@rapidmx/web-client 0.15.1 → 0.16.0

package/dist/apps/shared/mail/outbox/outgoingReplies.js

@@ -0,0 +1,131 @@
+///////////////////////////////////////////////////////////////////////////////
+// Copyright (C) 2026 Jean-Philippe Steinmetz
+// SPDX-License-Identifier: MPL-2.0
+///////////////////////////////////////////////////////////////////////////////
+import { useSyncExternalStore } from "react";
+/** The most entries kept; the oldest go first. Every entry is a message this tab sent, so this is generous. */
+const MAX_TRACKED = 25;
+/** A sent message that a read of its conversation has not found this many times is not part of that conversation (the server filed it elsewhere). */
+export const MAX_SETTLE_MISSES = 2;
+const NO_REPLIES = [];
+let replies = [];
+let snapshot = replies;
+const listeners = new Set();
+function commit(next) {
+    replies = next;
+    snapshot = next;
+    for (const listener of [...listeners]) {
+        listener();
+    }
+}
+function update(uid, patch) {
+    if (replies.some((reply) => reply.uid === uid)) {
+        commit(replies.map((reply) => (reply.uid === uid ? { ...reply, ...patch } : reply)));
+    }
+}
+/**
+ * Starts showing `request`'s message in the conversation it replies to - or does nothing for a message that replies to nothing (a new message
+ * starts a conversation of its own, it is never part of an open one) and for a send-later message (it is not sent yet). Called again for the same
+ * message - a Retry - it starts over as `sending`.
+ *
+ * The thread is `request.threading` (the compose session's), else what the draft itself records: a draft opened again from "Open draft" is a
+ * session with no threading of its own, but the server kept it on the message.
+ */
+export function trackOutgoing(request) {
+    const source = request.threading ?? request.draft;
+    const references = source.references ?? [];
+    if (request.scheduledSendTime || (!source.inReplyTo && references.length === 0)) {
+        return;
+    }
+    const { mailbox } = request;
+    const reply = {
+        uid: request.draft.uid,
+        mailboxUid: request.mailboxUid,
+        inReplyTo: source.inReplyTo,
+        references,
+        // The mailbox is only unknown when the window's own load of it had not succeeded: "Me" is what a sender is called then.
+        sender: mailbox ? { address: mailbox.primarySmtpAddress, displayName: mailbox.displayName } : { address: "Me" },
+        to: request.to,
+        cc: request.cc,
+        bcc: request.bcc,
+        subject: request.subject,
+        html: request.html,
+        startedAt: Date.now(),
+        state: "sending",
+        actions: [],
+        misses: 0,
+    };
+    commit([...replies.filter((existing) => existing.uid !== reply.uid), reply].slice(-MAX_TRACKED));
+}
+/** The send did not go: `failure` is why, `actions` what can be done (Retry, Open draft ...). */
+export function failOutgoing(uid, failure, actions) {
+    update(uid, { state: "failed", failure, actions });
+}
+/** A failed send is being tried again. */
+export function markOutgoingSending(uid) {
+    update(uid, { state: "sending", failure: undefined, actions: [] });
+}
+/** The server has relayed the message: its Sent Items copy is what the conversation shows next. */
+export function markOutgoingSent(uid) {
+    update(uid, { state: "sent" });
+}
+/** Stops showing a message - it went back to Drafts to be edited. */
+export function forgetOutgoing(uid) {
+    if (replies.some((reply) => reply.uid === uid)) {
+        commit(replies.filter((reply) => reply.uid !== uid));
+    }
+}
+/** Whether `reply` continues the conversation `messages` are: it answers one of them, or its `References` chain runs through one. */
+export function belongsToThread(reply, messages) {
+    return messages.some((message) => !!message.messageId && (message.messageId === reply.inReplyTo || reply.references.includes(message.messageId)));
+}
+/** The uids of the messages sent from here whose real copy is in `messages`, the thread as it was just read. */
+export function adoptedOutgoing(mailboxUid, messages) {
+    return replies.filter((reply) => reply.mailboxUid === mailboxUid && messages.some((message) => message.uid === reply.uid)).map((reply) => reply.uid);
+}
+/**
+ * Called with a mailbox's conversation as it was just read, `messages` being the whole thread: forgets the messages whose real copy is now in it
+ * (`adoptedOutgoing()`), and gives up on a *sent* message that belongs to this thread but that the read did not find `MAX_SETTLE_MISSES` times in a
+ * row - the server filed it in a conversation of its own, and it is not to be shown here. A message of another conversation is left alone.
+ *
+ * A pane draws the messages it has read *before* it calls this, so that there is never a moment with neither the pending card nor the real one.
+ */
+export function settleOutgoing(mailboxUid, messages) {
+    const adopted = new Set(adoptedOutgoing(mailboxUid, messages));
+    const next = [];
+    let changed = adopted.size > 0;
+    for (const reply of replies) {
+        if (adopted.has(reply.uid)) {
+            continue;
+        }
+        if (reply.mailboxUid === mailboxUid && reply.state === "sent" && belongsToThread(reply, messages)) {
+            changed = true;
+            if (reply.misses + 1 < MAX_SETTLE_MISSES) {
+                next.push({ ...reply, misses: reply.misses + 1 });
+            }
+        }
+        else {
+            next.push(reply);
+        }
+    }
+    if (changed) {
+        commit(next);
+    }
+}
+export function getOutgoingReplies() {
+    return snapshot;
+}
+function subscribe(listener) {
+    listeners.add(listener);
+    return () => {
+        listeners.delete(listener);
+    };
+}
+/** The messages this tab has sent that a conversation may still need to show, oldest first. */
+export function useOutgoingReplies() {
+    return useSyncExternalStore(subscribe, getOutgoingReplies, () => NO_REPLIES);
+}
+/** Forgets everything - for a test. */
+export function resetOutgoingReplies() {
+    commit([]);
+}

