portal-mojo 0.1.0

package/src/admin/messaging/EmailDomainsPage.tsx

@@ -0,0 +1,17 @@
+import { useState } from 'react';
+import { useQueryClient } from '@tanstack/react-query';
+import { ArmedButton, Badge, DetailView, FlatRow, ModelTable, SchemaForm, fmt, formModal, modal, toast, type Column, type FilterDef, type FormData } from '../../ui';
+import { auditEmailDomain, deleteMessagingRow, reconcileEmailDomain, saveEmailDomainAtomic } from './api';
+import { exportEmailDomains } from './data';
+import { openEmailDomainWizard } from './EmailDomainWizard';
+import { EmailDomainModel, type EmailDomainRow } from './models';
+import { redactMessagingError } from './sanitize';
+
+const columns:Column<EmailDomainRow>[]=[{key:'name',label:'Domain',sortable:true,hideable:false},{key:'status',label:'Status',sortable:true,render:r=><Badge tone={r.status==='verified'||r.status==='ready'?'success':r.status==='missing'?'danger':'warning'}>{r.status}</Badge>},{key:'region',label:'Region',sortable:true},{key:'receiving_enabled',label:'Receiving',sortable:true,render:r=>r.receiving_enabled?'Enabled':'Disabled'},{key:'dns_mode',label:'DNS',sortable:true},{key:'created',label:'Created',sortable:true,render:r=>fmt.date(r.created)}];
+const filters:FilterDef[]=[{key:'region',label:'Region',type:'text'},{key:'status',label:'Status',type:'select',options:['pending','verified','ready','missing'].map(v=>({value:v,label:v}))},{key:'receiving_enabled',label:'Receiving',type:'boolean'},{key:'dns_mode',label:'DNS mode',type:'select',options:[{value:'manual',label:'Manual'},{value:'route53',label:'Route 53'},{value:'godaddy',label:'GoDaddy'}]}];
+const fields=[{name:'name',label:'Domain',type:'text',required:true},{name:'region',label:'AWS region',type:'text',required:true},{name:'receiving_enabled',label:'Enable receiving',type:'switch'},{name:'s3_inbound_bucket',label:'Inbound S3 bucket',type:'text'},{name:'s3_inbound_prefix',label:'Inbound prefix',type:'text'}] as const;
+
+function DomainCreate({close}:{close:(value:unknown)=>void}) { const qc=useQueryClient(); const [draft,setDraft]=useState<FormData|null>(null);const [awsKey,setAwsKey]=useState('');const [awsSecret,setAwsSecret]=useState(''); return <div className="modal-pad"><h2 className="modal-title">Create email domain</h2><p className="form-alert">Creation may run best-effort SES audit/reconcile. A created row does not mean AWS converged.</p>{draft?<><p>Ready to create <b>{String(draft.name)}</b>. Optional credentials are write-only and discarded immediately after submission.</p><label className="field"><span className="field-label">AWS access key</span><input type="password" autoComplete="off" value={awsKey} onChange={event=>setAwsKey(event.target.value)}/></label><label className="field"><span className="field-label">AWS secret</span><input type="password" autoComplete="new-password" value={awsSecret} onChange={event=>setAwsSecret(event.target.value)}/></label><div className="modal-actions"><button className="btn" onClick={()=>setDraft(null)}>Back</button><ArmedButton label="Create domain" armedLabel="Click again to create and run best-effort AWS setup" onConfirm={async()=>{const payload={...draft,...(awsKey?{aws_key:awsKey}:{}),...(awsSecret?{aws_secret:awsSecret}:{})};setAwsKey('');setAwsSecret('');setDraft(null);try{const row=await saveEmailDomainAtomic(qc,null,payload);toast.success('Domain row created. AWS convergence is best effort.');close(row);}catch(error){toast.error(redactMessagingError(error));}}} /></div></>:<SchemaForm fields={[...fields]} submitText="Review" onCancel={()=>close(null)} onSubmit={setDraft}/>}</div>; }
+function CredentialDialog({id,close}:{id:number;close:()=>void}){const qc=useQueryClient();const [key,setKey]=useState('');const [secret,setSecret]=useState('');const submit=async()=>{if(!key&&!secret)return;const payload={...(key?{aws_key:key}:{}),...(secret?{aws_secret:secret}:{})};setKey('');setSecret('');try{await saveEmailDomainAtomic(qc,id,payload);toast.success('AWS credentials replaced');close();}catch(error){toast.error(redactMessagingError(error));}};return <div className="modal-pad"><h2 className="modal-title">Replace AWS credentials</h2><p>Write-only values are never prefilled or cached.</p><label className="field"><span className="field-label">AWS access key</span><input type="password" autoComplete="off" value={key} onChange={e=>setKey(e.target.value)}/></label><label className="field"><span className="field-label">AWS secret</span><input type="password" autoComplete="new-password" value={secret} onChange={e=>setSecret(e.target.value)}/></label><div className="modal-actions"><button className="btn" onClick={close}>Cancel</button><ArmedButton label="Replace credentials" armedLabel="Click again to replace write-only credentials" disabled={!key&&!secret} onConfirm={submit}/></div></div>}
+function DomainDetail({id,onClose}:{id:number;onClose:()=>void}) { const qc=useQueryClient(); const query=EmailDomainModel.useOne(id); if(!query.data)return <div className="modal-pad"><p>{query.isLoading?'Loading…':query.error instanceof Error?redactMessagingError(query.error):'Domain unavailable'}</p><button className="btn" onClick={onClose}>Close</button></div>; const row=query.data; const edit=async()=>{const data=await formModal({title:`Edit ${row.name}`,fields:[...fields].filter(f=>f.name!=='name'),initial:row as unknown as FormData});if(!data)return;try{await saveEmailDomainAtomic(qc,id,data);toast.success('Domain row updated');await query.refetch();}catch(error){toast.error(redactMessagingError(error));}}; const audit=async()=>{if(!await modal.confirm({title:'Audit SES domain?',message:'Audit performs a provider request and persists readiness fields.',confirmText:'Run audit'}))return;try{const result=await auditEmailDomain(qc,id);await modal.open((close)=><div className="modal-pad"><h2 className="modal-title">Audit result</h2><Badge tone={result.audit_pass?'success':'danger'}>{result.audit_pass?'Pass':'Attention needed'}</Badge>{Object.entries(result.checks).map(([k,v])=><FlatRow key={k} label={k.replaceAll('_',' ')}>{v?'Pass':'Fail'}</FlatRow>)}{result.items.map((item,index)=><FlatRow key={`${item.resource}:${index}`} label={item.resource}>{item.status}</FlatRow>)}{result.recommendations.map((recommendation,index)=><div className="known-card" key={`${recommendation.resource}:${index}`}><h3>{recommendation.resource||'Recommendation'}{recommendation.severity?` · ${recommendation.severity}`:''}</h3>{recommendation.action&&<p>{recommendation.action}</p>}{recommendation.explanation&&<p className="dim">{recommendation.explanation}</p>}</div>)}<div className="modal-actions"><button className="btn" onClick={()=>close(null)}>Close</button></div></div>);}catch(e){toast.error(redactMessagingError(e));}}; const reconcile=async()=>{if(!await modal.confirm({title:'Reconcile AWS resources?',message:'This may change SES identities, SNS topics, and receiving rules. It does not write DNS.',confirmText:'Reconcile'}))return;try{await reconcileEmailDomain(qc,id);toast.success('Reconcile completed');}catch(e){toast.error(redactMessagingError(e));}}; const onboard=()=>void openEmailDomainWizard(row,qc).catch(error=>toast.error(redactMessagingError(error))); const remove=async()=>{try{await deleteMessagingRow(qc,EmailDomainModel.endpoint,id);toast.success('Local domain row and cascaded mailbox/sent audit rows deleted');onClose();}catch(error){toast.error(redactMessagingError(error));}}; return <DetailView title={row.name} subtitle={`${row.region} · ${row.dns_mode}`} icon="bi-envelope-at" chips={[{text:row.status,tone:row.status==='verified'||row.status==='ready'?'success':'warning'}]} onClose={onClose} initialSection="overview" sections={[{key:'overview',label:'Overview',icon:'bi-info-circle',render:()=><div className="detail-section"><div className="storage-action-row"><button className="btn" onClick={()=>void edit()}>Edit</button><button className="btn" onClick={()=>void modal.open(close=><CredentialDialog id={id} close={()=>close(null)}/>)}>Credentials…</button><button className="btn" onClick={onboard}>Onboard…</button><button className="btn" onClick={()=>void audit()}>Audit…</button><button className="btn" onClick={()=>void reconcile()}>Reconcile…</button></div><FlatRow label="Status">{row.status}</FlatRow><FlatRow label="Receiving">{row.receiving_enabled?'Enabled':'Disabled'}</FlatRow><FlatRow label="S3 bucket">{row.s3_inbound_bucket||'—'}</FlatRow><FlatRow label="S3 prefix">{row.s3_inbound_prefix||'—'}</FlatRow><FlatRow label="Access key">{row.aws_key_masked||'Not configured'}</FlatRow><FlatRow label="Secret key">{row.aws_secret_masked||'Not configured'}</FlatRow><FlatRow label="Created">{fmt.datetime(row.created)}</FlatRow></div>},{key:'danger',label:'Delete',icon:'bi-trash',render:()=><div className="detail-section"><h3>Delete local email domain</h3><p>This erases local mailboxes and sent-message audit rows. SES identities, SNS topics/rules, S3 configuration, and provider DNS may remain orphaned.</p><ArmedButton label="Delete local domain" armedLabel={`Click again to delete ${row.name}`} onConfirm={remove}/></div>}]} />; }
+export function EmailDomainsPage(){return <ModelTable model={EmailDomainModel} eyebrow="Communications · SES" title="Email Domains" columns={columns} filters={filters} defaultSort="name" searchable searchPlaceholder="Search domain, region, or status" columnChooser persistState persistKey="admin:email:domains" exportFormats={['csv','json']} exporter={exportEmailDomains} addLabel="Create domain" onAdd={()=>void modal.open(close=><DomainCreate close={close}/>,{size:'lg'})} onRowClick={row=>void modal.detail(close=><DomainDetail id={row.id} onClose={()=>close(null)}/>)}/>;}

package/src/admin/messaging/EmailTemplatesPage.tsx

@@ -0,0 +1,13 @@
+import { useState } from 'react';
+import { useQueryClient } from '@tanstack/react-query';
+import { ArmedButton, DetailView, FlatRow, ModelTable, Tabs, fmt, modal, toast, type Column } from '../../ui';
+import { deleteMessagingRow } from './api';
+import { exportEmailTemplates } from './data';
+import { EmailTemplateModel, type EmailTemplateRow } from './models';
+import { SandboxedEmailPreview } from './SandboxedEmailPreview';
+import { redactMessagingError } from './sanitize';
+
+const columns:Column<EmailTemplateRow>[]=[{key:'name',label:'Template',sortable:true,hideable:false},{key:'modified',label:'Modified',sortable:true,render:r=>fmt.datetime(r.modified)},{key:'created',label:'Created',sortable:true,render:r=>fmt.date(r.created)}];
+function TemplateEditor({row,onSave,onClose}:{row?:EmailTemplateRow;onSave:(changes:Record<string,unknown>)=>Promise<void>;onClose:()=>void}){const [name,setName]=useState(row?.name??'');const [subject,setSubject]=useState(row?.subject_template??'');const [html,setHtml]=useState(row?.html_template??'');const [plain,setPlain]=useState(row?.text_template??'');const [busy,setBusy]=useState(false);const [error,setError]=useState('');const submit=async()=>{if(!name.trim())return;setBusy(true);setError('');try{await onSave({name:name.trim(),subject_template:subject,html_template:html,text_template:plain});onClose();}catch(reason){setError(redactMessagingError(reason));}finally{setBusy(false);}};return <div className="modal-pad"><h2 className="modal-title">{row?'Edit':'Create'} email template</h2>{error&&<div className="form-alert" role="alert">{error}</div>}<label className="field"><span className="field-label">Template name</span><input value={name} onChange={e=>setName(e.target.value)} required/></label><Tabs items={[{key:'subject',label:'Subject',panel:<label className="field"><span className="field-label">Subject template</span><textarea value={subject} onChange={e=>setSubject(e.target.value)}/></label>},{key:'html',label:'HTML',panel:<><label className="field"><span className="field-label">HTML template</span><textarea value={html} onChange={e=>setHtml(e.target.value)}/></label><SandboxedEmailPreview html={html}/></>},{key:'text',label:'Plain text',panel:<label className="field"><span className="field-label">Plain-text template</span><textarea value={plain} onChange={e=>setPlain(e.target.value)}/></label>}]} /><div className="modal-actions"><button className="btn" disabled={busy} onClick={onClose}>Cancel</button><button className="btn btn-primary" disabled={busy||!name.trim()} onClick={()=>void submit()}>{busy?'Saving…':'Save template'}</button></div></div>}
+function TemplateDetail({id,onClose}:{id:number;onClose:()=>void}){const qc=useQueryClient();const query=EmailTemplateModel.useOne(id);const save=EmailTemplateModel.useSave();if(!query.data)return <div className="modal-pad"><p>{query.isLoading?'Loading template…':query.error instanceof Error?redactMessagingError(query.error):'Template unavailable'}</p><button className="btn" onClick={onClose}>Close</button></div>;const row=query.data;const edit=()=>void modal.open(close=><TemplateEditor row={row} onClose={()=>close(null)} onSave={async changes=>{await save.mutateAsync({id,changes});toast.success('Template updated');await query.refetch();}}/>);const remove=async()=>{try{await deleteMessagingRow(qc,EmailTemplateModel.endpoint,id);toast.success('Template deleted');onClose();}catch(error){toast.error(redactMessagingError(error));}};return <DetailView title={row.name} subtitle={row.subject_template||'No subject template'} icon="bi-file-earmark-richtext" onClose={onClose} sections={[{key:'content',label:'Content',icon:'bi-layout-text-window',render:()=><div className="detail-section"><button className="btn" onClick={edit}>Edit</button><Tabs items={[{key:'subject',label:'Subject',panel:<FlatRow label="Subject">{row.subject_template||'—'}</FlatRow>},{key:'html',label:'HTML',panel:<SandboxedEmailPreview html={row.html_template}/>},{key:'text',label:'Plain text',panel:<SandboxedEmailPreview text={row.text_template}/>}]} /></div>},{key:'danger',label:'Delete',icon:'bi-trash',render:()=><div className="detail-section"><p>Future named sends may fail or fall back according to their backend caller after deletion.</p><ArmedButton label="Delete template" armedLabel={`Click again to delete ${row.name}`} onConfirm={remove}/></div>}]} />;}
+export function EmailTemplatesPage(){const save=EmailTemplateModel.useSave();const add=()=>void modal.open(close=><TemplateEditor onClose={()=>close(null)} onSave={async changes=>{await save.mutateAsync({id:null,changes});toast.success('Template created');}}/>);return <ModelTable model={EmailTemplateModel} eyebrow="Communications · SES" title="Email Templates" columns={columns} defaultSort="name" searchable searchPlaceholder="Search template names" columnChooser persistState persistKey="admin:email:templates" exportFormats={['csv','json']} exporter={exportEmailTemplates} addLabel="Create template" onAdd={add} onRowClick={row=>void modal.detail(close=><TemplateDetail id={row.id} onClose={()=>close(null)}/>)}/>;}

