@rapidmx/web-client 0.13.0 → 0.14.1

package/apps/shared/components/calendar/EventModal.tsx

@@ -35,6 +35,7 @@ import FormField from "@rapidmx/react-shared/components/forms/FormField.js";
 import RecurrenceEditor from "./RecurrenceEditor.js";
 import { addDaysToKey, allDayDateKey, allDayInstant, recurrenceUntilDateKey, recurrenceUntilInstant, startWeekdayCode } from "./allDay.js";
 import ResourcePicker from "./ResourcePicker.js";
+import { joinMeetingUrl } from "../../calendar/calendarReminders.js";
 
 const INPUT_CLASS =
     "w-full text-sm py-2 px-3 border border-border rounded-sm bg-surface text-text focus:outline-none focus:border-primary";
@@ -131,7 +132,11 @@ function wallTimeOfDayMs(instantMs: number, timezone: string | undefined): numbe
 async function toSeriesFields(occurrence: CalendarOccurrence, fields: EventFields): Promise<EventFields> {
     const { startDate, endDate, ...rest } = fields;
     if (sameMinute(startDate as string, occurrence.startDate) && sameMinute(endDate as string, occurrence.endDate)) {
-        return rest;
+        // `saveEventSeries()` treats *any* `timezone`/`allDay` in the update as a possible reinterpretation of
+        // the master's instant and fetches the master to check - so when neither differs from the occurrence's
+        // own, both are dropped too, or every plain series save (e.g. just a new title) would pay for that GET.
+        const { timezone, allDay, ...others } = rest;
+        return timezone === occurrence.timezone && allDay === occurrence.allDay ? others : rest;
     }
     const master = await getCalendarEvent(occurrence.uid);
     const timezone = fields.timezone as string;
@@ -318,7 +323,7 @@ export default function EventModal({
      * theirs and is preserved.
      *
      * **Known, deliberate limitation:** an event that already has a meeting is left completely alone, even
-     * when its attendee list has just changed. `@rapidmx/videoconf-plugin`'s `PUT /mail/video-meetings/:id`
+     * when its attendee list has just changed. `@rapidmx/meet-plugin`'s `PUT /mail/video-meetings/:id`
      * is deliberately minimal (title and cancellation only) and cannot add or remove invitees, and a private
      * meeting's personal join links are minted once at creation - so there is no way to reconcile an invitee
      * list, and silently pretending otherwise would leave a new attendee with no link and a removed one with
@@ -333,6 +338,20 @@ export default function EventModal({
         if (videoEnabled === !!videoMeetingUid) {
             return { event: saved, failed: false };
         }
+        // Detaching a single occurrence (`detachOccurrence()`, react-shared's `calendarMutations.ts`)
+        // deliberately never copies the series' `videoMeetingUid` onto the new standalone event - that
+        // shared meeting belongs to the series, not to the one occurrence being split off, and every other
+        // occurrence still needs it live. But this component's own `videoMeetingUid` *state* was seeded
+        // from the series' occurrence at mount and is untouched by the detach, so unchecking the toggle
+        // while detaching would otherwise still look like "off, but state says linked" above and fall into
+        // the cancel branch below - cancelling the series' shared meeting for every remaining occurrence,
+        // not just this one. `saved.videoMeetingUid` is the actual just-persisted record, so when the
+        // toggle is off and that record already has no meeting reference (true for every detach, checked or
+        // not - see this function's own doc comment on the still-checked case being a separate, documented
+        // gap), there is nothing of *this* record's to cancel.
+        if (!videoEnabled && !saved.videoMeetingUid) {
+            return { event: saved, failed: false };
+        }
         try {
             if (videoEnabled) {
                 const organizerAddressLower = saved.organizer.address.toLowerCase();
@@ -374,7 +393,17 @@ export default function EventModal({
             setLocation(restoredLocation);
             return { event: patched, failed: false };
         } catch (err) {
-            setVideoError(err instanceof ApiRequestError ? err.message : "Could not update this event's video conferencing.");
+            // `videoMeetingsApi.ts`'s own doc comment: when the plugin isn't installed at all, its routes
+            // simply aren't mounted and every call here fails with a plain 404 - a caller offering video
+            // conferencing optionally must treat that as "not available here," not alarm the reader with
+            // the raw (often server-generated, unhelpful) 404 body text.
+            setVideoError(
+                err instanceof ApiRequestError
+                    ? err.status === 404
+                        ? "Video conferencing is not available on this server."
+                        : err.message
+                    : "Could not update this event's video conferencing.",
+            );
             return { event: saved, failed: true };
         }
     }
@@ -536,6 +565,14 @@ export default function EventModal({
         );
     }
 
+    // Same scheme allow-list `calendarReminders.ts#joinMeetingUrl()` already applies to a reminder's own
+    // `location` field - reused here rather than duplicated so a video-conferencing plugin (or a stray
+    // manual edit of `videoMeetingUid`'s otherwise-plugin-owned join link) can't smuggle a `javascript:`/
+    // `file:`/other non-http(s) URL into `window.open()`. `undefined` (still loading) and `null` (fetch
+    // came back with nothing to join) both fail validation the same way as a bad scheme would - the button
+    // stays disabled either way, and the two are told apart below purely from `organizerJoinUrl` itself.
+    const validatedJoinUrl = joinMeetingUrl(organizerJoinUrl);
+
     return (
         <Modal open={open} onClose={onClose} title={occurrence ? "Edit event" : "New event"}>
             <form onSubmit={handleSubmit} className="flex flex-col gap-1">
@@ -594,14 +631,14 @@ export default function EventModal({
                             type="button"
                             variant="secondary"
                             className="!w-auto"
-                            disabled={!organizerJoinUrl}
-                            onClick={() => window.open(organizerJoinUrl!, "_blank", "noopener,noreferrer")}
+                            disabled={!validatedJoinUrl}
+                            onClick={() => window.open(validatedJoinUrl, "_blank", "noopener,noreferrer")}
                         >
                             Join video call
                         </Button>
-                        {!organizerJoinUrl && (
+                        {!validatedJoinUrl && (
                             <span className="text-xs text-text-muted">
-                                {organizerJoinUrl === null ? "This meeting’s join link isn’t available." : "Loading the join link…"}
+                                {organizerJoinUrl === undefined ? "Loading the join link…" : "This meeting’s join link isn’t available."}
                             </span>
                         )}
                     </div>

package/apps/shared/components/mail/compose/ComposeWindow.tsx

@@ -126,6 +126,20 @@ function parseAddresses(value: string): ComposeRecipientInput[] {
     return parseRecipientList(value);
 }
 
+/**
+ * Normalizes an address into the key `recipientStatuses`/the in-flight and failure trackers below use -
+ * matching `classifyRecipientTier()`'s own lowercase-domain comparison (`@rapidmx/react-shared`'s
+ * `composeSecurity.ts`), but applied to the whole address rather than just the domain. Without this, the
+ * same mailbox typed with different casing across To/Cc/Bcc (plausible via autocomplete vs. a pasted
+ * signature block) is tracked as two independent recipients: if one lookup lags or fails while the other
+ * succeeds, `decideMessageEncryption()`'s all-or-nothing check sees a spurious unresolved recipient and
+ * denies auto-encryption even though every *real* recipient resolved fine. Only ever used as an internal
+ * cache key - `ComposeRecipientInput.address` itself (what is actually sent as the recipient) is untouched.
+ */
+function addressCacheKey(address: string): string {
+    return address.trim().toLowerCase();
+}
+
 function HeaderButton({
     label,
     onClick,
@@ -411,26 +425,27 @@ export default function ComposeWindow({
         const ownPrefersMutual = mailbox.encryptPreference?.preferEncrypt === "mutual";
         const generation = discoveryGenerationRef.current;
         const inFlight = lookupsInFlightRef.current;
-        const unchecked = addresses.filter((r) => !(r.address in recipientStatuses) && !inFlight.has(r.address));
+        const unchecked = addresses.filter((r) => !(addressCacheKey(r.address) in recipientStatuses) && !inFlight.has(addressCacheKey(r.address)));
         for (const recipient of unchecked) {
-            inFlight.add(recipient.address);
+            const key = addressCacheKey(recipient.address);
+            inFlight.add(key);
             void lookupKeys(mailbox.uid, recipient.address)
                 .then(
                     (lookup) => ({ lookup }),
                     () => null,
                 )
                 .then((result) => {
-                    inFlight.delete(recipient.address);
+                    inFlight.delete(key);
                     if (generation !== discoveryGenerationRef.current) {
                         return;
                     }
                     if (!result) {
-                        noteLookupFailed(recipient.address);
+                        noteLookupFailed(key);
                         return;
                     }
-                    lookupFailuresRef.current.delete(recipient.address);
+                    lookupFailuresRef.current.delete(key);
                     const status = resolveRecipientEncryption(mailbox.primarySmtpAddress, ownPrefersMutual, encryptionPolicy, recipient.address, result.lookup);
-                    setRecipientStatuses((prev) => ({ ...prev, [recipient.address]: status }));
+                    setRecipientStatuses((prev) => ({ ...prev, [key]: status }));
                 });
         }
     }
@@ -1070,7 +1085,7 @@ export default function ComposeWindow({
     // (4) Send encrypts (or is refused, with the override, when it can't) - never silently plaintext. And back: when it stops being encrypted
     // (a recipient removed) autosave simply resumes.
     const currentAddresses = [...parseAddresses(to), ...parseAddresses(cc), ...parseAddresses(bcc)].map((r) => r.address);
-    const currentStatuses = currentAddresses.map((address) => recipientStatuses[address]);
+    const currentStatuses = currentAddresses.map((address) => recipientStatuses[addressCacheKey(address)]);
     const hasEncryptionKey = !!unlockedKeys?.encryptionPrivateKey || hasEnrolledEncryptionKey || offeredCryptoRef.current.encrypt;
     const requirement = evaluateEncryptionRequirement({
         encryptRequested,
@@ -1480,8 +1495,22 @@ export default function ComposeWindow({
                 )}
 
