@rapidmx/web-client 0.21.0 → 0.22.0

package/apps/shared/components/mail/pinnedSigners.ts

@@ -16,6 +16,11 @@
  * The cache is dropped (`clearPinnedSignerCache()`) whenever a key session locks (subscribed on first use), on sign-out
  * (`AppShell`), and after the reader adds, edits or deletes contacts (the contacts pages) - so a contact removed
  * because its key was revoked doesn't keep vouching for signatures until the TTL runs out.
+ *
+ * **Explicit-client callers get their own cache**, a `WeakMap<ApiClient, Map<...>>` alongside the default
+ * global-path `Map` - the same split `useMailboxUpdateAccess.ts` already uses, for the same reason: two
+ * `tauri-client` accounts must never answer each other's "who does this sender's key belong to" question from
+ * one shared cache keyed only by `mailboxUid` (mailbox uids are not guaranteed unique across accounts/servers).
  */
 import {
     Contact,
@@ -25,18 +30,38 @@ import {
     listContacts,
     pinnedSigningFingerprintsFor,
     signerKeyStateFor,
-} from "@rapidmx/react-shared/contacts/contactsApi.js";
+} from "../../../../lib/contacts/contactsApi.js";
 import { keyPinnedSince } from "../contacts/contactKeys.js";
-import { listFolders } from "@rapidmx/react-shared/mail/mailApi.js";
-import { subscribeKeySession } from "@rapidmx/react-shared/crypto/keySession.js";
+import { listFolders } from "../../../../lib/mail/mailApi.js";
+import { subscribeKeySession } from "../../../../lib/crypto/keySession.js";
+import type { ApiClient } from "../../../../lib/util/api.js";
 
 /** How long one mailbox's loaded contact list is reused before it is fetched again. */
 export const CONTACTS_CACHE_TTL_MS = 60_000;
 
-const contactsCache = new Map<string, { loadedAt: number; contacts: Promise<Contact[]> }>();
+interface ContactsCacheEntry {
+    loadedAt: number;
+    contacts: Promise<Contact[]>;
+}
+
+const contactsCache = new Map<string, ContactsCacheEntry>();
+const contactsCacheByClient = new WeakMap<ApiClient, Map<string, ContactsCacheEntry>>();
+
+function cacheFor(client: ApiClient | undefined): Map<string, ContactsCacheEntry> {
+    if (!client) {
+        return contactsCache;
+    }
+    let cache = contactsCacheByClient.get(client);
+    if (!cache) {
+        cache = new Map();
+        contactsCacheByClient.set(client, cache);
+    }
+    return cache;
+}
 
-/** Forgets every cached contact list - on sign-out, a key-session lock, after the reader changes their contacts, and
- * in tests. */
+/** Forgets every cached contact list for the default global path - on sign-out, a key-session lock, after the
+ * reader changes their contacts, and in tests. Does not clear any explicit-client cache: those are scoped to
+ * their own `ApiClient` and garbage-collected with it, with no shared "the app signed out" moment to clear on. */
 export function clearPinnedSignerCache(): void {
     contactsCache.clear();
 }
@@ -57,12 +82,12 @@ function subscribeToLocksOnce(): void {
     });
 }
 
-async function loadMailboxContacts(mailboxUid: string): Promise<Contact[]> {
-    const folders = await listFolders(mailboxUid);
+async function loadMailboxContacts(mailboxUid: string, client: ApiClient | undefined): Promise<Contact[]> {
+    const folders = await listFolders(mailboxUid, client);
     const contacts: Contact[] = [];
     for (const folder of folders.filter((f) => f.type === "contacts")) {
         for (let page = 0; page < PINNED_FINGERPRINT_MAX_PAGES; page++) {
-            const batch = await listContacts(folder.uid, { limit: PINNED_FINGERPRINT_PAGE_SIZE, page });
+            const batch = await listContacts(folder.uid, { limit: PINNED_FINGERPRINT_PAGE_SIZE, page }, client);
             contacts.push(...batch);
             if (batch.length < PINNED_FINGERPRINT_PAGE_SIZE) {
                 break;
@@ -73,15 +98,16 @@ async function loadMailboxContacts(mailboxUid: string): Promise<Contact[]> {
 }
 