package/src/admin/messaging/MailboxesPage.tsx

@@ -0,0 +1,15 @@
+import { useQueryClient } from '@tanstack/react-query';
+import { ArmedButton, Badge, DetailView, FlatRow, ModelTable, fmt, formModal, modal, toast, type Column, type FilterDef, type FormData } from '../../ui';
+import { deleteMessagingRow, saveMailbox, sendEmail } from './api';
+import { EmailDomainModel, MailboxModel, type MailboxRow, type SendEmailInput } from './models';
+import { redactMessagingError } from './sanitize';
+
+const columns:Column<MailboxRow>[]=[{key:'email',label:'Mailbox',sortable:true,hideable:false},{key:'domain',label:'Domain',render:r=>typeof r.domain==='object'?r.domain?.name??`#${r.domain?.id}`:`#${r.domain}`},{key:'allow_inbound',label:'Inbound',sortable:true,render:r=><Badge tone={r.allow_inbound?'success':'muted'}>{r.allow_inbound?'On':'Off'}</Badge>},{key:'allow_outbound',label:'Outbound',sortable:true,render:r=><Badge tone={r.allow_outbound?'success':'muted'}>{r.allow_outbound?'On':'Off'}</Badge>},{key:'is_system_default',label:'System default',sortable:true,render:r=>r.is_system_default?'Yes':'—'},{key:'is_domain_default',label:'Domain default',sortable:true,render:r=>r.is_domain_default?'Yes':'—'},{key:'created',label:'Created',sortable:true,render:r=>fmt.date(r.created)}];
+const filters:FilterDef[]=[{key:'domain',label:'Domain id',type:'number'},{key:'allow_inbound',label:'Inbound',type:'boolean'},{key:'allow_outbound',label:'Outbound',type:'boolean'},{key:'is_system_default',label:'System default',type:'boolean'},{key:'is_domain_default',label:'Domain default',type:'boolean'}];
+const mailboxFields=[{name:'email',label:'Email address',type:'email',required:true},{name:'domain',label:'Email domain',type:'collection',endpoint:EmailDomainModel.endpoint,labelField:'name',valueField:'id',required:true},{name:'allow_inbound',label:'Inbound enabled',type:'switch'},{name:'allow_outbound',label:'Outbound enabled',type:'switch'},{name:'is_system_default',label:'System default',type:'switch',help:'Saving may clear another system default.'},{name:'is_domain_default',label:'Domain default',type:'switch',help:'Saving may clear another default for this domain.'},{name:'async_handler',label:'Async handler',type:'text'}] as const;
+function domainId(row:MailboxRow){return typeof row.domain==='number'?row.domain:row.domain?.id??null;}
+function domainName(row:MailboxRow){return typeof row.domain==='object'?row.domain?.name??'':'';}
+function validMatch(email:string,domain:string){return !domain||email.toLowerCase().endsWith(`@${domain.toLowerCase()}`);}
+async function openSend(row:MailboxRow,qc:ReturnType<typeof useQueryClient>){const data=await formModal({title:`Send test from ${row.email}`,intro:'Only executable send fields are forwarded. A 2xx failed row is still a failed attempt.',fields:[{name:'to',label:'Recipients (comma separated)',type:'text',required:true},{name:'reply_to',label:'Reply-to',type:'email'},{name:'template_name',label:'Template name (optional)',type:'text'},{name:'template_context',label:'Template context JSON',type:'textarea'},{name:'subject',label:'Subject',type:'text'},{name:'body_text',label:'Plain text',type:'textarea'},{name:'body_html',label:'HTML',type:'textarea'}]});if(!data)return;const recipients=String(data.to??'').split(',').map(v=>v.trim()).filter(Boolean);if(!recipients.length){toast.error('Enter at least one recipient');return;}if(!await modal.confirm({title:'Submit email?',message:<><p>Sender: <b>{row.email}</b></p><p>Recipients: {recipients.join(', ')}</p><p>Submission remains pending until webhook updates.</p></>,confirmText:'Submit once'}))return;let context:Record<string,unknown>|undefined;try{if(data.template_context){const parsed=JSON.parse(String(data.template_context));if(!parsed||typeof parsed!=='object'||Array.isArray(parsed))throw new Error();context=parsed as Record<string,unknown>;}}catch{toast.error('Template context must be a plain JSON object');return;}const input:SendEmailInput={from_email:row.email,to:recipients,...(data.reply_to?{reply_to:String(data.reply_to)}:{}),...(data.template_name?{template_name:String(data.template_name),template_context:context??{}}:{subject:String(data.subject??''),body_text:String(data.body_text??''),body_html:String(data.body_html??'')})};try{const sent=await sendEmail(qc,input);if(sent.status==='failed')toast.error('The delivery attempt failed. Open Sent Messages for details.');else toast.success('Message submitted; delivery is pending webhook confirmation.');}catch(e){toast.error(redactMessagingError(e));}}
+function MailboxDetail({id,onClose}:{id:number;onClose:()=>void}){const qc=useQueryClient();const query=MailboxModel.useOne(id);if(!query.data)return <div className="modal-pad"><p>{query.isLoading?'Loading mailbox…':query.error instanceof Error?redactMessagingError(query.error):'Mailbox unavailable'}</p><button className="btn" onClick={onClose}>Close</button></div>;const row=query.data;const edit=async()=>{const data=await formModal({title:`Edit ${row.email}`,fields:[...mailboxFields],initial:{...row,domain:domainId(row)??''} as unknown as FormData});if(!data)return;try{const chosen=await EmailDomainModel.fetchOne(qc,Number(data.domain));if(!validMatch(String(data.email),chosen.name)){toast.error(`Email must belong to ${chosen.name}`);return;}await saveMailbox(qc,id,data);toast.success('Mailbox updated; competing defaults were refreshed');await query.refetch();}catch(error){toast.error(redactMessagingError(error));}};const remove=async()=>{try{await deleteMessagingRow(qc,MailboxModel.endpoint,id);toast.success('Mailbox and its sent-message audit history deleted');onClose();}catch(error){toast.error(redactMessagingError(error));}};return <DetailView title={row.email} subtitle={domainName(row)||`Domain #${domainId(row)}`} icon="bi-inbox" onClose={onClose} initialSection="overview" sections={[{key:'overview',label:'Overview',icon:'bi-info-circle',render:()=><div className="detail-section"><div className="storage-action-row"><button className="btn" onClick={()=>void edit()}>Edit</button><button className="btn" disabled={!row.allow_outbound} onClick={()=>void openSend(row,qc)}>Send test…</button></div><FlatRow label="Inbound">{row.allow_inbound?'Enabled':'Disabled'}</FlatRow><FlatRow label="Outbound">{row.allow_outbound?'Enabled':'Disabled'}</FlatRow><FlatRow label="System default">{row.is_system_default?'Yes':'No'}</FlatRow><FlatRow label="Domain default">{row.is_domain_default?'Yes':'No'}</FlatRow><FlatRow label="Async handler">{row.async_handler||'—'}</FlatRow></div>},{key:'danger',label:'Delete',icon:'bi-trash',render:()=><div className="detail-section"><p>Deleting this mailbox cascades its sent-message audit history.</p><ArmedButton label="Delete mailbox" armedLabel={`Click again to delete ${row.email}`} onConfirm={remove}/></div>}]} />;}
+export function MailboxesPage(){const qc=useQueryClient();const add=async()=>{const data=await formModal({title:'Create mailbox',fields:[...mailboxFields]});if(!data)return;try{const chosen=await EmailDomainModel.fetchOne(qc,Number(data.domain));if(!validMatch(String(data.email),chosen.name)){toast.error(`Email must belong to ${chosen.name}`);return;}await saveMailbox(qc,null,data);toast.success('Mailbox created');}catch(error){toast.error(redactMessagingError(error));}};return <ModelTable model={MailboxModel} eyebrow="Communications · SES" title="Mailboxes" columns={columns} filters={filters} defaultSort="email" searchable searchPlaceholder="Search mailbox addresses" columnChooser persistState persistKey="admin:email:mailboxes" addLabel="Create mailbox" onAdd={()=>void add()} onRowClick={row=>void modal.detail(close=><MailboxDetail id={row.id} onClose={()=>close(null)}/>)}/>;}

package/src/admin/messaging/PublicMessagesPage.tsx

@@ -0,0 +1,13 @@
+import { useQueryClient } from '@tanstack/react-query';
+import { ArmedButton, Badge, DetailView, FlatRow, ModelTable, fmt, groupByDay, modal, toast, type BatchAction, type Column, type FilterDef, type Section } from '../../ui';
+import { useCan } from '../../client';
+import { deleteMessagingRow } from './api';
+import { exportPublicMessages } from './data';
+import { PUBLIC_MESSAGE_DELETE_PERMISSIONS, PUBLIC_MESSAGE_MANAGE_PERMISSIONS, PublicMessageModel, type PublicMessageRow } from './models';
+import { publicMessageMailto, redactMessagingError } from './sanitize';
+
+const columns:Column<PublicMessageRow>[]=[{key:'created',label:'Received',sortable:true,hideable:false,render:r=>fmt.datetime(r.created)},{key:'kind',label:'Kind',sortable:true},{key:'name',label:'Name',sortable:true},{key:'email',label:'Email',sortable:true},{key:'subject',label:'Subject',sortable:true},{key:'status',label:'Status',sortable:true,render:r=><Badge tone={r.status==='open'?'warning':'success'}>{r.status}</Badge>}];
+const filters:FilterDef[]=[{key:'kind__in',label:'Kind',type:'multiselect',options:[{value:'contact_us',label:'Contact us'},{value:'support',label:'Support'}]},{key:'status__in',label:'Status',type:'multiselect',options:[{value:'open',label:'Open'},{value:'closed',label:'Closed'}]},{key:'created',label:'Received',type:'daterange'}];
+export function publicMessageGroupLabel(group:PublicMessageRow['group']):string{return group==null?'—':typeof group==='object'?group.name??`#${group.id}`:`#${group}`;}
+function PublicMessageDetail({id,onClose}:{id:number;onClose:()=>void}){const qc=useQueryClient();const query=PublicMessageModel.useOne(id);const save=PublicMessageModel.useSave();const canManage=useCan(PUBLIC_MESSAGE_MANAGE_PERMISSIONS).can;const canDelete=useCan(PUBLIC_MESSAGE_DELETE_PERMISSIONS).can;if(!query.data)return <div className="modal-pad"><p>{query.isLoading?'Loading contact message…':query.error instanceof Error?redactMessagingError(query.error):'Contact message unavailable'}</p><button className="btn" onClick={onClose}>Close</button></div>;const row=query.data;const setStatus=async(status:'open'|'closed')=>{try{await save.mutateAsync({id,changes:{status}});toast.success(`Message marked ${status}`);await query.refetch();}catch(error){toast.error(redactMessagingError(error));}};const remove=async()=>{try{await deleteMessagingRow(qc,PublicMessageModel.endpoint,id);toast.success('Contact message deleted');onClose();}catch(error){toast.error(redactMessagingError(error));}};const mailto=publicMessageMailto(row);const group=publicMessageGroupLabel(row.group);const sections:Section[]=[{key:'message',label:'Message',icon:'bi-envelope-open',render:()=><div className="detail-section"><div className="storage-action-row">{mailto&&<a className="btn" href={mailto}>Open mail app</a>}{canManage&&<button className="btn" onClick={()=>void setStatus(row.status==='open'?'closed':'open')}>Mark {row.status==='open'?'closed':'open'}</button>}</div><FlatRow label="Kind">{row.kind}</FlatRow><FlatRow label="Group">{group}</FlatRow><FlatRow label="Received">{fmt.datetime(row.created)}</FlatRow><div className="known-card"><h3>Message</h3><p className="pre-wrap">{row.message||'—'}</p></div></div>},{key:'context',label:'PII & context',icon:'bi-person-vcard',render:()=><div className="detail-section"><p className="form-alert">This section contains personally identifiable request data.</p><FlatRow label="IP address">{row.ip_address||'—'}</FlatRow><FlatRow label="User agent">{row.user_agent||'—'}</FlatRow>{Object.entries(row.metadata??{}).map(([key,value])=><FlatRow key={key} label={key.replaceAll('_',' ')}>{value}</FlatRow>)}{row.metadata_withheld&&<p className="dim">Additional metadata was withheld by the safe projection.</p>}</div>}];if(canDelete)sections.push({key:'delete',label:'Delete',icon:'bi-trash',render:()=><div className="detail-section"><ArmedButton label="Delete contact message" armedLabel="Click again to permanently delete" onConfirm={remove}/></div>});return <DetailView title={row.subject} subtitle={`${row.name} · ${row.email}`} icon="bi-chat-left-text" chips={[{text:row.status,tone:row.status==='open'?'warning':'success'}]} onClose={onClose} sections={sections} />;}
+export function PublicMessagesPage(){const canManage=useCan(PUBLIC_MESSAGE_MANAGE_PERMISSIONS).can;const save=PublicMessageModel.useSave();const update=async(row:PublicMessageRow,status:'open'|'closed')=>{try{return await save.mutateAsync({id:row.id,changes:{status}});}catch(error){throw new Error(redactMessagingError(error));}};const actions:BatchAction<PublicMessageRow>[]=[{key:'open',label:'Mark open',eligible:r=>r.status!=='open',run:r=>update(r,'open')},{key:'closed',label:'Mark closed',eligible:r=>r.status!=='closed',run:r=>update(r,'closed')}];const grouping=groupByDay<PublicMessageRow>('created');return <ModelTable model={PublicMessageModel} eyebrow="Communications · Support" title="Contact Messages" columns={columns} filters={filters} defaultSort="-created" searchable searchPlaceholder="Search name, email, subject, or message" selectable={canManage} batchActions={canManage?actions:[]} {...grouping} columnChooser persistState persistKey="admin:messaging:public" exportFormats={['csv','json']} exporter={exportPublicMessages} onRowClick={row=>void modal.detail(close=><PublicMessageDetail id={row.id} onClose={()=>close(null)}/>)}/>;}

