diff --git a/specs/013-mail-rules/spec.md b/specs/013-mail-rules/spec.md
new file mode 100644
index 0000000..942ae00
--- /dev/null
+++ b/specs/013-mail-rules/spec.md
@@ -0,0 +1,48 @@
+# Visual server-side mail rules
+
+**Status**: Prototype proposed upstream
+**Proposal**: https://ideas.tb.pro/p/visual-server-side-mail-rules-using-jmap-sieve
+**Issue**: https://github.com/thunderbird/stormbox/issues/128
+
+## Goal
+
+Stormbox shall let a signed-in user build ordered mail rules visually or edit their complete Sieve source and run them on the mail server through JMAP for Sieve (RFC 9661). The feature remains fully browser-owned and does not add a Stormbox application backend.
+
+## Requirements
+
+| ID | Requirement |
+|---|---|
+| MR-1 | When the account advertises `urn:ietf:params:jmap:sieve`, the account menu shall offer a Mail Rules editor. When the capability is absent, the editor shall explain that server-side rules are unavailable. |
+| MR-2 | The editor shall support ordered, enabled/disabled rules; recursively nested all/any/not condition groups; From, To, To/Cc, Subject, and custom-header conditions; and exact, contains, or wildcard matching. |
+| MR-3 | The editor shall support move, mark read, star, forward a copy, discard, and stop-processing actions, exposing only actions supported by the account's advertised Sieve extensions. |
+| MR-4 | The server-stored Sieve source shall be authoritative. Stormbox shall parse scripts into a source-ranged syntax tree and project every completely representable script into the visual rule model. UI-only identifiers may be regenerated and shall not duplicate the executable rule model in metadata. The complete source shall remain available in a Source editor. |
+| MR-5 | Every save shall use the durable mutation outbox, upload the generated or directly edited script, call `SieveScript/validate`, and activate it only after validation succeeds. |
+| MR-6 | A save shall use the last observed `SieveScript` state and reject a concurrent server change instead of overwriting it. |
+| MR-7 | The active script shall be edited in place. If it is completely representable, the user may switch between Visual and Source editors. If it is not representable, Stormbox shall open its complete source, explain the unsupported construct, and only allow switching to Visual after the edited source becomes representable. |
+| MR-8 | Move actions shall use the RFC 9042 `:mailboxid` extension when supported, retaining a readable hierarchy path as the fallback mailbox name. |
+| MR-9 | Invalid rule data, unsupported actions, server validation failures, and server conflicts shall remain visible and recoverable in the editor. Controls shall be disabled while a save is in flight. |
+| MR-10 | The editor shall be keyboard accessible, trap focus while open, and confirm before discarding unsaved changes. |
+| MR-11 | Stormbox shall only regenerate a script from the visual model when every required extension and executable construct is within the visual editor's semantics-preserving subset. Direct Source edits may use the server's full Sieve surface and remain subject to server validation. |
+
+## Initial scope
+
+- Server-side filtering of newly delivered mail.
+- One active script edited visually or as source at a time; JMAP may retain other scripts and permits at most one active script.
+- A source parser, deliberately limited visual projection, and Sieve emitter.
+- Compatible existing scripts can be visualized and edited in place.
+- Unsupported syntax falls back to the complete editable source with an exact visual-projection error.
+- Visual-to-source switching is always available; source-to-visual switching requires complete projection.
+
+## Non-goals
+
+- Visually representing every Sieve extension or control-flow construct.
+- Rich source-editor features such as syntax highlighting, completion, and inline diagnostics.
+- Retroactively applying rules to existing messages.
+- Shared-account rule management.
+- A Cloudflare Worker rule engine; the deployment bridge only adapts browser CORS and WebSocket authentication.
+
+## Verification
+
+- Unit tests cover syntax parsing, visual projection, nested grouping, escaping, capability checks, source round-tripping, conflict handling, server validation, and outbox integration.
+- Component tests cover loading, nested editing, Visual/Source switching, raw-source fallback, save locking, and discard confirmation.
+- Local-stack Playwright coverage asserts the visible editor result, durable mutation completion, and the active script directly through JMAP in Chromium and Firefox.
diff --git a/src/App.vue b/src/App.vue
index ad679cd..e8587dd 100644
--- a/src/App.vue
+++ b/src/App.vue
@@ -55,6 +55,7 @@ import AppDrawer from './components/AppDrawer.vue';
 import TopNavMenu from './components/TopNavMenu.vue';
 import AccountAvatarMenu from './components/AccountAvatarMenu.vue';
 import WelcomeModal from './components/WelcomeModal.vue';
+import MailRulesDialog from './components/MailRulesDialog.vue';
 import SpotlightOverlay from './components/SpotlightOverlay.vue';
 import FeatureBeaconLayer from './components/FeatureBeaconLayer.vue';
 import FeatureBeaconMenu from './components/FeatureBeaconMenu.vue';
@@ -155,6 +156,7 @@ const folderListWidth = ref(DEFAULT_COLUMN_WIDTHS.folderList);
 const folderListHidden = ref(false);
 const showWelcomeModal = ref(false);
 const showSettingsDialog = ref(false);
+const showMailRules = ref(false);
 const spotlight = useFeatureSpotlight(() => createSpotlightScripts({
   composeStore,
   currentSpace: () => space.value,
@@ -184,11 +186,12 @@ const shortcutsEnabled = computed(() =>
   authStore.status === AUTH_STATE.CONNECTED
   && !showWelcomeModal.value
   && !showSettingsDialog.value
+  && !showMailRules.value
   && beaconStore.openId == null,
 );
 // Beacon dots would sit on top of these dialogs' scrims.
 const showFeatureBeacons = computed(() =>
-  !showWelcomeModal.value && !showSettingsDialog.value);
+  !showWelcomeModal.value && !showSettingsDialog.value && !showMailRules.value);
 const windowWidth = ref(typeof window === 'undefined' ? COMPACT_READING_WIDTH : window.innerWidth);
 const wantsMessageDetailView = computed(() => mailStore.selectedMessageId != null);
 // Multi-select never opens the message view: the bulk actions live in
@@ -729,7 +732,9 @@ function unwatchSystemTheme() {
           @open-settings="showSettingsDialog = true"
         />
         <FeatureBeaconMenu @reveal="revealBeacon" />
-        <AccountAvatarMenu />
+        <AccountAvatarMenu
+          @show-mail-rules="showMailRules = true"
+        />
       </div>
     </header>
 
@@ -819,6 +824,7 @@ function unwatchSystemTheme() {
       singular-item-label="message"
       :total="mailStore.bulkOperation.total"
     />
+    <MailRulesDialog v-if="showMailRules" @close="showMailRules = false" />
     <WelcomeModal
       v-if="showWelcomeModal"
       :active-spotlight="activeSpotlight"
diff --git a/src/components/AccountAvatarMenu.vue b/src/components/AccountAvatarMenu.vue
index 7e712b9..e27533c 100644
--- a/src/components/AccountAvatarMenu.vue
+++ b/src/components/AccountAvatarMenu.vue
@@ -1,13 +1,18 @@
 <script setup lang="ts">
 import { computed, ref } from 'vue';
 import { onClickOutside } from '@vueuse/core';
-import { LogOut, Settings } from '@lucide/vue';
+import {
+  ListFilter, LogOut, Settings,
+} from '@lucide/vue';
 
 import { useAuthStore } from '../stores/auth-store';
 import { ACCOUNTS_URL } from '../defines';
 import { senderAvatarStyle, senderInitials } from '../utils/sender-avatar';
 
 const authStore = useAuthStore();
+const emit = defineEmits<{
+  (event: 'show-mail-rules'): void;
+}>();
 
 const detailsEl = ref<HTMLDetailsElement | null>(null);
 
@@ -26,6 +31,10 @@ function onLogout() {
   if (detailsEl.value) detailsEl.value.open = false;
   authStore.logout();
 }
+function onShowMailRules() {
+  if (detailsEl.value) detailsEl.value.open = false;
+  emit('show-mail-rules');
+}
 </script>
 