                 {(() => {
+                    // De-duplicated by the same normalized key `recipientStatuses` itself is keyed by - two
+                    // fields (or one field twice) naming the same mailbox in different casing now resolve to
+                    // one shared status object (see `addressCacheKey()`'s own doc comment), so without this
+                    // the list below would render - and React would warn about - two `<li key=...>`s sharing
+                    // the exact same key.
+                    const seenKeys = new Set<string>();
                     const knownRecipients = [...parseAddresses(to), ...parseAddresses(cc), ...parseAddresses(bcc)]
-                        .map((r) => recipientStatuses[r.address])
+                        .filter((r) => {
+                            const key = addressCacheKey(r.address);
+                            if (seenKeys.has(key)) {
+                                return false;
+                            }
+                            seenKeys.add(key);
+                            return true;
+                        })
+                        .map((r) => recipientStatuses[addressCacheKey(r.address)])
                         .filter((status): status is RecipientEncryptionStatus => !!status);
                     if (knownRecipients.length === 0) {
                         return null;

package/apps/shared/search/localIndexRpcClient.ts

@@ -20,6 +20,11 @@
  *
  * **Failed deletions are retried**: a destroy that couldn't remove a directory (another tab held it, the page
  * navigated away first) is recorded in `localStorage` and retried before this tab's first `init`.
+ *
+ * **A crashed Worker never leaves a caller hanging**: the `error` listener registered in `getWorker()` rejects
+ * every pending request and drops the module-level `worker` reference so the next `call()` spawns a
+ * replacement. `searchTier2.ts` additionally races its own calls against a timeout, since a Worker that's
+ * merely stuck (not crashed) posts no `error` event at all.
  */
 import type { ParsedSearchQuery } from "@rapidmx/react-shared/search/queryGrammar.js";
 import type {
@@ -71,8 +76,12 @@ function getWorker(): Worker {
     if (!worker) {
         // Named by its compiled `.js` file, like every other relative import: tsc copies the literal into
         // `dist` unchanged, where only the `.js` file exists, and Vite maps it back to the `.ts` source.
-        worker = new Worker(new URL("./localIndexWorker.js", import.meta.url), { type: "module" });
-        worker.addEventListener("message", (event: MessageEvent<LocalIndexResponse>) => {
+        // Captured in its own `created` const (not just read back from the module-level `worker` variable)
+        // so the `error` listener below can tell whether it still refers to *this* Worker - see that
+        // listener's own comment for why that guard matters.
+        const created = new Worker(new URL("./localIndexWorker.js", import.meta.url), { type: "module" });
+        worker = created;
+        created.addEventListener("message", (event: MessageEvent<LocalIndexResponse>) => {
             const entry = pending.get(event.data.id);
             if (!entry) {
                 return;
@@ -84,6 +93,28 @@ function getWorker(): Worker {
                 entry.reject(new Error(event.data.error));
             }
         });
+        // A Worker that crashes (an uncaught exception, the WASM module aborting) never posts a response to
+        // its in-flight requests - without this, every pending call() promise would sit unresolved forever,
+        // and searchTier2.ts's try/catch (which can only catch a *rejection*) couldn't rescue it. Reject
+        // everything outstanding and drop the reference so the next call() spawns a fresh Worker instead of
+        // continuing to postMessage into a dead one.
+        //
+        // Scoped to `created`, this listener's own Worker, via the `worker !== created` check below - not
+        // scoped, a very unlikely double-error (this same Worker firing a second `error` event after the
+        // first already replaced `worker` with a healthy new instance) would reject that new instance's own
+        // in-flight requests and terminate it too, for no reason of its own.
+        created.addEventListener("error", (event: ErrorEvent) => {
+            if (worker !== created) {
+                return;
+            }
+            const err = new Error(`Local search Worker crashed: ${event.message || "unknown error"}`);
+            for (const entry of pending.values()) {
+                entry.reject(err);
+            }
+            pending.clear();
+            created.terminate();
+            worker = undefined;
+        });
         // Only a tab with a Worker has connections to close when another tab signs out.
         listenForSignOut();
     }

package/apps/shared/search/searchTier2.ts

@@ -44,36 +44,54 @@ async function ensureInitialized(mailboxUid: string, unlocked: UnlockedKeys): Pr
     await initLocalIndex({ mailboxUid, indexKey });
 }
 
+/** How long a Tier 2 search may run before this function gives up on it and degrades to "no local results" -
+ * `localIndexRpcClient.ts`'s own `error` listener rescues a Worker that *crashes*, but a Worker that's merely
+ * wedged (an infinite loop in the WASM module, a stuck OPFS lock) posts no `error` event and no response
+ * either; without this, the caller's `Promise.all()` (`apps/www/index.tsx`) would wait on this tier forever
+ * even though Tier 1's results already arrived. */
+export const TIER2_SEARCH_TIMEOUT_MS = 5_000;
+
 export async function searchLocalIndex(
     mailboxUid: string,
     parsed: ParsedSearchQuery,
     unlocked: UnlockedKeys | undefined,
     limit = 50,
     offset = 0,
+    timeoutMs = TIER2_SEARCH_TIMEOUT_MS,
 ): Promise<Tier2SearchOutcome> {
     if (!unlocked) {
         return { results: [], hasMore: false };
     }
+    let timer: ReturnType<typeof setTimeout> | undefined;
     try {
-        await ensureInitialized(mailboxUid, unlocked);
-        const [page, coverage] = await Promise.all([searchLocal(mailboxUid, parsed, limit, offset), getLocalCoverage(mailboxUid)]);
-        const results: SearchResult[] = page.hits.map((hit) => ({
-            entityType: "message",
-            entityUid: hit.entityUid,
-            // Negated: bm25()'s own convention is "more negative is a better match" (SQLite), the
-            // opposite of every other score this codebase merges (Postgres ts_rank, OpenSearch _score,
-            // and normalizeServerScores() itself all treat "higher is better"). Negating here, once,
-            // keeps that convention uniform for the caller (apps/www/index.tsx's merge layer) - it never
-            // needs to know this tier's underlying scoring function works backwards from the others.
-            score: -hit.score,
-            snippet: hit.snippet,
-            source: "local",
-            metadataOnly: false,
-        }));
-        return { results, coverage, hasMore: page.hasMore };
+        return await Promise.race([
+            (async (): Promise<Tier2SearchOutcome> => {
+                await ensureInitialized(mailboxUid, unlocked);
+                const [page, coverage] = await Promise.all([searchLocal(mailboxUid, parsed, limit, offset), getLocalCoverage(mailboxUid)]);
+                const results: SearchResult[] = page.hits.map((hit) => ({
+                    entityType: "message",
+                    entityUid: hit.entityUid,
+                    // Negated: bm25()'s own convention is "more negative is a better match" (SQLite), the
+                    // opposite of every other score this codebase merges (Postgres ts_rank, OpenSearch _score,
+                    // and normalizeServerScores() itself all treat "higher is better"). Negating here, once,
+                    // keeps that convention uniform for the caller (apps/www/index.tsx's merge layer) - it never
+                    // needs to know this tier's underlying scoring function works backwards from the others.
+                    score: -hit.score,
+                    snippet: hit.snippet,
+                    source: "local",
+                    metadataOnly: false,
+                }));
+                return { results, coverage, hasMore: page.hasMore };
+            })(),
+            new Promise<Tier2SearchOutcome>((resolve) => {
+                timer = setTimeout(() => resolve({ results: [], hasMore: false }), timeoutMs);
+            }),
+        ]);
     } catch {
         // See this function's own doc comment - a broken local index degrades to "nothing to contribute
         // this time," never a rejected search.
         return { results: [], hasMore: false };
+    } finally {
+        clearTimeout(timer);
     }
 }

package/apps/www/index.tsx

@@ -378,6 +378,16 @@ const LOAD_MORE_ROOT_MARGIN_PX = 200;
  * "Load more" button instead. */
 const MAX_EMPTY_PAGE_CONTINUATIONS = 3;
 
+/** Hard ceiling on how many rows one list (the plain message list or the conversation list) keeps as live
+ * React state/DOM at once. `MAX_EMPTY_PAGE_CONTINUATIONS` above only bounds a streak of *empty* pages, not
+ * the total accumulated row count - infinite scroll on its own has no natural stopping point, so a reader
+ * who fully scrolls a large mailbox would otherwise keep every row ever fetched mounted forever. Past this
+ * cap, `loadMore()` stops fetching further pages and the list shows a "refine your search" banner instead of
+ * the load-more sentinel - deliberately not virtualization (a larger, riskier change this bug's own writeup
+ * called for only if trivial, which it isn't given this file's existing structure): capping the row count is
+ * the same fix's low-risk cousin, since the unbounded-memory failure mode is identical either way. */
+const MAX_LOADED_ROWS = 500;
+
 /** `true` when `more` has at least one row `shown` doesn't - i.e. appending it actually adds rows. Generic
  * over the row's own identity so both the message list (`uid`) and the conversation list
  * (`conversationId`) page the same way. */
@@ -397,8 +407,11 @@ function isWithinLoadMoreRange(sentinel: HTMLElement, root: HTMLElement): boolea
 /** Appends `more` to `shown`, skipping any row already shown - a later page can repeat rows (Tier 1 and
  * Tier 2/3 cursors advance independently, so the same message can come back from a different tier on a
  * later page; a plain folder listing's pages shift when new mail arrives between fetches). Generic for the
- * same reason `hasUnseenRows()` is. */
-function appendUnseenRows<T>(shown: T[], more: T[], idOf: (row: T) => string): T[] {
+ * same reason `hasUnseenRows()` is.
+ *
+ * `cap`, when given, truncates the result to its first `cap` rows (dropping the tail) rather than letting
+ * accumulated pages grow without bound - see `MAX_LOADED_ROWS`'s own doc comment for why this exists. */
+function appendUnseenRows<T>(shown: T[], more: T[], idOf: (row: T) => string, cap?: number): T[] {
     const seen = new Set(shown.map(idOf));
     const unseen: T[] = [];
     for (const row of more) {
@@ -407,7 +420,11 @@ function appendUnseenRows<T>(shown: T[], more: T[], idOf: (row: T) => string): T
             unseen.push(row);
         }
     }
-    return unseen.length === 0 ? shown : [...shown, ...unseen];
+    if (unseen.length === 0) {
+        return shown;
+    }
+    const combined = [...shown, ...unseen];
+    return cap !== undefined && combined.length > cap ? combined.slice(0, cap) : combined;
 }
 
 const messageUid = (message: Message) => message.uid;
@@ -1209,10 +1226,15 @@ function InboxContent({ userUid }: { userUid?: string }) {
         // has fully finished (the ref may still hold an earlier query's), in which case there's nowhere to
         // continue from yet.
         const searchCursor = decodeCursor(compositeCursorRef.current, fingerprint);
+        // Reads the ref, not `conversations`/`messages` state, so this callback (and the observer effect
+        // watching it) don't need to be recreated every time a page lands - the same reason every other
+        // check below reads a ref rather than closing over state.
+        const atRowCap = (preferences.showAsConversations ? conversationsRef.current.length : messagesRef.current.length) >= MAX_LOADED_ROWS;
         if (
             loadMoreInFlightRef.current ||
             !hasMore ||
             loading ||
+            atRowCap ||
             (!preferences.showAsConversations && !folderUid) ||
             (isSearching && !searchCursor)
         ) {
@@ -1251,7 +1273,7 @@ function InboxContent({ userUid }: { userUid?: string }) {
                     return;
                 }
                 const addedRows = hasUnseenRows(conversationsRef.current, more, conversationKey);
-                setConversations((prev) => appendUnseenRows(prev, more, conversationKey));
+                setConversations((prev) => appendUnseenRows(prev, more, conversationKey, MAX_LOADED_ROWS));
                 setHasMore(more.length === MESSAGE_PAGE_SIZE);
                 listedOffsetRef.current = page * MESSAGE_PAGE_SIZE + more.length;
                 notePageLanded(addedRows, more.length === MESSAGE_PAGE_SIZE);
@@ -1280,7 +1302,7 @@ function InboxContent({ userUid }: { userUid?: string }) {
                     return;
                 }
                 const addedRows = hasUnseenRows(messagesRef.current, more, messageUid);
-                setMessages((prev) => appendUnseenRows(prev, more, messageUid));
+                setMessages((prev) => appendUnseenRows(prev, more, messageUid, MAX_LOADED_ROWS));
                 setSnippets((prev) => ({ ...prev, ...moreSnippets }));
 
                 const nextTier3Offset = tier3Offset + tier3Page.length;
@@ -1304,7 +1326,7 @@ function InboxContent({ userUid }: { userUid?: string }) {
                     return;
                 }
                 const addedRows = hasUnseenRows(messagesRef.current, more, messageUid);
-                setMessages((prev) => appendUnseenRows(prev, more, messageUid));
+                setMessages((prev) => appendUnseenRows(prev, more, messageUid, MAX_LOADED_ROWS));
                 setHasMore(more.length === MESSAGE_PAGE_SIZE);
                 listedOffsetRef.current = page * MESSAGE_PAGE_SIZE + more.length;
                 notePageLanded(addedRows, more.length === MESSAGE_PAGE_SIZE);
@@ -1461,6 +1483,15 @@ function InboxContent({ userUid }: { userUid?: string }) {
      * arrived, so paging keeps appending to the same accumulated set. */
     const listedConversations = sortConversations(conversations, preferences.sortBy, preferences.sortOrder);
 
