@rapidmx/web-client 0.21.0 → 0.22.0

package/dist/apps/shared/components/mail/compose/encryptionRequirement.d.ts

@@ -1,5 +1,5 @@
-import { RecipientEncryptionStatus } from "@rapidmx/react-shared/crypto/composeSecurity.js";
-import type { EncryptionPolicy } from "@rapidmx/react-shared/crypto/keyvaultApi.js";
+import { RecipientEncryptionStatus } from "../../../../../lib/crypto/composeSecurity.js";
+import type { EncryptionPolicy } from "../../../../../lib/crypto/keyvaultApi.js";
 /**
  * Whether a message must be treated as encrypted - the one place that decides it, as a pure function of what is *known*.
  *

package/dist/apps/shared/components/mail/compose/encryptionRequirement.js

@@ -2,7 +2,7 @@
 // Copyright (C) 2026 Jean-Philippe Steinmetz
 // SPDX-License-Identifier: MPL-2.0
 ///////////////////////////////////////////////////////////////////////////////
-import { decideMessageEncryption } from "@rapidmx/react-shared/crypto/composeSecurity.js";
+import { decideMessageEncryption } from "../../../../../lib/crypto/composeSecurity.js";
 /** Any tier of `policy` auto-encrypts - only then can what is still unknown about the recipients turn a message into an encrypted one. */
 export function policyCanAutoEncrypt(policy) {
     return [policy.encryptSameOrg, policy.encryptFederated, policy.encryptExternal].includes("automatic");

package/dist/apps/shared/components/mail/compose/quotedBody.d.ts

@@ -1,6 +1,6 @@
-import { Message, Recipient } from "@rapidmx/react-shared/mail/mailApi.js";
-import type { QuotedBody } from "@rapidmx/react-shared/mail/compose/composeQuoting.js";
-import type { MessageSecurityResult } from "@rapidmx/react-shared/crypto/messageSecurity.js";
+import { Message, Recipient } from "../../../../../lib/mail/mailApi.js";
+import type { QuotedBody } from "../../../../../lib/mail/compose/composeQuoting.js";
+import type { MessageSecurityResult } from "../../../../../lib/crypto/messageSecurity.js";
 /** What a Reply/Reply All/Forward needs from the message being answered, beyond what its `Message` record holds. */
 export interface OriginalMessage {
     /** The body to quote. Empty when none could be loaded - the quote builders then fall back to `bodyPreview`. */

package/dist/apps/shared/components/mail/compose/quotedBody.js

@@ -2,9 +2,9 @@
 // Copyright (C) 2026 Jean-Philippe Steinmetz
 // SPDX-License-Identifier: MPL-2.0
 ///////////////////////////////////////////////////////////////////////////////
-import { apiUrl } from "@rapidmx/react-shared/util/api.js";
-import { getMessageRawContent } from "@rapidmx/react-shared/mail/mailApi.js";
-import { decodeHeaderText, extractDisplayBody, parseMimeEntity } from "@rapidmx/react-shared/crypto/mime.js";
+import { apiUrl } from "../../../../../lib/util/api.js";
+import { getMessageRawContent } from "../../../../../lib/mail/mailApi.js";
+import { decodeHeaderText, extractDisplayBody, parseMimeEntity } from "../../../../../lib/crypto/mime.js";
 import { parseRecipientList } from "./recipients.js";
 /** How long a reply waits for the original's body before it goes ahead with the preview - a slow or hung request must not
  * leave the window waiting on it (or, before it opened at once, keep it from opening) indefinitely. */

package/dist/apps/shared/components/mail/compose/recipients.d.ts

@@ -3,7 +3,7 @@
  * semicolons, each either a bare address or `Display Name <address>` (the name optionally quoted, so it can hold a comma
  * or semicolon itself). Separators inside quotes or angle brackets don't split.
  */
-import type { ComposeRecipientInput } from "@rapidmx/react-shared/mail/mailApi.js";
+import type { ComposeRecipientInput } from "../../../../../lib/mail/mailApi.js";
 /** Splits a field's text into trimmed, non-empty recipient strings - see `splitRaw()`. */
 export declare function splitRecipientList(value: string): string[];
 /** Splits text typed into a field: the recipients finished by a separator, and the text after the last separator

package/dist/apps/shared/components/mail/invite/InviteRowChip.d.ts

@@ -1,5 +1,5 @@
 import React from "react";
-import type { Message } from "@rapidmx/react-shared/mail/mailApi.js";
+import type { Message } from "../../../../../lib/mail/mailApi.js";
 export interface InviteRowChipProps {
     message: Message;
     /** Called with the row's message carrying the reader's new answer (`meetingResponse`), after an RSVP, so the list can show it. */