package/src/admin/messaging/SandboxedEmailPreview.tsx

@@ -0,0 +1,23 @@
+import { useMemo } from 'react';
+
+export const EMAIL_PREVIEW_CSP = "default-src 'none'; img-src data:; style-src 'unsafe-inline'; font-src 'none'; connect-src 'none'; frame-src 'none'; media-src 'none'; form-action 'none'; base-uri 'none'";
+const DROP_ELEMENTS='script,style,link,base,meta,iframe,frame,frameset,object,embed,form,input,button,textarea,select,option,video,audio,source,track,picture,svg,math,canvas';
+const DROP_ATTR=/^(?:on|href$|xlink:href$|src$|srcset$|action$|formaction$|poster$|ping$|background$|data$|codebase$|manifest$)/i;
+function escapeHtml(value:string):string{return value.replaceAll('&','&amp;').replaceAll('<','&lt;').replaceAll('>','&gt;').replaceAll('"','&quot;');}
+
+/** Parse into a fresh detached document, project safe presentation markup, then serialize. */
+export function sanitizeEmailHtml(html:string):string{
+    if(typeof DOMParser==='undefined')return `<pre>${escapeHtml(html)}</pre>`;
+    const parsed=new DOMParser().parseFromString(`<!doctype html><html><body>${html}</body></html>`,'text/html');
+    parsed.body.querySelectorAll(DROP_ELEMENTS).forEach(node=>node.remove());
+    parsed.body.querySelectorAll('*').forEach((element)=>{
+        for(const attr of [...element.attributes]){
+            const name=attr.name.toLowerCase();
+            if(DROP_ATTR.test(name)||name==='xmlns'||name.startsWith('xmlns:')||(name==='style'&&/url\s*\(|@import|expression\s*\(/i.test(attr.value)))element.removeAttribute(attr.name);
+        }
+        if(element.tagName==='A'){element.removeAttribute('href');element.removeAttribute('target');element.setAttribute('aria-disabled','true');}
+    });
+    return parsed.body.innerHTML;
+}
+export function buildEmailPreviewDocument(html:string):string{const body=sanitizeEmailHtml(html);return `<!doctype html><html><head><meta http-equiv="Content-Security-Policy" content="${EMAIL_PREVIEW_CSP}"><meta name="referrer" content="no-referrer"></head><body>${body}</body></html>`;}
+export function SandboxedEmailPreview({html,text}:{html?:string|null;text?:string|null}){const srcDoc=useMemo(()=>buildEmailPreviewDocument(html??''),[html]);return <div className="email-preview">{text&&<pre className="email-preview-text">{text}</pre>}{html&&<iframe title="Sandboxed email HTML preview" sandbox="" referrerPolicy="no-referrer" srcDoc={srcDoc}/>} {!text&&!html&&<p className="dim">No message body.</p>}</div>;}

package/src/admin/messaging/SentMessagesPage.tsx

@@ -0,0 +1,11 @@
+import { Badge, DetailView, FlatRow, ModelTable, fmt, groupByDay, modal, type Column, type FilterDef } from '../../ui';
+import { exportSentMessages, SENT_STATUSES } from './data';
+import { SentMessageModel, type SentMessageRow } from './models';
+import { SandboxedEmailPreview } from './SandboxedEmailPreview';
+import { redactMessagingError } from './sanitize';
+
+const mailboxEmail=(row:SentMessageRow)=>typeof row.mailbox==='object'?row.mailbox?.email??row.mailbox?.name??`#${row.mailbox?.id}`:`#${row.mailbox}`;
+const columns:Column<SentMessageRow>[]=[{key:'created',label:'Created',sortable:true,hideable:false,render:r=>fmt.datetime(r.created)},{key:'mailbox',label:'From',render:mailboxEmail},{key:'to_addresses',label:'To',render:r=>r.to_addresses.join(', ')},{key:'subject',label:'Subject',sortable:true},{key:'status',label:'Status',sortable:true,render:r=><Badge tone={r.status==='delivered'?'success':r.status==='failed'||r.status==='bounced'||r.status==='complained'?'danger':r.status==='sending'?'warning':'muted'}>{r.status==='sending'?'sending · pending':r.status}</Badge>},{key:'ses_message_id',label:'SES id',sortable:true,render:r=><code>{r.ses_message_id||'—'}</code>}];
+const filters:FilterDef[]=[{key:'status',label:'Status',type:'select',options:SENT_STATUSES.map(v=>({value:v,label:v}))},{key:'mailbox',label:'Mailbox id',type:'number'},{key:'created',label:'Created',type:'daterange'}];
+function SentDetail({id,onClose}:{id:number;onClose:()=>void}){const query=SentMessageModel.useOne(id);if(!query.data)return <div className="modal-pad"><p>{query.isLoading?'Loading sent message…':query.error instanceof Error?redactMessagingError(query.error):'Sent message unavailable'}</p><button className="btn" onClick={onClose}>Close</button></div>;const row=query.data;return <DetailView title={row.subject||'(no subject)'} subtitle={`${mailboxEmail(row)} → ${row.to_addresses.join(', ')}`} icon="bi-send" chips={[{text:row.status,tone:row.status==='delivered'?'success':row.status==='failed'?'danger':'warning'}]} onClose={onClose} sections={[{key:'overview',label:'Delivery',icon:'bi-info-circle',render:()=><div className="detail-section"><FlatRow label="From">{mailboxEmail(row)}</FlatRow><FlatRow label="To">{row.to_addresses.join(', ')}</FlatRow><FlatRow label="CC">{row.cc_addresses.join(', ')||'—'}</FlatRow><FlatRow label="SES message id"><code>{row.ses_message_id||'—'}</code></FlatRow><FlatRow label="Status reason">{row.status_reason?redactMessagingError(row.status_reason):'—'}</FlatRow><FlatRow label="Created">{fmt.datetime(row.created)}</FlatRow></div>},{key:'content',label:'Content',icon:'bi-file-earmark-code',render:()=><div className="detail-section"><SandboxedEmailPreview text={row.body_text} html={row.body_html}/></div>}]} />;}
+export function SentMessagesPage(){const grouping=groupByDay<SentMessageRow>('created');return <ModelTable model={SentMessageModel} eyebrow="Communications · SES" title="Sent Messages" columns={columns} filters={filters} defaultSort="-created" searchable searchPlaceholder="Search subject or SES message id" autoRefresh={15} {...grouping} columnChooser persistState persistKey="admin:email:sent" exportFormats={['csv','json']} exporter={exportSentMessages} onRowClick={row=>void modal.detail(close=><SentDetail id={row.id} onClose={()=>close(null)}/>)}/>;}

package/src/admin/messaging/api.ts

@@ -0,0 +1,17 @@
+import type { QueryClient } from '@tanstack/react-query';
+import { mojoCall, mojoDelete, mojoSave, withFreshAuth } from '../../client';
+import { EmailDomainModel, MailboxModel, SentMessageModel, type DomainActionResult, type DomainAuditResult, type DomainOnboardInput, type EmailDomainRow, type MailboxRow, type SendEmailInput, type SentMessageRow } from './models';
+import { redactMessagingError, sanitizeAuditResult, sanitizeDomainActionResult, sanitizeEmailDomainRow, sanitizeMailboxRow, sanitizeSentMessageRow } from './sanitize';
+
+const flights = new Map<string, Promise<unknown>>();
+function singleFlight<T>(key: string, fn: () => Promise<T>): Promise<T> { const current=flights.get(key); if (current) return current as Promise<T>; const next=fn().finally(()=>flights.delete(key)); flights.set(key,next); return next; }
+function safeChanges(input: Record<string, unknown>): Record<string, unknown> { const allowed=['name','region','receiving_enabled','s3_inbound_bucket','s3_inbound_prefix','dns_mode','sns_topic_bounce_arn','sns_topic_complaint_arn','sns_topic_delivery_arn','sns_topic_inbound_arn','aws_key','aws_secret']; const out:Record<string,unknown>={}; for (const key of allowed) if (input[key] !== undefined) out[key]=input[key]; for (const key of ['aws_key','aws_secret']) if (typeof out[key] !== 'string' || !(out[key] as string).trim()) delete out[key]; return out; }
+async function reconcileCaches(qc: QueryClient, id?: number | null) { await qc.invalidateQueries({queryKey:EmailDomainModel.keys.root,refetchType:'none'}); if (id != null) { qc.removeQueries({queryKey:EmailDomainModel.keys.one(id),exact:true}); try { await EmailDomainModel.fetchOne(qc,id); } catch { /* the mutation error remains primary */ } } await qc.refetchQueries({type:'active',predicate:(q)=>q.queryKey[0]===EmailDomainModel.endpoint}); }
+export async function saveEmailDomainAtomic(qc: QueryClient, id: number|null, changes: Record<string,unknown>): Promise<EmailDomainRow> { let saved:EmailDomainRow|undefined; let failure:unknown; let refreshFailed=false; try { saved=sanitizeEmailDomainRow(await withFreshAuth(()=>mojoSave<EmailDomainRow>(EmailDomainModel.endpoint,id,safeChanges(changes)))); } catch(error) { failure=error; } finally { try{await reconcileCaches(qc,saved?.id??id);}catch{refreshFailed=true;} } if (failure) throw new Error(`${redactMessagingError(failure)}${refreshFailed?' Authoritative refresh also failed; refresh before another action.':''}`); if (refreshFailed||!saved) throw new Error('The backend may have changed, but authoritative refresh failed. Refresh before another action.'); return saved; }
+async function domainAction(qc:QueryClient,id:number,action:'onboard'|'audit'|'reconcile',body:Record<string,unknown>):Promise<DomainActionResult|DomainAuditResult>{ return singleFlight(`domain:${id}:${action}`,async()=>{ let result:DomainActionResult|DomainAuditResult|undefined;let failure:unknown;let refreshFailed=false;try { const response=await mojoCall(`${EmailDomainModel.endpoint}/${id}/${action}`,{method:'POST',body}); result=action==='audit'?sanitizeAuditResult(response.data):sanitizeDomainActionResult(response.data); } catch(error){failure=error;} finally {try{await reconcileCaches(qc,id);}catch{refreshFailed=true;}}if(failure)throw new Error(`${redactMessagingError(failure)}${refreshFailed?' Authoritative refresh also failed; refresh before another action.':''}`);if(refreshFailed)throw new Error('The action may have changed AWS state, but authoritative refresh failed. Refresh before another action.');return result!; }); }
+export const auditEmailDomain=(qc:QueryClient,id:number)=>domainAction(qc,id,'audit',{}) as Promise<DomainAuditResult>;
+export const reconcileEmailDomain=(qc:QueryClient,id:number)=>domainAction(qc,id,'reconcile',{}) as Promise<DomainActionResult>;
+export const onboardEmailDomain=(qc:QueryClient,id:number,input:DomainOnboardInput)=>domainAction(qc,id,'onboard',{use_dnsman:Boolean(input.use_dnsman),...(input.region?{region:input.region}:{}),receiving_enabled:Boolean(input.receiving_enabled),...(input.s3_inbound_bucket?{s3_inbound_bucket:input.s3_inbound_bucket}:{}),...(input.s3_inbound_prefix!==undefined?{s3_inbound_prefix:input.s3_inbound_prefix}:{}),ensure_mail_from:Boolean(input.ensure_mail_from),...(input.mail_from_subdomain?{mail_from_subdomain:input.mail_from_subdomain}:{}),...(!input.use_dnsman?{dns_mode:'manual'}:{}),...(input.endpoints?{endpoints:input.endpoints}:{})}) as Promise<DomainActionResult>;
+export async function saveMailbox(qc:QueryClient,id:number|null,changes:Record<string,unknown>):Promise<MailboxRow>{const allowed=['email','domain','allow_inbound','allow_outbound','async_handler','is_system_default','is_domain_default'];const body:Record<string,unknown>={};for(const key of allowed)if(changes[key]!==undefined)body[key]=changes[key];let row:MailboxRow|undefined;let failure:unknown;let refreshFailed=false;try{row=sanitizeMailboxRow(await mojoSave<MailboxRow>(MailboxModel.endpoint,id,body));}catch(error){failure=error;}finally{try{await MailboxModel.invalidate(qc);await qc.refetchQueries({type:'active',predicate:q=>q.queryKey[0]===MailboxModel.endpoint});}catch{refreshFailed=true;}}if(failure)throw new Error(`${redactMessagingError(failure)}${refreshFailed?' Mailbox refresh also failed.':''}`);if(refreshFailed||!row)throw new Error('The mailbox may have changed, but authoritative refresh failed. Refresh before another action.');return row;}
+export async function deleteMessagingRow(qc:QueryClient,endpoint:string,id:number):Promise<void>{let failure:unknown;let refreshFailed=false;try{await withFreshAuth(()=>mojoDelete(endpoint,id));}catch(error){failure=error;}finally{try{await qc.invalidateQueries({queryKey:[endpoint]});await qc.refetchQueries({type:'active',predicate:q=>q.queryKey[0]===endpoint});}catch{refreshFailed=true;}}if(failure)throw new Error(`${redactMessagingError(failure)}${refreshFailed?' List refresh also failed.':''}`);if(refreshFailed)throw new Error('Deletion may have persisted, but list refresh failed. Refresh before another action.');}
+export async function sendEmail(qc:QueryClient,input:SendEmailInput):Promise<SentMessageRow>{ return singleFlight(`send:${input.from_email}`,async()=>{let row:SentMessageRow|undefined;let failure:unknown;let refreshFailed=false;try { const response=await mojoCall('/api/aws/email/send',{method:'POST',body:input as unknown as Record<string,unknown>}); row=sanitizeSentMessageRow(response.data as SentMessageRow); } catch(error){failure=error;}finally{try{await SentMessageModel.invalidate(qc);await qc.refetchQueries({type:'active',predicate:q=>q.queryKey[0]===SentMessageModel.endpoint});}catch{refreshFailed=true;}}if(failure)throw new Error(`${redactMessagingError(failure)}${refreshFailed?' Sent history refresh also failed.':''}`);if(refreshFailed||!row)throw new Error('The send may have persisted, but sent history refresh failed. Refresh before sending again.');return row; }); }

