@rapidmx/web-client 0.29.0 → 0.31.0

package/dist/apps/shared/components/mail/writableMailboxes.js

@@ -20,6 +20,7 @@
 import { useEffect, useMemo, useState } from "react";
 import { getMyMailboxAccess } from "../../../../lib/mail/mailboxAccessApi.js";
 import { useApiClient } from "../../../../lib/util/apiClientContext.js";
+import { onSigningOut } from "./compose/composeFlushRegistry.js";
 const inFlight = new Map();
 const settled = new Map();
 /** Forgets every cached answer - for tests, and anything that changes the caller's access mid-session. */
@@ -27,6 +28,7 @@ export function clearMailboxWritabilityCache() {
     inFlight.clear();
     settled.clear();
 }
+onSigningOut(clearMailboxWritabilityCache);
 function isImplicitlyWritable(mailbox, userUid, trusted) {
     return !!trusted || (!!userUid && mailbox.ownerUserUid === userUid);
 }

package/dist/apps/shared/components/rules/RuleBuilder.js

@@ -36,6 +36,8 @@ export function hasConditions(conditions) {
 export default function RuleBuilder({ value, onChange, conditionFields, actionTypes, showValidation = false, }) {
     const [draftText, setDraftText] = useState({});
     const [newActionType, setNewActionType] = useState(actionTypes[0]?.value ?? "");
+    // The sequence field's text while it is being edited (it may be empty, which is no number); `null` shows the rule's own.
+    const [sequenceDraft, setSequenceDraft] = useState(null);
     const conditions = value.conditions;
     function patch(next) {
         onChange({ ...value, ...next });
@@ -102,5 +104,11 @@ export default function RuleBuilder({ value, onChange, conditionFields, actionTy
                         }) })] }), _jsxs("div", { className: "bg-surface border border-border rounded-md p-6", children: [_jsx("h2", { className: "text-base font-bold uppercase tracking-wide mb-4", children: "Actions" }), _jsxs("div", { className: "flex flex-col gap-3 mb-4", children: [value.actions.length === 0 && _jsx("p", { className: "text-sm text-text-muted", children: "No actions yet." }), value.actions.map((action, index) => {
                                 const def = actionTypes.find((t) => t.value === action.type);
                                 return (_jsxs("div", { className: "border border-border rounded-sm p-3", children: [_jsxs("div", { className: "flex items-center justify-between mb-2", children: [_jsx("span", { className: "text-sm font-semibold", children: def?.label ?? action.type }), _jsx("button", { type: "button", onClick: () => removeAction(index), className: "text-sm text-danger hover:underline", children: "Remove" })] }), def?.render(action, (next) => updateAction(index, next))] }, index));
-                            })] }), _jsxs("div", { className: "flex gap-2", children: [_jsx("select", { "aria-label": "New action type", className: INPUT_CLASS, value: newActionType, onChange: (e) => setNewActionType(e.target.value), children: actionTypes.map((t) => (_jsx("option", { value: t.value, children: t.label }, t.value))) }), _jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", onClick: addAction, children: "Add action" })] })] }), _jsxs("div", { className: "bg-surface border border-border rounded-md p-6", children: [_jsx("h2", { className: "text-base font-bold uppercase tracking-wide mb-4", children: "Settings" }), _jsxs("div", { className: "flex flex-col gap-3", children: [_jsxs("label", { className: "flex items-center gap-2 text-sm", children: [_jsx("input", { type: "checkbox", checked: value.enabled, onChange: (e) => patch({ enabled: e.target.checked }) }), "Enabled"] }), _jsxs("label", { className: "flex items-center gap-2 text-sm", children: [_jsx("input", { type: "checkbox", checked: value.stopProcessingRules, onChange: (e) => patch({ stopProcessingRules: e.target.checked }) }), "Stop processing more rules once this one matches"] }), _jsxs("label", { className: "flex items-center gap-2 text-sm", children: ["Sequence (evaluation order, ascending)", _jsx("input", { type: "number", className: "w-20 text-sm py-1.5 px-2 border border-border rounded-sm bg-surface text-text focus:outline-none focus:border-primary", value: value.sequence, onChange: (e) => patch({ sequence: Number(e.target.value) }) })] })] })] })] }));
+                            })] }), _jsxs("div", { className: "flex gap-2", children: [_jsx("select", { "aria-label": "New action type", className: INPUT_CLASS, value: newActionType, onChange: (e) => setNewActionType(e.target.value), children: actionTypes.map((t) => (_jsx("option", { value: t.value, children: t.label }, t.value))) }), _jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", onClick: addAction, children: "Add action" })] })] }), _jsxs("div", { className: "bg-surface border border-border rounded-md p-6", children: [_jsx("h2", { className: "text-base font-bold uppercase tracking-wide mb-4", children: "Settings" }), _jsxs("div", { className: "flex flex-col gap-3", children: [_jsxs("label", { className: "flex items-center gap-2 text-sm", children: [_jsx("input", { type: "checkbox", checked: value.enabled, onChange: (e) => patch({ enabled: e.target.checked }) }), "Enabled"] }), _jsxs("label", { className: "flex items-center gap-2 text-sm", children: [_jsx("input", { type: "checkbox", checked: value.stopProcessingRules, onChange: (e) => patch({ stopProcessingRules: e.target.checked }) }), "Stop processing more rules once this one matches"] }), _jsxs("label", { className: "flex items-center gap-2 text-sm", children: ["Sequence (evaluation order, ascending)", _jsx("input", { type: "number", className: "w-20 text-sm py-1.5 px-2 border border-border rounded-sm bg-surface text-text focus:outline-none focus:border-primary", value: sequenceDraft ?? value.sequence, onChange: (e) => {
+                                            // What is typed is kept as typed, so the field can be cleared and typed afresh; the rule only takes a number.
+                                            setSequenceDraft(e.target.value);
+                                            if (e.target.value !== "") {
+                                                patch({ sequence: Number(e.target.value) });
+                                            }
+                                        }, onBlur: () => setSequenceDraft(null) })] })] })] })] }));
 }

