@rapidmx/web-client 0.21.0 → 0.23.0

package/dist/apps/shared/mail/outbox/sendJob.js

@@ -2,13 +2,13 @@
 // Copyright (C) 2026 Jean-Philippe Steinmetz
 // SPDX-License-Identifier: MPL-2.0
 ///////////////////////////////////////////////////////////////////////////////
-import { ApiRequestError } from "@rapidmx/react-shared/util/api.js";
-import { assembleDraft, assembleDraftRaw, getMailbox, getMessage, queueMessageSend, sendMessage, setMessageRequestReceipt, } from "@rapidmx/react-shared/mail/mailApi.js";
-import { describeSendFailure } from "@rapidmx/react-shared/mail/sendFailure.js";
-import { resolveRecipientEncryption } from "@rapidmx/react-shared/crypto/composeSecurity.js";
-import { getUnlockedKeys } from "@rapidmx/react-shared/crypto/keySession.js";
-import { findActivePublicKey, getEncryptionPolicy, lookupKeys } from "@rapidmx/react-shared/crypto/keyvaultApi.js";
-import { fromBase64 } from "@rapidmx/react-shared/crypto/encoding.js";
+import { ApiRequestError } from "../../../../lib/util/api.js";
+import { assembleDraft, assembleDraftRaw, getMailbox, getMessage, queueMessageSend, sendMessage, setMessageRequestReceipt, } from "../../../../lib/mail/mailApi.js";
+import { describeSendFailure } from "../../../../lib/mail/sendFailure.js";
+import { resolveRecipientEncryption } from "../../../../lib/crypto/composeSecurity.js";
+import { getUnlockedKeys } from "../../../../lib/crypto/keySession.js";
+import { findActivePublicKey, getEncryptionPolicy, lookupKeys } from "../../../../lib/crypto/keyvaultApi.js";
+import { fromBase64 } from "../../../../lib/crypto/encoding.js";
 import { policyCanAutoEncrypt } from "../../components/mail/compose/encryptionRequirement.js";
 import { dismiss, notify } from "../../notifications/store.js";
 import { INLINE_IMAGE_PATTERN, decideSend } from "./sendDecision.js";
@@ -79,16 +79,16 @@ export function sendDecisionInput(request, mailbox, policy, recipients, lookupsC
 }
 const OPEN_POLICY = { encryptSameOrg: "optional", encryptFederated: "optional", encryptExternal: "optional" };
 /** The mailbox and policy this send is missing, loaded now: the sender is not waiting, so a slow answer costs nothing - but it is not waited on for ever. */
-async function completeContext(request) {
+async function completeContext(request, client) {
     let mailbox = request.mailbox;
     let policy = request.policy;
     const keysNow = readSendKeys(request.mailboxUid, request.signEnabled, mailbox);
     const loads = [];
     if (!mailbox) {
-        loads.push(getMailbox(request.mailboxUid).then((loaded) => void (mailbox = loaded)));
+        loads.push(getMailbox(request.mailboxUid, undefined, client).then((loaded) => void (mailbox = loaded)));
     }
     if (!policy && (!mailbox || senderHasEncryptionKey({ mailbox, offeredEncrypt: request.offeredEncrypt }, keysNow.canEncryptSelf))) {
-        loads.push(getEncryptionPolicy().then((loaded) => void (policy = loaded)));
+        loads.push(getEncryptionPolicy(client).then((loaded) => void (policy = loaded)));
     }
     if (loads.length > 0) {
         let timer;
@@ -101,10 +101,10 @@ async function completeContext(request) {
     return { mailbox, policy };
 }
 /** Builds the message's final content into the draft (plain, signed, or signed and encrypted in this browser) and returns the stored message. */
-async function assemble(request, mailbox, mode, statuses, withSignature) {
+async function assemble(request, mailbox, mode, statuses, withSignature, client) {
     const { draft, to, cc, bcc, subject, html } = request;
     if (mode === "plain") {
-        return assembleDraft(draft.uid, { to, cc, bcc, subject, html });
+        return assembleDraft(draft.uid, { to, cc, bcc, subject, html }, client);
     }
     const keys = readSendKeys(request.mailboxUid, request.signEnabled, mailbox);
     const own = mailbox;
@@ -122,31 +122,32 @@ async function assemble(request, mailbox, mode, statuses, withSignature) {
     const signing = withSignature ? { certDer: keys.unlocked.signingCertDer, privateKey: keys.unlocked.signingPrivateKey } : undefined;
     // The S/MIME code (PKI.js and the ASN.1/X.509 libraries, over half a megabyte) is only needed here, to sign or encrypt - a plain message
     // never loads it, and it is kept out of the compose window's own chunk.
-    const { applyBaselineOuterHeaders, assembleOutboundMime, buildEncryptedMessage, buildSignedOnlyMessage } = await import("@rapidmx/react-shared/crypto/smimeMessage.js");
+    const { applyBaselineOuterHeaders, assembleOutboundMime, buildEncryptedMessage, buildSignedOnlyMessage } = await import("../../../../lib/crypto/smimeMessage.js");
     const encrypt = mode === "encrypt";