+    /** `true` once whichever list is on screen has hit `MAX_LOADED_ROWS` *and* the server still has more to
+     * give - `appendUnseenRows()` itself already stopped growing the array at that point, and `loadMore()`
+     * refuses to fetch further pages (see its own `atRowCap` check); this just drives the "refine your
+     * search" banner replacing the load-more sentinel below. The `hasMore` half matters at the edge: a
+     * mailbox/search whose true size lands at or near the cap can have its very last page be a partial one,
+     * which correctly turns `hasMore` false - without checking it here, the banner would still claim rows
+     * are being hidden even though every one of them is already on screen. */
+    const rowCapReached = hasMore && (preferences.showAsConversations ? conversations.length : messages.length) >= MAX_LOADED_ROWS;
+
     function leaveSelectMode() {
         setSelectMode(false);
         setSelectedUids(new Set());
@@ -2112,11 +2143,16 @@ function InboxContent({ userUid }: { userUid?: string }) {
                             selectedConversationIds={selectedConversationIds}
                             onToggleSelected={toggleConversationSelected}
                         />
-                        {hasMore && (
+                        {hasMore && !rowCapReached && (
                             <div ref={setSentinel} data-testid="load-more-sentinel" className="p-4 text-center text-xs text-text-muted">
                                 {loadMoreStatus}
                             </div>
                         )}
+                        {rowCapReached && (
+                            <p className="p-4 text-center text-xs text-text-muted">
+                                Showing the most recent {MAX_LOADED_ROWS} conversations &mdash; refine your search or filters to see more.
+                            </p>
+                        )}
                     </>
                 ) : messages.length === 0 ? (
                     <>
@@ -2213,11 +2249,16 @@ function InboxContent({ userUid }: { userUid?: string }) {
                                 </li>
                             ))}
                         </ul>
-                        {hasMore && (
+                        {hasMore && !rowCapReached && (
                             <div ref={setSentinel} data-testid="load-more-sentinel" className="p-4 text-center text-xs text-text-muted">
                                 {loadMoreStatus}
                             </div>
                         )}
+                        {rowCapReached && (
+                            <p className="p-4 text-center text-xs text-text-muted">
+                                Showing the most recent {MAX_LOADED_ROWS} messages &mdash; refine your search or filters to see more.
+                            </p>
+                        )}
                         {aggregateFolderType && (
                             <p className="p-4 text-center text-xs text-text-muted">
                                 Showing the most recent mail from each mailbox. Open a specific mailbox&rsquo;s folder to

