@rapidmx/web-client 0.20.0 → 0.22.0

package/dist/apps/shared/components/mail/verificationSeals.d.ts

@@ -1,14 +1,35 @@
-import { type Message } from "@rapidmx/react-shared/mail/mailApi.js";
-import type { SealToWrite } from "@rapidmx/react-shared/crypto/messageSecurity.js";
+/**
+ * The web client's side of verification seals (`@rapidmx/react-shared`'s `crypto/verificationSeal.ts`): the vault's
+ * current `masterKeyGeneration` a seal is checked and written under, and best-effort seal writes.
+ *
+ * **Vault generation.** `getVaultGeneration()` reads `KeyVault.masterKeyGeneration` once per mailbox and reuses it for
+ * `VAULT_GENERATION_TTL_MS`; a failed read isn't cached. A vault that doesn't report a non-negative integer generation
+ * (a server predating it) counts as unavailable, and callers then evaluate without seals at all. The cache is dropped
+ * whenever a key session locks (subscribed on first use), so a rekey followed by a re-unlock is picked up.
+ *
+ * **Writes.** `sendVerificationSeal()` stores `sealToWrite` with `setMessageVerificationSeal()` and never rejects. Each
+ * message is written at most once per master key generation per page session - a seal carries the time it was built,
+ * so every evaluation of the same message produces a different one, and sending each would only draw 409s. A `409`
+ * (the server kept its seal), `400`, `403` or `404` is final; any other failure (a network error) lets a later
+ * evaluation try again, never a retry loop. A stored seal is remembered (`currentVerificationSeal()`) so a message
+ * reopened before its list copy is refreshed opens that seal instead of building another.
+ */
+import { ApiClient } from "../../../../lib/util/api.js";
+import { type Message } from "../../../../lib/mail/mailApi.js";
+import type { SealToWrite } from "../../../../lib/crypto/messageSecurity.js";
 /** How long one mailbox's vault generation is reused before it is read again. */
 export declare const VAULT_GENERATION_TTL_MS = 60000;
 /** Forgets the cached vault generations and this session's seal writes - in tests. */
 export declare function clearVerificationSealCache(): void;
 /** Reads `mailboxUid`'s current vault `masterKeyGeneration`, uncached: `undefined` when the vault can't be read or
  * reports none. Never rejects. */
-export declare function readVaultGeneration(mailboxUid: string): Promise<number | undefined>;
-/** `mailboxUid`'s current vault `masterKeyGeneration`, or `undefined` when it can't be read. Never rejects. */
-export declare function getVaultGeneration(mailboxUid: string): Promise<number | undefined>;
+export declare function readVaultGeneration(mailboxUid: string, client?: ApiClient): Promise<number | undefined>;
+/** `mailboxUid`'s current vault `masterKeyGeneration`, or `undefined` when it can't be read. Never rejects.
+ *
+ * The cache below is keyed by `mailboxUid` alone, not by `client` - fine for every caller today (a
+ * `mailboxUid` belongs to one account's own `ApiClient`), but worth knowing if a future caller ever reused
+ * the same `mailboxUid` string across two different `ApiClient`s. */
+export declare function getVaultGeneration(mailboxUid: string, client?: ApiClient): Promise<number | undefined>;
 /** The seal to check `message` against: the one this session stored for it when that is newer than the message's own
  * copy (which may predate the write), else the message's `verificationSeal`/`verificationSealGeneration`. */
 export declare function currentVerificationSeal(message: Pick<Message, "uid" | "verificationSeal" | "verificationSealGeneration">): {
@@ -19,4 +40,4 @@ export declare function currentVerificationSeal(message: Pick<Message, "uid" | "
 export declare function verificationSealPending(messageUid: string, generation: number): boolean;
 /** Stores `sealToWrite` on `messageUid`, best effort - see this module's doc comment. Resolves `true` when a request was
  * sent, `false` when the write was skipped as already attempted. Never rejects. */
-export declare function sendVerificationSeal(messageUid: string, sealToWrite: SealToWrite): Promise<boolean>;
+export declare function sendVerificationSeal(messageUid: string, sealToWrite: SealToWrite, client?: ApiClient): Promise<boolean>;