 /** `mailboxUid`'s contacts, from the cache when fresh. Rejects if they can't be loaded. */
-function cachedMailboxContacts(mailboxUid: string): Promise<Contact[]> {
+function cachedMailboxContacts(mailboxUid: string, client: ApiClient | undefined): Promise<Contact[]> {
     subscribeToLocksOnce();
-    let entry = contactsCache.get(mailboxUid);
+    const cache = cacheFor(client);
+    let entry = cache.get(mailboxUid);
     if (!entry || Date.now() - entry.loadedAt > CONTACTS_CACHE_TTL_MS) {
-        const created = { loadedAt: Date.now(), contacts: loadMailboxContacts(mailboxUid) };
-        contactsCache.set(mailboxUid, created);
+        const created = { loadedAt: Date.now(), contacts: loadMailboxContacts(mailboxUid, client) };
+        cache.set(mailboxUid, created);
         created.contacts.catch(() => {
-            if (contactsCache.get(mailboxUid) === created) {
-                contactsCache.delete(mailboxUid);
+            if (cache.get(mailboxUid) === created) {
+                cache.delete(mailboxUid);
             }
         });
         entry = created;
@@ -90,8 +116,8 @@ function cachedMailboxContacts(mailboxUid: string): Promise<Contact[]> {
 }
 
 /** The sender `address`'s pinned signing fingerprints from `mailboxUid`'s contacts. Rejects if they can't be loaded. */
-export async function getPinnedSignerFingerprints(mailboxUid: string, address: string): Promise<string[]> {
-    return pinnedSigningFingerprintsFor(await cachedMailboxContacts(mailboxUid), address);
+export async function getPinnedSignerFingerprints(mailboxUid: string, address: string, client?: ApiClient): Promise<string[]> {
+    return pinnedSigningFingerprintsFor(await cachedMailboxContacts(mailboxUid, client), address);
 }
 
 /** A sender's signing-key state (`signerKeyStateFor()`) plus what a key-changed notice needs to show and link. */
@@ -104,8 +130,8 @@ export interface SenderKeyState extends SignerKeyState {
 
 /** The sender `address`'s signing-key state from `mailboxUid`'s (cached) contacts, for a "signing key changed" comparison
  * or to spot a recorded conflict. Reads stored contacts only. Rejects if they can't be loaded. */
-export async function getSignerKeyState(mailboxUid: string, address: string): Promise<SenderKeyState> {
-    const contacts = await cachedMailboxContacts(mailboxUid);
+export async function getSignerKeyState(mailboxUid: string, address: string, client?: ApiClient): Promise<SenderKeyState> {
+    const contacts = await cachedMailboxContacts(mailboxUid, client);
     const state = signerKeyStateFor(contacts, address);
     const wanted = address.trim().toLowerCase();
     const matching = contacts.filter((contact) => contact.emails.some((email) => email.address.trim().toLowerCase() === wanted));

package/apps/shared/components/mail/reading/EncryptedBody.tsx

@@ -4,8 +4,8 @@
 ///////////////////////////////////////////////////////////////////////////////
 import React from "react";
 import { HiOutlineExclamationTriangle, HiOutlineLockClosed } from "react-icons/hi2";
-import Alert from "@rapidmx/react-shared/components/feedback/Alert.js";
-import Button from "@rapidmx/react-shared/components/buttons/Button.js";
+import Alert from "../../../../../lib/components/feedback/Alert.js";
+import Button from "../../../../../lib/components/buttons/Button.js";
 import { useResolvedTheme } from "../../../appearance/resolvedTheme.js";
 import { formatColour } from "./color.js";
 import { useThemeSurface } from "./themeSurface.js";

package/apps/shared/components/mail/reading/MessageBody.tsx

@@ -3,12 +3,12 @@
 // SPDX-License-Identifier: MPL-2.0
 ///////////////////////////////////////////////////////////////////////////////
 import React, { useEffect, useMemo, useRef, useState } from "react";
-import { ApiRequestError, apiUrl } from "@rapidmx/react-shared/util/api.js";
-import type { Attachment } from "@rapidmx/react-shared/mail/mailApi.js";
-import type { MimeAttachment } from "@rapidmx/react-shared/crypto/mime.js";
-import Alert from "@rapidmx/react-shared/components/feedback/Alert.js";
-import Button from "@rapidmx/react-shared/components/buttons/Button.js";
-import Skeleton from "@rapidmx/react-shared/components/feedback/Skeleton.js";
+import { ApiRequestError, apiUrl } from "../../../../../lib/util/api.js";
+import type { Attachment } from "../../../../../lib/mail/mailApi.js";
+import type { MimeAttachment } from "../../../../../lib/crypto/mime.js";
+import Alert from "../../../../../lib/components/feedback/Alert.js";
+import Button from "../../../../../lib/components/buttons/Button.js";
+import Skeleton from "../../../../../lib/components/feedback/Skeleton.js";
 import { useResolvedTheme } from "../../../appearance/resolvedTheme.js";
 import { BodyContent, attachmentSource, cachedBodyContent, fetchBodyContent, makeCidResolver } from "./bodyContent.js";
 import { prepareBodyHtml } from "./bodyHtml.js";