     const outerHeaders = encrypt ? applyBaselineOuterHeaders(protectedHeaders) : protectedHeaders;
     const mimePart = encrypt
         ? await buildEncryptedMessage(bodyContentType, html, protectedHeaders, outerHeaders, [keys.unlocked.encryptionCertDer, ...statuses.map((status) => fromBase64(status.encryptCert.publicKey))], signing)
         : await buildSignedOnlyMessage(bodyContentType, html, protectedHeaders, signing.certDer, signing.privateKey);
     const rawMime = assembleOutboundMime(outerHeaders, mimePart);
-    return assembleDraftRaw(draft.uid, { to, cc, bcc, subject: outerHeaders.subject, rawMime });
+    return assembleDraftRaw(draft.uid, { to, cc, bcc, subject: outerHeaders.subject, rawMime }, client);
 }
 function failureOf(err, fallback) {
     const failure = describeSendFailure(err, fallback);
     return { message: failure.message, details: failure.lines };
 }
 /** Whether the server already holds `request`'s message as accepted (out of Drafts, or leased) - the answer to "did that request that never returned actually land?". */
-async function alreadyAccepted(request) {
+async function alreadyAccepted(request, client) {
     try {
-        const fresh = await getMessage(request.draft.uid);
+        const fresh = await getMessage(request.draft.uid, client);
         return fresh.folderUid !== request.draft.folderUid || !!fresh.scheduledSendLeaseExpiresAt || !!fresh.scheduledSendRelayedAt;
     }
     catch {
         return false;
     }
 }
-/** The whole client-side path of one send: settle, decide, assemble, hand over. Never rejects. */
-async function attempt(request) {
+/** The whole client-side path of one send: settle, decide, assemble, hand over. Never rejects. `client` is the explicit `ApiClient` (from
+ * `useApiClient()`) the window that built `request` was rendered under, `undefined` for the default global cookie-based session. */
+async function attempt(request, client) {
     try {
         await request.saved?.catch(() => undefined);
         const all = [...request.to, ...request.cc, ...request.bcc];
@@ -155,14 +156,14 @@ async function attempt(request) {
         let statuses = all.map(() => undefined);
         let lookupsComplete = false;
         if (!request.forcePlaintext) {
-            ({ mailbox, policy } = await completeContext(request));
+            ({ mailbox, policy } = await completeContext(request, client));
             const keys = readSendKeys(request.mailboxUid, request.signEnabled, mailbox);
             const hasKey = senderHasEncryptionKey({ mailbox, offeredEncrypt: request.offeredEncrypt }, keys.canEncryptSelf);
             // Recipients' keys are only looked up when the answer can matter: encryption was asked for, or the loaded policy auto-applies.
             if (mailbox && hasKey && (request.encryptRequested || (policy && policyCanAutoEncrypt(policy)))) {
                 const own = mailbox;
                 const ownPrefersMutual = own.encryptPreference?.preferEncrypt === "mutual";
-                const lookups = await Promise.all(all.map((recipient) => lookupKeys(request.mailboxUid, recipient.address).then((lookup) => ({ lookup }), () => null)));
+                const lookups = await Promise.all(all.map((recipient) => lookupKeys(request.mailboxUid, recipient.address, client).then((lookup) => ({ lookup }), () => null)));
                 statuses = all.map((recipient, index) => {
                     const found = lookups[index];
                     return found ? resolveRecipientEncryption(own.primarySmtpAddress, ownPrefersMutual, policy ?? OPEN_POLICY, recipient.address, found.lookup) : undefined;
@@ -177,20 +178,20 @@ async function attempt(request) {
         if (decision.action === "rejected") {
             return { kind: "failed", failure: { message: decision.message, details: [] } };
         }
-        const assembled = await assemble(request, mailbox, decision.action, statuses, decision.action === "sign" || (decision.action === "encrypt" && decision.sign));
-        const withReceipt = request.requestReceipt ? await setMessageRequestReceipt(assembled, true) : assembled;
+        const assembled = await assemble(request, mailbox, decision.action, statuses, decision.action === "sign" || (decision.action === "encrypt" && decision.sign), client);
+        const withReceipt = request.requestReceipt ? await setMessageRequestReceipt(assembled, true, client) : assembled;
         setPendingStage(request.draft.uid, "queuing");
         try {
             if (request.scheduledSendTime) {
-                await sendMessage(withReceipt.uid, { scheduledSendTime: request.scheduledSendTime });
+                await sendMessage(withReceipt.uid, { scheduledSendTime: request.scheduledSendTime }, client);
                 return { kind: "scheduled" };