package/dist/apps/shared/components/calendar/EventModal.js

@@ -17,6 +17,7 @@ import FormField from "@rapidmx/react-shared/components/forms/FormField.js";
 import RecurrenceEditor from "./RecurrenceEditor.js";
 import { addDaysToKey, allDayDateKey, allDayInstant, recurrenceUntilDateKey, recurrenceUntilInstant, startWeekdayCode } from "./allDay.js";
 import ResourcePicker from "./ResourcePicker.js";
+import { joinMeetingUrl } from "../../calendar/calendarReminders.js";
 const INPUT_CLASS = "w-full text-sm py-2 px-3 border border-border rounded-sm bg-surface text-text focus:outline-none focus:border-primary";
 const SELECT_CLASS = "text-sm py-2 px-2 border border-border rounded-sm bg-surface text-text focus:outline-none focus:border-primary";
 const ATTENDEE_ROLES = ["required", "optional", "resource"];
@@ -68,7 +69,11 @@ function wallTimeOfDayMs(instantMs, timezone) {
 async function toSeriesFields(occurrence, fields) {
     const { startDate, endDate, ...rest } = fields;
     if (sameMinute(startDate, occurrence.startDate) && sameMinute(endDate, occurrence.endDate)) {
-        return rest;
+        // `saveEventSeries()` treats *any* `timezone`/`allDay` in the update as a possible reinterpretation of
+        // the master's instant and fetches the master to check - so when neither differs from the occurrence's
+        // own, both are dropped too, or every plain series save (e.g. just a new title) would pay for that GET.
+        const { timezone, allDay, ...others } = rest;
+        return timezone === occurrence.timezone && allDay === occurrence.allDay ? others : rest;
     }
     const master = await getCalendarEvent(occurrence.uid);
     const timezone = fields.timezone;
@@ -230,7 +235,7 @@ export default function EventModal({ open, onClose, mailboxUid, folderUid, calen
      * theirs and is preserved.
      *
      * **Known, deliberate limitation:** an event that already has a meeting is left completely alone, even
-     * when its attendee list has just changed. `@rapidmx/videoconf-plugin`'s `PUT /mail/video-meetings/:id`
+     * when its attendee list has just changed. `@rapidmx/meet-plugin`'s `PUT /mail/video-meetings/:id`
      * is deliberately minimal (title and cancellation only) and cannot add or remove invitees, and a private
      * meeting's personal join links are minted once at creation - so there is no way to reconcile an invitee
      * list, and silently pretending otherwise would leave a new attendee with no link and a removed one with
@@ -245,6 +250,20 @@ export default function EventModal({ open, onClose, mailboxUid, folderUid, calen
         if (videoEnabled === !!videoMeetingUid) {
             return { event: saved, failed: false };
         }
+        // Detaching a single occurrence (`detachOccurrence()`, react-shared's `calendarMutations.ts`)
+        // deliberately never copies the series' `videoMeetingUid` onto the new standalone event - that
+        // shared meeting belongs to the series, not to the one occurrence being split off, and every other
+        // occurrence still needs it live. But this component's own `videoMeetingUid` *state* was seeded
+        // from the series' occurrence at mount and is untouched by the detach, so unchecking the toggle
+        // while detaching would otherwise still look like "off, but state says linked" above and fall into
+        // the cancel branch below - cancelling the series' shared meeting for every remaining occurrence,
+        // not just this one. `saved.videoMeetingUid` is the actual just-persisted record, so when the
+        // toggle is off and that record already has no meeting reference (true for every detach, checked or
+        // not - see this function's own doc comment on the still-checked case being a separate, documented
+        // gap), there is nothing of *this* record's to cancel.
+        if (!videoEnabled && !saved.videoMeetingUid) {
+            return { event: saved, failed: false };
+        }
         try {
             if (videoEnabled) {
                 const organizerAddressLower = saved.organizer.address.toLowerCase();
@@ -287,7 +306,15 @@ export default function EventModal({ open, onClose, mailboxUid, folderUid, calen
             return { event: patched, failed: false };
         }
         catch (err) {
-            setVideoError(err instanceof ApiRequestError ? err.message : "Could not update this event's video conferencing.");
+            // `videoMeetingsApi.ts`'s own doc comment: when the plugin isn't installed at all, its routes
+            // simply aren't mounted and every call here fails with a plain 404 - a caller offering video
+            // conferencing optionally must treat that as "not available here," not alarm the reader with
+            // the raw (often server-generated, unhelpful) 404 body text.
+            setVideoError(err instanceof ApiRequestError
+                ? err.status === 404
+                    ? "Video conferencing is not available on this server."
+                    : err.message
+                : "Could not update this event's video conferencing.");
             return { event: saved, failed: true };
         }
     }
@@ -439,6 +466,13 @@ export default function EventModal({ open, onClose, mailboxUid, folderUid, calen
     if (syncWarning) {
         return (_jsxs(Modal, { open: open, onClose: onSaved, title: "Series saved", children: [_jsx("p", { role: "alert", className: "text-sm mb-4", children: "The series was saved, but some occurrences you had changed individually couldn\u2019t be moved with it. They may now appear twice - check the calendar and delete any duplicate." }), _jsx(Button, { type: "button", className: "!w-auto", onClick: onSaved, children: "OK" })] }));
     }
-    return (_jsx(Modal, { open: open, onClose: onClose, title: occurrence ? "Edit event" : "New event", children: _jsxs("form", { onSubmit: handleSubmit, className: "flex flex-col gap-1", children: [error && _jsx(Alert, { children: error }), canRespond && (_jsxs("div", { className: "flex flex-col gap-2 mb-3 p-3 rounded-sm bg-surface-alt", children: [_jsxs("div", { className: "flex items-center justify-between gap-3 flex-wrap", children: [_jsx("span", { className: "text-sm font-medium", children: "Your response" }), _jsxs("div", { className: "flex gap-2", children: [_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", disabled: responding, onClick: () => handleRespond("accepted"), children: "Accept" }), _jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", disabled: responding, onClick: () => handleRespond("tentative"), children: "Tentative" }), _jsx(Button, { type: "button", variant: "secondary", className: "!w-auto text-danger", disabled: responding, onClick: () => handleRespond("declined"), children: "Decline" })] })] }), _jsx("p", { className: "text-xs text-text-muted", children: "Other attendees\u2019 responses may take a few minutes to update." })] })), isInvited && (_jsx("p", { className: "text-xs text-text-muted mb-3", children: "You were invited to this event. Only the organizer can change its details." })), videoMeetingUid && (_jsxs("div", { className: "flex items-center gap-3 mb-3", children: [_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", disabled: !organizerJoinUrl, onClick: () => window.open(organizerJoinUrl, "_blank", "noopener,noreferrer"), children: "Join video call" }), !organizerJoinUrl && (_jsx("span", { className: "text-xs text-text-muted", children: organizerJoinUrl === null ? "This meeting’s join link isn’t available." : "Loading the join link…" }))] })), _jsxs("fieldset", { disabled: isInvited, className: "flex flex-col gap-1 min-w-0", children: [!occurrence && mailboxOptions && mailboxOptions.length > 1 && (_jsx(FormField, { label: "Mailbox", htmlFor: "event-mailbox", children: _jsx("select", { id: "event-mailbox", className: INPUT_CLASS, value: targetMailboxUid, onChange: (e) => handleMailboxChange(e.target.value), children: mailboxOptions.map(({ mailbox }) => (_jsxs("option", { value: mailbox.uid, children: [mailbox.displayName, mailbox.ownerUserUid ? "" : " (shared)"] }, mailbox.uid))) }) })), !occurrence && calendarChoices && calendarChoices.length > 1 && (_jsx(FormField, { label: "Calendar", htmlFor: "event-calendar", children: _jsx("select", { id: "event-calendar", className: INPUT_CLASS, value: targetFolderUid, onChange: (e) => setTargetFolderUid(e.target.value), children: calendarChoices.map((cal) => (_jsx("option", { value: cal.uid, children: cal.name }, cal.uid))) }) })), _jsx(FormField, { label: "Title", htmlFor: "event-title", children: _jsx("input", { id: "event-title", type: "text", className: INPUT_CLASS, value: title, onChange: (e) => setTitle(e.target.value) }) }), _jsx(FormField, { label: "Location", htmlFor: "event-location", children: _jsx("input", { id: "event-location", type: "text", className: INPUT_CLASS, value: location, onChange: (e) => setLocation(e.target.value) }) }), _jsxs("div", { className: "mb-3", children: [_jsxs("label", { className: "flex items-center gap-2 text-sm font-medium", children: [_jsx("input", { type: "checkbox", checked: videoEnabled, onChange: (e) => setVideoEnabled(e.target.checked) }), "Add video conferencing"] }), videoEnabled && (_jsx("p", { className: "text-xs text-text-muted mt-1", children: "Changing attendees after enabling video conferencing won\u2019t update meeting invitees \u2014 turn this off and back on to reissue links to the current attendee list." })), videoError && (_jsx("p", { role: "alert", className: "text-xs text-danger mt-1", children: videoError }))] }), _jsxs("label", { className: "flex items-center gap-2 text-sm font-medium mb-3", children: [_jsx("input", { type: "checkbox", checked: allDay, onChange: (e) => handleAllDayChange(e.target.checked) }), "All day"] }), _jsxs("div", { className: "grid grid-cols-2 gap-3", children: [_jsx(FormField, { label: "Start", htmlFor: "event-start", children: _jsx("input", { id: "event-start", type: allDay ? "date" : "datetime-local", className: INPUT_CLASS, value: allDay ? start.slice(0, 10) : start, onChange: (e) => setStart(allDay ? `${e.target.value}T00:00` : e.target.value) }) }), _jsx(FormField, { label: "End", htmlFor: "event-end", children: _jsx("input", { id: "event-end", type: allDay ? "date" : "datetime-local", className: INPUT_CLASS, value: allDay ? end.slice(0, 10) : end, onChange: (e) => setEnd(allDay ? `${e.target.value}T00:00` : e.target.value) }) })] }), _jsx(FormField, { label: "Attendees", htmlFor: "event-attendees", children: _jsxs("div", { id: "event-attendees", className: "flex flex-col gap-2", children: [attendees.map((attendee, i) => (_jsxs("div", { className: "flex gap-2", children: [_jsx("input", { type: "email", className: `${INPUT_CLASS} flex-1`, value: attendee.address, onChange: (e) => updateAttendee(i, { address: e.target.value }), "aria-label": `Attendee email ${i + 1}` }), _jsx("select", { className: SELECT_CLASS, value: attendee.role, onChange: (e) => updateAttendee(i, { role: e.target.value }), "aria-label": `Attendee role ${i + 1}`, children: ATTENDEE_ROLES.map((role) => (_jsx("option", { value: role, children: role }, role))) }), _jsx("span", { className: "text-xs font-medium text-text-muted shrink-0 py-1 px-2.5 rounded-pill bg-surface-alt self-center", children: RESPONSE_STATUS_LABEL[attendee.responseStatus] }), _jsx("button", { type: "button", onClick: () => removeAttendee(i), className: "text-sm text-danger px-2", "aria-label": `Remove attendee ${i + 1}`, children: "\u00D7" })] }, i))), _jsxs("div", { className: "flex gap-3 items-center", children: [_jsx("button", { type: "button", onClick: () => setAttendees((prev) => [...prev, { address: "", role: "required", responseStatus: "needsAction", isOrganizer: false }]), className: "self-start text-xs font-medium text-primary-dark hover:underline", children: "+ Add attendee" }), _jsx("button", { ref: addResourceButtonRef, type: "button", onClick: () => setResourcePickerOpen(true), className: "self-start text-xs font-medium text-primary-dark hover:underline", children: "+ Add room/equipment" })] }), resourcePickerOpen && (_jsx(ResourcePicker, { anchorRef: addResourceButtonRef, onClose: () => setResourcePickerOpen(false), onSelect: addResource, excludeAddresses: attendees.map((a) => a.address.toLowerCase()) }))] }) }), _jsxs("div", { className: "grid grid-cols-2 gap-3", children: [_jsx(FormField, { label: "Busy status", htmlFor: "event-busyStatus", children: _jsx("select", { id: "event-busyStatus", className: INPUT_CLASS, value: busyStatus, onChange: (e) => setBusyStatus(e.target.value), children: BUSY_STATUSES.map((status) => (_jsx("option", { value: status, children: BUSY_STATUS_LABEL[status] }, status))) }) }), _jsx(FormField, { label: "Reminder (minutes before)", htmlFor: "event-reminder", children: _jsx("input", { id: "event-reminder", type: "number", min: 0, className: INPUT_CLASS, value: reminderMinutes, onChange: (e) => setReminderMinutes(e.target.value), placeholder: "None" }) })] }), _jsxs("div", { className: "mb-3", children: [_jsxs("label", { className: "flex items-center gap-2 text-sm font-medium", children: [_jsx("input", { type: "checkbox", checked: autoReplyEnabled, onChange: (e) => setAutoReplyEnabled(e.target.checked) }), "Send an automatic reply while this event is happening"] }), _jsx("p", { className: "text-xs text-text-muted mt-1", children: "Applies in addition to your mailbox\u2019s own Automatic Replies setting (see Settings) \u2014 this event\u2019s message takes over for its own start/end window." }), autoReplyEnabled && (_jsx("textarea", { "aria-label": "Automatic reply message", className: `${INPUT_CLASS} mt-2`, rows: 3, value: autoReplyMessage, onChange: (e) => setAutoReplyMessage(e.target.value), placeholder: "I'm out of office and back on..." }))] }), !editingSingleOccurrence && (_jsx(FormField, { label: "Recurrence", htmlFor: "event-recurrence", children: _jsx(RecurrenceEditor, { value: recurrenceRule, onChange: setRecurrenceRule, allDay: allDay, startWeekday: startWeekdayCode(start, allDay, timezone) }) })), occurrence?.isRecurringOccurrence && !isInvited && (_jsxs("fieldset", { className: "flex flex-col gap-1.5 text-sm mb-3", children: [_jsx("legend", { className: "text-xs font-bold uppercase tracking-wide text-text-muted mb-1", children: "Apply changes to" }), _jsxs("label", { className: "flex items-center gap-2", children: [_jsx("input", { type: "radio", name: "event-edit-scope", checked: editScope === "occurrence", onChange: () => setEditScope("occurrence") }), "This event only"] }), _jsxs("label", { className: "flex items-center gap-2", children: [_jsx("input", { type: "radio", name: "event-edit-scope", checked: editScope === "series", onChange: () => setEditScope("series") }), "The entire series"] })] }))] }), _jsxs("div", { className: "flex gap-3 mt-2", children: [!isInvited && (_jsx(Button, { type: "submit", loading: saving, disabled: saving, className: "!w-auto", children: "Save" })), _jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", onClick: onClose, children: "Cancel" }), occurrence &&
+    // Same scheme allow-list `calendarReminders.ts#joinMeetingUrl()` already applies to a reminder's own
+    // `location` field - reused here rather than duplicated so a video-conferencing plugin (or a stray
+    // manual edit of `videoMeetingUid`'s otherwise-plugin-owned join link) can't smuggle a `javascript:`/
+    // `file:`/other non-http(s) URL into `window.open()`. `undefined` (still loading) and `null` (fetch
+    // came back with nothing to join) both fail validation the same way as a bad scheme would - the button
+    // stays disabled either way, and the two are told apart below purely from `organizerJoinUrl` itself.
+    const validatedJoinUrl = joinMeetingUrl(organizerJoinUrl);
+    return (_jsx(Modal, { open: open, onClose: onClose, title: occurrence ? "Edit event" : "New event", children: _jsxs("form", { onSubmit: handleSubmit, className: "flex flex-col gap-1", children: [error && _jsx(Alert, { children: error }), canRespond && (_jsxs("div", { className: "flex flex-col gap-2 mb-3 p-3 rounded-sm bg-surface-alt", children: [_jsxs("div", { className: "flex items-center justify-between gap-3 flex-wrap", children: [_jsx("span", { className: "text-sm font-medium", children: "Your response" }), _jsxs("div", { className: "flex gap-2", children: [_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", disabled: responding, onClick: () => handleRespond("accepted"), children: "Accept" }), _jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", disabled: responding, onClick: () => handleRespond("tentative"), children: "Tentative" }), _jsx(Button, { type: "button", variant: "secondary", className: "!w-auto text-danger", disabled: responding, onClick: () => handleRespond("declined"), children: "Decline" })] })] }), _jsx("p", { className: "text-xs text-text-muted", children: "Other attendees\u2019 responses may take a few minutes to update." })] })), isInvited && (_jsx("p", { className: "text-xs text-text-muted mb-3", children: "You were invited to this event. Only the organizer can change its details." })), videoMeetingUid && (_jsxs("div", { className: "flex items-center gap-3 mb-3", children: [_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", disabled: !validatedJoinUrl, onClick: () => window.open(validatedJoinUrl, "_blank", "noopener,noreferrer"), children: "Join video call" }), !validatedJoinUrl && (_jsx("span", { className: "text-xs text-text-muted", children: organizerJoinUrl === undefined ? "Loading the join link…" : "This meeting’s join link isn’t available." }))] })), _jsxs("fieldset", { disabled: isInvited, className: "flex flex-col gap-1 min-w-0", children: [!occurrence && mailboxOptions && mailboxOptions.length > 1 && (_jsx(FormField, { label: "Mailbox", htmlFor: "event-mailbox", children: _jsx("select", { id: "event-mailbox", className: INPUT_CLASS, value: targetMailboxUid, onChange: (e) => handleMailboxChange(e.target.value), children: mailboxOptions.map(({ mailbox }) => (_jsxs("option", { value: mailbox.uid, children: [mailbox.displayName, mailbox.ownerUserUid ? "" : " (shared)"] }, mailbox.uid))) }) })), !occurrence && calendarChoices && calendarChoices.length > 1 && (_jsx(FormField, { label: "Calendar", htmlFor: "event-calendar", children: _jsx("select", { id: "event-calendar", className: INPUT_CLASS, value: targetFolderUid, onChange: (e) => setTargetFolderUid(e.target.value), children: calendarChoices.map((cal) => (_jsx("option", { value: cal.uid, children: cal.name }, cal.uid))) }) })), _jsx(FormField, { label: "Title", htmlFor: "event-title", children: _jsx("input", { id: "event-title", type: "text", className: INPUT_CLASS, value: title, onChange: (e) => setTitle(e.target.value) }) }), _jsx(FormField, { label: "Location", htmlFor: "event-location", children: _jsx("input", { id: "event-location", type: "text", className: INPUT_CLASS, value: location, onChange: (e) => setLocation(e.target.value) }) }), _jsxs("div", { className: "mb-3", children: [_jsxs("label", { className: "flex items-center gap-2 text-sm font-medium", children: [_jsx("input", { type: "checkbox", checked: videoEnabled, onChange: (e) => setVideoEnabled(e.target.checked) }), "Add video conferencing"] }), videoEnabled && (_jsx("p", { className: "text-xs text-text-muted mt-1", children: "Changing attendees after enabling video conferencing won\u2019t update meeting invitees \u2014 turn this off and back on to reissue links to the current attendee list." })), videoError && (_jsx("p", { role: "alert", className: "text-xs text-danger mt-1", children: videoError }))] }), _jsxs("label", { className: "flex items-center gap-2 text-sm font-medium mb-3", children: [_jsx("input", { type: "checkbox", checked: allDay, onChange: (e) => handleAllDayChange(e.target.checked) }), "All day"] }), _jsxs("div", { className: "grid grid-cols-2 gap-3", children: [_jsx(FormField, { label: "Start", htmlFor: "event-start", children: _jsx("input", { id: "event-start", type: allDay ? "date" : "datetime-local", className: INPUT_CLASS, value: allDay ? start.slice(0, 10) : start, onChange: (e) => setStart(allDay ? `${e.target.value}T00:00` : e.target.value) }) }), _jsx(FormField, { label: "End", htmlFor: "event-end", children: _jsx("input", { id: "event-end", type: allDay ? "date" : "datetime-local", className: INPUT_CLASS, value: allDay ? end.slice(0, 10) : end, onChange: (e) => setEnd(allDay ? `${e.target.value}T00:00` : e.target.value) }) })] }), _jsx(FormField, { label: "Attendees", htmlFor: "event-attendees", children: _jsxs("div", { id: "event-attendees", className: "flex flex-col gap-2", children: [attendees.map((attendee, i) => (_jsxs("div", { className: "flex gap-2", children: [_jsx("input", { type: "email", className: `${INPUT_CLASS} flex-1`, value: attendee.address, onChange: (e) => updateAttendee(i, { address: e.target.value }), "aria-label": `Attendee email ${i + 1}` }), _jsx("select", { className: SELECT_CLASS, value: attendee.role, onChange: (e) => updateAttendee(i, { role: e.target.value }), "aria-label": `Attendee role ${i + 1}`, children: ATTENDEE_ROLES.map((role) => (_jsx("option", { value: role, children: role }, role))) }), _jsx("span", { className: "text-xs font-medium text-text-muted shrink-0 py-1 px-2.5 rounded-pill bg-surface-alt self-center", children: RESPONSE_STATUS_LABEL[attendee.responseStatus] }), _jsx("button", { type: "button", onClick: () => removeAttendee(i), className: "text-sm text-danger px-2", "aria-label": `Remove attendee ${i + 1}`, children: "\u00D7" })] }, i))), _jsxs("div", { className: "flex gap-3 items-center", children: [_jsx("button", { type: "button", onClick: () => setAttendees((prev) => [...prev, { address: "", role: "required", responseStatus: "needsAction", isOrganizer: false }]), className: "self-start text-xs font-medium text-primary-dark hover:underline", children: "+ Add attendee" }), _jsx("button", { ref: addResourceButtonRef, type: "button", onClick: () => setResourcePickerOpen(true), className: "self-start text-xs font-medium text-primary-dark hover:underline", children: "+ Add room/equipment" })] }), resourcePickerOpen && (_jsx(ResourcePicker, { anchorRef: addResourceButtonRef, onClose: () => setResourcePickerOpen(false), onSelect: addResource, excludeAddresses: attendees.map((a) => a.address.toLowerCase()) }))] }) }), _jsxs("div", { className: "grid grid-cols-2 gap-3", children: [_jsx(FormField, { label: "Busy status", htmlFor: "event-busyStatus", children: _jsx("select", { id: "event-busyStatus", className: INPUT_CLASS, value: busyStatus, onChange: (e) => setBusyStatus(e.target.value), children: BUSY_STATUSES.map((status) => (_jsx("option", { value: status, children: BUSY_STATUS_LABEL[status] }, status))) }) }), _jsx(FormField, { label: "Reminder (minutes before)", htmlFor: "event-reminder", children: _jsx("input", { id: "event-reminder", type: "number", min: 0, className: INPUT_CLASS, value: reminderMinutes, onChange: (e) => setReminderMinutes(e.target.value), placeholder: "None" }) })] }), _jsxs("div", { className: "mb-3", children: [_jsxs("label", { className: "flex items-center gap-2 text-sm font-medium", children: [_jsx("input", { type: "checkbox", checked: autoReplyEnabled, onChange: (e) => setAutoReplyEnabled(e.target.checked) }), "Send an automatic reply while this event is happening"] }), _jsx("p", { className: "text-xs text-text-muted mt-1", children: "Applies in addition to your mailbox\u2019s own Automatic Replies setting (see Settings) \u2014 this event\u2019s message takes over for its own start/end window." }), autoReplyEnabled && (_jsx("textarea", { "aria-label": "Automatic reply message", className: `${INPUT_CLASS} mt-2`, rows: 3, value: autoReplyMessage, onChange: (e) => setAutoReplyMessage(e.target.value), placeholder: "I'm out of office and back on..." }))] }), !editingSingleOccurrence && (_jsx(FormField, { label: "Recurrence", htmlFor: "event-recurrence", children: _jsx(RecurrenceEditor, { value: recurrenceRule, onChange: setRecurrenceRule, allDay: allDay, startWeekday: startWeekdayCode(start, allDay, timezone) }) })), occurrence?.isRecurringOccurrence && !isInvited && (_jsxs("fieldset", { className: "flex flex-col gap-1.5 text-sm mb-3", children: [_jsx("legend", { className: "text-xs font-bold uppercase tracking-wide text-text-muted mb-1", children: "Apply changes to" }), _jsxs("label", { className: "flex items-center gap-2", children: [_jsx("input", { type: "radio", name: "event-edit-scope", checked: editScope === "occurrence", onChange: () => setEditScope("occurrence") }), "This event only"] }), _jsxs("label", { className: "flex items-center gap-2", children: [_jsx("input", { type: "radio", name: "event-edit-scope", checked: editScope === "series", onChange: () => setEditScope("series") }), "The entire series"] })] }))] }), _jsxs("div", { className: "flex gap-3 mt-2", children: [!isInvited && (_jsx(Button, { type: "submit", loading: saving, disabled: saving, className: "!w-auto", children: "Save" })), _jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", onClick: onClose, children: "Cancel" }), occurrence &&
                             (!occurrence.isRecurringOccurrence ? (_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto ml-auto text-danger", disabled: saving, onClick: () => handleDelete("series"), children: "Delete" })) : !confirmingDelete ? (_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto ml-auto text-danger", disabled: saving, onClick: () => setConfirmingDelete(true), children: "Delete" })) : (_jsxs("div", { className: "flex gap-2 ml-auto", children: [_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto text-danger", disabled: saving, onClick: () => handleDelete("occurrence"), children: "Delete this event" }), _jsx(Button, { type: "button", variant: "secondary", className: "!w-auto text-danger", disabled: saving, onClick: () => handleDelete("series"), children: "Delete series" })] })))] })] }) }));
 }

