMatter] = useState(null);
-    const [requests, setRequests] = useState([]);
     const [loading, setLoading] = useState(true);
     const [error, setError] = useState(null);
+    // Both lists are fetched for this matter only (`matterId`), newest first, a page at a time. Rows are still
+    // checked against this matter in case an older server ignores the filter.
+    const requests = usePagedList((params) => listAccessRequests({ ...params, matterId: uid }), "Could not load this matter's access requests.");
+    const exportRequests = usePagedList((params) => listMatterExportRequests({ ...params, matterId: uid }), "Could not load this matter's export requests.");
+    const [confirmingClose, setConfirmingClose] = useState(false);
     const [closing, setClosing] = useState(false);
     const [closeError, setCloseError] = useState(null);
+    const [approveTarget, setApproveTarget] = useState(null);
     const [showNewRequest, setShowNewRequest] = useState(false);
     const [newRequestMailboxUid, setNewRequestMailboxUid] = useState("");
     const [creatingRequest, setCreatingRequest] = useState(false);
@@ -51,41 +60,44 @@ function MatterDetailContent({ uid }) {
     const [materialText, setMaterialText] = useState("");
     const [materialError, setMaterialError] = useState(null);
     const [loadingMaterial, setLoadingMaterial] = useState(false);
-    const [exportRequests, setExportRequests] = useState([]);
+    // Bumped whenever the material modal closes (or the matter does), so a slow "Get material" response for a
+    // modal that's already gone - or for an earlier request - is never shown.
+    const materialSeq = useRef(0);
     const [creatingExport, setCreatingExport] = useState(false);
     const [exportError, setExportError] = useState(null);
     const [searchText, setSearchText] = useState("");
     const [searching, setSearching] = useState(false);
     const [searchError, setSearchError] = useState(null);
     const [searchResults, setSearchResults] = useState(null);
-    // Same "no server-side single-matter filter, fetch a generous page and filter client-side" shape
-    // REQUESTS_FETCH_LIMIT's own doc comment already establishes for access requests -
-    // listMatterExportRequests() has the identical held-scopes-derived scoping, not a per-matter one.
-    function reload() {
+    // Bumped by every search and by closing the matter, so a search still in flight when the matter closes (or
+    // superseded by a newer search) never shows its results.
+    const searchSeq = useRef(0);
+    useEffect(() => {
         setLoading(true);
         setError(null);
-        Promise.all([getMatter(uid), listAccessRequests({ limit: REQUESTS_FETCH_LIMIT }), listMatterExportRequests()])
-            .then(([loadedMatter, allRequests, allExportRequests]) => {
-            setMatter(loadedMatter);
-            setRequests(allRequests.filter((r) => r.matterId === uid));
-            setExportRequests(allExportRequests.filter((r) => r.matterId === uid));
-        })
+        getMatter(uid)
+            .then(setMatter)
             .catch((err) => setError(err instanceof ApiRequestError ? err.message : "Could not load this matter."))
             .finally(() => setLoading(false));
-    }
-    useEffect(() => {
-        reload();
+        void requests.reload();
+        void exportRequests.reload();
     }, [uid]);
-    // Only ever invoked from the "Close matter" button below, which itself only renders once `matter` is
+    // Only ever invoked from the close-confirmation modal below, which itself only renders once `matter` is
     // resolved (children only render once loaded — see the early returns further down) — the non-null
-    // assertion reflects that real invariant, not an unchecked assumption. Matches `DomainDetailContent.
-    // handleVerify`'s identical pattern.
+    // assertion reflects that real invariant, not an unchecked assumption.
     async function handleClose() {
         setClosing(true);
         setCloseError(null);
         try {
             const updated = await closeMatter(matter.uid);
             setMatter(updated);
+            setConfirmingClose(false);
+            // Nothing more may be read under a closed matter - drop any material or search results already on
+            // screen, including a search still in flight, and any approval still being confirmed.
+            closeMaterialModal();
+            searchSeq.current++;
+            setSearchResults(null);
+            setSearching(false);
         }
         catch (err) {
             setCloseError(err instanceof ApiRequestError ? err.message : "Could not close this matter.");
@@ -94,6 +106,10 @@ function MatterDetailContent({ uid }) {
             setClosing(false);
         }
     }
+    function closeCloseModal() {
+        setConfirmingClose(false);
+        setCloseError(null);
+    }
     async function handleCreateRequest(e) {
         e.preventDefault();
         setNewRequestError(null);
@@ -106,7 +122,7 @@ function MatterDetailContent({ uid }) {
             await createAccessRequest({ matterId: uid, mailboxUid: newRequestMailboxUid.trim() });
             setShowNewRequest(false);
             setNewRequestMailboxUid("");
-            reload();
+            void requests.reload();
         }
         catch (err) {
             setNewRequestError(err instanceof ApiRequestError ? err.message : "Could not create this access request.");
@@ -115,12 +131,15 @@ function MatterDetailContent({ uid }) {
             setCreatingRequest(false);
         }
     }
-    async function handleApprove(request) {
+    // Only ever invoked from the approve-confirmation modal below, which only renders once `approveTarget` is set.