             }
-            const result = await queueMessageSend(withReceipt.uid);
+            const result = await queueMessageSend(withReceipt.uid, client);
             return { kind: result.queued ? "queued" : "sent" };
         }
         catch (err) {
             // A request that never came back may still have landed: never offer to send it twice if it did.
-            if (!(err instanceof ApiRequestError) && (await alreadyAccepted(request))) {
+            if (!(err instanceof ApiRequestError) && (await alreadyAccepted(request, client))) {
                 return { kind: request.scheduledSendTime ? "scheduled" : "queued" };
             }
             throw err;
@@ -236,7 +237,7 @@ function failureNotificationId(draftUid) {
     return `send-failed:${draftUid}`;
 }
 /** The sticky "This message wasn't sent" pop-up for a send that failed on this side, with what can be done about it. */
-function notifyFailure(request, failure) {
+function notifyFailure(request, failure, client) {
     const uid = request.draft.uid;
     const actions = [];
     const { block } = failure;
@@ -244,15 +245,15 @@ function notifyFailure(request, failure) {
         actions.push({
             label: "Unlock",
             onClick: () => {
-                void requestUnlockFromOutside(request.mailboxUid, request.mailbox.keys).then(() => void retrySend(request), () => undefined);
+                void requestUnlockFromOutside(request.mailboxUid, request.mailbox.keys).then(() => void retrySend(request, client), () => undefined);
             },
         });
     }
     if (block) {
-        actions.push({ label: block.overrideLabel, onClick: () => void retrySend({ ...request, forcePlaintext: true }) });
+        actions.push({ label: block.overrideLabel, onClick: () => void retrySend({ ...request, forcePlaintext: true }, client) });
     }
     else {
-        actions.push({ label: "Retry", onClick: () => void retrySend(request) });
+        actions.push({ label: "Retry", onClick: () => void retrySend(request, client) });
     }
     actions.push({ label: "Open draft", onClick: () => void openDraftFromRequest(request) });
     notify({
@@ -279,8 +280,11 @@ export function notifySent(message = "Message sent") {
  * under way here. The outcome is shown as pop-ups and the Outbox indicator, never as a window that waits: a failure at any stage (assembling,
  * encrypting, the request) is a sticky "This message wasn't sent" with the reason, and Retry / Open draft; the server's own later outcome
  * (`send-succeeded`, `send-failed`, `send-retrying`) is `handleSendEvent()`'s.
+ *
+ * `client` is the explicit `ApiClient` (from `useApiClient()`) the compose window that built `request` was rendered under - `undefined` (the
+ * default) for every existing caller, which keeps using the default global cookie-based session exactly as before.
  */
-export function startSend(request) {
+export function startSend(request, client) {
     const uid = request.draft.uid;
     const recipients = [...request.to, ...request.cc, ...request.bcc].map((recipient) => recipient.address);
     if (!beginPendingSend({ draftUid: uid, mailboxUid: request.mailboxUid, subject: request.subject, recipients, scheduled: !!request.scheduledSendTime })) {
@@ -291,11 +295,11 @@ export function startSend(request) {
     // A reply or forward is on screen in its conversation from this moment, before any of the work below.
     trackOutgoing(request);
     const tracker = sendState.countTracker?.(request.mailboxUid);
-    void attempt(request).then((outcome) => {
+    void attempt(request, client).then((outcome) => {
         finishPendingSend(uid);
         if (outcome.kind === "failed") {
             tracker?.revert();
-            notifyFailure(request, outcome.failure);
+            notifyFailure(request, outcome.failure, client);
             return;
         }
         tracker?.settle();
@@ -321,12 +325,12 @@ export function startSend(request) {
     return true;
 }
 /** Tries a failed send again - unless the server already has the message (an earlier request that seemed to fail did land), which it must not send twice. */
-export async function retrySend(request) {
-    if (await alreadyAccepted(request)) {
+export async function retrySend(request, client) {
+    if (await alreadyAccepted(request, client)) {
         dismiss(failureNotificationId(request.draft.uid));
         markOutgoingSending(request.draft.uid);
         notify({ id: `already-sent:${request.draft.uid}`, kind: "info", title: "This message is already on its way", timeoutMs: 5000 });
         return;
     }
-    startSend({ ...request, saved: undefined });
+    startSend({ ...request, saved: undefined }, client);
 }