package/dist/apps/shared/mail/outbox/sendJob.d.ts

@@ -1,4 +1,4 @@
-import { Attachment, ComposeRecipientInput, Mailbox, Message } from "@rapidmx/react-shared/mail/mailApi.js";
+import { Attachment, ComposeRecipientInput, DraftThreading, Mailbox, Message } from "@rapidmx/react-shared/mail/mailApi.js";
 import { RecipientEncryptionStatus } from "@rapidmx/react-shared/crypto/composeSecurity.js";
 import { EncryptionPolicy } from "@rapidmx/react-shared/crypto/keyvaultApi.js";
 import { SendDecisionInput } from "./sendDecision.js";
@@ -34,6 +34,10 @@ export interface SendRequest {
     forcePlaintext: boolean;
     /** Settles when the window's own autosaves have landed, so none can overwrite the assembly below. */
     saved?: Promise<unknown>;
+    /** The thread this message continues (a reply or forward), as the compose session was opened with it - what lets the conversation on screen
+     * show the message as soon as it is sent (see `outgoingReplies.ts`). Absent for a new message, and for a draft opened again, which the draft's own
+     * `inReplyTo`/`references` stand in for. */
+    threading?: DraftThreading;
 }
 /** How long a background send waits for the mailbox / encryption policy it did not have, before it goes ahead treating them as unknown. Nobody waits for it. */
 export declare const CONTEXT_GRACE_MS = 4000;