package/apps/shared/components/mail/reading/MessageCard.tsx

@@ -3,9 +3,9 @@
 // SPDX-License-Identifier: MPL-2.0
 ///////////////////////////////////////////////////////////////////////////////
 import React from "react";
-import ContactAvatar from "@rapidmx/react-shared/components/avatar/ContactAvatar.js";
-import Skeleton from "@rapidmx/react-shared/components/feedback/Skeleton.js";
-import type { MailAddressLike } from "@rapidmx/react-shared/mail/mailAddress.js";
+import ContactAvatar from "../../../../../lib/components/avatar/ContactAvatar.js";
+import Skeleton from "../../../../../lib/components/feedback/Skeleton.js";
+import type { MailAddressLike } from "../../../../../lib/mail/mailAddress.js";
 import MailAddress from "../MailAddress.js";
 import { UnreadBar, UnreadLabel } from "../unreadStyle.js";
 

package/apps/shared/components/mail/reading/MessageSourceDialog.tsx

@@ -3,9 +3,9 @@
 // SPDX-License-Identifier: MPL-2.0
 ///////////////////////////////////////////////////////////////////////////////
 import React, { useMemo } from "react";
-import Alert from "@rapidmx/react-shared/components/feedback/Alert.js";
-import CopyButton from "@rapidmx/react-shared/components/buttons/CopyButton.js";
-import Drawer from "@rapidmx/react-shared/components/overlays/Drawer.js";
+import Alert from "../../../../../lib/components/feedback/Alert.js";
+import CopyButton from "../../../../../lib/components/buttons/CopyButton.js";
+import Drawer from "../../../../../lib/components/overlays/Drawer.js";
 import { MAX_SOURCE_DISPLAY_CHARS, headerText, sourceText } from "./messageExport.js";
 
 /** What the dialog is showing a message's source for: the whole of it, or only its header lines ("Message details"). */

package/apps/shared/components/mail/reading/PendingMessageCard.tsx

@@ -3,7 +3,7 @@
 // SPDX-License-Identifier: MPL-2.0
 ///////////////////////////////////////////////////////////////////////////////
 import React from "react";
-import Button from "@rapidmx/react-shared/components/buttons/Button.js";
+import Button from "../../../../../lib/components/buttons/Button.js";
 import type { OutgoingReply } from "../../../mail/outbox/outgoingReplies.js";
 import MailAddress, { RecipientLine } from "../MailAddress.js";
 import MessageBody from "./MessageBody.js";

package/apps/shared/components/mail/reading/bodyContent.ts

@@ -2,9 +2,9 @@
 // Copyright (C) 2026 Jean-Philippe Steinmetz
 // SPDX-License-Identifier: MPL-2.0
 ///////////////////////////////////////////////////////////////////////////////
-import { ApiRequestError, apiUrl } from "@rapidmx/react-shared/util/api.js";
-import { Attachment, attachmentContentUrl } from "@rapidmx/react-shared/mail/mailApi.js";
-import type { MimeAttachment } from "@rapidmx/react-shared/crypto/mime.js";
+import { ApiRequestError, apiUrl } from "../../../../../lib/util/api.js";
+import { Attachment, attachmentContentUrl } from "../../../../../lib/mail/mailApi.js";
+import type { MimeAttachment } from "../../../../../lib/crypto/mime.js";
 
 /** What a message's body is: server-sanitized HTML, or plain text (a message with no HTML part, or the server's plain-text fallback). */
 export type BodyContent = { kind: "html"; html: string } | { kind: "text"; text: string };

package/apps/shared/components/mail/reading/bodyHtml.ts

@@ -2,7 +2,7 @@
 // Copyright (C) 2026 Jean-Philippe Steinmetz
 // SPDX-License-Identifier: MPL-2.0
 ///////////////////////////////////////////////////////////////////////////////
-import { sanitizeMessageBodyHtml } from "@rapidmx/react-shared/mail/messageBodySanitizer.js";
+import { sanitizeMessageBodyHtml } from "../../../../../lib/mail/messageBodySanitizer.js";
 import { parseColour } from "./color.js";
 
 /**

package/apps/shared/components/mail/reading/messageExport.ts

@@ -2,7 +2,7 @@
 // Copyright (C) 2026 Jean-Philippe Steinmetz
 // SPDX-License-Identifier: MPL-2.0
 ///////////////////////////////////////////////////////////////////////////////
-import { binaryStringToBytes, extractAddresses, parseMimeEntity } from "@rapidmx/react-shared/crypto/mime.js";
+import { binaryStringToBytes, extractAddresses, parseMimeEntity } from "../../../../../lib/crypto/mime.js";
 