package/dist/apps/shared/components/mail/verificationSeals.js

@@ -18,10 +18,10 @@
  * evaluation try again, never a retry loop. A stored seal is remembered (`currentVerificationSeal()`) so a message
  * reopened before its list copy is refreshed opens that seal instead of building another.
  */
-import { ApiRequestError } from "@rapidmx/react-shared/util/api.js";
-import { getKeyVault } from "@rapidmx/react-shared/crypto/keyvaultApi.js";
-import { subscribeKeySession } from "@rapidmx/react-shared/crypto/keySession.js";
-import { setMessageVerificationSeal } from "@rapidmx/react-shared/mail/mailApi.js";
+import { ApiRequestError } from "../../../../lib/util/api.js";
+import { getKeyVault } from "../../../../lib/crypto/keyvaultApi.js";
+import { subscribeKeySession } from "../../../../lib/crypto/keySession.js";
+import { setMessageVerificationSeal } from "../../../../lib/mail/mailApi.js";
 /** How long one mailbox's vault generation is reused before it is read again. */
 export const VAULT_GENERATION_TTL_MS = 60000;
 /** Statuses after which a seal write is never attempted again for that message and generation. */
@@ -51,23 +51,27 @@ function subscribeToLocksOnce() {
 }
 /** Reads `mailboxUid`'s current vault `masterKeyGeneration`, uncached: `undefined` when the vault can't be read or
  * reports none. Never rejects. */
-export async function readVaultGeneration(mailboxUid) {
+export async function readVaultGeneration(mailboxUid, client) {
     try {
-        const { masterKeyGeneration } = await getKeyVault(mailboxUid);
+        const { masterKeyGeneration } = await getKeyVault(mailboxUid, client);
         return Number.isSafeInteger(masterKeyGeneration) && masterKeyGeneration >= 0 ? masterKeyGeneration : undefined;
     }
     catch {
         return undefined;
     }
 }
-/** `mailboxUid`'s current vault `masterKeyGeneration`, or `undefined` when it can't be read. Never rejects. */
-export function getVaultGeneration(mailboxUid) {
+/** `mailboxUid`'s current vault `masterKeyGeneration`, or `undefined` when it can't be read. Never rejects.
+ *
+ * The cache below is keyed by `mailboxUid` alone, not by `client` - fine for every caller today (a
+ * `mailboxUid` belongs to one account's own `ApiClient`), but worth knowing if a future caller ever reused
+ * the same `mailboxUid` string across two different `ApiClient`s. */
+export function getVaultGeneration(mailboxUid, client) {
     subscribeToLocksOnce();
     const entry = generationCache.get(mailboxUid);
     if (entry && Date.now() - entry.loadedAt <= VAULT_GENERATION_TTL_MS) {
         return entry.generation;
     }
-    const created = { loadedAt: Date.now(), generation: readVaultGeneration(mailboxUid) };
+    const created = { loadedAt: Date.now(), generation: readVaultGeneration(mailboxUid, client) };
     generationCache.set(mailboxUid, created);
     void created.generation.then((generation) => {
         // Only a readable generation is reused; an unavailable one is read again next time.
@@ -92,14 +96,14 @@ export function verificationSealPending(messageUid, generation) {
 }
 /** Stores `sealToWrite` on `messageUid`, best effort - see this module's doc comment. Resolves `true` when a request was
  * sent, `false` when the write was skipped as already attempted. Never rejects. */
-export async function sendVerificationSeal(messageUid, sealToWrite) {
+export async function sendVerificationSeal(messageUid, sealToWrite, client) {
     const key = `${messageUid}:${sealToWrite.masterKeyGeneration}`;
     if (attemptedWrites.has(key)) {
         return false;
     }
     attemptedWrites.add(key);
     try {
-        await setMessageVerificationSeal(messageUid, sealToWrite.seal, sealToWrite.masterKeyGeneration);
+        await setMessageVerificationSeal(messageUid, sealToWrite.seal, sealToWrite.masterKeyGeneration, client);
         storedSeals.set(messageUid, sealToWrite);
     }
     catch (err) {

package/dist/apps/shared/components/mail/writableMailboxes.d.ts

@@ -1,12 +1,17 @@
-import type { Mailbox } from "@rapidmx/react-shared/mail/mailApi.js";
+import type { Mailbox } from "../../../../lib/mail/mailApi.js";
+import type { ApiClient } from "../../../../lib/util/api.js";
 /** `true` writable, `false` known view-only, `undefined` couldn't tell (treated as writable). */
 export type MailboxWritability = boolean | undefined;
 /** Forgets every cached answer - for tests, and anything that changes the caller's access mid-session. */
 export declare function clearMailboxWritabilityCache(): void;
 /** The already-known answer for `mailbox`, without making a request. */
 export declare function peekMailboxWritability(mailbox: Mailbox, userUid: string | undefined, trusted?: boolean): MailboxWritability;
-/** Whether the caller can create items in `mailbox`. Never rejects. */
-export declare function getMailboxWritability(mailbox: Mailbox, userUid: string | undefined, trusted?: boolean): Promise<MailboxWritability>;
+/** Whether the caller can create items in `mailbox`. Never rejects.
+ *
+ * `inFlight`/`settled` are keyed by `mailbox.uid` alone, not by `client` - fine for every caller today (a
+ * mailbox uid belongs to one account's own `ApiClient`), but worth knowing if a future caller ever reused
+ * the same mailbox uid across two different `ApiClient`s. */
+export declare function getMailboxWritability(mailbox: Mailbox, userUid: string | undefined, trusted?: boolean, client?: ApiClient): Promise<MailboxWritability>;
 /** Per-mailbox writability answers for `mailboxes`, filled in as each one arrives (already-known answers are
  * present from the first render). */
 export declare function useMailboxWritability(mailboxes: Mailbox[], userUid: string | undefined, trusted?: boolean): Record<string, MailboxWritability>;