package/dist/apps/shared/components/mail/compose/ComposeWindow.js

@@ -64,6 +64,19 @@ const VIEWPORT_MARGIN = 24;
 function parseAddresses(value) {
     return parseRecipientList(value);
 }
+/**
+ * Normalizes an address into the key `recipientStatuses`/the in-flight and failure trackers below use -
+ * matching `classifyRecipientTier()`'s own lowercase-domain comparison (`@rapidmx/react-shared`'s
+ * `composeSecurity.ts`), but applied to the whole address rather than just the domain. Without this, the
+ * same mailbox typed with different casing across To/Cc/Bcc (plausible via autocomplete vs. a pasted
+ * signature block) is tracked as two independent recipients: if one lookup lags or fails while the other
+ * succeeds, `decideMessageEncryption()`'s all-or-nothing check sees a spurious unresolved recipient and
+ * denies auto-encryption even though every *real* recipient resolved fine. Only ever used as an internal
+ * cache key - `ComposeRecipientInput.address` itself (what is actually sent as the recipient) is untouched.
+ */
+function addressCacheKey(address) {
+    return address.trim().toLowerCase();
+}
 function HeaderButton({ label, onClick, icon: Icon, disabled, shortcut, }) {
     const env = useKeyEnvironment();
     return (_jsx("button", { type: "button", "aria-label": label, title: shortcut ? withHint(label, shortcut, env) : label, "aria-keyshortcuts": shortcut ? ariaKeyShortcuts(shortcut, env) : undefined, onClick: onClick, disabled: disabled, className: "w-6 h-6 flex items-center justify-center rounded-sm text-white/80 hover:bg-white/15 hover:text-white disabled:opacity-40 disabled:cursor-not-allowed", children: _jsx(Icon, { size: 14 }) }));
@@ -302,23 +315,24 @@ export default function ComposeWindow({ session, onClose, onToggleMinimize, user
         const ownPrefersMutual = mailbox.encryptPreference?.preferEncrypt === "mutual";
         const generation = discoveryGenerationRef.current;
         const inFlight = lookupsInFlightRef.current;
-        const unchecked = addresses.filter((r) => !(r.address in recipientStatuses) && !inFlight.has(r.address));
+        const unchecked = addresses.filter((r) => !(addressCacheKey(r.address) in recipientStatuses) && !inFlight.has(addressCacheKey(r.address)));
         for (const recipient of unchecked) {
-            inFlight.add(recipient.address);
+            const key = addressCacheKey(recipient.address);
+            inFlight.add(key);
             void lookupKeys(mailbox.uid, recipient.address)
                 .then((lookup) => ({ lookup }), () => null)
                 .then((result) => {
-                inFlight.delete(recipient.address);
+                inFlight.delete(key);
                 if (generation !== discoveryGenerationRef.current) {
                     return;
                 }
                 if (!result) {
-                    noteLookupFailed(recipient.address);
+                    noteLookupFailed(key);
                     return;
                 }
-                lookupFailuresRef.current.delete(recipient.address);
+                lookupFailuresRef.current.delete(key);
                 const status = resolveRecipientEncryption(mailbox.primarySmtpAddress, ownPrefersMutual, encryptionPolicy, recipient.address, result.lookup);
-                setRecipientStatuses((prev) => ({ ...prev, [recipient.address]: status }));
+                setRecipientStatuses((prev) => ({ ...prev, [key]: status }));
             });
         }
     }
@@ -932,7 +946,7 @@ export default function ComposeWindow({ session, onClose, onToggleMinimize, user
     // (4) Send encrypts (or is refused, with the override, when it can't) - never silently plaintext. And back: when it stops being encrypted
     // (a recipient removed) autosave simply resumes.
     const currentAddresses = [...parseAddresses(to), ...parseAddresses(cc), ...parseAddresses(bcc)].map((r) => r.address);
-    const currentStatuses = currentAddresses.map((address) => recipientStatuses[address]);
+    const currentStatuses = currentAddresses.map((address) => recipientStatuses[addressCacheKey(address)]);
     const hasEncryptionKey = !!unlockedKeys?.encryptionPrivateKey || hasEnrolledEncryptionKey || offeredCryptoRef.current.encrypt;
     const requirement = evaluateEncryptionRequirement({
         encryptRequested,
@@ -1132,8 +1146,22 @@ export default function ComposeWindow({ session, onClose, onToggleMinimize, user
                         ? "fixed inset-0 w-full h-full rounded-none border-0"
                         : ["border-b-0 rounded-t-md", manualSize ? "" : expanded ? "w-[720px] h-[85vh]" : "w-[480px] h-[520px]"].join(" "),
                 ].join(" "), children: [!isMobile && (_jsxs(_Fragment, { children: [_jsx("div", { onPointerDown: handleResizeStart("top"), "aria-hidden": "true", className: "absolute top-0 left-0 right-0 h-1.5 cursor-ns-resize z-20" }), _jsx("div", { onPointerDown: handleResizeStart("left"), "aria-hidden": "true", className: "absolute top-0 left-0 bottom-0 w-1.5 cursor-ew-resize z-20" }), _jsx("div", { onPointerDown: handleResizeStart("corner"), role: "separator", "aria-label": "Resize", className: "absolute top-0 left-0 w-3 h-3 cursor-nwse-resize z-30" })] })), _jsxs("div", { className: "h-10 shrink-0 flex items-center justify-between gap-2 px-3 bg-primary-darker text-white cursor-pointer", onClick: onToggleMinimize, children: [_jsx("span", { id: titleId, className: "text-sm font-medium truncate", children: title }), _jsxs("div", { className: "flex items-center gap-0.5", onClick: (e) => e.stopPropagation(), children: [_jsx(HeaderButton, { label: "Minimize", onClick: onToggleMinimize, icon: HiOutlineMinus }), !isMobile && (_jsx(HeaderButton, { label: expanded ? "Collapse" : "Expand", onClick: toggleExpanded, icon: expanded ? HiOutlineArrowsPointingIn : HiOutlineArrowsPointingOut })), _jsx(HeaderButton, { label: "Close", onClick: () => void handleClose(), icon: HiOutlineXMark, disabled: closing, shortcut: SHORTCUTS.compose.close })] })] }), _jsxs("div", { className: "flex-1 min-h-0 flex flex-col", children: [(folderError || draftError || sendError || attachError || discardError) && (_jsxs("div", { className: "px-3 pt-2 shrink-0 max-h-[45%] overflow-y-auto", children: [folderError && _jsx(Alert, { children: folderError }), draftError && _jsx(Alert, { children: draftError }), sendError && _jsx(Alert, { children: sendError }), attachError && _jsx(Alert, { children: attachError }), discardError && _jsx(Alert, { children: discardError })] })), securityBlock && (_jsx("div", { className: "px-3 pt-2", children: _jsxs(Alert, { children: [_jsx("p", { className: "mb-2", children: securityBlock.message }), _jsx(Button, { type: "button", onClick: () => void submit(true, blockedScheduleIso), children: securityBlock.overrideLabel })] }) })), fromOptions.length > 1 && (_jsxs("div", { className: FIELD_ROW, children: [_jsx("label", { htmlFor: `compose-from-${id}`, className: "text-xs text-text-muted shrink-0", children: "From" }), _jsx("select", { id: `compose-from-${id}`, className: `${FIELD_INPUT} disabled:opacity-55`, value: mailboxUid ?? "", disabled: hasUploads, title: hasUploads ? "The sender can't be changed after adding attachments or images." : undefined, onChange: (e) => handleFromChange(e.target.value), children: fromOptions.map((mb) => (_jsxs("option", { value: mb.uid, children: [mb.displayName ? `${mb.displayName} <${mb.primarySmtpAddress}>` : mb.primarySmtpAddress, mb.ownerUserUid ? "" : " (shared)"] }, mb.uid))) })] })), _jsxs("div", { className: FIELD_ROW, children: [_jsx("label", { htmlFor: `compose-to-${id}`, className: "text-xs text-text-muted shrink-0", children: "To" }), _jsx(RecipientInput, { id: `compose-to-${id}`, label: "To", value: to, mailboxUid: mailboxUid, onChange: setTo, onBlur: (value) => checkRecipientDiscovery(parseAddresses(value)), onCommit: (value) => checkRecipientDiscovery(parseAddresses(value)), autoFocus: focusToOnMount }), !showCcBcc && (_jsx("button", { type: "button", onClick: () => setShowCcBcc(true), className: "text-xs text-text-muted hover:text-text shrink-0", children: "Cc Bcc" }))] }), showCcBcc && (_jsxs(_Fragment, { children: [_jsxs("div", { className: FIELD_ROW, children: [_jsx("label", { htmlFor: `compose-cc-${id}`, className: "text-xs text-text-muted shrink-0", children: "Cc" }), _jsx(RecipientInput, { id: `compose-cc-${id}`, label: "Cc", value: cc, mailboxUid: mailboxUid, onChange: setCc, onBlur: (value) => checkRecipientDiscovery(parseAddresses(value)), onCommit: (value) => checkRecipientDiscovery(parseAddresses(value)) })] }), _jsxs("div", { className: FIELD_ROW, children: [_jsx("label", { htmlFor: `compose-bcc-${id}`, className: "text-xs text-text-muted shrink-0", children: "Bcc" }), _jsx(RecipientInput, { id: `compose-bcc-${id}`, label: "Bcc", value: bcc, mailboxUid: mailboxUid, onChange: setBcc, onBlur: (value) => checkRecipientDiscovery(parseAddresses(value)), onCommit: (value) => checkRecipientDiscovery(parseAddresses(value)) })] })] })), (() => {
+                                // De-duplicated by the same normalized key `recipientStatuses` itself is keyed by - two
+                                // fields (or one field twice) naming the same mailbox in different casing now resolve to
+                                // one shared status object (see `addressCacheKey()`'s own doc comment), so without this
+                                // the list below would render - and React would warn about - two `<li key=...>`s sharing
+                                // the exact same key.
+                                const seenKeys = new Set();
                                 const knownRecipients = [...parseAddresses(to), ...parseAddresses(cc), ...parseAddresses(bcc)]
-                                    .map((r) => recipientStatuses[r.address])
+                                    .filter((r) => {
+                                    const key = addressCacheKey(r.address);
+                                    if (seenKeys.has(key)) {
+                                        return false;
+                                    }
+                                    seenKeys.add(key);
+                                    return true;
+                                })
+                                    .map((r) => recipientStatuses[addressCacheKey(r.address)])
                                     .filter((status) => !!status);
                                 if (knownRecipients.length === 0) {
                                     return null;

package/dist/apps/shared/search/localIndexRpcClient.d.ts

@@ -16,6 +16,11 @@
  *
  * **Failed deletions are retried**: a destroy that couldn't remove a directory (another tab held it, the page
  * navigated away first) is recorded in `localStorage` and retried before this tab's first `init`.
+ *
+ * **A crashed Worker never leaves a caller hanging**: the `error` listener registered in `getWorker()` rejects
+ * every pending request and drops the module-level `worker` reference so the next `call()` spawns a
+ * replacement. `searchTier2.ts` additionally races its own calls against a timeout, since a Worker that's
+ * merely stuck (not crashed) posts no `error` event at all.
  */
 import type { ParsedSearchQuery } from "@rapidmx/react-shared/search/queryGrammar.js";
 import type { Coverage, IndexEntitiesResult, InitParams, LocalSearchPage, WindowState } from "./localIndexWorker.js";

package/dist/apps/shared/search/localIndexRpcClient.js

@@ -20,8 +20,12 @@ function getWorker() {
     if (!worker) {
         // Named by its compiled `.js` file, like every other relative import: tsc copies the literal into
         // `dist` unchanged, where only the `.js` file exists, and Vite maps it back to the `.ts` source.
-        worker = new Worker(new URL("./localIndexWorker.js", import.meta.url), { type: "module" });
-        worker.addEventListener("message", (event) => {
+        // Captured in its own `created` const (not just read back from the module-level `worker` variable)
+        // so the `error` listener below can tell whether it still refers to *this* Worker - see that
+        // listener's own comment for why that guard matters.
+        const created = new Worker(new URL("./localIndexWorker.js", import.meta.url), { type: "module" });
+        worker = created;
+        created.addEventListener("message", (event) => {
             const entry = pending.get(event.data.id);
             if (!entry) {
                 return;
@@ -34,6 +38,28 @@ function getWorker() {
                 entry.reject(new Error(event.data.error));
             }
         });
+        // A Worker that crashes (an uncaught exception, the WASM module aborting) never posts a response to
+        // its in-flight requests - without this, every pending call() promise would sit unresolved forever,
+        // and searchTier2.ts's try/catch (which can only catch a *rejection*) couldn't rescue it. Reject
+        // everything outstanding and drop the reference so the next call() spawns a fresh Worker instead of
+        // continuing to postMessage into a dead one.
+        //
+        // Scoped to `created`, this listener's own Worker, via the `worker !== created` check below - not
+        // scoped, a very unlikely double-error (this same Worker firing a second `error` event after the
+        // first already replaced `worker` with a healthy new instance) would reject that new instance's own
+        // in-flight requests and terminate it too, for no reason of its own.
+        created.addEventListener("error", (event) => {
+            if (worker !== created) {
+                return;
+            }
+            const err = new Error(`Local search Worker crashed: ${event.message || "unknown error"}`);
+            for (const entry of pending.values()) {
+                entry.reject(err);
+            }
+            pending.clear();
+            created.terminate();
+            worker = undefined;
+        });
         // Only a tab with a Worker has connections to close when another tab signs out.
         listenForSignOut();
     }

package/dist/apps/shared/search/searchTier2.d.ts

@@ -27,4 +27,10 @@ export interface Tier2SearchOutcome {
      * degradations below - there is nothing more to page through either way. */
     hasMore: boolean;
 }
-export declare function searchLocalIndex(mailboxUid: string, parsed: ParsedSearchQuery, unlocked: UnlockedKeys | undefined, limit?: number, offset?: number): Promise<Tier2SearchOutcome>;
+/** How long a Tier 2 search may run before this function gives up on it and degrades to "no local results" -
+ * `localIndexRpcClient.ts`'s own `error` listener rescues a Worker that *crashes*, but a Worker that's merely
+ * wedged (an infinite loop in the WASM module, a stuck OPFS lock) posts no `error` event and no response
+ * either; without this, the caller's `Promise.all()` (`apps/www/index.tsx`) would wait on this tier forever
+ * even though Tier 1's results already arrived. */
+export declare const TIER2_SEARCH_TIMEOUT_MS = 5000;
+export declare function searchLocalIndex(mailboxUid: string, parsed: ParsedSearchQuery, unlocked: UnlockedKeys | undefined, limit?: number, offset?: number, timeoutMs?: number): Promise<Tier2SearchOutcome>;