 /**
  * What the reading pane does with a message's raw RFC 5322 source (`getMessageRawContent()`, a binary string): show it, save it as a

package/apps/shared/components/mail/reading/printMessage.ts

@@ -2,8 +2,8 @@
 // Copyright (C) 2026 Jean-Philippe Steinmetz
 // SPDX-License-Identifier: MPL-2.0
 ///////////////////////////////////////////////////////////////////////////////
-import type { Attachment } from "@rapidmx/react-shared/mail/mailApi.js";
-import type { MimeAttachment } from "@rapidmx/react-shared/crypto/mime.js";
+import type { Attachment } from "../../../../../lib/mail/mailApi.js";
+import type { MimeAttachment } from "../../../../../lib/crypto/mime.js";
 import { BodyContent, attachmentSource, makeCidResolver } from "./bodyContent.js";
 import { prepareBodyHtml } from "./bodyHtml.js";
 import { frameCsp } from "./frameDocument.js";

package/apps/shared/components/mail/reading/useMessageActions.ts

@@ -12,7 +12,7 @@ import {
     moveMessage,
     reportMessage,
     setMessageFlagged,
-} from "@rapidmx/react-shared/mail/mailApi.js";
+} from "../../../../../lib/mail/mailApi.js";
 import {
     SenderListsChange,
     addBlockedSender,
@@ -20,8 +20,9 @@ import {
     checkSenderEntry,
     removeBlockedSender,
     removeSafeSender,
-} from "@rapidmx/react-shared/mail/senderListsApi.js";
-import { ApiRequestError } from "@rapidmx/react-shared/util/api.js";
+} from "../../../../../lib/mail/senderListsApi.js";
+import { ApiRequestError } from "../../../../../lib/util/api.js";
+import { useApiClient } from "../../../../../lib/util/apiClientContext.js";
 import type { CountTracker } from "../../../mail/folderCounts.js";
 import { resolveFolderOfType } from "../../../mail/folderOfType.js";
 import { setReadStateMany } from "../../../mail/messageReadState.js";
@@ -100,6 +101,7 @@ function isNotFound(err: unknown): boolean {
 export function useMessageActions(params: MessageActionsParams): MessageActions {
     const { message, newest, remember, folders, inJunk, inDeletedItems, ownAddresses = [], trackMessageChange, onMoved, onChanged, onFolderCreated } = params;
     const [busy, setBusy] = useState(false);
+    const client = useApiClient();
     const permanent = usePermanentDelete();
 
     /** Runs one action with the card's other actions held meanwhile. */
@@ -113,7 +115,7 @@ export function useMessageActions(params: MessageActionsParams): MessageActions
     }
 
     function folderOf(type: Folder["type"], name: string): Promise<string> {
-        return resolveFolderOfType(message.mailboxUid, type, name, folders, onFolderCreated);
+        return resolveFolderOfType(message.mailboxUid, type, name, folders, onFolderCreated, client);
     }
 