package/dist/apps/shared/components/mail/writableMailboxes.js

@@ -18,7 +18,8 @@
  * answer arrives.
  */
 import { useEffect, useMemo, useState } from "react";
-import { getMyMailboxAccess } from "@rapidmx/react-shared/mail/mailboxAccessApi.js";
+import { getMyMailboxAccess } from "../../../../lib/mail/mailboxAccessApi.js";
+import { useApiClient } from "../../../../lib/util/apiClientContext.js";
 const inFlight = new Map();
 const settled = new Map();
 /** Forgets every cached answer - for tests, and anything that changes the caller's access mid-session. */
@@ -33,15 +34,19 @@ function isImplicitlyWritable(mailbox, userUid, trusted) {
 export function peekMailboxWritability(mailbox, userUid, trusted) {
     return isImplicitlyWritable(mailbox, userUid, trusted) ? true : settled.get(mailbox.uid);
 }
-/** Whether the caller can create items in `mailbox`. Never rejects. */
-export function getMailboxWritability(mailbox, userUid, trusted) {
+/** Whether the caller can create items in `mailbox`. Never rejects.
+ *
+ * `inFlight`/`settled` are keyed by `mailbox.uid` alone, not by `client` - fine for every caller today (a
+ * mailbox uid belongs to one account's own `ApiClient`), but worth knowing if a future caller ever reused
+ * the same mailbox uid across two different `ApiClient`s. */
+export function getMailboxWritability(mailbox, userUid, trusted, client) {
     const known = peekMailboxWritability(mailbox, userUid, trusted);
     if (known !== undefined) {
         return Promise.resolve(known);
     }
     let request = inFlight.get(mailbox.uid);
     if (!request) {
-        request = getMyMailboxAccess(mailbox.uid).then((access) => {
+        request = getMyMailboxAccess(mailbox.uid, client).then((access) => {
             settled.set(mailbox.uid, access.canCreate);
             inFlight.delete(mailbox.uid);
             return access.canCreate;
@@ -57,11 +62,12 @@ export function getMailboxWritability(mailbox, userUid, trusted) {
 /** Per-mailbox writability answers for `mailboxes`, filled in as each one arrives (already-known answers are
  * present from the first render). */
 export function useMailboxWritability(mailboxes, userUid, trusted) {
+    const client = useApiClient();
     const [answers, setAnswers] = useState({});
     useEffect(() => {
         let cancelled = false;
         for (const mailbox of mailboxes) {
-            void getMailboxWritability(mailbox, userUid, trusted).then((writable) => {
+            void getMailboxWritability(mailbox, userUid, trusted, client).then((writable) => {
                 if (!cancelled) {
                     setAnswers((prev) => ({ ...prev, [mailbox.uid]: writable }));
                 }
@@ -70,7 +76,7 @@ export function useMailboxWritability(mailboxes, userUid, trusted) {
         return () => {
             cancelled = true;
         };
-    }, [mailboxes, userUid, trusted]);
+    }, [mailboxes, userUid, trusted, client]);
     return useMemo(() => {
         const merged = {};
         for (const mailbox of mailboxes) {

package/dist/apps/shared/components/rules/RuleBuilder.js

@@ -4,7 +4,7 @@ import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 // SPDX-License-Identifier: MPL-2.0
 ///////////////////////////////////////////////////////////////////////////////
 import { useState } from "react";
-import Button from "@rapidmx/react-shared/components/buttons/Button.js";
+import Button from "../../../../lib/components/buttons/Button.js";
 const INPUT_CLASS = "flex-1 text-sm py-2 px-3 border border-border rounded-sm bg-surface text-text focus:outline-none focus:border-primary";
 /**
  * Whether `conditions` holds at least one real condition: a list with a non-blank entry, a ticked

package/dist/apps/shared/components/settings/SigningCertificateCard.d.ts

@@ -1,5 +1,5 @@
 import React from "react";
-import type { EnrollmentResult } from "@rapidmx/react-shared/crypto/keyvaultApi.js";
+import type { EnrollmentResult } from "../../../../lib/crypto/keyvaultApi.js";
 import type { EnrollmentSnapshot } from "../../signing/enrollmentTracker.js";
 import type { SigningEnrollmentInfo } from "../../signing/signingInfo.js";
 export type SigningCertificateMode = "pending" | "issued" | "failed" | "expired";