package/dist/apps/shared/components/settings/GravatarSetting.d.ts

@@ -0,0 +1,6 @@
+import React from "react";
+/**
+ * The opt-in for Gravatar contact pictures. A per-browser preference (not the mailbox's), off until turned on, because looking a picture up tells
+ * gravatar.com the contact's address hash and the reader's IP address.
+ */
+export default function GravatarSetting(): React.JSX.Element;

package/dist/apps/shared/components/settings/GravatarSetting.js

@@ -0,0 +1,15 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+///////////////////////////////////////////////////////////////////////////////
+// Copyright (C) 2026 Jean-Philippe Steinmetz
+// SPDX-License-Identifier: MPL-2.0
+///////////////////////////////////////////////////////////////////////////////
+import { useSyncExternalStore } from "react";
+import { gravatarEnabled, setGravatarEnabled, subscribeGravatarPreference } from "../../../../lib/contacts/gravatar.js";
+/**
+ * The opt-in for Gravatar contact pictures. A per-browser preference (not the mailbox's), off until turned on, because looking a picture up tells
+ * gravatar.com the contact's address hash and the reader's IP address.
+ */
+export default function GravatarSetting() {
+    const enabled = useSyncExternalStore(subscribeGravatarPreference, gravatarEnabled, () => false);
+    return (_jsxs("div", { children: [_jsx("h2", { className: "text-sm font-semibold mb-2", children: "Contact pictures" }), _jsxs("label", { className: "flex items-center gap-2 text-sm", children: [_jsx("input", { type: "checkbox", checked: enabled, onChange: (e) => setGravatarEnabled(e.target.checked) }), "Show profile pictures from Gravatar"] }), _jsx("p", { className: "text-xs text-text-muted mt-2", children: "Looks up each contact's picture by sending a hash of their email address to gravatar.com, which also sees your IP address. Off by default; applies to this browser only." })] }));
+}

