@rapidmx/web-client 0.5.0 → 0.7.0

package/apps/www/messages/[uid].tsx

@@ -24,7 +24,7 @@ export default function MessageDetailPage(props: MailShellProps & { params: { ui
 }
 
 function MessageDetailContent({ uid }: { uid: string }) {
-    const { mailboxFolders, mailboxUid } = useMailShell();
+    const { mailboxFolders, mailboxUid, onFolderCreated } = useMailShell();
     const [message, setMessage] = useState<Message | null>(null);
     const [loading, setLoading] = useState(true);
     const [error, setError] = useState<string | null>(null);
@@ -77,7 +77,6 @@ function MessageDetailContent({ uid }: { uid: string }) {
     const backHref = `/?mailboxUid=${encodeURIComponent(message.mailboxUid)}&folderUid=${encodeURIComponent(message.folderUid)}`;
     const isSentItems = folders.find((f) => f.uid === message.folderUid)?.type === "sent_items";
     const isOutbox = folders.find((f) => f.uid === message.folderUid)?.type === "outbox";
-    const isInbox = folders.find((f) => f.uid === message.folderUid)?.type === "inbox";
     const draftsFolderUid = folders.find((f) => f.type === "drafts")?.uid;
     return (
         <MessageDetailPane
@@ -87,14 +86,16 @@ function MessageDetailContent({ uid }: { uid: string }) {
             isSentItems={isSentItems}
             onRecalled={setMessage}
             isOutbox={isOutbox}
-            isInbox={isInbox}
-            onClassified={setMessage}
             onReceiptHandled={setMessage}
             draftsFolderUid={draftsFolderUid}
+            folders={folders}
+            onMoved={setMessage}
+            onFolderCreated={onFolderCreated}
             onScheduledSendCanceled={setMessage}
             onArchived={setMessage}
             labels={labels}
             onLabelsChanged={setMessage}
+            onLabelCreated={(label) => setLabels((prev) => [...prev, label])}
         />
     );
 }

package/dist/apps/admin/_404.d.ts

@@ -0,0 +1,2 @@
+import React from "react";
+export default function NotFoundPage(): React.JSX.Element;

package/dist/apps/admin/_500.d.ts

@@ -0,0 +1,2 @@
+import React from "react";
+export default function ErrorPage(): React.JSX.Element;

package/dist/apps/admin/_layout.d.ts

@@ -0,0 +1,8 @@
+import React, { PropsWithChildren } from "react";
+import { Branding } from "@rapidmx/react-shared/branding/brandingApi.js";
+export interface LayoutProps {
+    /** See `apps/www/_layout.tsx`'s `LayoutProps` doc comment - identical mechanism, supplied by
+     * `AdminConsoleRoute`'s `fetchProps()` override. */
+    branding?: Branding;
+}
+export default function Layout({ children, branding }: PropsWithChildren<LayoutProps>): React.JSX.Element;

package/dist/apps/admin/audit-log/index.d.ts

@@ -0,0 +1,11 @@
+import React from "react";
+import { AuditLogFilters } from "@rapidmx/react-shared/admin/auditLogApi.js";
+import { AdminShellProps } from "../../shared/components/admin/layout/AdminShell.js";
+/** How long typing in a filter box has to pause before the log is re-fetched. */
+export declare const FILTER_DEBOUNCE_MS = 300;
+/** Seeds the filter form from the query string on first render — lets a link (e.g. a future "View audit
+ * log" deep link from a mailbox's detail page) land here pre-filtered, same convention as `quarantine`'s
+ * `readMailboxUid()`. Filters are also written back to the URL as they change, so the filtered view
+ * itself is shareable/bookmarkable. */
+export declare function readFiltersFromUrl(): AuditLogFilters;
+export default function AuditLogPage(props: Omit<AdminShellProps, "active">): React.JSX.Element;

package/dist/apps/admin/branding/index.d.ts

@@ -0,0 +1,3 @@
+import React from "react";
+import { AdminShellProps } from "../../shared/components/admin/layout/AdminShell.js";
+export default function BrandingPage(props: Omit<AdminShellProps, "active">): React.JSX.Element;

package/dist/apps/admin/data-requests/index.d.ts

@@ -0,0 +1,3 @@
+import React from "react";
+import { AdminShellProps } from "../../shared/components/admin/layout/AdminShell.js";
+export default function DataRequestsPage(props: Omit<AdminShellProps, "active">): React.JSX.Element;

package/dist/apps/admin/distribution-lists/[uid].d.ts

@@ -0,0 +1,7 @@
+import React from "react";
+import { AdminShellProps } from "../../shared/components/admin/layout/AdminShell.js";
+export default function DistributionListDetailPage(props: Omit<AdminShellProps, "active"> & {
+    params: {
+        uid: string;
+    };
+}): React.JSX.Element;

package/dist/apps/admin/distribution-lists/index.d.ts

@@ -0,0 +1,3 @@
+import React from "react";
+import { AdminShellProps } from "../../shared/components/admin/layout/AdminShell.js";
+export default function DistributionListsPage(props: Omit<AdminShellProps, "active">): React.JSX.Element;

package/dist/apps/admin/distribution-lists/new/index.d.ts

@@ -0,0 +1,3 @@
+import React from "react";
+import { AdminShellProps } from "../../../shared/components/admin/layout/AdminShell.js";
+export default function NewDistributionListPage(props: Omit<AdminShellProps, "active">): React.JSX.Element;

package/dist/apps/admin/domains/[uid].d.ts

@@ -0,0 +1,7 @@
+import React from "react";
+import { AdminShellProps } from "../../shared/components/admin/layout/AdminShell.js";
+export default function DomainDetailPage(props: Omit<AdminShellProps, "active"> & {
+    params: {
+        uid: string;
+    };
+}): React.JSX.Element;

package/dist/apps/admin/domains/index.d.ts

@@ -0,0 +1,3 @@
+import React from "react";
+import { AdminShellProps } from "../../shared/components/admin/layout/AdminShell.js";
+export default function DomainsListPage(props: Omit<AdminShellProps, "active">): React.JSX.Element;

package/dist/apps/admin/domains/new/index.d.ts

@@ -0,0 +1,3 @@
+import React from "react";
+import { AdminShellProps } from "../../../shared/components/admin/layout/AdminShell.js";
+export default function NewDomainPage(props: Omit<AdminShellProps, "active">): React.JSX.Element;