+    async function handleApprove() {
+        const request = approveTarget;
+        setApproveTarget(null);
         setActingOn((prev) => ({ ...prev, [request.uid]: true }));
         setActionErrors((prev) => ({ ...prev, [request.uid]: "" }));
         try {
             const updated = await approveAccessRequest(request.uid);
-            setRequests((prev) => prev.map((r) => (r.uid === updated.uid ? updated : r)));
+            requests.replaceItem(updated);
         }
         catch (err) {
             setActionErrors((prev) => ({
@@ -137,7 +156,7 @@ function MatterDetailContent({ uid }) {
         setActionErrors((prev) => ({ ...prev, [request.uid]: "" }));
         try {
             const updated = await denyAccessRequest(request.uid);
-            setRequests((prev) => prev.map((r) => (r.uid === updated.uid ? updated : r)));
+            requests.replaceItem(updated);
         }
         catch (err) {
             setActionErrors((prev) => ({
@@ -150,30 +169,39 @@ function MatterDetailContent({ uid }) {
         }
     }
     async function handleGetMaterial(request) {
+        const seq = ++materialSeq.current;
         setMaterialFor(request);
         setMaterialText("");
         setMaterialError(null);
         setLoadingMaterial(true);
         try {
             const material = await getAccessRequestMaterial(request.uid);
-            setMaterialText(JSON.stringify(material.masterKeyWraps, null, 2));
+            if (seq === materialSeq.current)
+                setMaterialText(JSON.stringify(material.masterKeyWraps, null, 2));
         }
         catch (err) {
-            setMaterialError(err instanceof ApiRequestError ? err.message : "Could not read this request's material.");
+            if (seq === materialSeq.current) {
+                setMaterialError(err instanceof ApiRequestError ? err.message : "Could not read this request's material.");
+            }
         }
         finally {
-            setLoadingMaterial(false);
+            if (seq === materialSeq.current)
+                setLoadingMaterial(false);
         }
     }
     function closeMaterialModal() {
+        materialSeq.current++;
         setMaterialFor(null);
+        setMaterialText("");
+        setMaterialError(null);
+        setLoadingMaterial(false);
     }
     async function handleCreateExport() {
         setExportError(null);
         setCreatingExport(true);
         try {
             await createMatterExportRequest(uid);
-            reload();
+            void exportRequests.reload();
         }
         catch (err) {
             setExportError(err instanceof ApiRequestError ? err.message : "Could not start this export.");
@@ -184,6 +212,7 @@ function MatterDetailContent({ uid }) {
     }
     async function handleSearch(e) {
         e.preventDefault();
+        const seq = ++searchSeq.current;
         setSearchError(null);
         setSearching(true);
         try {
@@ -207,13 +236,17 @@ function MatterDetailContent({ uid }) {
                 flags: parsed.flags,
                 labels: parsed.labels,
             });
-            setSearchResults(results);
+            if (seq === searchSeq.current)
+                setSearchResults(results);
         }
         catch (err) {
-            setSearchError(err instanceof ApiRequestError ? err.message : "Could not search this matter.");
+            if (seq === searchSeq.current) {
+                setSearchError(err instanceof ApiRequestError ? err.message : "Could not search this matter.");
+            }
         }
         finally {
-            setSearching(false);
+            if (seq === searchSeq.current)
+                setSearching(false);
         }
     }
     if (loading) {
@@ -222,13 +255,15 @@ function MatterDetailContent({ uid }) {
     if (error || !matter) {
         return _jsx(Alert, { children: error ?? "Matter not found." });
     }
-    return (_jsxs("div", { className: "max-w-4xl flex flex-col gap-5", children: [_jsxs("div", { className: "flex items-start justify-between gap-4", children: [_jsxs("div", { children: [_jsx("a", { href: "/escrow", className: "text-sm text-primary-dark hover:underline", children: "\u2190 All matters" }), _jsx("h1", { className: "text-xl font-bold tracking-tight mt-1", children: matter.name })] }), !matter.closedAt && (_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto shrink-0", loading: closing, disabled: closing, onClick: handleClose, children: "Close matter" }))] }), closeError && _jsx(Alert, { children: closeError }), _jsx("div", { className: "bg-surface border border-border rounded-md p-6", children: _jsxs("dl", { className: "grid grid-cols-1 sm:grid-cols-2 gap-x-6 gap-y-3 text-sm", children: [_jsx("dt", { className: "text-text-muted", children: "Description" }), _jsx("dd", { children: matter.description ?? "None" }), _jsx("dt", { className: "text-text-muted", children: "Escrow scope" }), _jsx("dd", { className: "font-mono text-xs", children: matter.escrowScopeId }), _jsx("dt", { className: "text-text-muted", children: "Custodian mailboxes" }), _jsx("dd", { children: matter.custodianMailboxUids.join(", ") }), _jsx("dt", { className: "text-text-muted", children: "Date range" }), _jsxs("dd", { children: [new Date(matter.dateRangeStart).toLocaleDateString(), " \u2013", " ", new Date(matter.dateRangeEnd).toLocaleDateString()] }), _jsx("dt", { className: "text-text-muted", children: "Status" }), _jsx("dd", { children: matter.closedAt ? `Closed ${new Date(matter.closedAt).toLocaleString()}` : "Open" })] }) }), _jsxs("div", { className: "bg-surface border border-border rounded-md p-6", children: [_jsxs("div", { className: "flex items-center justify-between mb-3", children: [_jsx("h2", { className: "text-base font-bold uppercase tracking-wide", children: "Access requests" }), !matter.closedAt && (_jsx(Button, { type: "button", className: "!w-auto", onClick: () => setShowNewRequest(true), children: "+ New access request" }))] }), requests.length === 0 ? (_jsx("p", { className: "text-sm text-text-muted", children: "No access requests yet." })) : (_jsx("ul", { className: "flex flex-col gap-3", children: requests.map((request) => (_jsxs("li", { className: "border border-border rounded-sm p-4", children: [_jsxs("div", { className: "flex items-center justify-between gap-3 flex-wrap", children: [_jsxs("div", { children: [_jsx("div", { className: "text-sm font-semibold", children: request.mailboxUid }), _jsxs("div", { className: "text-xs text-text-muted", children: [request.approvals.length, " of ", request.requiredHoldersAtCreation, " approvals \u00B7 requested by ", request.requestedByUserUid] })] }), _jsx("span", { className: [
+    const matterRequests = requests.items.filter((request) => request.matterId === uid);