package/dist/apps/shared/components/mail/invite/InviteRsvpPopover.d.ts

@@ -1,5 +1,5 @@
 import React, { RefObject } from "react";
-import { MessageInvite } from "@rapidmx/react-shared/calendar/inviteApi.js";
+import { MessageInvite } from "../../../../../lib/calendar/inviteApi.js";
 export interface InviteRsvpPopoverProps {
     messageUid: string;
     invite: MessageInvite;

package/dist/apps/shared/components/mail/invite/InviteRsvpPopover.js

@@ -5,11 +5,12 @@ import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 ///////////////////////////////////////////////////////////////////////////////
 import { useEffect, useId, useRef, useState } from "react";
 import { HiOutlineCheck, HiOutlineEllipsisHorizontal } from "react-icons/hi2";
-import { proposeNewTime, respondToMessageInvite } from "@rapidmx/react-shared/calendar/inviteApi.js";
-import Button from "@rapidmx/react-shared/components/buttons/Button.js";
-import Modal from "@rapidmx/react-shared/components/overlays/Modal.js";
-import PopoverPortal from "@rapidmx/react-shared/components/overlays/PopoverPortal.js";
-import useIsMobile from "@rapidmx/react-shared/util/useIsMobile.js";
+import { proposeNewTime, respondToMessageInvite } from "../../../../../lib/calendar/inviteApi.js";
+import Button from "../../../../../lib/components/buttons/Button.js";
+import Modal from "../../../../../lib/components/overlays/Modal.js";
+import PopoverPortal from "../../../../../lib/components/overlays/PopoverPortal.js";
+import { useApiClient } from "../../../../../lib/util/apiClientContext.js";
+import useIsMobile from "../../../../../lib/util/useIsMobile.js";
 import { notifyApiError } from "../../../notifications/apiErrors.js";
 import { calendarHref, conflictSummary, formatInviteWhen } from "./inviteFormat.js";
 import InviteTimeline from "./InviteTimeline.js";
@@ -44,6 +45,7 @@ const RESPONSES = [
 /** What is inside the RSVP popover (or dialog): the meeting, a day view around it and the buttons that answer it. */
 function RsvpPanel({ messageUid, invite, onDone, onClose, onProposingChange }) {
     const titleId = useId();
+    const client = useApiClient();
     const [pending, setPending] = useState(null);
     const [proposing, setProposingState] = useState(false);
     const [menuOpen, setMenuOpen] = useState(false);
@@ -63,7 +65,7 @@ function RsvpPanel({ messageUid, invite, onDone, onClose, onProposingChange }) {
     async function answer(response, failure) {
         setPending(response);
         try {
-            onDone(await respondToMessageInvite(messageUid, response));
+            onDone(await respondToMessageInvite(messageUid, response, client));
         }
         catch (err) {
             notifyApiError(err, failure);
@@ -73,7 +75,7 @@ function RsvpPanel({ messageUid, invite, onDone, onClose, onProposingChange }) {
     async function propose(proposal) {
         setPending("propose");
         try {
-            onDone(await proposeNewTime(messageUid, proposal));
+            onDone(await proposeNewTime(messageUid, proposal, client));
         }
         catch (err) {
             notifyApiError(err, "Couldn't send the proposed time");

package/dist/apps/shared/components/mail/invite/InviteTimeline.d.ts

@@ -1,5 +1,5 @@
 import React from "react";
-import type { MessageInvite } from "@rapidmx/react-shared/calendar/inviteApi.js";
+import type { MessageInvite } from "../../../../../lib/calendar/inviteApi.js";
 /** A block of the day and where it sits among the blocks it overlaps. */
 export interface PlacedBlock {
     /** Which of the overlapping columns it is drawn in. */

package/dist/apps/shared/components/mail/invite/ProposeTimeForm.d.ts

@@ -1,5 +1,5 @@
 import React from "react";
-import type { MessageInvite, ProposedTime } from "@rapidmx/react-shared/calendar/inviteApi.js";
+import type { MessageInvite, ProposedTime } from "../../../../../lib/calendar/inviteApi.js";
 export interface ProposeTimeFormProps {
     /** The invitation being answered: its own time (in the reader's zone) is what the fields start out as. */
     invite: Pick<MessageInvite, "startDate" | "endDate">;

package/dist/apps/shared/components/mail/invite/ProposeTimeForm.js

@@ -4,7 +4,7 @@ import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 // SPDX-License-Identifier: MPL-2.0
 ///////////////////////////////////////////////////////////////////////////////
 import { useId, useState } from "react";
-import Button from "@rapidmx/react-shared/components/buttons/Button.js";
+import Button from "../../../../../lib/components/buttons/Button.js";
 import { isoDay, validDate } from "./inviteFormat.js";
 const INPUT_CLASS = "w-full text-sm border border-border rounded-sm py-1.5 px-2 bg-surface text-text";
 /** `HH:MM` of an instant in the reader's zone, the value of a time input. */