package/dist/apps/shared/components/settings/SigningCertificateCard.js

@@ -1,8 +1,8 @@
 import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
 import { HiOutlineCheckCircle, HiOutlineExclamationTriangle, HiOutlineXCircle } from "react-icons/hi2";
-import Alert from "@rapidmx/react-shared/components/feedback/Alert.js";
-import Button from "@rapidmx/react-shared/components/buttons/Button.js";
-import CopyButton from "@rapidmx/react-shared/components/buttons/CopyButton.js";
+import Alert from "../../../../lib/components/feedback/Alert.js";
+import Button from "../../../../lib/components/buttons/Button.js";
+import CopyButton from "../../../../lib/components/buttons/CopyButton.js";
 import { CA_UNREACHABLE_TEXT, MANUAL_ISSUE_TEXT, PENDING_FALLBACK_TEXT, expiryOf, formatDate, formatDateTime, healthWarning, isInstalling, isOverdue, issueModeOf, progressOf, requestedFromText, relativeTime, statusLineOf, stepsOf, timeOf, truncateSerial, } from "../../signing/enrollmentView.js";
 import { useNow } from "../../signing/useNow.js";
 const BADGE = {

package/dist/apps/shared/components/settings/layout/SettingsShell.d.ts

@@ -1,5 +1,5 @@
 import React, { PropsWithChildren } from "react";
-import { Mailbox } from "@rapidmx/react-shared/mail/mailApi.js";
+import { Mailbox } from "../../../../../lib/mail/mailApi.js";
 import { AppShellProps } from "../../layout/AppShell.js";
 import { PluginNav } from "../../../plugins/pluginNav.js";
 export interface SettingsSectionDef {

package/dist/apps/shared/components/settings/layout/SettingsShell.js

@@ -5,11 +5,12 @@ import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-run
 ///////////////////////////////////////////////////////////////////////////////
 import { createContext, useContext, useEffect, useMemo, useState } from "react";
 import { HiOutlineBars3 } from "react-icons/hi2";
-import { ApiRequestError } from "@rapidmx/react-shared/util/api.js";
-import Drawer from "@rapidmx/react-shared/components/overlays/Drawer.js";
-import { listMailboxes } from "@rapidmx/react-shared/mail/mailApi.js";
-import Alert from "@rapidmx/react-shared/components/feedback/Alert.js";
-import Skeleton, { SkeletonList } from "@rapidmx/react-shared/components/feedback/Skeleton.js";
+import { ApiRequestError } from "../../../../../lib/util/api.js";
+import Drawer from "../../../../../lib/components/overlays/Drawer.js";
+import { listMailboxes } from "../../../../../lib/mail/mailApi.js";
+import { useApiClient } from "../../../../../lib/util/apiClientContext.js";
+import Alert from "../../../../../lib/components/feedback/Alert.js";
+import Skeleton, { SkeletonList } from "../../../../../lib/components/feedback/Skeleton.js";
 import AppShell from "../../layout/AppShell.js";
 import { useLocation, useNavigate } from "../../../navigation/index.js";
 import MailboxProvisioning from "../../layout/MailboxProvisioning.js";
@@ -52,6 +53,7 @@ export function useSettingsShell() {
  * app rail, since this framework has no client-side router.
  */
 export default function SettingsShell({ active, userUid, authServerUrl, impersonating, impersonationBaseUrl, trusted, trustedRoles, pluginNav, children, }) {
+    const client = useApiClient();
     const [status, setStatus] = useState("checking");
     const [error, setError] = useState(null);
     const [mailboxes, setMailboxes] = useState([]);
@@ -73,7 +75,7 @@ export default function SettingsShell({ active, userUid, authServerUrl, imperson
         if (!userUid) {
             return;
         }
-        listMailboxes({ limit: 100 })
+        listMailboxes({ limit: 100 }, client)
             .then((result) => {
             setMailboxes(orderMailboxes(result, userUid));
             setStatus("ready");

package/dist/apps/shared/components/sharing/PrincipalListField.d.ts

@@ -1,5 +1,5 @@
 import React from "react";
-import { ResolvedPrincipal } from "@rapidmx/react-shared/mail/mailboxAccessApi.js";
+import { ResolvedPrincipal } from "../../../../lib/mail/mailboxAccessApi.js";
 export interface PrincipalListFieldProps {
     label: string;
     values: string[];

package/dist/apps/shared/components/sharing/PrincipalPicker.d.ts

@@ -1,5 +1,5 @@
 import React from "react";
-import { MailboxAccessRole, ResolvedPrincipal } from "@rapidmx/react-shared/mail/mailboxAccessApi.js";
+import { MailboxAccessRole, ResolvedPrincipal } from "../../../../lib/mail/mailboxAccessApi.js";
 import { describePerson } from "./PrincipalResolver.js";
 export { describePerson };
 export interface PrincipalPickerProps {