 <template>
@@ -42,6 +51,10 @@ function onLogout() {
         </span>
         <span class="account-menu__email">{{ identityLabel }}</span>
       </div>
+      <button class="account-menu__item" type="button" role="menuitem" @click="onShowMailRules">
+        <ListFilter :size="16" :stroke-width="1.75" aria-hidden="true" />
+        <span>Mail Rules</span>
+      </button>
       <a class="account-menu__item" :href="ACCOUNTS_URL" role="menuitem">
         <Settings :size="16" :stroke-width="1.75" aria-hidden="true" />
         <span>Account Settings</span>
diff --git a/src/components/MailRuleSelect.vue b/src/components/MailRuleSelect.vue
new file mode 100644
index 0000000..53ee439
--- /dev/null
+++ b/src/components/MailRuleSelect.vue
@@ -0,0 +1,131 @@
+<script setup lang="ts">
+import { computed, nextTick } from 'vue';
+import { Check } from '@lucide/vue';
+
+import AppDropdown from './AppDropdown.vue';
+import { closeContainingDropdown } from '../utils/dropdown';
+
+interface MailRuleSelectOption {
+  value: string;
+  label: string;
+  disabled?: boolean;
+}
+
+const props = withDefaults(defineProps<{
+  modelValue: string;
+  options: readonly MailRuleSelectOption[];
+  controlLabel: string;
+  placeholder?: string;
+  disabled?: boolean;
+}>(), {
+  placeholder: 'Select an option',
+  disabled: false,
+});
+
+const emit = defineEmits<{
+  (event: 'update:modelValue', value: string): void;
+}>();
+
+const selectedLabel = computed(() =>
+  props.options.find((option) => option.value === props.modelValue)?.label ?? props.placeholder);
+
+function containingDropdown(source: EventTarget | null): HTMLDetailsElement | null {
+  if (!(source instanceof Element)) return null;
+  const details = source.closest('details');
+  return details instanceof HTMLDetailsElement ? details : null;
+}
+
+function enabledOptions(details: HTMLDetailsElement): HTMLButtonElement[] {
+  return Array.from(details.querySelectorAll<HTMLButtonElement>('[data-rule-option]:not(:disabled)'));
+}
+
+async function openFromKeyboard(event: KeyboardEvent): Promise<void> {
+  if (props.disabled) return;
+  if (event.key !== 'ArrowDown' && event.key !== 'ArrowUp') return;
+  event.preventDefault();
+  const details = containingDropdown(event.currentTarget);
+  if (!details) return;
+  details.open = true;
+  await nextTick();
+  const options = enabledOptions(details);
+  const target = event.key === 'ArrowDown' ? options[0] : options.at(-1);
+  target?.focus();
+}
+
+function moveOptionFocus(event: KeyboardEvent): void {
+  if (!['ArrowDown', 'ArrowUp', 'Home', 'End'].includes(event.key)) return;
+  const details = containingDropdown(event.currentTarget);
+  if (!details) return;
+  const options = enabledOptions(details);
+  const current = event.currentTarget;
+  if (!(current instanceof HTMLButtonElement) || options.length === 0) return;
+  event.preventDefault();
+
+  const currentIndex = options.indexOf(current);
+  let targetIndex: number;
+  if (event.key === 'Home') targetIndex = 0;
+  else if (event.key === 'End') targetIndex = options.length - 1;
+  else if (event.key === 'ArrowDown') targetIndex = (currentIndex + 1) % options.length;
+  else targetIndex = (currentIndex - 1 + options.length) % options.length;
+  options[targetIndex]?.focus();
+}
+
+function selectOption(option: MailRuleSelectOption, event: Event): void {
+  if (props.disabled || option.disabled) return;
+  const details = containingDropdown(event.currentTarget);
+  emit('update:modelValue', option.value);
+  closeContainingDropdown(event);
+  details?.querySelector<HTMLElement>('summary')?.focus();
+}
+</script>
+
+<template>
+  <AppDropdown class="mail-rule-select" :disabled="disabled">
+    <summary
+      class="app-dropdown__summary app-dropdown__summary--control mail-rule-select__summary"
+      :aria-label="controlLabel"
+      :aria-disabled="disabled ? 'true' : undefined"
+      aria-haspopup="menu"
+      :tabindex="disabled ? -1 : undefined"
+      @keydown="openFromKeyboard"
+    >{{ selectedLabel }}</summary>
+    <div class="app-dropdown__menu mail-rule-select__menu" role="menu" :aria-label="controlLabel">
+      <button
+        v-for="option in options"
+        :key="option.value"
+        class="app-dropdown__item"
+        type="button"
+        role="menuitemradio"
+        :disabled="disabled || option.disabled"
+        :aria-checked="option.value === modelValue"
+        :data-rule-option="option.value"
+        @click="selectOption(option, $event)"
+        @keydown="moveOptionFocus"
+      >
+        <Check v-if="option.value === modelValue" :size="14" aria-hidden="true" />
+        <span v-else aria-hidden="true" />
+        <span>{{ option.label }}</span>
+      </button>
+    </div>
+  </AppDropdown>
+</template>
+
+<style scoped>
+.mail-rule-select {
+  width: 100%;
+  min-width: 0;
+}
+.mail-rule-select__summary {
+  box-sizing: border-box;
+  width: 100%;
+  min-width: 0;
+  white-space: nowrap;
+}
+.mail-rule-select__menu {
+  min-width: max(100%, 190px);
+}
+.mail-rule-select :deep(.app-dropdown__item:disabled) {
+  cursor: default;
+  opacity: 0.45;
+}
+</style>
diff --git a/src/components/MailRuleTestEditor.vue b/src/components/MailRuleTestEditor.vue
new file mode 100644
index 0000000..8a27593
--- /dev/null
+++ b/src/components/MailRuleTestEditor.vue
@@ -0,0 +1,374 @@
+<script setup lang="ts">
+import { Plus, Trash2, X } from '@lucide/vue';
+
+import MailRuleSelect from './MailRuleSelect.vue';
+import { newRuleId } from '../sieve/rules';
+import type {
+  MailRuleCondition, MailRuleConditionGroup, MailRuleTest, RuleMatch,
+} from '../sieve/rules';
+
+defineOptions({ name: 'MailRuleTestEditor' });
+
+const props = withDefaults(defineProps<{
+  match: RuleMatch;
+  conditions: MailRuleTest[];
+  negated?: boolean;
+  depth?: number;
+  root?: boolean;
+  disabled?: boolean;
+  removable?: boolean;
+}>(), {
+  negated: false,
+  depth: 0,
+  root: false,
+  disabled: false,
+  removable: true,
+});
+
+const matchOptions = [
+  { value: 'all', label: 'all of these match' },
+  { value: 'any', label: 'any of these match' },
+] as const;
+
+const fieldOptions = [
+  { value: 'from', label: 'From' },
+  { value: 'to', label: 'To' },
+  { value: 'toCc', label: 'To or Cc' },
+  { value: 'subject', label: 'Subject' },
+  { value: 'header', label: 'Custom header' },
+] as const;
+
+const operatorOptions = [
+  { value: 'is', label: 'is' },
+  { value: 'contains', label: 'contains' },
+  { value: 'matches', label: 'matches wildcard' },
+] as const;
+
+const emit = defineEmits<{
+  (event: 'update:match', value: RuleMatch): void;
+  (event: 'update:conditions', value: MailRuleTest[]): void;
+  (event: 'update:negated', value: boolean): void;
+  (event: 'remove'): void;
+}>();
+
+function createCondition(): MailRuleCondition {
+  return {
+    id: newRuleId('condition'),
+    type: 'condition',
+    negated: false,
+    field: 'from',
+    operator: 'contains',
+    value: '',
+  };
+}
+
+function createGroup(): MailRuleConditionGroup {
+  return {
+    id: newRuleId('group'),
+    type: 'group',
+    negated: false,
+    match: 'all',
+    conditions: [createCondition()],
+  };
+}
+
+function replaceCondition(index: number, condition: MailRuleTest) {
+  const conditions = [...props.conditions];
+  conditions.splice(index, 1, condition);
+  emit('update:conditions', conditions);
+}
+
+function updateCondition(index: number, patch: Partial<MailRuleCondition>) {
+  const condition = props.conditions[index];
+  if (condition?.type !== 'condition') return;
+  replaceCondition(index, { ...condition, ...patch });
+}
+
+function removeCondition(index: number) {
+  if (props.conditions.length <= 1) return;
+  const conditions = [...props.conditions];
+  conditions.splice(index, 1);
+  emit('update:conditions', conditions);
+}
+
+function addCondition() {
+  emit('update:conditions', [...props.conditions, createCondition()]);
+}
+
+function addGroup() {
+  emit('update:conditions', [...props.conditions, createGroup()]);
+}
+
+function updateField(index: number, value: string) {
+  const field = value as MailRuleCondition['field'];
+  updateCondition(index, {
+    field,
+    ...(field === 'header' ? { headerName: 'X-Header' } : { headerName: undefined }),
+  });
+}
+
+function updateMatch(value: string) {
+  emit('update:match', value as RuleMatch);
+}
+
+function onGroupNegatedChange(event: Event) {
+  emit('update:negated', (event.target as HTMLInputElement).checked);
+}
+
+function onConditionNegatedChange(index: number, event: Event) {
+  updateCondition(index, { negated: (event.target as HTMLInputElement).checked });
+}
+
+function updateOperator(index: number, value: string) {
+  updateCondition(index, {
+    operator: value as MailRuleCondition['operator'],
+  });
+}
+
+function onTextInput(
+  index: number,
+  property: 'headerName' | 'value',
+  event: Event,
+) {
+  updateCondition(index, { [property]: (event.target as HTMLInputElement).value });
+}
+</script>
+
+<template>
+  <div class="condition-group" :class="{ 'condition-group--nested': !root }">
+    <div class="condition-group__header">
+      <span>{{ root ? 'When' : 'Group' }}</span>
+      <MailRuleSelect
+        class="condition-group__match"
+        :model-value="match"
+        :options="matchOptions"
+        :control-label="root ? 'Condition match mode' : 'Nested condition match mode'"
+        :disabled="disabled"
+        @update:model-value="updateMatch"
+      />
+      <label v-if="!root" class="condition-group__not">
+        <input
+          type="checkbox"
+          :checked="negated"
+          :disabled="disabled"
+          @change="onGroupNegatedChange"
+        />
+        Not
+      </label>
+      <button
+        v-if="!root"
+        class="condition-group__icon-button condition-group__icon-button--danger"
+        type="button"
+        :disabled="disabled || !removable"
+        aria-label="Remove condition group"
+        @click="emit('remove')"
+      ><Trash2 :size="15" aria-hidden="true" /></button>
+    </div>
+
+    <div class="condition-group__children">
+      <template v-for="(condition, index) in conditions" :key="condition.id">
+        <MailRuleTestEditor
+          v-if="condition.type === 'group'"
+          :match="condition.match"
+          :conditions="condition.conditions"
+          :negated="condition.negated"
+          :depth="depth + 1"
+          :disabled="disabled"
+          :removable="conditions.length > 1"
+          @update:match="replaceCondition(index, { ...condition, match: $event })"
+          @update:conditions="replaceCondition(index, { ...condition, conditions: $event })"
+          @update:negated="replaceCondition(index, { ...condition, negated: $event })"
+          @remove="removeCondition(index)"
+        />
+
+        <div v-else class="condition-group__condition">
+          <label class="condition-group__not">
+            <input
+              type="checkbox"
+              :checked="condition.negated"
+              :disabled="disabled"
+              @change="onConditionNegatedChange(index, $event)"
+            />
+            Not
+          </label>
+          <MailRuleSelect
+            :model-value="condition.field"
+            :options="fieldOptions"
+            control-label="Condition field"
+            :disabled="disabled"
+            @update:model-value="updateField(index, $event)"
+          />
+          <input
+            v-if="condition.field === 'header'"
+            :value="condition.headerName"
+            type="text"
+            :disabled="disabled"
+            aria-label="Header name"
+            placeholder="X-Header"
+            @input="onTextInput(index, 'headerName', $event)"
+          />
+          <MailRuleSelect
+            :model-value="condition.operator"
+            :options="operatorOptions"
+            control-label="Condition operator"
+            :disabled="disabled"
+            @update:model-value="updateOperator(index, $event)"
+          />
+          <input
+            :value="condition.value"
+            type="text"
+            :disabled="disabled"
+            aria-label="Condition value"
+            placeholder="Value"
+            @input="onTextInput(index, 'value', $event)"
+          />
+          <button
+            class="condition-group__icon-button"
+            type="button"
+            :disabled="disabled || conditions.length === 1"
+            aria-label="Remove condition"
+            @click="removeCondition(index)"
+          ><X :size="15" aria-hidden="true" /></button>
+        </div>
+      </template>
+    </div>
+
+    <div class="condition-group__actions">
+      <button type="button" :disabled="disabled" @click="addCondition">
+        <Plus :size="14" aria-hidden="true" /> Condition
+      </button>
+      <button type="button" :disabled="disabled || depth >= 7" @click="addGroup">
+        <Plus :size="14" aria-hidden="true" /> Group
+      </button>
+    </div>
+  </div>
+</template>
+
+<style scoped>
+.condition-group {
+  min-width: 0;
+}
+.condition-group--nested {
+  margin: 8px 0;
+  padding: 9px;
+  border: 1px solid var(--border-soft);
+  border-left: 3px solid color-mix(in srgb, var(--accent) 52%, var(--border));
+  border-radius: 7px;
+  background: color-mix(in srgb, var(--panel) 58%, transparent);
+}
+.condition-group__header,
+.condition-group__condition,
+.condition-group__actions,
+.condition-group__not {
+  display: flex;
+  align-items: center;
+}
+.condition-group__header {
+  gap: 8px;
+  margin-bottom: 8px;
+  color: var(--muted);
+  font-size: 12px;
+  font-weight: 650;
+  letter-spacing: 0.04em;
+  text-transform: uppercase;
+}
+.condition-group__match {
+  width: auto;
+  min-width: 160px;
+}
+.condition-group__match :deep(.mail-rule-select__summary) {
+  text-transform: none;
+  letter-spacing: normal;
+}
+.condition-group__not {
+  gap: 5px;
+  white-space: nowrap;
+  font-weight: 500;
+  letter-spacing: normal;
+  text-transform: none;
+}
+.condition-group__not input {
+  width: 15px;
+  min-height: 15px;
+}
+.condition-group__condition {
+  display: grid;
+  grid-template-columns: auto minmax(110px, 0.8fr) minmax(135px, 1fr) minmax(160px, 1.5fr) 32px;
+  gap: 8px;
+  margin-bottom: 8px;
+}
+.condition-group__condition:has(input[aria-label="Header name"]) {
+  grid-template-columns: auto minmax(105px, 0.75fr) minmax(110px, 0.75fr) minmax(135px, 1fr) minmax(150px, 1.35fr) 32px;
+}
+.condition-group input[type="text"] {
+  box-sizing: border-box;
+  width: 100%;
+  min-width: 0;
+  min-height: 34px;
+  padding: 6px 8px;
+  border: 1px solid var(--border);
+  border-radius: 5px;
+  background: var(--panel);
+  color: var(--text);
+  font: inherit;
+  font-size: 13px;
+}
+.condition-group input[type="checkbox"] { accent-color: var(--accent); }
+.condition-group input:focus-visible {
+  border-color: var(--accent);
+  outline: 2px solid color-mix(in srgb, var(--accent) 30%, transparent);
+  outline-offset: 1px;
+}
+.condition-group__actions {
+  gap: 3px;
+}
+.condition-group__actions button,
+.condition-group__icon-button {
+  border: 0;
+  border-radius: 4px;
+  background: transparent;
+  color: var(--accent);
+  cursor: pointer;
+  font: inherit;
+  font-size: 12px;
+  font-weight: 600;
+}
+.condition-group__actions button {
+  display: inline-flex;
+  align-items: center;
+  gap: 3px;
+  padding: 5px 7px;
+}
+.condition-group__icon-button {
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  width: 32px;
+  height: 32px;
+  margin-left: auto;
+  padding: 0;
+  border-radius: 999px;
+  color: var(--muted);
+}
+.condition-group__actions button:hover:not(:disabled),
+.condition-group__actions button:focus-visible,
+.condition-group__icon-button:hover:not(:disabled),
+.condition-group__icon-button:focus-visible {
+  background: var(--rowHover);
+  color: var(--text);
+  outline: none;
+}
+.condition-group__icon-button--danger:hover:not(:disabled),
+.condition-group__icon-button--danger:focus-visible { color: #d84a4a; }
+.condition-group button:disabled { opacity: 0.35; cursor: default; }
+
+@media (max-width: 760px) {
+  .condition-group__condition,
+  .condition-group__condition:has(input[aria-label="Header name"]) {
+    grid-template-columns: auto 1fr 32px;
+  }
+  .condition-group__condition > :not(.condition-group__not, button) { grid-column: 2; }
+  .condition-group__condition > .condition-group__not { grid-column: 1; grid-row: 1; }
+  .condition-group__condition > button { grid-column: 3; grid-row: 1; }
+}
+</style>
diff --git a/src/components/MailRulesDialog.vue b/src/components/MailRulesDialog.vue
new file mode 100644
index 0000000..ba9cc04
--- /dev/null
+++ b/src/components/MailRulesDialog.vue
@@ -0,0 +1,1006 @@
+<script setup lang="ts">
+import {
+  computed, nextTick, onBeforeUnmount, onMounted, ref,
+} from 'vue';
+import {
+  ArrowDown, ArrowUp, CircleAlert, Filter, Plus, Trash2, X,
+} from '@lucide/vue';
+
+import AppButton from './AppButton.vue';
+import MailRuleSelect from './MailRuleSelect.vue';
+import MailRuleTestEditor from './MailRuleTestEditor.vue';
+import { useAuthStore } from '../stores/auth-store';
+import { useMailStore } from '../stores/mail-store';
+import { useRulesStore } from '../stores/rules-store';
+import {
+  cloneRuleDocument,
+  compileRules,
+  createEmptyRule,
+  newRuleId,
+  normalizeRuleDocument,
+  parseRulesSource,
+  RuleValidationError,
+} from '../sieve/rules';
+import type {
+  MailRule, MailRuleAction, MailRuleDocument,
+} from '../sieve/rules';
+
+const emit = defineEmits<{ (event: 'close'): void }>();
+
+const authStore = useAuthStore();
+const mailStore = useMailStore();
+const rulesStore = useRulesStore();
+const panelEl = ref<HTMLElement | null>(null);
+const closeButtonEl = ref<HTMLButtonElement | null>(null);
+const mode = ref<'visual' | 'source'>('visual');
+const draft = ref<MailRuleDocument>({ version: 2, rules: [] });
+const baseline = ref('');
+const sourceDraft = ref('');
+const sourceBaseline = ref('');
+const visualSourceCheckpoint = ref('');
+const localError = ref<string | null>(null);
+const modeError = ref<string | null>(null);
+const notice = ref<string | null>(null);
+const confirmation = ref<'discard' | null>(null);
+
+const busy = computed(() => rulesStore.loading || rulesStore.saving);
+const dirty = computed(() =>
+  JSON.stringify(draft.value) !== baseline.value
+  || sourceDraft.value !== sourceBaseline.value);
+const extensions = computed(() => new Set(rulesStore.capabilities.sieveExtensions));
+const canMove = computed(() => extensions.value.has('fileinto'));
+const canFlags = computed(() => extensions.value.has('imap4flags'));
+const canRedirectCopy = computed(() => extensions.value.has('copy'));
+
+const folderOptions = computed(() => {
+  const ownFolders = mailStore.folders.filter((folder) =>
+    folder.account_id === authStore.accountId
+    && folder.is_deleted !== 1
+    && folder.may_add_items !== 0);
+  const byId = new Map(ownFolders.map((folder) => [folder.id, folder]));
+  return ownFolders
+    .map((folder) => {
+      const names: string[] = [];
+      const visited = new Set<number>();
+      let current: typeof folder | undefined = folder;
+      while (current && !visited.has(current.id)) {
+        visited.add(current.id);
+        names.unshift(current.name);
+        current = current.parent_id == null ? undefined : byId.get(current.parent_id);
+      }
+      return { remoteId: folder.remote_id, label: names.join('/') };
+    })
+    .sort((a, b) => a.label.localeCompare(b.label));
+});
+
+const actionOptions = [
+  { value: 'move', label: 'Move to folder' },
+  { value: 'markRead', label: 'Mark as read' },
+  { value: 'star', label: 'Star' },
+  { value: 'redirect', label: 'Forward a copy' },
+  { value: 'discard', label: 'Discard' },
+] as const;
+
+const availableActionOptions = computed(() => actionOptions.map((option) => ({
+  ...option,
+  disabled: !actionSupported(option.value),
+})));
+
+const folderSelectOptions = computed(() => folderOptions.value.map((folder) => ({
+  value: folder.remoteId,
+  label: folder.label,
+})));
+
+function actionSupported(type: MailRuleAction['type']): boolean {
+  if (type === 'move') return canMove.value;
+  if (type === 'markRead' || type === 'star') return canFlags.value;
+  if (type === 'redirect') return canRedirectCopy.value;
+  return true;
+}
+
+function addRule() {
+  const rule = createEmptyRule();
+  if (!canFlags.value) rule.actions = [createDefaultAction()];
+  draft.value.rules.push(rule);
+  localError.value = null;
+}
+
+function removeRule(index: number) {
+  draft.value.rules.splice(index, 1);
+}
+
+function moveRule(index: number, delta: number) {
+  const target = index + delta;
+  if (target < 0 || target >= draft.value.rules.length) return;
+  const [rule] = draft.value.rules.splice(index, 1);
+  draft.value.rules.splice(target, 0, rule);
+}
+
+function addAction(rule: MailRule) {
+  rule.actions.push(createDefaultAction());
+}
+
+function removeAction(rule: MailRule, index: number) {
+  if (rule.actions.length <= 1) return;
+  rule.actions.splice(index, 1);
+}
+
+function onActionTypeChange(rule: MailRule, index: number, value: string) {
+  const type = value as MailRuleAction['type'];
+  rule.actions.splice(index, 1, createAction(type));
+}
+
+function onMoveTargetChange(action: Extract<MailRuleAction, { type: 'move' }>, mailboxId: string) {
+  const target = folderOptions.value.find((folder) => folder.remoteId === mailboxId);
+  action.mailboxId = mailboxId;
+  action.mailboxName = target?.label ?? action.mailboxName;
+}
+
+function createDefaultAction(): MailRuleAction {
+  const order: MailRuleAction['type'][] = ['move', 'markRead', 'discard'];
+  return createAction(order.find(actionSupported) ?? 'discard');
+}
+
+function createAction(type: MailRuleAction['type']): MailRuleAction {
+  const id = newRuleId('action');
+  if (type === 'move') {
+    const folder = folderOptions.value[0];
+    return {
+      id,
+      type,
+      mailboxId: folder?.remoteId ?? '',
+      mailboxName: folder?.label ?? '',
+    };
+  }
+  if (type === 'redirect') return { id, type, address: '' };
+  return { id, type };
+}
+
+async function load() {
+  localError.value = null;
+  modeError.value = null;
+  notice.value = null;
+  try {
+    await rulesStore.load();
+    syncDrafts();
+  } catch (error) {
+    localError.value = errorMessage(error);
+  }
+}
+
+function syncDrafts(preferredMode?: 'visual' | 'source') {
+  draft.value = resolveFolderTargets(rulesStore.freshDocument());
+  baseline.value = JSON.stringify(draft.value);
+  visualSourceCheckpoint.value = baseline.value;
+  sourceDraft.value = rulesStore.freshSource();
+  sourceBaseline.value = sourceDraft.value;
+  mode.value = rulesStore.snapshot?.visualizationError
+    ? 'source'
+    : (preferredMode ?? 'visual');
+}
+
+function switchToSource() {
+  if (mode.value === 'source') return;
+  localError.value = null;
+  modeError.value = null;
+  const currentDocument = JSON.stringify(draft.value);
+  if (currentDocument !== visualSourceCheckpoint.value) {
+    try {
+      draft.value = refreshFolderFallbacks(draft.value);
+      sourceDraft.value = compileRules(draft.value, rulesStore.capabilities, {
+        managed: rulesStore.snapshot?.managedScript != null
+          || rulesStore.snapshot?.editableScript == null,
+      });
+      visualSourceCheckpoint.value = JSON.stringify(draft.value);
+    } catch (error) {
+      modeError.value = errorMessage(error);
+      return;
+    }
+  }
+  mode.value = 'source';
+}
+
+function switchToVisual() {
+  if (mode.value === 'visual') return;
+  localError.value = null;
+  modeError.value = null;
+  try {
+    draft.value = resolveFolderTargets(parseRulesSource(sourceDraft.value));
+    visualSourceCheckpoint.value = JSON.stringify(draft.value);
+    mode.value = 'visual';
+  } catch (error) {
+    modeError.value = errorMessage(error);
+  }
+}
+
+function requestSave() {
+  localError.value = null;
+  modeError.value = null;
+  notice.value = null;
+  if (mode.value === 'source') {
+    void persist();
+    return;
+  }
+  try {
+    draft.value = refreshFolderFallbacks(draft.value);
+    normalizeRuleDocument(draft.value);
+  } catch (error) {
+    localError.value = errorMessage(error);
+    return;
+  }
+  void persist();
+}
+
+async function persist() {
+  localError.value = null;
+  notice.value = null;
+  try {
+    const savedMode = mode.value;
+    if (savedMode === 'source') await rulesStore.saveSource(sourceDraft.value);
+    else await rulesStore.save(draft.value);
+    syncDrafts(savedMode);
+    notice.value = savedMode === 'source'
+      ? 'Sieve source saved, validated, and activated.'
+      : 'Rules saved, validated, and activated.';
+  } catch (error) {
+    localError.value = errorMessage(error);
+  }
+}
+
+function refreshFolderFallbacks(input: MailRuleDocument): MailRuleDocument {
+  const document = cloneRuleDocument(input);
+  const folders = new Map(folderOptions.value.map((folder) => [folder.remoteId, folder.label]));
+  for (const rule of document.rules) {
+    for (const action of rule.actions) {
+      if (action.type !== 'move') continue;
+      const label = folders.get(action.mailboxId);
+      if (!label) {
+        throw new RuleValidationError(
+          `The destination folder in “${rule.name || 'Unnamed rule'}” is no longer available.`,
+        );
+      }
+      action.mailboxName = label;
+    }
+  }
+  return document;
+}
+
+function resolveFolderTargets(input: MailRuleDocument): MailRuleDocument {
+  const document = cloneRuleDocument(input);
+  const foldersByLabel = new Map(folderOptions.value.map((folder) => [folder.label, folder.remoteId]));
+  for (const rule of document.rules) {
+    for (const action of rule.actions) {
+      if (action.type === 'move' && !action.mailboxId) {
+        action.mailboxId = foldersByLabel.get(action.mailboxName) ?? '';
+      }
+    }
+  }
+  return document;
+}
+
+function requestClose() {
+  if (busy.value) return;
+  if (dirty.value) {
+    confirmation.value = 'discard';
+    focusConfirmation();
+    return;
+  }
+  emit('close');
+}
+
+function cancelConfirmation() {
+  confirmation.value = null;
+  nextTick(() => closeButtonEl.value?.focus());
+}
+
+function confirmDiscard() {
+  confirmation.value = null;
+  emit('close');
+}
+
+function focusConfirmation() {
+  nextTick(() => {
+    panelEl.value?.querySelector<HTMLElement>('[data-mail-rules-confirm]')?.focus();
+  });
+}
+
+function onWindowKeydown(event: KeyboardEvent) {
+  if (event.key === 'Escape') {
+    event.preventDefault();
+    if (confirmation.value) {
+      cancelConfirmation();
+      return;
+    }
+    requestClose();
+    return;
+  }
+  if (event.key !== 'Tab' || !panelEl.value) return;
+  const focusRoot = confirmation.value
+    ? panelEl.value.querySelector<HTMLElement>('.mail-rules__confirm')
+    : panelEl.value;
+  if (!focusRoot) return;
+  const focusable = [...focusRoot.querySelectorAll<HTMLElement>(
+    'button:not([disabled]), input:not([disabled]), summary:not([aria-disabled="true"]), textarea:not([disabled]), [tabindex]:not([tabindex="-1"])',
+  )].filter((element) => element.offsetParent !== null);
+  if (focusable.length === 0) return;
+  const first = focusable[0];
+  const last = focusable[focusable.length - 1];
+  if (event.shiftKey && document.activeElement === first) {
+    event.preventDefault();
+    last.focus();
+  } else if (!event.shiftKey && document.activeElement === last) {
+    event.preventDefault();
+    first.focus();
+  }
+}
+
+function scriptLabel(script: { name?: string | null } | null): string {
+  return script?.name?.trim() || 'Unnamed script';
+}
+
+function errorMessage(error: unknown): string {
+  return error instanceof Error ? error.message : String(error);
+}
+
+onMounted(async () => {
+  window.addEventListener('keydown', onWindowKeydown);
+  closeButtonEl.value?.focus();
+  await load();
+});
+
+onBeforeUnmount(() => {
+  window.removeEventListener('keydown', onWindowKeydown);
+});
+</script>
+
+<template>
+  <Teleport to="body">
+    <div class="mail-rules" role="presentation" @click.self="requestClose">
+      <section
+        ref="panelEl"
+        class="mail-rules__panel"
+        role="dialog"
+        aria-modal="true"
+        aria-labelledby="mail-rules-title"
+      >
+        <header class="mail-rules__header">
+          <div>
+            <h2 id="mail-rules-title">Mail Rules</h2>
+            <p>Filter new mail on the server, even while Stormbox is closed.</p>
+          </div>
+          <button
+            ref="closeButtonEl"
+            class="mail-rules__icon-button"
+            type="button"
+            aria-label="Close mail rules"
+            :disabled="busy"
+            @click="requestClose"
+          >
+            <X :size="19" :stroke-width="2" aria-hidden="true" />
+          </button>
+        </header>
+
+        <main class="mail-rules__body">
+          <p v-if="rulesStore.loading" class="mail-rules__empty" role="status">
+            Loading server rules…
+          </p>
+
+          <div v-if="localError || rulesStore.error" class="mail-rules__alert mail-rules__alert--error" role="alert">
+            <CircleAlert :size="18" aria-hidden="true" />
+            <div>
+              <strong>Mail rules could not be loaded or saved.</strong>
+              <p>{{ localError || rulesStore.error }}</p>
+              <button v-if="!rulesStore.saving" type="button" class="mail-rules__text-button" @click="load">
+                Reload from server
+              </button>
+            </div>
+          </div>
+
+          <div v-if="notice" class="mail-rules__alert mail-rules__alert--success" role="status">
+            {{ notice }}
+          </div>
+
+          <template v-if="!rulesStore.loading && rulesStore.snapshot">
+            <div v-if="!rulesStore.supported" class="mail-rules__alert" role="status">
+              This account does not advertise JMAP for Sieve, so server-side rules are unavailable.
+            </div>
+
+            <div v-else-if="rulesStore.snapshot.parseError" class="mail-rules__alert mail-rules__alert--error" role="alert">
+              <CircleAlert :size="18" aria-hidden="true" />
+              <div>
+                <strong>Stormbox cannot choose a script to edit.</strong>
+                <p>{{ rulesStore.snapshot.parseError }}</p>
+              </div>
+            </div>
+
+            <template v-else-if="rulesStore.supported">
+              <div class="mail-rules__mode-switch" role="group" aria-label="Mail rules editor mode">
+                <button
+                  type="button"
+                  :aria-pressed="mode === 'visual'"
+                  :disabled="busy"
+                  @click="switchToVisual"
+                >Visual</button>
+                <button
+                  type="button"
+                  :aria-pressed="mode === 'source'"
+                  :disabled="busy"
+                  @click="switchToSource"
+                >Source</button>
+              </div>
+
+              <div v-if="modeError" class="mail-rules__alert mail-rules__alert--warning" role="alert">
+                <CircleAlert :size="18" aria-hidden="true" />
+                <div>
+                  <strong>Cannot switch to the visual editor.</strong>
+                  <p>{{ modeError }}</p>
+                </div>
+              </div>
+
+              <div
+                v-if="mode === 'source' && rulesStore.snapshot.visualizationError && !modeError"
+                class="mail-rules__alert mail-rules__alert--warning"
+                role="status"
+              >
+                <CircleAlert :size="18" aria-hidden="true" />
+                <div>
+                  <strong>This script cannot be represented visually.</strong>
+                  <p>{{ rulesStore.snapshot.visualizationError }}</p>
+                  <p>Edit its complete source below. The server will validate it before saving.</p>
+                </div>
+              </div>
+
+              <div
+                v-else-if="mode === 'visual' && rulesStore.snapshot.editableScript"
+                class="mail-rules__alert"
+                role="status"
+              >
+                <div>
+                  <strong>This script is visually compatible.</strong>
+                  <p>Visual saves preserve its behavior, but normalize source formatting and comments.</p>
+                </div>
+              </div>
+
+              <div v-if="mode === 'visual'" aria-label="Visual rule editor">
+                <div class="mail-rules__toolbar">
+                  <div class="mail-rules__summary">
+                    <Filter :size="17" aria-hidden="true" />
+                    <span>{{ draft.rules.length }} {{ draft.rules.length === 1 ? 'rule' : 'rules' }}</span>
+                  </div>
+                  <AppButton data-mail-rules-add :disabled="busy" @click="addRule">
+                    <template #iconLeft><Plus :size="16" aria-hidden="true" /></template>
+                    Add rule
+                  </AppButton>
+                </div>
+
+                <p v-if="draft.rules.length === 0" class="mail-rules__empty">
+                  No rules yet. Add one, or save an empty ruleset to keep all incoming mail unchanged.
+                </p>
+
+                <fieldset class="mail-rules__fieldset" :disabled="busy">
+                  <article
+                    v-for="(rule, ruleIndex) in draft.rules"
+                    :key="rule.id"
+                    class="mail-rule"
+                  >
+                  <header class="mail-rule__header">
+                    <label class="mail-rule__enabled">
+                      <input v-model="rule.enabled" type="checkbox" />
+                      <span class="sr-only">Enable rule</span>
+                    </label>
+                    <input
+                      v-model="rule.name"
+                      class="mail-rule__name"
+                      type="text"
+                      aria-label="Rule name"
+                      placeholder="Rule name"
+                    />
+                    <button
+                      class="mail-rules__icon-button"
+                      type="button"
+                      :disabled="ruleIndex === 0"
+                      aria-label="Move rule up"
+                      @click="moveRule(ruleIndex, -1)"
+                    ><ArrowUp :size="16" aria-hidden="true" /></button>
+                    <button
+                      class="mail-rules__icon-button"
+                      type="button"
+                      :disabled="ruleIndex === draft.rules.length - 1"
+                      aria-label="Move rule down"
+                      @click="moveRule(ruleIndex, 1)"
+                    ><ArrowDown :size="16" aria-hidden="true" /></button>
+                    <button
+                      class="mail-rules__icon-button mail-rules__icon-button--danger"
+                      type="button"
+                      aria-label="Delete rule"
+                      @click="removeRule(ruleIndex)"
+                    ><Trash2 :size="16" aria-hidden="true" /></button>
+                  </header>
+
+                  <div class="mail-rule__section">
+                    <MailRuleTestEditor
+                      root
+                      :match="rule.match"
+                      :conditions="rule.conditions"
+                      :disabled="busy"
+                      @update:match="rule.match = $event"
+                      @update:conditions="rule.conditions = $event"
+                    />
+                  </div>
+
+                  <div class="mail-rule__section">
+                    <div class="mail-rule__section-title"><span>Then</span></div>
+                    <div
+                      v-for="(action, actionIndex) in rule.actions"
+                      :key="action.id"
+                      class="mail-rule__row mail-rule__action"
+                    >
+                      <MailRuleSelect
+                        :model-value="action.type"
+                        :options="availableActionOptions"
+                        control-label="Rule action"
+                        :disabled="busy"
+                        @update:model-value="onActionTypeChange(rule, actionIndex, $event)"
+                      />
+                      <MailRuleSelect
+                        v-if="action.type === 'move'"
+                        :model-value="action.mailboxId"
+                        :options="folderSelectOptions"
+                        control-label="Destination folder"
+                        placeholder="Select folder"
+                        :disabled="busy"
+                        @update:model-value="onMoveTargetChange(action, $event)"
+                      />
+                      <input
+                        v-else-if="action.type === 'redirect'"
+                        v-model="action.address"
+                        type="email"
+                        aria-label="Forwarding address"
+                        placeholder="person@example.com"
+                      />
+                      <span v-else class="mail-rule__action-description">
+                        {{ actionOptions.find((option) => option.value === action.type)?.label }}
+                      </span>
+                      <button
+                        class="mail-rules__icon-button"
+                        type="button"
+                        :disabled="rule.actions.length === 1"
+                        aria-label="Remove action"
+                        @click="removeAction(rule, actionIndex)"
+                      ><X :size="15" aria-hidden="true" /></button>
+                    </div>
+                    <button class="mail-rules__text-button" type="button" @click="addAction(rule)">
+                      + Add action
+                    </button>
+                    <label class="mail-rule__stop">
+                      <input v-model="rule.stopProcessing" type="checkbox" />
+                      Stop processing later rules when this rule matches
+                    </label>
+                  </div>
+                  </article>
+                </fieldset>
+              </div>
+
+              <div v-else class="mail-rules__source" aria-label="Sieve source editor">
+                <div class="mail-rules__source-heading">
+                  <strong>Sieve source</strong>
+                  <span>
+                    {{ rulesStore.snapshot.editableScript
+                      ? scriptLabel(rulesStore.snapshot.editableScript)
+                      : 'New script' }}
+                  </span>
+                </div>
+                <textarea
+                  v-model="sourceDraft"
+                  aria-label="Sieve source"
+                  :disabled="busy"
+                  autocomplete="off"
+                  autocapitalize="off"
+                  spellcheck="false"
+                />
+              </div>
+            </template>
+          </template>
+        </main>
+
+        <footer class="mail-rules__footer">
+          <span class="mail-rules__footer-status">
+            <template v-if="rulesStore.saving">Uploading and validating…</template>
+            <template v-else-if="dirty">Unsaved changes</template>
+          </span>
+          <AppButton variant="outline" :disabled="busy" @click="requestClose">Close</AppButton>
+          <AppButton
+            data-mail-rules-save
+            :disabled="busy || !rulesStore.supported || Boolean(rulesStore.snapshot?.parseError)"
+            @click="requestSave"
+          >Save and activate</AppButton>
+        </footer>
+
+        <div v-if="confirmation" class="mail-rules__confirm-backdrop" role="presentation">
+          <section
+            class="mail-rules__confirm"
+            role="alertdialog"
+            aria-modal="true"
+            aria-labelledby="discard-title"
+          >
+            <h3 id="discard-title">Discard unsaved changes?</h3>
+            <p>Your server-side rules will stay as they were when this editor opened.</p>
+            <div class="mail-rules__confirm-actions">
+              <AppButton variant="outline" @click="cancelConfirmation">Keep editing</AppButton>
+              <AppButton data-mail-rules-confirm @click="confirmDiscard">Discard changes</AppButton>
+            </div>
+          </section>
+        </div>
+      </section>
+    </div>
+  </Teleport>
+</template>
+
+<style scoped>
+.mail-rules {
+  position: fixed;
+  inset: 0;
+  z-index: 125;
+  display: grid;
+  place-items: center;
+  padding: 18px;
+  background: color-mix(in srgb, #000 58%, transparent);
+}
+.mail-rules__panel {
+  position: relative;
+  display: grid;
+  grid-template-rows: auto minmax(0, 1fr) auto;
+  width: min(900px, 100%);
+  max-height: min(90vh, calc(100vh - 36px));
+  overflow: hidden;
+  border: 1px solid var(--border);
+  border-radius: 16px;
+  background: var(--panel);
+  color: var(--text);
+  box-shadow: 0 24px 64px color-mix(in srgb, #000 45%, transparent);
+}
+.mail-rules__header {
+  display: flex;
+  align-items: flex-start;
+  justify-content: space-between;
+  gap: 16px;
+  padding: 18px 20px 14px;
+  border-bottom: 1px solid var(--border-soft);
+}
+.mail-rules__header h2,
+.mail-rules__confirm h3 {
+  margin: 0;
+  font-size: 18px;
+  font-weight: 650;
+}
+.mail-rules__header p,
+.mail-rules__confirm p,
+.mail-rules__alert p {
+  margin: 5px 0 0;
+  color: var(--muted);
+  font-size: 13px;
+  line-height: 1.45;
+}
+.mail-rules__body {
+  overflow: auto;
+  padding: 16px 20px 24px;
+}
+.mail-rules__mode-switch {
+  display: inline-flex;
+  gap: 2px;
+  margin: 0 0 14px;
+  padding: 3px;
+  border: 1px solid var(--border);
+  border-radius: 8px;
+  background: var(--panel2);
+}
+.mail-rules__mode-switch button {
+  min-width: 82px;
+  padding: 6px 12px;
+  border: 0;
+  border-radius: 5px;
+  background: transparent;
+  color: var(--muted);
+  cursor: pointer;
+  font: inherit;
+  font-size: 13px;
+  font-weight: 600;
+}
+.mail-rules__mode-switch button[aria-pressed="true"] {
+  background: var(--panel);
+  color: var(--text);
+  box-shadow: 0 1px 3px color-mix(in srgb, #000 22%, transparent);
+}
+.mail-rules__mode-switch button:focus-visible {
+  outline: 2px solid color-mix(in srgb, var(--accent) 45%, transparent);
+  outline-offset: 1px;
+}
+.mail-rules__mode-switch button:disabled {
+  cursor: default;
+  opacity: 0.55;
+}
+.mail-rules__toolbar,
+.mail-rules__footer,
+.mail-rule__header,
+.mail-rule__section-title,
+.mail-rules__summary,
+.mail-rules__confirm-actions {
+  display: flex;
+  align-items: center;
+}
+.mail-rules__toolbar {
+  justify-content: space-between;
+  gap: 12px;
+  margin: 4px 0 12px;
+}
+.mail-rules__summary {
+  gap: 7px;
+  color: var(--muted);
+  font-size: 13px;
+  font-weight: 600;
+}
+.mail-rules__footer {
+  justify-content: flex-end;
+  gap: 9px;
+  padding: 12px 20px;
+  border-top: 1px solid var(--border-soft);
+  background: var(--panel2);
+}
+.mail-rules__footer-status {
+  flex: 1;
+  color: var(--muted);
+  font-size: 12px;
+}
+.mail-rules__alert {
+  display: flex;
+  align-items: flex-start;
+  gap: 9px;
+  margin: 0 0 14px;
+  padding: 11px 12px;
+  border: 1px solid var(--border);
+  border-radius: 8px;
+  background: var(--panel2);
+  font-size: 13px;
+  line-height: 1.4;
+}
+.mail-rules__alert svg { flex: 0 0 auto; margin-top: 1px; }
+.mail-rules__alert--warning {
+  border-color: var(--warn-border);
+  background: var(--warn-bg);
+  color: var(--warn-fg);
+}
+.mail-rules__alert--error {
+  border-color: color-mix(in srgb, #d33 55%, var(--border));
+  background: color-mix(in srgb, #d33 10%, var(--panel));
+}
+.mail-rules__alert--success {
+  border-color: color-mix(in srgb, #2b9b58 60%, var(--border));
+  background: color-mix(in srgb, #2b9b58 10%, var(--panel));
+}
+.mail-rules__empty {
+  margin: 28px 8px;
+  color: var(--muted);
+  font-size: 13px;
+  text-align: center;
+}
+.mail-rules__fieldset {
+  min-width: 0;
+  margin: 0;
+  padding: 0;
+  border: 0;
+}
+.mail-rules__source {
+  display: grid;
+  gap: 9px;
+}
+.mail-rules__source-heading {
+  display: flex;
+  align-items: baseline;
+  justify-content: space-between;
+  gap: 12px;
+  color: var(--text);
+  font-size: 13px;
+}
+.mail-rules__source-heading span {
+  overflow: hidden;
+  color: var(--muted);
+  font-size: 12px;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+}
+.mail-rules__source textarea {
+  box-sizing: border-box;
+  width: 100%;
+  min-height: 430px;
+  padding: 12px 14px;
+  resize: vertical;
+  border: 1px solid var(--border);
+  border-radius: 8px;
+  background: var(--panel2);
+  color: var(--text);
+  font-family: ui-monospace, SFMono-Regular, Consolas, "Liberation Mono", monospace;
+  font-size: 12px;
+  line-height: 1.55;
+  tab-size: 2;
+}
+.mail-rules__source textarea:focus-visible {
+  border-color: var(--accent);
+  outline: 2px solid color-mix(in srgb, var(--accent) 30%, transparent);
+  outline-offset: 1px;
+}
+.mail-rule {
+  margin-bottom: 14px;
+  border: 1px solid var(--border);
+  border-radius: 10px;
+  background: var(--panel2);
+  overflow: visible;
+}
+.mail-rule__header {
+  gap: 6px;
+  padding: 10px 12px;
+  border-bottom: 1px solid var(--border-soft);
+}
+.mail-rule__enabled {
+  display: inline-flex;
+  padding: 4px;
+}
+.mail-rule__name {
+  flex: 1;
+  min-width: 100px;
+  font-weight: 600;
+}
+.mail-rule__section {
+  padding: 12px;
+}
+.mail-rule__section + .mail-rule__section {
+  border-top: 1px solid var(--border-soft);
+}
+.mail-rule__section-title {
+  gap: 8px;
+  margin-bottom: 8px;
+  font-size: 12px;
+  font-weight: 650;
+  text-transform: uppercase;
+  letter-spacing: 0.04em;
+  color: var(--muted);
+}
+.mail-rule__row {
+  display: grid;
+  gap: 8px;
+  align-items: center;
+  margin-bottom: 8px;
+}
+.mail-rule__condition {
+  grid-template-columns: minmax(120px, 0.8fr) minmax(120px, 0.8fr) minmax(145px, 1fr) minmax(160px, 1.5fr) 32px;
+}
+.mail-rule__condition:not(:has(input[aria-label="Header name"])) {
+  grid-template-columns: minmax(120px, 0.8fr) minmax(145px, 1fr) minmax(160px, 1.8fr) 32px;
+}
+.mail-rule__action {
+  grid-template-columns: minmax(170px, 0.8fr) minmax(200px, 1.4fr) 32px;
+}
+.mail-rule__action-description {
+  color: var(--muted);
+  font-size: 13px;
+}
+.mail-rule__stop {
+  display: flex;
+  align-items: center;
+  gap: 8px;
+  margin-top: 10px;
+  color: var(--muted);
+  font-size: 12px;
+}
+.mail-rule input {
+  box-sizing: border-box;
+  width: 100%;
+  min-width: 0;
+  min-height: 34px;
+  padding: 6px 8px;
+  border: 1px solid var(--border);
+  border-radius: 5px;
+  background: var(--panel);
+  color: var(--text);
+  font: inherit;
+  font-size: 13px;
+}
+.mail-rule input[type="checkbox"] {
+  width: 16px;
+  min-height: 16px;
+  accent-color: var(--accent);
+}
+.mail-rule input:focus-visible {
+  border-color: var(--accent);
+  outline: 2px solid color-mix(in srgb, var(--accent) 30%, transparent);
+  outline-offset: 1px;
+}
+.mail-rules__icon-button,
+.mail-rules__text-button {
+  border: 0;
+  background: transparent;
+  color: var(--muted);
+  cursor: pointer;
+  font: inherit;
+}
+.mail-rules__icon-button {
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  width: 32px;
+  height: 32px;
+  padding: 0;
+  border-radius: 999px;
+}
+.mail-rules__icon-button:hover:not(:disabled),
+.mail-rules__icon-button:focus-visible,
+.mail-rules__text-button:hover,
+.mail-rules__text-button:focus-visible {
+  background: var(--rowHover);
+  color: var(--text);
+  outline: none;
+}
+.mail-rules__icon-button--danger:hover:not(:disabled),
+.mail-rules__icon-button--danger:focus-visible { color: #d84a4a; }
+.mail-rules__icon-button:disabled { opacity: 0.35; cursor: default; }
+.mail-rules__text-button {
+  padding: 5px 7px;
+  border-radius: 4px;
+  color: var(--accent);
+  font-size: 12px;
+  font-weight: 600;
+}
+.mail-rules__confirm-backdrop {
+  position: absolute;
+  inset: 0;
+  z-index: 2;
+  display: grid;
+  place-items: center;
+  padding: 16px;
+  background: color-mix(in srgb, #000 62%, transparent);
+}
+.mail-rules__confirm {
+  width: min(440px, 100%);
+  padding: 18px;
+  border: 1px solid var(--border);
+  border-radius: 12px;
+  background: var(--panel);
+  box-shadow: 0 20px 45px color-mix(in srgb, #000 45%, transparent);
+}
+.mail-rules__confirm-actions {
+  justify-content: flex-end;
+  gap: 8px;
+  margin-top: 18px;
+}
+.sr-only {
+  position: absolute;
+  width: 1px;
+  height: 1px;
+  padding: 0;
+  margin: -1px;
+  overflow: hidden;
+  clip: rect(0, 0, 0, 0);
+  white-space: nowrap;
+  border: 0;
+}
+@media (max-width: 760px) {
+  .mail-rules { padding: 0; }
+  .mail-rules__panel {
+    width: 100%;
+    height: 100%;
+    max-height: none;
+    border: 0;
+    border-radius: 0;
+  }
+  .mail-rule__condition,
+  .mail-rule__condition:not(:has(input[aria-label="Header name"])),
+  .mail-rule__action {
+    grid-template-columns: 1fr 32px;
+  }
+  .mail-rule__condition > :not(button),
+  .mail-rule__action > :not(button) { grid-column: 1; }
+  .mail-rule__condition > button,
+  .mail-rule__action > button { grid-column: 2; grid-row: 1; }
+  .mail-rules__footer { flex-wrap: wrap; }
+  .mail-rules__footer-status { flex-basis: 100%; }
+}
+</style>
diff --git a/src/constants/states.ts b/src/constants/states.ts
index 62bc1e0..e40d2dd 100644
--- a/src/constants/states.ts
+++ b/src/constants/states.ts
@@ -195,6 +195,7 @@ export const MUTATION_TYPE = Object.freeze({
   DESTROY_MAILBOX: 'destroyMailbox',
   PUSH_SETTINGS: 'pushSettings',
   PUSH_CONTACTS_TRASH: 'pushContactsTrash',
+  SET_SIEVE_RULES: 'setSieveRules',
 } as const);
 export type MutationType = (typeof MUTATION_TYPE)[keyof typeof MUTATION_TYPE];
 
