@rapidmx/web-client 0.21.0 → 0.23.0

package/apps/shared/components/mail/compose/GifPicker.tsx

@@ -3,9 +3,9 @@
 // SPDX-License-Identifier: MPL-2.0
 ///////////////////////////////////////////////////////////////////////////////
 import React, { RefObject, useEffect, useState } from "react";
-import { ApiRequestError } from "@rapidmx/react-shared/util/api.js";
-import { GiphyGif, searchGifs } from "@rapidmx/react-shared/mail/compose/giphyApi.js";
-import PopoverPortal from "@rapidmx/react-shared/components/overlays/PopoverPortal.js";
+import { ApiRequestError } from "../../../../../lib/util/api.js";
+import { GiphyGif, searchGifs } from "../../../../../lib/mail/compose/giphyApi.js";
+import PopoverPortal from "../../../../../lib/components/overlays/PopoverPortal.js";
 
 export interface GifPickerProps {
     anchorRef: RefObject<HTMLElement | null>;

package/apps/shared/components/mail/compose/RecipientInput.tsx

@@ -11,7 +11,7 @@ import {
     type ContactSuggestionOptions,
     type RecipientSuggestion,
     type RecipientSuggestionKind,
-} from "@rapidmx/react-shared/mail/directoryApi.js";
+} from "../../../../../lib/mail/directoryApi.js";
 import { formatRecipient, isValidRecipientAddress, parseRecipient, splitRecipientList, splitTypedRecipients } from "./recipients.js";
 
 /** How long typing must pause before suggestions are requested. */

package/apps/shared/components/mail/compose/ScheduleSendPicker.tsx

@@ -3,7 +3,7 @@
 // SPDX-License-Identifier: MPL-2.0
 ///////////////////////////////////////////////////////////////////////////////
 import React, { FormEvent, RefObject, useState } from "react";
-import PopoverPortal from "@rapidmx/react-shared/components/overlays/PopoverPortal.js";
+import PopoverPortal from "../../../../../lib/components/overlays/PopoverPortal.js";
 
 export interface ScheduleSendPickerProps {
     anchorRef: RefObject<HTMLElement | null>;

package/apps/shared/components/mail/compose/encryptionRequirement.ts

@@ -2,8 +2,8 @@
 // Copyright (C) 2026 Jean-Philippe Steinmetz
 // SPDX-License-Identifier: MPL-2.0
 ///////////////////////////////////////////////////////////////////////////////
-import { RecipientEncryptionStatus, decideMessageEncryption } from "@rapidmx/react-shared/crypto/composeSecurity.js";
-import type { EncryptionPolicy } from "@rapidmx/react-shared/crypto/keyvaultApi.js";
+import { RecipientEncryptionStatus, decideMessageEncryption } from "../../../../../lib/crypto/composeSecurity.js";
+import type { EncryptionPolicy } from "../../../../../lib/crypto/keyvaultApi.js";
 
 /**
  * Whether a message must be treated as encrypted - the one place that decides it, as a pure function of what is *known*.

package/apps/shared/components/mail/compose/quotedBody.ts

@@ -2,11 +2,11 @@
 // Copyright (C) 2026 Jean-Philippe Steinmetz
 // SPDX-License-Identifier: MPL-2.0
 ///////////////////////////////////////////////////////////////////////////////
-import { apiUrl } from "@rapidmx/react-shared/util/api.js";
-import { Message, Recipient, getMessageRawContent } from "@rapidmx/react-shared/mail/mailApi.js";
-import type { QuotedBody } from "@rapidmx/react-shared/mail/compose/composeQuoting.js";
-import type { MessageSecurityResult } from "@rapidmx/react-shared/crypto/messageSecurity.js";
-import { decodeHeaderText, extractDisplayBody, parseMimeEntity } from "@rapidmx/react-shared/crypto/mime.js";
+import { apiUrl } from "../../../../../lib/util/api.js";
+import { Message, Recipient, getMessageRawContent } from "../../../../../lib/mail/mailApi.js";
+import type { QuotedBody } from "../../../../../lib/mail/compose/composeQuoting.js";
+import type { MessageSecurityResult } from "../../../../../lib/crypto/messageSecurity.js";
+import { decodeHeaderText, extractDisplayBody, parseMimeEntity } from "../../../../../lib/crypto/mime.js";
 import { parseRecipientList } from "./recipients.js";
 