package/dist/apps/shared/components/sharing/PrincipalPicker.js

@@ -4,7 +4,7 @@ import { jsx as _jsx, Fragment as _Fragment, jsxs as _jsxs } from "react/jsx-run
 // SPDX-License-Identifier: MPL-2.0
 ///////////////////////////////////////////////////////////////////////////////
 import { useState } from "react";
-import { resolveMailboxPrincipal, setMailboxAccess, } from "@rapidmx/react-shared/mail/mailboxAccessApi.js";
+import { resolveMailboxPrincipal, setMailboxAccess, } from "../../../../lib/mail/mailboxAccessApi.js";
 import PrincipalResolver, { describePerson } from "./PrincipalResolver.js";
 export { describePerson };
 /**

package/dist/apps/shared/components/sharing/PrincipalResolver.d.ts

@@ -1,5 +1,5 @@
 import React, { ReactNode } from "react";
-import { ResolvedPrincipal } from "@rapidmx/react-shared/mail/mailboxAccessApi.js";
+import { ResolvedPrincipal } from "../../../../lib/mail/mailboxAccessApi.js";
 export interface PrincipalResolverProps {
     /** Resolves what was typed - a mailbox address, an auth-server username or e-mail alias, or a user uid - to
      * the one person it names, exact match only. Rejects (typically with an `ApiRequestError`) for nobody. */

package/dist/apps/shared/components/sharing/PrincipalResolver.js

@@ -4,9 +4,9 @@ import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 // SPDX-License-Identifier: MPL-2.0
 ///////////////////////////////////////////////////////////////////////////////
 import { useEffect, useState } from "react";
-import { ApiRequestError } from "@rapidmx/react-shared/util/api.js";
-import Alert from "@rapidmx/react-shared/components/feedback/Alert.js";
-import Button from "@rapidmx/react-shared/components/buttons/Button.js";
+import { ApiRequestError } from "../../../../lib/util/api.js";
+import Alert from "../../../../lib/components/feedback/Alert.js";
+import Button from "../../../../lib/components/buttons/Button.js";
 /** Who a resolved person is, for a person to check before confirming: their name and address, else their uid. */
 export function describePerson(person) {
     if (person.displayName && person.address)

package/dist/apps/shared/components/tasks/TasksSidebar.d.ts

@@ -1,5 +1,5 @@
 import React from "react";
-import { Task } from "@rapidmx/react-shared/tasks/tasksApi.js";
+import { Task } from "../../../../lib/tasks/tasksApi.js";
 export type TasksView = {
     type: "myDay";
 } | {

package/dist/apps/shared/components/tasks/TasksSidebar.js

@@ -5,9 +5,10 @@ import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-run
 ///////////////////////////////////////////////////////////////////////////////
 import { useEffect, useMemo, useState } from "react";
 import { HiOutlineBars3 } from "react-icons/hi2";
-import { ApiRequestError } from "@rapidmx/react-shared/util/api.js";
-import { createTaskList, listTaskLists } from "@rapidmx/react-shared/tasks/tasksApi.js";
-import Drawer from "@rapidmx/react-shared/components/overlays/Drawer.js";
+import { ApiRequestError } from "../../../../lib/util/api.js";
+import { createTaskList, listTaskLists } from "../../../../lib/tasks/tasksApi.js";
+import Drawer from "../../../../lib/components/overlays/Drawer.js";
+import { useApiClient } from "../../../../lib/util/apiClientContext.js";
 import { notifyApiError } from "../../notifications/apiErrors.js";
 export function tasksViewKey(view) {
     return view.type === "list" ? `list:${view.uid}` : view.type;
@@ -27,6 +28,7 @@ function NavItem({ label, count, active, onClick }) {
  * lists are real `TaskList` records, fetched here (same pattern as `ContactsSidebar`'s contact lists).
  */
 export default function TasksSidebar({ mailboxUid, tasks, userUid, active, onSelect, refreshToken }) {
+    const client = useApiClient();
     const [lists, setLists] = useState([]);
     const [listsError, setListsError] = useState(null);
     const [addingList, setAddingList] = useState(false);
@@ -38,7 +40,7 @@ export default function TasksSidebar({ mailboxUid, tasks, userUid, active, onSel
             return;
         }
         setListsError(null);
-        listTaskLists(mailboxUid, { limit: 200 })
+        listTaskLists(mailboxUid, { limit: 200 }, client)
             .then(setLists)
             .catch((err) => setListsError(err instanceof ApiRequestError ? err.message : "Could not load task lists."));
     }, [mailboxUid, refreshToken]);
@@ -61,7 +63,7 @@ export default function TasksSidebar({ mailboxUid, tasks, userUid, active, onSel
             return;
         }
         try {
-            const created = await createTaskList({ mailboxUid, name: newListName.trim() });
+            const created = await createTaskList({ mailboxUid, name: newListName.trim() }, client);
             setLists((prev) => [...prev, created].sort((a, b) => a.name.localeCompare(b.name)));
             setNewListName("");
             setAddingList(false);