package/dist/apps/shared/components/mail/invite/inviteFormat.d.ts

@@ -1,5 +1,5 @@
-import type { Attachment } from "@rapidmx/react-shared/mail/mailApi.js";
-import type { InviteResponse, MessageInvite } from "@rapidmx/react-shared/calendar/inviteApi.js";
+import type { Attachment } from "../../../../../lib/mail/mailApi.js";
+import type { InviteResponse, MessageInvite } from "../../../../../lib/calendar/inviteApi.js";
 /** Whether an attachment is a calendar file - what tells the pane a message may carry an invitation worth asking the server about. By type
  * or by name, since mail clients disagree about which one they set (`text/calendar`, `application/ics`, or a bare `.ics` as octet-stream). */
 export declare function isCalendarAttachment(attachment: Pick<Attachment, "filename" | "mimeType">): boolean;

package/dist/apps/shared/components/mail/invite/inviteStore.d.ts

@@ -1,4 +1,5 @@
-import { MessageInvite } from "@rapidmx/react-shared/calendar/inviteApi.js";
+import { MessageInvite } from "../../../../../lib/calendar/inviteApi.js";
+import { ApiClient } from "../../../../../lib/util/api.js";
 /**
  * A per-message cache of the calendar invitation the server reads out of a message, shared by everything that draws one: the reading pane's
  * card, the list row's RSVP chip and its popover. They ask for the same message a moment apart (the row's chip, then the pane once it is
@@ -10,8 +11,13 @@ import { MessageInvite } from "@rapidmx/react-shared/calendar/inviteApi.js";
  */
 /** How long a looked-up invitation is trusted before the next ask reads it again. */
 export declare const INVITE_TTL_MS = 30000;
-/** Reads a message's invitation, from the cache when it is fresh. Rejects when the lookup fails. */
-export declare function loadInvite(uid: string): Promise<MessageInvite | null>;
+/**
+ * Reads a message's invitation, from the cache when it is fresh. Rejects when the lookup fails. `client` (see
+ * `useApiClient()`) is only consulted for a lookup this call actually makes - a fresh entry already in flight or
+ * cached keeps whichever client (or lack of one) started it, same as every other cache-by-uid shortcut here; the
+ * cache itself is keyed only by `uid`, not by account, so it assumes distinct accounts never share one.
+ */
+export declare function loadInvite(uid: string, client?: ApiClient): Promise<MessageInvite | null>;
 /** Records the invitation as it now stands after an answer, so the pane, the chip and the popover all show it. */
 export declare function storeInvite(uid: string, invite: MessageInvite): void;
 /** Forgets everything - for tests, and for a sign-out. */

package/dist/apps/shared/components/mail/invite/inviteStore.js

@@ -3,7 +3,8 @@
 // SPDX-License-Identifier: MPL-2.0
 ///////////////////////////////////////////////////////////////////////////////
 import { useCallback, useEffect, useReducer } from "react";
-import { getMessageInvite } from "@rapidmx/react-shared/calendar/inviteApi.js";
+import { getMessageInvite } from "../../../../../lib/calendar/inviteApi.js";
+import { useApiClient } from "../../../../../lib/util/apiClientContext.js";
 /**
  * A per-message cache of the calendar invitation the server reads out of a message, shared by everything that draws one: the reading pane's
  * card, the list row's RSVP chip and its popover. They ask for the same message a moment apart (the row's chip, then the pane once it is
@@ -28,15 +29,20 @@ function normalize(invite) {
     const partial = invite;
     return { ...invite, attendees: partial.attendees ?? [], conflicts: partial.conflicts ?? [], schedule: partial.schedule ?? [] };
 }
-/** Reads a message's invitation, from the cache when it is fresh. Rejects when the lookup fails. */
-export function loadInvite(uid) {
+/**
+ * Reads a message's invitation, from the cache when it is fresh. Rejects when the lookup fails. `client` (see
+ * `useApiClient()`) is only consulted for a lookup this call actually makes - a fresh entry already in flight or
+ * cached keeps whichever client (or lack of one) started it, same as every other cache-by-uid shortcut here; the
+ * cache itself is keyed only by `uid`, not by account, so it assumes distinct accounts never share one.
+ */
+export function loadInvite(uid, client) {
     const existing = entries.get(uid);
     if (existing && (existing.value === undefined || Date.now() - existing.at < INVITE_TTL_MS)) {
         return existing.promise;
     }
     const entry = {
         at: Date.now(),
-        promise: getMessageInvite(uid).then((invite) => {
+        promise: getMessageInvite(uid, client).then((invite) => {
             entry.value = normalize(invite);
             entry.at = Date.now();
             notify(uid);
@@ -68,6 +74,7 @@ export function clearInviteCache() {
  */
 export function useMessageInvite(uid, enabled = true) {
     const [, rerender] = useReducer((n) => n + 1, 0);
+    const client = useApiClient();
     useEffect(() => {
         if (!enabled) {
             return;
@@ -81,14 +88,14 @@ export function useMessageInvite(uid, enabled = true) {
         const set = listeners.get(uid) ?? new Set();
         set.add(update);
         listeners.set(uid, set);
-        loadInvite(uid).then(update, () => {
+        loadInvite(uid, client).then(update, () => {
             // Nothing to show, and nothing worth interrupting the reader with: the message reads the same without it.
         });
         return () => {
             cancelled = true;
             set.delete(update);
         };
-    }, [uid, enabled]);
+    }, [uid, enabled, client]);
     const setInvite = useCallback((invite) => storeInvite(uid, invite), [uid]);
     const value = enabled ? entries.get(uid)?.value : undefined;
     return { invite: value ?? null, settled: value !== undefined, setInvite };