 /** What a Reply/Reply All/Forward needs from the message being answered, beyond what its `Message` record holds. */

package/apps/shared/components/mail/compose/recipients.ts

@@ -7,7 +7,7 @@
  * semicolons, each either a bare address or `Display Name <address>` (the name optionally quoted, so it can hold a comma
  * or semicolon itself). Separators inside quotes or angle brackets don't split.
  */
-import type { ComposeRecipientInput } from "@rapidmx/react-shared/mail/mailApi.js";
+import type { ComposeRecipientInput } from "../../../../../lib/mail/mailApi.js";
 
 /** One plain address: something, one `@`, something - no whitespace, brackets, quotes or separators. */
 const ADDRESS_PATTERN = /^[^\s@<>()",;]+@[^\s@<>()",;]+$/;

package/apps/shared/components/mail/invite/InviteRowChip.tsx

@@ -4,9 +4,9 @@
 ///////////////////////////////////////////////////////////////////////////////
 import React, { useRef, useState } from "react";
 import { HiOutlineCalendarDays } from "react-icons/hi2";
-import type { Message } from "@rapidmx/react-shared/mail/mailApi.js";
-import type { MessageInvite } from "@rapidmx/react-shared/calendar/inviteApi.js";
-import { ANSWER_LABEL, formatRowStart } from "./inviteFormat.js";
+import type { Message } from "../../../../../lib/mail/mailApi.js";
+import type { MessageInvite } from "../../../../../lib/calendar/inviteApi.js";
+import { formatRowStart } from "./inviteFormat.js";
 import { useMessageInvite } from "./inviteStore.js";
 import InviteRsvpPopover from "./InviteRsvpPopover.js";
 
@@ -25,8 +25,8 @@ export function showsInviteChip(message: Pick<Message, "meetingMethod" | "encryp
 
 /**
  * The line a meeting request gets in a list of mail, under its preview, as Outlook draws it: a calendar icon, when the meeting starts (in the reader's
- * zone), under that whether it conflicts with the reader's calendar - or, once answered, the answer - and an RSVP button that opens the day view with
- * Accept, Decline and Tentative (`InviteRsvpPopover`).
+ * zone), under that whether it conflicts with the reader's calendar, and an RSVP button that opens the day view with
+ * Accept, Decline and Maybe (`InviteRsvpPopover`). Once the meeting has been answered - from here or anywhere else - the chip is gone.
  *
  * The invitation is looked up (once, through the shared cache) only for a row that `showsInviteChip()` - the rest of the list is never asked about. Until
  * it arrives, or when the lookup fails, the chip says only "Meeting request", with no button.
@@ -39,11 +39,12 @@ export default function InviteRowChip({ message, onResponded, className = "mx-4"
     const { invite, setInvite } = useMessageInvite(message.uid, eligible);
     const [open, setOpen] = useState(false);
     const rsvpRef = useRef<HTMLButtonElement>(null);
-    if (!eligible) {
+    const answer = invite?.response ?? message.meetingResponse;
+    // Once the reader has answered, the row has nothing left to ask: the chip goes away (the answer stays on the message itself, and can be changed there).
+    if (!eligible || answer) {
         return null;
     }
 
-    const answer = invite?.response ?? message.meetingResponse;
     const conflicts = invite?.conflicts.length ?? 0;
     const start = invite ? formatRowStart(invite) : undefined;
 
@@ -67,13 +68,8 @@ export default function InviteRowChip({ message, onResponded, className = "mx-4"
             <div className="min-w-0 flex-1">
                 <div className="truncate text-text">{start ?? "Meeting request"}</div>
                 {invite && (
-                    <div
-                        className={[
-                            "truncate",
-                            answer === "accepted" ? "text-success" : answer === "declined" ? "text-danger" : conflicts > 0 ? "text-danger" : "text-text-muted",
-                        ].join(" ")}
-                    >
-                        {answer ? ANSWER_LABEL[answer] : conflicts > 0 ? `Conflicts with ${conflicts} ${conflicts === 1 ? "event" : "events"}` : "No conflicts"}
+                    <div className={["truncate", conflicts > 0 ? "text-danger" : "text-text-muted"].join(" ")}>
+                        {conflicts > 0 ? `Conflicts with ${conflicts} ${conflicts === 1 ? "event" : "events"}` : "No conflicts"}
                     </div>
                 )}
             </div>