+    const matterExportRequests = exportRequests.items.filter((request) => request.matterId === uid);
+    return (_jsxs("div", { className: "max-w-4xl flex flex-col gap-5", children: [_jsxs("div", { className: "flex items-start justify-between gap-4", children: [_jsxs("div", { children: [_jsx("a", { href: "/escrow", className: "text-sm text-primary-dark hover:underline", children: "\u2190 All matters" }), _jsx("h1", { className: "text-xl font-bold tracking-tight mt-1", children: matter.name })] }), !matter.closedAt && (_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto shrink-0", onClick: () => setConfirmingClose(true), children: "Close matter" }))] }), _jsx("div", { className: "bg-surface border border-border rounded-md p-6", children: _jsxs("dl", { className: "grid grid-cols-1 sm:grid-cols-2 gap-x-6 gap-y-3 text-sm", children: [_jsx("dt", { className: "text-text-muted", children: "Description" }), _jsx("dd", { children: matter.description ?? "None" }), _jsx("dt", { className: "text-text-muted", children: "Escrow scope" }), _jsx("dd", { className: "font-mono text-xs", children: matter.escrowScopeId }), _jsx("dt", { className: "text-text-muted", children: "Custodian mailboxes" }), _jsx("dd", { children: matter.custodianMailboxUids.join(", ") }), _jsx("dt", { className: "text-text-muted", children: "Date range" }), _jsx("dd", { children: formatDateRange(matter) }), _jsx("dt", { className: "text-text-muted", children: "Status" }), _jsx("dd", { children: matter.closedAt ? `Closed ${new Date(matter.closedAt).toLocaleString()}` : "Open" })] }) }), _jsxs("div", { className: "bg-surface border border-border rounded-md p-6", children: [_jsxs("div", { className: "flex items-center justify-between mb-3", children: [_jsx("h2", { className: "text-base font-bold uppercase tracking-wide", children: "Access requests" }), !matter.closedAt && (_jsx(Button, { type: "button", className: "!w-auto", onClick: () => setShowNewRequest(true), children: "+ New access request" }))] }), requests.loadError && _jsx(Alert, { children: requests.loadError }), matterRequests.length === 0 ? (_jsx("p", { className: "text-sm text-text-muted", children: requests.loading ? "Loading…" : "No access requests yet." })) : (_jsx("ul", { className: "flex flex-col gap-3", children: matterRequests.map((request) => (_jsxs("li", { className: "border border-border rounded-sm p-4", children: [_jsxs("div", { className: "flex items-center justify-between gap-3 flex-wrap", children: [_jsxs("div", { children: [_jsx("div", { className: "text-sm font-semibold", children: request.mailboxUid }), _jsxs("div", { className: "text-xs text-text-muted", children: [request.approvals.length, " of ", request.requiredHoldersAtCreation, " approvals \u00B7 requested by ", request.requestedByUserUid] })] }), _jsx("span", { className: [
                                                 "text-xs font-bold uppercase tracking-wide py-0.5 px-2 rounded-pill",
                                                 request.status === "denied"
                                                     ? "bg-danger-bg text-danger"
                                                     : request.status === "pending"
                                                         ? "bg-surface-alt text-text-muted"
                                                         : "bg-success text-white",
-                                            ].join(" "), children: request.status })] }), actionErrors[request.uid] && _jsx(Alert, { children: actionErrors[request.uid] }), _jsxs("div", { className: "flex gap-3 mt-3", children: [request.status === "pending" && (_jsxs(_Fragment, { children: [_jsx(Button, { type: "button", className: "!w-auto", loading: actingOn[request.uid], disabled: actingOn[request.uid], onClick: () => handleApprove(request), children: "Approve" }), _jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", loading: actingOn[request.uid], disabled: actingOn[request.uid], onClick: () => handleDeny(request), children: "Deny" })] })), (request.status === "approved" || request.status === "fulfilled") && (_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", onClick: () => handleGetMaterial(request), children: "Get material" }))] })] }, request.uid))) }))] }), _jsxs("div", { className: "bg-surface border border-border rounded-md p-6", children: [_jsxs("div", { className: "flex items-center justify-between mb-3", children: [_jsx("h2", { className: "text-base font-bold uppercase tracking-wide", children: "Export this matter" }), _jsx(Button, { type: "button", className: "!w-auto", loading: creatingExport, disabled: creatingExport, onClick: handleCreateExport, children: "+ New export" })] }), _jsx("p", { className: "text-xs text-text-muted mb-3", children: "Exports messages (narrowed to this matter\u2019s own date range), plus full contacts, calendar events, tasks, and notes, from every custodian mailbox actually assigned to this matter\u2019s escrow scope, as one combined NDJSON file." }), exportError && _jsx(Alert, { children: exportError }), exportRequests.length === 0 ? (_jsx("p", { className: "text-sm text-text-muted", children: "No export requests yet." })) : (_jsx("ul", { className: "flex flex-col gap-2", children: exportRequests.map((request) => (_jsxs("li", { className: "flex items-center justify-between gap-3 text-sm py-1.5 px-3 bg-surface-alt rounded-sm", children: [_jsxs("span", { children: [new Date(request.dateCreated).toLocaleString(), request.status === "failed" && request.errorMessage && (_jsxs("span", { className: "text-danger", children: [" \u2014 ", request.errorMessage] }))] }), _jsxs("span", { className: "flex items-center gap-3", children: [_jsx("span", { className: `text-xs font-bold uppercase tracking-wide py-0.5 px-2 rounded-pill ${statusBadgeClass(request.status)}`, children: request.status }), request.status === "ready" && (_jsx("a", { href: matterExportRequestDownloadUrl(request.uid), className: "text-primary-dark hover:underline font-medium", children: "Download" }))] })] }, request.uid))) }))] }), _jsxs("div", { className: "bg-surface border border-border rounded-md p-6", children: [_jsx("h2", { className: "text-base font-bold uppercase tracking-wide mb-3", children: "Search this matter\u2019s custodians" }), _jsxs("form", { onSubmit: handleSearch, className: "flex gap-3 mb-4", children: [_jsx("input", { "aria-label": "Search this matter", className: INPUT_CLASS, value: searchText, onChange: (e) => setSearchText(e.target.value), placeholder: "Free text or an operator filter, e.g. from:alice@example.com" }), _jsx(Button, { type: "submit", className: "!w-auto shrink-0", loading: searching, disabled: searching || !searchText.trim(), children: "Search" })] }), searchError && _jsx(Alert, { children: searchError }), searchResults &&