package/src/admin/messaging/data.ts

@@ -0,0 +1,10 @@
+import { createSafeExporter } from '../../client';
+import { EmailDomainModel, EmailTemplateModel, PublicMessageModel, SentMessageModel, type EmailDomainRow, type EmailTemplateRow, type PublicMessageRow, type SentMessageRow } from './models';
+import { sanitizeEmailDomainRow, sanitizePublicMessageRow, sanitizeSentMessageRow, sanitizeTemplateRow } from './sanitize';
+
+export const SENT_STATUSES = ['queued','sending','delivered','bounced','complained','failed','unknown'] as const;
+export function spreadsheetSafe(value:unknown):unknown{if(typeof value!=='string')return value;return /^[\t\r\n\u0000-\u0020]*[=+\-@]/.test(value)?`'${value}`:value;}
+export const exportEmailDomains = createSafeExporter<EmailDomainRow>({ endpoint: EmailDomainModel.endpoint, filename: 'email-domains', sanitizeRow: sanitizeEmailDomainRow, fields: [{key:'id'},{key:'name',value:r=>spreadsheetSafe(r.name)},{key:'region'},{key:'status'},{key:'receiving_enabled'},{key:'dns_mode'},{key:'created'},{key:'modified'}] });
+export const exportSentMessages = createSafeExporter<SentMessageRow>({ endpoint: SentMessageModel.endpoint, filename: 'sent-messages', sanitizeRow: sanitizeSentMessageRow, fields: [{key:'id'},{key:'created'},{key:'modified'},{key:'mailbox',value:r=>typeof r.mailbox==='object'?spreadsheetSafe(r.mailbox?.email??''):r.mailbox},{key:'to_addresses',value:(r)=>spreadsheetSafe(r.to_addresses.join(', '))},{key:'subject',value:r=>spreadsheetSafe(r.subject)},{key:'status'},{key:'ses_message_id',value:r=>spreadsheetSafe(r.ses_message_id)}] });
+export const exportEmailTemplates = createSafeExporter<EmailTemplateRow>({ endpoint: EmailTemplateModel.endpoint, filename: 'email-templates', sanitizeRow: sanitizeTemplateRow, fields: [{key:'id'},{key:'name',value:r=>spreadsheetSafe(r.name)},{key:'created'},{key:'modified'}] });
+export const exportPublicMessages = createSafeExporter<PublicMessageRow>({ endpoint: PublicMessageModel.endpoint, filename: 'contact-messages', sanitizeRow: sanitizePublicMessageRow, fields: [{key:'id'},{key:'created'},{key:'modified'},{key:'kind'},{key:'status'},{key:'name',value:r=>spreadsheetSafe(r.name)},{key:'email',value:r=>spreadsheetSafe(r.email)},{key:'subject',value:r=>spreadsheetSafe(r.subject)}] });

package/src/admin/messaging/index.ts

@@ -0,0 +1,23 @@
+import type { AdminSection } from '../index';
+import { EmailDomainsPage } from './EmailDomainsPage';
+import { EmailTemplatesPage } from './EmailTemplatesPage';
+import { MailboxesPage } from './MailboxesPage';
+import { PublicMessagesPage } from './PublicMessagesPage';
+import { SentMessagesPage } from './SentMessagesPage';
+import { EMAIL_ADMIN_PERMISSIONS, PUBLIC_MESSAGE_VIEW_PERMISSIONS } from './models';
+export * from './push';
+
+export * from './models';
+export * from './sanitize';
+export * from './api';
+export * from './data';
+export * from './SandboxedEmailPreview';
+export * from './EmailDomainWizard';
+export * from './EmailDomainsPage';
+export * from './MailboxesPage';
+export * from './SentMessagesPage';
+export * from './EmailTemplatesPage';
+export * from './PublicMessagesPage';
+
+export const EMAIL_ADMIN_SECTION:AdminSection={id:'email',basePath:'email',title:'Email',icon:'bi-envelope-at',navigationGroup:'communications',permissions:EMAIL_ADMIN_PERMISSIONS,routes:[{path:'domains',label:'Email Domains',component:EmailDomainsPage,permissions:EMAIL_ADMIN_PERMISSIONS},{path:'mailboxes',label:'Mailboxes',component:MailboxesPage,permissions:EMAIL_ADMIN_PERMISSIONS},{path:'sent',label:'Sent Messages',component:SentMessagesPage,permissions:EMAIL_ADMIN_PERMISSIONS},{path:'templates',label:'Email Templates',component:EmailTemplatesPage,permissions:EMAIL_ADMIN_PERMISSIONS}]};
+export const PUBLIC_MESSAGES_ADMIN_SECTION:AdminSection={id:'public-messages',basePath:'messaging',title:'Contact Messages',icon:'bi-chat-left-text',navigationGroup:'communications',permissions:PUBLIC_MESSAGE_VIEW_PERMISSIONS,routes:[{path:'public-messages',label:'Contact Messages',component:PublicMessagesPage,permissions:PUBLIC_MESSAGE_VIEW_PERMISSIONS}]};

package/src/admin/messaging/models.ts

@@ -0,0 +1,76 @@
+import { defineModel, type Params } from '../../client';
+import {
+    sanitizeEmailDomainRow, sanitizeMailboxRow, sanitizePublicMessageRow,
+    sanitizeSentMessageRow, sanitizeTemplateRow,
+} from './sanitize';
+
+export const EMAIL_ADMIN_PERMISSIONS = ['sys.manage_aws', 'sys.comms'];
+export const PUBLIC_MESSAGE_VIEW_PERMISSIONS = ['sys.view_support', 'sys.security', 'sys.support'];
+export const PUBLIC_MESSAGE_MANAGE_PERMISSIONS = ['sys.manage_support', 'sys.security', 'sys.support'];
+export const PUBLIC_MESSAGE_DELETE_PERMISSIONS = ['sys.manage_support'];
+
+export interface MessagingRelation { id: number; name?: string; email?: string }
+export type EmailDomainStatus = 'pending' | 'verified' | 'ready' | 'missing' | 'unknown';
+export type EmailDnsMode = 'manual' | 'route53' | 'godaddy' | 'unknown';
+export type SentMessageStatus = 'queued' | 'sending' | 'delivered' | 'bounced' | 'complained' | 'failed' | 'unknown';
+
+export interface EmailDomainRow {
+    id: number; created: number; modified: number; name: string; region: string; status: EmailDomainStatus;
+    receiving_enabled: boolean; s3_inbound_bucket: string | null; s3_inbound_prefix: string; dns_mode: EmailDnsMode;
+    aws_key_masked?: string | null; aws_secret_masked?: string | null;
+    sns_topic_bounce_arn?: string | null; sns_topic_complaint_arn?: string | null; sns_topic_delivery_arn?: string | null; sns_topic_inbound_arn?: string | null;
+}
+export interface MailboxRow {
+    id: number; created: number; modified: number; email: string; domain: MessagingRelation | number | null;
+    allow_inbound: boolean; allow_outbound: boolean; async_handler: string | null;
+    is_system_default: boolean; is_domain_default: boolean;
+}
+export interface SentMessageRow {
+    id: number; created: number; modified: number; mailbox: MessagingRelation | number | null;
+    to_addresses: string[]; cc_addresses: string[]; bcc_addresses?: string[]; subject: string; status: SentMessageStatus;
+    ses_message_id: string | null; status_reason?: string | null; body_text?: string | null; body_html?: string | null;
+}
+export interface EmailTemplateRow {
+    id: number; created: number; modified: number; name: string; subject_template?: string; html_template?: string | null; text_template?: string | null;
+}
+export interface PublicMessageRow {
+    id: number; created: number; modified: number; kind: 'contact_us' | 'support' | string; status: 'open' | 'closed' | string;
+    name: string; email: string; subject: string; group: MessagingRelation | number | null;
+    message?: string; metadata?: Record<string, string>; metadata_withheld?: boolean; ip_address?: string | null; user_agent?: string | null;
+}
+export interface EmailDnsRecord { type: string; name: string; value: string; ttl: number }
+export interface DomainOnboardInput {
+    use_dnsman: boolean; region?: string; receiving_enabled?: boolean; s3_inbound_bucket?: string; s3_inbound_prefix?: string;
+    ensure_mail_from?: boolean; mail_from_subdomain?: string; dns_mode?: 'manual';
+    endpoints?: { bounce?: string; complaint?: string; delivery?: string; inbound?: string };
+}
+export interface DomainActionResult {
+    domain: string; region: string; status?: string; dns_records: EmailDnsRecord[]; dkim_tokens: string[]; notes: string[];
+    provider?: string; applied?: number; topic_arns?: Record<string, string>; receipt_rule?: string; rule_set?: string;
+}
+export interface DomainAuditResult {
+    domain: string; region: string; status: string; audit_pass: boolean; checks: Record<string, boolean>;
+    items: Array<{ resource: string; status: string }>;
+    recommendations: Array<{ resource: string; severity: string; action: string; explanation: string }>;
+}
+export interface SendEmailInput {
+    from_email: string; to: string[]; cc?: string[]; bcc?: string[]; reply_to?: string;
+    subject?: string; body_text?: string; body_html?: string; template_name?: string; template_context?: Record<string, unknown>;
+}
+
+const COMMON = new Set(['start', 'size', 'search', 'sort', 'dr_field', 'dr_start', 'dr_end']);
+function allow(params: Params, graph: string, filters: readonly string[], sorts:readonly string[], defaultSort: string, dateRange=false): Params {
+    const out: Params = { graph, start: params.start ?? 0, size: params.size ?? 25 };
+    const allowed = new Set([...COMMON, ...filters]);
+    for (const [key, value] of Object.entries(params)) if (allowed.has(key) && value != null && value !== '') out[key] = value;
+    const requested=typeof params.sort==='string'?params.sort:'';const field=requested.replace(/^-/,'');
+    out.graph = graph; out.sort = sorts.includes(field) ? requested : defaultSort;
+    if(dateRange&&(out.dr_start||out.dr_end)){out.dr_field='created';}else{delete out.dr_field;delete out.dr_start;delete out.dr_end;}
+    return out;
+}
+
+export const EmailDomainModel = defineModel<EmailDomainRow>({ name: 'email-domain', endpoint: '/api/aws/email/domain', permissions: { view: EMAIL_ADMIN_PERMISSIONS, manage: EMAIL_ADMIN_PERMISSIONS, delete: EMAIL_ADMIN_PERMISSIONS }, normalizeListParams: (p) => allow(p, 'default', ['region', 'status', 'receiving_enabled', 'dns_mode'], ['name','region','status','receiving_enabled','dns_mode','created','modified'], 'name'), sanitizeRow: sanitizeEmailDomainRow });
+export const MailboxModel = defineModel<MailboxRow>({ name: 'email-mailbox', endpoint: '/api/aws/email/mailbox', permissions: { view: EMAIL_ADMIN_PERMISSIONS, manage: EMAIL_ADMIN_PERMISSIONS, delete: EMAIL_ADMIN_PERMISSIONS }, normalizeListParams: (p) => allow(p, 'default', ['domain', 'allow_inbound', 'allow_outbound', 'is_system_default', 'is_domain_default'], ['email','allow_inbound','allow_outbound','is_system_default','is_domain_default','created','modified'], 'email'), sanitizeRow: sanitizeMailboxRow });
+export const SentMessageModel = defineModel<SentMessageRow>({ name: 'sent-message', endpoint: '/api/aws/email/sent', permissions: { view: EMAIL_ADMIN_PERMISSIONS }, normalizeListParams: (p) => allow(p, 'basic', ['mailbox', 'status', 'status__in'], ['created','status','subject','ses_message_id'], '-created',true), sanitizeRow: sanitizeSentMessageRow });
+export const EmailTemplateModel = defineModel<EmailTemplateRow>({ name: 'email-template', endpoint: '/api/aws/email/template', permissions: { view: EMAIL_ADMIN_PERMISSIONS, manage: EMAIL_ADMIN_PERMISSIONS, delete: EMAIL_ADMIN_PERMISSIONS }, normalizeListParams: (p) => allow(p, 'basic', [], ['name','created','modified'], 'name',true), sanitizeRow: sanitizeTemplateRow });
+export const PublicMessageModel = defineModel<PublicMessageRow>({ name: 'public-message', endpoint: '/api/account/public_message', permissions: { view: PUBLIC_MESSAGE_VIEW_PERMISSIONS, manage: PUBLIC_MESSAGE_MANAGE_PERMISSIONS, delete: PUBLIC_MESSAGE_DELETE_PERMISSIONS }, normalizeListParams: (p) => allow(p, 'list', ['kind', 'kind__in', 'status', 'status__in'], ['created','modified','kind','status','name','email','subject'], '-created',true), sanitizeRow: sanitizePublicMessageRow });