package/apps/shared/components/mail/invite/InviteRsvpPopover.tsx

@@ -4,11 +4,12 @@
 ///////////////////////////////////////////////////////////////////////////////
 import React, { RefObject, useEffect, useId, useRef, useState } from "react";
 import { HiOutlineCheck, HiOutlineEllipsisHorizontal } from "react-icons/hi2";
-import { InviteResponse, MessageInvite, ProposedTime, proposeNewTime, respondToMessageInvite } from "@rapidmx/react-shared/calendar/inviteApi.js";
-import Button from "@rapidmx/react-shared/components/buttons/Button.js";
-import Modal from "@rapidmx/react-shared/components/overlays/Modal.js";
-import PopoverPortal from "@rapidmx/react-shared/components/overlays/PopoverPortal.js";
-import useIsMobile from "@rapidmx/react-shared/util/useIsMobile.js";
+import { InviteResponse, MessageInvite, ProposedTime, proposeNewTime, respondToMessageInvite } from "../../../../../lib/calendar/inviteApi.js";
+import Button from "../../../../../lib/components/buttons/Button.js";
+import Modal from "../../../../../lib/components/overlays/Modal.js";
+import PopoverPortal from "../../../../../lib/components/overlays/PopoverPortal.js";
+import { useApiClient } from "../../../../../lib/util/apiClientContext.js";
+import useIsMobile from "../../../../../lib/util/useIsMobile.js";
 import { notifyApiError } from "../../../notifications/apiErrors.js";
 import { calendarHref, conflictSummary, formatInviteWhen } from "./inviteFormat.js";
 import InviteTimeline from "./InviteTimeline.js";
@@ -41,7 +42,7 @@ function estimateHeight(invite: MessageInvite, proposing: boolean): number {
 const RESPONSES: { response: InviteResponse; label: string; text: string; failure: string }[] = [
     { response: "accepted", label: "Accept", text: "Accept", failure: "Couldn't accept this meeting" },
     { response: "declined", label: "Decline", text: "Decline", failure: "Couldn't decline this meeting" },
-    { response: "tentative", label: "Tentative", text: "?", failure: "Couldn't respond tentatively to this meeting" },
+    { response: "tentative", label: "Tentative", text: "Maybe", failure: "Couldn't respond tentatively to this meeting" },
 ];
 
 interface RsvpPanelProps {
@@ -58,6 +59,7 @@ interface RsvpPanelProps {
 /** What is inside the RSVP popover (or dialog): the meeting, a day view around it and the buttons that answer it. */
 function RsvpPanel({ messageUid, invite, onDone, onClose, onProposingChange }: RsvpPanelProps) {
     const titleId = useId();
+    const client = useApiClient();
     const [pending, setPending] = useState<InviteResponse | "propose" | null>(null);
     const [proposing, setProposingState] = useState(false);
     const [menuOpen, setMenuOpen] = useState(false);
@@ -80,7 +82,7 @@ function RsvpPanel({ messageUid, invite, onDone, onClose, onProposingChange }: R
     async function answer(response: InviteResponse, failure: string) {
         setPending(response);
         try {
-            onDone(await respondToMessageInvite(messageUid, response));
+            onDone(await respondToMessageInvite(messageUid, response, client));
         } catch (err) {
             notifyApiError(err, failure);
             setPending(null);
@@ -90,7 +92,7 @@ function RsvpPanel({ messageUid, invite, onDone, onClose, onProposingChange }: R
     async function propose(proposal: ProposedTime) {
         setPending("propose");
         try {
-            onDone(await proposeNewTime(messageUid, proposal));
+            onDone(await proposeNewTime(messageUid, proposal, client));
         } catch (err) {
             notifyApiError(err, "Couldn't send the proposed time");
             setPending(null);
@@ -234,7 +236,7 @@ export interface InviteRsvpPopoverProps {
 
 /**
  * What the RSVP button opens: an anchored popover on a desktop, a dialog on a phone. A day view of the reader's schedule around the meeting, with
- * the invitation highlighted and its conflicts marked, and Accept, Decline, a "?" for Tentative and a "..." menu (Propose new time, Open in calendar).
+ * the invitation highlighted and its conflicts marked, and Accept, Decline, a "Maybe" for Tentative and a "..." menu (Propose new time, Open in calendar).
  * An answer is sent to the server, which puts the meeting on the calendar and replies to the organizer; the popover then closes and hands the
  * updated invitation to its caller. A failure raises a pop-up and leaves the popover open.
  *

package/apps/shared/components/mail/invite/InviteTimeline.tsx

@@ -3,7 +3,7 @@
 // SPDX-License-Identifier: MPL-2.0
 ///////////////////////////////////////////////////////////////////////////////
 import React from "react";
-import type { InviteScheduleEntry, MessageInvite } from "@rapidmx/react-shared/calendar/inviteApi.js";
+import type { InviteScheduleEntry, MessageInvite } from "../../../../../lib/calendar/inviteApi.js";
 import { validDate } from "./inviteFormat.js";
 