package/dist/apps/admin/encryption-policy/index.d.ts

@@ -0,0 +1,3 @@
+import React from "react";
+import { AdminShellProps } from "../../shared/components/admin/layout/AdminShell.js";
+export default function EncryptionPolicyPage(props: Omit<AdminShellProps, "active">): React.JSX.Element;

package/dist/apps/admin/escrow-scopes/[uid].d.ts

@@ -0,0 +1,21 @@
+import React from "react";
+import { EscrowScope, EscrowScopePublicKey } from "@rapidmx/react-shared/admin/escrowScopesApi.js";
+import { AdminShellProps } from "../../shared/components/admin/layout/AdminShell.js";
+import { EscrowScopeKeyAndHoldersValue } from "../../shared/components/admin/escrowScopes/EscrowScopeKeyAndHoldersFields.js";
+/**
+ * Describes every change to the security-relevant parts of a scope - who holds it, how many holders must approve,
+ * and its public key - so the administrator confirms exactly what they're changing before it's saved.
+ */
+export declare function describeSecurityChanges(original: EscrowScope, next: EscrowScopeKeyAndHoldersValue): string[];
+/**
+ * The `publicKey` to send with an update, or `undefined` when the admin didn't touch any key field - the form only
+ * shows dates to the minute, so re-sending a rebuilt key would silently truncate the stored validity window. A date
+ * field left as loaded keeps its original epoch-ms value. `revokedAt` isn't editable here: it's carried over when
+ * only the validity window changed, and dropped when the key material itself is replaced (a new key isn't revoked).
+ */
+export declare function buildPublicKeyUpdate(original: EscrowScope, next: EscrowScopeKeyAndHoldersValue): EscrowScopePublicKey | undefined;
+export default function EscrowScopeDetailPage(props: Omit<AdminShellProps, "active"> & {
+    params: {
+        uid: string;
+    };
+}): React.JSX.Element;

package/dist/apps/admin/escrow-scopes/index.d.ts

@@ -0,0 +1,3 @@
+import React from "react";
+import { AdminShellProps } from "../../shared/components/admin/layout/AdminShell.js";
+export default function EscrowScopesPage(props: Omit<AdminShellProps, "active">): React.JSX.Element;

package/dist/apps/admin/escrow-scopes/new/index.d.ts

@@ -0,0 +1,3 @@
+import React from "react";
+import { AdminShellProps } from "../../../shared/components/admin/layout/AdminShell.js";
+export default function NewEscrowScopePage(props: Omit<AdminShellProps, "active">): React.JSX.Element;

package/dist/apps/admin/index.d.ts

@@ -0,0 +1,3 @@
+import React from "react";
+import { AdminShellProps } from "../shared/components/admin/layout/AdminShell.js";
+export default function MailboxesListPage(props: Omit<AdminShellProps, "active">): React.JSX.Element;

package/dist/apps/admin/ingest-queue/index.d.ts

@@ -0,0 +1,4 @@
+import React from "react";
+import { AdminShellProps } from "../../shared/components/admin/layout/AdminShell.js";
+export declare function readMailboxUid(): string | null;
+export default function IngestQueuePage(props: Omit<AdminShellProps, "active">): React.JSX.Element;

package/dist/apps/admin/mailbox-policy/index.d.ts

@@ -0,0 +1,3 @@
+import React from "react";
+import { AdminShellProps } from "../../shared/components/admin/layout/AdminShell.js";
+export default function MailboxPolicyPage(props: Omit<AdminShellProps, "active">): React.JSX.Element;

package/dist/apps/admin/mailboxes/[uid].d.ts

@@ -0,0 +1,7 @@
+import React from "react";
+import { AdminShellProps } from "../../shared/components/admin/layout/AdminShell.js";
+export default function MailboxDetailPage(props: Omit<AdminShellProps, "active"> & {
+    params: {
+        uid: string;
+    };
+}): React.JSX.Element;

package/dist/apps/admin/mailboxes/new/index.d.ts

@@ -0,0 +1,3 @@
+import React from "react";
+import { AdminShellProps } from "../../../shared/components/admin/layout/AdminShell.js";
+export default function NewMailboxPage(props: Omit<AdminShellProps, "active">): React.JSX.Element;

package/dist/apps/admin/plugins/index.d.ts

@@ -0,0 +1,3 @@
+import React from "react";
+import { AdminShellProps } from "../../shared/components/admin/layout/AdminShell.js";
+export default function PluginsPage(props: Omit<AdminShellProps, "active">): React.JSX.Element;

package/dist/apps/admin/quarantine/index.d.ts

@@ -0,0 +1,6 @@
+import React from "react";
+import { AdminShellProps } from "../../shared/components/admin/layout/AdminShell.js";
+export declare function readMailboxUid(): string | null;
+export default function QuarantinePage(props: Omit<AdminShellProps, "active"> & {
+    userUid?: string;
+}): React.JSX.Element;

package/dist/apps/admin/retention-policy/index.d.ts

@@ -0,0 +1,3 @@
+import React from "react";
+import { AdminShellProps } from "../../shared/components/admin/layout/AdminShell.js";
+export default function RetentionPolicyPage(props: Omit<AdminShellProps, "active">): React.JSX.Element;

package/dist/apps/admin/setup/index.d.ts

@@ -0,0 +1,3 @@
+import React from "react";
+import { AdminShellProps } from "../../shared/components/admin/layout/AdminShell.js";
+export default function SetupPage(props: Omit<AdminShellProps, "active">): React.JSX.Element;

package/dist/apps/admin/transport-rules/[uid].d.ts

@@ -0,0 +1,7 @@
+import React from "react";
+import { AdminShellProps } from "../../shared/components/admin/layout/AdminShell.js";
+export default function TransportRuleDetailPage(props: Omit<AdminShellProps, "active"> & {
+    params: {
+        uid: string;
+    };
+}): React.JSX.Element;