package/dist/apps/shared/components/mail/labelMenu.d.ts

@@ -1,5 +1,5 @@
 import React from "react";
-import { Label } from "@rapidmx/react-shared/mail/labelsApi.js";
+import { Label } from "../../../../lib/mail/labelsApi.js";
 import { MenuSectionSpec } from "./MenuButton.js";
 /**
  * The one multi-select label list this app uses everywhere labels are picked: the Filter menu's "Labels"

package/dist/apps/shared/components/mail/labelMenu.js

@@ -5,12 +5,13 @@ import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-run
 ///////////////////////////////////////////////////////////////////////////////
 import { useState } from "react";
 import { HiOutlineTag } from "react-icons/hi2";
-import { ApiRequestError } from "@rapidmx/react-shared/util/api.js";
-import { createLabel } from "@rapidmx/react-shared/mail/labelsApi.js";
-import Alert from "@rapidmx/react-shared/components/feedback/Alert.js";
-import Button from "@rapidmx/react-shared/components/buttons/Button.js";
-import FormField from "@rapidmx/react-shared/components/forms/FormField.js";
-import Modal from "@rapidmx/react-shared/components/overlays/Modal.js";
+import { ApiRequestError } from "../../../../lib/util/api.js";
+import { createLabel } from "../../../../lib/mail/labelsApi.js";
+import { useApiClient } from "../../../../lib/util/apiClientContext.js";
+import Alert from "../../../../lib/components/feedback/Alert.js";
+import Button from "../../../../lib/components/buttons/Button.js";
+import FormField from "../../../../lib/components/forms/FormField.js";
+import Modal from "../../../../lib/components/overlays/Modal.js";
 import MenuButton from "./MenuButton.js";
 /** `a` and `b` hold the same uids, order ignored. */
 function sameUids(a, b) {
@@ -96,6 +97,7 @@ export function labelSections({ labels, state, commit, clear, emptyNote, note, b
  * has no place for a text field. Colour is left to Settings > Labels; this is the quick path from a
  * message, so it only asks for the name. */
 export function NewLabelDialog({ open, onClose, mailboxUid, onCreated }) {
+    const client = useApiClient();
     const [name, setName] = useState("");
     const [saving, setSaving] = useState(false);
     const [error, setError] = useState(null);
@@ -103,7 +105,7 @@ export function NewLabelDialog({ open, onClose, mailboxUid, onCreated }) {
         setSaving(true);
         setError(null);
         try {
-            onCreated(await createLabel({ mailboxUid, name: name.trim() }));
+            onCreated(await createLabel({ mailboxUid, name: name.trim() }, client));
             setName("");
             onClose();
         }

package/dist/apps/shared/components/mail/layout/MailShell.d.ts

@@ -1,5 +1,5 @@
 import React, { PropsWithChildren } from "react";
-import { Folder, Mailbox, Message } from "@rapidmx/react-shared/mail/mailApi.js";
+import { Folder, Mailbox, Message } from "../../../../../lib/mail/mailApi.js";
 import { AppShellProps } from "../../layout/AppShell.js";
 import { LiveUpdates } from "../../../mail/useMailLiveUpdates.js";
 import { MAILBOX_LIST_LIMIT } from "../../../mail/useMailConnection.js";

package/dist/apps/shared/components/mail/layout/MailShell.js

@@ -5,9 +5,9 @@ import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-run
 ///////////////////////////////////////////////////////////////////////////////
 import { createContext, useCallback, useContext, useEffect, useMemo, useState } from "react";
 import { HiOutlineBars3, HiOutlinePencilSquare } from "react-icons/hi2";
-import Drawer from "@rapidmx/react-shared/components/overlays/Drawer.js";
-import Alert from "@rapidmx/react-shared/components/feedback/Alert.js";
-import Skeleton, { SkeletonList } from "@rapidmx/react-shared/components/feedback/Skeleton.js";
+import Drawer from "../../../../../lib/components/overlays/Drawer.js";
+import Alert from "../../../../../lib/components/feedback/Alert.js";
+import Skeleton, { SkeletonList } from "../../../../../lib/components/feedback/Skeleton.js";
 import AppShell from "../../layout/AppShell.js";
 import FloatingActionButton from "../../layout/FloatingActionButton.js";
 import { useLocation, useNavigate } from "../../../navigation/index.js";