 /** How tall one hour is drawn, in px. */

package/apps/shared/components/mail/invite/ProposeTimeForm.tsx

@@ -3,8 +3,8 @@
 // SPDX-License-Identifier: MPL-2.0
 ///////////////////////////////////////////////////////////////////////////////
 import React, { useId, useState } from "react";
-import type { MessageInvite, ProposedTime } from "@rapidmx/react-shared/calendar/inviteApi.js";
-import Button from "@rapidmx/react-shared/components/buttons/Button.js";
+import type { MessageInvite, ProposedTime } from "../../../../../lib/calendar/inviteApi.js";
+import Button from "../../../../../lib/components/buttons/Button.js";
 import { isoDay, validDate } from "./inviteFormat.js";
 
 const INPUT_CLASS = "w-full text-sm border border-border rounded-sm py-1.5 px-2 bg-surface text-text";

package/apps/shared/components/mail/invite/inviteFormat.ts

@@ -2,8 +2,8 @@
 // Copyright (C) 2026 Jean-Philippe Steinmetz
 // SPDX-License-Identifier: MPL-2.0
 ///////////////////////////////////////////////////////////////////////////////
-import type { Attachment } from "@rapidmx/react-shared/mail/mailApi.js";
-import type { InviteResponse, MessageInvite } from "@rapidmx/react-shared/calendar/inviteApi.js";
+import type { Attachment } from "../../../../../lib/mail/mailApi.js";
+import type { InviteResponse, MessageInvite } from "../../../../../lib/calendar/inviteApi.js";
 import { APP_HREFS } from "../../../navigation/appHrefs.js";
 
 /** Whether an attachment is a calendar file - what tells the pane a message may carry an invitation worth asking the server about. By type

package/apps/shared/components/mail/invite/inviteStore.ts

@@ -3,7 +3,9 @@
 // SPDX-License-Identifier: MPL-2.0
 ///////////////////////////////////////////////////////////////////////////////
 import { useCallback, useEffect, useReducer } from "react";
-import { MessageInvite, getMessageInvite } from "@rapidmx/react-shared/calendar/inviteApi.js";
+import { MessageInvite, getMessageInvite } from "../../../../../lib/calendar/inviteApi.js";
+import { ApiClient } from "../../../../../lib/util/api.js";
+import { useApiClient } from "../../../../../lib/util/apiClientContext.js";
 
 /**
  * A per-message cache of the calendar invitation the server reads out of a message, shared by everything that draws one: the reading pane's
@@ -41,15 +43,20 @@ function normalize(invite: MessageInvite | null): MessageInvite | null {
     return { ...invite, attendees: partial.attendees ?? [], conflicts: partial.conflicts ?? [], schedule: partial.schedule ?? [] };
 }
 
-/** Reads a message's invitation, from the cache when it is fresh. Rejects when the lookup fails. */
-export function loadInvite(uid: string): Promise<MessageInvite | null> {
+/**
+ * Reads a message's invitation, from the cache when it is fresh. Rejects when the lookup fails. `client` (see
+ * `useApiClient()`) is only consulted for a lookup this call actually makes - a fresh entry already in flight or
+ * cached keeps whichever client (or lack of one) started it, same as every other cache-by-uid shortcut here; the
+ * cache itself is keyed only by `uid`, not by account, so it assumes distinct accounts never share one.
+ */
+export function loadInvite(uid: string, client?: ApiClient): Promise<MessageInvite | null> {
     const existing = entries.get(uid);
     if (existing && (existing.value === undefined || Date.now() - existing.at < INVITE_TTL_MS)) {
         return existing.promise;
     }
     const entry: Entry = {
         at: Date.now(),
-        promise: getMessageInvite(uid).then(
+        promise: getMessageInvite(uid, client).then(
             (invite) => {
                 entry.value = normalize(invite);
                 entry.at = Date.now();
@@ -87,6 +94,7 @@ export function clearInviteCache(): void {
  */
 export function useMessageInvite(uid: string, enabled = true): { invite: MessageInvite | null; settled: boolean; setInvite: (invite: MessageInvite) => void } {
     const [, rerender] = useReducer((n: number) => n + 1, 0);
+    const client = useApiClient();
     useEffect(() => {
         if (!enabled) {
             return;
@@ -100,14 +108,14 @@ export function useMessageInvite(uid: string, enabled = true): { invite: Message
         const set = listeners.get(uid) ?? new Set();
         set.add(update);
         listeners.set(uid, set);
-        loadInvite(uid).then(update, () => {
+        loadInvite(uid, client).then(update, () => {
             // Nothing to show, and nothing worth interrupting the reader with: the message reads the same without it.
         });
         return () => {
             cancelled = true;
             set.delete(update);
         };
-    }, [uid, enabled]);
+    }, [uid, enabled, client]);
     const setInvite = useCallback((invite: MessageInvite) => storeInvite(uid, invite), [uid]);
     const value = enabled ? entries.get(uid)?.value : undefined;
     return { invite: value ?? null, settled: value !== undefined, setInvite };