package/dist/apps/shared/mail/outbox/sendJob.js

@@ -13,6 +13,7 @@ import { policyCanAutoEncrypt } from "../../components/mail/compose/encryptionRe
 import { dismiss, notify } from "../../notifications/store.js";
 import { INLINE_IMAGE_PATTERN, decideSend } from "./sendDecision.js";
 import { beginPendingSend, finishPendingSend, setPendingStage } from "./pendingSends.js";
+import { failOutgoing, forgetOutgoing, markOutgoingSending, markOutgoingSent, trackOutgoing } from "./outgoingReplies.js";
 import { openComposeFromOutside, requestUnlockFromOutside } from "./composeBridge.js";
 import { sendState } from "./sendState.js";
 /** How long a background send waits for the mailbox / encryption policy it did not have, before it goes ahead treating them as unknown. Nobody waits for it. */
@@ -209,7 +210,7 @@ export function describeMessage(subject, recipients) {
 }
 /** Re-opens the compose window around a request's message, with everything as it was typed. */
 export function openDraftFromRequest(request) {
-    return openComposeFromOutside({
+    const opened = openComposeFromOutside({
         mailboxUid: request.mailboxUid,
         resume: {
             draft: request.draft,
@@ -225,6 +226,11 @@ export function openDraftFromRequest(request) {
             encryptRequested: request.encryptRequested,
         },
     });
+    // Being edited again, it is no longer a message on its way in the conversation.
+    if (opened) {
+        forgetOutgoing(request.draft.uid);
+    }
+    return opened;
 }
 function failureNotificationId(draftUid) {
     return `send-failed:${draftUid}`;
@@ -257,6 +263,8 @@ function notifyFailure(request, failure) {
         details: failure.details,
         actions,
     });
+    // The conversation on screen shows the same failure under the message, with the same ways out.
+    failOutgoing(uid, failure.message, actions);
 }
 const SENT_BURST_MS = 6000;
 /** The short "Message sent" confirmation - several sent close together are one pop-up counting up, never a stack of them. */
@@ -280,6 +288,8 @@ export function startSend(request) {
     }
     // The failure of an earlier attempt is resolved by trying again.
     dismiss(failureNotificationId(uid));
+    // A reply or forward is on screen in its conversation from this moment, before any of the work below.
+    trackOutgoing(request);
     const tracker = sendState.countTracker?.(request.mailboxUid);
     void attempt(request).then((outcome) => {
         finishPendingSend(uid);
@@ -294,6 +304,8 @@ export function startSend(request) {
             sendState.queuedListener?.(request.mailboxUid);
         }
         else if (outcome.kind === "sent") {
+            // A server with no queue relayed it before answering: the Sent Items copy exists already.
+            markOutgoingSent(uid);
             notifySent();
         }
         else {
@@ -312,6 +324,7 @@ export function startSend(request) {
 export async function retrySend(request) {
     if (await alreadyAccepted(request)) {
         dismiss(failureNotificationId(request.draft.uid));
+        markOutgoingSending(request.draft.uid);
         notify({ id: `already-sent:${request.draft.uid}`, kind: "info", title: "This message is already on its way", timeoutMs: 5000 });
         return;
     }

package/dist/apps/shared/mail/outbox/sendOutcomes.js

@@ -9,6 +9,7 @@ import { loadOriginalMessage } from "../../components/mail/compose/quotedBody.js
 import { notifyApiError } from "../../notifications/apiErrors.js";
 import { dismiss, notify } from "../../notifications/store.js";
 import { beginPendingSend, finishPendingSend, setPendingStage } from "./pendingSends.js";
+import { failOutgoing, forgetOutgoing, markOutgoingSending, markOutgoingSent } from "./outgoingReplies.js";
 import { openComposeFromOutside } from "./composeBridge.js";
 import { describeMessage, forgetRetainedRequest, notifySent, openDraftFromRequest, retainedRequest } from "./sendJob.js";
 /**
@@ -39,6 +40,8 @@ function escapeHtml(text) {
 async function openFailedDraft(event) {
     try {
         const moved = await moveBackToDrafts(event.uid, event.mailboxUid ?? "");
+        // Back in Drafts it is no longer a message on its way in its conversation.
+        forgetOutgoing(event.uid);
         const request = retainedRequest(event.uid);
         if (request) {
             openDraftFromRequest({ ...request, draft: moved });
@@ -84,6 +87,7 @@ async function retryFailed(event) {
         return;
     }
     dismiss(failedId(event.uid));
+    markOutgoingSending(event.uid);
     try {
         setPendingStage(event.uid, "queuing");
         const result = await queueMessageSend(event.uid);
@@ -103,6 +107,8 @@ export function handleSendEvent(event) {
     if (event.action === "send-succeeded") {
         dismiss(retryId(event.uid));
         dismiss(failedId(event.uid));
+        // The conversation on screen swaps the message it drew for the Sent Items copy (a message this tab did not send has nothing drawn).
+        markOutgoingSent(event.uid);
         // The server reports every message it relays, scheduled ones from long ago included: only a message this tab queued in the background is
         // worth a confirmation (several are one pop-up counting up). Anything else - a send-later message going out, another tab's send - is quiet.
         if (retainedRequest(event.uid)) {
@@ -127,15 +133,18 @@ export function handleSendEvent(event) {
         return;
     }
     dismiss(retryId(event.uid));
+    const actions = [
+        { label: "Retry", onClick: () => void retryFailed(event) },
+        { label: "Open draft", onClick: () => void openFailedDraft(event) },
+    ];
     notify({
         id: failedId(event.uid),
         kind: "error",
         title: "This message wasn't sent",
         message: `${what}: ${failure.message}`,
         details: failure.lines,
-        actions: [
-            { label: "Retry", onClick: () => void retryFailed(event) },
-            { label: "Open draft", onClick: () => void openFailedDraft(event) },
-        ],
+        actions,
     });
+    // The conversation on screen shows the same failure under the message, with the same ways out.
+    failOutgoing(event.uid, failure.message, actions);
 }