package/src/admin/messaging/push/PushPage.tsx

@@ -0,0 +1,44 @@
+import { useRef, useState } from 'react';
+import { useQuery, useQueryClient } from '@tanstack/react-query';
+import { useSearchParams } from 'react-router-dom';
+import { KPITile, MetricsChart } from '../../../charts';
+import { useCan } from '../../../client';
+import { Badge, DetailView, FlatRow, ModelTable, Tabs, fmt, modal, toast, type Column, type FilterDef } from '../../../ui';
+import { fetchPushGroupChoices, fetchPushStats, parseFcmServiceAccount, savePushConfigImperative, testPushConfigConnection, type FcmCredentialEdit } from './api';
+import {
+    PUSH_CONFIG_MANAGE_PERMISSIONS, PUSH_CONFIG_TEST_PERMISSIONS, PUSH_CONFIG_VIEW_PERMISSIONS,
+    PUSH_DELIVERY_VIEW_PERMISSIONS, PUSH_DEVICE_VIEW_PERMISSIONS, PUSH_GROUP_DIRECTORY_PERMISSIONS,
+    PUSH_METRICS_PERMISSIONS, PUSH_TEMPLATE_MANAGE_PERMISSIONS, PUSH_TEMPLATE_VIEW_PERMISSIONS,
+    PushConfigModel, PushDeliveryModel, PushDeviceModel, PushTemplateModel,
+    type PushConfigRow, type PushDeliveryRow, type PushDeviceRow, type PushTemplateRow,
+} from './models';
+
+const relationLabel=(value:{id:number;name?:string;display_name?:string}|null,fallback='—')=>value?.name??value?.display_name??(value?`#${value.id}`:fallback);
+const statusTone=(status:string)=>status==='sent'||status==='delivered'?'success':status==='failed'?'danger':'warning';
+
+export function PushStatsPanel(){const query=useQuery({queryKey:['/api/account/devices/push/stats','caller'],queryFn:fetchPushStats,staleTime:30_000});const row=query.data;return <div className="push-stats"><section><h2>Your activity</h2><p className="dim">These five counts belong only to the signed-in caller; they are not platform totals.</p><div className="push-kpi-grid"><KPITile label="Sent" value={row?.total_sent} loading={query.isPending}/><KPITile label="Failed" value={row?.total_failed} tone="bad" loading={query.isPending}/><KPITile label="Pending" value={row?.total_pending} loading={query.isPending}/></div></section><section><h2>Your devices</h2><div className="push-kpi-grid push-kpi-grid-two"><KPITile label="Registered devices" value={row?.registered_devices} loading={query.isPending}/><KPITile label="Enabled devices" value={row?.enabled_devices} loading={query.isPending}/></div></section>{query.error&&<div className="form-alert">Caller push statistics are unavailable.</div>}</div>;}
+export function PushMetricsPanel(){return <div className="panel panel-pad"><p className="eyebrow">Global metrics account</p><MetricsChart title="Push delivery activity" slugs={['push_sent','push_failed']} seriesLabels={{push_sent:'Sent',push_failed:'Failed'}} account="global" defaultRange="7d" defaultGranularity="hours" defaultType="line"/></div>;}
+
+const deviceColumns:Column<PushDeviceRow>[]=[{key:'last_seen',label:'Last seen',sortable:true,hideable:false,render:r=>fmt.datetime(r.last_seen)},{key:'device_name',label:'Device',sortable:true,render:r=>r.device_name||r.device_id},{key:'user',label:'User',render:r=>relationLabel(r.user)},{key:'platform',label:'Platform',sortable:true,render:r=><Badge tone="info">{r.platform}</Badge>},{key:'app_version',label:'App version',render:r=>r.app_version||'—'},{key:'push_enabled',label:'Push',sortable:true,render:r=><Badge tone={r.push_enabled?'success':'muted'}>{r.push_enabled?'enabled':'disabled'}</Badge>}];
+const deviceFilters:FilterDef[]=[{key:'platform',label:'Platform',type:'select',options:['ios','android','web'].map(value=>({value,label:value}))},{key:'push_enabled',label:'Push enabled',type:'boolean'},{key:'is_active',label:'Active',type:'boolean'}];
+function DeviceDetail({id,onClose}:{id:number;onClose:()=>void}){const query=PushDeviceModel.useOne(id);if(!query.data)return <div className="modal-pad">{query.isLoading?'Loading registered device…':'Registered device unavailable'}<button className="btn" onClick={onClose}>Close</button></div>;const row=query.data;return <DetailView title={row.device_name||row.device_id} subtitle={`${row.platform} · ${relationLabel(row.user)}`} icon="bi-phone" onClose={onClose} sections={[{key:'device',label:'Device',icon:'bi-device-ssd',render:()=><div className="detail-section"><FlatRow label="Device id"><code>{row.device_id}</code></FlatRow><FlatRow label="Platform">{row.platform}</FlatRow><FlatRow label="OS version">{row.os_version||'—'}</FlatRow><FlatRow label="App version">{row.app_version||'—'}</FlatRow><FlatRow label="Push enabled">{row.push_enabled?'Yes':'No'}</FlatRow><FlatRow label="Last seen">{fmt.datetime(row.last_seen)}</FlatRow></div>},{key:'preferences',label:'Preferences',icon:'bi-sliders',render:()=><div className="detail-section">{Object.keys(row.push_preferences).length?Object.entries(row.push_preferences).map(([key,value])=><FlatRow key={key} label={key}>{value?'Enabled':'Disabled'}</FlatRow>):<p className="dim">No category overrides.</p>}<p className="dim">Device tokens are sensitive and never enter this client.</p></div>}]} />;}
+export function PushDevicesPage(){return <ModelTable model={PushDeviceModel} eyebrow="Communications · Push" title="Registered Devices" columns={deviceColumns} filters={deviceFilters} defaultSort="-last_seen" searchable searchPlaceholder="Search device name or device id" columnChooser persistState persistKey="admin:push:devices" onRowClick={row=>void modal.detail(close=><DeviceDetail id={row.id} onClose={()=>close(null)}/>)}/>;}
+
+const deliveryColumns:Column<PushDeliveryRow>[]=[{key:'created',label:'Created',sortable:true,hideable:false,render:r=>fmt.datetime(r.created)},{key:'title',label:'Title',render:r=>r.title||`[${r.category} data]`},{key:'user',label:'User',render:r=>relationLabel(r.user)},{key:'device',label:'Device',render:r=>relationLabel(r.device)},{key:'category',label:'Category',sortable:true},{key:'status',label:'Status',sortable:true,render:r=><Badge tone={statusTone(r.status)}>{r.status}</Badge>}];
+const deliveryFilters:FilterDef[]=[{key:'status',label:'Status',type:'select',options:['pending','sent','delivered','failed'].map(value=>({value,label:value}))},{key:'category',label:'Category',type:'text'},{key:'created',label:'Created',type:'daterange'}];
+function DeliveryDetail({id,onClose}:{id:number;onClose:()=>void}){const query=PushDeliveryModel.useOne(id);if(!query.data)return <div className="modal-pad">{query.isLoading?'Loading delivery…':'Delivery unavailable'}<button className="btn" onClick={onClose}>Close</button></div>;const row=query.data;return <DetailView title={row.title||`[${row.category} data]`} subtitle={`${row.status} · ${relationLabel(row.device)}`} icon="bi-bell" chips={[{text:row.status,tone:statusTone(row.status)}]} onClose={onClose} sections={[{key:'preview',label:'Notification',icon:'bi-app-indicator',render:()=><div className="detail-section"><div className="push-preview"><strong>{row.title||'Data-only notification'}</strong><p>{row.body||'No visible message body.'}</p></div><FlatRow label="Category">{row.category}</FlatRow><FlatRow label="Action URL"><code>{row.action_url||'—'}</code></FlatRow></div>},{key:'delivery',label:'Delivery',icon:'bi-truck',render:()=><div className="detail-section"><FlatRow label="User">{relationLabel(row.user)}</FlatRow><FlatRow label="Device">{relationLabel(row.device)}</FlatRow><FlatRow label="Created">{fmt.datetime(row.created)}</FlatRow><FlatRow label="Sent">{row.sent_at?fmt.datetime(row.sent_at):'—'}</FlatRow><FlatRow label="Delivered">{row.delivered_at?fmt.datetime(row.delivered_at):'—'}</FlatRow><FlatRow label="Error">{row.error_message||'—'}</FlatRow><p className="dim">Platform responses and raw payloads are deliberately excluded. Deliveries cannot be retried or deleted here.</p></div>}]} />;}
+export function PushDeliveriesPage(){return <ModelTable model={PushDeliveryModel} eyebrow="Communications · Push" title="Deliveries" columns={deliveryColumns} filters={deliveryFilters} defaultSort="-created" searchable searchPlaceholder="Search title or category" autoRefresh={20} columnChooser persistState persistKey="admin:push:deliveries" onRowClick={row=>void modal.detail(close=><DeliveryDetail id={row.id} onClose={()=>close(null)}/>)}/>;}
+
+function jsonText(value:Record<string,unknown>):string{return Object.keys(value).length?JSON.stringify(value,null,2):'';}
+function parseJsonObject(value:string,label:string):Record<string,unknown>{if(!value.trim())return {};let parsed:unknown;try{parsed=JSON.parse(value);}catch{throw new Error(`${label} must be valid JSON.`);}if(!parsed||typeof parsed!=='object'||Array.isArray(parsed))throw new Error(`${label} must be a JSON object.`);return parsed as Record<string,unknown>;}
+function TemplateEditor({row,close}:{row?:PushTemplateRow;close:(value:PushTemplateRow|null)=>void}){const save=PushTemplateModel.useSave();const canGroups=useCan(PUSH_GROUP_DIRECTORY_PERMISSIONS).can;const groups=useQuery({queryKey:['push','group-choices'],queryFn:fetchPushGroupChoices,enabled:canGroups,staleTime:60_000});const [name,setName]=useState(row?.name??'');const [category,setCategory]=useState(row?.category??'general');const [priority,setPriority]=useState<PushTemplateRow['priority']>(row?.priority??'normal');const [group,setGroup]=useState(row?.group?String(row.group.id):'');const [title,setTitle]=useState(row?.title_template??'');const [body,setBody]=useState(row?.body_template??'');const [actionUrl,setActionUrl]=useState(row?.action_url??'');const [data,setData]=useState(jsonText(row?.data_template??{}));const [variables,setVariables]=useState(jsonText(row?.variables??{}));const [active,setActive]=useState(row?.is_active??true);const [busy,setBusy]=useState(false);const [error,setError]=useState('');const submit=async()=>{setBusy(true);setError('');try{const dataTemplate=parseJsonObject(data,'Data template');const variableDocs=parseJsonObject(variables,'Variables');if(!title.trim()&&!body.trim()&&!Object.keys(dataTemplate).length)throw new Error('Provide a title, body, or data template.');const saved=await save.mutateAsync({id:row?.id??null,changes:{name:name.trim(),category:category.trim()||'general',priority,group:group?Number(group):null,title_template:title||null,body_template:body||null,action_url:actionUrl||null,data_template:dataTemplate,variables:variableDocs,is_active:active}});toast.success(row?'Push template updated':'Push template created');close(saved);}catch(reason){setError(reason instanceof Error?reason.message:'Template could not be saved.');}finally{setBusy(false);}};return <div className="modal-pad push-editor"><h2 className="modal-title">{row?'Edit':'Create'} push template</h2>{error&&<div className="form-alert" role="alert">{error}</div>}<div className="form-grid"><label className="field col-6"><span className="field-label">Name</span><input className="input" value={name} onChange={e=>setName(e.target.value)}/></label><label className="field col-3"><span className="field-label">Category</span><input className="input" value={category} onChange={e=>setCategory(e.target.value)}/></label><label className="field col-3"><span className="field-label">Priority</span><select className="input" value={priority} onChange={e=>setPriority(e.target.value as PushTemplateRow['priority'])}><option value="low">Low</option><option value="normal">Normal</option><option value="high">High</option></select></label>{canGroups?<label className="field col-12"><span className="field-label">Group</span><select className="input" value={group} onChange={e=>setGroup(e.target.value)}><option value="">System template</option>{groups.data?.map(item=><option key={item.id} value={item.id}>{item.name}</option>)}</select></label>:<div className="field col-12"><span className="field-label">Group</span><div className="input" aria-readonly="true">{relationLabel(row?.group??null,'System template')}</div></div>}<label className="field col-12"><span className="field-label">Title template</span><input className="input" value={title} onChange={e=>setTitle(e.target.value)}/></label><label className="field col-12"><span className="field-label">Body template</span><textarea className="input" rows={4} value={body} onChange={e=>setBody(e.target.value)}/></label><label className="field col-12"><span className="field-label">Action URL template</span><input className="input" value={actionUrl} onChange={e=>setActionUrl(e.target.value)}/></label><label className="field col-6"><span className="field-label">Data template JSON</span><textarea className="input" rows={6} value={data} onChange={e=>setData(e.target.value)}/></label><label className="field col-6"><span className="field-label">Variable documentation JSON</span><textarea className="input" rows={6} value={variables} onChange={e=>setVariables(e.target.value)}/></label><label className="check col-4"><input type="checkbox" checked={active} onChange={e=>setActive(e.target.checked)}/><span>Active</span></label></div><div className="modal-actions"><button className="btn" disabled={busy} onClick={()=>close(null)}>Cancel</button><button className="btn btn-primary" disabled={busy||!name.trim()} onClick={()=>void submit()}>{busy?'Saving…':'Save template'}</button></div></div>;}