package/dist/apps/admin/transport-rules/_transportRuleConfig.d.ts

@@ -0,0 +1,21 @@
+import React from "react";
+import { TransportRuleAction, TransportRuleConditions } from "@rapidmx/react-shared/admin/transportRulesApi.js";
+import { ActionTypeDef, ConditionFieldDef } from "../../shared/components/rules/RuleBuilder.js";
+/** Refused outright when a rule has no conditions: it would reject or quarantine every message the server receives. */
+export declare const NO_CONDITIONS_BLOCKED_MESSAGE = "Add at least one condition. A rule without conditions that rejects or quarantines mail would do so for every message.";
+/**
+ * How a save should proceed given a rule's conditions: `"ok"` with at least one condition, `"blocked"` with none and a
+ * reject/quarantine action, or `"confirm"` with none and only other actions (which then apply to every message).
+ */
+export declare function checkRuleConditions(rule: {
+    conditions: TransportRuleConditions;
+    actions: TransportRuleAction[];
+}): "ok" | "blocked" | "confirm";
+/** Asks before saving a rule with no conditions whose actions will run on every message. */
+export declare function NoConditionsConfirmModal({ open, onCancel, onConfirm }: {
+    open: boolean;
+    onCancel: () => void;
+    onConfirm: () => void;
+}): React.JSX.Element;
+export declare const TRANSPORT_RULE_CONDITION_FIELDS: ConditionFieldDef[];
+export declare const TRANSPORT_RULE_ACTION_TYPES: ActionTypeDef<TransportRuleAction>[];

package/dist/apps/admin/transport-rules/index.d.ts

@@ -0,0 +1,3 @@
+import React from "react";
+import { AdminShellProps } from "../../shared/components/admin/layout/AdminShell.js";
+export default function TransportRulesPage(props: Omit<AdminShellProps, "active">): React.JSX.Element;

package/dist/apps/admin/transport-rules/new/index.d.ts

@@ -0,0 +1,3 @@
+import React from "react";
+import { AdminShellProps } from "../../../shared/components/admin/layout/AdminShell.js";
+export default function NewTransportRulePage(props: Omit<AdminShellProps, "active">): React.JSX.Element;

package/dist/apps/escrow/_layout.d.ts

@@ -0,0 +1,10 @@
+import React, { PropsWithChildren } from "react";
+import { Branding } from "@rapidmx/react-shared/branding/brandingApi.js";
+export interface LayoutProps {
+    /** See `apps/www/_layout.tsx`'s `LayoutProps` doc comment — identical mechanism, supplied by
+     * `EscrowConsoleRoute`'s `fetchProps()`. */
+    branding?: Branding;
+}
+/** Unlike the other apps, never links the admin-configured custom stylesheet: the escrow console handles escrow
+ * key material, so no admin-supplied CSS is loaded on it. */
+export default function Layout({ children, branding }: PropsWithChildren<LayoutProps>): React.JSX.Element;

package/dist/apps/escrow/audit-log/index.d.ts

@@ -0,0 +1,9 @@
+import React from "react";
+import { EscrowAuditVerificationResult } from "@rapidmx/react-shared/admin/escrowAuditLogApi.js";
+import { EscrowShellProps } from "../../shared/components/escrow/layout/EscrowShell.js";
+/** The label for an audit action - the raw action name for one this console doesn't know yet (a newer server). */
+export declare function actionLabel(action: string): string;
+/** Explains a failed chain verification by its `reason` (plus where it broke, when known). An unrecognized or missing
+ * reason (a newer or older server) reads as a generic failure. */
+export declare function describeVerificationFailure(result: EscrowAuditVerificationResult): string;
+export default function EscrowAuditLogPage(props: Omit<EscrowShellProps, "active">): React.JSX.Element;

package/dist/apps/escrow/index.d.ts

@@ -0,0 +1,3 @@
+import React from "react";
+import { EscrowShellProps } from "../shared/components/escrow/layout/EscrowShell.js";
+export default function MattersPage(props: Omit<EscrowShellProps, "active">): React.JSX.Element;

package/dist/apps/escrow/matters/[uid].d.ts

@@ -0,0 +1,7 @@
+import React from "react";
+import { EscrowShellProps } from "../../shared/components/escrow/layout/EscrowShell.js";
+export default function MatterDetailPage(props: Omit<EscrowShellProps, "active"> & {
+    params: {
+        uid: string;
+    };
+}): React.JSX.Element;

package/dist/apps/escrow/matters/new/index.d.ts

@@ -0,0 +1,3 @@
+import React from "react";
+import { EscrowShellProps } from "../../../shared/components/escrow/layout/EscrowShell.js";
+export default function NewMatterPage(props: Omit<EscrowShellProps, "active">): React.JSX.Element;

package/dist/apps/shared/components/admin/distributionLists/MemberListCard.d.ts

@@ -0,0 +1,17 @@
+import React from "react";
+import { DistributionList } from "@rapidmx/react-shared/admin/distributionListsApi.js";
+export interface MemberListCardProps {
+    list: DistributionList;
+    /** Called with the freshly-saved list (new `version`, updated `memberAddresses`) after a successful
+     * add/remove, so the parent detail page can keep its own copy of the list in sync — mirrors
+     * `ShareAccessCard`'s `reload()` pattern, just pushed up rather than re-fetched, since the caller
+     * already has everything the response would return. */
+    onUpdate: (list: DistributionList) => void;
+}
+/**
+ * Lets an admin view and edit a distribution list's members — same load/inline-add-row/per-row-remove
+ * interaction shape as `ShareAccessCard`, but against a plain `memberAddresses: string[]` field on the
+ * `DistributionList` itself via read-modify-write `PUT`, not a separate ACL endpoint (a distribution
+ * list has no per-record ACL to speak of — see `BaseDistributionListRoute`'s own doc comment).
+ */
+export default function MemberListCard({ list, onUpdate }: MemberListCardProps): React.JSX.Element;

package/dist/apps/shared/components/admin/escrowScopes/EscrowScopeKeyAndHoldersFields.d.ts