     /** The card's part of a message having left its folder for `updated`'s: the folder badges and the local search index. */
@@ -126,7 +128,7 @@ export function useMessageActions(params: MessageActionsParams): MessageActions
     /** Moves the message into its mailbox's folder of `type`, and tells the folder badges and the local search index. */
     async function moveToType(type: Folder["type"], name: string): Promise<Message> {
         const before = newest();
-        const updated = await moveMessage(before, await folderOf(type, name));
+        const updated = await moveMessage(before, await folderOf(type, name), client);
         relocated(before, updated);
         return updated;
     }
@@ -154,7 +156,7 @@ export function useMessageActions(params: MessageActionsParams): MessageActions
                       {
                           label: "Undo",
                           onClick: () => {
-                              removeSafeSender(message.mailboxUid, safeSender).then(
+                              removeSafeSender(message.mailboxUid, safeSender, client).then(
                                   () => notify({ kind: "info", title: `${safeSender} is no longer a safe sender`, message: "This message stays in the Inbox." }),
                                   (err) => notifyApiError(err, "Couldn't undo trusting this sender"),
                               );
@@ -188,7 +190,7 @@ export function useMessageActions(params: MessageActionsParams): MessageActions
         await exclusive(async () => {
             let result: MessageReportResult;
             try {
-                result = await reportMessage(message.uid, kind, { alwaysTrustSender });
+                result = await reportMessage(message.uid, kind, { alwaysTrustSender }, client);
             } catch (err) {
                 if (isNotFound(err)) {
                     await reportByMoving(kind, alwaysTrustSender);
@@ -225,13 +227,18 @@ export function useMessageActions(params: MessageActionsParams): MessageActions
         await exclusive(async () => {
             const before = newest();
             try {
-                await setReadStateMany([before], before.flags.read !== true, {
-                    patch: (updated, previous) => {
-                        remember(updated);
-                        onChanged?.(updated, previous);
+                await setReadStateMany(
+                    [before],
+                    before.flags.read !== true,
+                    {
+                        patch: (updated, previous) => {
+                            remember(updated);
+                            onChanged?.(updated, previous);
+                        },
+                        track: trackMessageChange,
                     },
-                    track: trackMessageChange,
-                });
+                    client,
+                );
             } catch (err) {
                 notifyApiError(err, "Couldn't update the message");
             }
@@ -242,7 +249,7 @@ export function useMessageActions(params: MessageActionsParams): MessageActions
         await exclusive(async () => {
             const before = newest();
             try {
-                const updated = await setMessageFlagged(before, before.flags.flagged !== true);
+                const updated = await setMessageFlagged(before, before.flags.flagged !== true, client);
                 remember(updated);
                 onChanged?.(updated, before);
             } catch (err) {
@@ -289,7 +296,7 @@ export function useMessageActions(params: MessageActionsParams): MessageActions
         let result: Awaited<ReturnType<typeof blockSender>>;
         try {
             const [junkUid, inboxUid] = await Promise.all([folderOf("junk", "Junk Email"), folderOf("inbox", "Inbox")]);
-            result = await blockSender(message.mailboxUid, addresses, junkUid, inboxUid);
+            result = await blockSender(message.mailboxUid, addresses, junkUid, inboxUid, client);
         } catch (err) {
             notifyApiError(err, "Couldn't block this sender");
             return;
@@ -306,7 +313,7 @@ export function useMessageActions(params: MessageActionsParams): MessageActions
                           {
                               label: "Undo",
                               onClick: () => {
-                                  removeSenderRule(result.rule).then(
+                                  removeSenderRule(result.rule, client).then(
                                       () => notify({ kind: "info", title: `Unblocked ${address}`, message: "The block was removed. This message stays where it is." }),
                                       (err) => notifyApiError(err, "Couldn't undo the block"),
                                   );
@@ -331,7 +338,7 @@ export function useMessageActions(params: MessageActionsParams): MessageActions
             }
             let added: SenderListsChange;
             try {
-                added = await addBlockedSender(message.mailboxUid, listed);
+                added = await addBlockedSender(message.mailboxUid, listed, client);
             } catch (err) {
                 if (isNotFound(err)) {
                     await blockWithRules(all, message.from.address);
@@ -351,7 +358,7 @@ export function useMessageActions(params: MessageActionsParams): MessageActions
                               {
                                   label: "Undo",
                                   onClick: () => {
-                                      removeBlockedSender(message.mailboxUid, listed).then(
+                                      removeBlockedSender(message.mailboxUid, listed, client).then(
                                           () => notify({ kind: "info", title: `Unblocked ${listed}`, message: "The block was removed. This message stays where it is." }),
                                           (err) => notifyApiError(err, "Couldn't undo the block"),
                                       );
@@ -370,7 +377,7 @@ export function useMessageActions(params: MessageActionsParams): MessageActions
         let result: Awaited<ReturnType<typeof neverBlockSender>>;
         try {
             const [junkUid, inboxUid] = await Promise.all([folderOf("junk", "Junk Email"), folderOf("inbox", "Inbox")]);
-            result = await neverBlockSender(message.mailboxUid, addresses, junkUid, inboxUid);
+            result = await neverBlockSender(message.mailboxUid, addresses, junkUid, inboxUid, client);
         } catch (err) {
             notifyApiError(err, "Couldn't stop blocking this sender");
             return;
@@ -392,7 +399,7 @@ export function useMessageActions(params: MessageActionsParams): MessageActions
             }
             let added: SenderListsChange;
             try {
-                added = await addSafeSender(message.mailboxUid, listed);
+                added = await addSafeSender(message.mailboxUid, listed, client);
             } catch (err) {
                 if (isNotFound(err)) {
                     await neverBlockWithRules(all, message.from.address);
@@ -413,7 +420,7 @@ export function useMessageActions(params: MessageActionsParams): MessageActions
                               {
                                   label: "Undo",
                                   onClick: () => {
-                                      removeSafeSender(message.mailboxUid, listed).then(
+                                      removeSafeSender(message.mailboxUid, listed, client).then(
                                           () => notify({ kind: "info", title: `${listed} is no longer a safe sender`, message: "Its mail is filtered as usual again." }),
                                           (err) => notifyApiError(err, "Couldn't undo the change"),
                                       );

package/apps/shared/components/mail/unreadStyle.tsx

@@ -3,7 +3,7 @@
 // SPDX-License-Identifier: MPL-2.0
 ///////////////////////////////////////////////////////////////////////////////
 import React from "react";
-import type { Message } from "@rapidmx/react-shared/mail/mailApi.js";
+import type { Message } from "../../../../lib/mail/mailApi.js";
 