package/dist/apps/shared/mail/outbox/sendOutcomes.d.ts

@@ -1,3 +1,6 @@
-import { SendEvent } from "@rapidmx/react-shared/mail/sendEvents.js";
-/** Shows what a send event means to the user. */
-export declare function handleSendEvent(event: SendEvent): void;
+import { SendEvent } from "../../../../lib/mail/sendEvents.js";
+import type { ApiClient } from "../../../../lib/util/api.js";
+/** Shows what a send event means to the user. `client` is the explicit `ApiClient` (from `useApiClient()`) whichever code observed this push
+ * event was rendered under - `undefined` (the default) for every existing caller, which keeps using the default global cookie-based session
+ * exactly as before. */
+export declare function handleSendEvent(event: SendEvent, client?: ApiClient): void;

package/dist/apps/shared/mail/outbox/sendOutcomes.js

@@ -2,8 +2,8 @@
 // Copyright (C) 2026 Jean-Philippe Steinmetz
 // SPDX-License-Identifier: MPL-2.0
 ///////////////////////////////////////////////////////////////////////////////
-import { cancelScheduledSend, getMessage, listAttachments, listFolders, queueMessageSend } from "@rapidmx/react-shared/mail/mailApi.js";
-import { describeSendEventError } from "@rapidmx/react-shared/mail/sendEvents.js";
+import { cancelScheduledSend, getMessage, listAttachments, listFolders, queueMessageSend } from "../../../../lib/mail/mailApi.js";
+import { describeSendEventError } from "../../../../lib/mail/sendEvents.js";
 import { formatRecipient } from "../../components/mail/compose/recipients.js";
 import { loadOriginalMessage } from "../../components/mail/compose/quotedBody.js";
 import { notifyApiError } from "../../notifications/apiErrors.js";
@@ -25,21 +25,21 @@ function summary(recipients) {
     return recipients.length <= 2 ? recipients.join(" and ") : `${recipients[0]} and ${recipients.length - 1} others`;
 }
 /** Moves a message the server failed to relay back into Drafts (the only place it can be edited or sent again), and returns it as it is there. */
-async function moveBackToDrafts(uid, mailboxUid) {
-    const message = await getMessage(uid);
-    const drafts = (await listFolders(mailboxUid)).find((folder) => folder.type === "drafts");
+async function moveBackToDrafts(uid, mailboxUid, client) {
+    const message = await getMessage(uid, client);
+    const drafts = (await listFolders(mailboxUid, client)).find((folder) => folder.type === "drafts");
     if (!drafts || message.folderUid === drafts.uid) {
         return message;
     }
-    return cancelScheduledSend(message, drafts.uid);
+    return cancelScheduledSend(message, drafts.uid, client);
 }
 function escapeHtml(text) {
     return text.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
 }
 /** "Open draft" for a message the server failed to relay: back into Drafts, and into a compose window with what was written. */
-async function openFailedDraft(event) {
+async function openFailedDraft(event, client) {
     try {
-        const moved = await moveBackToDrafts(event.uid, event.mailboxUid ?? "");
+        const moved = await moveBackToDrafts(event.uid, event.mailboxUid ?? "", client);
         // Back in Drafts it is no longer a message on its way in its conversation.
         forgetOutgoing(event.uid);
         const request = retainedRequest(event.uid);
@@ -57,8 +57,10 @@ async function openFailedDraft(event) {
             });
             return;
         }
+        // loadOriginalMessage() (quotedBody.ts) does not yet accept an explicit ApiClient itself - out of scope here (that module is not one of
+        // this task's files); it still falls back to the default global session even under an ApiClientContext.Provider.
         const original = await loadOriginalMessage(moved, null);
-        const attachments = await listAttachments(moved.folderUid, moved.uid).catch(() => []);
+        const attachments = await listAttachments(moved.folderUid, moved.uid, client).catch(() => []);
         const byType = (type) => moved.recipients.filter((recipient) => recipient.type === type).map(formatRecipient).join(", ");
         openComposeFromOutside({
             mailboxUid: moved.mailboxUid,
@@ -82,7 +84,7 @@ async function openFailedDraft(event) {
     }
 }
 /** "Retry" for a message the server failed to relay: the same send call again - a failed message stays in Outbox and the server queues it afresh (with a new retry budget). */
-async function retryFailed(event) {
+async function retryFailed(event, client) {
     if (!beginPendingSend({ draftUid: event.uid, mailboxUid: event.mailboxUid ?? "", subject: event.subject, recipients: event.recipients, scheduled: false })) {
         return;
     }
@@ -90,7 +92,7 @@ async function retryFailed(event) {
     markOutgoingSending(event.uid);
     try {
         setPendingStage(event.uid, "queuing");
-        const result = await queueMessageSend(event.uid);
+        const result = await queueMessageSend(event.uid, client);
         if (!result.queued) {
             notifySent();
         }
@@ -102,8 +104,10 @@ async function retryFailed(event) {
         finishPendingSend(event.uid);
     }
 }
-/** Shows what a send event means to the user. */
-export function handleSendEvent(event) {
+/** Shows what a send event means to the user. `client` is the explicit `ApiClient` (from `useApiClient()`) whichever code observed this push
+ * event was rendered under - `undefined` (the default) for every existing caller, which keeps using the default global cookie-based session
+ * exactly as before. */
+export function handleSendEvent(event, client) {
     if (event.action === "send-succeeded") {
         dismiss(retryId(event.uid));
         dismiss(failedId(event.uid));
@@ -134,8 +138,8 @@ export function handleSendEvent(event) {
     }
     dismiss(retryId(event.uid));
     const actions = [
-        { label: "Retry", onClick: () => void retryFailed(event) },
-        { label: "Open draft", onClick: () => void openFailedDraft(event) },
+        { label: "Retry", onClick: () => void retryFailed(event, client) },
+        { label: "Open draft", onClick: () => void openFailedDraft(event, client) },
     ];
     notify({
         id: failedId(event.uid),