@@ -0,0 +1,32 @@
+import React from "react";
+/** The part of an `EscrowScope` shared by the "new" and "[uid]" pages — everything except `name`/
+ * `description`, which stay plain inline `FormField`s on each page (same split `distribution-lists`
+ * already uses: simple top-level fields inline, the more involved sub-structure factored out). An admin
+ * pastes in the fields of an already-issued certificate here; nothing in this app generates a keypair —
+ * see `EscrowScopePublicKey`'s own doc comment in `escrowScopesApi.ts`. */
+export interface EscrowScopeKeyAndHoldersValue {
+    publicKey: string;
+    keyType: string;
+    fingerprint: string;
+    /** `<input type="datetime-local">` value — see `toDatetimeLocal()`. */
+    notBefore: string;
+    notAfter: string;
+    holderUserUids: string[];
+    requiredHolders: number;
+    notifySubjectOnAccess: boolean;
+}
+export interface EscrowScopeKeyAndHoldersFieldsProps {
+    value: EscrowScopeKeyAndHoldersValue;
+    onChange: (value: EscrowScopeKeyAndHoldersValue) => void;
+    disabled?: boolean;
+    /** Shows the public key fields without letting them be edited, e.g. for keys generated in the browser. */
+    keyReadOnly?: boolean;
+}
+/** Builds an all-zeroes starting point for the "new" page — `notBefore`/`notAfter` default to "now" so an
+ * admin pasting in a cert's own dates only has to touch what actually differs. */
+export declare function emptyEscrowScopeKeyAndHoldersValue(): EscrowScopeKeyAndHoldersValue;
+/** The message shown when an administrator tries to make themselves a holder: whoever configures a scope must not
+ * also be able to approve access under it (separation of duties - the server refuses it too). Holders who were
+ * already on the scope (`existingHolderUserUids`) aren't treated as newly added. */
+export declare function selfAsHolderError(holderUserUids: string[], adminUid: string | undefined, existingHolderUserUids?: string[]): string | null;
+export default function EscrowScopeKeyAndHoldersFields({ value, onChange, disabled, keyReadOnly }: EscrowScopeKeyAndHoldersFieldsProps): React.JSX.Element;

package/dist/apps/shared/components/admin/layout/AdminShell.d.ts

@@ -0,0 +1,32 @@
+import "../../../styles/app.css";
+import React, { PropsWithChildren } from "react";
+import { NavItem } from "@rapidmx/react-shared/components/navigation/BottomTabBar.js";
+import { PluginNav, PluginNavProps } from "../../../plugins/pluginNav.js";
+export type AdminSection = "mailboxes" | "quarantine" | "ingestQueue" | "domains" | "auditLog" | "distributionLists" | "transportRules" | "escrowScopes" | "retentionPolicy" | "encryptionPolicy" | "mailboxPolicy" | "setup" | "dataRequests" | "plugins" | "branding";
+/** A core `AdminSection`, or a plugin's `adminNav` item id (see `PluginNav`). */
+export type AdminShellActive = AdminSection | (string & {});
+export interface AdminShellProps extends PluginNavProps {
+    /** Which icon in the rail is highlighted as the current section - a plugin admin page passes its own
+     * `adminNav` item id. */
+    active: AdminShellActive;
+    /** Populated automatically by the framework from an authenticated request (e.g. a valid `jwt` cookie). */
+    userUid?: string;
+    /** auth-server's base URL, injected via the route's `fetchProps` — see `src/mongo/routes/AdminConsoleRoute.ts`. */
+    authServerUrl?: string;
+    /**
+     * Where `mailApi.ts`'s `impersonateUser()`/`stopImpersonating()` should call: the real auth-server in
+     * production, or `""` under `yarn dev` to call this app's own local dev-only impersonation endpoint
+     * instead — see `AdminConsoleRoute`'s `fetchProps` and `src/dev/DevImpersonationRoute.ts`.
+     */
+    impersonationBaseUrl?: string;
+}
+/** `NAV_ITEMS` followed by the plugins' `adminNav` items (generic icon). Core ids win, including the
+ * off-rail sections' - see `mergePluginNavItems`. */
+export declare function adminNavItems(pluginNav?: PluginNav): NavItem[];
+/**
+ * Gates every `apps/admin` page behind the `admin` trusted role. Uses `GET /api/admin/release-notes` (any
+ * `BaseAdminRoute` endpoint works — this one is side-effect-free) purely as a canary: a 200 means the
+ * caller's JWT carries a trusted role, a 403 means it doesn't. There is no local step-up/elevation flow
+ * (that would need a cross-origin call to auth-server's own elevation endpoint — not wired up yet).
+ */
+export default function AdminShell({ active, userUid, authServerUrl, pluginNav, children }: PropsWithChildren<AdminShellProps>): React.JSX.Element;