package/dist/apps/shared/components/tasks/layout/TasksShell.d.ts

@@ -1,5 +1,5 @@
 import React, { PropsWithChildren } from "react";
-import { Mailbox } from "@rapidmx/react-shared/mail/mailApi.js";
+import { Mailbox } from "../../../../../lib/mail/mailApi.js";
 import { AppShellProps } from "../../layout/AppShell.js";
 export type TasksShellProps = Omit<AppShellProps, "active">;
 export interface TasksShellContextValue {

package/dist/apps/shared/components/tasks/layout/TasksShell.js

@@ -5,11 +5,12 @@ import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-run
 ///////////////////////////////////////////////////////////////////////////////
 import { createContext, useContext, useEffect, useMemo, useState } from "react";
 import { HiOutlineBars3 } from "react-icons/hi2";
-import { ApiRequestError } from "@rapidmx/react-shared/util/api.js";
-import Drawer from "@rapidmx/react-shared/components/overlays/Drawer.js";
-import { listFolders, listMailboxes } from "@rapidmx/react-shared/mail/mailApi.js";
-import Alert from "@rapidmx/react-shared/components/feedback/Alert.js";
-import Skeleton, { SkeletonList } from "@rapidmx/react-shared/components/feedback/Skeleton.js";
+import { ApiRequestError } from "../../../../../lib/util/api.js";
+import Drawer from "../../../../../lib/components/overlays/Drawer.js";
+import { listFolders, listMailboxes } from "../../../../../lib/mail/mailApi.js";
+import { useApiClient } from "../../../../../lib/util/apiClientContext.js";
+import Alert from "../../../../../lib/components/feedback/Alert.js";
+import Skeleton, { SkeletonList } from "../../../../../lib/components/feedback/Skeleton.js";
 import AppShell from "../../layout/AppShell.js";
 import { useLocation, useNavigate } from "../../../navigation/index.js";
 import MailboxProvisioning from "../../layout/MailboxProvisioning.js";
@@ -27,6 +28,7 @@ export function useTasksShell() {
  * grow its own app-specific controls later without threading extra props through a shared one.
  */
 export default function TasksShell({ userUid, authServerUrl, impersonating, impersonationBaseUrl, trusted, trustedRoles, pluginNav, children, }) {
+    const client = useApiClient();
     const [status, setStatus] = useState("checking");
     const [error, setError] = useState(null);
     const [mailboxes, setMailboxes] = useState([]);
@@ -50,7 +52,7 @@ export default function TasksShell({ userUid, authServerUrl, impersonating, impe
         if (!userUid) {
             return;
         }
-        listMailboxes({ limit: 100 })
+        listMailboxes({ limit: 100 }, client)
             .then((result) => {
             setMailboxes(orderMailboxes(result, userUid));
             setStatus("ready");
@@ -68,7 +70,7 @@ export default function TasksShell({ userUid, authServerUrl, impersonating, impe
             return;
         }
         setFolderError(null);
-        listFolders(mailboxUid)
+        listFolders(mailboxUid, client)
             .then(setFolders)
             .catch((err) => setFolderError(err instanceof ApiRequestError ? err.message : "Could not load this mailbox's tasks folder."));
     }, [mailboxUid]);

package/dist/apps/shared/keyboard/ShortcutsDialog.js

@@ -4,7 +4,7 @@ import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 // SPDX-License-Identifier: MPL-2.0
 ///////////////////////////////////////////////////////////////////////////////
 import React from "react";
-import Modal from "@rapidmx/react-shared/components/overlays/Modal.js";
+import Modal from "../../../lib/components/overlays/Modal.js";
 import { formatSpec, specsFor } from "./format.js";
 import { HELP_SCOPES, SCOPE_LABELS, SHORTCUTS, shortcutRank } from "./keymap.js";
 import { useKeyEnvironment, useRegisteredShortcuts } from "./ShortcutProvider.js";

package/dist/apps/shared/mail/findWellKnownFolderUid.d.ts

@@ -1,5 +1,7 @@
-import { FolderType } from "@rapidmx/react-shared/mail/mailApi.js";
+import { FolderType } from "../../../lib/mail/mailApi.js";
+import { ApiClient } from "../../../lib/util/api.js";
 /** The uid of a mailbox's well-known folder of `type` (e.g. its Contacts or Tasks folder), for creating an
  * item in a mailbox other than the one an app currently has loaded. Resolves `undefined` if the mailbox has
- * no such folder; rejects if the folder list can't be fetched. */
-export declare function findWellKnownFolderUid(mailboxUid: string, type: FolderType): Promise<string | undefined>;
+ * no such folder; rejects if the folder list can't be fetched. `client`, when given, is threaded through to
+ * `listFolders()` (see `useApiClient()`'s own doc comment) - omitted, this behaves exactly as before. */
+export declare function findWellKnownFolderUid(mailboxUid: string, type: FolderType, client?: ApiClient): Promise<string | undefined>;