package/apps/shared/components/mail/labelMenu.tsx

@@ -4,12 +4,13 @@
 ///////////////////////////////////////////////////////////////////////////////
 import React, { useState } from "react";
 import { HiOutlineTag } from "react-icons/hi2";
-import { ApiRequestError } from "@rapidmx/react-shared/util/api.js";
-import { Label, createLabel } from "@rapidmx/react-shared/mail/labelsApi.js";
-import Alert from "@rapidmx/react-shared/components/feedback/Alert.js";
-import Button from "@rapidmx/react-shared/components/buttons/Button.js";
-import FormField from "@rapidmx/react-shared/components/forms/FormField.js";
-import Modal from "@rapidmx/react-shared/components/overlays/Modal.js";
+import { ApiRequestError } from "../../../../lib/util/api.js";
+import { Label, createLabel } from "../../../../lib/mail/labelsApi.js";
+import { useApiClient } from "../../../../lib/util/apiClientContext.js";
+import Alert from "../../../../lib/components/feedback/Alert.js";
+import Button from "../../../../lib/components/buttons/Button.js";
+import FormField from "../../../../lib/components/forms/FormField.js";
+import Modal from "../../../../lib/components/overlays/Modal.js";
 import MenuButton, { MenuSectionSpec } from "./MenuButton.js";
 
 /**
@@ -159,6 +160,7 @@ export interface NewLabelDialogProps {
  * has no place for a text field. Colour is left to Settings > Labels; this is the quick path from a
  * message, so it only asks for the name. */
 export function NewLabelDialog({ open, onClose, mailboxUid, onCreated }: NewLabelDialogProps) {
+    const client = useApiClient();
     const [name, setName] = useState("");
     const [saving, setSaving] = useState(false);
     const [error, setError] = useState<string | null>(null);
@@ -167,7 +169,7 @@ export function NewLabelDialog({ open, onClose, mailboxUid, onCreated }: NewLabe
         setSaving(true);
         setError(null);
         try {
-            onCreated(await createLabel({ mailboxUid, name: name.trim() }));
+            onCreated(await createLabel({ mailboxUid, name: name.trim() }, client));
             setName("");
             onClose();
         } catch (err) {

package/apps/shared/components/mail/layout/MailShell.tsx

@@ -4,10 +4,10 @@
 ///////////////////////////////////////////////////////////////////////////////
 import React, { createContext, PropsWithChildren, ReactNode, useCallback, useContext, useEffect, useMemo, useState } from "react";
 import { HiOutlineBars3, HiOutlinePencilSquare } from "react-icons/hi2";
-import Drawer from "@rapidmx/react-shared/components/overlays/Drawer.js";
-import { Folder, Mailbox, Message } from "@rapidmx/react-shared/mail/mailApi.js";
-import Alert from "@rapidmx/react-shared/components/feedback/Alert.js";
-import Skeleton, { SkeletonList } from "@rapidmx/react-shared/components/feedback/Skeleton.js";
+import Drawer from "../../../../../lib/components/overlays/Drawer.js";
+import { Folder, Mailbox, Message } from "../../../../../lib/mail/mailApi.js";
+import Alert from "../../../../../lib/components/feedback/Alert.js";
+import Skeleton, { SkeletonList } from "../../../../../lib/components/feedback/Skeleton.js";
 import AppShell, { AppShellProps } from "../../layout/AppShell.js";
 import FloatingActionButton from "../../layout/FloatingActionButton.js";
 import { useLocation, useNavigate } from "../../../navigation/index.js";

package/apps/shared/components/mail/listPreferences.ts

@@ -22,8 +22,8 @@ import {
     MessageListFilter,
     MessageListSort,
     MessageSortOrder,
-} from "@rapidmx/react-shared/mail/mailApi.js";
-import { ConversationSummary } from "@rapidmx/react-shared/mail/conversationsApi.js";
+} from "../../../../lib/mail/mailApi.js";
+import { ConversationSummary } from "../../../../lib/mail/conversationsApi.js";
 