package/dist/apps/shared/components/admin/layout/AdminShell.js

@@ -15,6 +15,7 @@ import BottomTabBar from "@rapidmx/react-shared/components/navigation/BottomTabB
 import { BrandingFooter, BrandingHeader } from "../../layout/BrandingChrome.js";
 import UserMenu from "../../layout/UserMenu.js";
 import { signOutOfConsole } from "../signOut.js";
+import { mergePluginNavItems } from "../../../plugins/pluginNav.js";
 /** Sections shown in the persistent icon rail / mobile tab bar — every admin area reachable from
  * anywhere in the console. Deliberately excludes `quarantine`/`ingestQueue`: those are scoped to a
  * single mailbox and only ever reached via links on that mailbox's own detail page (see
@@ -76,14 +77,19 @@ const MAILBOX_SCOPED_ITEMS = [
 ];
 /** The setup wizard - reached by redirect or from the Mailboxes page, not from the rail. */
 const SETUP_ITEM = { id: "setup", href: "/admin/setup", label: "Setup", icon: HiOutlineRocketLaunch };
-const ALL_ITEMS = [...NAV_ITEMS, ...MAILBOX_SCOPED_ITEMS, SETUP_ITEM];
+const OFF_RAIL_ITEMS = [...MAILBOX_SCOPED_ITEMS, SETUP_ITEM];
+/** `NAV_ITEMS` followed by the plugins' `adminNav` items (generic icon). Core ids win, including the
+ * off-rail sections' - see `mergePluginNavItems`. */
+export function adminNavItems(pluginNav) {
+    return mergePluginNavItems(NAV_ITEMS, pluginNav?.adminNav, ({ id, href, label }) => ({ id, href, label, icon: HiOutlinePuzzlePiece }), OFF_RAIL_ITEMS.map((item) => item.id));
+}
 /**
  * Gates every `apps/admin` page behind the `admin` trusted role. Uses `GET /api/admin/release-notes` (any
  * `BaseAdminRoute` endpoint works — this one is side-effect-free) purely as a canary: a 200 means the
  * caller's JWT carries a trusted role, a 403 means it doesn't. There is no local step-up/elevation flow
  * (that would need a cross-origin call to auth-server's own elevation endpoint — not wired up yet).
  */
-export default function AdminShell({ active, userUid, authServerUrl, children }) {
+export default function AdminShell({ active, userUid, authServerUrl, pluginNav, children }) {
     const [status, setStatus] = useState("checking");
     const [error, setError] = useState(null);
     const { branding, iconSrc } = useBranding();
@@ -133,13 +139,14 @@ export default function AdminShell({ active, userUid, authServerUrl, children })
         content = (_jsx("div", { className: "min-h-screen flex items-center justify-center p-8", children: _jsx("div", { className: "w-full max-w-md", children: _jsx(Alert, { children: error }) }) }));
     }
     else {
-        const activeItem = ALL_ITEMS.find((item) => item.id === active);
-        content = (_jsx("div", { className: "min-h-screen flex flex-col bg-surface-alt", children: _jsxs("div", { className: "flex-1 flex min-h-0", children: [_jsxs("nav", { "aria-label": "Admin sections", className: "hidden md:flex w-16 shrink-0 bg-surface border-r border-border flex-col items-center py-3 gap-1", children: [_jsx("img", { src: iconSrc, width: "96", height: "96", alt: "", className: "mb-3" }), NAV_ITEMS.map(({ id, href, label, icon: Icon }) => (_jsx("a", { href: href, "aria-label": label, "aria-current": id === active ? "page" : undefined, title: label, className: [
+        const navItems = adminNavItems(pluginNav);
+        const activeItem = [...navItems, ...OFF_RAIL_ITEMS].find((item) => item.id === active);
+        content = (_jsx("div", { className: "min-h-screen flex flex-col bg-surface-alt", children: _jsxs("div", { className: "flex-1 flex min-h-0", children: [_jsxs("nav", { "aria-label": "Admin sections", className: "hidden md:flex w-16 shrink-0 bg-surface border-r border-border flex-col items-center py-3 gap-1", children: [_jsx("img", { src: iconSrc, width: "96", height: "96", alt: "", className: "mb-3" }), navItems.map(({ id, href, label, icon: Icon }) => (_jsx("a", { href: href, "aria-label": label, "aria-current": id === active ? "page" : undefined, title: label, className: [
                                     "w-10 h-10 flex items-center justify-center rounded-sm",
                                     id === active
                                         ? "bg-primary/10 text-primary-dark"
                                         : "text-text-muted hover:bg-surface-alt hover:text-text",
-                                ].join(" "), children: _jsx(Icon, { size: 20, "aria-hidden": "true" }) }, id)))] }), _jsx(BottomTabBar, { apps: NAV_ITEMS, active: active }), _jsxs("div", { className: "flex-1 flex flex-col min-w-0", children: [_jsxs("header", { className: "h-16 shrink-0 bg-surface border-b border-border flex items-center justify-between gap-4 px-6", children: [_jsx("span", { className: "font-display font-bold text-lg uppercase tracking-wide", children: activeItem?.label }), _jsx(UserMenu, { userUid: userUid, authServerUrl: authServerUrl, onSignOut: handleSignOut })] }), _jsx("div", { className: "flex-1 pb-14 md:pb-0", children: _jsx("main", { className: "max-w-6xl mx-auto px-6 py-8", children: children }) })] })] }) }));
+                                ].join(" "), children: _jsx(Icon, { size: 20, "aria-hidden": "true" }) }, id)))] }), _jsx(BottomTabBar, { apps: navItems, active: active }), _jsxs("div", { className: "flex-1 flex flex-col min-w-0", children: [_jsxs("header", { className: "h-16 shrink-0 bg-surface border-b border-border flex items-center justify-between gap-4 px-6", children: [_jsx("span", { className: "font-display font-bold text-lg uppercase tracking-wide", children: activeItem?.label }), _jsx(UserMenu, { userUid: userUid, authServerUrl: authServerUrl, onSignOut: handleSignOut })] }), _jsx("div", { className: "flex-1 pb-14 md:pb-0", children: _jsx("main", { className: "max-w-6xl mx-auto px-6 py-8", children: children }) })] })] }) }));
     }
     return (_jsxs(_Fragment, { children: [_jsx(BrandingHeader, { branding: branding }), content, _jsx(BrandingFooter, { branding: branding })] }));
 }

package/dist/apps/shared/components/admin/mailboxes/EscrowScopeCard.d.ts

@@ -0,0 +1,12 @@
+import React from "react";
+import { Mailbox } from "@rapidmx/react-shared/mail/mailApi.js";
+export interface EscrowScopeCardProps {
+    mailbox: Mailbox;
+    /** Called with the saved mailbox, same push-up pattern as `ResourceSettingsCard`. */
+    onUpdate: (mailbox: Mailbox) => void;
+}
+/**
+ * Assigns a mailbox to an escrow scope (or none), which decides whose holders can recover its encrypted mail. Only
+ * shown in the admin console, whose trusted-role gate the server enforces again for `escrowScopeId`.
+ */
+export default function EscrowScopeCard({ mailbox, onUpdate }: EscrowScopeCardProps): React.JSX.Element;

package/dist/apps/shared/components/admin/mailboxes/MailboxTable.d.ts

@@ -0,0 +1,6 @@
+import React from "react";
+import { Mailbox } from "@rapidmx/react-shared/mail/mailApi.js";
+export interface MailboxTableProps {
+    mailboxes: Mailbox[];
+}
+export default function MailboxTable({ mailboxes }: MailboxTableProps): React.JSX.Element;

package/dist/apps/shared/components/admin/mailboxes/ResourceSettingsCard.d.ts

@@ -0,0 +1,19 @@
+import React from "react";
+import { Mailbox } from "@rapidmx/react-shared/mail/mailApi.js";
+export interface ResourceSettingsCardProps {
+    mailbox: Mailbox;
+    /** Called with the freshly-saved mailbox after a successful save — mirrors `MemberListCard`'s
+     * identical push-up-rather-than-reload pattern, since the caller already has everything the
+     * response would return. */
+    onUpdate: (mailbox: Mailbox) => void;
+}
+/**
+ * Lets an admin view and edit a resource mailbox's booking settings — same load/edit/PUT/reload
+ * interaction shape as `ShareAccessCard`, adapted the same way `MemberListCard` already adapted it:
+ * these seven fields live directly on the `Mailbox` the parent detail page already loaded (not a
+ * separate resource fetched by its own endpoint, unlike a mailbox's ACL), so this receives the
+ * already-loaded `mailbox` and pushes the `PUT` response back up rather than fetching independently.
+ * Only rendered by the detail page when `mailbox.isResource` is already `true` — a mailbox becomes a
+ * resource at creation time (`apps/admin/mailboxes/new`), not retroactively from here.
+ */
+export default function ResourceSettingsCard({ mailbox, onUpdate }: ResourceSettingsCardProps): React.JSX.Element;