-                        (Object.keys(searchResults).length === 0 ? (_jsx("p", { className: "text-sm text-text-muted", children: "No custodian mailboxes could be searched." })) : (_jsx("div", { className: "flex flex-col gap-4", children: Object.entries(searchResults).map(([mailboxUid, page]) => (_jsxs("div", { children: [_jsx("h3", { className: "text-sm font-semibold mb-2", children: mailboxUid }), page.results.length === 0 ? (_jsx("p", { className: "text-xs text-text-muted", children: "No matches." })) : (_jsx("ul", { className: "flex flex-col gap-1", children: page.results.map((result) => (_jsxs("li", { className: "text-sm py-1 px-2 bg-surface-alt rounded-sm", children: [result.entityType, " \u00B7 ", result.entityUid, result.snippet && _jsxs("span", { className: "text-text-muted", children: [" \u2014 ", result.snippet] })] }, `${result.entityType}-${result.entityUid}`))) }))] }, mailboxUid))) })))] }), _jsx(Modal, { open: showNewRequest, onClose: () => setShowNewRequest(false), title: "New access request", children: _jsxs("form", { onSubmit: handleCreateRequest, className: "flex flex-col gap-4", children: [newRequestError && _jsx(Alert, { children: newRequestError }), _jsx(FormField, { label: "Mailbox uid", htmlFor: "newRequestMailboxUid", children: _jsx("input", { id: "newRequestMailboxUid", type: "text", className: INPUT_CLASS, value: newRequestMailboxUid, onChange: (e) => setNewRequestMailboxUid(e.target.value) }) }), _jsx("p", { className: "text-xs text-text-muted", children: "Must be one of this matter's own custodian mailboxes, currently assigned to this matter's escrow scope. Your own creation counts as the first approval." }), _jsxs("div", { className: "flex gap-3 justify-end", children: [_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", disabled: creatingRequest, onClick: () => setShowNewRequest(false), children: "Cancel" }), _jsx(Button, { type: "submit", className: "!w-auto", loading: creatingRequest, disabled: creatingRequest, children: "Create request" })] })] }) }), _jsx(Modal, { open: materialFor !== null, onClose: closeMaterialModal, title: "Escrow key material", children: loadingMaterial ? (_jsx("p", { className: "text-sm text-text-muted", children: "Loading\u2026" })) : materialError ? (_jsx(Alert, { children: materialError })) : (_jsxs(_Fragment, { children: [_jsxs("p", { className: "text-sm text-text-muted mb-3", children: ["Still-encrypted master key wraps for ", _jsx("strong", { children: materialFor?.mailboxUid }), " \u2014 this server cannot decrypt these either. Copy the JSON below into your own offline tooling."] }), _jsx("pre", { className: "text-xs font-mono bg-surface-alt border border-border rounded-sm p-3 overflow-x-auto whitespace-pre-wrap break-all", children: materialText })] })) })] }));
+                                            ].join(" "), children: request.status })] }), actionErrors[request.uid] && _jsx(Alert, { children: actionErrors[request.uid] }), _jsxs("div", { className: "flex gap-3 mt-3", children: [!matter.closedAt && request.status === "pending" && (_jsxs(_Fragment, { children: [_jsx(Button, { type: "button", className: "!w-auto", loading: actingOn[request.uid], disabled: actingOn[request.uid], onClick: () => setApproveTarget(request), children: "Approve" }), _jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", loading: actingOn[request.uid], disabled: actingOn[request.uid], onClick: () => handleDeny(request), children: "Deny" })] })), !matter.closedAt && (request.status === "approved" || request.status === "fulfilled") && (_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", onClick: () => handleGetMaterial(request), children: "Get material" }))] })] }, request.uid))) })), _jsx(LoadMoreButton, { list: requests, label: "Load more access requests" })] }), _jsxs("div", { className: "bg-surface border border-border rounded-md p-6", children: [_jsxs("div", { className: "flex items-center justify-between mb-3", children: [_jsx("h2", { className: "text-base font-bold uppercase tracking-wide", children: "Export this matter" }), !matter.closedAt && (_jsx(Button, { type: "button", className: "!w-auto", loading: creatingExport, disabled: creatingExport, onClick: handleCreateExport, children: "+ New export" }))] }), _jsx("p", { className: "text-xs text-text-muted mb-3", children: "Exports messages (narrowed to this matter\u2019s own date range), plus full contacts, calendar events, tasks, and notes, from every custodian mailbox actually assigned to this matter\u2019s escrow scope, as one combined NDJSON file." }), exportError && _jsx(Alert, { children: exportError }), exportRequests.loadError && _jsx(Alert, { children: exportRequests.loadError }), matterExportRequests.length === 0 ? (_jsx("p", { className: "text-sm text-text-muted", children: exportRequests.loading ? "Loading…" : "No export requests yet." })) : (_jsx("ul", { className: "flex flex-col gap-2", children: matterExportRequests.map((request) => (_jsxs("li", { className: "flex items-center justify-between gap-3 text-sm py-1.5 px-3 bg-surface-alt rounded-sm", children: [_jsxs("span", { children: [new Date(request.dateCreated).toLocaleString(), request.status === "failed" && request.errorMessage && (_jsxs("span", { className: "text-danger", children: [" \u2014 ", request.errorMessage] }))] }), _jsxs("span", { className: "flex items-center gap-3", children: [_jsx("span", { className: `text-xs font-bold uppercase tracking-wide py-0.5 px-2 rounded-pill ${statusBadgeClass(request.status)}`, children: statusLabel(request.status) }), !matter.closedAt && request.status === "ready" && (_jsx("a", { href: matterExportRequestDownloadUrl(request.uid), className: "text-primary-dark hover:underline font-medium", children: "Download" }))] })] }, request.uid))) }))] }), _jsxs("div", { className: "bg-surface border border-border rounded-md p-6", children: [_jsx("h2", { className: "text-base font-bold uppercase tracking-wide mb-3", children: "Search this matter\u2019s custodians" }), matter.closedAt ? (_jsx("p", { className: "text-sm text-text-muted", children: "This matter is closed, so its custodians can no longer be searched or exported." })) : (_jsxs("form", { onSubmit: handleSearch, className: "flex gap-3 mb-4", children: [_jsx("input", { "aria-label": "Search this matter", className: INPUT_CLASS, value: searchText, onChange: (e) => setSearchText(e.target.value), placeholder: "Free text or an operator filter, e.g. from:alice@example.com" }), _jsx(Button, { type: "submit", className: "!w-auto shrink-0", loading: searching, disabled: searching || !searchText.trim(), children: "Search" })] })), searchError && _jsx(Alert, { children: searchError }), searchResults &&