diff --git a/src/db/protocol.ts b/src/db/protocol.ts
index ffde09d..aeeb28a 100644
--- a/src/db/protocol.ts
+++ b/src/db/protocol.ts
@@ -187,6 +187,7 @@ export const DB_RPC = Object.freeze({
   SYNC_INVENTORY_ADDRESSBOOK: 'sync.inventoryAddressbook',
   SYNC_ENSURE_CONTACTS: 'sync.ensureContacts',
   SYNC_ENSURE_FOLDER_INDEX: 'sync.ensureFolderIndex',
+  SYNC_GET_MAIL_RULES: 'sync.getMailRules',
   SYNC_DRAIN_OUTBOX: 'sync.drainOutbox',
   SYNC_RUN_MUTATION: 'sync.runMutation',
   SYNC_GET_ATTACHMENT_LIMITS: 'sync.getAttachmentLimits',
diff --git a/src/db/repository.ts b/src/db/repository.ts
index f3b14e2..b462479 100644
--- a/src/db/repository.ts
+++ b/src/db/repository.ts
@@ -655,6 +655,10 @@ export class Repository {
     return this.call(DB_RPC.SYNC_ENSURE_FOLDER_INDEX, { accountId, folderId, options });
   }
 
+  getMailRules(accountId) {
+    return this.call(DB_RPC.SYNC_GET_MAIL_RULES, { accountId });
+  }
+
   drainOutbox(accountId, limit = 25) {
     return this.call(DB_RPC.SYNC_DRAIN_OUTBOX, { accountId, limit });
   }
diff --git a/src/sieve/parser.ts b/src/sieve/parser.ts
new file mode 100644
index 0000000..d9438df
--- /dev/null
+++ b/src/sieve/parser.ts
@@ -0,0 +1,514 @@
+export interface SieveSourceRange {
+  start: number;
+  end: number;
+}
+
+export type SieveValue =
+  | { type: 'tag'; value: string; range: SieveSourceRange }
+  | { type: 'string'; value: string; range: SieveSourceRange }
+  | { type: 'stringList'; values: string[]; range: SieveSourceRange }
+  | { type: 'number'; value: string; range: SieveSourceRange };
+
+export interface SieveCallTest {
+  type: 'call';
+  name: string;
+  arguments: SieveValue[];
+  range: SieveSourceRange;
+}
+
+export interface SieveNotTest {
+  type: 'not';
+  test: SieveTest;
+  range: SieveSourceRange;
+}
+
+export interface SieveBooleanTest {
+  type: 'allof' | 'anyof';
+  tests: SieveTest[];
+  range: SieveSourceRange;
+}
+
+export type SieveTest = SieveCallTest | SieveNotTest | SieveBooleanTest;
+
+export interface SieveCommand {
+  type: 'command';
+  name: string;
+  arguments: SieveValue[];
+  comments: string[];
+  range: SieveSourceRange;
+}
+
+export interface SieveBlockCommand {
+  type: 'block';
+  name: string;
+  arguments: SieveValue[];
+  commands: SieveStatement[];
+  comments: string[];
+  range: SieveSourceRange;
+}
+
+export interface SieveIfBranch {
+  test: SieveTest;
+  commands: SieveStatement[];
+  comments: string[];
+}
+
+export interface SieveIfStatement {
+  type: 'if';
+  branches: SieveIfBranch[];
+  elseCommands: SieveStatement[] | null;
+  elseComments: string[];
+  comments: string[];
+  range: SieveSourceRange;
+}
+
+export type SieveStatement = SieveCommand | SieveBlockCommand | SieveIfStatement;
+
+export interface SieveScript {
+  source: string;
+  statements: SieveStatement[];
+  trailingComments: string[];
+}
+
+export class SieveSyntaxError extends Error {
+  readonly offset: number;
+
+  constructor(message: string, source: string, offset: number) {
+    const before = source.slice(0, offset);
+    const line = before.split(/\r\n|\r|\n/).length;
+    const lastNewline = Math.max(before.lastIndexOf('\n'), before.lastIndexOf('\r'));
+    const column = offset - lastNewline;
+    super(`${message} at line ${line}, column ${column}.`);
+    this.name = 'SieveSyntaxError';
+    this.offset = offset;
+  }
+}
+
+type TokenType =
+  | 'identifier'
+  | 'tag'
+  | 'number'
+  | 'string'
+  | 'comment'
+  | '['
+  | ']'
+  | '('
+  | ')'
+  | '{'
+  | '}'
+  | ','
+  | ';'
+  | 'eof';
+
+const MAX_SOURCE_CHARACTERS = 2_000_000;
+const MAX_TOKENS = 100_000;
+const MAX_AST_NODES = 10_000;
+const MAX_NESTING_DEPTH = 64;
+
+interface Token {
+  type: TokenType;
+  value: string;
+  start: number;
+  end: number;
+}
+
+export function parseSieve(source: string): SieveScript {
+  if (source.length > MAX_SOURCE_CHARACTERS) {
+    throw new SieveSyntaxError('Script exceeds the parser size limit', source, 0);
+  }
+  const parser = new Parser(source, tokenize(source));
+  return parser.parse();
+}
+
+class Parser {
+  private index = 0;
+  private nodeCount = 0;
+  private trailingComments: string[] = [];
+
+  constructor(
+    private readonly source: string,
+    private readonly tokens: Token[],
+  ) {}
+
+  parse(): SieveScript {
+    const statements = this.parseStatements('eof', 0);
+    this.expect('eof');
+    return { source: this.source, statements, trailingComments: this.trailingComments };
+  }
+
+  private parseStatements(end: '}' | 'eof', depth: number): SieveStatement[] {
+    const statements: SieveStatement[] = [];
+    while (true) {
+      const comments = this.takeComments();
+      if (this.peek().type === end) {
+        if (end === 'eof') {
+          this.trailingComments = comments;
+        } else if (comments.length > 0 && statements.length > 0) {
+          statements[statements.length - 1].comments.push(...comments);
+        }
+        return statements;
+      }
+      if (this.peek().type === 'eof') {
+        if (end === 'eof') return statements;
+        throw this.error('Expected “}”', this.peek().start);
+      }
+      statements.push(this.parseStatement(comments, depth));
+    }
+  }
+
+  private parseStatement(comments: string[], depth: number): SieveStatement {
+    const start = this.peek().start;
+    this.countNode(start);
+    const name = this.expect('identifier');
+    if (name.value.toLowerCase() === 'if') return this.parseIf(start, comments, depth);
+    if (['elsif', 'else'].includes(name.value.toLowerCase())) {
+      throw this.error(`Unexpected “${name.value}”`, name.start);
+    }
+
+    const args = this.parseValues(new Set([';', '{']));
+    if (this.match('{')) {
+      this.checkDepth(depth + 1, start);
+      const commands = this.parseStatements('}', depth + 1);
+      const close = this.expect('}');
+      return {
+        type: 'block',
+        name: name.value.toLowerCase(),
+        arguments: args,
+        commands,
+        comments,
+        range: { start, end: close.end },
+      };
+    }
+    const endToken = this.expect(';');
+    return {
+      type: 'command',
+      name: name.value.toLowerCase(),
+      arguments: args,
+      comments,
+      range: { start, end: endToken.end },
+    };
+  }
+
+  private parseIf(start: number, comments: string[], depth: number): SieveIfStatement {
+    const branches: SieveIfBranch[] = [];
+    const firstTest = this.parseTest(new Set(['{']), 0);
+    branches.push({ test: firstTest, commands: this.parseBlock(depth), comments: [] });
+    let end = this.previous().end;
+
+    let elseCommands: SieveStatement[] | null = null;
+    let elseComments: string[] = [];
+    while (true) {
+      const beforeComments = this.index;
+      const branchComments = this.takeComments();
+      const token = this.peek();
+      if (token.type !== 'identifier') {
+        this.index = beforeComments;
+        break;
+      }
+      const keyword = token.value.toLowerCase();
+      if (keyword === 'elsif') {
+        this.index += 1;
+        const test = this.parseTest(new Set(['{']), 0);
+        branches.push({ test, commands: this.parseBlock(depth), comments: branchComments });
+        end = this.previous().end;
+        continue;
+      }
+      if (keyword === 'else') {
+        this.index += 1;
+        elseComments = branchComments;
+        elseCommands = this.parseBlock(depth);
+        end = this.previous().end;
+      } else {
+        this.index = beforeComments;
+      }
+      break;
+    }
+
+    return {
+      type: 'if',
+      branches,
+      elseCommands,
+      elseComments,
+      comments,
+      range: { start, end },
+    };
+  }
+
+  private parseBlock(depth: number): SieveStatement[] {
+    this.checkDepth(depth + 1, this.peek().start);
+    this.expect('{');
+    const commands = this.parseStatements('}', depth + 1);
+    this.expect('}');
+    return commands;
+  }
+
+  private parseTest(stop: ReadonlySet<TokenType>, depth: number): SieveTest {
+    this.takeComments();
+    const start = this.peek().start;
+    this.checkDepth(depth, start);
+    this.countNode(start);
+    const nameToken = this.expect('identifier');
+    const name = nameToken.value.toLowerCase();
+    if (name === 'not') {
+      const test = this.parseTest(stop, depth + 1);
+      return { type: 'not', test, range: { start, end: test.range.end } };
+    }
+    if (name === 'allof' || name === 'anyof') {
+      this.expect('(');
+      const tests: SieveTest[] = [];
+      if (this.peek().type === ')') {
+        throw this.error(`${name} requires at least one test`, this.peek().start);
+      }
+      do {
+        tests.push(this.parseTest(new Set([',', ')']), depth + 1));
+      } while (this.match(','));
+      const close = this.expect(')');
+      return { type: name, tests, range: { start, end: close.end } };
+    }
+
+    const args = this.parseValues(stop);
+    return {
+      type: 'call',
+      name,
+      arguments: args,
+      range: { start, end: this.previous().end },
+    };
+  }
+
+  private parseValues(stop: ReadonlySet<TokenType>): SieveValue[] {
+    const values: SieveValue[] = [];
+    while (!stop.has(this.peek().type)) {
+      const token = this.peek();
+      if (token.type === 'comment') {
+        this.index += 1;
+        continue;
+      }
+      if (token.type === 'tag') {
+        this.index += 1;
+        values.push({ type: 'tag', value: token.value.toLowerCase(), range: range(token) });
+        continue;
+      }
+      if (token.type === 'number') {
+        this.index += 1;
+        values.push({ type: 'number', value: token.value, range: range(token) });
+        continue;
+      }
+      if (token.type === 'string') {
+        this.index += 1;
+        values.push({ type: 'string', value: token.value, range: range(token) });
+        continue;
+      }
+      if (token.type === '[') {
+        values.push(this.parseStringList());
+        continue;
+      }
+      throw this.error(`Unexpected token “${token.value || token.type}”`, token.start);
+    }
+    return values;
+  }
+
+  private parseStringList(): SieveValue {
+    const open = this.expect('[');
+    const values: string[] = [];
+    do {
+      values.push(this.expect('string').value);
+    } while (this.match(','));
+    const close = this.expect(']');
+    return { type: 'stringList', values, range: { start: open.start, end: close.end } };
+  }
+
+  private takeComments(): string[] {
+    const comments: string[] = [];
+    while (this.peek().type === 'comment') {
+      comments.push(this.peek().value);
+      this.index += 1;
+    }
+    return comments;
+  }
+
+  private match(type: TokenType): boolean {
+    const start = this.index;
+    this.takeComments();
+    if (this.peek().type !== type) {
+      this.index = start;
+      return false;
+    }
+    this.index += 1;
+    return true;
+  }
+
+  private expect(type: TokenType): Token {
+    if (type !== 'comment') this.takeComments();
+    const token = this.peek();
+    if (token.type !== type) throw this.error(`Expected “${type}”`, token.start);
+    this.index += 1;
+    return token;
+  }
+
+  private peek(): Token {
+    return this.tokens[this.index];
+  }
+
+  private previous(): Token {
+    return this.tokens[Math.max(0, this.index - 1)];
+  }
+
+  private error(message: string, offset: number): SieveSyntaxError {
+    return new SieveSyntaxError(message, this.source, offset);
+  }
+
+  private countNode(offset: number): void {
+    this.nodeCount += 1;
+    if (this.nodeCount > MAX_AST_NODES) {
+      throw this.error('Script exceeds the parser node limit', offset);
+    }
+  }
+
+  private checkDepth(depth: number, offset: number): void {
+    if (depth > MAX_NESTING_DEPTH) {
+      throw this.error('Script exceeds the parser nesting limit', offset);
+    }
+  }
+}
+
+function tokenize(source: string): Token[] {
+  const tokens: Token[] = [];
+  let offset = 0;
+  while (offset < source.length) {
+    if (tokens.length >= MAX_TOKENS) {
+      throw new SieveSyntaxError('Script exceeds the parser token limit', source, offset);
+    }
+    const character = source[offset];
+    if (/\s/.test(character)) {
+      offset += 1;
+      continue;
+    }
+    if (character === '#') {
+      const start = offset;
+      offset += 1;
+      const contentStart = offset;
+      while (offset < source.length && source[offset] !== '\r' && source[offset] !== '\n') offset += 1;
+      tokens.push({ type: 'comment', value: source.slice(contentStart, offset).trim(), start, end: offset });
+      continue;
+    }
+    if (source.startsWith('/*', offset)) {
+      const start = offset;
+      const end = source.indexOf('*/', offset + 2);
+      if (end < 0) throw new SieveSyntaxError('Unterminated comment', source, start);
+      tokens.push({
+        type: 'comment',
+        value: source.slice(offset + 2, end).trim(),
+        start,
+        end: end + 2,
+      });
+      offset = end + 2;
+      continue;
+    }
+    if (isMultilineStart(source, offset)) {
+      const token = readMultilineString(source, offset);
+      tokens.push(token);
+      offset = token.end;
+      continue;
+    }
+    if (character === '"') {
+      const token = readQuotedString(source, offset);
+      tokens.push(token);
+      offset = token.end;
+      continue;
+    }
+    if (character === ':') {
+      const start = offset;
+      offset += 1;
+      if (!/[A-Za-z_]/.test(source[offset] ?? '')) {
+        throw new SieveSyntaxError('Invalid tag', source, start);
+      }
+      while (/[A-Za-z0-9_]/.test(source[offset] ?? '')) offset += 1;
+      tokens.push({ type: 'tag', value: source.slice(start, offset), start, end: offset });
+      continue;
+    }
+    if (/[A-Za-z_]/.test(character)) {
+      const start = offset;
+      offset += 1;
+      while (/[A-Za-z0-9_]/.test(source[offset] ?? '')) offset += 1;
+      tokens.push({ type: 'identifier', value: source.slice(start, offset), start, end: offset });
+      continue;
+    }
+    if (/[0-9]/.test(character)) {
+      const start = offset;
+      offset += 1;
+      while (/[0-9]/.test(source[offset] ?? '')) offset += 1;
+      if (/[KkMmGg]/.test(source[offset] ?? '')) offset += 1;
+      tokens.push({ type: 'number', value: source.slice(start, offset), start, end: offset });
+      continue;
+    }
+    if ('[](){},;'.includes(character)) {
+      tokens.push({ type: character as TokenType, value: character, start: offset, end: offset + 1 });
+      offset += 1;
+      continue;
+    }
+    throw new SieveSyntaxError(`Unexpected character “${character}”`, source, offset);
+  }
+  tokens.push({ type: 'eof', value: '', start: source.length, end: source.length });
+  return tokens;
+}
+
+function readQuotedString(source: string, start: number): Token {
+  let offset = start + 1;
+  let value = '';
+  while (offset < source.length) {
+    const character = source[offset];
+    if (character === '"') {
+      return { type: 'string', value, start, end: offset + 1 };
+    }
+    if (character === '\\') {
+      offset += 1;
+      if (offset >= source.length) break;
+      value += source[offset];
+      offset += 1;
+      continue;
+    }
+    if (character === '\0') throw new SieveSyntaxError('NUL is not allowed in a string', source, offset);
+    value += character;
+    offset += 1;
+  }
+  throw new SieveSyntaxError('Unterminated string', source, start);
+}
+
+function isMultilineStart(source: string, offset: number): boolean {
+  if (source.slice(offset, offset + 5).toLowerCase() !== 'text:') return false;
+  const next = source[offset + 5];
+  return next === ' ' || next === '\t' || next === '#' || next === '\r' || next === '\n';
+}
+
+function readMultilineString(source: string, start: number): Token {
+  let offset = start + 5;
+  while (source[offset] === ' ' || source[offset] === '\t') offset += 1;
+  if (source[offset] === '#') {
+    while (offset < source.length && source[offset] !== '\r' && source[offset] !== '\n') offset += 1;
+  }
+  offset = consumeLineBreak(source, offset, start);
+  const lines: string[] = [];
+  while (offset <= source.length) {
+    const lineStart = offset;
+    while (offset < source.length && source[offset] !== '\r' && source[offset] !== '\n') offset += 1;
+    const line = source.slice(lineStart, offset);
+    const afterLine = consumeLineBreak(source, offset, start);
+    if (line === '.') {
+      const value = lines.length === 0 ? '' : `${lines.join('\r\n')}\r\n`;
+      return { type: 'string', value, start, end: afterLine };
+    }
+    lines.push(line.startsWith('..') ? line.slice(1) : line);
+    offset = afterLine;
+  }
+  throw new SieveSyntaxError('Unterminated multi-line string', source, start);
+}
+
+function consumeLineBreak(source: string, offset: number, start: number): number {
+  if (source.startsWith('\r\n', offset)) return offset + 2;
+  if (source[offset] === '\r' || source[offset] === '\n') return offset + 1;
+  throw new SieveSyntaxError('Expected a line break in multi-line string', source, start);
+}
+
+function range(token: Token): SieveSourceRange {
+  return { start: token.start, end: token.end };
+}
diff --git a/src/sieve/rules.ts b/src/sieve/rules.ts
new file mode 100644
index 0000000..bb25d82
--- /dev/null
+++ b/src/sieve/rules.ts
@@ -0,0 +1,904 @@
+import { parseSieve } from './parser';
+import type {
+  SieveCommand, SieveIfStatement, SieveStatement, SieveTest, SieveValue,
+} from './parser';
+
+export const SIEVE_CAPABILITY = 'urn:ietf:params:jmap:sieve';
+export const MANAGED_SCRIPT_NAME = 'Stormbox Mail Rules';
+export const MANAGED_SCRIPT_MARKER = '# stormbox-managed: mail-rules/v2';
+
+const LEGACY_MANAGED_SCRIPT_MARKER = '# stormbox-managed: mail-rules/v1';
+const DATA_PREFIX = '# stormbox-data: ';
+const BASE64URL_ALPHABET = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_';
+const MAX_TEST_DEPTH = 20;
+const MAX_TEST_NODES = 500;
+const VISUAL_REQUIRE_EXTENSIONS = new Set([
+  'copy',
+  'fileinto',
+  'imap4flags',
+  'mailbox',
+  'mailboxid',
+]);
+
+export type RuleMatch = 'all' | 'any';
+export type RuleField = 'from' | 'to' | 'toCc' | 'subject' | 'header';
+export type RuleOperator = 'is' | 'contains' | 'matches';
+
+export interface MailRuleCondition {
+  id: string;
+  type: 'condition';
+  negated: boolean;
+  field: RuleField;
+  operator: RuleOperator;
+  value: string;
+  headerName?: string;
+}
+
+export interface MailRuleConditionGroup {
+  id: string;
+  type: 'group';
+  negated: boolean;
+  match: RuleMatch;
+  conditions: MailRuleTest[];
+}
+
+export type MailRuleTest = MailRuleCondition | MailRuleConditionGroup;
+
+export type MailRuleAction =
+  | { id: string; type: 'move'; mailboxId: string; mailboxName: string }
+  | { id: string; type: 'markRead' }
+  | { id: string; type: 'star' }
+  | { id: string; type: 'redirect'; address: string }
+  | { id: string; type: 'discard' };
+
+export interface MailRule {
+  id: string;
+  name: string;
+  enabled: boolean;
+  match: RuleMatch;
+  conditions: MailRuleTest[];
+  actions: MailRuleAction[];
+  stopProcessing: boolean;
+}
+
+export interface MailRuleDocument {
+  version: 2;
+  rules: MailRule[];
+}
+
+export interface SieveRuleCapabilities {
+  sieveExtensions: string[];
+  maxSizeScript?: number | null;
+  maxNumberRedirects?: number | null;
+}
+
+export interface CompileRulesOptions {
+  managed?: boolean;
+}
+
+export class RuleValidationError extends Error {
+  constructor(message: string) {
+    super(message);
+    this.name = 'RuleValidationError';
+  }
+}
+
+export function emptyRuleDocument(): MailRuleDocument {
+  return { version: 2, rules: [] };
+}
+
+export function newRuleId(prefix = 'rule'): string {
+  const uuid = globalThis.crypto?.randomUUID?.();
+  if (uuid) return `${prefix}-${uuid}`;
+  return `${prefix}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}`;
+}
+
+export function createEmptyRule(): MailRule {
+  return {
+    id: newRuleId(),
+    name: 'New rule',
+    enabled: true,
+    match: 'all',
+    conditions: [{
+      id: newRuleId('condition'),
+      type: 'condition',
+      negated: false,
+      field: 'from',
+      operator: 'contains',
+      value: '',
+    }],
+    actions: [{ id: newRuleId('action'), type: 'markRead' }],
+    stopProcessing: true,
+  };
+}
+
+export function cloneRuleDocument(document: MailRuleDocument): MailRuleDocument {
+  return {
+    version: 2,
+    rules: document.rules.map((rule) => ({
+      ...rule,
+      conditions: rule.conditions.map(cloneRuleTest),
+      actions: rule.actions.map((action) => ({ ...action })),
+    })),
+  };
+}
+
+function cloneRuleTest(test: MailRuleTest): MailRuleTest {
+  if (test.type === 'condition') return { ...test };
+  return { ...test, conditions: test.conditions.map(cloneRuleTest) };
+}
+
+export function normalizeRuleDocument(input: unknown): MailRuleDocument {
+  if (
+    !isRecord(input)
+    || (input.version !== 1 && input.version !== 2)
+    || !Array.isArray(input.rules)
+  ) {
+    throw new RuleValidationError('The managed rule data has an unsupported format.');
+  }
+
+  const seenRuleIds = new Set<string>();
+  const rules = input.rules.map((value, ruleIndex) => {
+    if (!isRecord(value)) {
+      throw new RuleValidationError(`Rule ${ruleIndex + 1} is malformed.`);
+    }
+    const id = requiredId(value.id, `Rule ${ruleIndex + 1}`, seenRuleIds);
+    const name = requiredText(value.name, `Rule ${ruleIndex + 1} needs a name.`);
+    rejectControlCharacters(name, `Rule ${ruleIndex + 1} name`);
+    const match = value.match === 'all' || value.match === 'any' ? value.match : null;
+    if (!match) throw new RuleValidationError(`Rule “${name}” has an invalid match mode.`);
+    if (!Array.isArray(value.conditions) || value.conditions.length === 0) {
+      throw new RuleValidationError(`Rule “${name}” needs at least one condition.`);
+    }
+    if (!Array.isArray(value.actions) || value.actions.length === 0) {
+      throw new RuleValidationError(`Rule “${name}” needs at least one action.`);
+    }
+
+    const testContext = { seenIds: new Set<string>(), nodes: 0 };
+    const conditions = value.conditions.map((condition, conditionIndex) =>
+      normalizeRuleTest(condition, name, `${conditionIndex + 1}`, testContext, 1));
+    const seenActionIds = new Set<string>();
+    const actions = value.actions.map((action, actionIndex) =>
+      normalizeAction(action, name, actionIndex, seenActionIds));
+
+    return {
+      id,
+      name,
+      enabled: value.enabled !== false,
+      match,
+      conditions,
+      actions,
+      stopProcessing: value.stopProcessing === true,
+    } satisfies MailRule;
+  });
+
+  return { version: 2, rules };
+}
+
+export function isManagedRulesScript(script: string): boolean {
+  return script.split(/\r?\n/).some((line) => {
+    const value = line.trimEnd();
+    return value === MANAGED_SCRIPT_MARKER || value === LEGACY_MANAGED_SCRIPT_MARKER;
+  });
+}
+
+/**
+ * Return null for an unmarked script. Version 2 is reconstructed from
+ * executable source; version 1 metadata is retained as a migration path.
+ */
+export function parseManagedRules(script: string): MailRuleDocument | null {
+  if (!isManagedRulesScript(script)) return null;
+  if (script.split(/\r?\n/).some((line) => line.trimEnd() === MANAGED_SCRIPT_MARKER)) {
+    return parseVisualRules(script);
+  }
+  const chunks = script
+    .split(/\r?\n/)
+    .filter((line) => line.startsWith(DATA_PREFIX))
+    .map((line) => line.slice(DATA_PREFIX.length).trim());
+  if (chunks.length === 0 || chunks.some((chunk) => !/^[A-Za-z0-9_-]+$/.test(chunk))) {
+    throw new RuleValidationError('The Stormbox rule metadata is missing or malformed.');
+  }
+  let legacyDocument: MailRuleDocument;
+  try {
+    const json = new TextDecoder().decode(decodeBase64Url(chunks.join('')));
+    legacyDocument = normalizeRuleDocument(JSON.parse(json));
+  } catch (error) {
+    if (error instanceof RuleValidationError) throw error;
+    throw new RuleValidationError('The Stormbox rule metadata could not be decoded.');
+  }
+
+  const executableDocument = parseVisualRules(script);
+  const enabledLegacyDocument: MailRuleDocument = {
+    version: 2,
+    rules: legacyDocument.rules.filter((rule) => rule.enabled),
+  };
+  if (!sameRuleSemantics(enabledLegacyDocument, executableDocument)) {
+    throw new RuleValidationError(
+      'The legacy Stormbox metadata differs from its executable Sieve. Preserve the script and resolve the mismatch before saving.',
+    );
+  }
+  let executableIndex = 0;
+  return normalizeRuleDocument({
+    version: 2,
+    rules: legacyDocument.rules.map((rule) => (
+      rule.enabled ? executableDocument.rules[executableIndex++] : rule
+    )),
+  });
+}
+
+/** Parse any script that can be represented without changing its executable semantics. */
+export function parseRulesSource(script: string): MailRuleDocument {
+  if (!isManagedRulesScript(script)) return parseVisualRules(script);
+  const document = parseManagedRules(script);
+  if (!document) {
+    throw new RuleValidationError('The Stormbox-managed script could not be read.');
+  }
+  return document;
+}
+
+export function parseVisualRules(script: string): MailRuleDocument {
+  const parsed = parseSieve(script);
+  for (const statement of parsed.statements) {
+    if (statement.type !== 'command' || statement.name !== 'require') continue;
+    if (statement.arguments.length !== 1) {
+      throw notVisualizable(script, statement, 'The require command is malformed');
+    }
+    const extensions = stringValues(statement.arguments[0]);
+    const unsupported = extensions.find((extension) =>
+      !VISUAL_REQUIRE_EXTENSIONS.has(extension.toLowerCase()));
+    if (extensions.length === 0 || unsupported) {
+      throw notVisualizable(
+        script,
+        statement,
+        `Required extension “${unsupported ?? 'unknown'}” is not safe to rewrite visually`,
+      );
+    }
+  }
+  const rules: MailRule[] = [];
+  const statements = parsed.statements.filter((statement) =>
+    statement.type !== 'command' || statement.name !== 'require');
+
+  if (
+    statements.length === 1
+    && statements[0].type === 'command'
+    && statements[0].name === 'keep'
+    && statements[0].arguments.length === 0
+  ) return emptyRuleDocument();
+
+  for (const statement of statements) {
+    if (statement.type !== 'if') {
+      throw notVisualizable(script, statement, `Top-level “${statement.name}” is not represented by the visual editor`);
+    }
+    rules.push(ruleFromIf(script, statement, rules.length));
+  }
+
+  return normalizeRuleDocument({ version: 2, rules });
+}
+
+function ruleFromIf(source: string, statement: SieveIfStatement, index: number): MailRule {
+  let visualStatement = statement;
+  let enabled = true;
+  if (isFalseTest(statement.branches[0]?.test)) {
+    const commands = statement.branches[0]?.commands ?? [];
+    if (
+      statement.branches.length !== 1
+      || statement.elseCommands
+      || commands.length !== 1
+      || commands[0].type !== 'if'
+    ) {
+      throw notVisualizable(source, statement, 'This false branch is not a generated disabled rule');
+    }
+    enabled = false;
+    visualStatement = commands[0];
+  }
+
+  if (visualStatement.branches.length !== 1 || visualStatement.elseCommands) {
+    throw notVisualizable(source, visualStatement, 'elsif and else branches are not represented yet');
+  }
+
+  const root = testFromSieve(source, visualStatement.branches[0].test);
+  const { actions, stopProcessing } = actionsFromCommands(
+    source,
+    visualStatement.branches[0].commands,
+  );
+  const label = ruleLabel(statement.comments, index, enabled);
+  return {
+    id: newRuleId(),
+    name: label,
+    enabled,
+    match: root.type === 'group' && !root.negated ? root.match : 'all',
+    conditions: root.type === 'group' && !root.negated ? root.conditions : [root],
+    actions,
+    stopProcessing,
+  };
+}
+
+function testFromSieve(source: string, test: SieveTest): MailRuleTest {
+  if (test.type === 'not') {
+    const visual = testFromSieve(source, test.test);
+    visual.negated = !visual.negated;
+    return visual;
+  }
+  if (test.type === 'allof' || test.type === 'anyof') {
+    return {
+      id: newRuleId('group'),
+      type: 'group',
+      negated: false,
+      match: test.type === 'allof' ? 'all' : 'any',
+      conditions: test.tests.map((child) => testFromSieve(source, child)),
+    };
+  }
+  if (test.type !== 'call') {
+    throw notVisualizable(source, test, `Test “${test.type}” is not represented by the visual editor`);
+  }
+
+  if (!['address', 'header'].includes(test.name)) {