package/dist/apps/shared/mail/primaryMailbox.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Which of the caller's mailboxes is "theirs", and the order every list of them is shown in - the one definition the mail, calendar,
+ * contacts, tasks and settings shells, the compose window's From picker and the account menu all use, so a shared mailbox that happens
+ * to sort first (or that the server lists first) is never the one an app opens on or a picker defaults to.
+ *
+ * An **own** mailbox is one whose `ownerUserUid` is the signed-in user.
+ *
+ * A **shared** mailbox is any other one the caller merely has access to: an ownerless (shared/organization) mailbox, or a delegate grant on
+ * somebody else's (`isSharedWithMe()`).
+ *
+ * The **primary** mailbox is the caller's own mailbox - the earliest created, when they own several - else the first mailbox that isn't
+ * shared, else the first one there is.
+ *
+ * `orderMailboxes()` puts the primary mailbox first, then the caller's other mailboxes, then the shared ones, each group alphabetical.
+ */
+import { type Mailbox } from "@rapidmx/react-shared/mail/mailApi.js";
+/** Whether `mailbox` is the signed-in user's own. */
+export declare function isOwnMailbox(mailbox: Mailbox, userUid: string | undefined): boolean;
+/** Whether `mailbox` is one the caller only has access to (an ownerless one, or somebody else's shared with them). */
+export declare function isSharedMailbox(mailbox: Mailbox, userUid: string | undefined): boolean;
+/** The caller's own mailboxes, earliest created first (the given order among ones created together). */
+export declare function ownMailboxes(mailboxes: readonly Mailbox[], userUid: string | undefined): Mailbox[];
+/** The mailbox to open and to default pickers to: see the rules at the top of this file. `undefined` only for no mailboxes at all. */
+export declare function primaryMailbox(mailboxes: readonly Mailbox[], userUid: string | undefined): Mailbox | undefined;
+/** `primaryMailbox()`'s uid. */
+export declare function primaryMailboxUid(mailboxes: readonly Mailbox[], userUid: string | undefined): string | undefined;
+/** `mailboxes` in display order: the primary mailbox, then the caller's other mailboxes, then the shared ones - each group by name. Never
+ * changes the list it is given. */
+export declare function orderMailboxes(mailboxes: readonly Mailbox[], userUid: string | undefined): Mailbox[];