+                        (Object.keys(searchResults).length === 0 ? (_jsx("p", { className: "text-sm text-text-muted", children: "No custodian mailboxes could be searched." })) : (_jsx("div", { className: "flex flex-col gap-4", children: Object.entries(searchResults).map(([mailboxUid, page]) => (_jsxs("div", { children: [_jsx("h3", { className: "text-sm font-semibold mb-2", children: mailboxUid }), page.results.length === 0 ? (_jsx("p", { className: "text-xs text-text-muted", children: "No matches." })) : (_jsx("ul", { className: "flex flex-col gap-1", children: page.results.map((result) => (_jsxs("li", { className: "text-sm py-1 px-2 bg-surface-alt rounded-sm", children: [result.entityType, " \u00B7 ", result.entityUid, result.snippet && _jsxs("span", { className: "text-text-muted", children: [" \u2014 ", result.snippet] })] }, `${result.entityType}-${result.entityUid}`))) }))] }, mailboxUid))) })))] }), _jsxs(Modal, { open: confirmingClose, onClose: closeCloseModal, title: "Close matter", children: [_jsxs("p", { className: "text-sm mb-3", children: ["Close ", _jsx("strong", { children: matter.name }), "? Once closed, no new access requests, exports, searches, or key material reads are allowed under it. This cannot be reopened here."] }), _jsxs("dl", { className: "grid grid-cols-[auto_1fr] gap-x-4 gap-y-1 text-sm mb-4", children: [_jsx("dt", { className: "text-text-muted", children: "Custodians" }), _jsx("dd", { className: "break-all", children: matter.custodianMailboxUids.join(", ") }), _jsx("dt", { className: "text-text-muted", children: "Date range" }), _jsx("dd", { children: formatDateRange(matter) })] }), closeError && _jsx(Alert, { children: closeError }), _jsxs("div", { className: "flex gap-3 justify-end", children: [_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", disabled: closing, onClick: closeCloseModal, children: "Cancel" }), _jsx(Button, { type: "button", className: "!w-auto !bg-none !bg-danger !border-danger hover:!bg-danger", loading: closing, disabled: closing, onClick: handleClose, children: "Close matter" })] })] }), _jsxs(Modal, { open: approveTarget !== null, onClose: () => setApproveTarget(null), title: "Approve access request", children: [_jsx("p", { className: "text-sm mb-3", children: "Approving lets holders of this matter\u2019s escrow scope read the key material for this mailbox once enough holders have approved." }), _jsxs("dl", { className: "grid grid-cols-[auto_1fr] gap-x-4 gap-y-1 text-sm mb-4", children: [_jsx("dt", { className: "text-text-muted", children: "Matter" }), _jsx("dd", { children: matter.name }), _jsx("dt", { className: "text-text-muted", children: "Mailbox" }), _jsx("dd", { className: "break-all", children: approveTarget?.mailboxUid }), _jsx("dt", { className: "text-text-muted", children: "Date range" }), _jsx("dd", { children: formatDateRange(matter) }), _jsx("dt", { className: "text-text-muted", children: "Approvals" }), _jsxs("dd", { children: [approveTarget?.approvals.length, " of ", approveTarget?.requiredHoldersAtCreation, " so far, including requester ", approveTarget?.requestedByUserUid] })] }), _jsxs("div", { className: "flex gap-3 justify-end", children: [_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", onClick: () => setApproveTarget(null), children: "Cancel" }), _jsx(Button, { type: "button", className: "!w-auto", onClick: () => void handleApprove(), children: "Approve request" })] })] }), _jsx(Modal, { open: showNewRequest, onClose: () => setShowNewRequest(false), title: "New access request", children: _jsxs("form", { onSubmit: handleCreateRequest, className: "flex flex-col gap-4", children: [newRequestError && _jsx(Alert, { children: newRequestError }), _jsx(FormField, { label: "Mailbox uid", htmlFor: "newRequestMailboxUid", children: _jsx("input", { id: "newRequestMailboxUid", type: "text", className: INPUT_CLASS, value: newRequestMailboxUid, onChange: (e) => setNewRequestMailboxUid(e.target.value) }) }), _jsx("p", { className: "text-xs text-text-muted", children: "Must be one of this matter's own custodian mailboxes, currently assigned to this matter's escrow scope. Your own creation counts as the first approval." }), _jsxs("div", { className: "flex gap-3 justify-end", children: [_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", disabled: creatingRequest, onClick: () => setShowNewRequest(false), children: "Cancel" }), _jsx(Button, { type: "submit", className: "!w-auto", loading: creatingRequest, disabled: creatingRequest, children: "Create request" })] })] }) }), _jsx(Modal, { open: materialFor !== null, onClose: closeMaterialModal, title: "Escrow key material", children: loadingMaterial ? (_jsx("p", { className: "text-sm text-text-muted", children: "Loading\u2026" })) : materialError ? (_jsx(Alert, { children: materialError })) : (_jsxs(_Fragment, { children: [_jsxs("p", { className: "text-sm text-text-muted mb-3", children: ["Still-encrypted master key wraps for ", _jsx("strong", { children: materialFor?.mailboxUid }), " \u2014 this server cannot decrypt these either. Copy the JSON below into your own offline tooling."] }), _jsx("pre", { className: "text-xs font-mono bg-surface-alt border border-border rounded-sm p-3 overflow-x-auto whitespace-pre-wrap break-all", children: materialText })] })) })] }));
 }

package/dist/apps/escrow/matters/new/index.d.ts

@@ -0,0 +1,3 @@
+import React from "react";
+import { EscrowShellProps } from "../../../shared/components/escrow/layout/EscrowShell.js";
+export default function NewMatterPage(props: Omit<EscrowShellProps, "active">): React.JSX.Element;

package/dist/apps/shared/components/admin/distributionLists/MemberListCard.d.ts

@@ -0,0 +1,17 @@
+import React from "react";
+import { DistributionList } from "@rapidmx/react-shared/admin/distributionListsApi.js";
+export interface MemberListCardProps {
+    list: DistributionList;
+    /** Called with the freshly-saved list (new `version`, updated `memberAddresses`) after a successful
+     * add/remove, so the parent detail page can keep its own copy of the list in sync — mirrors
+     * `ShareAccessCard`'s `reload()` pattern, just pushed up rather than re-fetched, since the caller
+     * already has everything the response would return. */
+    onUpdate: (list: DistributionList) => void;
+}
+/**
+ * Lets an admin view and edit a distribution list's members — same load/inline-add-row/per-row-remove
+ * interaction shape as `ShareAccessCard`, but against a plain `memberAddresses: string[]` field on the
+ * `DistributionList` itself via read-modify-write `PUT`, not a separate ACL endpoint (a distribution
+ * list has no per-record ACL to speak of — see `BaseDistributionListRoute`'s own doc comment).