package/dist/apps/shared/search/searchTier2.js

@@ -8,31 +8,48 @@ async function ensureInitialized(mailboxUid, unlocked) {
     const indexKey = await deriveLocalIndexKey(unlocked.masterKey, mailboxUid);
     await initLocalIndex({ mailboxUid, indexKey });
 }
-export async function searchLocalIndex(mailboxUid, parsed, unlocked, limit = 50, offset = 0) {
+/** How long a Tier 2 search may run before this function gives up on it and degrades to "no local results" -
+ * `localIndexRpcClient.ts`'s own `error` listener rescues a Worker that *crashes*, but a Worker that's merely
+ * wedged (an infinite loop in the WASM module, a stuck OPFS lock) posts no `error` event and no response
+ * either; without this, the caller's `Promise.all()` (`apps/www/index.tsx`) would wait on this tier forever
+ * even though Tier 1's results already arrived. */
+export const TIER2_SEARCH_TIMEOUT_MS = 5000;
+export async function searchLocalIndex(mailboxUid, parsed, unlocked, limit = 50, offset = 0, timeoutMs = TIER2_SEARCH_TIMEOUT_MS) {
     if (!unlocked) {
         return { results: [], hasMore: false };
     }
+    let timer;
     try {
-        await ensureInitialized(mailboxUid, unlocked);
-        const [page, coverage] = await Promise.all([searchLocal(mailboxUid, parsed, limit, offset), getLocalCoverage(mailboxUid)]);
-        const results = page.hits.map((hit) => ({
-            entityType: "message",
-            entityUid: hit.entityUid,
-            // Negated: bm25()'s own convention is "more negative is a better match" (SQLite), the
-            // opposite of every other score this codebase merges (Postgres ts_rank, OpenSearch _score,
-            // and normalizeServerScores() itself all treat "higher is better"). Negating here, once,
-            // keeps that convention uniform for the caller (apps/www/index.tsx's merge layer) - it never
-            // needs to know this tier's underlying scoring function works backwards from the others.
-            score: -hit.score,
-            snippet: hit.snippet,
-            source: "local",
-            metadataOnly: false,
-        }));
-        return { results, coverage, hasMore: page.hasMore };
+        return await Promise.race([
+            (async () => {
+                await ensureInitialized(mailboxUid, unlocked);
+                const [page, coverage] = await Promise.all([searchLocal(mailboxUid, parsed, limit, offset), getLocalCoverage(mailboxUid)]);
+                const results = page.hits.map((hit) => ({
+                    entityType: "message",
+                    entityUid: hit.entityUid,
+                    // Negated: bm25()'s own convention is "more negative is a better match" (SQLite), the
+                    // opposite of every other score this codebase merges (Postgres ts_rank, OpenSearch _score,
+                    // and normalizeServerScores() itself all treat "higher is better"). Negating here, once,
+                    // keeps that convention uniform for the caller (apps/www/index.tsx's merge layer) - it never
+                    // needs to know this tier's underlying scoring function works backwards from the others.
+                    score: -hit.score,
+                    snippet: hit.snippet,
+                    source: "local",
+                    metadataOnly: false,
+                }));
+                return { results, coverage, hasMore: page.hasMore };
+            })(),
+            new Promise((resolve) => {
+                timer = setTimeout(() => resolve({ results: [], hasMore: false }), timeoutMs);
+            }),
+        ]);
     }
     catch {
         // See this function's own doc comment - a broken local index degrades to "nothing to contribute
         // this time," never a rejected search.
         return { results: [], hasMore: false };
     }
+    finally {
+        clearTimeout(timer);
+    }
 }