+    throw notVisualizable(source, test, `Test “${test.name}” is not represented by the visual editor`);
+  }
+  const { operator, positional } = visualMatchArguments(source, test);
+
+  const headers = stringValues(positional[0]);
+  const values = stringValues(positional[1]);
+  if (headers.length === 0 || values.length === 0) {
+    throw notVisualizable(source, test, `Test “${test.name}” has unsupported header or value lists`);
+  }
+  const normalizedHeaders = headers.map((header) => header.toLowerCase());
+  let targets: Array<{ field: RuleField; headerName?: string }>;
+  if (
+    test.name === 'address'
+    && normalizedHeaders.length === 2
+    && normalizedHeaders.includes('to')
+    && normalizedHeaders.includes('cc')
+  ) {
+    targets = [{ field: 'toCc' }];
+  } else if (test.name === 'address' && normalizedHeaders.every((header) => ['from', 'to'].includes(header))) {
+    targets = normalizedHeaders.map((header) => ({ field: header as 'from' | 'to' }));
+  } else if (test.name === 'header') {
+    targets = headers.map((header, index) => (
+      normalizedHeaders[index] === 'subject'
+        ? { field: 'subject' }
+        : { field: 'header', headerName: header }
+    ));
+  } else {
+    throw notVisualizable(source, test, `Test “${test.name}” targets headers the visual editor cannot combine`);
+  }
+
+  const conditions = targets.flatMap((target) => values.map<MailRuleCondition>((value) => ({
+    id: newRuleId('condition'),
+    type: 'condition',
+    negated: false,
+    field: target.field,
+    operator,
+    value,
+    ...(target.headerName ? { headerName: target.headerName } : {}),
+  })));
+  if (conditions.length === 1) return conditions[0];
+  return {
+    id: newRuleId('group'),
+    type: 'group',
+    negated: false,
+    match: 'any',
+    conditions,
+  };
+}
+
+function visualMatchArguments(
+  source: string,
+  test: Extract<SieveTest, { type: 'call' }>,
+): { operator: RuleOperator; positional: SieveValue[] } {
+  let operator: RuleOperator = 'is';
+  let matchTypeSeen = false;
+  let comparatorSeen = false;
+  let addressPartSeen = false;
+  let index = 0;
+
+  while (true) {
+    const argument = test.arguments[index];
+    if (argument?.type !== 'tag') break;
+    const tag = argument.value;
+    if ([':is', ':contains', ':matches'].includes(tag)) {
+      if (matchTypeSeen) {
+        throw notVisualizable(source, test, `Test “${test.name}” has more than one match type`);
+      }
+      matchTypeSeen = true;
+      operator = tag.slice(1) as RuleOperator;
+      index += 1;
+      continue;
+    }
+    if (tag === ':comparator') {
+      const comparator = test.arguments[index + 1];
+      if (
+        comparatorSeen
+        || comparator?.type !== 'string'
+        || comparator.value.toLowerCase() !== 'i;ascii-casemap'
+      ) {
+        throw notVisualizable(source, test, `Test “${test.name}” uses an unsupported comparator`);
+      }
+      comparatorSeen = true;
+      index += 2;
+      continue;
+    }
+    if (test.name === 'address' && tag === ':all') {
+      if (addressPartSeen) {
+        throw notVisualizable(source, test, 'The address test has more than one address part');
+      }
+      addressPartSeen = true;
+      index += 1;
+      continue;
+    }
+    throw notVisualizable(source, test, `Test “${test.name}” uses unsupported match arguments`);
+  }
+
+  const positional = test.arguments.slice(index);
+  if (positional.length !== 2 || positional.some((value) => value.type === 'tag')) {
+    throw notVisualizable(source, test, `Test “${test.name}” uses unsupported match arguments`);
+  }
+  return { operator, positional };
+}
+
+function actionsFromCommands(
+  source: string,
+  commands: SieveStatement[],
+): { actions: MailRuleAction[]; stopProcessing: boolean } {
+  const actions: MailRuleAction[] = [];
+  let stopProcessing = false;
+  commands.forEach((command, index) => {
+    if (command.type !== 'command') {
+      throw notVisualizable(source, command, 'Nested control blocks are not represented as rule actions');
+    }
+    if (command.name === 'stop') {
+      if (command.arguments.length > 0 || index !== commands.length - 1) {
+        throw notVisualizable(source, command, 'stop must be the final action in a visual rule');
+      }
+      stopProcessing = true;
+      return;
+    }
+    actions.push(...actionsFromCommand(source, command));
+  });
+  if (actions.length === 0) {
+    throw notVisualizable(source, commands[0], 'A visual rule needs at least one supported action');
+  }
+  return { actions, stopProcessing };
+}
+
+function actionsFromCommand(source: string, command: SieveCommand): MailRuleAction[] {
+  const tags = command.arguments.filter((value) => value.type === 'tag').map((value) => value.value);
+  const positional = command.arguments.filter((value) => value.type !== 'tag');
+  if (command.name === 'discard' && tags.length === 0 && positional.length === 0) {
+    return [{ id: newRuleId('action'), type: 'discard' }];
+  }
+  if (command.name === 'fileinto' && tags.every((tag) => tag === ':mailboxid')) {
+    const strings = positional.flatMap(stringValues);
+    if (tags.length === 0 && strings.length === 1) {
+      return [{
+        id: newRuleId('action'), type: 'move', mailboxId: '', mailboxName: strings[0],
+      }];
+    }
+    if (tags.length === 1 && strings.length === 2) {
+      return [{
+        id: newRuleId('action'), type: 'move', mailboxId: strings[0], mailboxName: strings[1],
+      }];
+    }
+  }
+  if (command.name === 'addflag' && tags.length === 0 && positional.length === 1) {
+    const flags = stringValues(positional[0]);
+    if (flags.length > 0 && flags.every((flag) => ['\\seen', '\\flagged'].includes(flag.toLowerCase()))) {
+      return flags.map<MailRuleAction>((flag) => ({
+        id: newRuleId('action'),
+        type: flag.toLowerCase() === '\\seen' ? 'markRead' : 'star',
+      }));
+    }
+  }
+  if (command.name === 'redirect' && tags.length === 1 && tags[0] === ':copy' && positional.length === 1) {
+    const addresses = stringValues(positional[0]);
+    if (addresses.length === 1) {
+      return [{ id: newRuleId('action'), type: 'redirect', address: addresses[0] }];
+    }
+  }
+  throw notVisualizable(source, command, `Action “${command.name}” is not represented by the visual editor`);
+}
+
+function stringValues(value: SieveValue): string[] {
+  if (value.type === 'string') return [value.value];
+  if (value.type === 'stringList') return value.values;
+  return [];
+}
+
+function isFalseTest(test: SieveTest | undefined): boolean {
+  return test?.type === 'call' && test.name === 'false' && test.arguments.length === 0;
+}
+
+function ruleLabel(comments: string[], index: number, enabled: boolean): string {
+  const prefixes = enabled ? [/^Rule:\s*(.+)$/i] : [/^Disabled rule:\s*(.+)$/i, /^Rule:\s*(.+)$/i];
+  for (const comment of [...comments].reverse()) {
+    for (const pattern of prefixes) {
+      const match = comment.match(pattern);
+      if (match?.[1]?.trim()) return match[1].trim();
+    }
+  }
+  return `Rule ${index + 1}`;
+}
+
+function notVisualizable(
+  source: string,
+  node: { range: { start: number } } | undefined,
+  message: string,
+): RuleValidationError {
+  const offset = node?.range.start ?? 0;
+  const before = source.slice(0, offset);
+  const line = before.split(/\r\n|\r|\n/).length;
+  return new RuleValidationError(`${message} at line ${line}.`);
+}
+
+export function compileRules(
+  input: unknown,
+  capabilities: SieveRuleCapabilities,
+  { managed = true }: CompileRulesOptions = {},
+): string {
+  const document = normalizeRuleDocument(input);
+  validateRedirectBudget(document, capabilities.maxNumberRedirects);
+  const extensions = new Set(capabilities.sieveExtensions ?? []);
+  const required = new Set<string>();
+  const blocks: string[] = [];
+
+  for (const rule of document.rules) {
+    const test = compileRuleTest(rule);
+    const actionLines = rule.actions.map((action) =>
+      `  ${compileAction(action, extensions, required)}`);
+    if (rule.stopProcessing) actionLines.push('  stop;');
+    const label = rule.name.replace(/[\r\n]+/g, ' ').trim();
+    const ruleBlock = [`if ${test} {`, ...actionLines, '}'];
+    if (rule.enabled) {
+      blocks.push([`# Rule: ${label}`, ...ruleBlock].join('\r\n'));
+    } else {
+      blocks.push([
+        `# Disabled rule: ${label}`,
+        'if false {',
+        ...ruleBlock.map((line) => `  ${line}`),
+        '}',
+      ].join('\r\n'));
+    }
+  }
+
+  const lines = [
+    '# Stormbox-compatible mail rules. The Sieve source is authoritative.',
+    ...(managed ? [MANAGED_SCRIPT_MARKER] : []),
+    '',
+  ];
+  if (required.size > 0) {
+    lines.push(`require [${[...required].sort().map(sieveString).join(', ')}];`, '');
+  }
+  if (blocks.length > 0) {
+    lines.push(blocks.join('\r\n\r\n'));
+  } else {
+    lines.push('# No enabled rules.', 'keep;');
+  }
+  lines.push('', '# End Stormbox managed mail rules.', '');
+  const script = lines.join('\r\n');
+  const maxSize = capabilities.maxSizeScript;
+  if (typeof maxSize === 'number' && maxSize >= 0) {
+    const size = new TextEncoder().encode(script).byteLength;
+    if (size > maxSize) {
+      throw new RuleValidationError(`The generated script is ${size} bytes; the server limit is ${maxSize}.`);
+    }
+  }
+  return script;
+}
+
+function validateRedirectBudget(document: MailRuleDocument, limit: number | null | undefined): void {
+  if (typeof limit !== 'number' || !Number.isFinite(limit) || limit < 0) return;
+
+  let redirectsOnContinuingPath = 0;
+  let maximumRedirects = 0;
+  for (const rule of document.rules) {
+    if (!rule.enabled) continue;
+    const redirectsInRule = rule.actions.filter((action) => action.type === 'redirect').length;
+    maximumRedirects = Math.max(maximumRedirects, redirectsOnContinuingPath + redirectsInRule);
+    // A matching stop rule terminates that path. Only the non-matching
+    // path can reach later rules, so its redirects do not accumulate.
+    if (!rule.stopProcessing) redirectsOnContinuingPath += redirectsInRule;
+  }
+
+  if (maximumRedirects > limit) {
+    throw new RuleValidationError(
+      `The rules can redirect ${maximumRedirects} messages in one evaluation; the server limit is ${limit}.`,
+    );
+  }
+}
+
+export function uniqueManagedScriptName(existingNames: Iterable<string | null | undefined>): string {
+  const names = new Set([...existingNames].filter((name): name is string => Boolean(name)));
+  if (!names.has(MANAGED_SCRIPT_NAME)) return MANAGED_SCRIPT_NAME;
+  for (let suffix = 2; suffix < 10_000; suffix += 1) {
+    const candidate = `${MANAGED_SCRIPT_NAME} ${suffix}`;
+    if (!names.has(candidate)) return candidate;
+  }
+  throw new RuleValidationError('Could not choose a unique managed script name.');
+}
+
+function normalizeRuleTest(
+  input: unknown,
+  ruleName: string,
+  path: string,
+  context: { seenIds: Set<string>; nodes: number },
+  depth: number,
+): MailRuleTest {
+  if (!isRecord(input)) {
+    throw new RuleValidationError(`Condition ${path} in “${ruleName}” is malformed.`);
+  }
+  context.nodes += 1;
+  if (context.nodes > MAX_TEST_NODES) {
+    throw new RuleValidationError(`Rule “${ruleName}” has more than ${MAX_TEST_NODES} conditions and groups.`);
+  }
+  if (depth > MAX_TEST_DEPTH) {
+    throw new RuleValidationError(`Rule “${ruleName}” has condition groups nested more than ${MAX_TEST_DEPTH} levels.`);
+  }
+
+  if (input.type === 'group') {
+    const id = requiredId(input.id, `Condition group ${path} in “${ruleName}”`, context.seenIds);
+    const match = input.match === 'all' || input.match === 'any' ? input.match : null;
+    if (!match || !Array.isArray(input.conditions) || input.conditions.length === 0) {
+      throw new RuleValidationError(`Condition group ${path} in “${ruleName}” is malformed.`);
+    }
+    return {
+      id,
+      type: 'group',
+      negated: input.negated === true,
+      match,
+      conditions: input.conditions.map((condition, index) =>
+        normalizeRuleTest(condition, ruleName, `${path}.${index + 1}`, context, depth + 1)),
+    };
+  }
+
+  const field = ['from', 'to', 'toCc', 'subject', 'header'].includes(String(input.field))
+    ? input.field as RuleField
+    : null;
+  const operator = ['is', 'contains', 'matches'].includes(String(input.operator))
+    ? input.operator as RuleOperator
+    : null;
+  if (!field || !operator) {
+    throw new RuleValidationError(`Condition ${path} in “${ruleName}” is not supported.`);
+  }
+  const value = requiredSieveText(
+    input.value,
+    `Condition ${path} in “${ruleName}” needs a value.`,
+  );
+  rejectControlCharacters(value, `Condition ${path} in “${ruleName}”`);
+  const condition: MailRuleCondition = {
+    id: requiredId(input.id, `Condition ${path} in “${ruleName}”`, context.seenIds),
+    type: 'condition',
+    negated: input.negated === true,
+    field,
+    operator,
+    value,
+  };
+  if (field === 'header') {
+    const headerName = requiredSieveText(
+      input.headerName,
+      `Custom header condition ${path} in “${ruleName}” needs a header name.`,
+    );
+    if (!/^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/.test(headerName)) {
+      throw new RuleValidationError(`“${headerName}” is not a valid header field name.`);
+    }
+    condition.headerName = headerName;
+  }
+  return condition;
+}
+
+function normalizeAction(
+  input: unknown,
+  ruleName: string,
+  index: number,
+  seenIds: Set<string>,
+): MailRuleAction {
+  if (!isRecord(input)) {
+    throw new RuleValidationError(`Action ${index + 1} in “${ruleName}” is malformed.`);
+  }
+  const id = requiredId(input.id, `Action ${index + 1} in “${ruleName}”`, seenIds);
+  switch (input.type) {
+    case 'move': {
+      const mailboxId = typeof input.mailboxId === 'string' ? input.mailboxId : '';
+      const mailboxName = requiredSieveText(
+        input.mailboxName,
+        `Move action ${index + 1} in “${ruleName}” needs a folder fallback name.`,
+      );
+      rejectControlCharacters(mailboxId, `Move action ${index + 1} in “${ruleName}”`);
+      rejectControlCharacters(mailboxName, `Move action ${index + 1} in “${ruleName}”`);
+      return { id, type: 'move', mailboxId, mailboxName };
+    }
+    case 'redirect': {
+      const address = requiredSieveText(
+        input.address,
+        `Forward action ${index + 1} in “${ruleName}” needs an email address.`,
+      );
+      rejectControlCharacters(address, `Forward action ${index + 1} in “${ruleName}”`);
+      if (!/^[^\s@]+@[^\s@]+$/.test(address)) {
+        throw new RuleValidationError(`“${address}” is not a valid forwarding address.`);
+      }
+      return { id, type: 'redirect', address };
+    }
+    case 'markRead':
+    case 'star':
+    case 'discard':
+      return { id, type: input.type };
+    default:
+      throw new RuleValidationError(`Action ${index + 1} in “${ruleName}” is not supported.`);
+  }
+}
+
+function compileRuleTest(rule: MailRule): string {
+  return compileTestGroup(rule.match, rule.conditions, false);
+}
+
+function compileRuleTestNode(test: MailRuleTest): string {
+  if (test.type === 'group') {
+    return compileTestGroup(test.match, test.conditions, test.negated);
+  }
+  const compiled = compileCondition(test);
+  return test.negated ? `not ${compiled}` : compiled;
+}
+
+function compileTestGroup(match: RuleMatch, tests: MailRuleTest[], negated: boolean): string {
+  const compiled = tests.map(compileRuleTestNode);
+  const expression = compiled.length === 1
+    ? compiled[0]
+    : `${match === 'all' ? 'allof' : 'anyof'} (${compiled.join(', ')})`;
+  return negated ? `not ${expression}` : expression;
+}
+
+function compileCondition(condition: MailRuleCondition): string {
+  const match = `:${condition.operator}`;
+  const value = sieveString(condition.value);
+  switch (condition.field) {
+    case 'from':
+      return `address ${match} "From" ${value}`;
+    case 'to':
+      return `address ${match} "To" ${value}`;
+    case 'toCc':
+      return `address ${match} ["To", "Cc"] ${value}`;
+    case 'subject':
+      return `header ${match} "Subject" ${value}`;
+    case 'header':
+      return `header ${match} ${sieveString(condition.headerName ?? '')} ${value}`;
+  }
+}
+
+function compileAction(
+  action: MailRuleAction,
+  extensions: ReadonlySet<string>,
+  required: Set<string>,
+): string {
+  switch (action.type) {
+    case 'move':
+      requireExtension('fileinto', extensions, required, 'Moving messages');
+      if (action.mailboxId && extensions.has('mailboxid')) {
+        required.add('mailboxid');
+        // Stalwart currently checks :mailboxid against the RFC 5490 "mailbox"
+        // capability as well. Declare it when advertised so its authoritative
+        // SieveScript/validate call accepts an otherwise RFC 9042 script.
+        if (extensions.has('mailbox')) required.add('mailbox');
+        return `fileinto :mailboxid ${sieveString(action.mailboxId)} ${sieveString(action.mailboxName)};`;
+      }
+      return `fileinto ${sieveString(action.mailboxName)};`;
+    case 'markRead':
+      requireExtension('imap4flags', extensions, required, 'Marking messages as read');
+      return 'addflag "\\\\Seen";';
+    case 'star':
+      requireExtension('imap4flags', extensions, required, 'Starring messages');
+      return 'addflag "\\\\Flagged";';
+    case 'redirect':
+      requireExtension('copy', extensions, required, 'Forwarding a copy');
+      return `redirect :copy ${sieveString(action.address)};`;
+    case 'discard':
+      return 'discard;';
+  }
+}
+
+function requireExtension(
+  extension: string,
+  available: ReadonlySet<string>,
+  required: Set<string>,
+  action: string,
+): void {
+  if (!available.has(extension)) {
+    throw new RuleValidationError(`${action} requires the server’s “${extension}” Sieve extension.`);
+  }
+  required.add(extension);
+}
+
+function sieveString(value: string): string {
+  rejectControlCharacters(value, 'Sieve value');
+  return `"${value.replace(/\\/g, '\\\\').replace(/"/g, '\\"')}"`;
+}
+
+function requiredText(value: unknown, message: string): string {
+  if (typeof value !== 'string' || value.trim().length === 0) {
+    throw new RuleValidationError(message);
+  }
+  return value.trim();
+}
+
+function requiredSieveText(value: unknown, message: string): string {
+  if (typeof value !== 'string' || value.length === 0) {
+    throw new RuleValidationError(message);
+  }
+  return value;
+}
+
+function requiredId(value: unknown, label: string, seen: Set<string>): string {
+  const id = requiredText(value, `${label} needs an identifier.`);
+  if (seen.has(id)) throw new RuleValidationError(`${label} has a duplicate identifier.`);
+  seen.add(id);
+  return id;
+}
+
+function rejectControlCharacters(value: string, label: string): void {
+  if (/[\u0000-\u001f\u007f-\u009f\u2028\u2029]/.test(value)) {
+    throw new RuleValidationError(`${label} contains a line break or control character.`);
+  }
+}
+
+function decodeBase64Url(value: string): Uint8Array {
+  if (value.length % 4 === 1) throw new Error('invalid base64url length');
+  const bytes: number[] = [];
+  let buffer = 0;
+  let bits = 0;
+  for (const character of value) {
+    const index = BASE64URL_ALPHABET.indexOf(character);
+    if (index < 0) throw new Error('invalid base64url character');
+    buffer = (buffer << 6) | index;
+    bits += 6;
+    if (bits >= 8) {
+      bits -= 8;
+      bytes.push((buffer >> bits) & 0xff);
+      buffer &= (1 << bits) - 1;
+    }
+  }
+  return new Uint8Array(bytes);
+}
+
+function sameRuleSemantics(left: MailRuleDocument, right: MailRuleDocument): boolean {
+  return left.rules.length === right.rules.length
+    && left.rules.every((rule, index) => sameRule(rule, right.rules[index]));
+}
+
+function sameRule(left: MailRule, right: MailRule): boolean {
+  return left.name === right.name
+    && left.enabled === right.enabled
+    && (left.conditions.length < 2 || left.match === right.match)
+    && left.stopProcessing === right.stopProcessing
+    && left.conditions.length === right.conditions.length
+    && left.conditions.every((test, index) => sameTest(test, right.conditions[index]))
+    && left.actions.length === right.actions.length
+    && left.actions.every((action, index) => sameAction(action, right.actions[index]));
+}
+
+function sameTest(left: MailRuleTest, right: MailRuleTest): boolean {
+  if (left.type !== right.type || left.negated !== right.negated) return false;
+  if (left.type === 'condition' && right.type === 'condition') {
+    return left.field === right.field
+      && left.operator === right.operator
+      && left.value === right.value
+      && left.headerName === right.headerName;
+  }
+  if (left.type !== 'group' || right.type !== 'group') return false;
+  return left.match === right.match
+    && left.conditions.length === right.conditions.length
+    && left.conditions.every((test, index) => sameTest(test, right.conditions[index]));
+}
+
+function sameAction(left: MailRuleAction, right: MailRuleAction): boolean {
+  if (left.type !== right.type) return false;
+  if (left.type === 'move' && right.type === 'move') {
+    return left.mailboxName === right.mailboxName
+      && (!left.mailboxId || !right.mailboxId || left.mailboxId === right.mailboxId);
+  }
+  if (left.type === 'redirect' && right.type === 'redirect') {
+    return left.address === right.address;
+  }
+  return true;
+}
+
+function isRecord(value: unknown): value is Record<string, any> {
+  return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
diff --git a/src/stores/rules-store.ts b/src/stores/rules-store.ts
new file mode 100644
index 0000000..9dde87e
--- /dev/null
+++ b/src/stores/rules-store.ts
@@ -0,0 +1,204 @@
+import { defineStore } from 'pinia';
+import { computed, ref } from 'vue';
+
+import { getRepositoryAsync } from '../composables/useRepository';
+import { MUTATION_TYPE } from '../constants/states';
+import {
+  cloneRuleDocument,
+  compileRules,
+  emptyRuleDocument,
+  normalizeRuleDocument,
+} from '../sieve/rules';
+import type { MailRuleDocument, SieveRuleCapabilities } from '../sieve/rules';
+import { useAuthStore } from './auth-store';
+
+interface RuleScriptSummary {
+  id: string;
+  name: string | null;
+  isActive?: boolean;
+}
+
+export interface MailRulesSnapshot {
+  supported: boolean;
+  accountId: string | null;
+  state: string | null;
+  capabilities: SieveRuleCapabilities;
+  scripts: RuleScriptSummary[];
+  managedScript: RuleScriptSummary | null;
+  editableScript: RuleScriptSummary | null;
+  source: string;
+  document: MailRuleDocument;
+  visualizationError: string | null;
+  parseError: string | null;
+}
+
+export class MailRulesSaveError extends Error {
+  code: string;
+  detail: any;
+
+  constructor(code: string, message: string, detail: any = null) {
+    super(message);
+    this.name = 'MailRulesSaveError';
+    this.code = code;
+    this.detail = detail;
+  }
+}
+
+export const useRulesStore = defineStore('rules', () => {
+  const authStore = useAuthStore();
+  const loading = ref(false);
+  const saving = ref(false);
+  const error = ref<string | null>(null);
+  const snapshot = ref<MailRulesSnapshot | null>(null);
+
+  const supported = computed(() => snapshot.value?.supported === true);
+  const capabilities = computed<SieveRuleCapabilities>(() =>
+    snapshot.value?.capabilities ?? { sieveExtensions: [] });
+
+  async function load(): Promise<MailRulesSnapshot> {
+    if (authStore.accountId == null) {
+      throw new MailRulesSaveError('notConnected', 'Sign in before managing mail rules.');
+    }
+    loading.value = true;
+    error.value = null;
+    try {
+      const repo = await getRepositoryAsync();
+      const result = await repo.getMailRules(authStore.accountId) as MailRulesSnapshot;
+      snapshot.value = {
+        ...result,
+        document: normalizeRuleDocument(result?.document ?? emptyRuleDocument()),
+      };
+      return snapshot.value;
+    } catch (cause) {
+      error.value = errorMessage(cause);
+      throw cause;
+    } finally {
+      loading.value = false;
+    }
+  }
+
+  async function save(input: MailRuleDocument): Promise<MailRulesSnapshot> {
+    const current = await requireWritableSnapshot();
+    const document = normalizeRuleDocument(input);
+    // Give immediate editor feedback; the SharedWorker compiles again
+    // against a freshly fetched capability snapshot before uploading.
+    compileRules(document, current.capabilities, {
+      managed: current.managedScript !== null || current.editableScript === null,
+    });
+    return persist({ mode: 'visual', document }, current);
+  }
+
+  async function saveSource(source: string): Promise<MailRulesSnapshot> {
+    const current = await requireWritableSnapshot();
+    const size = new TextEncoder().encode(source).byteLength;
+    if (
+      typeof current.capabilities.maxSizeScript === 'number'
+      && size > current.capabilities.maxSizeScript
+    ) {
+      throw new MailRulesSaveError(
+        'invalidSieve',
+        `The script is ${size} bytes; the server limit is ${current.capabilities.maxSizeScript}.`,
+      );
+    }
+    return persist({ mode: 'source', source }, current);
+  }
+
+  async function requireWritableSnapshot(): Promise<MailRulesSnapshot> {
+    if (authStore.accountId == null) {
+      throw new MailRulesSaveError('notConnected', 'Sign in before saving mail rules.');
+    }
+    if (!snapshot.value) await load();
+    if (!snapshot.value?.supported) {
+      throw new MailRulesSaveError('sieveUnsupported', 'This account does not support JMAP for Sieve.');
+    }
+    if (snapshot.value.parseError) {
+      throw new MailRulesSaveError('managedScriptUnreadable', snapshot.value.parseError);
+    }
+    return snapshot.value;
+  }
+
+  async function persist(
+    request: Record<string, unknown>,
+    current: MailRulesSnapshot,
+  ): Promise<MailRulesSnapshot> {
+    const accountId = authStore.accountId;
+    if (accountId == null) {
+      throw new MailRulesSaveError('notConnected', 'Sign in before saving mail rules.');
+    }
+    saving.value = true;
+    error.value = null;
+    try {
+      const repo = await getRepositoryAsync();
+      const inserted = await repo.insertPendingMutation({
+        accountId,
+        mutationType: MUTATION_TYPE.SET_SIEVE_RULES,
+        targetMessageId: null,
+        requestJson: JSON.stringify({
+          ...request,
+          expectedState: current.state,
+        }),
+        optimisticPatchJson: null,
+      });
+      const outcome = await repo.runMutation(accountId, inserted.id);
+      if ((outcome?.failed ?? 0) > 0) {
+        const row = await repo.getPendingMutationError(inserted.id);
+        const detail = parseErrorJson(row?.error_json);
+        const code = detail?.type ?? 'saveFailed';
+        throw new MailRulesSaveError(
+          code,
+          detail?.message ?? 'The server did not save the mail rules.',
+          detail?.result ?? detail,
+        );
+      }
+      return await load();
+    } catch (cause) {
+      error.value = errorMessage(cause);
+      throw cause;
+    } finally {
+      saving.value = false;
+    }
+  }
+
+  function freshDocument(): MailRuleDocument {
+    return cloneRuleDocument(snapshot.value?.document ?? emptyRuleDocument());
+  }
+
+  function freshSource(): string {
+    return snapshot.value?.source ?? '';
+  }
+
+  function $reset() {
+    loading.value = false;
+    saving.value = false;
+    error.value = null;
+    snapshot.value = null;
+  }
+
+  return {
+    loading,
+    saving,
+    error,
+    snapshot,
+    supported,
+    capabilities,
+    load,
+    save,
+    saveSource,
+    freshDocument,
+    freshSource,
+    $reset,
+  };
+});
+
+function parseErrorJson(value: unknown): any {
+  if (typeof value !== 'string' || value.length === 0) return null;
+  try {
+    return JSON.parse(value);
+  } catch {
+    return null;
+  }
+}
+
+function errorMessage(error: unknown): string {
+  return error instanceof Error ? error.message : String(error);
+}
diff --git a/src/sync/backends/jmap/backend.ts b/src/sync/backends/jmap/backend.ts
index 47902ed..4845990 100644
--- a/src/sync/backends/jmap/backend.ts
+++ b/src/sync/backends/jmap/backend.ts
@@ -61,6 +61,7 @@ import { attachmentTransferLimits, maxObjectsInGet } from './limits';
 import { bytesToBase64 } from '../../../utils/inline-images';
 import { addressKey } from '../../../utils/address-key';
 import { createContactUid } from '../../../utils/contact-uid';
+import { getMailRules } from './sieve';
 