 /**
  * How an unread message looks in every list of mail (the message list, the conversation list and its child rows, the

package/apps/shared/components/mail/verificationSeals.ts

@@ -18,11 +18,11 @@
  * evaluation try again, never a retry loop. A stored seal is remembered (`currentVerificationSeal()`) so a message
  * reopened before its list copy is refreshed opens that seal instead of building another.
  */
-import { ApiRequestError } from "@rapidmx/react-shared/util/api.js";
-import { getKeyVault } from "@rapidmx/react-shared/crypto/keyvaultApi.js";
-import { subscribeKeySession } from "@rapidmx/react-shared/crypto/keySession.js";
-import { type Message, setMessageVerificationSeal } from "@rapidmx/react-shared/mail/mailApi.js";
-import type { SealToWrite } from "@rapidmx/react-shared/crypto/messageSecurity.js";
+import { ApiClient, ApiRequestError } from "../../../../lib/util/api.js";
+import { getKeyVault } from "../../../../lib/crypto/keyvaultApi.js";
+import { subscribeKeySession } from "../../../../lib/crypto/keySession.js";
+import { type Message, setMessageVerificationSeal } from "../../../../lib/mail/mailApi.js";
+import type { SealToWrite } from "../../../../lib/crypto/messageSecurity.js";
 
 /** How long one mailbox's vault generation is reused before it is read again. */
 export const VAULT_GENERATION_TTL_MS = 60_000;
@@ -59,23 +59,27 @@ function subscribeToLocksOnce(): void {
 
 /** Reads `mailboxUid`'s current vault `masterKeyGeneration`, uncached: `undefined` when the vault can't be read or
  * reports none. Never rejects. */
-export async function readVaultGeneration(mailboxUid: string): Promise<number | undefined> {
+export async function readVaultGeneration(mailboxUid: string, client?: ApiClient): Promise<number | undefined> {
     try {
-        const { masterKeyGeneration } = await getKeyVault(mailboxUid);
+        const { masterKeyGeneration } = await getKeyVault(mailboxUid, client);
         return Number.isSafeInteger(masterKeyGeneration) && masterKeyGeneration! >= 0 ? masterKeyGeneration : undefined;
     } catch {
         return undefined;
     }
 }
 
-/** `mailboxUid`'s current vault `masterKeyGeneration`, or `undefined` when it can't be read. Never rejects. */
-export function getVaultGeneration(mailboxUid: string): Promise<number | undefined> {
+/** `mailboxUid`'s current vault `masterKeyGeneration`, or `undefined` when it can't be read. Never rejects.
+ *
+ * The cache below is keyed by `mailboxUid` alone, not by `client` - fine for every caller today (a
+ * `mailboxUid` belongs to one account's own `ApiClient`), but worth knowing if a future caller ever reused
+ * the same `mailboxUid` string across two different `ApiClient`s. */
+export function getVaultGeneration(mailboxUid: string, client?: ApiClient): Promise<number | undefined> {
     subscribeToLocksOnce();
     const entry = generationCache.get(mailboxUid);
     if (entry && Date.now() - entry.loadedAt <= VAULT_GENERATION_TTL_MS) {
         return entry.generation;
     }
-    const created = { loadedAt: Date.now(), generation: readVaultGeneration(mailboxUid) };
+    const created = { loadedAt: Date.now(), generation: readVaultGeneration(mailboxUid, client) };
     generationCache.set(mailboxUid, created);
     void created.generation.then((generation) => {
         // Only a readable generation is reused; an unavailable one is read again next time.
@@ -106,14 +110,14 @@ export function verificationSealPending(messageUid: string, generation: number):
 