+const templateColumns:Column<PushTemplateRow>[]=[{key:'name',label:'Template',sortable:true,hideable:false},{key:'category',label:'Category',sortable:true},{key:'group',label:'Scope',render:r=>relationLabel(r.group,'System')},{key:'priority',label:'Priority',sortable:true,render:r=><Badge tone={r.priority==='high'?'warning':'info'}>{r.priority}</Badge>},{key:'is_active',label:'Active',sortable:true,render:r=><Badge tone={r.is_active?'success':'muted'}>{r.is_active?'active':'inactive'}</Badge>}];
+function TemplateDetail({id,onClose}:{id:number;onClose:()=>void}){const query=PushTemplateModel.useOne(id);const canManage=useCan(PUSH_TEMPLATE_MANAGE_PERMISSIONS).can;if(!query.data)return <div className="modal-pad">{query.isLoading?'Loading template…':'Template unavailable'}<button className="btn" onClick={onClose}>Close</button></div>;const row=query.data;const edit=()=>void modal.open(close=><TemplateEditor row={row} close={async saved=>{close(saved);if(saved)await query.refetch();}}/>,{size:'lg'});return <DetailView title={row.name} subtitle={`${row.category} · ${relationLabel(row.group,'System')}`} icon="bi-file-earmark-richtext" onClose={onClose} sections={[{key:'template',label:'Template',icon:'bi-card-text',render:()=><div className="detail-section">{canManage&&<button className="btn" onClick={edit}>Edit</button>}<FlatRow label="Title">{row.title_template||'—'}</FlatRow><div className="known-card"><h3>Body</h3><p className="pre-wrap">{row.body_template||'—'}</p></div><FlatRow label="Action URL"><code>{row.action_url||'—'}</code></FlatRow><FlatRow label="Data keys">{Object.keys(row.data_template).join(', ')||'—'}</FlatRow><FlatRow label="Variables">{Object.keys(row.variables).join(', ')||'—'}</FlatRow></div>}]} />;}
+export function PushTemplatesPage(){const canManage=useCan(PUSH_TEMPLATE_MANAGE_PERMISSIONS).can;return <ModelTable model={PushTemplateModel} eyebrow="Communications · Push" title="Templates" columns={templateColumns} defaultSort="name" searchable searchPlaceholder="Search name or category" columnChooser persistState persistKey="admin:push:templates" addLabel="Create template" onAdd={canManage?()=>void modal.open(close=><TemplateEditor close={close}/>,{size:'lg'}):undefined} onRowClick={row=>void modal.detail(close=><TemplateDetail id={row.id} onClose={()=>close(null)}/>)}/>;}
+
+function ConfigEditor({row,close}:{row?:PushConfigRow;close:(value:PushConfigRow|null)=>void}){const qc=useQueryClient();const canGroups=useCan(PUSH_GROUP_DIRECTORY_PERMISSIONS).can;const groups=useQuery({queryKey:['push','group-choices'],queryFn:fetchPushGroupChoices,enabled:canGroups,staleTime:60_000});const credentialRef=useRef<HTMLTextAreaElement>(null);const [clearCredential,setClearCredential]=useState(false);const [name,setName]=useState(row?.name??'');const [group,setGroup]=useState(row?.group?String(row.group.id):'');const [sound,setSound]=useState(row?.default_sound??'default');const [active,setActive]=useState(row?.is_active??true);const [testMode,setTestMode]=useState(row?.test_mode??false);const [busy,setBusy]=useState(false);const [error,setError]=useState('');const toggleClear=()=>{if(clearCredential){setClearCredential(false);return;}if(window.confirm('Clear the stored FCM service account on save?'))setClearCredential(true);};const submit=async()=>{setBusy(true);setError('');let credential:FcmCredentialEdit={mode:'untouched'};try{const source=credentialRef.current?.value??'';if(clearCredential)credential={mode:'clear',confirmed:true};else if(source.trim())credential={mode:'replace',value:parseFcmServiceAccount(source)};const saved=await savePushConfigImperative(qc,row?.id??null,{name:name.trim(),group:group?Number(group):null,default_sound:sound.trim()||'default',is_active:active,test_mode:testMode},credential);toast.success(row?'Push configuration updated':'Push configuration created');close(saved);}catch(reason){setError(reason instanceof Error?reason.message:'Configuration could not be saved.');}finally{if(credentialRef.current)credentialRef.current.value='';credential={mode:'untouched'};setBusy(false);}};return <div className="modal-pad push-editor"><h2 className="modal-title">{row?'Edit':'Create'} push configuration</h2><p className="dim">The FCM service account is write-only and never prefills. Leave blank to keep it, enter a validated service-account JSON object to replace it, or explicitly confirm clear.</p>{error&&<div className="form-alert" role="alert">{error}</div>}<div className="form-grid"><label className="field col-8"><span className="field-label">Name</span><input className="input" value={name} onChange={e=>setName(e.target.value)}/></label><label className="field col-4"><span className="field-label">Default sound</span><input className="input" value={sound} onChange={e=>setSound(e.target.value)}/></label>{canGroups?<label className="field col-12"><span className="field-label">Group</span><select className="input" value={group} onChange={e=>setGroup(e.target.value)}><option value="">System default</option>{groups.data?.map(item=><option key={item.id} value={item.id}>{item.name}</option>)}</select></label>:<div className="field col-12"><span className="field-label">Group</span><div className="input" aria-readonly="true">{relationLabel(row?.group??null,'System default')}</div></div>}<label className="field col-12"><span className="field-label">FCM service account JSON</span><textarea ref={credentialRef} className="input" rows={9} autoComplete="off" spellCheck={false} disabled={clearCredential}/><span className="field-help">Required fields: type=service_account, project_id, client_email, and a PEM private_key.</span></label><div className="col-12"><button type="button" className={`btn${clearCredential?' btn-danger':''}`} onClick={toggleClear}>{clearCredential?'Keep stored credential':'Clear stored credential…'}</button></div><label className="check col-4"><input type="checkbox" checked={active} onChange={e=>setActive(e.target.checked)}/><span>Active</span></label><label className="check col-4"><input type="checkbox" checked={testMode} onChange={e=>setTestMode(e.target.checked)}/><span>Test mode</span></label></div><div className="modal-actions"><button className="btn" disabled={busy} onClick={()=>close(null)}>Cancel</button><button className="btn btn-primary" disabled={busy||!name.trim()} onClick={()=>void submit()}>{busy?'Saving…':'Save configuration'}</button></div></div>;}
+const configColumns:Column<PushConfigRow>[]=[{key:'name',label:'Configuration',sortable:true,hideable:false},{key:'group',label:'Scope',render:r=>relationLabel(r.group,'System default')},{key:'fcm_project_id',label:'FCM project',render:r=>r.fcm_project_id||'Not reported'},{key:'test_mode',label:'Test mode',sortable:true,render:r=><Badge tone={r.test_mode?'warning':'muted'}>{r.test_mode?'yes':'no'}</Badge>},{key:'is_active',label:'Active',sortable:true,render:r=><Badge tone={r.is_active?'success':'muted'}>{r.is_active?'active':'inactive'}</Badge>}];
+function ConfigDetail({id,onClose}:{id:number;onClose:()=>void}){const query=PushConfigModel.useOne(id);const canManage=useCan(PUSH_CONFIG_MANAGE_PERMISSIONS).can;const canTest=useCan(PUSH_CONFIG_TEST_PERMISSIONS).can;if(!query.data)return <div className="modal-pad">{query.isLoading?'Loading configuration…':'Configuration unavailable'}<button className="btn" onClick={onClose}>Close</button></div>;const row=query.data;const edit=()=>void modal.open(close=><ConfigEditor row={row} close={async saved=>{close(saved);if(saved)await query.refetch();}}/>,{size:'lg'});const test=async()=>{try{const result=await testPushConfigConnection(id);toast.success(result.message);}catch{toast.error('FCM connection test failed. Review the stored service account and server logs.');}};return <DetailView title={row.name} subtitle={`${relationLabel(row.group,'System default')} · ${row.fcm_project_id||'FCM project unavailable'}`} icon="bi-broadcast-pin" onClose={onClose} sections={[{key:'configuration',label:'Configuration',icon:'bi-sliders',render:()=><div className="detail-section"><div className="storage-action-row">{canManage&&<button className="btn" onClick={edit}>Edit</button>}{canTest&&<button className="btn" onClick={()=>void test()}>Test stored credentials</button>}</div><FlatRow label="FCM project">{row.fcm_project_id||'—'}</FlatRow><FlatRow label="Default sound">{row.default_sound}</FlatRow><FlatRow label="Active">{row.is_active?'Yes':'No'}</FlatRow><FlatRow label="Test mode">{row.test_mode?'Yes — sends are faked':'No'}</FlatRow><p className="dim">The connection test uses the backend's dummy registration token to validate credentials. This portal never accepts a device token and never sends a caller test notification.</p></div>}]} />;}
+export function PushConfigsPage(){const canManage=useCan(PUSH_CONFIG_MANAGE_PERMISSIONS).can;return <ModelTable model={PushConfigModel} eyebrow="Communications · Push" title="Configuration" columns={configColumns} defaultSort="name" searchable searchPlaceholder="Search configuration names" columnChooser persistState persistKey="admin:push:configs" addLabel="Create configuration" onAdd={canManage?()=>void modal.open(close=><ConfigEditor close={close}/>,{size:'lg'}):undefined} onRowClick={row=>void modal.detail(close=><ConfigDetail id={row.id} onClose={()=>close(null)}/>)}/>;}
+
+export function PushPage(){const [searchParams,setSearchParams]=useSearchParams();const devices=useCan(PUSH_DEVICE_VIEW_PERMISSIONS);const deliveries=useCan(PUSH_DELIVERY_VIEW_PERMISSIONS);const templates=useCan(PUSH_TEMPLATE_VIEW_PERMISSIONS);const config=useCan(PUSH_CONFIG_VIEW_PERMISSIONS);const metrics=useCan(PUSH_METRICS_PERMISSIONS);if(devices.isLoading||deliveries.isLoading||templates.isLoading||config.isLoading||metrics.isLoading)return <div className="panel panel-pad dim">Loading Push permissions…</div>;const items=[{key:'stats',label:'Your stats',panel:<PushStatsPanel/>},...(metrics.can?[{key:'metrics',label:'Global metrics',panel:<PushMetricsPanel/>}]:[]),...(devices.can?[{key:'devices',label:'Devices',panel:<PushDevicesPage/>}]:[]),...(deliveries.can?[{key:'deliveries',label:'Deliveries',panel:<PushDeliveriesPage/>}]:[]),...(templates.can?[{key:'templates',label:'Templates',panel:<PushTemplatesPage/>}]:[]),...(config.can?[{key:'config',label:'Config',panel:<PushConfigsPage/>}]:[])];const requested=searchParams.get('push_surface')??'stats';const select=(key:string)=>setSearchParams({push_surface:key},{replace:true});return <div className="push-page"><div className="push-heading"><p className="eyebrow">Communications</p><h1>Push Notifications</h1><p className="dim">One global, no-group control plane. Each tab has an independent backend-derived gate; only the active authorized tab mounts and fetches.</p></div><Tabs ariaLabel="Push administration areas" variant="underline-all" items={items} activeKey={requested} onActiveKeyChange={select}/></div>;}