package/dist/apps/shared/mail/findWellKnownFolderUid.js

@@ -2,11 +2,12 @@
 // Copyright (C) 2026 Jean-Philippe Steinmetz
 // SPDX-License-Identifier: MPL-2.0
 ///////////////////////////////////////////////////////////////////////////////
-import { listFolders } from "@rapidmx/react-shared/mail/mailApi.js";
+import { listFolders } from "../../../lib/mail/mailApi.js";
 /** The uid of a mailbox's well-known folder of `type` (e.g. its Contacts or Tasks folder), for creating an
  * item in a mailbox other than the one an app currently has loaded. Resolves `undefined` if the mailbox has
- * no such folder; rejects if the folder list can't be fetched. */
-export async function findWellKnownFolderUid(mailboxUid, type) {
-    const folders = await listFolders(mailboxUid);
+ * no such folder; rejects if the folder list can't be fetched. `client`, when given, is threaded through to
+ * `listFolders()` (see `useApiClient()`'s own doc comment) - omitted, this behaves exactly as before. */
+export async function findWellKnownFolderUid(mailboxUid, type, client) {
+    const folders = await listFolders(mailboxUid, client);
     return folders.find((folder) => folder.type === type)?.uid;
 }

package/dist/apps/shared/mail/folderCounts.d.ts

@@ -1,4 +1,4 @@
-import { Folder, FolderType, Mailbox, Message } from "@rapidmx/react-shared/mail/mailApi.js";
+import { Folder, FolderType, Mailbox, Message } from "../../../lib/mail/mailApi.js";
 /**
  * The folder badges' numbers, kept right without a reload.
  *

package/dist/apps/shared/mail/folderCounts.js

@@ -3,7 +3,8 @@
 // SPDX-License-Identifier: MPL-2.0
 ///////////////////////////////////////////////////////////////////////////////
 import { useCallback, useEffect, useRef, useState } from "react";
-import { listFolders } from "@rapidmx/react-shared/mail/mailApi.js";
+import { listFolders } from "../../../lib/mail/mailApi.js";
+import { useApiClient } from "../../../lib/util/apiClientContext.js";
 /** What one message change - a new message (`previous` absent), a deletion (`next` absent), a read/unread flip, a move - does to the folders' counts. */
 export function countDeltas(previous, next) {
     const byFolder = new Map();
@@ -75,9 +76,10 @@ const SEEN_LIMIT = 500;
  * each was loaded with); `mailboxes` is whose folders to read back. The overlay starts again whenever `mailboxes` does.
  */
 export function useFolderCounts(mailboxes, folders, onFoldersListed) {
+    const client = useApiClient();
     const [counts, setCounts] = useState({});
-    const latestRef = useRef({ mailboxes, folders, onFoldersListed });
-    latestRef.current = { mailboxes, folders, onFoldersListed };
+    const latestRef = useRef({ mailboxes, folders, onFoldersListed, client });
+    latestRef.current = { mailboxes, folders, onFoldersListed, client };
     // Bumped by every change of the overlay this page makes, so a read that started before one can tell it is out of date.
     const changesRef = useRef(0);
     const inFlightRef = useRef(0);
@@ -124,7 +126,7 @@ export function useFolderCounts(mailboxes, folders, onFoldersListed) {
         timerRef.current = undefined;
         const run = ++runRef.current;
         const startedAt = changesRef.current;
-        const results = await Promise.all(latestRef.current.mailboxes.map((mailbox) => listFolders(mailbox.uid).catch(() => undefined)));
+        const results = await Promise.all(latestRef.current.mailboxes.map((mailbox) => listFolders(mailbox.uid, latestRef.current.client).catch(() => undefined)));
         if (stoppedRef.current || run !== runRef.current) {
             return;
         }

package/dist/apps/shared/mail/folderOfType.d.ts

@@ -1,4 +1,5 @@
-import { Folder } from "@rapidmx/react-shared/mail/mailApi.js";
+import { Folder } from "../../../lib/mail/mailApi.js";
+import type { ApiClient } from "../../../lib/util/api.js";
 /** Forgets every remembered folder - for the tests. */
 export declare function clearResolvedFolders(): void;
 /**
@@ -10,4 +11,4 @@ export declare function clearResolvedFolders(): void;
  * lacks is asked for - the tree may only be out of date - and used, never created twice; only a server that really has none is asked to
  * make it. `onFound` is told about a folder the tree did not have, so the sidebar picks it up.
  */
-export declare function resolveFolderOfType(mailboxUid: string, type: Folder["type"], name: string, known?: Folder[], onFound?: (folder: Folder) => void): Promise<string>;
+export declare function resolveFolderOfType(mailboxUid: string, type: Folder["type"], name: string, known?: Folder[], onFound?: (folder: Folder) => void, client?: ApiClient): Promise<string>;