+ */
+export default function MemberListCard({ list, onUpdate }: MemberListCardProps): React.JSX.Element;

package/dist/apps/shared/components/admin/escrowScopes/EscrowScopeKeyAndHoldersFields.d.ts

@@ -0,0 +1,32 @@
+import React from "react";
+/** The part of an `EscrowScope` shared by the "new" and "[uid]" pages — everything except `name`/
+ * `description`, which stay plain inline `FormField`s on each page (same split `distribution-lists`
+ * already uses: simple top-level fields inline, the more involved sub-structure factored out). An admin
+ * pastes in the fields of an already-issued certificate here; nothing in this app generates a keypair —
+ * see `EscrowScopePublicKey`'s own doc comment in `escrowScopesApi.ts`. */
+export interface EscrowScopeKeyAndHoldersValue {
+    publicKey: string;
+    keyType: string;
+    fingerprint: string;
+    /** `<input type="datetime-local">` value — see `toDatetimeLocal()`. */
+    notBefore: string;
+    notAfter: string;
+    holderUserUids: string[];
+    requiredHolders: number;
+    notifySubjectOnAccess: boolean;
+}
+export interface EscrowScopeKeyAndHoldersFieldsProps {
+    value: EscrowScopeKeyAndHoldersValue;
+    onChange: (value: EscrowScopeKeyAndHoldersValue) => void;
+    disabled?: boolean;
+    /** Shows the public key fields without letting them be edited, e.g. for keys generated in the browser. */
+    keyReadOnly?: boolean;
+}
+/** Builds an all-zeroes starting point for the "new" page — `notBefore`/`notAfter` default to "now" so an
+ * admin pasting in a cert's own dates only has to touch what actually differs. */
+export declare function emptyEscrowScopeKeyAndHoldersValue(): EscrowScopeKeyAndHoldersValue;
+/** The message shown when an administrator tries to make themselves a holder: whoever configures a scope must not
+ * also be able to approve access under it (separation of duties - the server refuses it too). Holders who were
+ * already on the scope (`existingHolderUserUids`) aren't treated as newly added. */
+export declare function selfAsHolderError(holderUserUids: string[], adminUid: string | undefined, existingHolderUserUids?: string[]): string | null;
+export default function EscrowScopeKeyAndHoldersFields({ value, onChange, disabled, keyReadOnly }: EscrowScopeKeyAndHoldersFieldsProps): React.JSX.Element;

package/dist/apps/shared/components/admin/escrowScopes/EscrowScopeKeyAndHoldersFields.js

@@ -18,9 +18,18 @@ export function emptyEscrowScopeKeyAndHoldersValue() {
         notifySubjectOnAccess: false,
     };
 }
-export default function EscrowScopeKeyAndHoldersFields({ value, onChange, disabled }) {
+/** The message shown when an administrator tries to make themselves a holder: whoever configures a scope must not
+ * also be able to approve access under it (separation of duties - the server refuses it too). Holders who were
+ * already on the scope (`existingHolderUserUids`) aren't treated as newly added. */
+export function selfAsHolderError(holderUserUids, adminUid, existingHolderUserUids = []) {
+    if (!adminUid || !holderUserUids.includes(adminUid) || existingHolderUserUids.includes(adminUid)) {
+        return null;
+    }
+    return "You can't add yourself as a holder of an escrow scope you configure. Ask another administrator to add you, or choose different holders.";
+}
+export default function EscrowScopeKeyAndHoldersFields({ value, onChange, disabled, keyReadOnly }) {
     function set(key, next) {
         onChange({ ...value, [key]: next });
     }
-    return (_jsxs(_Fragment, { children: [_jsxs("div", { className: "bg-surface border border-border rounded-md p-6", children: [_jsx("h2", { className: "text-base font-bold uppercase tracking-wide mb-1", children: "Public key" }), _jsx("p", { className: "text-sm text-text-muted mb-4", children: "The fields of an already-issued certificate \u2014 this server never generates or holds the corresponding private key." }), _jsx(FormField, { label: "Public key (base64)", htmlFor: "publicKey", children: _jsx("textarea", { id: "publicKey", className: `${INPUT_CLASS} font-mono text-xs`, rows: 4, value: value.publicKey, disabled: disabled, onChange: (e) => set("publicKey", e.target.value) }) }), _jsx(FormField, { label: "Key type", htmlFor: "keyType", children: _jsx("input", { id: "keyType", type: "text", className: INPUT_CLASS, value: value.keyType, disabled: disabled, onChange: (e) => set("keyType", e.target.value), placeholder: "x509" }) }), _jsx(FormField, { label: "Fingerprint (hex SHA-256)", htmlFor: "fingerprint", children: _jsx("input", { id: "fingerprint", type: "text", className: `${INPUT_CLASS} font-mono`, value: value.fingerprint, disabled: disabled, onChange: (e) => set("fingerprint", e.target.value) }) }), _jsxs("div", { className: "grid grid-cols-1 sm:grid-cols-2 gap-x-4", children: [_jsx(FormField, { label: "Not before", htmlFor: "notBefore", children: _jsx("input", { id: "notBefore", type: "datetime-local", className: INPUT_CLASS, value: value.notBefore, disabled: disabled, onChange: (e) => set("notBefore", e.target.value) }) }), _jsx(FormField, { label: "Not after", htmlFor: "notAfter", children: _jsx("input", { id: "notAfter", type: "datetime-local", className: INPUT_CLASS, value: value.notAfter, disabled: disabled, onChange: (e) => set("notAfter", e.target.value) }) })] })] }), _jsxs("div", { className: "bg-surface border border-border rounded-md p-6", children: [_jsx("h2", { className: "text-base font-bold uppercase tracking-wide mb-1", children: "Holders & dual control" }), _jsx("p", { className: "text-sm text-text-muted mb-4", children: "Every uid below is granted the eDiscovery/compliance holder role for this scope \u2014 a deliberately separate role from server administration. At least one holder is required." }), _jsx(StringListField, { label: "Holder user uids", id: "holderUserUids", values: value.holderUserUids, onChange: (holderUserUids) => set("holderUserUids", holderUserUids), placeholder: "User uid to add", emptyMessage: "No holders added yet.", disabled: disabled }), _jsx(FormField, { label: "Required holders (M-of-N dual control)", htmlFor: "requiredHolders", children: _jsx("input", { id: "requiredHolders", type: "number", className: INPUT_CLASS, value: value.requiredHolders, disabled: disabled, onChange: (e) => set("requiredHolders", Number(e.target.value) || 1) }) }), _jsxs("label", { className: "flex items-center gap-2 text-sm", children: [_jsx("input", { type: "checkbox", checked: value.notifySubjectOnAccess, disabled: disabled, onChange: (e) => set("notifySubjectOnAccess", e.target.checked) }), "Notify subject on access"] })] })] }));