 const SUBSCRIBED_TYPES = [
   'Mailbox',
@@ -1503,6 +1504,14 @@ export class JmapBackend {
     return { considered: recipients.size, alreadyImported: false, deferred: false };
   }
 
+  async getMailRules() {
+    return getMailRules({
+      transport: this.transport,
+      account: this.account,
+      useWebSocket: this._wsReady(),
+    });
+  }
+
   async drainOutbox() {
     if (!this.outboxRunner) {
       return { attempted: 0, succeeded: 0, failed: 0 };
diff --git a/src/sync/backends/jmap/outbox/index.ts b/src/sync/backends/jmap/outbox/index.ts
index 53c5b91..f63f430 100644
--- a/src/sync/backends/jmap/outbox/index.ts
+++ b/src/sync/backends/jmap/outbox/index.ts
@@ -28,6 +28,8 @@
  *                      Identity/set writes with authoritative read-back
  *   'createAddressbook' / 'updateAddressbook' / 'destroyAddressbook'
  *                      AddressBook/set writes with authoritative inventory
+ *   'setSieveRules'    SieveScript upload, validation, and activation
+ *                      through JMAP for Sieve (RFC 9661)
  *
  * Move and destroy delegate the cache effect to the protocol-neutral
  * OUTBOX_APPLY_MOVE_BATCH / OUTBOX_APPLY_DESTROY_BATCH DB handlers,
@@ -90,6 +92,7 @@ import { runPushSettings } from './operations/settings';
 import { runPushContactsTrash } from './operations/contacts-trash';
 import { runUpdateMailbox } from './operations/update-mailbox';
 import { toProcessResult } from './send-outcome';
+import { runSetSieveRules } from '../sieve';
 