package/dist/apps/shared/mail/outbox/useOutboxStatus.js

@@ -3,7 +3,8 @@
 // SPDX-License-Identifier: MPL-2.0
 ///////////////////////////////////////////////////////////////////////////////
 import { useEffect, useMemo, useState } from "react";
-import { listMessages } from "@rapidmx/react-shared/mail/mailApi.js";
+import { listMessages } from "../../../../lib/mail/mailApi.js";
+import { useApiClient } from "../../../../lib/util/apiClientContext.js";
 import { countOfFolder } from "../folderCounts.js";
 import { summarizeOutbox } from "./outboxState.js";
 /** The most Outbox messages read to say what state they are in; beyond this the pill still shows the folder's own total. */
@@ -14,6 +15,7 @@ export const OUTBOX_STATUS_LIMIT = 50;
  * whenever that count or the live updates change, so an empty Outbox - almost always - is free. A failed read keeps what was known.
  */
 export function useOutboxStatus(mailboxFolders, counts, liveTick, enabled) {
+    const client = useApiClient();
     const [statuses, setStatuses] = useState({});
     const outboxes = useMemo(() => mailboxFolders.flatMap((entry) => entry.folders.filter((folder) => folder.type === "outbox")).map((folder) => ({ uid: folder.uid, total: countOfFolder(folder, counts).total })), [mailboxFolders, counts]);
     const key = outboxes.map((outbox) => `${outbox.uid}:${outbox.total}`).join("|");
@@ -35,7 +37,7 @@ export function useOutboxStatus(mailboxFolders, counts, liveTick, enabled) {
         });
         let cancelled = false;
         for (const outbox of occupied) {
-            listMessages(outbox.uid, { limit: OUTBOX_STATUS_LIMIT }).then((messages) => {
+            listMessages(outbox.uid, { limit: OUTBOX_STATUS_LIMIT }, client).then((messages) => {
                 if (!cancelled) {
                     setStatuses((previous) => ({ ...previous, [outbox.uid]: summarizeOutbox(messages) }));
                 }
@@ -44,6 +46,6 @@ export function useOutboxStatus(mailboxFolders, counts, liveTick, enabled) {
         return () => {
             cancelled = true;
         };
-    }, [enabled, key, liveTick]);
+    }, [enabled, key, liveTick, client]);
     return statuses;
 }