package/src/admin/messaging/push/api.ts

@@ -0,0 +1,17 @@
+import type { QueryClient } from '@tanstack/react-query';
+import { mojoCall, mojoList } from '../../../client';
+import { PushConfigModel, sanitizePushConfigRow, type PushConfigRow, type PushRelation } from './models';
+
+export interface PushStats { total_sent:number; total_failed:number; total_pending:number; registered_devices:number; enabled_devices:number }
+export const PUSH_GROUP_CHOICE_LIMIT=100;
+export type FcmCredentialEdit={mode:'untouched'}|{mode:'replace';value:Record<string,unknown>}|{mode:'clear';confirmed:true};
+
+export function sanitizePushStats(value:unknown):PushStats{const row=value&&typeof value==='object'?value as Record<string,unknown>:{};const count=(key:string)=>Math.max(0,Number.isFinite(Number(row[key]))?Number(row[key]):0);return {total_sent:count('total_sent'),total_failed:count('total_failed'),total_pending:count('total_pending'),registered_devices:count('registered_devices'),enabled_devices:count('enabled_devices')};}
+export async function fetchPushStats():Promise<PushStats>{const response=await mojoCall('/api/account/devices/push/stats');return sanitizePushStats(response.data);}
+
+export function validateFcmServiceAccount(value:unknown):Record<string,unknown>{if(!value||typeof value!=='object'||Array.isArray(value))throw new Error('Service account must be a JSON object.');const row=value as Record<string,unknown>;if(row.type!=='service_account')throw new Error('Service account type must be "service_account".');for(const key of ['project_id','client_email','private_key'])if(typeof row[key]!=='string'||!row[key])throw new Error(`Service account is missing ${key}.`);if(!(row.private_key as string).includes('BEGIN PRIVATE KEY'))throw new Error('Service account private_key is not a PEM private key.');return {...row};}
+export function parseFcmServiceAccount(source:string):Record<string,unknown>{let value:unknown;try{value=JSON.parse(source);}catch{throw new Error('Service account must be valid JSON.');}return validateFcmServiceAccount(value);}
+export function buildPushConfigPayload(scalars:Record<string,unknown>,credential:FcmCredentialEdit):Record<string,unknown>{const body={...scalars};if(credential.mode==='clear')body.fcm_service_account=null;if(credential.mode==='replace')body.fcm_service_account=validateFcmServiceAccount(credential.value);return body;}
+export async function savePushConfigImperative(qc:QueryClient,id:number|null,scalars:Record<string,unknown>,credential:FcmCredentialEdit):Promise<PushConfigRow>{const payload=buildPushConfigPayload(scalars,credential);const path=id==null?PushConfigModel.endpoint:`${PushConfigModel.endpoint}/${id}`;try{const response=await mojoCall(path,{method:'POST',body:payload});const row=sanitizePushConfigRow(response.data as PushConfigRow);qc.setQueryData(PushConfigModel.keys.one(row.id),row);await qc.invalidateQueries({queryKey:PushConfigModel.keys.root});return row;}finally{delete payload.fcm_service_account;}}
+export async function testPushConfigConnection(id:number):Promise<{success:boolean;message:string;test_mode:boolean;note:string|null;fcm_version:string|null}>{const response=await mojoCall(`${PushConfigModel.endpoint}/${id}/test`,{method:'POST',body:{}});const row=(response.data??response) as Record<string,unknown>;return {success:row.success!==false,message:typeof row.message==='string'?row.message.slice(0,500):'FCM connection test completed.',test_mode:Boolean(row.test_mode),note:typeof row.note==='string'?row.note.slice(0,500):null,fcm_version:typeof row.fcm_version==='string'?row.fcm_version.slice(0,30):null};}
+export async function fetchPushGroupChoices():Promise<PushRelation[]>{const response=await mojoList<Record<string,unknown>>('/api/group',{graph:'basic',sort:'name',start:0,size:PUSH_GROUP_CHOICE_LIMIT});return response.rows.flatMap(row=>{const id=Number(row.id);return Number.isFinite(id)&&typeof row.name==='string'?[{id,name:row.name.slice(0,120)}]:[];});}

package/src/admin/messaging/push/index.ts

@@ -0,0 +1,9 @@
+import type { AdminSection } from '../../index';
+import { PushPage } from './PushPage';
+import { PUSH_ADMIN_PERMISSIONS } from './models';
+
+export * from './models';
+export * from './api';
+export * from './PushPage';
+
+export const PUSH_ADMIN_SECTION:AdminSection={id:'push',basePath:'push',title:'Push Notifications',icon:'bi-bell',navigationGroup:'communications',permissions:PUSH_ADMIN_PERMISSIONS,routes:[{path:'',label:'Push Notifications',component:PushPage,permissions:PUSH_ADMIN_PERMISSIONS}]};

package/src/admin/messaging/push/models.ts

@@ -0,0 +1,43 @@
+import { defineModel, registerNonFilterParams, type Params } from '../../../client';
+
+registerNonFilterParams('push_surface');
+
+export const PUSH_DEVICE_VIEW_PERMISSIONS = ['sys.view_devices', 'sys.manage_devices', 'sys.comms', 'sys.owner', 'sys.manage_users'];
+export const PUSH_DEVICE_MANAGE_PERMISSIONS = ['sys.manage_devices', 'sys.comms', 'sys.owner'];
+export const PUSH_DELIVERY_VIEW_PERMISSIONS = ['sys.view_notifications', 'sys.manage_notifications', 'sys.comms', 'sys.owner', 'sys.manage_users'];
+export const PUSH_DELIVERY_MANAGE_PERMISSIONS = ['sys.manage_notifications', 'sys.comms'];
+export const PUSH_TEMPLATE_VIEW_PERMISSIONS = ['sys.manage_notifications', 'sys.manage_groups', 'sys.comms', 'sys.owner', 'sys.manage_users'];
+export const PUSH_TEMPLATE_MANAGE_PERMISSIONS = ['sys.manage_notifications', 'sys.manage_groups', 'sys.comms'];
+export const PUSH_CONFIG_VIEW_PERMISSIONS = ['sys.manage_push_config', 'sys.manage_groups', 'sys.comms'];
+export const PUSH_CONFIG_MANAGE_PERMISSIONS = PUSH_CONFIG_VIEW_PERMISSIONS;
+export const PUSH_CONFIG_TEST_PERMISSIONS = ['sys.manage_push_config', 'sys.comms'];
+export const PUSH_METRICS_PERMISSIONS = ['sys.view_metrics', 'sys.metrics'];
+export const PUSH_GROUP_DIRECTORY_PERMISSIONS = ['sys.view_groups', 'sys.manage_groups', 'sys.manage_group', 'sys.groups'];
+export const PUSH_ADMIN_PERMISSIONS = [...new Set([
+    ...PUSH_DEVICE_VIEW_PERMISSIONS, ...PUSH_DELIVERY_VIEW_PERMISSIONS,
+    ...PUSH_TEMPLATE_VIEW_PERMISSIONS, ...PUSH_CONFIG_VIEW_PERMISSIONS,
+    ...PUSH_METRICS_PERMISSIONS,
+])];
+
+export interface PushRelation { id:number; name?:string; display_name?:string }
+export interface PushDeviceRow { id:number; device_id:string; platform:'ios'|'android'|'web'|string; device_name:string; app_version:string; os_version:string; push_enabled:boolean; push_preferences:Record<string,boolean>; last_seen:number; user:PushRelation|null }
+export interface PushDeliveryRow { id:number; created:number; title:string|null; body:string|null; category:string; action_url:string|null; status:'pending'|'sent'|'delivered'|'failed'|string; sent_at:number|null; delivered_at:number|null; error_message:string|null; user:PushRelation|null; device:PushRelation|null }
+export interface PushTemplateRow { id:number; name:string; title_template:string|null; body_template:string|null; action_url:string|null; data_template:Record<string,unknown>; category:string; priority:'low'|'normal'|'high'; variables:Record<string,unknown>; is_active:boolean; group:PushRelation|null }
+export interface PushConfigRow { id:number; created:number; modified:number; name:string; test_mode:boolean; default_sound:string; is_active:boolean; fcm_project_id:string|null; group:PushRelation|null }
+
+const asText=(value:unknown,max=2000):string|null=>typeof value==='string'?value.slice(0,max):null;
+const asEpoch=(value:unknown):number|null=>typeof value==='number'&&Number.isFinite(value)?value:null;
+function relation(value:unknown):PushRelation|null { if(!value||typeof value!=='object')return null;const row=value as Record<string,unknown>;const id=Number(row.id);if(!Number.isFinite(id))return null;return {id,...(typeof row.name==='string'?{name:row.name.slice(0,120)}:{}),...(typeof row.display_name==='string'?{display_name:row.display_name.slice(0,120)}:{})}; }
+function safeObject(value:unknown,limit=50):Record<string,unknown>{if(!value||typeof value!=='object'||Array.isArray(value))return {};const out:Record<string,unknown>={};for(const [key,item] of Object.entries(value).slice(0,limit)){if(typeof item==='string')out[key.slice(0,100)]=item.slice(0,2000);else if(typeof item==='number'||typeof item==='boolean'||item==null)out[key.slice(0,100)]=item;}return out;}
+export function sanitizePushDeviceRow(input:PushDeviceRow):PushDeviceRow {const row=input as unknown as Record<string,unknown>;const preferences=safeObject(row.push_preferences);return {id:Number(row.id),device_id:String(row.device_id??'').slice(0,255),platform:String(row.platform??''),device_name:String(row.device_name??'').slice(0,100),app_version:String(row.app_version??'').slice(0,50),os_version:String(row.os_version??'').slice(0,50),push_enabled:Boolean(row.push_enabled),push_preferences:Object.fromEntries(Object.entries(preferences).filter((entry):entry is [string,boolean]=>typeof entry[1]==='boolean')),last_seen:asEpoch(row.last_seen)??0,user:relation(row.user)};}
+export function sanitizePushDeliveryRow(input:PushDeliveryRow):PushDeliveryRow {const row=input as unknown as Record<string,unknown>;return {id:Number(row.id),created:asEpoch(row.created)??0,title:asText(row.title,200),body:asText(row.body,10_000),category:String(row.category??'').slice(0,50),action_url:asText(row.action_url,2000),status:String(row.status??''),sent_at:asEpoch(row.sent_at),delivered_at:asEpoch(row.delivered_at),error_message:asText(row.error_message,2000),user:relation(row.user),device:relation(row.device)};}
+export function sanitizePushTemplateRow(input:PushTemplateRow):PushTemplateRow {const row=input as unknown as Record<string,unknown>;const priority=['low','normal','high'].includes(String(row.priority))?String(row.priority) as PushTemplateRow['priority']:'normal';return {id:Number(row.id),name:String(row.name??'').slice(0,100),title_template:asText(row.title_template,200),body_template:asText(row.body_template,10_000),action_url:asText(row.action_url,2000),data_template:safeObject(row.data_template),category:String(row.category??'general').slice(0,50),priority,variables:safeObject(row.variables),is_active:Boolean(row.is_active),group:relation(row.group)};}
+export function sanitizePushConfigRow(input:PushConfigRow):PushConfigRow {const row=input as unknown as Record<string,unknown>;return {id:Number(row.id),created:asEpoch(row.created)??0,modified:asEpoch(row.modified)??0,name:String(row.name??'').slice(0,100),test_mode:Boolean(row.test_mode),default_sound:String(row.default_sound??'default').slice(0,50),is_active:Boolean(row.is_active),fcm_project_id:asText(row.fcm_project_id,200),group:relation(row.group)};}
+
+const BASE_KEYS=new Set(['start','size','search']);
+function listParams(params:Params,graph:'basic'|'default',filters:readonly string[],sorts:readonly string[],defaultSort:string,dateRange=false):Params{const out:Params={graph,start:params.start??0,size:params.size??25,sort:defaultSort};for(const key of BASE_KEYS)if(params[key]!=null&&params[key]!=='')out[key]=params[key];for(const key of filters)if(params[key]!=null&&params[key]!=='')out[key]=params[key];const sort=typeof params.sort==='string'?params.sort:'';if(sorts.includes(sort.replace(/^-/,'')))out.sort=sort;if(dateRange&&(params.dr_start||params.dr_end)){out.dr_field='created';if(params.dr_start)out.dr_start=params.dr_start;if(params.dr_end)out.dr_end=params.dr_end;}return out;}
+
+export const PushDeviceModel=defineModel<PushDeviceRow>({name:'push-device',endpoint:'/api/account/devices/push',permissions:{view:PUSH_DEVICE_VIEW_PERMISSIONS,manage:PUSH_DEVICE_MANAGE_PERMISSIONS},normalizeListParams:p=>listParams(p,'default',['platform','push_enabled','is_active','user'],['last_seen','platform','device_name','push_enabled'],'-last_seen'),sanitizeRow:sanitizePushDeviceRow});
+export const PushDeliveryModel=defineModel<PushDeliveryRow>({name:'push-delivery',endpoint:'/api/account/devices/push/deliveries',permissions:{view:PUSH_DELIVERY_VIEW_PERMISSIONS,manage:PUSH_DELIVERY_MANAGE_PERMISSIONS},normalizeListParams:p=>listParams(p,'default',['status','category','user','device'],['created','status','category','sent_at','delivered_at'],'-created',true),sanitizeRow:sanitizePushDeliveryRow});
+export const PushTemplateModel=defineModel<PushTemplateRow>({name:'push-template',endpoint:'/api/account/devices/push/templates',permissions:{view:PUSH_TEMPLATE_VIEW_PERMISSIONS,manage:PUSH_TEMPLATE_MANAGE_PERMISSIONS},normalizeListParams:p=>listParams(p,'default',['category','priority','is_active','group'],['name','category','priority','is_active'],'name'),sanitizeRow:sanitizePushTemplateRow});
+export const PushConfigModel=defineModel<PushConfigRow>({name:'push-config',endpoint:'/api/account/devices/push/config',permissions:{view:PUSH_CONFIG_VIEW_PERMISSIONS,manage:PUSH_CONFIG_MANAGE_PERMISSIONS},normalizeListParams:p=>listParams(p,'default',['test_mode','is_active','group'],['name','test_mode','is_active','created','modified'],'name'),sanitizeRow:sanitizePushConfigRow});