 /** Stores `sealToWrite` on `messageUid`, best effort - see this module's doc comment. Resolves `true` when a request was
  * sent, `false` when the write was skipped as already attempted. Never rejects. */
-export async function sendVerificationSeal(messageUid: string, sealToWrite: SealToWrite): Promise<boolean> {
+export async function sendVerificationSeal(messageUid: string, sealToWrite: SealToWrite, client?: ApiClient): Promise<boolean> {
     const key = `${messageUid}:${sealToWrite.masterKeyGeneration}`;
     if (attemptedWrites.has(key)) {
         return false;
     }
     attemptedWrites.add(key);
     try {
-        await setMessageVerificationSeal(messageUid, sealToWrite.seal, sealToWrite.masterKeyGeneration);
+        await setMessageVerificationSeal(messageUid, sealToWrite.seal, sealToWrite.masterKeyGeneration, client);
         storedSeals.set(messageUid, sealToWrite);
     } catch (err) {
         // `VerificationSealConflictError` is an `ApiRequestError` with status 409.

package/apps/shared/components/mail/writableMailboxes.ts

@@ -18,8 +18,10 @@
  * answer arrives.
  */
 import { useEffect, useMemo, useState } from "react";
-import type { Mailbox } from "@rapidmx/react-shared/mail/mailApi.js";
-import { getMyMailboxAccess } from "@rapidmx/react-shared/mail/mailboxAccessApi.js";
+import type { Mailbox } from "../../../../lib/mail/mailApi.js";
+import { getMyMailboxAccess } from "../../../../lib/mail/mailboxAccessApi.js";
+import type { ApiClient } from "../../../../lib/util/api.js";
+import { useApiClient } from "../../../../lib/util/apiClientContext.js";
 
 /** `true` writable, `false` known view-only, `undefined` couldn't tell (treated as writable). */
 export type MailboxWritability = boolean | undefined;
@@ -42,15 +44,19 @@ export function peekMailboxWritability(mailbox: Mailbox, userUid: string | undef
     return isImplicitlyWritable(mailbox, userUid, trusted) ? true : settled.get(mailbox.uid);
 }
 
-/** Whether the caller can create items in `mailbox`. Never rejects. */
-export function getMailboxWritability(mailbox: Mailbox, userUid: string | undefined, trusted?: boolean): Promise<MailboxWritability> {
+/** Whether the caller can create items in `mailbox`. Never rejects.
+ *
+ * `inFlight`/`settled` are keyed by `mailbox.uid` alone, not by `client` - fine for every caller today (a
+ * mailbox uid belongs to one account's own `ApiClient`), but worth knowing if a future caller ever reused
+ * the same mailbox uid across two different `ApiClient`s. */
+export function getMailboxWritability(mailbox: Mailbox, userUid: string | undefined, trusted?: boolean, client?: ApiClient): Promise<MailboxWritability> {
     const known = peekMailboxWritability(mailbox, userUid, trusted);
     if (known !== undefined) {
         return Promise.resolve(known);
     }
     let request = inFlight.get(mailbox.uid);
     if (!request) {
-        request = getMyMailboxAccess(mailbox.uid).then(
+        request = getMyMailboxAccess(mailbox.uid, client).then(
             (access) => {
                 settled.set(mailbox.uid, access.canCreate);
                 inFlight.delete(mailbox.uid);
@@ -70,11 +76,12 @@ export function getMailboxWritability(mailbox: Mailbox, userUid: string | undefi
 /** Per-mailbox writability answers for `mailboxes`, filled in as each one arrives (already-known answers are
  * present from the first render). */
 export function useMailboxWritability(mailboxes: Mailbox[], userUid: string | undefined, trusted?: boolean): Record<string, MailboxWritability> {
+    const client = useApiClient();
     const [answers, setAnswers] = useState<Record<string, MailboxWritability>>({});
     useEffect(() => {
         let cancelled = false;
         for (const mailbox of mailboxes) {
-            void getMailboxWritability(mailbox, userUid, trusted).then((writable) => {
+            void getMailboxWritability(mailbox, userUid, trusted, client).then((writable) => {
                 if (!cancelled) {
                     setAnswers((prev) => ({ ...prev, [mailbox.uid]: writable }));
                 }
@@ -83,7 +90,7 @@ export function useMailboxWritability(mailboxes: Mailbox[], userUid: string | un
         return () => {
             cancelled = true;
         };
-    }, [mailboxes, userUid, trusted]);
+    }, [mailboxes, userUid, trusted, client]);
     return useMemo(() => {
         const merged: Record<string, MailboxWritability> = {};
         for (const mailbox of mailboxes) {

package/apps/shared/components/rules/RuleBuilder.tsx

@@ -3,7 +3,7 @@
 // SPDX-License-Identifier: MPL-2.0
 ///////////////////////////////////////////////////////////////////////////////
 import React, { ReactNode, useState } from "react";
-import Button from "@rapidmx/react-shared/components/buttons/Button.js";
+import Button from "../../../../lib/components/buttons/Button.js";
 