package/dist/apps/shared/components/settings/layout/SettingsShell.js

@@ -93,7 +93,7 @@ export default function SettingsShell({ active, userUid, authServerUrl, imperson
     // A full-screen takeover, not nested inside the rest of the app's chrome — same as ContactsShell/
     // TasksShell, there's nothing else for a mailbox-less caller to configure here yet.
     if (userUid && status === "ready" && !mailboxUid) {
-        return _jsx(MailboxProvisioning, {});
+        return _jsx(MailboxProvisioning, { impersonating: impersonating, impersonationBaseUrl: impersonationBaseUrl });
     }
     let inner = null;
     if (userUid && status === "checking") {

package/dist/apps/shared/components/tasks/dueDate.d.ts

@@ -0,0 +1,12 @@
+/**
+ * The stored value of a date-only due date (a `yyyy-MM-dd` day from a date input): UTC midnight of that day, so the task is due on the same
+ * calendar day for everyone, whatever zone they read it in - the way an all-day event is stored. (The creator's local midnight would be a
+ * different day for a reader in another zone.)
+ */
+export declare function dueDateInstant(dateKey: string): string;
+/**
+ * A task's `dueDate` as a local `Date`. An exact UTC midnight is a date-only due date (see `dueDateInstant()`) and reads as the start of that
+ * calendar day wherever the reader is; any other instant - a time on the day, or a date-only value an older version stored as the creator's local
+ * midnight - is that instant itself. (`parseISO()` rather than `new Date()`: a bare `yyyy-MM-dd` would be read as UTC.)
+ */
+export declare function parseDueDate(value: string): Date;

package/dist/apps/shared/components/tasks/dueDate.js

@@ -0,0 +1,26 @@
+///////////////////////////////////////////////////////////////////////////////
+// Copyright (C) 2026 Jean-Philippe Steinmetz
+// SPDX-License-Identifier: MPL-2.0
+///////////////////////////////////////////////////////////////////////////////
+import { parseISO } from "date-fns";
+const MS_PER_DAY = 86400000;
+/**
+ * The stored value of a date-only due date (a `yyyy-MM-dd` day from a date input): UTC midnight of that day, so the task is due on the same
+ * calendar day for everyone, whatever zone they read it in - the way an all-day event is stored. (The creator's local midnight would be a
+ * different day for a reader in another zone.)
+ */
+export function dueDateInstant(dateKey) {
+    return `${dateKey}T00:00:00.000Z`;
+}
+/**
+ * A task's `dueDate` as a local `Date`. An exact UTC midnight is a date-only due date (see `dueDateInstant()`) and reads as the start of that
+ * calendar day wherever the reader is; any other instant - a time on the day, or a date-only value an older version stored as the creator's local
+ * midnight - is that instant itself. (`parseISO()` rather than `new Date()`: a bare `yyyy-MM-dd` would be read as UTC.)
+ */
+export function parseDueDate(value) {
+    const instant = parseISO(value);
+    if (instant.getTime() % MS_PER_DAY !== 0) {
+        return instant;
+    }
+    return new Date(instant.getUTCFullYear(), instant.getUTCMonth(), instant.getUTCDate());
+}

package/dist/apps/shared/components/tasks/layout/TasksShell.js

@@ -79,7 +79,7 @@ export default function TasksShell({ userUid, authServerUrl, impersonating, impe
     // A full-screen takeover, not nested inside the rest of the app's chrome — there's nothing else
     // for a mailbox-less caller to do here yet, so the icon rail/header don't render at all.
     if (userUid && status === "ready" && !mailboxUid) {
-        return _jsx(MailboxProvisioning, {});
+        return _jsx(MailboxProvisioning, { impersonating: impersonating, impersonationBaseUrl: impersonationBaseUrl });
     }
     let inner = null;
     if (userUid && status === "checking") {