 export { applySendLocally } from './send-apply';
 export { MUTATION_TYPES };
@@ -173,7 +176,19 @@ export async function processMutationRow({
       })
     : [];
   const currentRow = currentRows[0] ?? row;
-  const request = JSON.parse(currentRow.request_json);
+  let request;
+  try {
+    request = JSON.parse(currentRow.request_json);
+  } catch {
+    return {
+      ok: false,
+      error: {
+        type: 'invalidArguments',
+        message: 'The durable mutation payload is not valid JSON.',
+        terminal: true,
+      },
+    };
+  }
   switch (currentRow.mutation_type) {
     case MUTATION_TYPES.SET_KEYWORDS:
       return runSetKeywords({ transport, handlers, row, request, useWebSocket });
@@ -256,6 +271,8 @@ export async function processMutationRow({
       return runPushSettings({ transport, account, handlers, useWebSocket });
     case MUTATION_TYPES.PUSH_CONTACTS_TRASH:
       return runPushContactsTrash({ transport, account, handlers, useWebSocket });
+    case MUTATION_TYPES.SET_SIEVE_RULES:
+      return runSetSieveRules({ transport, account, request, useWebSocket });
     default:
       return {
         ok: false,
diff --git a/src/sync/backends/jmap/sieve.ts b/src/sync/backends/jmap/sieve.ts
new file mode 100644
index 0000000..d061926
--- /dev/null
+++ b/src/sync/backends/jmap/sieve.ts
@@ -0,0 +1,376 @@
+import {
+  compileRules,
+  emptyRuleDocument,
+  isManagedRulesScript,
+  MANAGED_SCRIPT_NAME,
+  normalizeRuleDocument,
+  parseRulesSource,
+  RuleValidationError,
+  SIEVE_CAPABILITY,
+  uniqueManagedScriptName,
+} from '../../../sieve/rules';
+import type { MailRuleDocument, SieveRuleCapabilities } from '../../../sieve/rules';
+import { JMAP_CAPS } from './transport';
+import { callJmap, pickResponse, requireResponse } from './invoke';
+
+interface SieveScriptRecord {
+  id: string;
+  name: string | null;
+  blobId: string;
+  isActive: boolean;
+}
+
+export interface MailRulesSnapshot {
+  supported: boolean;
+  accountId: string | null;
+  state: string | null;
+  capabilities: SieveRuleCapabilities;
+  scripts: Array<{ id: string; name: string | null; isActive: boolean }>;
+  managedScript: { id: string; name: string | null; isActive: boolean } | null;
+  editableScript: { id: string; name: string | null; isActive: boolean } | null;
+  source: string;
+  document: MailRuleDocument;
+  visualizationError: string | null;
+  parseError: string | null;
+}
+
+interface SieveContext {
+  accountId: string;
+  capabilities: SieveRuleCapabilities;
+}
+
+export async function getMailRules({
+  transport,
+  account,
+  useWebSocket = false,
+}: {
+  transport: any;
+  account: { remote_account_id: string };
+  useWebSocket?: boolean;
+}): Promise<MailRulesSnapshot> {
+  const context = await sieveContext(transport, account);
+  if (!context) return unsupportedSnapshot();
+
+  const raw = await callJmap(transport, {
+    using: [JMAP_CAPS.CORE, JMAP_CAPS.SIEVE],
+    methodCalls: [['SieveScript/get', {
+      accountId: context.accountId,
+      ids: null,
+      properties: ['id', 'name', 'blobId', 'isActive'],
+    }, 'sieve-get']],
+    useWebSocket,
+  });
+  const response = requireResponse(raw, 'SieveScript/get');
+  const scripts = normalizeScriptList(response.list);
+  const sources = new Map<string, string>();
+
+  for (const script of scripts) {
+    const bytes = await transport.download({
+      accountId: context.accountId,
+      blobId: script.blobId,
+      type: 'application/sieve',
+      name: `${script.name || 'script'}.siv`,
+    });
+    const source = new TextDecoder().decode(bytes);
+    sources.set(script.id, source);
+  }
+
+  const active = scripts.find((script) => script.isActive) ?? null;
+  const managed = scripts.filter((script) =>
+    isManagedRulesScript(sources.get(script.id) ?? ''));
+  let parseError: string | null = null;
+  let selected = active;
+  if (!selected && managed.length > 1) {
+    parseError = 'More than one Stormbox-managed rule script exists. Resolve the duplicate scripts before saving.';
+  } else if (!selected) {
+    selected = managed[0] ?? null;
+  }
+
+  const source = selected ? (sources.get(selected.id) ?? '') : '';
+  let document = emptyRuleDocument();
+  let visualizationError: string | null = null;
+  if (selected && !parseError) {
+    try {
+      document = parseRulesSource(source);
+    } catch (error) {
+      visualizationError = errorMessage(error);
+    }
+  }
+
+  return {
+    supported: true,
+    accountId: context.accountId,
+    state: typeof response.state === 'string' ? response.state : null,
+    capabilities: context.capabilities,
+    scripts: scripts.map(publicScript),
+    managedScript: selected && isManagedRulesScript(source)
+      ? publicScript(selected)
+      : null,
+    editableScript: selected ? publicScript(selected) : null,
+    source,
+    document,
+    visualizationError,
+    parseError,
+  };
+}
+
+export async function runSetSieveRules({
+  transport,
+  account,
+  request,
+  useWebSocket = false,
+}: {
+  transport: any;
+  account: { remote_account_id: string };
+  request: any;
+  useWebSocket?: boolean;
+}): Promise<{ ok: boolean; error?: any; result?: any; response?: any }> {
+  const mode = request?.mode ?? 'visual';
+  if (mode !== 'visual' && mode !== 'source') {
+    return terminalError('invalidArguments', 'The Sieve editor mode is invalid.');
+  }
+  const sourceMode = mode === 'source';
+  if (sourceMode && typeof request?.source !== 'string') {
+    return terminalError('invalidArguments', 'The Sieve source must be text.');
+  }
+  let document: MailRuleDocument | null = null;
+  if (!sourceMode) {
+    try {
+      document = normalizeRuleDocument(request?.document);
+    } catch (error) {
+      return terminalError('invalidRules', errorMessage(error));
+    }
+  }
+
+  let snapshot: MailRulesSnapshot;
+  try {
+    snapshot = await getMailRules({ transport, account, useWebSocket });
+  } catch (error) {
+    return { ok: false, error: { type: 'transport', message: errorMessage(error) } };
+  }
+  if (!snapshot.supported || !snapshot.accountId) {
+    return terminalError('sieveUnsupported', 'This account does not advertise JMAP for Sieve.');
+  }
+  if (snapshot.parseError) {
+    return terminalError('managedScriptUnreadable', snapshot.parseError);
+  }
+  if (typeof request?.expectedState === 'string' && request.expectedState !== snapshot.state) {
+    return terminalError(
+      'sieveStateMismatch',
+      'The server’s Sieve scripts changed after this editor loaded. Reload before saving.',
+    );
+  }
+
+  let source: string;
+  if (sourceMode) {
+    source = request.source;
+  } else {
+    try {
+      source = compileRules(document, snapshot.capabilities, {
+        managed: snapshot.managedScript !== null || snapshot.editableScript === null,
+      });
+    } catch (error) {
+      return terminalError('invalidRules', errorMessage(error));
+    }
+  }
+
+  const sourceBytes = new TextEncoder().encode(source);
+  if (
+    typeof snapshot.capabilities.maxSizeScript === 'number'
+    && sourceBytes.byteLength > snapshot.capabilities.maxSizeScript
+  ) {
+    return terminalError(
+      'invalidSieve',
+      `The script is ${sourceBytes.byteLength} bytes; the server limit is ${snapshot.capabilities.maxSizeScript}.`,
+    );
+  }
+
+  let upload;
+  try {
+    upload = await transport.upload({
+      accountId: snapshot.accountId,
+      type: 'application/sieve',
+      body: sourceBytes,
+    });
+  } catch (error) {
+    return { ok: false, error: { type: 'transport', message: errorMessage(error) } };
+  }
+  if (!upload?.blobId) {
+    return { ok: false, error: { type: 'noResponse', message: 'The Sieve upload returned no blob id.' } };
+  }
+
+  let validationRaw;
+  try {
+    validationRaw = await callJmap(transport, {
+      using: [JMAP_CAPS.CORE, JMAP_CAPS.SIEVE],
+      methodCalls: [['SieveScript/validate', {
+        accountId: snapshot.accountId,
+        blobId: upload.blobId,
+      }, 'sieve-validate']],
+      useWebSocket,
+    });
+  } catch (error) {
+    return { ok: false, error: { type: 'transport', message: errorMessage(error) } };
+  }
+  const validation = pickResponse(validationRaw, 'SieveScript/validate');
+  if (!validation) {
+    return methodFailure(validationRaw, 'SieveScript/validate');
+  }
+  if (validation.error) {
+    return terminalError(
+      'invalidSieve',
+      validation.error.description ?? 'The server rejected the Sieve script.',
+      { validationError: validation.error },
+    );
+  }
+
+  const target = snapshot.editableScript;
+  const creationId = 'stormbox';
+  const setRequest: any = {
+    accountId: snapshot.accountId,
+  };
+  if (typeof snapshot.state === 'string') setRequest.ifInState = snapshot.state;
+  if (target) {
+    setRequest.update = { [target.id]: { blobId: upload.blobId } };
+    setRequest.onSuccessActivateScript = target.id;
+  } else {
+    setRequest.create = {
+      [creationId]: {
+        name: uniqueManagedScriptName(snapshot.scripts.map((script) => script.name)),
+        blobId: upload.blobId,
+      },
+    };
+    setRequest.onSuccessActivateScript = `#${creationId}`;
+  }
+
+  let setRaw;
+  try {
+    setRaw = await callJmap(transport, {
+      using: [JMAP_CAPS.CORE, JMAP_CAPS.SIEVE],
+      methodCalls: [['SieveScript/set', setRequest, 'sieve-set']],
+      useWebSocket,
+    });
+  } catch (error) {
+    return { ok: false, error: { type: 'transport', message: errorMessage(error) } };
+  }
+  const setResponse = pickResponse(setRaw, 'SieveScript/set');
+  if (!setResponse) return methodFailure(setRaw, 'SieveScript/set');
+
+  const setError = target
+    ? setResponse.notUpdated?.[target.id]
+    : setResponse.notCreated?.[creationId];
+  if (setError) {
+    const type = setError.type === 'stateMismatch' ? 'sieveStateMismatch' : (setError.type ?? 'sieveSetFailed');
+    return terminalError(type, setError.description ?? 'The server did not save the Sieve script.', {
+      setError,
+    });
+  }
+
+  const scriptId = target?.id ?? setResponse.created?.[creationId]?.id ?? null;
+  if (!scriptId) {
+    return { ok: false, error: { type: 'noResponse', message: 'The server did not report the saved script.' } };
+  }
+  return {
+    ok: true,
+    response: setRaw,
+    result: {
+      scriptId,
+      state: setResponse.newState ?? snapshot.state,
+    },
+  };
+}
+
+async function sieveContext(
+  transport: any,
+  account: { remote_account_id: string },
+): Promise<SieveContext | null> {
+  const session = transport.session ?? await transport.fetchSession();
+  if (!session?.capabilities?.[SIEVE_CAPABILITY]) return null;
+  const accountId = session.primaryAccounts?.[SIEVE_CAPABILITY]
+    ?? account.remote_account_id;
+  const accountCapability = session.accounts?.[accountId]?.accountCapabilities?.[SIEVE_CAPABILITY];
+  if (!accountCapability) return null;
+  return {
+    accountId,
+    capabilities: {
+      sieveExtensions: Array.isArray(accountCapability.sieveExtensions)
+        ? accountCapability.sieveExtensions.filter((item) => typeof item === 'string')
+        : [],
+      maxSizeScript: finiteOrNull(accountCapability.maxSizeScript),
+      maxNumberRedirects: finiteOrNull(accountCapability.maxNumberRedirects),
+    },
+  };
+}
+
+function normalizeScriptList(value: unknown): SieveScriptRecord[] {
+  if (!Array.isArray(value)) return [];
+  return value.flatMap((script) => {
+    if (
+      !isRecord(script)
+      || typeof script.id !== 'string'
+      || typeof script.blobId !== 'string'
+    ) return [];
+    return [{
+      id: script.id,
+      name: typeof script.name === 'string' ? script.name : null,
+      blobId: script.blobId,
+      isActive: script.isActive === true,
+    }];
+  });
+}
+
+function isRecord(value: unknown): value is Record<string, any> {
+  return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+
+function publicScript(script: SieveScriptRecord) {
+  return { id: script.id, name: script.name, isActive: script.isActive };
+}
+
+function unsupportedSnapshot(): MailRulesSnapshot {
+  return {
+    supported: false,
+    accountId: null,
+    state: null,
+    capabilities: { sieveExtensions: [] },
+    scripts: [],
+    managedScript: null,
+    editableScript: null,
+    source: '',
+    document: emptyRuleDocument(),
+    visualizationError: null,
+    parseError: null,
+  };
+}
+
+function finiteOrNull(value: unknown): number | null {
+  return typeof value === 'number' && Number.isFinite(value) ? value : null;
+}
+
+function methodFailure(raw: any, method: string) {
+  const failure = pickResponse(raw, 'error');
+  const serverType = failure?.type ?? 'noResponse';
+  const type = serverType === 'stateMismatch' ? 'sieveStateMismatch' : serverType;
+  const message = failure?.description ?? `${method} returned no response.`;
+  if (serverType === 'stateMismatch' || serverType === 'invalidArguments') {
+    return terminalError(type, message, { methodError: failure ?? null });
+  }
+  return { ok: false, error: { type, message, methodError: failure ?? null } };
+}
+
+function terminalError(type: string, message: string, result?: any) {
+  return {
+    ok: false,
+    error: {
+      type,
+      message,
+      terminal: true,
+      ...(result === undefined ? {} : { result }),
+    },
+  };
+}
+
+function errorMessage(error: unknown): string {
+  if (error instanceof RuleValidationError || error instanceof Error) return error.message;
+  return String(error);
+}
diff --git a/src/sync/backends/jmap/transport.ts b/src/sync/backends/jmap/transport.ts
index de072c6..47c7346 100644
--- a/src/sync/backends/jmap/transport.ts
+++ b/src/sync/backends/jmap/transport.ts
@@ -28,6 +28,7 @@ const JMAP_SUBMISSION = 'urn:ietf:params:jmap:submission';
 const JMAP_CONTACTS = 'urn:ietf:params:jmap:contacts';
 const JMAP_QUOTA = 'urn:ietf:params:jmap:quota';
 const JMAP_FILENODE = 'urn:ietf:params:jmap:filenode';
+const JMAP_SIEVE = 'urn:ietf:params:jmap:sieve';
 const JMAP_WEBSOCKET_CAP = 'urn:ietf:params:jmap:websocket';
 
 export const JMAP_CAPS = Object.freeze({
@@ -37,6 +38,7 @@ export const JMAP_CAPS = Object.freeze({
   CONTACTS: JMAP_CONTACTS,
   QUOTA: JMAP_QUOTA,
   FILENODE: JMAP_FILENODE,
+  SIEVE: JMAP_SIEVE,
   WEBSOCKET: JMAP_WEBSOCKET_CAP,
 });
 
diff --git a/src/sync/sync-host.ts b/src/sync/sync-host.ts
index 75b98e7..0ef0f9f 100644
--- a/src/sync/sync-host.ts
+++ b/src/sync/sync-host.ts
@@ -273,6 +273,12 @@ export function makeSyncRpcHandlers({
     [DB_RPC.SYNC_ENSURE_FOLDER_INDEX]: async ({ accountId, folderId, options }) =>
       syncClient.ensureFolderIndex(accountId, folderId, options ?? {}),
 
+    [DB_RPC.SYNC_GET_MAIL_RULES]: async ({ accountId }) => {
+      const backend = backends.get(accountId);
+      if (!backend) throw new Error(`No JMAP backend registered for account ${accountId}`);
+      return backend.getMailRules();
+    },
+
     [DB_RPC.SYNC_DRAIN_OUTBOX]: async ({ accountId, limit = 25 }) => {
       const backend = backends.get(accountId);
       if (!backend) {
diff --git a/tests/e2e/mail-rules.spec.js b/tests/e2e/mail-rules.spec.js
new file mode 100644
index 0000000..c03bd30
--- /dev/null
+++ b/tests/e2e/mail-rules.spec.js
@@ -0,0 +1,166 @@
+import {
+  connectJmap,
+  downloadBlob,
+  jmapRequest,
+  pickResponse,
+} from './helpers/jmap-client.js';
+import {
+  attachConsoleTail,
+  consoleLinesFor,
+  expect,
+  resetSharedSession,
+  test,
+} from './helpers/shared-session.js';
+import {
+  localStackEnabled,
+  skipLocalStackMessage,
+} from './helpers/stack-env.js';
+import { waitForPendingMutations } from './helpers/ui.js';
+
+test.skip(!localStackEnabled, skipLocalStackMessage);
+
+const CORE = 'urn:ietf:params:jmap:core';
+const SIEVE = 'urn:ietf:params:jmap:sieve';
+const MANAGED_MARKER = '# stormbox-managed: mail-rules/v2';
+const RULE_NAME = 'MailRulesE2E visual rule';
+const CONDITION_VALUE = 'MailRulesE2E';
+
+async function sieveRequest(jmap, calls) {
+  return jmapRequest(jmap, calls, [CORE, SIEVE]);
+}
+
+async function listScripts(jmap) {
+  const payload = await sieveRequest(jmap, [[
+    'SieveScript/get',
+    {
+      accountId: jmap.accountId,
+      ids: null,
+      properties: ['id', 'name', 'blobId', 'isActive'],
+    },
+    'getScripts',
+  ]]);
+  return pickResponse(payload, 'SieveScript/get')?.list ?? [];
+}
+
+async function restoreScripts(jmap, before) {
+  const current = await listScripts(jmap);
+  const beforeById = new Map(before.map((script) => [script.id, script]));
+  const currentById = new Map(current.map((script) => [script.id, script]));
+  const update = {};
+  for (const script of before) {
+    const live = currentById.get(script.id);
+    if (live && live.blobId !== script.blobId) {
+      update[script.id] = { blobId: script.blobId };
+    }
+  }
+  const activeBefore = before.find((script) => script.isActive)?.id ?? null;
+  await sieveRequest(jmap, [[
+    'SieveScript/set',
+    {
+      accountId: jmap.accountId,
+      ...(Object.keys(update).length > 0 ? { update } : {}),
+      ...(activeBefore
+        ? { onSuccessActivateScript: activeBefore }
+        : { onSuccessDeactivateScript: true }),
+    },
+    'restoreScripts',
+  ]]);
+
+  const createdIds = current
+    .map((script) => script.id)
+    .filter((id) => !beforeById.has(id));
+  if (createdIds.length > 0) {
+    await sieveRequest(jmap, [[
+      'SieveScript/set',
+      {
+        accountId: jmap.accountId,
+        destroy: createdIds,
+        ...(activeBefore
+          ? { onSuccessActivateScript: activeBefore }
+          : { onSuccessDeactivateScript: true }),
+      },
+      'removeCreatedScripts',
+    ]]);
+  }
+}
+
+async function openRulesDialog(page) {
+  await page.locator('.account-menu__button').click();
+  await page.getByRole('menuitem', { name: 'Mail Rules' }).click();
+  const dialog = page.getByRole('dialog', { name: 'Mail Rules' });
+  await expect(dialog).toBeVisible({ timeout: 10_000 });
+  await expect(dialog).not.toContainText('Loading server rules…', { timeout: 15_000 });
+  return dialog;
+}
+
+test.describe('JMAP Sieve mail rules e2e', () => {
+  test.beforeEach(async ({ sharedPage }) => {
+    await resetSharedSession(sharedPage);
+  });
+
+  test('visual rule round-trips through the outbox and active server script', async ({ sharedPage: page }, testInfo) => {
+    const jmap = await connectJmap();
+    expect(jmap.session.capabilities?.[SIEVE]).toBeTruthy();
+    expect(jmap.session.accounts?.[jmap.accountId]?.accountCapabilities?.[SIEVE]).toBeTruthy();
+    const before = await listScripts(jmap);
+
+    try {
+      let dialog = await openRulesDialog(page);
+      await expect(dialog).not.toContainText('server-side rules are unavailable');
+      await dialog.locator('[data-mail-rules-add]').click();
+      const rule = dialog.locator('.mail-rule').last();
+      await rule.locator('input[aria-label="Rule name"]').fill(RULE_NAME);
+      await rule.locator('input[aria-label="Condition value"]').fill(CONDITION_VALUE);
+      await rule.getByRole('button', { name: 'Group' }).click();
+      const nestedGroup = rule.locator('.condition-group--nested');
+      await nestedGroup.locator('summary[aria-label="Nested condition match mode"]').click();
+      await nestedGroup.locator('[data-rule-option="any"]').click();
+      await nestedGroup.getByLabel('Condition value').fill('lead@example.com');
+      await nestedGroup.getByRole('button', { name: 'Condition', exact: true }).click();
+      await nestedGroup.getByLabel('Condition value').nth(1).fill('manager@example.com');
+      await dialog.locator('[data-mail-rules-save]').click();
+
+      await expect(dialog).toContainText('Rules saved, validated, and activated.', { timeout: 20_000 });
+      await waitForPendingMutations(page);
+      await expect.poll(
+        async () => page.evaluate(async () => {
+          const rows = await globalThis.__repo.call('db.query', {
+            sql: `SELECT COUNT(*) AS count
+                    FROM pending_mutations
+                   WHERE mutation_type = 'setSieveRules'`,
+            params: [],
+          });
+          return Number(rows?.[0]?.count ?? -1);
+        }),
+        { timeout: 10_000, message: 'Sieve mutation should leave no durable outbox row' },
+      ).toBe(0);
+
+      const scripts = await listScripts(jmap);
+      const active = scripts.find((script) => script.isActive);
+      expect(active).toBeTruthy();
+      const source = (await downloadBlob(jmap, {
+        blobId: active.blobId,
+        type: 'application/sieve',
+        name: 'mail-rules.siv',
+      })).toString('utf8');
+      expect(source).toContain(MANAGED_MARKER);
+      expect(source).toContain(CONDITION_VALUE);
+      expect(source).toContain('anyof (address :contains "From" "lead@example.com", address :contains "From" "manager@example.com")');
+
+      await dialog.getByRole('button', { name: 'Close', exact: true }).click();
+      await expect(dialog).toBeHidden({ timeout: 5_000 });
+      dialog = await openRulesDialog(page);
+      const savedRule = dialog.locator('.mail-rule').last();
+      await expect(savedRule.locator('input[aria-label="Rule name"]')).toHaveValue(RULE_NAME);
+      await expect(savedRule.locator('input[aria-label="Condition value"]').first()).toHaveValue(CONDITION_VALUE);
+      await expect(savedRule.locator('.condition-group--nested')).toHaveCount(1);
+      await dialog.getByRole('button', { name: 'Source' }).click();
+      await expect(dialog.getByRole('textbox', { name: 'Sieve source' }))
+        .toHaveValue(new RegExp(CONDITION_VALUE));
+      await dialog.getByRole('button', { name: 'Close', exact: true }).click();
+    } finally {
+      await restoreScripts(jmap, before);
+      await attachConsoleTail(testInfo, consoleLinesFor(page));
+    }
+  });
+});
diff --git a/tests/unit/components/app-layout.test.ts b/tests/unit/components/app-layout.test.ts
index 05ea27d..467f4cc 100644
--- a/tests/unit/components/app-layout.test.ts
+++ b/tests/unit/components/app-layout.test.ts
@@ -1443,6 +1443,10 @@ describe('App mail layout', () => {
     expect(settingsLink.attributes('href')).toBe(ACCOUNTS_URL);
     expect(settingsLink.text()).toContain('Account Settings');
 