package/dist/apps/shared/components/mail/listPreferences.d.ts

@@ -13,8 +13,8 @@
  * contexts) - and every write swallows its own failure, so a blocked store only means the preference
  * doesn't survive a reload.
  */
-import { MessageListFilter, MessageListSort, MessageSortOrder } from "@rapidmx/react-shared/mail/mailApi.js";
-import { ConversationSummary } from "@rapidmx/react-shared/mail/conversationsApi.js";
+import { MessageListFilter, MessageListSort, MessageSortOrder } from "../../../../lib/mail/mailApi.js";
+import { ConversationSummary } from "../../../../lib/mail/conversationsApi.js";
 export interface MailListPreferences {
     sortBy: MessageListSort;
     sortOrder: MessageSortOrder;

package/dist/apps/shared/components/mail/listPreferences.js

@@ -17,7 +17,7 @@
  * contexts) - and every write swallows its own failure, so a blocked store only means the preference
  * doesn't survive a reload.
  */
-import { MAX_MESSAGE_LABEL_FILTER, } from "@rapidmx/react-shared/mail/mailApi.js";
+import { MAX_MESSAGE_LABEL_FILTER, } from "../../../../lib/mail/mailApi.js";
 const STORAGE_KEY_PREFIX = "rapidmx:mail-list-preferences:";
 /** How many labels the list may be narrowed to at once. `@rapidmx/restapi` refuses a longer `?labelUids=`
  * with a 400, so a stored selection is trimmed to the cap rather than sent. */

package/dist/apps/shared/components/mail/pinnedSigners.d.ts

@@ -12,15 +12,22 @@
  * The cache is dropped (`clearPinnedSignerCache()`) whenever a key session locks (subscribed on first use), on sign-out
  * (`AppShell`), and after the reader adds, edits or deletes contacts (the contacts pages) - so a contact removed
  * because its key was revoked doesn't keep vouching for signatures until the TTL runs out.
+ *
+ * **Explicit-client callers get their own cache**, a `WeakMap<ApiClient, Map<...>>` alongside the default
+ * global-path `Map` - the same split `useMailboxUpdateAccess.ts` already uses, for the same reason: two
+ * `tauri-client` accounts must never answer each other's "who does this sender's key belong to" question from
+ * one shared cache keyed only by `mailboxUid` (mailbox uids are not guaranteed unique across accounts/servers).
  */
-import { SignerKeyState } from "@rapidmx/react-shared/contacts/contactsApi.js";
+import { SignerKeyState } from "../../../../lib/contacts/contactsApi.js";
+import type { ApiClient } from "../../../../lib/util/api.js";
 /** How long one mailbox's loaded contact list is reused before it is fetched again. */
 export declare const CONTACTS_CACHE_TTL_MS = 60000;
-/** Forgets every cached contact list - on sign-out, a key-session lock, after the reader changes their contacts, and
- * in tests. */
+/** Forgets every cached contact list for the default global path - on sign-out, a key-session lock, after the
+ * reader changes their contacts, and in tests. Does not clear any explicit-client cache: those are scoped to
+ * their own `ApiClient` and garbage-collected with it, with no shared "the app signed out" moment to clear on. */
 export declare function clearPinnedSignerCache(): void;
 /** The sender `address`'s pinned signing fingerprints from `mailboxUid`'s contacts. Rejects if they can't be loaded. */
-export declare function getPinnedSignerFingerprints(mailboxUid: string, address: string): Promise<string[]>;
+export declare function getPinnedSignerFingerprints(mailboxUid: string, address: string, client?: ApiClient): Promise<string[]>;
 /** A sender's signing-key state (`signerKeyStateFor()`) plus what a key-changed notice needs to show and link. */
 export interface SenderKeyState extends SignerKeyState {
     /** The contact holding the first pinned signing key, else the one holding the conflict, else the first match. */
@@ -30,4 +37,4 @@ export interface SenderKeyState extends SignerKeyState {
 }
 /** The sender `address`'s signing-key state from `mailboxUid`'s (cached) contacts, for a "signing key changed" comparison
  * or to spot a recorded conflict. Reads stored contacts only. Rejects if they can't be loaded. */
-export declare function getSignerKeyState(mailboxUid: string, address: string): Promise<SenderKeyState>;
+export declare function getSignerKeyState(mailboxUid: string, address: string, client?: ApiClient): Promise<SenderKeyState>;