package/dist/apps/shared/mail/primaryMailbox.js

@@ -0,0 +1,61 @@
+///////////////////////////////////////////////////////////////////////////////
+// Copyright (C) 2026 Jean-Philippe Steinmetz
+// SPDX-License-Identifier: MPL-2.0
+///////////////////////////////////////////////////////////////////////////////
+/**
+ * Which of the caller's mailboxes is "theirs", and the order every list of them is shown in - the one definition the mail, calendar,
+ * contacts, tasks and settings shells, the compose window's From picker and the account menu all use, so a shared mailbox that happens
+ * to sort first (or that the server lists first) is never the one an app opens on or a picker defaults to.
+ *
+ * An **own** mailbox is one whose `ownerUserUid` is the signed-in user.
+ *
+ * A **shared** mailbox is any other one the caller merely has access to: an ownerless (shared/organization) mailbox, or a delegate grant on
+ * somebody else's (`isSharedWithMe()`).
+ *
+ * The **primary** mailbox is the caller's own mailbox - the earliest created, when they own several - else the first mailbox that isn't
+ * shared, else the first one there is.
+ *
+ * `orderMailboxes()` puts the primary mailbox first, then the caller's other mailboxes, then the shared ones, each group alphabetical.
+ */
+import { isSharedWithMe } from "@rapidmx/react-shared/mail/mailApi.js";
+/** Whether `mailbox` is the signed-in user's own. */
+export function isOwnMailbox(mailbox, userUid) {
+    return !!userUid && mailbox.ownerUserUid === userUid;
+}
+/** Whether `mailbox` is one the caller only has access to (an ownerless one, or somebody else's shared with them). */
+export function isSharedMailbox(mailbox, userUid) {
+    if (isOwnMailbox(mailbox, userUid)) {
+        return false;
+    }
+    // The server says how the caller reaches a mailbox (`accessRole`); an older one doesn't, and then a mailbox that isn't the known
+    // caller's own is somebody else's.
+    return mailbox.accessRole ? isSharedWithMe(mailbox) : !!userUid || isSharedWithMe(mailbox);
+}
+function createdAt(mailbox) {
+    const time = Date.parse(mailbox.dateCreated);
+    return Number.isNaN(time) ? Infinity : time;
+}
+/** The caller's own mailboxes, earliest created first (the given order among ones created together). */
+export function ownMailboxes(mailboxes, userUid) {
+    return mailboxes.filter((mailbox) => isOwnMailbox(mailbox, userUid)).sort((a, b) => createdAt(a) - createdAt(b));
+}
+/** The mailbox to open and to default pickers to: see the rules at the top of this file. `undefined` only for no mailboxes at all. */
+export function primaryMailbox(mailboxes, userUid) {
+    return ownMailboxes(mailboxes, userUid)[0] ?? mailboxes.find((mailbox) => !isSharedMailbox(mailbox, userUid)) ?? mailboxes[0];
+}
+/** `primaryMailbox()`'s uid. */
+export function primaryMailboxUid(mailboxes, userUid) {
+    return primaryMailbox(mailboxes, userUid)?.uid;
+}
+/** `mailboxes` in display order: the primary mailbox, then the caller's other mailboxes, then the shared ones - each group by name. Never
+ * changes the list it is given. */
+export function orderMailboxes(mailboxes, userUid) {
+    const primary = primaryMailbox(mailboxes, userUid);
+    const rank = (mailbox) => (mailbox === primary ? 0 : isSharedMailbox(mailbox, userUid) ? 2 : 1);
+    // Tolerates a mailbox that says nothing of its name or address (an older server's, or a test fixture's).
+    const name = (mailbox) => mailbox.displayName ?? "";
+    const address = (mailbox) => mailbox.primarySmtpAddress ?? "";
+    return [...mailboxes].sort((a, b) => rank(a) - rank(b) ||
+        name(a).localeCompare(name(b), undefined, { sensitivity: "base" }) ||
+        address(a).localeCompare(address(b)));
+}

package/dist/apps/shared/mail/useCollapsedSections.d.ts

@@ -0,0 +1,32 @@
+/** The id of the "All mailboxes" section; every mailbox's section is its uid. */
+export declare const ALL_MAILBOXES_SECTION = "all";
+/** What the reader chose per section: `true` collapsed, `false` open. A section that is not there follows the default rule. */
+export type SectionChoices = Record<string, boolean>;
+/** The `localStorage` key one user's choices are kept under. */
+export declare function collapsedSectionsKey(userUid: string): string;
+/** Reads a user's stored choices - none for an unknown user, a missing entry, unparsable JSON, something that is not an object, or a store that throws. */
+export declare function readSectionChoices(userUid: string | undefined): SectionChoices;
+/** Stores a user's choices. Best-effort - see this module's own doc comment. */
+export declare function writeSectionChoices(userUid: string | undefined, choices: SectionChoices): void;
+/** Whether a section is open by the reader's choice, or by the default rule where they have made none (a navigation's override not considered). */
+export declare function sectionChosenOpen(id: string, choices: SectionChoices, primaryUid: string | undefined): boolean;
+export interface SidebarSectionsOptions {
+    /** The signed-in user, whose choices these are; `undefined` keeps them for this page view only. */
+    userUid: string | undefined;
+    /** The user's primary mailbox, which - with "All mailboxes" - is open until they choose otherwise. */
+    primaryUid: string | undefined;
+    /**
+     * The section holding the folder that is open: `ALL_MAILBOXES_SECTION` for an aggregate view, else that mailbox's uid; `undefined`
+     * while that is not known yet (the address not read, the mailboxes not loaded). Moving from one section to another opens the new one
+     * (see this module's doc comment); the first section that becomes known does not.
+     */
+    activeId: string | undefined;
+}
+export interface SidebarSections {
+    /** Whether the section shows its folders. */
+    isExpanded: (id: string) => boolean;
+    /** Opens a collapsed section, collapses an open one, and remembers it as the reader's choice. */
+    toggle: (id: string) => void;
+}
+/** See this module's doc comment. */
+export declare function useSidebarSections({ userUid, primaryUid, activeId }: SidebarSectionsOptions): SidebarSections;