+    const rulesButton = avatarMenu.findAll('button.account-menu__item')
+      .find((button) => button.text().includes('Mail Rules'));
+    expect(rulesButton?.text()).toContain('Mail Rules');
+
     const logoutButton = avatarMenu.findAll('button.account-menu__item')
       .find((button) => button.text().includes('Log Out'));
     if (!logoutButton) throw new Error('Could not find Log Out account menu item');
diff --git a/tests/unit/components/mail-rule-select.test.ts b/tests/unit/components/mail-rule-select.test.ts
new file mode 100644
index 0000000..459cbc4
--- /dev/null
+++ b/tests/unit/components/mail-rule-select.test.ts
@@ -0,0 +1,87 @@
+// @vitest-environment happy-dom
+
+import { mount } from '@vue/test-utils';
+import { describe, expect, it } from 'vitest';
+import { nextTick } from 'vue';
+
+import MailRuleSelect from '../../../src/components/MailRuleSelect.vue';
+
+const options = [
+  { value: 'all', label: 'All conditions' },
+  { value: 'disabled', label: 'Unavailable', disabled: true },
+  { value: 'any', label: 'Any condition' },
+];
+
+describe('MailRuleSelect', () => {
+  it('supports menu keyboard navigation and restores summary focus after selection', async () => {
+    const wrapper = mount(MailRuleSelect, {
+      attachTo: document.body,
+      props: {
+        modelValue: 'all',
+        options,
+        controlLabel: 'Condition mode',
+      },
+    });
+    const summary = wrapper.get('summary');
+
+    await summary.trigger('keydown', { key: 'ArrowDown' });
+    await nextTick();
+    expect((document.activeElement as HTMLElement).dataset.ruleOption).toBe('all');
+
+    const allOption = wrapper.get('[data-rule-option="all"]');
+    await allOption.trigger('keydown', { key: 'ArrowDown' });
+    expect((document.activeElement as HTMLElement).dataset.ruleOption).toBe('any');
+
+    const anyOption = wrapper.get('[data-rule-option="any"]');
+    await anyOption.trigger('keydown', { key: 'ArrowDown' });
+    expect((document.activeElement as HTMLElement).dataset.ruleOption).toBe('all');
+
+    await allOption.trigger('keydown', { key: 'End' });
+    expect((document.activeElement as HTMLElement).dataset.ruleOption).toBe('any');
+    await anyOption.trigger('keydown', { key: 'Home' });
+    expect((document.activeElement as HTMLElement).dataset.ruleOption).toBe('all');
+
+    await anyOption.trigger('click');
+    expect(wrapper.emitted('update:modelValue')).toEqual([['any']]);
+    expect(document.activeElement).toBe(summary.element);
+    expect(wrapper.get('details').attributes('open')).toBeUndefined();
+
+    wrapper.unmount();
+  });
+
+  it('opens upward from the summary and focuses the last enabled option', async () => {
+    const wrapper = mount(MailRuleSelect, {
+      attachTo: document.body,
+      props: {
+        modelValue: 'all',
+        options,
+        controlLabel: 'Condition mode',
+      },
+    });
+
+    await wrapper.get('summary').trigger('keydown', { key: 'ArrowUp' });
+    await nextTick();
+    expect((document.activeElement as HTMLElement).dataset.ruleOption).toBe('any');
+
+    wrapper.unmount();
+  });
+
+  it('does not reopen from retained focus after becoming disabled', async () => {
+    const wrapper = mount(MailRuleSelect, {
+      attachTo: document.body,
+      props: {
+        modelValue: 'all',
+        options,
+        controlLabel: 'Condition mode',
+      },
+    });
+    const summary = wrapper.get('summary');
+    (summary.element as HTMLElement).focus();
+    await wrapper.setProps({ disabled: true });
+
+    await summary.trigger('keydown', { key: 'ArrowDown' });
+    expect(wrapper.get('details').attributes('open')).toBeUndefined();
+
+    wrapper.unmount();
+  });
+});
diff --git a/tests/unit/components/mail-rules-dialog.test.ts b/tests/unit/components/mail-rules-dialog.test.ts
new file mode 100644
index 0000000..76584d8
--- /dev/null
+++ b/tests/unit/components/mail-rules-dialog.test.ts
@@ -0,0 +1,278 @@
+// @vitest-environment happy-dom
+
+import {
+  beforeEach, describe, expect, it, vi,
+} from 'vitest';
+import { mount, flushPromises } from '@vue/test-utils';
+import { createPinia, setActivePinia } from 'pinia';
+
+vi.mock('../../../src/services/auth', () => ({
+  initOidc: async () => null,
+  getOidc: () => null,
+}));
+
+import MailRulesDialog from '../../../src/components/MailRulesDialog.vue';
+import {
+  __resetRepositoryForTests,
+  __setRepositoryForTests,
+} from '../../../src/composables/useRepository';
+import { useAuthStore } from '../../../src/stores/auth-store';
+import { useMailStore } from '../../../src/stores/mail-store';
+
+function snapshot(overrides: Record<string, unknown> = {}) {
+  return {
+    supported: true,
+    accountId: 'remote-1',
+    state: 'sieve-state-1',
+    capabilities: {
+      sieveExtensions: ['copy', 'fileinto', 'imap4flags', 'mailboxid'],
+      maxSizeScript: 64_000,
+      maxNumberRedirects: 4,
+    },
+    scripts: [],
+    managedScript: null,
+    editableScript: null,
+    source: '',
+    document: { version: 2, rules: [] },
+    visualizationError: null,
+    parseError: null,
+    ...overrides,
+  };
+}
+
+function folder(id: number, overrides: Record<string, unknown> = {}) {
+  return {
+    id,
+    account_id: 1,
+    remote_id: `mailbox-${id}`,
+    parent_id: null,
+    name: `Folder ${id}`,
+    role: null,
+    sort_order: 0,
+    is_deleted: 0,
+    is_subscribed: 1,
+    total_emails: 0,
+    unread_emails: 0,
+    rights_json: null,
+    may_add_items: 1,
+    ...overrides,
+  } as any;
+}
+
+function mountDialog() {
+  return mount(MailRulesDialog, {
+    global: { stubs: { teleport: true } },
+  });
+}
+
+function installRepo({
+  incompatible = false,
+  saveGate = null,
+}: { incompatible?: boolean; saveGate?: Promise<void> | null } = {}) {
+  let serverSnapshot = snapshot(incompatible ? {
+    scripts: [{ id: 'foreign', name: 'Handwritten filters', isActive: true }],
+    editableScript: { id: 'foreign', name: 'Handwritten filters', isActive: true },
+    source: 'vacation "Away";\r\n',
+    visualizationError: 'Top-level “vacation” is not represented by the visual editor at line 1.',
+  } : {});
+  let pendingRequest: any = null;
+  const repo = {
+    getMailRules: vi.fn(async () => structuredClone(serverSnapshot)),
+    insertPendingMutation: vi.fn(async (input) => {
+      pendingRequest = JSON.parse(input.requestJson);
+      return { id: 72 };
+    }),
+    runMutation: vi.fn(async () => {
+      if (saveGate) await saveGate;
+      serverSnapshot = pendingRequest.mode === 'source'
+        ? snapshot({
+          state: 'sieve-state-2',
+          scripts: [{ id: 'foreign', name: 'Handwritten filters', isActive: true }],
+          editableScript: { id: 'foreign', name: 'Handwritten filters', isActive: true },
+          source: pendingRequest.source,
+          visualizationError: 'Top-level “vacation” is not represented by the visual editor at line 1.',
+        })
+        : snapshot({
+          state: 'sieve-state-2',
+          document: pendingRequest.document,
+          scripts: [{ id: 'managed', name: 'Stormbox Mail Rules', isActive: true }],
+          managedScript: { id: 'managed', name: 'Stormbox Mail Rules', isActive: true },
+          editableScript: { id: 'managed', name: 'Stormbox Mail Rules', isActive: true },
+        });
+      return { attempted: 1, succeeded: 1, failed: 0 };
+    }),
+    getPendingMutationError: vi.fn(),
+  };
+  __setRepositoryForTests(repo);
+  return repo;
+}
+
+beforeEach(() => {
+  setActivePinia(createPinia());
+  __resetRepositoryForTests();
+  useAuthStore().accountId = 1;
+  useMailStore().folders = [
+    folder(1, { name: 'Projects' }),
+    folder(2, { name: 'Receipts', parent_id: 1 }),
+  ];
+});
+
+describe('MailRulesDialog', () => {
+  it('creates and saves a visual rule through the durable mutation path', async () => {
+    const repo = installRepo();
+    const wrapper = mountDialog();
+    await flushPromises();
+
+    expect(wrapper.text()).toContain('No rules yet');
+    await wrapper.get('[data-mail-rules-add]').trigger('click');
+    expect(wrapper.find('select').exists()).toBe(false);
+    await wrapper.get('input[aria-label="Condition value"]').setValue('newsletter');
+    await wrapper.get('[data-mail-rules-save]').trigger('click');
+    await flushPromises();
+
+    expect(repo.insertPendingMutation).toHaveBeenCalledTimes(1);
+    const queued = JSON.parse(repo.insertPendingMutation.mock.calls[0][0].requestJson);
+    expect(queued.mode).toBe('visual');
+    expect(queued.document.rules).toHaveLength(1);
+    expect(queued.document.rules[0]).toMatchObject({
+      name: 'New rule',
+      conditions: [{ field: 'from', operator: 'contains', value: 'newsletter' }],
+      actions: [{ type: 'markRead' }],
+    });
+    expect(wrapper.text()).toContain('Rules saved, validated, and activated.');
+  });
+
+  it('builds nested any/all condition groups', async () => {
+    const repo = installRepo();
+    const wrapper = mountDialog();
+    await flushPromises();
+
+    await wrapper.get('[data-mail-rules-add]').trigger('click');
+    await wrapper.get('input[aria-label="Condition value"]').setValue('project');
+    const addGroup = wrapper.findAll('button').find((button) => button.text().trim() === 'Group');
+    expect(addGroup).toBeTruthy();
+    await addGroup!.trigger('click');
+
+    await wrapper.get('.condition-group--nested summary[aria-label="Nested condition match mode"]')
+      .trigger('click');
+    await wrapper.get('.condition-group--nested [data-rule-option="any"]').trigger('click');
+    await wrapper.get('.condition-group--nested .condition-group__header input[type="checkbox"]')
+      .setValue(true);
+    await wrapper.get('.condition-group--nested input[aria-label="Condition value"]')
+      .setValue('lead@example.com');
+    const addNestedCondition = wrapper.get('.condition-group--nested').findAll('button')
+      .find((button) => button.text().trim() === 'Condition');
+    await addNestedCondition!.trigger('click');
+    const nestedValues = wrapper.get('.condition-group--nested')
+      .findAll('input[aria-label="Condition value"]');
+    expect(nestedValues).toHaveLength(2);
+    await nestedValues[1].setValue('manager@example.com');
+
+    await wrapper.get('[data-mail-rules-save]').trigger('click');
+    await flushPromises();
+
+    const queued = JSON.parse(repo.insertPendingMutation.mock.calls[0][0].requestJson);
+    expect(queued.document.rules[0]).toMatchObject({
+      match: 'all',
+      conditions: [
+        { type: 'condition', value: 'project' },
+        {
+          type: 'group',
+          match: 'any',
+          negated: true,
+          conditions: [
+            { type: 'condition', value: 'lead@example.com' },
+            { type: 'condition', value: 'manager@example.com' },
+          ],
+        },
+      ],
+    });
+  });
+
+  it('switches between visual rules and their generated source', async () => {
+    installRepo();
+    const wrapper = mountDialog();
+    await flushPromises();
+
+    await wrapper.get('[data-mail-rules-add]').trigger('click');
+    await wrapper.get('input[aria-label="Condition value"]').setValue('newsletter');
+    const sourceTab = wrapper.findAll('.mail-rules__mode-switch button')
+      .find((tab) => tab.text().trim() === 'Source');
+    await sourceTab!.trigger('click');
+
+    expect(wrapper.get('textarea[aria-label="Sieve source"]').element)
+      .toHaveProperty('value', expect.stringContaining('address :contains "From" "newsletter"'));
+
+    const visualTab = wrapper.findAll('.mail-rules__mode-switch button')
+      .find((tab) => tab.text().trim() === 'Visual');
+    await visualTab!.trigger('click');
+    expect(wrapper.get('input[aria-label="Condition value"]').element)
+      .toHaveProperty('value', 'newsletter');
+  });
+
+  it('locks the draft while a server save is in flight', async () => {
+    let releaseSave = () => {};
+    const saveGate = new Promise<void>((resolve) => {
+      releaseSave = resolve;
+    });
+    installRepo({ saveGate });
+    const wrapper = mountDialog();
+    await flushPromises();
+
+    await wrapper.get('[data-mail-rules-add]').trigger('click');
+    const condition = wrapper.get('input[aria-label="Condition value"]');
+    await condition.setValue('locked');
+    await wrapper.get('[data-mail-rules-save]').trigger('click');
+    await flushPromises();
+
+    expect(wrapper.get('[data-mail-rules-save]').attributes('disabled')).toBeDefined();
+    expect(wrapper.get('input[aria-label="Condition value"]').attributes('disabled')).toBeDefined();
+
+    releaseSave();
+    await flushPromises();
+    expect(wrapper.text()).toContain('Rules saved, validated, and activated.');
+  });
+
+  it('falls back to source and saves an incompatible active script in place', async () => {
+    const repo = installRepo({ incompatible: true });
+    const wrapper = mountDialog();
+    await flushPromises();
+
+    expect(wrapper.text()).toContain('Handwritten filters');
+    expect(wrapper.text()).toContain('Top-level “vacation” is not represented by the visual editor at line 1.');
+    const source = wrapper.get('textarea[aria-label="Sieve source"]');
+    expect(source.element).toHaveProperty('value', 'vacation "Away";\r\n');
+
+    const visualTab = wrapper.findAll('.mail-rules__mode-switch button')
+      .find((tab) => tab.text().trim() === 'Visual');
+    await visualTab!.trigger('click');
+    expect(wrapper.get('[role="alert"]').text()).toContain(
+      'Top-level “vacation” is not represented by the visual editor at line 1.',
+    );
+
+    await source.setValue('vacation "Back Monday";\r\n');
+    await wrapper.get('[data-mail-rules-save]').trigger('click');
+    await flushPromises();
+    const queued = JSON.parse(repo.insertPendingMutation.mock.calls[0][0].requestJson);
+    expect(queued).toEqual({
+      mode: 'source',
+      source: 'vacation "Back Monday";\r\n',
+      expectedState: 'sieve-state-1',
+    });
+    expect(wrapper.find('[role="alertdialog"]').exists()).toBe(false);
+    expect(wrapper.text()).toContain('Sieve source saved, validated, and activated.');
+  });
+
+  it('confirms before discarding an edited draft', async () => {
+    installRepo();
+    const wrapper = mountDialog();
+    await flushPromises();
+
+    await wrapper.get('[data-mail-rules-add]').trigger('click');
+    await wrapper.get('button[aria-label="Close mail rules"]').trigger('click');
+    expect(wrapper.get('[role="alertdialog"]').text()).toContain('Discard unsaved changes?');
+
+    await wrapper.get('[data-mail-rules-confirm]').trigger('click');
+    expect(wrapper.emitted('close')).toHaveLength(1);
+  });
+});
diff --git a/tests/unit/sieve/parser.test.ts b/tests/unit/sieve/parser.test.ts
new file mode 100644
index 0000000..e837823
--- /dev/null
+++ b/tests/unit/sieve/parser.test.ts
@@ -0,0 +1,78 @@
+import { describe, expect, it } from 'vitest';
+
+import { parseSieve, SieveSyntaxError } from '../../../src/sieve/parser';
+
+describe('Sieve syntax parser', () => {
+  it('builds nested test nodes with source ranges', () => {
+    const source = [
+      '/* existing script */',
+      'if allof (header :contains "Subject" "Project", not anyof (address :is "From" "a@example.com", address :is "From" "b@example.com")) {',
+      '  addflag "\\\\Flagged";',
+      '}',
+    ].join('\r\n');
+
+    const script = parseSieve(source);
+    expect(script.statements).toHaveLength(1);
+    expect(script.statements[0]).toMatchObject({
+      type: 'if',
+      comments: ['existing script'],
+      branches: [{
+        test: {
+          type: 'allof',
+          tests: [
+            { type: 'call', name: 'header' },
+            { type: 'not', test: { type: 'anyof' } },
+          ],
+        },
+      }],
+    });
+    expect(source.slice(
+      script.statements[0].range.start,
+      script.statements[0].range.end,
+    )).toMatch(/^if allof/);
+  });
+
+  it('parses elsif branches and multi-line strings before visual projection', () => {
+    const source = [
+      'if header :is "Subject" "one" { discard; }',
+      'elsif header :is "Subject" "two" {',
+      '  vacation text:# explanatory comment',
+      'Out of office',
+      '.',
+      '  ;',
+      '}',
+      '',
+    ].join('\r\n');
+    const script = parseSieve(source);
+    expect(script.statements[0]).toMatchObject({
+      type: 'if',
+      branches: [
+        { test: { type: 'call', name: 'header' } },
+        {
+          test: { type: 'call', name: 'header' },
+          commands: [{
+            type: 'command', name: 'vacation', arguments: [{ type: 'string', value: 'Out of office\r\n' }],
+          }],
+        },
+      ],
+    });
+  });
+
+  it('reports syntax locations', () => {
+    expect(() => parseSieve('if header :is "Subject" "broken" {\r\n  discard;'))
+      .toThrow(SieveSyntaxError);
+    expect(() => parseSieve('if header :is "Subject" "broken" {\r\n  discard;'))
+      .toThrow(/line 2/);
+  });
+
+  it('retains trailing comments separately from the preceding statement', () => {
+    const script = parseSieve('keep;\r\n# trailing note\r\n');
+    expect(script.statements[0].comments).toEqual([]);
+    expect(script.trailingComments).toEqual(['trailing note']);
+  });
+
+  it('rejects excessive recursive nesting before exhausting the JS stack', () => {
+    const source = `if ${'not '.repeat(70)}true { keep; }`;
+    expect(() => parseSieve(source)).toThrow(/parser nesting limit/);
+  });
+});
diff --git a/tests/unit/sieve/rules.test.ts b/tests/unit/sieve/rules.test.ts
new file mode 100644
index 0000000..1c8c372
--- /dev/null
+++ b/tests/unit/sieve/rules.test.ts
@@ -0,0 +1,368 @@
+import { describe, expect, it } from 'vitest';
+
+import {
+  compileRules,
+  isManagedRulesScript,
+  MANAGED_SCRIPT_MARKER,
+  parseManagedRules,
+  parseVisualRules,
+  RuleValidationError,
+  uniqueManagedScriptName,
+} from '../../../src/sieve/rules';
+import type { MailRuleDocument, SieveRuleCapabilities } from '../../../src/sieve/rules';
+
+const ALL_CAPABILITIES: SieveRuleCapabilities = {
+  sieveExtensions: ['copy', 'fileinto', 'imap4flags', 'mailbox', 'mailboxid'],
+  maxSizeScript: 100_000,
+  maxNumberRedirects: 4,
+};
+
+function document(): MailRuleDocument {
+  return {
+    version: 2,
+    rules: [{
+      id: 'rule-1',
+      name: 'File important mail',
+      enabled: true,
+      match: 'all',
+      conditions: [
+        {
+          id: 'condition-1', type: 'condition', negated: false,
+          field: 'from', operator: 'contains', value: '@example.com',
+        },
+        {
+          id: 'condition-2', type: 'condition', negated: false,
+          field: 'subject', operator: 'matches', value: '*invoice*',
+        },
+      ],
+      actions: [
+        {
+          id: 'action-1', type: 'move', mailboxId: 'mailbox-42', mailboxName: 'Finance/Invoices',
+        },
+        { id: 'action-2', type: 'markRead' },
+        { id: 'action-3', type: 'star' },
+        { id: 'action-4', type: 'redirect', address: 'archive@example.net' },
+      ],
+      stopProcessing: true,
+    }],
+  };
+}
+
+describe('mail-rule Sieve compiler', () => {
+  it('emits a capability-aware script and round-trips the visual model', () => {
+    const input = document();
+    const source = compileRules(input, ALL_CAPABILITIES);
+
+    expect(source).toContain(MANAGED_SCRIPT_MARKER);
+    expect(source).toContain('require ["copy", "fileinto", "imap4flags", "mailbox", "mailboxid"];');
+    expect(source).toContain('if allof (address :contains "From" "@example.com", header :matches "Subject" "*invoice*") {');
+    expect(source).toContain('fileinto :mailboxid "mailbox-42" "Finance/Invoices";');
+    expect(source).toContain('addflag "\\\\Seen";');
+    expect(source).toContain('addflag "\\\\Flagged";');
+    expect(source).toContain('redirect :copy "archive@example.net";');
+    expect(source).toContain('  stop;');
+    expect(isManagedRulesScript(source)).toBe(true);
+    expect(withoutIds(parseManagedRules(source))).toEqual(withoutIds(input));
+  });
+
+  it('escapes user strings and round-trips disabled rules through a false branch', () => {
+    const input = document();
+    input.rules[0].conditions = [{
+      id: 'condition-escape',
+      type: 'condition',
+      negated: false,
+      field: 'subject',
+      operator: 'contains',
+      value: 'say "hi" \\ there',
+    }];
+    input.rules.push({
+      id: 'rule-disabled',
+      name: 'Disabled executable marker',
+      enabled: false,
+      match: 'all',
+      conditions: [{
+        id: 'condition-disabled', type: 'condition', negated: false,
+        field: 'subject', operator: 'is', value: 'DO-NOT-EMIT',
+      }],
+      actions: [{ id: 'action-disabled', type: 'discard' }],
+      stopProcessing: true,
+    });
+
+    const source = compileRules(input, ALL_CAPABILITIES);
+    expect(source).toContain('header :contains "Subject" "say \\"hi\\" \\\\ there"');
+    expect(source).toContain('# Disabled rule: Disabled executable marker');
+    expect(withoutIds(parseManagedRules(source))).toEqual(withoutIds(input));
+  });
+
+  it('uses a path-only fallback when mailboxid is unavailable', () => {
+    const source = compileRules(document(), {
+      ...ALL_CAPABILITIES,
+      sieveExtensions: ['copy', 'fileinto', 'imap4flags'],
+    });
+    expect(source).toContain('fileinto "Finance/Invoices";');
+    expect(source).not.toContain(':mailboxid');
+  });
+
+  it('declares Stalwart’s advertised mailbox compatibility capability for mailboxid', () => {
+    const input = document();
+    input.rules[0].actions = [input.rules[0].actions[0]];
+
+    const source = compileRules(input, {
+      ...ALL_CAPABILITIES,
+      sieveExtensions: ['fileinto', 'mailbox', 'mailboxid'],
+    });
+    expect(source).toContain('require ["fileinto", "mailbox", "mailboxid"];');
+
+    const standardsOnlySource = compileRules(input, {
+      ...ALL_CAPABILITIES,
+      sieveExtensions: ['fileinto', 'mailboxid'],
+    });
+    expect(standardsOnlySource).toContain('require ["fileinto", "mailboxid"];');
+    expect(standardsOnlySource).not.toContain('"mailbox",');
+  });
+
+  it('rejects missing action extensions, invalid headers, and oversized scripts', () => {
+    expect(() => compileRules(document(), { sieveExtensions: [] }))
+      .toThrow(/fileinto/);
+
+    const invalidHeader = document();
+    invalidHeader.rules[0].conditions = [{
+      id: 'condition-header',
+      type: 'condition',
+      negated: false,
+      field: 'header',
+      headerName: 'Bad:Header',
+      operator: 'contains',
+      value: 'x',
+    }];
+    expect(() => compileRules(invalidHeader, ALL_CAPABILITIES))
+      .toThrow(RuleValidationError);
+
+    expect(() => compileRules(document(), {
+      ...ALL_CAPABILITIES,
+      maxSizeScript: 10,
+    })).toThrow(/server limit is 10/);
+  });
+
+  it('checks redirect limits along executable paths', () => {
+    const input = document();
+    input.rules[0].actions = [{
+      id: 'redirect-1', type: 'redirect', address: 'one@example.net',
+    }];
+    input.rules.push({
+      id: 'rule-2',
+      name: 'Second redirect',
+      enabled: true,
+      match: 'all',
+      conditions: [{
+        id: 'condition-2a', type: 'condition', negated: false,
+        field: 'subject', operator: 'contains', value: 'two',
+      }],
+      actions: [{ id: 'redirect-2', type: 'redirect', address: 'two@example.net' }],
+      stopProcessing: false,
+    });
+
+    expect(() => compileRules(input, { ...ALL_CAPABILITIES, maxNumberRedirects: 1 }))
+      .not.toThrow();
+
+    input.rules[0].stopProcessing = false;
+    expect(() => compileRules(input, { ...ALL_CAPABILITIES, maxNumberRedirects: 1 }))
+      .toThrow(/can redirect 2 messages/);
+  });
+
+  it('rejects corrupt managed metadata without claiming foreign scripts', () => {
+    expect(parseManagedRules('require ["fileinto"];\r\nkeep;')).toBeNull();
+    expect(() => parseManagedRules('# stormbox-managed: mail-rules/v1\r\n# stormbox-data: !!!'))
+      .toThrow(/metadata is missing or malformed/);
+  });
+
+  it('migrates version 1 managed metadata to the source-backed model', () => {
+    const legacy = {
+      version: 1,
+      rules: [
+        {
+          id: 'legacy-rule',
+          name: 'Legacy receipts',
+          enabled: true,
+          match: 'all',
+          conditions: [{
+            id: 'legacy-condition', field: 'subject', operator: 'contains', value: 'Receipt',
+          }],
+          actions: [{ id: 'legacy-action', type: 'markRead' }],
+          stopProcessing: true,
+        },
+        {
+          id: 'legacy-disabled',
+          name: 'Disabled legacy rule',
+          enabled: false,
+          match: 'all',
+          conditions: [{
+            id: 'legacy-disabled-condition', field: 'from', operator: 'is', value: 'later@example.com',
+          }],
+          actions: [{ id: 'legacy-disabled-action', type: 'discard' }],
+          stopProcessing: true,
+        },
+      ],
+    };
+    const encoded = Buffer.from(JSON.stringify(legacy)).toString('base64url');
+    const matchingSource = [
+      '# Stormbox managed mail rules. Edit these rules in Stormbox.',
+      '# stormbox-managed: mail-rules/v1',
+      `# stormbox-data: ${encoded}`,
+      'require ["imap4flags"];',
+      '# Rule: Legacy receipts',
+      'if header :contains "Subject" "Receipt" {',
+      '  addflag "\\\\Seen";',
+      '  stop;',
+      '}',
+      '',
+    ].join('\r\n');
+    const parsed = parseManagedRules(matchingSource);
+
+    expect(parsed).toMatchObject({
+      version: 2,
+      rules: [
+        {
+          name: 'Legacy receipts',
+          conditions: [{ type: 'condition', negated: false, value: 'Receipt' }],
+        },
+        { name: 'Disabled legacy rule', enabled: false },
+      ],
+    });
+
+    expect(() => parseManagedRules(matchingSource.replace(
+      '  addflag "\\\\Seen";',
+      '  discard;',
+    ))).toThrow(/metadata differs from its executable Sieve/);
+  });
+
+  it('keeps executable path-only folder routing authoritative during version 1 migration', () => {
+    const legacy = {
+      version: 1,
+      rules: [{
+        id: 'legacy-rule',
+        name: 'Archive receipts',
+        enabled: true,
+        match: 'all',
+        conditions: [{
+          id: 'legacy-condition', field: 'subject', operator: 'contains', value: 'Receipt',
+        }],
+        actions: [{
+          id: 'legacy-action', type: 'move', mailboxId: 'mailbox-archive', mailboxName: 'Archive',
+        }],
+        stopProcessing: true,
+      }],
+    };
+    const encoded = Buffer.from(JSON.stringify(legacy)).toString('base64url');
+    const parsed = parseManagedRules([
+      '# Stormbox managed mail rules. Edit these rules in Stormbox.',
+      '# stormbox-managed: mail-rules/v1',
+      `# stormbox-data: ${encoded}`,
+      'require ["fileinto"];',
+      '# Rule: Archive receipts',
+      'if header :contains "Subject" "Receipt" {',
+      '  fileinto "Archive";',
+      '  stop;',
+      '}',
+      '',
+    ].join('\r\n'));
+
+    expect(parsed?.rules[0].actions[0]).toMatchObject({
+      type: 'move', mailboxId: '', mailboxName: 'Archive',
+    });
+    const compiled = compileRules(parsed, ALL_CAPABILITIES);
+    expect(compiled).toContain('fileinto "Archive";');
+    expect(compiled).not.toContain(':mailboxid');
+  });
+
+  it('parses a compatible existing script and nested Boolean groups from source', () => {
+    const source = [
+      'require ["imap4flags"];',
+      '# Rule: Priority project mail',
+      'if allof (anyof (address :is "From" "lead@example.com", header :contains "Subject" "Project"), not header :contains "X-Spam" "yes") {',
+      '  addflag "\\\\Flagged";',
+      '  stop;',
+      '}',
+      '',
+    ].join('\r\n');
+
+    const parsed = parseVisualRules(source);
+    expect(parsed.rules[0]).toMatchObject({
+      name: 'Priority project mail',
+      match: 'all',
+      conditions: [
+        {
+          type: 'group',
+          match: 'any',
+          negated: false,
+          conditions: [
+            { type: 'condition', field: 'from', operator: 'is', value: 'lead@example.com' },
+            { type: 'condition', field: 'subject', operator: 'contains', value: 'Project' },
+          ],
+        },
+        {
+          type: 'condition', field: 'header', headerName: 'X-Spam',
+          operator: 'contains', value: 'yes', negated: true,
+        },
+      ],
+      actions: [{ type: 'star' }],
+      stopProcessing: true,
+    });
+    expect(compileRules(parsed, ALL_CAPABILITIES))
+      .toContain('allof (anyof (address :is "From" "lead@example.com", header :contains "Subject" "Project"), not header :contains "X-Spam" "yes")');
+  });
+
+  it('accepts implicit and explicit default match arguments', () => {
+    const source = [
+      'require ["imap4flags"];',
+      'if allof (',
+      '  header "Subject" "Status",',
+      '  address :comparator "i;ascii-casemap" :all :contains "From" "@example.com"',
+      ') {',
+      '  addflag "\\\\Seen";',
+      '}',
+      '',
+    ].join('\r\n');
+
+    expect(parseVisualRules(source).rules[0].conditions).toMatchObject([
+      { type: 'condition', field: 'subject', operator: 'is', value: 'Status' },
+      { type: 'condition', field: 'from', operator: 'contains', value: '@example.com' },
+    ]);
+  });
+
+  it('preserves significant whitespace in source-derived match values', () => {
+    const parsed = parseVisualRules([
+      'if header :is "Subject" " urgent " {',
+      '  discard;',
+      '}',
+      '',
+    ].join('\r\n'));
+
+    expect(parsed.rules[0].conditions[0]).toMatchObject({ value: ' urgent ' });
+    expect(compileRules(parsed, ALL_CAPABILITIES)).toContain('"Subject" " urgent "');
+  });
+
+  it('rejects required extensions that can change otherwise representable source semantics', () => {
+    expect(() => parseVisualRules([
+      'require ["encoded-character"];',
+      'if header :is "Subject" "${hex:41}" {',
+      '  discard;',
+      '}',
+      '',
+    ].join('\r\n'))).toThrow(/encoded-character.+not safe to rewrite visually/);
+  });
+
+  it('chooses a non-conflicting managed script name', () => {
+    expect(uniqueManagedScriptName(['Personal filters'])).toBe('Stormbox Mail Rules');
+    expect(uniqueManagedScriptName(['Stormbox Mail Rules', 'Stormbox Mail Rules 2']))
+      .toBe('Stormbox Mail Rules 3');
+  });
+});
+
+function withoutIds(value: unknown): unknown {
+  if (Array.isArray(value)) return value.map(withoutIds);
+  if (!value || typeof value !== 'object') return value;
+  return Object.fromEntries(Object.entries(value)
+    .filter(([key]) => key !== 'id')
+    .map(([key, item]) => [key, withoutIds(item)]));
+}
diff --git a/tests/unit/stores/rules-store.test.ts b/tests/unit/stores/rules-store.test.ts
new file mode 100644
index 0000000..1ecd5c1
--- /dev/null
+++ b/tests/unit/stores/rules-store.test.ts
@@ -0,0 +1,212 @@
+// @vitest-environment happy-dom
+
+import {
+  beforeEach, describe, expect, it, vi,
+} from 'vitest';
+import { createPinia, setActivePinia } from 'pinia';
+
+vi.mock('../../../src/services/auth', () => ({
+  initOidc: async () => null,
+  getOidc: () => null,
+}));
+
+import {
+  __resetRepositoryForTests,
+  __setRepositoryForTests,
+} from '../../../src/composables/useRepository';
+import { MUTATION_TYPE } from '../../../src/constants/states';
+import { compileRules } from '../../../src/sieve/rules';
+import type { MailRuleDocument } from '../../../src/sieve/rules';
+import { useAuthStore } from '../../../src/stores/auth-store';
+import {
+  MailRulesSaveError,
+  useRulesStore,
+} from '../../../src/stores/rules-store';
+
+function document(): MailRuleDocument {
+  return {
+    version: 2,
+    rules: [{
+      id: 'rule-1',
+      name: 'Receipts',
+      enabled: true,
+      match: 'all',
+      conditions: [{
+        id: 'condition-1', type: 'condition', negated: false,
+        field: 'subject', operator: 'contains', value: 'Receipt',
+      }],
+      actions: [{ id: 'action-1', type: 'markRead' }],
+      stopProcessing: true,
+    }],
+  };
+}
+
+function snapshot(overrides: Record<string, unknown> = {}) {
+  return {
+    supported: true,
+    accountId: 'remote-1',
+    state: 'sieve-state-1',
+    capabilities: {
+      sieveExtensions: ['imap4flags'],
+      maxSizeScript: 64_000,
+      maxNumberRedirects: 4,
+    },
+    scripts: [],
+    managedScript: null,
+    editableScript: null,
+    source: '',
+    document: document(),
+    visualizationError: null,
+    parseError: null,
+    ...overrides,
+  };
+}
+
+beforeEach(() => {
+  setActivePinia(createPinia());
+  __resetRepositoryForTests();
+});
+
+describe('rules store', () => {
+  it('loads a normalized snapshot and returns isolated drafts', async () => {
+    const repo = { getMailRules: vi.fn(async () => snapshot()) };
+    __setRepositoryForTests(repo);
+    useAuthStore().accountId = 7;
+    const store = useRulesStore();
+
+    const loaded = await store.load();
+    const draft = store.freshDocument();
+    draft.rules[0].name = 'Edited locally';
+
+    expect(repo.getMailRules).toHaveBeenCalledWith(7);
+    expect(loaded.state).toBe('sieve-state-1');
+    expect(store.snapshot?.document.rules[0].name).toBe('Receipts');
+    expect(store.loading).toBe(false);
+  });
+
+  it('queues and runs a state-checked durable mutation before reloading', async () => {
+    const repo = {
+      getMailRules: vi.fn(async () => snapshot()),
+      insertPendingMutation: vi.fn(async (_input: any) => ({ id: 93 })),
+      runMutation: vi.fn(async () => ({ attempted: 1, succeeded: 1, failed: 0 })),
+      getPendingMutationError: vi.fn(),
+    };
+    __setRepositoryForTests(repo);
+    useAuthStore().accountId = 7;
+    const store = useRulesStore();
+    await store.load();
+
+    await store.save(document());
+
+    expect(repo.insertPendingMutation).toHaveBeenCalledTimes(1);
+    const pending = repo.insertPendingMutation.mock.calls[0][0];
+    expect(pending).toMatchObject({
+      accountId: 7,
+      mutationType: MUTATION_TYPE.SET_SIEVE_RULES,
+      targetMessageId: null,
+      optimisticPatchJson: null,
+    });
+    expect(JSON.parse(pending.requestJson)).toEqual({
+      mode: 'visual',
+      document: document(),
+      expectedState: 'sieve-state-1',
+    });
+    expect(repo.runMutation).toHaveBeenCalledWith(7, 93);
+    expect(repo.getMailRules).toHaveBeenCalledTimes(2);
+    expect(store.saving).toBe(false);
+  });
+
+  it('sizes an editable external script without adding a managed marker', async () => {
+    const input = document();
+    const capabilities = {
+      sieveExtensions: ['imap4flags'],
+      maxSizeScript: null,
+      maxNumberRedirects: 4,
+    };
+    const externalSource = compileRules(input, capabilities, { managed: false });
+    const externalSnapshot = snapshot({
+      capabilities: {
+        ...capabilities,
+        maxSizeScript: new TextEncoder().encode(externalSource).length,
+      },
+      editableScript: { id: 'personal', name: 'Personal filters', isActive: true },
+      source: externalSource,
+    });
+    const repo = {
+      getMailRules: vi.fn(async () => externalSnapshot),
+      insertPendingMutation: vi.fn(async () => ({ id: 95 })),
+      runMutation: vi.fn(async () => ({ attempted: 1, succeeded: 1, failed: 0 })),
+      getPendingMutationError: vi.fn(),
+    };
+    __setRepositoryForTests(repo);
+    useAuthStore().accountId = 7;
+    const store = useRulesStore();
+    await store.load();
+
+    await expect(store.save(input)).resolves.toMatchObject({
+      editableScript: { id: 'personal' },
+    });
+    expect(repo.insertPendingMutation).toHaveBeenCalledOnce();
+  });
+
+  it('queues raw source without requiring visual projection', async () => {
+    const rawSource = 'vacation "Away";\r\n';
+    const repo = {
+      getMailRules: vi.fn(async () => snapshot({
+        editableScript: { id: 'personal', name: 'Personal filters', isActive: true },
+        source: rawSource,
+        visualizationError: 'Top-level “vacation” is not represented by the visual editor at line 1.',
+      })),
+      insertPendingMutation: vi.fn(async (_input: any) => ({ id: 96 })),
+      runMutation: vi.fn(async () => ({ attempted: 1, succeeded: 1, failed: 0 })),
+      getPendingMutationError: vi.fn(),
+    };
+    __setRepositoryForTests(repo);
+    useAuthStore().accountId = 7;
+    const store = useRulesStore();
+    await store.load();
+
+    await store.saveSource('vacation "Back Monday";\r\n');
+
+    const pending = repo.insertPendingMutation.mock.calls[0][0];
+    expect(JSON.parse(pending.requestJson)).toEqual({
+      mode: 'source',
+      source: 'vacation "Back Monday";\r\n',
+      expectedState: 'sieve-state-1',
+    });
+  });
+
+  it('surfaces the typed terminal error left by the outbox', async () => {
+    const repo = {
+      getMailRules: vi.fn(async () => snapshot()),
+      insertPendingMutation: vi.fn(async () => ({ id: 94 })),
+      runMutation: vi.fn(async () => ({ attempted: 1, succeeded: 0, failed: 1 })),
+      getPendingMutationError: vi.fn(async () => ({
+        error_json: JSON.stringify({
+          type: 'invalidSieve',
+          message: 'The server rejected the script.',
+          result: { validationError: { type: 'invalidSieve' } },
+        }),
+      })),
+    };
+    __setRepositoryForTests(repo);
+    useAuthStore().accountId = 7;
+    const store = useRulesStore();
+    await store.load();
+
+    await expect(store.save(document())).rejects.toMatchObject({
+      name: 'MailRulesSaveError',
+      code: 'invalidSieve',
+      message: 'The server rejected the script.',
+      detail: { validationError: { type: 'invalidSieve' } },
+    } satisfies Partial<MailRulesSaveError>);
+    expect(store.error).toBe('The server rejected the script.');
+    expect(store.saving).toBe(false);
+  });
+
+  it('requires an authenticated local account', async () => {
+    __setRepositoryForTests({});
+    const store = useRulesStore();
+    await expect(store.load()).rejects.toMatchObject({ code: 'notConnected' });
+  });
+});
diff --git a/tests/unit/sync/_mock-transport.ts b/tests/unit/sync/_mock-transport.ts
index 122c3ff..bc21c8a 100644
--- a/tests/unit/sync/_mock-transport.ts
+++ b/tests/unit/sync/_mock-transport.ts
@@ -48,6 +48,10 @@ export class MockTransport {
   requests: Array<{ using: any; methodCalls: any }>;
   uploads: Array<{ accountId: string; type: string; body: any }>;
   _uploadHandler: ((args: { accountId: string; type: string; body: any }) => any) | null;
+  downloads: Array<{ accountId: string; blobId: string; type?: string; name?: string }>;
+  _downloadHandler: ((args: {
+    accountId: string; blobId: string; type?: string; name?: string;
+  }) => any) | null;
 