package/dist/apps/shared/mail/permanentDelete.d.ts

@@ -1,4 +1,5 @@
-import { Message } from "@rapidmx/react-shared/mail/mailApi.js";
+import { Message } from "../../../lib/mail/mailApi.js";
+import { ApiClient } from "../../../lib/util/api.js";
 /**
  * Permanent delete: what "Delete" does to a message that is already in Deleted Items (and what "Empty folder" does to Deleted Items and
  * Junk Email). Unlike a move into Deleted Items it cannot be undone, so it is never reached without a confirmation (see
@@ -38,7 +39,7 @@ export declare function messageCount(count: number): string;
  * to delete, a message that is already gone) is recorded against its message and the rest carry on. `deleted` and `failed` keep the order of
  * `messages`.
  */
-export declare function purgeMessages(messages: Message[]): Promise<PurgeOutcome>;
+export declare function purgeMessages(messages: Message[], client?: ApiClient): Promise<PurgeOutcome>;
 /**
  * Permanently deletes everything in `folderUid`: one request for the whole folder, which is all or nothing. The server refuses it as a whole
  * when a message in it is under a legal hold (`409`) or when the caller may delete messages but not empty a folder (`403`, a delegate) - and
@@ -48,7 +49,7 @@ export declare function purgeMessages(messages: Message[]): Promise<PurgeOutcome
 export declare function purgeFolder(folderUid: string, paging?: {
     pageSize: number;
     maxPages: number;
-}): Promise<EmptyFolderOutcome>;
+}, client?: ApiClient): Promise<EmptyFolderOutcome>;
 /**
  * Tells the reader what a delete of several messages came to: "3 messages permanently deleted" (no Undo - there is none), or "2 deleted, 1
  * could not be deleted" with the server's reasons.

package/dist/apps/shared/mail/permanentDelete.js

@@ -2,8 +2,8 @@
 // Copyright (C) 2026 Jean-Philippe Steinmetz
 // SPDX-License-Identifier: MPL-2.0
 ///////////////////////////////////////////////////////////////////////////////
-import { emptyFolder, listMessages, purgeMessage } from "@rapidmx/react-shared/mail/mailApi.js";
-import { ApiRequestError } from "@rapidmx/react-shared/util/api.js";
+import { emptyFolder, listMessages, purgeMessage } from "../../../lib/mail/mailApi.js";
+import { ApiRequestError } from "../../../lib/util/api.js";
 import { displaySubject } from "../components/mail/reading/EncryptedPreview.js";
 import { notifySessionExpired } from "../notifications/apiErrors.js";
 import { notify } from "../notifications/store.js";
@@ -37,14 +37,14 @@ export function messageCount(count) {
  * to delete, a message that is already gone) is recorded against its message and the rest carry on. `deleted` and `failed` keep the order of
  * `messages`.
  */
-export async function purgeMessages(messages) {
+export async function purgeMessages(messages, client) {
     const failures = new Array(messages.length).fill(null);
     let next = 0;
     async function worker() {
         while (next < messages.length) {
             const index = next++;
             try {
-                await purgeMessage(messages[index].uid);
+                await purgeMessage(messages[index].uid, client);
             }
             catch (err) {
                 failures[index] = { message: messages[index], ...describeFailure(err) };
@@ -63,9 +63,9 @@ export async function purgeMessages(messages) {
  * then this lists the folder and deletes message by message instead, so what may go does and each refusal is reported. Any other failure
  * (the server is down) rejects, and the caller says so.
  */
-export async function purgeFolder(folderUid, paging = { pageSize: LIST_PAGE_SIZE, maxPages: MAX_LIST_PAGES }) {
+export async function purgeFolder(folderUid, paging = { pageSize: LIST_PAGE_SIZE, maxPages: MAX_LIST_PAGES }, client) {
     try {
-        await emptyFolder(folderUid);
+        await emptyFolder(folderUid, client);
         return { emptied: true, deleted: [], failed: [] };
     }
     catch (err) {
@@ -73,8 +73,8 @@ export async function purgeFolder(folderUid, paging = { pageSize: LIST_PAGE_SIZE
             throw err;
         }
     }
-    const listed = await listAllPages((page) => listMessages(folderUid, { limit: paging.pageSize, page }), paging.pageSize, paging.maxPages);
-    const outcome = await purgeMessages(listed.items);
+    const listed = await listAllPages((page) => listMessages(folderUid, { limit: paging.pageSize, page }, client), paging.pageSize, paging.maxPages);
+    const outcome = await purgeMessages(listed.items, client);
     return { ...outcome, emptied: outcome.failed.length === 0 && !listed.truncated };
 }
 /** The line for one refusal, in the notification's details. */

package/dist/apps/shared/mail/primaryMailbox.d.ts

@@ -13,7 +13,7 @@
  *
  * `orderMailboxes()` puts the primary mailbox first, then the caller's other mailboxes, then the shared ones, each group alphabetical.
  */
-import { type Mailbox } from "@rapidmx/react-shared/mail/mailApi.js";
+import { type Mailbox } from "../../../lib/mail/mailApi.js";
 /** Whether `mailbox` is the signed-in user's own. */
 export declare function isOwnMailbox(mailbox: Mailbox, userUid: string | undefined): boolean;
 /** Whether `mailbox` is one the caller only has access to (an ownerless one, or somebody else's shared with them). */