 const STORAGE_KEY_PREFIX = "rapidmx:mail-list-preferences:";
 

package/apps/shared/components/mail/pinnedSigners.ts

@@ -16,6 +16,11 @@
  * The cache is dropped (`clearPinnedSignerCache()`) whenever a key session locks (subscribed on first use), on sign-out
  * (`AppShell`), and after the reader adds, edits or deletes contacts (the contacts pages) - so a contact removed
  * because its key was revoked doesn't keep vouching for signatures until the TTL runs out.
+ *
+ * **Explicit-client callers get their own cache**, a `WeakMap<ApiClient, Map<...>>` alongside the default
+ * global-path `Map` - the same split `useMailboxUpdateAccess.ts` already uses, for the same reason: two
+ * `tauri-client` accounts must never answer each other's "who does this sender's key belong to" question from
+ * one shared cache keyed only by `mailboxUid` (mailbox uids are not guaranteed unique across accounts/servers).
  */
 import {
     Contact,
@@ -25,18 +30,38 @@ import {
     listContacts,
     pinnedSigningFingerprintsFor,
     signerKeyStateFor,
-} from "@rapidmx/react-shared/contacts/contactsApi.js";
+} from "../../../../lib/contacts/contactsApi.js";
 import { keyPinnedSince } from "../contacts/contactKeys.js";
-import { listFolders } from "@rapidmx/react-shared/mail/mailApi.js";
-import { subscribeKeySession } from "@rapidmx/react-shared/crypto/keySession.js";
+import { listFolders } from "../../../../lib/mail/mailApi.js";
+import { subscribeKeySession } from "../../../../lib/crypto/keySession.js";
+import type { ApiClient } from "../../../../lib/util/api.js";
 
 /** How long one mailbox's loaded contact list is reused before it is fetched again. */
 export const CONTACTS_CACHE_TTL_MS = 60_000;
 
-const contactsCache = new Map<string, { loadedAt: number; contacts: Promise<Contact[]> }>();
+interface ContactsCacheEntry {
+    loadedAt: number;
+    contacts: Promise<Contact[]>;
+}
+
+const contactsCache = new Map<string, ContactsCacheEntry>();
+const contactsCacheByClient = new WeakMap<ApiClient, Map<string, ContactsCacheEntry>>();
+
+function cacheFor(client: ApiClient | undefined): Map<string, ContactsCacheEntry> {
+    if (!client) {
+        return contactsCache;
+    }
+    let cache = contactsCacheByClient.get(client);
+    if (!cache) {
+        cache = new Map();
+        contactsCacheByClient.set(client, cache);
+    }
+    return cache;
+}
 
-/** Forgets every cached contact list - on sign-out, a key-session lock, after the reader changes their contacts, and
- * in tests. */
+/** Forgets every cached contact list for the default global path - on sign-out, a key-session lock, after the
+ * reader changes their contacts, and in tests. Does not clear any explicit-client cache: those are scoped to
+ * their own `ApiClient` and garbage-collected with it, with no shared "the app signed out" moment to clear on. */
 export function clearPinnedSignerCache(): void {
     contactsCache.clear();
 }
@@ -57,12 +82,12 @@ function subscribeToLocksOnce(): void {
     });
 }
 
-async function loadMailboxContacts(mailboxUid: string): Promise<Contact[]> {
-    const folders = await listFolders(mailboxUid);
+async function loadMailboxContacts(mailboxUid: string, client: ApiClient | undefined): Promise<Contact[]> {
+    const folders = await listFolders(mailboxUid, client);
     const contacts: Contact[] = [];
     for (const folder of folders.filter((f) => f.type === "contacts")) {
         for (let page = 0; page < PINNED_FINGERPRINT_MAX_PAGES; page++) {
-            const batch = await listContacts(folder.uid, { limit: PINNED_FINGERPRINT_PAGE_SIZE, page });
+            const batch = await listContacts(folder.uid, { limit: PINNED_FINGERPRINT_PAGE_SIZE, page }, client);
             contacts.push(...batch);
             if (batch.length < PINNED_FINGERPRINT_PAGE_SIZE) {
                 break;
@@ -73,15 +98,16 @@ async function loadMailboxContacts(mailboxUid: string): Promise<Contact[]> {
 }
 