package/dist/apps/shared/gestures/useLongPress.d.ts

@@ -0,0 +1,41 @@
+import { type MouseEvent, type TouchEvent } from "react";
+export interface UseLongPressOptions {
+    /** Nothing starts while this is `false` (a desktop pointer, select mode); a press already held out is still seen through. Default `true`. */
+    enabled?: boolean;
+    /** How long a finger has to stay down, in ms. Default `LONG_PRESS_MS`. */
+    delay?: number;
+    /** How far it may wander meanwhile, in px. Default `LONG_PRESS_SLOP`. */
+    tolerance?: number;
+    /** Called once when the press has been held for `delay`. */
+    onLongPress: () => void;
+}
+/** How long a finger holds still to count as a press and hold, and how far it may drift (an unsteady hand) before it is a scroll or a swipe instead. */
+export declare const LONG_PRESS_MS = 480;
+export declare const LONG_PRESS_SLOP = 8;
+/**
+ * Press and hold by one finger, for the touch screens the app's phone layout is for: mouse and pen are left alone.
+ *
+ * Spread the handlers on the element. The press is given up the moment the finger moves more than `tolerance`, a second finger lands, the touch is
+ * cancelled (the browser took it over to scroll) or something scrolls, so it never fights vertical scrolling or `useSwipe()`: a swipe has to travel
+ * further than the tolerance to be one. Once it fires, the finger lifting must not also be a click on whatever is under it (the click that follows is
+ * swallowed once), and the browser's own long-press (the context menu, the text selection and the callout of a link) is suppressed.
+ *
+ * The handlers stay on even while `enabled` is `false`, because the row that was pressed usually makes itself disabled in answer (select mode),
+ * and the click that ends the press still has to be swallowed after that.
+ */
+export declare function useLongPress({ enabled, delay, tolerance, onLongPress }: UseLongPressOptions): {
+    handlers: {
+        onTouchStart: (event: TouchEvent<HTMLElement>) => void;
+        onTouchMove: (event: TouchEvent<HTMLElement>) => void;
+        onTouchEnd: (event: TouchEvent<HTMLElement>) => void;
+        onTouchCancel: () => void;
+        onClickCapture: (event: MouseEvent<HTMLElement>) => void;
+        onContextMenu: (event: MouseEvent<HTMLElement>) => void;
+    };
+    /** No text selection and no callout on what is pressed, while a press can start: the page's text stays selectable elsewhere. */
+    style: {
+        readonly WebkitTouchCallout: "none";
+        readonly WebkitUserSelect: "none";
+        readonly userSelect: "none";
+    } | undefined;
+};