package/dist/apps/shared/components/mail/pinnedSigners.js

@@ -16,16 +16,34 @@
  * The cache is dropped (`clearPinnedSignerCache()`) whenever a key session locks (subscribed on first use), on sign-out
  * (`AppShell`), and after the reader adds, edits or deletes contacts (the contacts pages) - so a contact removed
  * because its key was revoked doesn't keep vouching for signatures until the TTL runs out.
+ *
+ * **Explicit-client callers get their own cache**, a `WeakMap<ApiClient, Map<...>>` alongside the default
+ * global-path `Map` - the same split `useMailboxUpdateAccess.ts` already uses, for the same reason: two
+ * `tauri-client` accounts must never answer each other's "who does this sender's key belong to" question from
+ * one shared cache keyed only by `mailboxUid` (mailbox uids are not guaranteed unique across accounts/servers).
  */
-import { PINNED_FINGERPRINT_MAX_PAGES, PINNED_FINGERPRINT_PAGE_SIZE, listContacts, pinnedSigningFingerprintsFor, signerKeyStateFor, } from "@rapidmx/react-shared/contacts/contactsApi.js";
+import { PINNED_FINGERPRINT_MAX_PAGES, PINNED_FINGERPRINT_PAGE_SIZE, listContacts, pinnedSigningFingerprintsFor, signerKeyStateFor, } from "../../../../lib/contacts/contactsApi.js";
 import { keyPinnedSince } from "../contacts/contactKeys.js";
-import { listFolders } from "@rapidmx/react-shared/mail/mailApi.js";
-import { subscribeKeySession } from "@rapidmx/react-shared/crypto/keySession.js";
+import { listFolders } from "../../../../lib/mail/mailApi.js";
+import { subscribeKeySession } from "../../../../lib/crypto/keySession.js";
 /** How long one mailbox's loaded contact list is reused before it is fetched again. */
 export const CONTACTS_CACHE_TTL_MS = 60000;
 const contactsCache = new Map();
-/** Forgets every cached contact list - on sign-out, a key-session lock, after the reader changes their contacts, and
- * in tests. */
+const contactsCacheByClient = new WeakMap();
+function cacheFor(client) {
+    if (!client) {
+        return contactsCache;
+    }
+    let cache = contactsCacheByClient.get(client);
+    if (!cache) {
+        cache = new Map();
+        contactsCacheByClient.set(client, cache);
+    }
+    return cache;
+}
+/** Forgets every cached contact list for the default global path - on sign-out, a key-session lock, after the
+ * reader changes their contacts, and in tests. Does not clear any explicit-client cache: those are scoped to
+ * their own `ApiClient` and garbage-collected with it, with no shared "the app signed out" moment to clear on. */
 export function clearPinnedSignerCache() {
     contactsCache.clear();
 }
@@ -43,12 +61,12 @@ function subscribeToLocksOnce() {
         }
     });
 }
-async function loadMailboxContacts(mailboxUid) {
-    const folders = await listFolders(mailboxUid);
+async function loadMailboxContacts(mailboxUid, client) {
+    const folders = await listFolders(mailboxUid, client);
     const contacts = [];
     for (const folder of folders.filter((f) => f.type === "contacts")) {
         for (let page = 0; page < PINNED_FINGERPRINT_MAX_PAGES; page++) {
-            const batch = await listContacts(folder.uid, { limit: PINNED_FINGERPRINT_PAGE_SIZE, page });
+            const batch = await listContacts(folder.uid, { limit: PINNED_FINGERPRINT_PAGE_SIZE, page }, client);
             contacts.push(...batch);
             if (batch.length < PINNED_FINGERPRINT_PAGE_SIZE) {
                 break;
@@ -58,15 +76,16 @@ async function loadMailboxContacts(mailboxUid) {
     return contacts;
 }
 /** `mailboxUid`'s contacts, from the cache when fresh. Rejects if they can't be loaded. */
-function cachedMailboxContacts(mailboxUid) {
+function cachedMailboxContacts(mailboxUid, client) {
     subscribeToLocksOnce();
-    let entry = contactsCache.get(mailboxUid);
+    const cache = cacheFor(client);
+    let entry = cache.get(mailboxUid);
     if (!entry || Date.now() - entry.loadedAt > CONTACTS_CACHE_TTL_MS) {
-        const created = { loadedAt: Date.now(), contacts: loadMailboxContacts(mailboxUid) };
-        contactsCache.set(mailboxUid, created);
+        const created = { loadedAt: Date.now(), contacts: loadMailboxContacts(mailboxUid, client) };
+        cache.set(mailboxUid, created);
         created.contacts.catch(() => {
-            if (contactsCache.get(mailboxUid) === created) {
-                contactsCache.delete(mailboxUid);
+            if (cache.get(mailboxUid) === created) {
+                cache.delete(mailboxUid);
             }
         });
         entry = created;
@@ -74,13 +93,13 @@ function cachedMailboxContacts(mailboxUid) {
     return entry.contacts;
 }
 /** The sender `address`'s pinned signing fingerprints from `mailboxUid`'s contacts. Rejects if they can't be loaded. */
-export async function getPinnedSignerFingerprints(mailboxUid, address) {
-    return pinnedSigningFingerprintsFor(await cachedMailboxContacts(mailboxUid), address);
+export async function getPinnedSignerFingerprints(mailboxUid, address, client) {
+    return pinnedSigningFingerprintsFor(await cachedMailboxContacts(mailboxUid, client), address);
 }
 /** The sender `address`'s signing-key state from `mailboxUid`'s (cached) contacts, for a "signing key changed" comparison
  * or to spot a recorded conflict. Reads stored contacts only. Rejects if they can't be loaded. */
-export async function getSignerKeyState(mailboxUid, address) {
-    const contacts = await cachedMailboxContacts(mailboxUid);
+export async function getSignerKeyState(mailboxUid, address, client) {
+    const contacts = await cachedMailboxContacts(mailboxUid, client);
     const state = signerKeyStateFor(contacts, address);
     const wanted = address.trim().toLowerCase();
     const matching = contacts.filter((contact) => contact.emails.some((email) => email.address.trim().toLowerCase() === wanted));