   constructor(session: any = null) {
     this._session = session ?? mockSession();
@@ -67,6 +71,8 @@ export class MockTransport {
     this.requests = [];
     this.uploads = [];
     this._uploadHandler = null;
+    this.downloads = [];
+    this._downloadHandler = null;
   }
 
   set session(s) {
@@ -125,6 +131,24 @@ export class MockTransport {
     };
   }
 
+  handleDownload(fn: (args: {
+    accountId: string; blobId: string; type?: string; name?: string;
+  }) => any) {
+    this._downloadHandler = fn;
+  }
+
+  async download({ accountId, blobId, type, name }: {
+    accountId: string; blobId: string; type?: string; name?: string;
+  }) {
+    const args = { accountId, blobId, type, name };
+    this.downloads.push(args);
+    if (!this._downloadHandler) {
+      throw new Error(`MockTransport has no download handler for ${blobId}`);
+    }
+    const value = await this._downloadHandler(args);
+    return typeof value === 'string' ? new TextEncoder().encode(value) : value;
+  }
+
   /** Teardown surface JmapBackend.stop() calls. Nothing here holds a
    *  socket or an in-flight fetch, so both are no-ops. */
   abort() {}
diff --git a/tests/unit/sync/jmap-outbox-sieve.test.ts b/tests/unit/sync/jmap-outbox-sieve.test.ts
new file mode 100644
index 0000000..7fa6ab3
--- /dev/null
+++ b/tests/unit/sync/jmap-outbox-sieve.test.ts
@@ -0,0 +1,91 @@
+import { describe, expect, it } from 'vitest';
+
+import type { MailRuleDocument } from '../../../src/sieve/rules';
+import { SIEVE_CAPABILITY } from '../../../src/sieve/rules';
+import {
+  MUTATION_TYPES,
+  processMutationRow,
+} from '../../../src/sync/backends/jmap/outbox';
+import { JMAP_CAPS } from '../../../src/sync/backends/jmap/transport';
+import { MockTransport } from './_mock-transport';
+
+const DOCUMENT: MailRuleDocument = {
+  version: 2,
+  rules: [{
+    id: 'rule-1',
+    name: 'Discard automated noise',
+    enabled: true,
+    match: 'all',
+    conditions: [{
+      id: 'condition-1', type: 'condition', negated: false,
+      field: 'from', operator: 'contains', value: 'noise@example.net',
+    }],
+    actions: [{ id: 'action-1', type: 'discard' }],
+    stopProcessing: true,
+  }],
+};
+
+function sieveTransport() {
+  const transport = new MockTransport({
+    capabilities: { [JMAP_CAPS.CORE]: {}, [SIEVE_CAPABILITY]: {} },
+    primaryAccounts: { [SIEVE_CAPABILITY]: 'acct-1' },
+    accounts: {
+      'acct-1': {
+        accountCapabilities: {
+          [SIEVE_CAPABILITY]: { sieveExtensions: [], maxSizeScript: 64_000 },
+        },
+      },
+    },
+  });
+  transport.handle('SieveScript/get', () => ({
+    accountId: 'acct-1', state: 'state-1', list: [],
+  }));
+  transport.handle('SieveScript/validate', () => ({ accountId: 'acct-1', error: null }));
+  transport.handle('SieveScript/set', () => ({
+    accountId: 'acct-1',
+    newState: 'state-2',
+    created: { stormbox: { id: 'managed-1', blobId: 'blob-1' } },
+  }));
+  return transport;
+}
+
+describe('Sieve outbox dispatch', () => {
+  it('dispatches the durable rules mutation through upload, validation, and set', async () => {
+    const transport = sieveTransport();
+    const result = await processMutationRow({
+      transport,
+      account: { id: 1, remote_account_id: 'acct-1' },
+      handlers: {},
+      row: {
+        mutation_type: MUTATION_TYPES.SET_SIEVE_RULES,
+        request_json: JSON.stringify({ document: DOCUMENT, expectedState: 'state-1' }),
+      },
+    });
+
+    expect(result).toMatchObject({ ok: true, result: { scriptId: 'managed-1' } });
+    expect(transport.uploads).toHaveLength(1);
+    expect(transport.requests.map(({ methodCalls }) => methodCalls[0][0]))
+      .toEqual(['SieveScript/get', 'SieveScript/validate', 'SieveScript/set']);
+  });
+
+  it('classifies malformed durable payloads as terminal', async () => {
+    const result = await processMutationRow({
+      transport: sieveTransport(),
+      account: { id: 1, remote_account_id: 'acct-1' },
+      handlers: {},
+      row: {
+        mutation_type: MUTATION_TYPES.SET_SIEVE_RULES,
+        request_json: '{not-json',
+      },
+    });
+
+    expect(result).toEqual({
+      ok: false,
+      error: {
+        type: 'invalidArguments',
+        message: 'The durable mutation payload is not valid JSON.',
+        terminal: true,
+      },
+    });
+  });
+});
diff --git a/tests/unit/sync/jmap-sieve.test.ts b/tests/unit/sync/jmap-sieve.test.ts
new file mode 100644
index 0000000..8669574
--- /dev/null
+++ b/tests/unit/sync/jmap-sieve.test.ts
@@ -0,0 +1,327 @@
+import { describe, expect, it } from 'vitest';
+
+import {
+  compileRules,
+  emptyRuleDocument,
+  MANAGED_SCRIPT_MARKER,
+  MANAGED_SCRIPT_NAME,
+  SIEVE_CAPABILITY,
+} from '../../../src/sieve/rules';
+import type { MailRuleDocument } from '../../../src/sieve/rules';
+import {
+  getMailRules,
+  runSetSieveRules,
+} from '../../../src/sync/backends/jmap/sieve';
+import { JMAP_CAPS } from '../../../src/sync/backends/jmap/transport';
+import { MockTransport } from './_mock-transport';
+
+const EXTENSIONS = ['copy', 'fileinto', 'imap4flags', 'mailboxid'];
+const ACCOUNT = { remote_account_id: 'acct-1' };
+
+function session() {
+  return {
+    capabilities: {
+      [JMAP_CAPS.CORE]: {},
+      [SIEVE_CAPABILITY]: { implementation: 'test' },
+    },
+    primaryAccounts: { [SIEVE_CAPABILITY]: 'acct-1' },
+    accounts: {
+      'acct-1': {
+        accountCapabilities: {
+          [SIEVE_CAPABILITY]: {
+            sieveExtensions: EXTENSIONS,
+            maxSizeScript: 64_000,
+            maxNumberRedirects: 4,
+          },
+        },
+      },
+    },
+  };
+}
+
+function ruleDocument(): MailRuleDocument {
+  return {
+    version: 2,
+    rules: [{
+      id: 'rule-1',
+      name: 'Read receipts',
+      enabled: true,
+      match: 'all',
+      conditions: [{
+        id: 'condition-1', type: 'condition', negated: false,
+        field: 'subject', operator: 'contains', value: 'Receipt',
+      }],
+      actions: [{ id: 'action-1', type: 'markRead' }],
+      stopProcessing: true,
+    }],
+  };
+}
+
+function managedSource(document = ruleDocument()) {
+  return compileRules(document, {
+    sieveExtensions: EXTENSIONS,
+    maxSizeScript: 64_000,
+    maxNumberRedirects: 4,
+  });
+}
+
+describe('JMAP Sieve rules backend', () => {
+  it('reports unsupported accounts without issuing a JMAP method call', async () => {
+    const transport = new MockTransport();
+    const result = await getMailRules({ transport, account: ACCOUNT });
+
+    expect(result.supported).toBe(false);
+    expect(result.document).toEqual(emptyRuleDocument());
+    expect(transport.requests).toHaveLength(0);
+  });
+
+  it('uses an incompatible active script as the authoritative source', async () => {
+    const transport = new MockTransport(session());
+    transport.handle('SieveScript/get', () => ({
+      accountId: 'acct-1',
+      state: 'sieve-state-1',
+      list: [
+        {
+          id: 'foreign', name: 'Handwritten filters', blobId: 'blob-foreign', isActive: true,
+        },
+        {
+          id: 'managed', name: MANAGED_SCRIPT_NAME, blobId: 'blob-managed', isActive: false,
+        },
+      ],
+      notFound: [],
+    }));
+    transport.handleDownload(({ blobId }) => (
+      blobId === 'blob-managed' ? managedSource() : 'vacation "Away";\r\n'
+    ));
+
+    const result = await getMailRules({ transport, account: ACCOUNT });
+
+    expect(result.supported).toBe(true);
+    expect(result.state).toBe('sieve-state-1');
+    expect(result.document).toEqual(emptyRuleDocument());
+    expect(result.managedScript).toBeNull();
+    expect(result.editableScript).toMatchObject({ id: 'foreign', isActive: true });
+    expect(result.source).toBe('vacation "Away";\r\n');
+    expect(result.visualizationError)
+      .toBe('Top-level “vacation” is not represented by the visual editor at line 1.');
+    expect(result.capabilities.sieveExtensions).toEqual(EXTENSIONS);
+  });
+
+  it('visualizes and updates a compatible existing active script in place', async () => {
+    const transport = new MockTransport(session());
+    let setRequest: any = null;
+    transport.handle('SieveScript/get', () => ({
+      accountId: 'acct-1',
+      state: 'sieve-state-1',
+      list: [{
+        id: 'personal', name: 'Personal filters', blobId: 'blob-personal', isActive: true,
+      }],
+    }));
+    transport.handleDownload(() => [
+      'require ["imap4flags"];',
+      '# Rule: Important projects',
+      'if allof (anyof (address :contains "From" "@example.com", header :contains "Subject" "Project"), not header :contains "X-Spam" "yes") {',
+      '  addflag "\\\\Flagged";',
+      '  stop;',
+      '}',
+      '',
+    ].join('\r\n'));
+    transport.handle('SieveScript/validate', () => ({ accountId: 'acct-1', error: null }));
+    transport.handle('SieveScript/set', (params) => {
+      setRequest = params;
+      return {
+        accountId: 'acct-1', oldState: 'sieve-state-1', newState: 'sieve-state-2',
+        updated: { personal: null },
+      };
+    });
+
+    const loaded = await getMailRules({ transport, account: ACCOUNT });
+    expect(loaded.managedScript).toBeNull();
+    expect(loaded.editableScript).toMatchObject({ id: 'personal', isActive: true });
+    expect(loaded.visualizationError).toBeNull();
+    expect(loaded.source).toContain('# Rule: Important projects');
+    expect(loaded.document.rules[0]).toMatchObject({
+      name: 'Important projects',
+      match: 'all',
+      conditions: [{ type: 'group', match: 'any' }, { type: 'condition', negated: true }],
+    });
+
+    const result = await runSetSieveRules({
+      transport,
+      account: ACCOUNT,
+      request: { document: loaded.document, expectedState: 'sieve-state-1' },
+    });
+    expect(result.ok).toBe(true);
+    expect(setRequest).toMatchObject({
+      update: { personal: { blobId: 'blob-1' } },
+      onSuccessActivateScript: 'personal',
+    });
+    expect(setRequest.create).toBeUndefined();
+    expect(new TextDecoder().decode(transport.uploads[0].body))
+      .not.toContain(MANAGED_SCRIPT_MARKER);
+  });
+
+  it('prefers a compatible active script over an inactive managed script', async () => {
+    const transport = new MockTransport(session());
+    transport.handle('SieveScript/get', () => ({
+      accountId: 'acct-1',
+      state: 'sieve-state-1',
+      list: [
+        {
+          id: 'personal', name: 'Personal filters', blobId: 'blob-personal', isActive: true,
+        },
+        {
+          id: 'managed', name: MANAGED_SCRIPT_NAME, blobId: 'blob-managed', isActive: false,
+        },
+      ],
+    }));
+    transport.handleDownload(({ blobId }) => (
+      blobId === 'blob-managed'
+        ? managedSource()
+        : 'if header :contains "Subject" "Active" { discard; stop; }\r\n'
+    ));
+
+    const loaded = await getMailRules({ transport, account: ACCOUNT });
+    expect(loaded.editableScript).toMatchObject({ id: 'personal', isActive: true });
+    expect(loaded.managedScript).toBeNull();
+    expect(loaded.visualizationError).toBeNull();
+    expect(loaded.document.rules[0]).toMatchObject({
+      conditions: [{ value: 'Active' }],
+      actions: [{ type: 'discard' }],
+    });
+  });
+
+  it('validates and updates an incompatible active script from raw source', async () => {
+    const transport = new MockTransport(session());
+    let setRequest: any = null;
+    transport.handle('SieveScript/get', () => ({
+      accountId: 'acct-1',
+      state: 'sieve-state-1',
+      list: [{
+        id: 'foreign', name: 'Handwritten filters', blobId: 'blob-foreign', isActive: true,
+      }],
+      notFound: [],
+    }));
+    transport.handleDownload(() => 'vacation "Away";\r\n');
+    transport.handle('SieveScript/validate', () => ({ accountId: 'acct-1', error: null }));
+    transport.handle('SieveScript/set', (params) => {
+      setRequest = params;
+      return {
+        accountId: 'acct-1',
+        oldState: 'sieve-state-1',
+        newState: 'sieve-state-2',
+        updated: { foreign: null },
+      };
+    });
+
+    const source = 'vacation "Back Monday";\r\n';
+    const result = await runSetSieveRules({
+      transport,
+      account: ACCOUNT,
+      request: { mode: 'source', source, expectedState: 'sieve-state-1' },
+    });
+
+    expect(result).toMatchObject({
+      ok: true,
+      result: { scriptId: 'foreign', state: 'sieve-state-2' },
+    });
+    expect(transport.uploads).toHaveLength(1);
+    expect(transport.uploads[0]).toMatchObject({
+      accountId: 'acct-1', type: 'application/sieve',
+    });
+    expect(new TextDecoder().decode(transport.uploads[0].body)).toBe(source);
+    expect(setRequest).toMatchObject({
+      accountId: 'acct-1',
+      ifInState: 'sieve-state-1',
+      onSuccessActivateScript: 'foreign',
+      update: { foreign: { blobId: 'blob-1' } },
+    });
+    expect(setRequest.create).toBeUndefined();
+    expect(setRequest.destroy).toBeUndefined();
+  });
+
+  it('updates the owned script and never creates or destroys another script', async () => {
+    const transport = new MockTransport(session());
+    let setRequest: any = null;
+    transport.handle('SieveScript/get', () => ({
+      accountId: 'acct-1',
+      state: 'sieve-state-7',
+      list: [
+        {
+          id: 'managed', name: MANAGED_SCRIPT_NAME, blobId: 'blob-managed', isActive: true,
+        },
+        {
+          id: 'foreign', name: 'Saved elsewhere', blobId: 'blob-foreign', isActive: false,
+        },
+      ],
+    }));
+    transport.handleDownload(({ blobId }) => (
+      blobId === 'blob-managed' ? managedSource() : 'keep;\r\n'
+    ));
+    transport.handle('SieveScript/validate', () => ({ accountId: 'acct-1', error: null }));
+    transport.handle('SieveScript/set', (params) => {
+      setRequest = params;
+      return {
+        accountId: 'acct-1', oldState: 'sieve-state-7', newState: 'sieve-state-8', updated: { managed: null },
+      };
+    });
+
+    const result = await runSetSieveRules({
+      transport,
+      account: ACCOUNT,
+      request: { document: ruleDocument(), expectedState: 'sieve-state-7' },
+    });
+
+    expect(result.ok).toBe(true);
+    expect(setRequest).toMatchObject({
+      update: { managed: { blobId: 'blob-1' } },
+      onSuccessActivateScript: 'managed',
+    });
+    expect(setRequest.create).toBeUndefined();
+    expect(setRequest.destroy).toBeUndefined();
+  });
+
+  it('stops on state conflicts and server validation errors', async () => {
+    const conflictTransport = new MockTransport(session());
+    conflictTransport.handle('SieveScript/get', () => ({
+      accountId: 'acct-1', state: 'changed', list: [],
+    }));
+    const conflict = await runSetSieveRules({
+      transport: conflictTransport,
+      account: ACCOUNT,
+      request: { document: ruleDocument(), expectedState: 'loaded-state' },
+    });
+    expect(conflict).toMatchObject({
+      ok: false, error: { type: 'sieveStateMismatch', terminal: true },
+    });
+    expect(conflictTransport.uploads).toHaveLength(0);
+
+    const validationTransport = new MockTransport(session());
+    validationTransport.handle('SieveScript/get', () => ({
+      accountId: 'acct-1', state: 'sieve-state-1', list: [],
+    }));
+    validationTransport.handle('SieveScript/validate', () => ({
+      accountId: 'acct-1',
+      error: { type: 'invalidSieve', description: 'line 4: invalid command' },
+    }));
+    const validation = await runSetSieveRules({
+      transport: validationTransport,
+      account: ACCOUNT,
+      request: { document: ruleDocument(), expectedState: 'sieve-state-1' },
+    });
+    expect(validation).toMatchObject({
+      ok: false,
+      error: { type: 'invalidSieve', message: 'line 4: invalid command', terminal: true },
+    });
+    expect(validationTransport.requests.some(({ methodCalls }) =>
+      methodCalls[0][0] === 'SieveScript/set')).toBe(false);
+  });
+});
+
+function withoutIds(value: unknown): unknown {
+  if (Array.isArray(value)) return value.map(withoutIds);
+  if (!value || typeof value !== 'object') return value;
+  return Object.fromEntries(Object.entries(value)
+    .filter(([key]) => key !== 'id')
+    .map(([key, item]) => [key, withoutIds(item)]));
+}