package/dist/apps/shared/mail/primaryMailbox.js

@@ -17,7 +17,7 @@
  *
  * `orderMailboxes()` puts the primary mailbox first, then the caller's other mailboxes, then the shared ones, each group alphabetical.
  */
-import { isSharedWithMe } from "@rapidmx/react-shared/mail/mailApi.js";
+import { isSharedWithMe } from "../../../lib/mail/mailApi.js";
 /** Whether `mailbox` is the signed-in user's own. */
 export function isOwnMailbox(mailbox, userUid) {
     return !!userUid && mailbox.ownerUserUid === userUid;

package/dist/apps/shared/mail/reportNotices.d.ts

@@ -1,4 +1,4 @@
-import type { MessageReportKind, MessageReportResult } from "@rapidmx/react-shared/mail/mailApi.js";
+import type { MessageReportKind, MessageReportResult } from "../../../lib/mail/mailApi.js";
 /** Where a notification's "Manage blocked senders" goes: the Blocked and safe senders page of the mailbox. */
 export declare function senderListsHref(mailboxUid: string): string;
 /** The noun of `kind` for a failure's title ("Couldn't report this message as phishing"). */

package/dist/apps/shared/mail/senderBlocking.d.ts

@@ -1,4 +1,5 @@
-import { MailFilterRule } from "@rapidmx/react-shared/mail/mailFilterRulesApi.js";
+import { MailFilterRule } from "../../../lib/mail/mailFilterRulesApi.js";
+import type { ApiClient } from "../../../lib/util/api.js";
 export declare const BLOCK_RULE_PREFIX = "Block ";
 export declare const NEVER_BLOCK_RULE_PREFIX = "Never block ";
 /** `addresses` trimmed, lowercased and without repeats, keeping only what has an `@`. */
@@ -19,8 +20,8 @@ export interface NeverBlockResult {
  * usually has both) goes to `junkFolderUid` from now on. Idempotent: the rule is made once, and a rule that was turned off is turned on.
  * A "Never block" rule for the same sender is taken away, since the two would fight.
  */
-export declare function blockSender(mailboxUid: string, addresses: string[], junkFolderUid: string, inboxFolderUid: string): Promise<BlockResult>;
+export declare function blockSender(mailboxUid: string, addresses: string[], junkFolderUid: string, inboxFolderUid: string, client?: ApiClient): Promise<BlockResult>;
 /** Never blocks a sender: takes away the block rule for `addresses` and makes (once) the rule that keeps their mail in the Inbox. */
-export declare function neverBlockSender(mailboxUid: string, addresses: string[], junkFolderUid: string, inboxFolderUid: string): Promise<NeverBlockResult>;
+export declare function neverBlockSender(mailboxUid: string, addresses: string[], junkFolderUid: string, inboxFolderUid: string, client?: ApiClient): Promise<NeverBlockResult>;
 /** Takes back a rule this module made (the notification's Undo). */
-export declare function removeSenderRule(rule: MailFilterRule): Promise<void>;
+export declare function removeSenderRule(rule: MailFilterRule, client?: ApiClient): Promise<void>;