package/dist/apps/shared/mail/useCollapsedSections.js

@@ -0,0 +1,110 @@
+///////////////////////////////////////////////////////////////////////////////
+// Copyright (C) 2026 Jean-Philippe Steinmetz
+// SPDX-License-Identifier: MPL-2.0
+///////////////////////////////////////////////////////////////////////////////
+/**
+ * Which of the Mail sidebar's sections - "All mailboxes" and one per mailbox - are open, and the reader's own choices about it.
+ *
+ * A section the reader has never touched follows the **default rule**: "All mailboxes" and the signed-in user's primary mailbox
+ * (`primaryMailboxUid()`) are open, every other mailbox is collapsed - so a mailbox that is newly shared with them arrives closed.
+ * Once they toggle a section the choice is remembered for that section, replacing the default, whatever the default later says.
+ *
+ * **Every** section can be collapsed, the one holding the open folder and the primary mailbox included, and a collapsed one stays collapsed
+ * across reloads even while its own folder is the selected one: the toggle always toggles and always remembers.
+ *
+ * The one exception is *navigation*: when the section holding the open folder (`activeId`) **changes** - the reader picks a folder in
+ * another section, or a search result or a link lands in one - that section is shown open, so the folder just highlighted is not hidden
+ * from them. That is an in-memory override of this page view, never written as the reader's choice: it does not apply to the first
+ * section the page resolves (a reload lands on whatever was chosen), and it ends when they navigate to yet another section. Toggling
+ * the section it opened forgets the override and remembers the reader's new choice (the opposite of what was showing).
+ *
+ * The choices are kept per signed-in user, per device, in `localStorage` (`rapidmx:mail-sidebar-collapsed:<userUid>`), the way
+ * `listPreferences.ts` keeps the list arrangement: `{ "<section id>": <collapsed> }`. Every read tolerates a missing, corrupt or
+ * blocked store (and keeps only the booleans of a partly-valid one), every write swallows its failure - a blocked store only means the
+ * choices do not survive a reload.
+ */
+import { useCallback, useMemo, useRef, useState } from "react";
+const STORAGE_KEY_PREFIX = "rapidmx:mail-sidebar-collapsed:";
+/** The id of the "All mailboxes" section; every mailbox's section is its uid. */
+export const ALL_MAILBOXES_SECTION = "all";
+/** The `localStorage` key one user's choices are kept under. */
+export function collapsedSectionsKey(userUid) {
+    return `${STORAGE_KEY_PREFIX}${userUid}`;
+}
+/** Reads a user's stored choices - none for an unknown user, a missing entry, unparsable JSON, something that is not an object, or a store that throws. */
+export function readSectionChoices(userUid) {
+    if (!userUid) {
+        return {};
+    }
+    let stored;
+    try {
+        const raw = localStorage.getItem(collapsedSectionsKey(userUid));
+        stored = raw === null ? null : JSON.parse(raw);
+    }
+    catch {
+        return {};
+    }
+    if (!stored || typeof stored !== "object" || Array.isArray(stored)) {
+        return {};
+    }
+    // Only what is a real choice: a value that is not a boolean falls back to the default for its own section, not for all of them.
+    return Object.fromEntries(Object.entries(stored).filter((entry) => typeof entry[1] === "boolean"));
+}
+/** Stores a user's choices. Best-effort - see this module's own doc comment. */
+export function writeSectionChoices(userUid, choices) {
+    if (!userUid) {
+        return;
+    }
+    try {
+        localStorage.setItem(collapsedSectionsKey(userUid), JSON.stringify(choices));
+    }
+    catch {
+        // Best-effort - see this module's own doc comment.
+    }
+}
+/** Whether a section is open by the reader's choice, or by the default rule where they have made none (a navigation's override not considered). */
+export function sectionChosenOpen(id, choices, primaryUid) {
+    const collapsed = choices[id];
+    return collapsed === undefined ? id === ALL_MAILBOXES_SECTION || id === primaryUid : !collapsed;
+}
+/** See this module's doc comment. */
+export function useSidebarSections({ userUid, primaryUid, activeId }) {
+    const [loaded, setLoaded] = useState(() => ({ userUid, choices: readSectionChoices(userUid) }));
+    let current = loaded;
+    if (loaded.userUid !== userUid) {
+        // Another user signed in on this page: theirs are not the last one's choices.
+        current = { userUid, choices: readSectionChoices(userUid) };
+        setLoaded(current);
+    }
+    // The section the last navigation opened, if any: derived while rendering from the change of `activeId` (no effect, so the section is
+    // already open in the render that highlights its folder). A first `activeId` (from undefined) is not a navigation.
+    const [nav, setNav] = useState({ activeId, opened: undefined });
+    let currentNav = nav;
+    if (nav.activeId !== activeId) {
+        currentNav = { activeId, opened: nav.activeId === undefined ? undefined : activeId };
+        setNav(currentNav);
+    }
+    // Kept in step with what was last rendered, and moved on by a toggle at once, so two toggles before a re-render both count.
+    const choicesRef = useRef(current.choices);
+    choicesRef.current = current.choices;
+    const openedRef = useRef(currentNav.opened);
+    openedRef.current = currentNav.opened;
+    const toggle = useCallback((id) => {
+        const expanded = openedRef.current === id || sectionChosenOpen(id, choicesRef.current, primaryUid);
+        const next = { ...choicesRef.current, [id]: expanded };
+        choicesRef.current = next;
+        setLoaded({ userUid, choices: next });
+        writeSectionChoices(userUid, next);
+        if (openedRef.current === id) {
+            // The reader's own choice replaces the override that had opened it.
+            openedRef.current = undefined;
+            setNav({ activeId, opened: undefined });
+        }
+    }, [activeId, primaryUid, userUid]);
+    const choices = current.choices;
+    const opened = currentNav.opened;
+    return useMemo(() => ({
+        isExpanded: (id) => id === opened || sectionChosenOpen(id, choices, primaryUid),
+        toggle,
+    }), [opened, choices, primaryUid, toggle]);
+}