+    return (_jsxs(_Fragment, { children: [_jsxs("div", { className: "bg-surface border border-border rounded-md p-6", children: [_jsx("h2", { className: "text-base font-bold uppercase tracking-wide mb-1", children: "Public key" }), _jsx("p", { className: "text-sm text-text-muted mb-4", children: "The fields of an already-issued certificate \u2014 this server never generates or holds the corresponding private key." }), _jsx(FormField, { label: "Public key (base64)", htmlFor: "publicKey", children: _jsx("textarea", { id: "publicKey", className: `${INPUT_CLASS} font-mono text-xs`, rows: 4, value: value.publicKey, disabled: disabled, readOnly: keyReadOnly, onChange: (e) => set("publicKey", e.target.value) }) }), _jsx(FormField, { label: "Key type", htmlFor: "keyType", children: _jsx("input", { id: "keyType", type: "text", className: INPUT_CLASS, value: value.keyType, disabled: disabled, readOnly: keyReadOnly, onChange: (e) => set("keyType", e.target.value), placeholder: "x509" }) }), _jsx(FormField, { label: "Fingerprint (hex SHA-256)", htmlFor: "fingerprint", children: _jsx("input", { id: "fingerprint", type: "text", className: `${INPUT_CLASS} font-mono`, value: value.fingerprint, disabled: disabled, readOnly: keyReadOnly, onChange: (e) => set("fingerprint", e.target.value) }) }), _jsxs("div", { className: "grid grid-cols-1 sm:grid-cols-2 gap-x-4", children: [_jsx(FormField, { label: "Not before", htmlFor: "notBefore", children: _jsx("input", { id: "notBefore", type: "datetime-local", className: INPUT_CLASS, value: value.notBefore, disabled: disabled, readOnly: keyReadOnly, onChange: (e) => set("notBefore", e.target.value) }) }), _jsx(FormField, { label: "Not after", htmlFor: "notAfter", children: _jsx("input", { id: "notAfter", type: "datetime-local", className: INPUT_CLASS, value: value.notAfter, disabled: disabled, readOnly: keyReadOnly, onChange: (e) => set("notAfter", e.target.value) }) })] })] }), _jsxs("div", { className: "bg-surface border border-border rounded-md p-6", children: [_jsx("h2", { className: "text-base font-bold uppercase tracking-wide mb-1", children: "Holders & dual control" }), _jsx("p", { className: "text-sm text-text-muted mb-4", children: "Every uid below is granted the eDiscovery/compliance holder role for this scope \u2014 a deliberately separate role from server administration. At least one holder is required." }), _jsx(StringListField, { label: "Holder user uids", id: "holderUserUids", values: value.holderUserUids, onChange: (holderUserUids) => set("holderUserUids", holderUserUids), placeholder: "User uid to add", emptyMessage: "No holders added yet.", disabled: disabled }), _jsx(FormField, { label: "Required holders (M-of-N dual control)", htmlFor: "requiredHolders", children: _jsx("input", { id: "requiredHolders", type: "number", className: INPUT_CLASS, value: value.requiredHolders, disabled: disabled, onChange: (e) => set("requiredHolders", Number(e.target.value) || 1) }) }), _jsxs("label", { className: "flex items-center gap-2 text-sm", children: [_jsx("input", { type: "checkbox", checked: value.notifySubjectOnAccess, disabled: disabled, onChange: (e) => set("notifySubjectOnAccess", e.target.checked) }), "Notify subject on access"] })] })] }));
 }

package/dist/apps/shared/components/admin/layout/AdminShell.d.ts

@@ -0,0 +1,32 @@
+import "../../../styles/app.css";
+import React, { PropsWithChildren } from "react";
+import { NavItem } from "@rapidmx/react-shared/components/navigation/BottomTabBar.js";
+import { PluginNav, PluginNavProps } from "../../../plugins/pluginNav.js";
+export type AdminSection = "mailboxes" | "quarantine" | "ingestQueue" | "domains" | "auditLog" | "distributionLists" | "transportRules" | "escrowScopes" | "retentionPolicy" | "encryptionPolicy" | "mailboxPolicy" | "setup" | "dataRequests" | "plugins" | "branding";
+/** A core `AdminSection`, or a plugin's `adminNav` item id (see `PluginNav`). */
+export type AdminShellActive = AdminSection | (string & {});
+export interface AdminShellProps extends PluginNavProps {
+    /** Which icon in the rail is highlighted as the current section - a plugin admin page passes its own
+     * `adminNav` item id. */
+    active: AdminShellActive;
+    /** Populated automatically by the framework from an authenticated request (e.g. a valid `jwt` cookie). */
+    userUid?: string;
+    /** auth-server's base URL, injected via the route's `fetchProps` — see `src/mongo/routes/AdminConsoleRoute.ts`. */
+    authServerUrl?: string;
+    /**
+     * Where `mailApi.ts`'s `impersonateUser()`/`stopImpersonating()` should call: the real auth-server in
+     * production, or `""` under `yarn dev` to call this app's own local dev-only impersonation endpoint
+     * instead — see `AdminConsoleRoute`'s `fetchProps` and `src/dev/DevImpersonationRoute.ts`.
+     */
+    impersonationBaseUrl?: string;
+}
+/** `NAV_ITEMS` followed by the plugins' `adminNav` items (generic icon). Core ids win, including the
+ * off-rail sections' - see `mergePluginNavItems`. */
+export declare function adminNavItems(pluginNav?: PluginNav): NavItem[];
+/**
+ * Gates every `apps/admin` page behind the `admin` trusted role. Uses `GET /api/admin/release-notes` (any
+ * `BaseAdminRoute` endpoint works — this one is side-effect-free) purely as a canary: a 200 means the
+ * caller's JWT carries a trusted role, a 403 means it doesn't. There is no local step-up/elevation flow
+ * (that would need a cross-origin call to auth-server's own elevation endpoint — not wired up yet).
+ */
+export default function AdminShell({ active, userUid, authServerUrl, pluginNav, children }: PropsWithChildren<AdminShellProps>): React.JSX.Element;

package/dist/apps/shared/components/admin/layout/AdminShell.js

@@ -14,6 +14,8 @@ import Alert from "@rapidmx/react-shared/components/feedback/Alert.js";
 import BottomTabBar from "@rapidmx/react-shared/components/navigation/BottomTabBar.js";
 import { BrandingFooter, BrandingHeader } from "../../layout/BrandingChrome.js";
 import UserMenu from "../../layout/UserMenu.js";
+import { signOutOfConsole } from "../signOut.js";
+import { mergePluginNavItems } from "../../../plugins/pluginNav.js";
 /** Sections shown in the persistent icon rail / mobile tab bar — every admin area reachable from
  * anywhere in the console. Deliberately excludes `quarantine`/`ingestQueue`: those are scoped to a
  * single mailbox and only ever reached via links on that mailbox's own detail page (see
@@ -75,14 +77,19 @@ const MAILBOX_SCOPED_ITEMS = [
 ];
 /** The setup wizard - reached by redirect or from the Mailboxes page, not from the rail. */
 const SETUP_ITEM = { id: "setup", href: "/admin/setup", label: "Setup", icon: HiOutlineRocketLaunch };
-const ALL_ITEMS = [...NAV_ITEMS, ...MAILBOX_SCOPED_ITEMS, SETUP_ITEM];
+const OFF_RAIL_ITEMS = [...MAILBOX_SCOPED_ITEMS, SETUP_ITEM];
+/** `NAV_ITEMS` followed by the plugins' `adminNav` items (generic icon). Core ids win, including the
+ * off-rail sections' - see `mergePluginNavItems`. */
+export function adminNavItems(pluginNav) {
+    return mergePluginNavItems(NAV_ITEMS, pluginNav?.adminNav, ({ id, href, label }) => ({ id, href, label, icon: HiOutlinePuzzlePiece }), OFF_RAIL_ITEMS.map((item) => item.id));
+}
 /**
  * Gates every `apps/admin` page behind the `admin` trusted role. Uses `GET /api/admin/release-notes` (any
  * `BaseAdminRoute` endpoint works — this one is side-effect-free) purely as a canary: a 200 means the
  * caller's JWT carries a trusted role, a 403 means it doesn't. There is no local step-up/elevation flow
  * (that would need a cross-origin call to auth-server's own elevation endpoint — not wired up yet).