package/dist/apps/www/index.js

@@ -284,6 +284,15 @@ const LOAD_MORE_ROOT_MARGIN_PX = 200;
 /** How many full pages in a row that added no new rows the list keeps loading on its own before it shows a
  * "Load more" button instead. */
 const MAX_EMPTY_PAGE_CONTINUATIONS = 3;
+/** Hard ceiling on how many rows one list (the plain message list or the conversation list) keeps as live
+ * React state/DOM at once. `MAX_EMPTY_PAGE_CONTINUATIONS` above only bounds a streak of *empty* pages, not
+ * the total accumulated row count - infinite scroll on its own has no natural stopping point, so a reader
+ * who fully scrolls a large mailbox would otherwise keep every row ever fetched mounted forever. Past this
+ * cap, `loadMore()` stops fetching further pages and the list shows a "refine your search" banner instead of
+ * the load-more sentinel - deliberately not virtualization (a larger, riskier change this bug's own writeup
+ * called for only if trivial, which it isn't given this file's existing structure): capping the row count is
+ * the same fix's low-risk cousin, since the unbounded-memory failure mode is identical either way. */
+const MAX_LOADED_ROWS = 500;
 /** `true` when `more` has at least one row `shown` doesn't - i.e. appending it actually adds rows. Generic
  * over the row's own identity so both the message list (`uid`) and the conversation list
  * (`conversationId`) page the same way. */
@@ -301,8 +310,11 @@ function isWithinLoadMoreRange(sentinel, root) {
 /** Appends `more` to `shown`, skipping any row already shown - a later page can repeat rows (Tier 1 and
  * Tier 2/3 cursors advance independently, so the same message can come back from a different tier on a
  * later page; a plain folder listing's pages shift when new mail arrives between fetches). Generic for the
- * same reason `hasUnseenRows()` is. */
-function appendUnseenRows(shown, more, idOf) {
+ * same reason `hasUnseenRows()` is.
+ *
+ * `cap`, when given, truncates the result to its first `cap` rows (dropping the tail) rather than letting
+ * accumulated pages grow without bound - see `MAX_LOADED_ROWS`'s own doc comment for why this exists. */
+function appendUnseenRows(shown, more, idOf, cap) {
     const seen = new Set(shown.map(idOf));
     const unseen = [];
     for (const row of more) {
@@ -311,7 +323,11 @@ function appendUnseenRows(shown, more, idOf) {
             unseen.push(row);
         }
     }
-    return unseen.length === 0 ? shown : [...shown, ...unseen];
+    if (unseen.length === 0) {
+        return shown;
+    }
+    const combined = [...shown, ...unseen];
+    return cap !== undefined && combined.length > cap ? combined.slice(0, cap) : combined;
 }
 const messageUid = (message) => message.uid;
 const conversationKey = (conversation) => conversation.conversationId;
@@ -1063,9 +1079,14 @@ function InboxContent({ userUid }) {
         // has fully finished (the ref may still hold an earlier query's), in which case there's nowhere to
         // continue from yet.
         const searchCursor = decodeCursor(compositeCursorRef.current, fingerprint);
+        // Reads the ref, not `conversations`/`messages` state, so this callback (and the observer effect
+        // watching it) don't need to be recreated every time a page lands - the same reason every other
+        // check below reads a ref rather than closing over state.
+        const atRowCap = (preferences.showAsConversations ? conversationsRef.current.length : messagesRef.current.length) >= MAX_LOADED_ROWS;
         if (loadMoreInFlightRef.current ||
             !hasMore ||
             loading ||
+            atRowCap ||
             (!preferences.showAsConversations && !folderUid) ||
             (isSearching && !searchCursor)) {
             return;
@@ -1105,7 +1126,7 @@ function InboxContent({ userUid }) {
                     return;
                 }
                 const addedRows = hasUnseenRows(conversationsRef.current, more, conversationKey);
-                setConversations((prev) => appendUnseenRows(prev, more, conversationKey));
+                setConversations((prev) => appendUnseenRows(prev, more, conversationKey, MAX_LOADED_ROWS));
                 setHasMore(more.length === MESSAGE_PAGE_SIZE);
                 listedOffsetRef.current = page * MESSAGE_PAGE_SIZE + more.length;
                 notePageLanded(addedRows, more.length === MESSAGE_PAGE_SIZE);
@@ -1133,7 +1154,7 @@ function InboxContent({ userUid }) {
                     return;
                 }
                 const addedRows = hasUnseenRows(messagesRef.current, more, messageUid);
-                setMessages((prev) => appendUnseenRows(prev, more, messageUid));
+                setMessages((prev) => appendUnseenRows(prev, more, messageUid, MAX_LOADED_ROWS));
                 setSnippets((prev) => ({ ...prev, ...moreSnippets }));
                 const nextTier3Offset = tier3Offset + tier3Page.length;
                 compositeCursorRef.current = {
@@ -1157,7 +1178,7 @@ function InboxContent({ userUid }) {
                     return;
                 }
                 const addedRows = hasUnseenRows(messagesRef.current, more, messageUid);
-                setMessages((prev) => appendUnseenRows(prev, more, messageUid));
+                setMessages((prev) => appendUnseenRows(prev, more, messageUid, MAX_LOADED_ROWS));
                 setHasMore(more.length === MESSAGE_PAGE_SIZE);
                 listedOffsetRef.current = page * MESSAGE_PAGE_SIZE + more.length;
                 notePageLanded(addedRows, more.length === MESSAGE_PAGE_SIZE);
@@ -1295,6 +1316,14 @@ function InboxContent({ userUid }) {
      * far - which the Sort menu says on screen. `conversations` itself stays in the order the pages
      * arrived, so paging keeps appending to the same accumulated set. */
     const listedConversations = sortConversations(conversations, preferences.sortBy, preferences.sortOrder);
+    /** `true` once whichever list is on screen has hit `MAX_LOADED_ROWS` *and* the server still has more to
+     * give - `appendUnseenRows()` itself already stopped growing the array at that point, and `loadMore()`
+     * refuses to fetch further pages (see its own `atRowCap` check); this just drives the "refine your
+     * search" banner replacing the load-more sentinel below. The `hasMore` half matters at the edge: a
+     * mailbox/search whose true size lands at or near the cap can have its very last page be a partial one,
+     * which correctly turns `hasMore` false - without checking it here, the banner would still claim rows
+     * are being hidden even though every one of them is already on screen. */
+    const rowCapReached = hasMore && (preferences.showAsConversations ? conversations.length : messages.length) >= MAX_LOADED_ROWS;
     function leaveSelectMode() {
         setSelectMode(false);
         setSelectedUids(new Set());
@@ -1674,14 +1703,14 @@ function InboxContent({ userUid }) {
                                     ? `${messages.length} result${messages.length === 1 ? "" : "s"}`
                                     : `${messages.length} of ??` }), tier2Done && !searchAllMail && (_jsx("button", { type: "button", onClick: handleSearchAllMail, className: "text-primary-dark hover:underline font-medium shrink-0", children: "Search all mail" }))] })), isSearching && coverage?.indexedFrom && (_jsxs("div", { className: "px-4 py-1.5 text-xs text-text-muted border-b border-border", children: ["Local search covers messages back to ", new Date(coverage.indexedFrom).toLocaleDateString(), coverage.building ? " (still building)" : "", searchAllMail
                                 ? " - searching everything, not just recent mail."
-                                : " - older encrypted mail is still searched, just slower."] })), isSearching && !getUnlockedKeys(mailboxUid) && (_jsx("div", { className: "px-4 py-2 border-b border-border bg-surface-alt", children: _jsxs("button", { type: "button", onClick: handleUnlockSearch, className: "inline-flex items-center gap-1 text-xs font-medium text-primary-dark hover:underline", children: [_jsx(HiOutlineLockClosed, { size: 12, "aria-hidden": "true" }), "Unlock to include encrypted messages in these results"] }) })), !isSearching && !preferences.showAsConversations && undecryptedEncryptedUids.length > 0 && !getUnlockedKeys(activeMailboxUid) && (_jsx("div", { className: "px-4 py-2 border-b border-border bg-surface-alt", children: _jsxs("button", { type: "button", onClick: handleUnlockList, className: "inline-flex items-center gap-1 text-xs font-medium text-primary-dark hover:underline", children: [_jsx(HiOutlineLockClosed, { size: 12, "aria-hidden": "true" }), "Unlock to show ", undecryptedEncryptedUids.length === 1 ? "an encrypted message's" : "encrypted messages'", " subject"] }) })), error && (_jsx("div", { className: "p-4", children: _jsx(Alert, { children: error }) })), loading ? (_jsxs("div", { role: "status", "aria-busy": "true", className: "p-4", children: [_jsx("span", { className: "sr-only", children: "Loading\u2026" }), _jsx(SkeletonList, { count: 8 })] })) : preferences.showAsConversations ? (_jsxs(_Fragment, { children: [_jsx(ConversationList, { conversations: listedConversations, newestFirst: preferences.sortBy === "date" && preferences.sortOrder === "desc", mailboxUid: activeMailboxUid, selectedUid: selectedUid, messageOverrides: conversationPatches, onOpenMessage: handleOpenConversation, selectMode: selectMode, selectedConversationIds: selectedConversationIds, onToggleSelected: toggleConversationSelected }), hasMore && (_jsx("div", { ref: setSentinel, "data-testid": "load-more-sentinel", className: "p-4 text-center text-xs text-text-muted", children: loadMoreStatus }))] })) : messages.length === 0 ? (_jsxs(_Fragment, { children: [_jsx("p", { className: "p-4 text-sm text-text-muted", children: isSearching
+                                : " - older encrypted mail is still searched, just slower."] })), isSearching && !getUnlockedKeys(mailboxUid) && (_jsx("div", { className: "px-4 py-2 border-b border-border bg-surface-alt", children: _jsxs("button", { type: "button", onClick: handleUnlockSearch, className: "inline-flex items-center gap-1 text-xs font-medium text-primary-dark hover:underline", children: [_jsx(HiOutlineLockClosed, { size: 12, "aria-hidden": "true" }), "Unlock to include encrypted messages in these results"] }) })), !isSearching && !preferences.showAsConversations && undecryptedEncryptedUids.length > 0 && !getUnlockedKeys(activeMailboxUid) && (_jsx("div", { className: "px-4 py-2 border-b border-border bg-surface-alt", children: _jsxs("button", { type: "button", onClick: handleUnlockList, className: "inline-flex items-center gap-1 text-xs font-medium text-primary-dark hover:underline", children: [_jsx(HiOutlineLockClosed, { size: 12, "aria-hidden": "true" }), "Unlock to show ", undecryptedEncryptedUids.length === 1 ? "an encrypted message's" : "encrypted messages'", " subject"] }) })), error && (_jsx("div", { className: "p-4", children: _jsx(Alert, { children: error }) })), loading ? (_jsxs("div", { role: "status", "aria-busy": "true", className: "p-4", children: [_jsx("span", { className: "sr-only", children: "Loading\u2026" }), _jsx(SkeletonList, { count: 8 })] })) : preferences.showAsConversations ? (_jsxs(_Fragment, { children: [_jsx(ConversationList, { conversations: listedConversations, newestFirst: preferences.sortBy === "date" && preferences.sortOrder === "desc", mailboxUid: activeMailboxUid, selectedUid: selectedUid, messageOverrides: conversationPatches, onOpenMessage: handleOpenConversation, selectMode: selectMode, selectedConversationIds: selectedConversationIds, onToggleSelected: toggleConversationSelected }), hasMore && !rowCapReached && (_jsx("div", { ref: setSentinel, "data-testid": "load-more-sentinel", className: "p-4 text-center text-xs text-text-muted", children: loadMoreStatus })), rowCapReached && (_jsxs("p", { className: "p-4 text-center text-xs text-text-muted", children: ["Showing the most recent ", MAX_LOADED_ROWS, " conversations \u2014 refine your search or filters to see more."] }))] })) : messages.length === 0 ? (_jsxs(_Fragment, { children: [_jsx("p", { className: "p-4 text-sm text-text-muted", children: isSearching
                                     ? `No messages match "${searchQuery}".`
                                     : effectiveFilter === "all"
                                         ? "No messages in this folder."
                                         : "No messages here." }), hasMore && (_jsx("div", { ref: setSentinel, "data-testid": "load-more-sentinel", className: "p-4 text-center text-xs text-text-muted", children: loadMoreStatus }))] })) : (_jsxs(_Fragment, { children: [_jsx("ul", { children: messages.map((message) => (_jsxs("li", { "data-message-uid": message.uid, "data-unread": isUnread(message) ? "true" : undefined, className: rowClass({ unread: isUnread(message), selected: message.uid === selectedUid || selectedUids.has(message.uid) }, "flex items-stretch"), children: [_jsx(UnreadBar, { unread: isUnread(message) }), selectMode && (_jsx("span", { className: "shrink-0 flex items-center pl-3", children: _jsx("input", { type: "checkbox", checked: selectedUids.has(message.uid), onChange: () => toggleSelected(message.uid), "aria-label": `Select ${rowSubject(message)}`, className: "w-4 h-4 accent-primary" }) })), _jsxs("button", { type: "button", "data-row-open": true, onClick: () => handleSelect(message), className: ["flex-1 min-w-0 text-left px-4 py-3", ROW_FOCUS_CLASS].join(" "), children: [_jsx(UnreadLabel, { unread: isUnread(message) }), _jsxs("div", { className: "flex items-center justify-between gap-2 text-sm", children: [_jsx(MailAddress, { recipient: message.from, className: senderClass(isUnread(message)) }), _jsx("span", { className: ["text-xs shrink-0", dateClass(isUnread(message))].join(" "), children: new Date(message.receivedDate).toLocaleDateString() })] }), aggregateFolderType && (_jsx("div", { className: "text-xs text-text-muted truncate font-normal", children: mailboxes.find((mb) => mb.uid === message.mailboxUid)?.displayName })), isSearching && pendingUids.has(message.uid) ? (_jsxs("div", { className: "flex flex-col gap-1.5 py-0.5", children: [_jsx(Skeleton, { height: "h-3.5", className: "w-2/3 rounded-sm" }), _jsx(Skeleton, { height: "h-3", className: "w-full rounded-sm" })] })) : (_jsxs(_Fragment, { children: [_jsx("div", { className: ["text-sm truncate", subjectClass(isUnread(message))].join(" "), children: rowSubject(message) }), _jsxs("div", { className: "flex items-center gap-2 text-xs text-text-muted font-normal", children: [_jsx("span", { className: "truncate", children: snippets[message.uid] ||
                                                                         decryptedRows[message.uid]?.preview ||
                                                                         message.bodyPreview ||
-                                                                        (message.encrypted ? _jsx(EncryptedPreview, {}) : null) }), message.hasAttachments && _jsx(HiOutlinePaperClip, { size: 12, "aria-label": "Has attachments" }), message.flags.flagged && (_jsx(HiOutlineFlag, { size: 12, "aria-label": "Flagged", className: "text-danger" }))] }), isOutbox && _jsx(OutboxRowStatus, { message: message })] }))] })] }, message.uid))) }), hasMore && (_jsx("div", { ref: setSentinel, "data-testid": "load-more-sentinel", className: "p-4 text-center text-xs text-text-muted", children: loadMoreStatus })), aggregateFolderType && (_jsx("p", { className: "p-4 text-center text-xs text-text-muted", children: "Showing the most recent mail from each mailbox. Open a specific mailbox\u2019s folder to see older mail." }))] }))] }), _jsx("div", { className: "hidden md:flex flex-1 min-w-0 min-h-0", children: preferences.showAsConversations ? (_jsx(LazyConversationThreadPane, { conversation: openThread?.conversation ?? null, selectedUid: openThread?.uid ?? null, mailboxUid: activeMailboxUid, folders: currentFolders, labels: mailboxLabels, shortcuts: !selectMode, onMessagePatched: patchListedMessage, onMessageRemoved: (updated) => removeListedMessage(updated.uid), onLabelCreated: (label) => setMailboxLabels((prev) => [...prev, label]), onFolderCreated: onFolderCreated })) : (_jsx(LazyMessageDetailPane, { shortcuts: !selectMode, message: selected, attachments: attachments, isSentItems: isSentItems, onRecalled: patchListedMessage, isOutbox: isOutbox, onReceiptHandled: patchListedMessage, draftsFolderUid: draftsFolderUid, folders: folders, onMoved: (updated) => {
+                                                                        (message.encrypted ? _jsx(EncryptedPreview, {}) : null) }), message.hasAttachments && _jsx(HiOutlinePaperClip, { size: 12, "aria-label": "Has attachments" }), message.flags.flagged && (_jsx(HiOutlineFlag, { size: 12, "aria-label": "Flagged", className: "text-danger" }))] }), isOutbox && _jsx(OutboxRowStatus, { message: message })] }))] })] }, message.uid))) }), hasMore && !rowCapReached && (_jsx("div", { ref: setSentinel, "data-testid": "load-more-sentinel", className: "p-4 text-center text-xs text-text-muted", children: loadMoreStatus })), rowCapReached && (_jsxs("p", { className: "p-4 text-center text-xs text-text-muted", children: ["Showing the most recent ", MAX_LOADED_ROWS, " messages \u2014 refine your search or filters to see more."] })), aggregateFolderType && (_jsx("p", { className: "p-4 text-center text-xs text-text-muted", children: "Showing the most recent mail from each mailbox. Open a specific mailbox\u2019s folder to see older mail." }))] }))] }), _jsx("div", { className: "hidden md:flex flex-1 min-w-0 min-h-0", children: preferences.showAsConversations ? (_jsx(LazyConversationThreadPane, { conversation: openThread?.conversation ?? null, selectedUid: openThread?.uid ?? null, mailboxUid: activeMailboxUid, folders: currentFolders, labels: mailboxLabels, shortcuts: !selectMode, onMessagePatched: patchListedMessage, onMessageRemoved: (updated) => removeListedMessage(updated.uid), onLabelCreated: (label) => setMailboxLabels((prev) => [...prev, label]), onFolderCreated: onFolderCreated })) : (_jsx(LazyMessageDetailPane, { shortcuts: !selectMode, message: selected, attachments: attachments, isSentItems: isSentItems, onRecalled: patchListedMessage, isOutbox: isOutbox, onReceiptHandled: patchListedMessage, draftsFolderUid: draftsFolderUid, folders: folders, onMoved: (updated) => {
                         // Same reasoning as onArchived below - a move takes the message out of the folder
                         // being listed, so it leaves the list rather than being patched in place.
                         removeListedMessage(updated.uid);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rapidmx/web-client",
-  "version": "0.13.0",
+  "version": "0.14.1",
   "description": "RapidMX's webmail and admin console React UI for web-based clients.",
   "type": "module",
   "repository": "https://github.com/rapidmx/web-client",
@@ -17,7 +17,7 @@
     "./shared/styles/app.css": "./apps/shared/styles/app.css"
   },
   "scripts": {
-    "build": "rimraf dist && tsc -p tsconfig.json && shx mkdir -p dist/apps/shared/styles && shx cp apps/shared/styles/app.css dist/apps/shared/styles/app.css && node scripts/checkDistReferences.mjs",
+    "build": "yarn lint && rimraf dist && tsc -p tsconfig.json && shx mkdir -p dist/apps/shared/styles && shx cp apps/shared/styles/app.css dist/apps/shared/styles/app.css && node scripts/checkDistReferences.mjs",
     "lint": "eslint ./apps ./test",
     "test": "vitest run --coverage",
     "test:watch": "vitest --watch --coverage",
@@ -39,7 +39,7 @@
     "@dnd-kit/core": "^6.3.1",
     "@journeyapps/wa-sqlite": "^2.0.4",
     "@peculiar/x509": "^2.1.0",
-    "@rapidmx/react-shared": "^0.13.0",
+    "@rapidmx/react-shared": "^0.15.0",
     "@tiptap/core": "^3.31.3",
     "@tiptap/extension-highlight": "^3.31.3",
     "@tiptap/extension-image": "^3.31.3",