package/dist/apps/shared/mail/useMailConnection.js

@@ -6,6 +6,7 @@ import { createContext, useCallback, useEffect, useRef, useState } from "react";
 import { ApiRequestError } from "@rapidmx/react-shared/util/api.js";
 import { listFolders, listMailboxes } from "@rapidmx/react-shared/mail/mailApi.js";
 import { FOLDER_ORDER, MAIL_FOLDER_TYPES, isMailFolder, knownFolderUids, reconcileFolders, removeFolder, upsertFolder } from "./folderTree.js";
+import { orderMailboxes } from "./primaryMailbox.js";
 import { useMailLiveUpdates } from "./useMailLiveUpdates.js";
 import { useNewMailNotifications } from "./useNewMailNotifications.js";
 import { usePushConnectionNotice } from "../notifications/pushStatus.js";
@@ -38,7 +39,8 @@ export function useMailConnection({ userUid, enabled, open }) {
         }
         listMailboxes({ limit: MAILBOX_LIST_LIMIT })
             .then((result) => {
-            setMailboxes(result);
+            // The caller's own mailbox first, then the others: every sidebar, picker and default below follows this order.
+            setMailboxes(orderMailboxes(result, userUid));
             setStatus("ready");
         })
             .catch((err) => {

package/dist/apps/shared/search/crossMailboxSearch.d.ts

@@ -0,0 +1,72 @@
+import type { SearchResult } from "@rapidmx/react-shared/search/searchApi.js";
+/**
+ * How far a cross-mailbox search fans out. Exported (and mutable) so a test can shrink them instead of building 26 mailboxes or waiting a
+ * minute for a timeout; nothing else writes to it.
+ */
+export declare const SEARCH_LIMITS: {
+    /** How many mailboxes are worked on at once. */
+    concurrency: number;
+    /** The most mailboxes one search covers - the caller's own first, then the shared ones (`orderMailboxes()`); a note says how many were left out. */
+    maxMailboxes: number;
+    /** How long one mailbox's Tier 1 (server) request may take before that mailbox is given up on, so one wedged mailbox cannot hold the search. */
+    tier1TimeoutMs: number;
+    /** The same for a mailbox's Tier 3 pass (fetching and decrypting up to a couple of hundred candidates, so much longer). */
+    tier3TimeoutMs: number;
+    /** The most result rows a search keeps on screen (the page's own cap for a list, `MAX_LOADED_ROWS`, applies to a search too). */
+    maxRows: number;
+};
+/**
+ * How many results each mailbox contributes to one page. One mailbox gives the whole page; with several the page is shared out between them
+ * (never below `MIN_MAILBOX_PAGE_SIZE`), so the merged first page stays about one page long instead of growing by the number of mailboxes.
+ */
+export declare function searchPageSize(mailboxCount: number, pageSize: number): number;
+/** A search hit that remembers which mailbox it was found in. */
+export interface MailboxHit extends SearchResult {
+    mailboxUid: string;
+}
+export declare function tagHits(mailboxUid: string, hits: SearchResult[]): MailboxHit[];
+/** One hit's identity across mailboxes: the same entity uid found in two mailboxes is two hits. */
+export declare function hitKey(hit: {
+    mailboxUid: string;
+    entityUid: string;
+}): string;
+/**