package/dist/apps/shared/mail/senderBlocking.js

@@ -2,7 +2,7 @@
 // Copyright (C) 2026 Jean-Philippe Steinmetz
 // SPDX-License-Identifier: MPL-2.0
 ///////////////////////////////////////////////////////////////////////////////
-import { createMailFilterRule, deleteMailFilterRule, listMailFilterRules, updateMailFilterRule, } from "@rapidmx/react-shared/mail/mailFilterRulesApi.js";
+import { createMailFilterRule, deleteMailFilterRule, listMailFilterRules, updateMailFilterRule, } from "../../../lib/mail/mailFilterRulesApi.js";
 /**
  * "Block sender" and "Never block sender", expressed as the mailbox's own mail filter rules - the server has no blocked-senders list.
  * A rule's "From contains" is a case-insensitive substring match on the From header (restapi's `matchesConditions()`), which is the
@@ -41,7 +41,7 @@ function firstSequence(rules) {
     return Math.min(0, ...rules.map((rule) => rule.sequence)) - 1;
 }
 /** Finds the rule that does `folderUid` for `addresses`, makes one (named `${prefix}${addresses[0]}`) if there is none, and turns a found one on. */
-async function ensureRule(rules, mailboxUid, addresses, folderUid, prefix) {
+async function ensureRule(rules, mailboxUid, addresses, folderUid, prefix, client) {
     const found = rules.find((rule) => isSenderRule(rule, addresses, folderUid));
     if (found) {
         if (found.enabled) {
@@ -49,7 +49,10 @@ async function ensureRule(rules, mailboxUid, addresses, folderUid, prefix) {
         }
         // The whole rule, as the filters page saves one: the update replaces the record.
         const { uid, version, name, sequence, stopProcessingRules, conditions, actions } = found;
-        return { outcome: "enabled", rule: await updateMailFilterRule({ uid, version, name, enabled: true, sequence, stopProcessingRules, conditions, actions }) };
+        return {
+            outcome: "enabled",
+            rule: await updateMailFilterRule({ uid, version, name, enabled: true, sequence, stopProcessingRules, conditions, actions }, client),
+        };
     }
     const rule = await createMailFilterRule({
         mailboxUid,
@@ -58,14 +61,14 @@ async function ensureRule(rules, mailboxUid, addresses, folderUid, prefix) {
         stopProcessingRules: true,
         conditions: { fromContains: addresses },
         actions: [{ type: "move_to_folder", folderUid }],
-    });
+    }, client);
     return { outcome: "created", rule };
 }
 /** Takes away every rule that is `folderUid` for `addresses`. */
-async function removeRules(rules, addresses, folderUid) {
+async function removeRules(rules, addresses, folderUid, client) {
     const doomed = rules.filter((rule) => isSenderRule(rule, addresses, folderUid));
     for (const rule of doomed) {
-        await deleteMailFilterRule(rule.uid, rule.version);
+        await deleteMailFilterRule(rule.uid, rule.version, client);
     }
     return doomed;
 }
@@ -74,19 +77,19 @@ async function removeRules(rules, addresses, folderUid) {
  * usually has both) goes to `junkFolderUid` from now on. Idempotent: the rule is made once, and a rule that was turned off is turned on.
  * A "Never block" rule for the same sender is taken away, since the two would fight.
  */
-export async function blockSender(mailboxUid, addresses, junkFolderUid, inboxFolderUid) {
-    const rules = await listMailFilterRules(mailboxUid, { limit: RULE_LIMIT });
-    await removeRules(rules, addresses, inboxFolderUid);
-    return ensureRule(rules, mailboxUid, addresses, junkFolderUid, BLOCK_RULE_PREFIX);
+export async function blockSender(mailboxUid, addresses, junkFolderUid, inboxFolderUid, client) {
+    const rules = await listMailFilterRules(mailboxUid, { limit: RULE_LIMIT }, client);
+    await removeRules(rules, addresses, inboxFolderUid, client);
+    return ensureRule(rules, mailboxUid, addresses, junkFolderUid, BLOCK_RULE_PREFIX, client);
 }
 /** Never blocks a sender: takes away the block rule for `addresses` and makes (once) the rule that keeps their mail in the Inbox. */
-export async function neverBlockSender(mailboxUid, addresses, junkFolderUid, inboxFolderUid) {
-    const rules = await listMailFilterRules(mailboxUid, { limit: RULE_LIMIT });
-    const removed = await removeRules(rules, addresses, junkFolderUid);
-    const kept = await ensureRule(rules.filter((rule) => !removed.includes(rule)), mailboxUid, addresses, inboxFolderUid, NEVER_BLOCK_RULE_PREFIX);
+export async function neverBlockSender(mailboxUid, addresses, junkFolderUid, inboxFolderUid, client) {
+    const rules = await listMailFilterRules(mailboxUid, { limit: RULE_LIMIT }, client);
+    const removed = await removeRules(rules, addresses, junkFolderUid, client);
+    const kept = await ensureRule(rules.filter((rule) => !removed.includes(rule)), mailboxUid, addresses, inboxFolderUid, NEVER_BLOCK_RULE_PREFIX, client);
     return { removed, ...kept };
 }
 /** Takes back a rule this module made (the notification's Undo). */
-export function removeSenderRule(rule) {
-    return deleteMailFilterRule(rule.uid, rule.version);
+export function removeSenderRule(rule, client) {
+    return deleteMailFilterRule(rule.uid, rule.version, client);
 }

package/dist/apps/shared/mail/useMailConnection.d.ts

@@ -1,4 +1,4 @@
-import { Folder, Mailbox } from "@rapidmx/react-shared/mail/mailApi.js";
+import { Folder, Mailbox } from "../../../lib/mail/mailApi.js";
 import { FOLDER_ORDER, MAIL_FOLDER_TYPES } from "./folderTree.js";
 import type { MailboxFolders } from "../components/mail/layout/MailShell.js";
 import { LiveUpdates } from "./useMailLiveUpdates.js";