package/dist/apps/shared/components/admin/mailboxes/ShareAccessCard.d.ts

@@ -0,0 +1,12 @@
+import React from "react";
+export interface ShareAccessCardProps {
+    mailboxUid: string;
+    /** The mailbox's owner - their own grant is shown but can't be revoked from here. */
+    ownerUserUid?: string;
+}
+/**
+ * Lets an admin (or, eventually, the mailbox owner) view and edit a mailbox's delegate access — the
+ * mechanism behind Exchange-style shared mailboxes. `records` on a mailbox's own ACL doubles as both the
+ * owner's grant (if any) and every delegate's — see `BaseMailboxRoute`'s doc comment in `@rapidmx/restapi`.
+ */
+export default function ShareAccessCard({ mailboxUid, ownerUserUid }: ShareAccessCardProps): React.JSX.Element;

package/dist/apps/shared/components/admin/settings/BrandingForm.d.ts

@@ -0,0 +1,13 @@
+import React from "react";
+import { Branding } from "@rapidmx/react-shared/branding/brandingApi.js";
+/** SVG logo/icon uploads are refused (the server refuses them too): an SVG served from this origin can carry script. */
+export declare function isSvgFile(file: File): boolean;
+export interface BrandingFormProps {
+    branding: Branding;
+    onChange: (b: Branding) => void;
+    /** Set when shown in a page that already introduces branding (the setup wizard): the title and introduction are
+     * left out, and the section headings sit one level lower. */
+    embedded?: boolean;
+}
+/** The branding editor, shared by the Branding page and the setup wizard. */
+export default function BrandingForm({ branding, onChange, embedded }: BrandingFormProps): React.JSX.Element;