package/dist/apps/shared/mail/folderOfType.js

@@ -2,7 +2,7 @@
 // Copyright (C) 2026 Jean-Philippe Steinmetz
 // SPDX-License-Identifier: MPL-2.0
 ///////////////////////////////////////////////////////////////////////////////
-import { createFolder, listFolders } from "@rapidmx/react-shared/mail/mailApi.js";
+import { createFolder, listFolders } from "../../../lib/mail/mailApi.js";
 /** The folders this page load has had to look up or make for a mailbox, so a second Report junk does not ask again. */
 const resolved = new Map();
 /** Forgets every remembered folder - for the tests. */
@@ -18,7 +18,7 @@ export function clearResolvedFolders() {
  * lacks is asked for - the tree may only be out of date - and used, never created twice; only a server that really has none is asked to
  * make it. `onFound` is told about a folder the tree did not have, so the sidebar picks it up.
  */
-export async function resolveFolderOfType(mailboxUid, type, name, known = [], onFound) {
+export async function resolveFolderOfType(mailboxUid, type, name, known = [], onFound, client) {
     const inTree = known.find((folder) => folder.mailboxUid === mailboxUid && folder.type === type);
     if (inTree) {
         return inTree.uid;
@@ -28,13 +28,13 @@ export async function resolveFolderOfType(mailboxUid, type, name, known = [], on
     if (remembered) {
         return remembered;
     }
-    const listed = (await listFolders(mailboxUid)).find((folder) => folder.type === type);
+    const listed = (await listFolders(mailboxUid, client)).find((folder) => folder.type === type);
     if (listed) {
         onFound?.(listed);
         resolved.set(key, listed.uid);
         return listed.uid;
     }
-    const created = await createFolder({ mailboxUid, name, type });
+    const created = await createFolder({ mailboxUid, name, type }, client);
     resolved.set(key, created.uid);
     return created.uid;
 }

package/dist/apps/shared/mail/folderTree.d.ts

@@ -1,4 +1,4 @@
-import type { Folder } from "@rapidmx/react-shared/mail/mailApi.js";
+import type { Folder } from "../../../lib/mail/mailApi.js";
 import type { MailboxFolders } from "../components/mail/layout/MailShell.js";
 /**
  * The sidebar's order of a mailbox's well-known folders; anything else (`user`) follows, alphabetically. Also the order push channels are asked

package/dist/apps/shared/mail/listSnapshots.d.ts

@@ -1,5 +1,5 @@
-import type { ConversationSummary } from "@rapidmx/react-shared/mail/conversationsApi.js";
-import type { Message } from "@rapidmx/react-shared/mail/mailApi.js";
+import type { ConversationSummary } from "../../../lib/mail/conversationsApi.js";
+import type { Message } from "../../../lib/mail/mailApi.js";
 /**
  * A short-lived, in-memory copy of a folder's listing, so that switching to a folder that was shown a moment ago (or coming back
  * to Mail from another app) shows its rows on the very frame of the click and revalidates behind them (stale-while-revalidate),

package/dist/apps/shared/mail/messageReadState.d.ts

@@ -1,4 +1,5 @@
-import { Message } from "@rapidmx/react-shared/mail/mailApi.js";
+import { Message } from "../../../lib/mail/mailApi.js";
+import type { ApiClient } from "../../../lib/util/api.js";
 import type { CountTracker } from "./folderCounts.js";
 /**
  * The one way a message's read state changes in the webmail, so that every place that shows it moves together: the row in
@@ -23,10 +24,10 @@ export interface ReadStateSink {
  * doing (it already was that way) or the server refused - in which case everything has already been put back as it was.
  * Never rejects: like the old mark-as-read, a failure must not get in the way of reading the message.
  */
-export declare function setReadState(message: Message, read: boolean, sink: ReadStateSink): Promise<Message | undefined>;
+export declare function setReadState(message: Message, read: boolean, sink: ReadStateSink, client?: ApiClient): Promise<Message | undefined>;
 /**
  * The same for a whole selection, in one request. Resolves the updated messages, in request order. Unlike `setReadState()`
  * it rejects when the server refuses (after putting everything back), because a bulk update is not atomic - some of it may
  * have landed - and the caller's own handling reloads the list and says so (see `bulkUpdateMessages()`).
  */
-export declare function setReadStateMany(messages: Message[], read: boolean, sink: ReadStateSink): Promise<Message[]>;
+export declare function setReadStateMany(messages: Message[], read: boolean, sink: ReadStateSink, client?: ApiClient): Promise<Message[]>;