package/dist/apps/shared/components/mail/reading/EncryptedBody.js

@@ -1,7 +1,7 @@
 import { jsx as _jsx, Fragment as _Fragment, jsxs as _jsxs } from "react/jsx-runtime";
 import { HiOutlineExclamationTriangle, HiOutlineLockClosed } from "react-icons/hi2";
-import Alert from "@rapidmx/react-shared/components/feedback/Alert.js";
-import Button from "@rapidmx/react-shared/components/buttons/Button.js";
+import Alert from "../../../../../lib/components/feedback/Alert.js";
+import Button from "../../../../../lib/components/buttons/Button.js";
 import { useResolvedTheme } from "../../../appearance/resolvedTheme.js";
 import { formatColour } from "./color.js";
 import { useThemeSurface } from "./themeSurface.js";

package/dist/apps/shared/components/mail/reading/MessageBody.d.ts

@@ -1,6 +1,6 @@
 import React from "react";
-import type { Attachment } from "@rapidmx/react-shared/mail/mailApi.js";
-import type { MimeAttachment } from "@rapidmx/react-shared/crypto/mime.js";
+import type { Attachment } from "../../../../../lib/mail/mailApi.js";
+import type { MimeAttachment } from "../../../../../lib/crypto/mime.js";
 import { BodyContent } from "./bodyContent.js";
 export interface MessageBodyProps {
     messageUid: string;

package/dist/apps/shared/components/mail/reading/MessageBody.js

@@ -4,10 +4,10 @@ import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 // SPDX-License-Identifier: MPL-2.0
 ///////////////////////////////////////////////////////////////////////////////
 import { useEffect, useMemo, useRef, useState } from "react";
-import { ApiRequestError, apiUrl } from "@rapidmx/react-shared/util/api.js";
-import Alert from "@rapidmx/react-shared/components/feedback/Alert.js";
-import Button from "@rapidmx/react-shared/components/buttons/Button.js";
-import Skeleton from "@rapidmx/react-shared/components/feedback/Skeleton.js";
+import { ApiRequestError, apiUrl } from "../../../../../lib/util/api.js";
+import Alert from "../../../../../lib/components/feedback/Alert.js";
+import Button from "../../../../../lib/components/buttons/Button.js";
+import Skeleton from "../../../../../lib/components/feedback/Skeleton.js";
 import { useResolvedTheme } from "../../../appearance/resolvedTheme.js";
 import { attachmentSource, cachedBodyContent, fetchBodyContent, makeCidResolver } from "./bodyContent.js";
 import { prepareBodyHtml } from "./bodyHtml.js";

package/dist/apps/shared/components/mail/reading/MessageCard.d.ts

@@ -1,5 +1,5 @@
 import React from "react";
-import type { MailAddressLike } from "@rapidmx/react-shared/mail/mailAddress.js";
+import type { MailAddressLike } from "../../../../../lib/mail/mailAddress.js";
 /**
  * The pieces the reading pane is drawn from: a header card that carries the subject, and one card per message. Built from the app's own
  * tokens only (`bg-surface`, `text-text`, `border-border`), so they follow the theme, a branding palette and the Appearance colours; the

package/dist/apps/shared/components/mail/reading/MessageCard.js

@@ -1,6 +1,6 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
-import ContactAvatar from "@rapidmx/react-shared/components/avatar/ContactAvatar.js";
-import Skeleton from "@rapidmx/react-shared/components/feedback/Skeleton.js";
+import ContactAvatar from "../../../../../lib/components/avatar/ContactAvatar.js";
+import Skeleton from "../../../../../lib/components/feedback/Skeleton.js";
 import MailAddress from "../MailAddress.js";
 import { UnreadBar, UnreadLabel } from "../unreadStyle.js";
 /**