package/dist/apps/shared/components/admin/settings/BrandingForm.js

@@ -1,4 +1,4 @@
-import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { jsx as _jsx, Fragment as _Fragment, jsxs as _jsxs } from "react/jsx-runtime";
 ///////////////////////////////////////////////////////////////////////////////
 // Copyright (C) 2026 Jean-Philippe Steinmetz
 // SPDX-License-Identifier: MPL-2.0
@@ -16,7 +16,8 @@ export function isSvgFile(file) {
 }
 const RASTER_IMAGE_ACCEPT = "image/png,image/jpeg,image/gif,image/webp,image/x-icon,image/vnd.microsoft.icon";
 /** The branding editor, shared by the Branding page and the setup wizard. */
-export default function BrandingForm({ branding, onChange }) {
+export default function BrandingForm({ branding, onChange, embedded = false }) {
+    const SectionHeading = embedded ? "h3" : "h2";
     const [companyName, setCompanyName] = useState(branding.companyName);
     const [title, setTitle] = useState(branding.title);
     const [headerHtml, setHeaderHtml] = useState(branding.headerHtml ?? "");
@@ -103,13 +104,13 @@ export default function BrandingForm({ branding, onChange }) {
             setSaving(false);
         }
     }
-    return (_jsxs("div", { className: "max-w-2xl", children: [_jsx("h1", { className: "text-xl font-bold uppercase tracking-wide mb-1", children: "Branding" }), _jsx("p", { className: "text-sm text-text-muted mb-5", children: "Customize the logo, nav-header icon, product name, and chrome shown to every visitor of the webmail and admin console \u2014 including anonymous booking-page visitors." }), error && _jsx(Alert, { children: error }), saved && !error && _jsx("div", { className: "mb-4 text-sm text-success font-medium", children: "Saved." }), _jsxs("div", { className: "flex flex-col gap-6", children: [_jsxs("section", { className: "flex flex-col gap-3", children: [_jsx("h2", { className: "text-sm font-bold uppercase tracking-wide text-text-muted", children: "Logo" }), _jsxs("div", { className: "flex items-center gap-4", children: [_jsx("img", { src: branding.logoUrl || "/images/logo.svg", alt: "Current logo", width: "64", height: "64", className: "border border-border rounded-sm bg-surface-alt p-1" }), _jsxs("div", { className: "flex flex-col gap-2", children: [_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", loading: assetBusy === "logo-upload", disabled: assetBusy !== null, onClick: () => logoFileRef.current?.click(), children: "Upload logo" }), _jsx("input", { ref: logoFileRef, type: "file", accept: RASTER_IMAGE_ACCEPT, "aria-label": "Upload logo", className: "hidden", onChange: handleLogoFileChange }), branding.logoUrl && (_jsx(Button, { type: "button", variant: "text", disabled: assetBusy !== null, loading: assetBusy === "logo-delete", onClick: () => void runAsset("logo-delete", async () => {
+    return (_jsxs("div", { className: "max-w-2xl", children: [!embedded && (_jsxs(_Fragment, { children: [_jsx("h1", { className: "text-xl font-bold uppercase tracking-wide mb-1", children: "Branding" }), _jsx("p", { className: "text-sm text-text-muted mb-5", children: "Customize the logo, nav-header icon, product name, and chrome shown to every visitor of the webmail and admin console \u2014 including anonymous booking-page visitors." })] })), error && _jsx(Alert, { children: error }), saved && !error && _jsx("div", { className: "mb-4 text-sm text-success font-medium", children: "Saved." }), _jsxs("div", { className: "flex flex-col gap-6", children: [_jsxs("section", { className: "flex flex-col gap-3", children: [_jsx(SectionHeading, { className: "text-sm font-bold uppercase tracking-wide text-text-muted", children: "Logo" }), _jsxs("div", { className: "flex items-center gap-4", children: [_jsx("img", { src: branding.logoUrl || "/images/logo.svg", alt: "Current logo", width: "64", height: "64", className: "border border-border rounded-sm bg-surface-alt p-1" }), _jsxs("div", { className: "flex flex-col gap-2", children: [_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", loading: assetBusy === "logo-upload", disabled: assetBusy !== null, onClick: () => logoFileRef.current?.click(), children: "Upload logo" }), _jsx("input", { ref: logoFileRef, type: "file", accept: RASTER_IMAGE_ACCEPT, "aria-label": "Upload logo", className: "hidden", onChange: handleLogoFileChange }), branding.logoUrl && (_jsx(Button, { type: "button", variant: "text", disabled: assetBusy !== null, loading: assetBusy === "logo-delete", onClick: () => void runAsset("logo-delete", async () => {
                                                     await deleteBrandingLogo();
                                                     return { ...branding, logoUrl: undefined };
-                                                }), children: "Remove logo" }))] })] }), _jsxs("label", { className: "flex flex-col gap-1.5 text-sm", children: [_jsx("span", { className: "font-semibold", children: "Or use an external image URL" }), _jsxs("div", { className: "flex gap-2", children: [_jsx("input", { "aria-label": "Logo URL", className: INPUT_CLASS, value: logoUrlInput, onChange: (e) => setLogoUrlInput(e.target.value) }), _jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", disabled: assetBusy !== null || logoUrlInput === (branding.logoUrl ?? ""), loading: assetBusy === "logo-url", onClick: () => void runAsset("logo-url", () => updateBranding({ logoUrl: logoUrlInput })), children: "Set" })] })] })] }), _jsxs("section", { className: "flex flex-col gap-3", children: [_jsx("h2", { className: "text-sm font-bold uppercase tracking-wide text-text-muted", children: "Icon" }), _jsx("p", { className: "text-xs text-text-muted -mt-1", children: "A compact mark for navigation headers, independent of the full logo above. Falls back to the logo, then a default asset, when not set." }), _jsxs("div", { className: "flex items-center gap-4", children: [_jsx("img", { src: branding.iconUrl || branding.logoUrl || "/images/logo.svg", alt: "Current icon", width: "64", height: "64", className: "border border-border rounded-sm bg-surface-alt p-1" }), _jsxs("div", { className: "flex flex-col gap-2", children: [_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", loading: assetBusy === "icon-upload", disabled: assetBusy !== null, onClick: () => iconFileRef.current?.click(), children: "Upload icon" }), _jsx("input", { ref: iconFileRef, type: "file", accept: RASTER_IMAGE_ACCEPT, "aria-label": "Upload icon", className: "hidden", onChange: handleIconFileChange }), branding.iconUrl && (_jsx(Button, { type: "button", variant: "text", disabled: assetBusy !== null, loading: assetBusy === "icon-delete", onClick: () => void runAsset("icon-delete", async () => {
+                                                }), children: "Remove logo" }))] })] }), _jsxs("label", { className: "flex flex-col gap-1.5 text-sm", children: [_jsx("span", { className: "font-semibold", children: "Or use an external image URL" }), _jsxs("div", { className: "flex gap-2", children: [_jsx("input", { "aria-label": "Logo URL", className: INPUT_CLASS, value: logoUrlInput, onChange: (e) => setLogoUrlInput(e.target.value) }), _jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", disabled: assetBusy !== null || logoUrlInput === (branding.logoUrl ?? ""), loading: assetBusy === "logo-url", onClick: () => void runAsset("logo-url", () => updateBranding({ logoUrl: logoUrlInput })), children: "Set" })] })] })] }), _jsxs("section", { className: "flex flex-col gap-3", children: [_jsx(SectionHeading, { className: "text-sm font-bold uppercase tracking-wide text-text-muted", children: "Icon" }), _jsx("p", { className: "text-xs text-text-muted -mt-1", children: "A compact mark for navigation headers, independent of the full logo above. Falls back to the logo, then a default asset, when not set." }), _jsxs("div", { className: "flex items-center gap-4", children: [_jsx("img", { src: branding.iconUrl || branding.logoUrl || "/images/logo.svg", alt: "Current icon", width: "64", height: "64", className: "border border-border rounded-sm bg-surface-alt p-1" }), _jsxs("div", { className: "flex flex-col gap-2", children: [_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", loading: assetBusy === "icon-upload", disabled: assetBusy !== null, onClick: () => iconFileRef.current?.click(), children: "Upload icon" }), _jsx("input", { ref: iconFileRef, type: "file", accept: RASTER_IMAGE_ACCEPT, "aria-label": "Upload icon", className: "hidden", onChange: handleIconFileChange }), branding.iconUrl && (_jsx(Button, { type: "button", variant: "text", disabled: assetBusy !== null, loading: assetBusy === "icon-delete", onClick: () => void runAsset("icon-delete", async () => {
                                                     await deleteBrandingIcon();
                                                     return { ...branding, iconUrl: undefined };
-                                                }), children: "Remove icon" }))] })] }), _jsxs("label", { className: "flex flex-col gap-1.5 text-sm", children: [_jsx("span", { className: "font-semibold", children: "Or use an external image URL" }), _jsxs("div", { className: "flex gap-2", children: [_jsx("input", { "aria-label": "Icon URL", className: INPUT_CLASS, value: iconUrlInput, onChange: (e) => setIconUrlInput(e.target.value) }), _jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", disabled: assetBusy !== null || iconUrlInput === (branding.iconUrl ?? ""), loading: assetBusy === "icon-url", onClick: () => void runAsset("icon-url", () => updateBranding({ iconUrl: iconUrlInput })), children: "Set" })] })] })] }), _jsxs("section", { className: "flex flex-col gap-3", children: [_jsx("h2", { className: "text-sm font-bold uppercase tracking-wide text-text-muted", children: "Custom stylesheet" }), _jsx("div", { className: "flex items-center gap-3", children: _jsx("span", { className: "text-sm text-text-muted truncate", children: branding.stylesheetUrl || "None configured" }) }), _jsxs("div", { className: "flex gap-2", children: [_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", loading: assetBusy === "stylesheet-upload", disabled: assetBusy !== null, onClick: () => stylesheetFileRef.current?.click(), children: "Upload CSS file" }), _jsx("input", { ref: stylesheetFileRef, type: "file", accept: "text/css,.css", "aria-label": "Upload stylesheet", className: "hidden", onChange: handleStylesheetFileChange }), branding.stylesheetUrl && (_jsx(Button, { type: "button", variant: "text", disabled: assetBusy !== null, loading: assetBusy === "stylesheet-delete", onClick: () => void runAsset("stylesheet-delete", async () => {
+                                                }), children: "Remove icon" }))] })] }), _jsxs("label", { className: "flex flex-col gap-1.5 text-sm", children: [_jsx("span", { className: "font-semibold", children: "Or use an external image URL" }), _jsxs("div", { className: "flex gap-2", children: [_jsx("input", { "aria-label": "Icon URL", className: INPUT_CLASS, value: iconUrlInput, onChange: (e) => setIconUrlInput(e.target.value) }), _jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", disabled: assetBusy !== null || iconUrlInput === (branding.iconUrl ?? ""), loading: assetBusy === "icon-url", onClick: () => void runAsset("icon-url", () => updateBranding({ iconUrl: iconUrlInput })), children: "Set" })] })] })] }), _jsxs("section", { className: "flex flex-col gap-3", children: [_jsx(SectionHeading, { className: "text-sm font-bold uppercase tracking-wide text-text-muted", children: "Custom stylesheet" }), _jsx("div", { className: "flex items-center gap-3", children: _jsx("span", { className: "text-sm text-text-muted truncate", children: branding.stylesheetUrl || "None configured" }) }), _jsxs("div", { className: "flex gap-2", children: [_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", loading: assetBusy === "stylesheet-upload", disabled: assetBusy !== null, onClick: () => stylesheetFileRef.current?.click(), children: "Upload CSS file" }), _jsx("input", { ref: stylesheetFileRef, type: "file", accept: "text/css,.css", "aria-label": "Upload stylesheet", className: "hidden", onChange: handleStylesheetFileChange }), branding.stylesheetUrl && (_jsx(Button, { type: "button", variant: "text", disabled: assetBusy !== null, loading: assetBusy === "stylesheet-delete", onClick: () => void runAsset("stylesheet-delete", async () => {
                                             await deleteBrandingStylesheet();
                                             return { ...branding, stylesheetUrl: undefined };
                                         }), children: "Remove stylesheet" }))] }), _jsxs("label", { className: "flex flex-col gap-1.5 text-sm", children: [_jsx("span", { className: "font-semibold", children: "Or use an external stylesheet URL" }), _jsxs("div", { className: "flex gap-2", children: [_jsx("input", { "aria-label": "Stylesheet URL", className: INPUT_CLASS, value: stylesheetUrlInput, onChange: (e) => setStylesheetUrlInput(e.target.value) }), _jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", disabled: assetBusy !== null || stylesheetUrlInput === (branding.stylesheetUrl ?? ""), loading: assetBusy === "stylesheet-url", onClick: () => void runAsset("stylesheet-url", () => updateBranding({ stylesheetUrl: stylesheetUrlInput })), children: "Set" })] })] })] }), _jsxs("form", { onSubmit: handleSubmit, className: "flex flex-col gap-4 pt-2 border-t border-border", children: [_jsxs("label", { className: "flex flex-col gap-1.5 text-sm", children: [_jsx("span", { className: "font-semibold", children: "Company name" }), _jsx("input", { "aria-label": "Company name", className: INPUT_CLASS, value: companyName, onChange: (e) => setCompanyName(e.target.value) })] }), _jsxs("label", { className: "flex flex-col gap-1.5 text-sm", children: [_jsx("span", { className: "font-semibold", children: "Product title" }), _jsx("input", { "aria-label": "Product title", className: INPUT_CLASS, value: title, onChange: (e) => setTitle(e.target.value) }), _jsx("span", { className: "text-xs text-text-muted", children: "Shown as the browser tab title." })] }), _jsxs("label", { className: "flex flex-col gap-1.5 text-sm", children: [_jsx("span", { className: "font-semibold", children: "Header HTML (optional)" }), _jsx("textarea", { "aria-label": "Header HTML", className: `${INPUT_CLASS} font-mono`, rows: 3, value: headerHtml, onChange: (e) => setHeaderHtml(e.target.value) })] }), _jsxs("label", { className: "flex flex-col gap-1.5 text-sm", children: [_jsx("span", { className: "font-semibold", children: "Footer HTML (optional)" }), _jsx("textarea", { "aria-label": "Footer HTML", className: `${INPUT_CLASS} font-mono`, rows: 3, value: footerHtml, onChange: (e) => setFooterHtml(e.target.value) })] }), _jsx("div", { children: _jsx(Button, { type: "submit", loading: saving, disabled: saving, className: "!w-auto", children: "Save" }) })] })] })] }));