+ * Merges Tier 1 (server, possibly `metadataOnly` for an encrypted message), Tier 2 (local index, fully decrypted and re-scored) and Tier 3
+ * (server-narrowed candidates, decrypted and re-scored) results into one ranked list, per `specs/search.md` §7's "client MUST re-score all
+ * results it can see... normalise into the same space rather than interleaving raw scores": each tier is normalized independently via
+ * `normalizeServerScores()` before merging, since a Postgres/OpenSearch score, a local `bm25()` score, and Tier 3's own term-count score all
+ * occupy unrelated ranges. A hit present in more than one list keeps only the last-inserted entry (Tier 2 wins over Tier 3 wins over Tier 1) -
+ * Tier 2 and Tier 3 both represent genuine, content-verified scores for the same message, so which one "wins" on overlap doesn't change
+ * correctness, only which of two equally-valid scores is shown; either supersedes Tier 1's metadata-only guess for the same message.
+ *
+ * Each tier's list is pooled across every mailbox searched before it is normalized, so one mailbox's best hit is not automatically "1.0"
+ * next to another's: the ranking is the same rule as for one mailbox, applied to the merged lists. A hit's identity is its mailbox and its
+ * entity uid (`hitKey()`), so the same uid can only collapse within a mailbox. Ties keep the order the lists were given in (a stable sort), which
+ * the caller makes the mailboxes' display order.
+ *
+ * Called progressively - each time with whatever tiers have reported so far (an empty array for the rest). Pure and stateless.
+ */
+export declare function mergeSearchResults(tier1: MailboxHit[], tier2: MailboxHit[], tier3: MailboxHit[]): MailboxHit[];
+/** Raised by `withTimeout()`. */
+export declare class SearchTimeoutError extends Error {
+    constructor();
+}
+/** `promise`, or a rejection with `SearchTimeoutError` if it has not settled after `ms` (never, for a non-finite `ms`). The work is not aborted - a late answer is just dropped. */
+export declare function withTimeout<T>(promise: Promise<T>, ms: number): Promise<T>;
+/**
+ * Runs `task` for every item, at most `concurrency` at a time, starting them in order. Stops starting new ones once `isCancelled()` (the search
+ * was superseded) or once one has rejected - which is then this function's own rejection, after the ones already running have settled.
+ */
+export declare function runLimited<T>(items: readonly T[], concurrency: number, task: (item: T) => Promise<void>, isCancelled: () => boolean): Promise<void>;
+/** Why one mailbox's search failed, as a short phrase for the notice: the class of failure, never the server's own text. */
+export declare function classifyFailure(err: unknown): string;
+/** A mailbox that could not be (fully) searched. `encrypted` is set when only its Tier 3 pass (the encrypted mail) failed - its other results are in. */
+export interface MailboxFailure {
+    mailboxUid: string;
+    /** The mailbox's display name, as it was when the search ran. */
+    mailboxName: string;
+    encrypted: boolean;
+    reason: string;
+}
+/** The body of the "Some results may be missing" notice: which mailboxes, and why each. */
+export declare function describeFailures(failures: readonly MailboxFailure[]): string;