 const INPUT_CLASS =
     "flex-1 text-sm py-2 px-3 border border-border rounded-sm bg-surface text-text focus:outline-none focus:border-primary";

package/apps/shared/components/settings/SigningCertificateCard.tsx

@@ -4,10 +4,10 @@
 ///////////////////////////////////////////////////////////////////////////////
 import React from "react";
 import { HiOutlineCheckCircle, HiOutlineExclamationTriangle, HiOutlineXCircle } from "react-icons/hi2";
-import Alert from "@rapidmx/react-shared/components/feedback/Alert.js";
-import Button from "@rapidmx/react-shared/components/buttons/Button.js";
-import CopyButton from "@rapidmx/react-shared/components/buttons/CopyButton.js";
-import type { EnrollmentResult, SignEnrollmentStep } from "@rapidmx/react-shared/crypto/keyvaultApi.js";
+import Alert from "../../../../lib/components/feedback/Alert.js";
+import Button from "../../../../lib/components/buttons/Button.js";
+import CopyButton from "../../../../lib/components/buttons/CopyButton.js";
+import type { EnrollmentResult, SignEnrollmentStep } from "../../../../lib/crypto/keyvaultApi.js";
 import type { EnrollmentSnapshot } from "../../signing/enrollmentTracker.js";
 import type { SigningEnrollmentInfo } from "../../signing/signingInfo.js";
 import {

package/apps/shared/components/settings/layout/SettingsShell.tsx

@@ -4,11 +4,12 @@
 ///////////////////////////////////////////////////////////////////////////////
 import React, { createContext, PropsWithChildren, ReactNode, useContext, useEffect, useMemo, useState } from "react";
 import { HiOutlineBars3 } from "react-icons/hi2";
-import { ApiRequestError } from "@rapidmx/react-shared/util/api.js";
-import Drawer from "@rapidmx/react-shared/components/overlays/Drawer.js";
-import { Mailbox, listMailboxes } from "@rapidmx/react-shared/mail/mailApi.js";
-import Alert from "@rapidmx/react-shared/components/feedback/Alert.js";
-import Skeleton, { SkeletonList } from "@rapidmx/react-shared/components/feedback/Skeleton.js";
+import { ApiRequestError } from "../../../../../lib/util/api.js";
+import Drawer from "../../../../../lib/components/overlays/Drawer.js";
+import { Mailbox, listMailboxes } from "../../../../../lib/mail/mailApi.js";
+import { useApiClient } from "../../../../../lib/util/apiClientContext.js";
+import Alert from "../../../../../lib/components/feedback/Alert.js";
+import Skeleton, { SkeletonList } from "../../../../../lib/components/feedback/Skeleton.js";
 import AppShell, { AppShellProps } from "../../layout/AppShell.js";
 import { useLocation, useNavigate } from "../../../navigation/index.js";
 import MailboxProvisioning from "../../layout/MailboxProvisioning.js";
@@ -93,6 +94,7 @@ export default function SettingsShell({
     pluginNav,
     children,
 }: PropsWithChildren<SettingsShellProps>) {
+    const client = useApiClient();
     const [status, setStatus] = useState<Status>("checking");
     const [error, setError] = useState<string | null>(null);
     const [mailboxes, setMailboxes] = useState<Mailbox[]>([]);
@@ -116,7 +118,7 @@ export default function SettingsShell({
         if (!userUid) {
             return;
         }
-        listMailboxes({ limit: 100 })
+        listMailboxes({ limit: 100 }, client)
             .then((result) => {
                 setMailboxes(orderMailboxes(result, userUid));
                 setStatus("ready");

package/apps/shared/components/sharing/PrincipalListField.tsx

@@ -3,7 +3,7 @@
 // SPDX-License-Identifier: MPL-2.0
 ///////////////////////////////////////////////////////////////////////////////
 import React from "react";
-import { ResolvedPrincipal } from "@rapidmx/react-shared/mail/mailboxAccessApi.js";
+import { ResolvedPrincipal } from "../../../../lib/mail/mailboxAccessApi.js";
 import PrincipalResolver, { describePerson } from "./PrincipalResolver.js";
 
 export interface PrincipalListFieldProps {

package/apps/shared/components/sharing/PrincipalPicker.tsx

@@ -8,7 +8,7 @@ import {
     ResolvedPrincipal,
     resolveMailboxPrincipal,
     setMailboxAccess,
-} from "@rapidmx/react-shared/mail/mailboxAccessApi.js";
+} from "../../../../lib/mail/mailboxAccessApi.js";
 import PrincipalResolver, { describePerson } from "./PrincipalResolver.js";
 
 export { describePerson };