package/dist/apps/shared/components/admin/settings/DomainDnsSetup.d.ts

@@ -0,0 +1,12 @@
+import React from "react";
+import { Domain } from "@rapidmx/react-shared/admin/domainsApi.js";
+export interface DomainDnsSetupProps {
+    uid: string;
+    /** Called with the domain every time it's (re)loaded - e.g. after "Verify now". */
+    onLoaded?: (domain: Domain) => void;
+}
+/**
+ * A domain's status, its ownership TXT record with "Verify now", and the DNS setup checklist - shared by the domain
+ * detail page and the setup wizard.
+ */
+export default function DomainDnsSetup({ uid, onLoaded }: DomainDnsSetupProps): React.JSX.Element;

package/dist/apps/shared/components/admin/settings/EncryptionPolicyForm.d.ts

@@ -0,0 +1,15 @@
+import React from "react";
+import { EncryptionPolicy } from "@rapidmx/react-shared/crypto/keyvaultApi.js";
+/** Whether end-to-end encryption can be used at all under `policy` - i.e. any tier allows it. */
+export declare function isEncryptionEnabled(policy: EncryptionPolicy): boolean;
+export interface EncryptionPolicyFormProps {
+    policy: EncryptionPolicy;
+    onChange: (policy: EncryptionPolicy) => void;
+    /** Told whether the form has edits that haven't been saved. */
+    onDirtyChange?: (dirty: boolean) => void;
+    /** Set when shown as one section of a page with its own heading (the setup wizard), so the title is a smaller,
+     * lower-level heading. */
+    embedded?: boolean;
+}
+/** The end-to-end encryption policy editor, shared by the Encryption Policy page and the setup wizard. */
+export default function EncryptionPolicyForm({ policy, onChange, onDirtyChange, embedded }: EncryptionPolicyFormProps): React.JSX.Element;