 /** `mailboxUid`'s contacts, from the cache when fresh. Rejects if they can't be loaded. */
-function cachedMailboxContacts(mailboxUid: string): Promise<Contact[]> {
+function cachedMailboxContacts(mailboxUid: string, client: ApiClient | undefined): Promise<Contact[]> {
     subscribeToLocksOnce();
-    let entry = contactsCache.get(mailboxUid);
+    const cache = cacheFor(client);
+    let entry = cache.get(mailboxUid);
     if (!entry || Date.now() - entry.loadedAt > CONTACTS_CACHE_TTL_MS) {
-        const created = { loadedAt: Date.now(), contacts: loadMailboxContacts(mailboxUid) };
-        contactsCache.set(mailboxUid, created);
+        const created = { loadedAt: Date.now(), contacts: loadMailboxContacts(mailboxUid, client) };
+        cache.set(mailboxUid, created);
         created.contacts.catch(() => {
-            if (contactsCache.get(mailboxUid) === created) {
-                contactsCache.delete(mailboxUid);
+            if (cache.get(mailboxUid) === created) {
+                cache.delete(mailboxUid);
             }
         });
         entry = created;
@@ -90,8 +116,8 @@ function cachedMailboxContacts(mailboxUid: string): Promise<Contact[]> {
 }
 
 /** The sender `address`'s pinned signing fingerprints from `mailboxUid`'s contacts. Rejects if they can't be loaded. */
-export async function getPinnedSignerFingerprints(mailboxUid: string, address: string): Promise<string[]> {
-    return pinnedSigningFingerprintsFor(await cachedMailboxContacts(mailboxUid), address);
+export async function getPinnedSignerFingerprints(mailboxUid: string, address: string, client?: ApiClient): Promise<string[]> {
+    return pinnedSigningFingerprintsFor(await cachedMailboxContacts(mailboxUid, client), address);
 }
 
 /** A sender's signing-key state (`signerKeyStateFor()`) plus what a key-changed notice needs to show and link. */
@@ -104,8 +130,8 @@ export interface SenderKeyState extends SignerKeyState {
 
 /** The sender `address`'s signing-key state from `mailboxUid`'s (cached) contacts, for a "signing key changed" comparison
  * or to spot a recorded conflict. Reads stored contacts only. Rejects if they can't be loaded. */
-export async function getSignerKeyState(mailboxUid: string, address: string): Promise<SenderKeyState> {
-    const contacts = await cachedMailboxContacts(mailboxUid);
+export async function getSignerKeyState(mailboxUid: string, address: string, client?: ApiClient): Promise<SenderKeyState> {
+    const contacts = await cachedMailboxContacts(mailboxUid, client);
     const state = signerKeyStateFor(contacts, address);
     const wanted = address.trim().toLowerCase();
     const matching = contacts.filter((contact) => contact.emails.some((email) => email.address.trim().toLowerCase() === wanted));

package/apps/shared/components/mail/reading/EncryptedBody.tsx

@@ -4,8 +4,8 @@
 ///////////////////////////////////////////////////////////////////////////////
 import React from "react";
 import { HiOutlineExclamationTriangle, HiOutlineLockClosed } from "react-icons/hi2";
-import Alert from "@rapidmx/react-shared/components/feedback/Alert.js";
-import Button from "@rapidmx/react-shared/components/buttons/Button.js";
+import Alert from "../../../../../lib/components/feedback/Alert.js";
+import Button from "../../../../../lib/components/buttons/Button.js";
 import { useResolvedTheme } from "../../../appearance/resolvedTheme.js";
 import { formatColour } from "./color.js";
 import { useThemeSurface } from "./themeSurface.js";

package/apps/shared/components/mail/reading/MessageBody.tsx

@@ -3,12 +3,12 @@
 // SPDX-License-Identifier: MPL-2.0
 ///////////////////////////////////////////////////////////////////////////////
 import React, { useEffect, useMemo, useRef, useState } from "react";
-import { ApiRequestError, apiUrl } from "@rapidmx/react-shared/util/api.js";
-import type { Attachment } from "@rapidmx/react-shared/mail/mailApi.js";
-import type { MimeAttachment } from "@rapidmx/react-shared/crypto/mime.js";
-import Alert from "@rapidmx/react-shared/components/feedback/Alert.js";
-import Button from "@rapidmx/react-shared/components/buttons/Button.js";
-import Skeleton from "@rapidmx/react-shared/components/feedback/Skeleton.js";
+import { ApiRequestError, apiUrl } from "../../../../../lib/util/api.js";
+import type { Attachment } from "../../../../../lib/mail/mailApi.js";
+import type { MimeAttachment } from "../../../../../lib/crypto/mime.js";
+import Alert from "../../../../../lib/components/feedback/Alert.js";
+import Button from "../../../../../lib/components/buttons/Button.js";
+import Skeleton from "../../../../../lib/components/feedback/Skeleton.js";
 import { useResolvedTheme } from "../../../appearance/resolvedTheme.js";
 import { BodyContent, attachmentSource, cachedBodyContent, fetchBodyContent, makeCidResolver } from "./bodyContent.js";
 import { prepareBodyHtml } from "./bodyHtml.js";