package/dist/apps/shared/components/mail/reading/MessageSourceDialog.js

@@ -4,9 +4,9 @@ import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-run
 // SPDX-License-Identifier: MPL-2.0
 ///////////////////////////////////////////////////////////////////////////////
 import { useMemo } from "react";
-import Alert from "@rapidmx/react-shared/components/feedback/Alert.js";
-import CopyButton from "@rapidmx/react-shared/components/buttons/CopyButton.js";
-import Drawer from "@rapidmx/react-shared/components/overlays/Drawer.js";
+import Alert from "../../../../../lib/components/feedback/Alert.js";
+import CopyButton from "../../../../../lib/components/buttons/CopyButton.js";
+import Drawer from "../../../../../lib/components/overlays/Drawer.js";
 import { MAX_SOURCE_DISPLAY_CHARS, headerText, sourceText } from "./messageExport.js";
 const TITLES = { source: "Message source", headers: "Message details" };
 /**

package/dist/apps/shared/components/mail/reading/PendingMessageCard.js

@@ -1,5 +1,5 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
-import Button from "@rapidmx/react-shared/components/buttons/Button.js";
+import Button from "../../../../../lib/components/buttons/Button.js";
 import MailAddress, { RecipientLine } from "../MailAddress.js";
 import MessageBody from "./MessageBody.js";
 import { BODY_FONT_STYLE, CardShell, SenderAvatar } from "./MessageCard.js";

package/dist/apps/shared/components/mail/reading/bodyContent.d.ts

@@ -1,5 +1,5 @@
-import { Attachment } from "@rapidmx/react-shared/mail/mailApi.js";
-import type { MimeAttachment } from "@rapidmx/react-shared/crypto/mime.js";
+import { Attachment } from "../../../../../lib/mail/mailApi.js";
+import type { MimeAttachment } from "../../../../../lib/crypto/mime.js";
 /** What a message's body is: server-sanitized HTML, or plain text (a message with no HTML part, or the server's plain-text fallback). */
 export type BodyContent = {
     kind: "html";

package/dist/apps/shared/components/mail/reading/bodyContent.js

@@ -2,8 +2,8 @@
 // Copyright (C) 2026 Jean-Philippe Steinmetz
 // SPDX-License-Identifier: MPL-2.0
 ///////////////////////////////////////////////////////////////////////////////
-import { ApiRequestError, apiUrl } from "@rapidmx/react-shared/util/api.js";
-import { attachmentContentUrl } from "@rapidmx/react-shared/mail/mailApi.js";
+import { ApiRequestError, apiUrl } from "../../../../../lib/util/api.js";
+import { attachmentContentUrl } from "../../../../../lib/mail/mailApi.js";
 /** How many bodies are remembered for the session - a thread that is expanded, collapsed and expanded again does not ask the server twice. */
 const CACHE_LIMIT = 40;
 /** What the pane asks `/content` for. */

package/dist/apps/shared/components/mail/reading/bodyHtml.js

@@ -2,7 +2,7 @@
 // Copyright (C) 2026 Jean-Philippe Steinmetz
 // SPDX-License-Identifier: MPL-2.0
 ///////////////////////////////////////////////////////////////////////////////
-import { sanitizeMessageBodyHtml } from "@rapidmx/react-shared/mail/messageBodySanitizer.js";
+import { sanitizeMessageBodyHtml } from "../../../../../lib/mail/messageBodySanitizer.js";
 import { parseColour } from "./color.js";
 /**
  * Turning a message's HTML - which is hostile until proven otherwise - into the fragment that goes into its display frame.

package/dist/apps/shared/components/mail/reading/messageExport.js

@@ -2,7 +2,7 @@
 // Copyright (C) 2026 Jean-Philippe Steinmetz
 // SPDX-License-Identifier: MPL-2.0
 ///////////////////////////////////////////////////////////////////////////////
-import { binaryStringToBytes, extractAddresses, parseMimeEntity } from "@rapidmx/react-shared/crypto/mime.js";
+import { binaryStringToBytes, extractAddresses, parseMimeEntity } from "../../../../../lib/crypto/mime.js";
 /**
  * What the reading pane does with a message's raw RFC 5322 source (`getMessageRawContent()`, a binary string): show it, save it as a
  * file, and read the From header out of it. Nothing here interprets the message's content beyond its header block.

package/dist/apps/shared/components/mail/reading/printMessage.d.ts

@@ -1,5 +1,5 @@
-import type { Attachment } from "@rapidmx/react-shared/mail/mailApi.js";
-import type { MimeAttachment } from "@rapidmx/react-shared/crypto/mime.js";
+import type { Attachment } from "../../../../../lib/mail/mailApi.js";
+import type { MimeAttachment } from "../../../../../lib/crypto/mime.js";
 import { BodyContent } from "./bodyContent.js";
 /**
  * Printing one message: a document of its own - the message's header lines, and under them the same sanitized body the reading pane draws -