package/src/admin/messaging/sanitize.ts

@@ -0,0 +1,44 @@
+import type { DomainActionResult, DomainAuditResult, EmailDomainRow, EmailTemplateRow, MailboxRow, PublicMessageRow, SentMessageRow } from './models';
+
+const MAX_TEXT = 4000;
+const object = (value: unknown): Record<string, unknown> => value && typeof value === 'object' && !Array.isArray(value) ? value as Record<string, unknown> : {};
+const text = (value: unknown, max = MAX_TEXT): string => typeof value === 'string' ? value.slice(0, max) : '';
+const nullableText = (value: unknown, max = MAX_TEXT): string | null => value == null ? null : text(value, max);
+const number = (value: unknown): number => Number.isFinite(Number(value)) ? Number(value) : 0;
+const relation = (value: unknown) => {
+    if (typeof value === 'number') return value;
+    const row = object(value); if (!Number.isInteger(row.id)) return null;
+    return { id: Number(row.id), ...(typeof row.name === 'string' ? { name: text(row.name, 200) } : {}), ...(typeof row.email === 'string' ? { email: text(row.email, 320) } : {}) };
+};
+const strings = (value: unknown, maxItems = 50, max = 1000): string[] => Array.isArray(value) ? value.slice(0, maxItems).map((item) => text(item, max)).filter(Boolean) : [];
+const redactedOptionalText=(value:unknown,max=MAX_TEXT):string=>{const projected=text(value,max);return projected?redactMessagingError(projected):'';};
+
+function safeMask(value:unknown):string|null{const masked=nullableText(value,64);if(!masked)return null;return /^(?:\*{1,60}|•{1,60})[^*•\s]{0,4}$/.test(masked)?masked:'Configured';}
+export function sanitizeEmailDomainRow(value: EmailDomainRow): EmailDomainRow { const raw = object(value); const status=String(raw.status), dnsMode=String(raw.dns_mode); return { id: number(raw.id), created: number(raw.created), modified: number(raw.modified), name: text(raw.name, 253), region: text(raw.region, 64), status: (['pending','verified','ready','missing'].includes(status)?status:'unknown') as EmailDomainRow['status'], receiving_enabled: Boolean(raw.receiving_enabled), s3_inbound_bucket: nullableText(raw.s3_inbound_bucket, 255), s3_inbound_prefix: text(raw.s3_inbound_prefix, 255), dns_mode: (['manual','route53','godaddy'].includes(dnsMode)?dnsMode:'unknown') as EmailDomainRow['dns_mode'], aws_key_masked: safeMask(raw.aws_key_masked), aws_secret_masked: safeMask(raw.aws_secret_masked), sns_topic_bounce_arn: nullableText(raw.sns_topic_bounce_arn, 512), sns_topic_complaint_arn: nullableText(raw.sns_topic_complaint_arn, 512), sns_topic_delivery_arn: nullableText(raw.sns_topic_delivery_arn, 512), sns_topic_inbound_arn: nullableText(raw.sns_topic_inbound_arn, 512) }; }
+export function sanitizeMailboxRow(value: MailboxRow): MailboxRow { const raw = object(value); return { id: number(raw.id), created: number(raw.created), modified: number(raw.modified), email: text(raw.email, 320), domain: relation(raw.domain), allow_inbound: Boolean(raw.allow_inbound), allow_outbound: Boolean(raw.allow_outbound), async_handler: nullableText(raw.async_handler, 255), is_system_default: Boolean(raw.is_system_default), is_domain_default: Boolean(raw.is_domain_default) }; }
+export function sanitizeSentMessageRow(value: SentMessageRow): SentMessageRow { const raw = object(value); const reason=nullableText(raw.status_reason,1000); return { id: number(raw.id), created: number(raw.created), modified: number(raw.modified), mailbox: relation(raw.mailbox), to_addresses: strings(raw.to_addresses, 50, 320), cc_addresses: strings(raw.cc_addresses, 50, 320), bcc_addresses: strings(raw.bcc_addresses, 50, 320), subject: text(raw.subject, 998), status: (['queued','sending','delivered','bounced','complained','failed','unknown'].includes(String(raw.status)) ? String(raw.status) : 'unknown') as SentMessageRow['status'], ses_message_id: nullableText(raw.ses_message_id, 255), status_reason: reason?redactMessagingError(reason):null, body_text: nullableText(raw.body_text, 100_000), body_html: nullableText(raw.body_html, 200_000) }; }
+export function sanitizeTemplateRow(value: EmailTemplateRow): EmailTemplateRow { const raw = object(value); return { id: number(raw.id), created: number(raw.created), modified: number(raw.modified), name: text(raw.name, 255), subject_template: text(raw.subject_template, 998), html_template: nullableText(raw.html_template, 200_000), text_template: nullableText(raw.text_template, 100_000) }; }
+const PUBLIC_META = new Set(['company','category','severity','referrer','landing_page','utm_source','utm_medium','utm_campaign','utm_term','utm_content']);
+export function sanitizePublicMessageRow(value: PublicMessageRow): PublicMessageRow { const raw = object(value); const source = object(raw.metadata); const metadata: Record<string,string> = {}; for (const [key, val] of Object.entries(source)) if (PUBLIC_META.has(key) && typeof val === 'string') metadata[key] = text(val, 500); return { id: number(raw.id), created: number(raw.created), modified: number(raw.modified), kind: text(raw.kind, 40), status: text(raw.status, 40), name: text(raw.name, 255), email: text(raw.email, 320), subject: text(raw.subject, 998), group: relation(raw.group), ...(typeof raw.message === 'string' ? { message: text(raw.message, 50_000) } : {}), ...(Object.keys(metadata).length ? { metadata } : {}), metadata_withheld: Object.keys(source).some((key) => !PUBLIC_META.has(key)), ip_address: nullableText(raw.ip_address, 64), user_agent: nullableText(raw.user_agent, 1000) }; }
+
+const CHECKS = new Set(['ses_production_access','ses_verified','dkim_verified','notification_topics_ok','receiving_rule_s3_ok','receiving_rule_sns_ok','s3_bucket_exists','sns_topics_exist','sns_subscriptions_confirmed']);
+export function sanitizeAuditResult(value: unknown): DomainAuditResult { const raw = object(value); const checks: Record<string,boolean> = {}; for (const [key,val] of Object.entries(object(raw.checks))) if (CHECKS.has(key) && typeof val === 'boolean') checks[key] = val; const items = Array.isArray(raw.items) ? raw.items.slice(0, 50).map((v) => object(v)).map((v) => ({ resource: redactedOptionalText(v.resource,100), status: redactedOptionalText(v.status,100) })).filter((v) => v.resource || v.status) : []; const recommendations=Array.isArray(raw.recommendations)?raw.recommendations.slice(0,25).map((entry)=>object(entry)).map((entry)=>({resource:redactedOptionalText(entry.resource,100),severity:redactedOptionalText(entry.severity,40),action:redactedOptionalText(entry.action,500),explanation:redactedOptionalText(entry.explanation,1000)})).filter(entry=>entry.resource&&entry.severity&&entry.action&&entry.explanation):[]; return { domain: text(raw.domain, 253), region: text(raw.region, 64), status: text(raw.status, 40), audit_pass: Boolean(raw.audit_pass), checks, items, recommendations }; }
+function records(value: unknown) { return Array.isArray(value) ? value.slice(0, 100).flatMap((v) => { const r=object(v); const type=text(r.type,16), name=text(r.name,253); const values = Array.isArray(r.record_values) ? strings(r.record_values, 20, 4000) : [text(r.value,4000)].filter(Boolean); return values.map((item) => ({ type, name, value:item, ttl: Math.min(86400, Math.max(1,number(r.ttl)||300)) })); }) : []; }
+export function sanitizeDomainActionResult(value: unknown): DomainActionResult { const raw=object(value); const appliedRaw=object(raw.applied); const applied = Number.isInteger(raw.applied) ? Number(raw.applied) : Number.isInteger(appliedRaw.applied) ? Number(appliedRaw.applied) : undefined; const topic_arns: Record<string,string> = {}; for (const key of ['bounce','complaint','delivery','inbound']) { const val=object(raw.topic_arns)[key]; if (typeof val === 'string') topic_arns[key]=text(val,512); } return { domain:text(raw.domain,253), region:text(raw.region,64), ...(typeof raw.status==='string'?{status:text(raw.status,40)}:{}), dns_records:records(raw.dns_records), dkim_tokens:strings(raw.dkim_tokens,20,255), notes:strings(raw.notes,20,500), ...(typeof raw.provider==='string'?{provider:text(raw.provider,64)}:{}), ...(applied!==undefined?{applied}:{}), ...(Object.keys(topic_arns).length?{topic_arns}:{}), ...(typeof raw.receipt_rule==='string'?{receipt_rule:text(raw.receipt_rule,255)}:{}), ...(typeof raw.rule_set==='string'?{rule_set:text(raw.rule_set,255)}:{}) }; }
+
+const SECRET_KEY='(?:aws[_-]?(?:secret[_-]?access[_-]?key|access[_-]?key(?:[_-]?id)?)|x-amz-security-token|godaddy[_-]?(?:key|secret)|api[_-]?key|access[_-]?token|refresh[_-]?token|secret|token|password|credential)';
+export function redactMessagingError(error: unknown): string {
+    const source=error instanceof Error?error.message:typeof error==='string'?error:'Operation failed';
+    const keyed=new RegExp(`(["']?${SECRET_KEY}["']?\\s*[:=]\\s*)(?:"[^"]*"|'[^']*'|[^\\s,;}&]+)`,'gi');
+    const query=new RegExp(`([?&])(${SECRET_KEY})=[^&#\\s]*`,'gi');
+    const clean=source
+        .replace(/([a-z][a-z0-9+.-]*:\/\/)[^\s/@:]+:[^\s/@]+@/gi,'$1[redacted]@')
+        .replace(/\b(authorization|proxy-authorization)\s*:\s*(?:bearer|basic)\s+[^\s,;]+/gi,'$1: [redacted]')
+        .replace(/\bbearer\s+[A-Za-z0-9._~+/=-]+/gi,'Bearer [redacted]')
+        .replace(query,'$1$2=[redacted]')
+        .replace(keyed,'$1[redacted]')
+        .replace(/(?:AKIA|ASIA)[0-9A-Z]{16}/g,'[redacted]');
+    return clean.slice(0,1000)||'Operation failed';
+}
+export function isOneMailbox(value: string): boolean { return /^[^\s@,;&#?]+@[^\s@,;&#?]+\.[^\s@,;&#?]+$/.test(value.trim()); }
+export function publicMessageMailto(row: PublicMessageRow): string | null { if (!isOneMailbox(row.email)) return null; const params = new URLSearchParams({ subject: `Re: ${row.subject}` }); return `mailto:${encodeURIComponent(row.email.trim())}?${params.toString()}`; }