package/apps/shared/components/mail/reading/MessageCard.tsx

@@ -3,9 +3,9 @@
 // SPDX-License-Identifier: MPL-2.0
 ///////////////////////////////////////////////////////////////////////////////
 import React from "react";
-import ContactAvatar from "@rapidmx/react-shared/components/avatar/ContactAvatar.js";
-import Skeleton from "@rapidmx/react-shared/components/feedback/Skeleton.js";
-import type { MailAddressLike } from "@rapidmx/react-shared/mail/mailAddress.js";
+import ContactAvatar from "../../../../../lib/components/avatar/ContactAvatar.js";
+import Skeleton from "../../../../../lib/components/feedback/Skeleton.js";
+import type { MailAddressLike } from "../../../../../lib/mail/mailAddress.js";
 import MailAddress from "../MailAddress.js";
 import { UnreadBar, UnreadLabel } from "../unreadStyle.js";
 

package/apps/shared/components/mail/reading/MessageSourceDialog.tsx

@@ -3,9 +3,9 @@
 // SPDX-License-Identifier: MPL-2.0
 ///////////////////////////////////////////////////////////////////////////////
 import React, { useMemo } from "react";
-import Alert from "@rapidmx/react-shared/components/feedback/Alert.js";
-import CopyButton from "@rapidmx/react-shared/components/buttons/CopyButton.js";
-import Drawer from "@rapidmx/react-shared/components/overlays/Drawer.js";
+import Alert from "../../../../../lib/components/feedback/Alert.js";
+import CopyButton from "../../../../../lib/components/buttons/CopyButton.js";
+import Drawer from "../../../../../lib/components/overlays/Drawer.js";
 import { MAX_SOURCE_DISPLAY_CHARS, headerText, sourceText } from "./messageExport.js";
 
 /** What the dialog is showing a message's source for: the whole of it, or only its header lines ("Message details"). */

package/apps/shared/components/mail/reading/PendingMessageCard.tsx

@@ -3,7 +3,7 @@
 // SPDX-License-Identifier: MPL-2.0
 ///////////////////////////////////////////////////////////////////////////////
 import React from "react";
-import Button from "@rapidmx/react-shared/components/buttons/Button.js";
+import Button from "../../../../../lib/components/buttons/Button.js";
 import type { OutgoingReply } from "../../../mail/outbox/outgoingReplies.js";
 import MailAddress, { RecipientLine } from "../MailAddress.js";
 import MessageBody from "./MessageBody.js";

package/apps/shared/components/mail/reading/bodyContent.ts

@@ -2,9 +2,9 @@
 // Copyright (C) 2026 Jean-Philippe Steinmetz
 // SPDX-License-Identifier: MPL-2.0
 ///////////////////////////////////////////////////////////////////////////////
-import { ApiRequestError, apiUrl } from "@rapidmx/react-shared/util/api.js";
-import { Attachment, attachmentContentUrl } from "@rapidmx/react-shared/mail/mailApi.js";
-import type { MimeAttachment } from "@rapidmx/react-shared/crypto/mime.js";
+import { ApiRequestError, apiUrl } from "../../../../../lib/util/api.js";
+import { Attachment, attachmentContentUrl } from "../../../../../lib/mail/mailApi.js";
+import type { MimeAttachment } from "../../../../../lib/crypto/mime.js";
 
 /** What a message's body is: server-sanitized HTML, or plain text (a message with no HTML part, or the server's plain-text fallback). */
 export type BodyContent = { kind: "html"; html: string } | { kind: "text"; text: string };

package/apps/shared/components/mail/reading/bodyHtml.ts

@@ -2,7 +2,7 @@
 // Copyright (C) 2026 Jean-Philippe Steinmetz
 // SPDX-License-Identifier: MPL-2.0
 ///////////////////////////////////////////////////////////////////////////////
-import { sanitizeMessageBodyHtml } from "@rapidmx/react-shared/mail/messageBodySanitizer.js";
+import { sanitizeMessageBodyHtml } from "../../../../../lib/mail/messageBodySanitizer.js";
 import { parseColour } from "./color.js";
 
 /**