  */
-export default function AdminShell({ active, userUid, authServerUrl, children }) {
+export default function AdminShell({ active, userUid, authServerUrl, pluginNav, children }) {
     const [status, setStatus] = useState("checking");
     const [error, setError] = useState(null);
     const { branding, iconSrc } = useBranding();
@@ -118,7 +125,8 @@ export default function AdminShell({ active, userUid, authServerUrl, children })
         });
     }, [userUid]);
     function handleSignOut() {
-        window.location.href = authServerUrl ?? "/";
+        // Ends the auth-server session and tells other tabs, not just navigates - see `signOutOfConsole()`.
+        void signOutOfConsole(authServerUrl);
     }
     let content;
     if (!userUid || status === "checking") {
@@ -131,13 +139,14 @@ export default function AdminShell({ active, userUid, authServerUrl, children })
         content = (_jsx("div", { className: "min-h-screen flex items-center justify-center p-8", children: _jsx("div", { className: "w-full max-w-md", children: _jsx(Alert, { children: error }) }) }));
     }
     else {
-        const activeItem = ALL_ITEMS.find((item) => item.id === active);
-        content = (_jsx("div", { className: "min-h-screen flex flex-col bg-surface-alt", children: _jsxs("div", { className: "flex-1 flex min-h-0", children: [_jsxs("nav", { "aria-label": "Admin sections", className: "hidden md:flex w-16 shrink-0 bg-surface border-r border-border flex-col items-center py-3 gap-1", children: [_jsx("img", { src: iconSrc, width: "96", height: "96", alt: "", className: "mb-3" }), NAV_ITEMS.map(({ id, href, label, icon: Icon }) => (_jsx("a", { href: href, "aria-label": label, "aria-current": id === active ? "page" : undefined, title: label, className: [
+        const navItems = adminNavItems(pluginNav);
+        const activeItem = [...navItems, ...OFF_RAIL_ITEMS].find((item) => item.id === active);
+        content = (_jsx("div", { className: "min-h-screen flex flex-col bg-surface-alt", children: _jsxs("div", { className: "flex-1 flex min-h-0", children: [_jsxs("nav", { "aria-label": "Admin sections", className: "hidden md:flex w-16 shrink-0 bg-surface border-r border-border flex-col items-center py-3 gap-1", children: [_jsx("img", { src: iconSrc, width: "96", height: "96", alt: "", className: "mb-3" }), navItems.map(({ id, href, label, icon: Icon }) => (_jsx("a", { href: href, "aria-label": label, "aria-current": id === active ? "page" : undefined, title: label, className: [
                                     "w-10 h-10 flex items-center justify-center rounded-sm",
                                     id === active
                                         ? "bg-primary/10 text-primary-dark"
                                         : "text-text-muted hover:bg-surface-alt hover:text-text",
-                                ].join(" "), children: _jsx(Icon, { size: 20, "aria-hidden": "true" }) }, id)))] }), _jsx(BottomTabBar, { apps: NAV_ITEMS, active: active }), _jsxs("div", { className: "flex-1 flex flex-col min-w-0", children: [_jsxs("header", { className: "h-16 shrink-0 bg-surface border-b border-border flex items-center justify-between gap-4 px-6", children: [_jsx("span", { className: "font-display font-bold text-lg uppercase tracking-wide", children: activeItem?.label }), _jsx(UserMenu, { userUid: userUid, authServerUrl: authServerUrl, onSignOut: handleSignOut })] }), _jsx("div", { className: "flex-1 pb-14 md:pb-0", children: _jsx("main", { className: "max-w-6xl mx-auto px-6 py-8", children: children }) })] })] }) }));
+                                ].join(" "), children: _jsx(Icon, { size: 20, "aria-hidden": "true" }) }, id)))] }), _jsx(BottomTabBar, { apps: navItems, active: active }), _jsxs("div", { className: "flex-1 flex flex-col min-w-0", children: [_jsxs("header", { className: "h-16 shrink-0 bg-surface border-b border-border flex items-center justify-between gap-4 px-6", children: [_jsx("span", { className: "font-display font-bold text-lg uppercase tracking-wide", children: activeItem?.label }), _jsx(UserMenu, { userUid: userUid, authServerUrl: authServerUrl, onSignOut: handleSignOut })] }), _jsx("div", { className: "flex-1 pb-14 md:pb-0", children: _jsx("main", { className: "max-w-6xl mx-auto px-6 py-8", children: children }) })] })] }) }));
     }
     return (_jsxs(_Fragment, { children: [_jsx(BrandingHeader, { branding: branding }), content, _jsx(BrandingFooter, { branding: branding })] }));
 }

package/dist/apps/shared/components/admin/mailboxes/EscrowScopeCard.d.ts

@@ -0,0 +1,12 @@
+import React from "react";
+import { Mailbox } from "@rapidmx/react-shared/mail/mailApi.js";
+export interface EscrowScopeCardProps {
+    mailbox: Mailbox;
+    /** Called with the saved mailbox, same push-up pattern as `ResourceSettingsCard`. */
+    onUpdate: (mailbox: Mailbox) => void;
+}
+/**
+ * Assigns a mailbox to an escrow scope (or none), which decides whose holders can recover its encrypted mail. Only
+ * shown in the admin console, whose trusted-role gate the server enforces again for `escrowScopeId`.
+ */
+export default function EscrowScopeCard({ mailbox, onUpdate }: EscrowScopeCardProps): React.JSX.Element;