package/dist/apps/shared/gestures/useLongPress.js

@@ -0,0 +1,112 @@
+///////////////////////////////////////////////////////////////////////////////
+// Copyright (C) 2026 Jean-Philippe Steinmetz
+// SPDX-License-Identifier: MPL-2.0
+///////////////////////////////////////////////////////////////////////////////
+import { useEffect, useRef } from "react";
+/** How long a finger holds still to count as a press and hold, and how far it may drift (an unsteady hand) before it is a scroll or a swipe instead. */
+export const LONG_PRESS_MS = 480;
+export const LONG_PRESS_SLOP = 8;
+/** How long after the finger lifts the click it would make is still swallowed; a press that makes none (the browser took it as a context menu) must not eat a later one. */
+const CLICK_WINDOW_MS = 500;
+/**
+ * Press and hold by one finger, for the touch screens the app's phone layout is for: mouse and pen are left alone.
+ *
+ * Spread the handlers on the element. The press is given up the moment the finger moves more than `tolerance`, a second finger lands, the touch is
+ * cancelled (the browser took it over to scroll) or something scrolls, so it never fights vertical scrolling or `useSwipe()`: a swipe has to travel
+ * further than the tolerance to be one. Once it fires, the finger lifting must not also be a click on whatever is under it (the click that follows is
+ * swallowed once), and the browser's own long-press (the context menu, the text selection and the callout of a link) is suppressed.
+ *
+ * The handlers stay on even while `enabled` is `false`, because the row that was pressed usually makes itself disabled in answer (select mode),
+ * and the click that ends the press still has to be swallowed after that.
+ */
+export function useLongPress({ enabled = true, delay = LONG_PRESS_MS, tolerance = LONG_PRESS_SLOP, onLongPress }) {
+    const timer = useRef(null);
+    const start = useRef({ x: 0, y: 0 });
+    /** The press fired and its click has not come yet. */
+    const fired = useRef(false);
+    const clickWindow = useRef(null);
+    const latest = useRef(onLongPress);
+    latest.current = onLongPress;
+    // One function for the life of the row: it is also the scroll listener, which has to be removed with the very function it was added with.
+    const forget = useRef(() => {
+        if (timer.current !== null) {
+            clearTimeout(timer.current);
+            timer.current = null;
+            window.removeEventListener("scroll", forget, true);
+        }
+    }).current;
+    function clearClickWindow() {
+        if (clickWindow.current !== null) {
+            clearTimeout(clickWindow.current);
+            clickWindow.current = null;
+        }
+    }
+    // A timer left running would fire into a row that is gone.
+    useEffect(() => () => {
+        forget();
+        if (clickWindow.current !== null) {
+            clearTimeout(clickWindow.current);
+        }
+    }, [forget]);
+    function onTouchStart(event) {
+        forget();
+        clearClickWindow();
+        fired.current = false;
+        if (!enabled || event.touches.length !== 1) {
+            return;
+        }
+        start.current = { x: event.touches[0].clientX, y: event.touches[0].clientY };
+        // Scroll events don't bubble: only a capturing listener hears the list (or the page) moving under a finger that hasn't moved.
+        window.addEventListener("scroll", forget, { capture: true, passive: true });
+        timer.current = setTimeout(() => {
+            timer.current = null;
+            window.removeEventListener("scroll", forget, true);
+            fired.current = true;
+            navigator.vibrate?.(10);
+            latest.current();
+        }, delay);
+    }
+    function onTouchMove(event) {
+        if (timer.current === null) {
+            return;
+        }
+        const touch = event.touches[0];
+        if (event.touches.length !== 1 || Math.hypot(touch.clientX - start.current.x, touch.clientY - start.current.y) >= tolerance) {
+            forget();
+        }
+    }
+    function onTouchEnd(event) {
+        forget();
+        if (fired.current) {
+            // No click of the browser's own after this; the one that comes anyway (older browsers) is swallowed by `onClickCapture`.
+            event.preventDefault();
+            clearClickWindow();
+            clickWindow.current = setTimeout(() => {
+                clickWindow.current = null;
+                fired.current = false;
+            }, CLICK_WINDOW_MS);
+        }
+    }
+    function onTouchCancel() {
+        forget();
+        fired.current = false;
+    }
+    function onClickCapture(event) {
+        if (fired.current) {
+            fired.current = false;
+            event.preventDefault();
+            event.stopPropagation();
+        }
+    }
+    function onContextMenu(event) {
+        // The long-press menu of a touch screen comes while the finger is still down (Android) or just after it fired.
+        if (timer.current !== null || fired.current) {
+            event.preventDefault();
+        }
+    }
+    return {
+        handlers: { onTouchStart, onTouchMove, onTouchEnd, onTouchCancel, onClickCapture, onContextMenu },
+        /** No text selection and no callout on what is pressed, while a press can start: the page's text stays selectable elsewhere. */
+        style: enabled ? { WebkitTouchCallout: "none", WebkitUserSelect: "none", userSelect: "none" } : undefined,
+    };
+}

package/dist/apps/shared/mail/decryptedMessages.d.ts

@@ -9,6 +9,14 @@ export interface DecryptedMessage {
     subject?: string;
     preview?: string;
 }
+/** Whether decrypting this message already came to nothing since the keys were last unlocked, recently enough that trying again would only repeat it. */
+export declare function decryptFailedBefore(uid: string): boolean;
+/** Remembers that decrypting this message came to nothing, so a list that refreshes does not download and try it again each time. */
+export declare function markDecryptFailed(uid: string): void;
+/** Forgets everything remembered about messages that could not be decrypted (sign-out, an account switch). */
+export declare function clearDecryptedMessages(): void;
+/** Runs `task` over `items` with at most `limit` running at once, resolving to the results in the order of `items`. */
+export declare function mapWithConcurrency<T, R>(items: T[], limit: number, task: (item: T) => Promise<R>): Promise<R[]>;
 /** Plain text of decrypted HTML for a one-line preview. Only ever feeds text display, never markup. */
 export declare function previewOf(html: string): string;
 /** Remembers what was recovered of one message. Ignored when there is nothing new to show. */

package/dist/apps/shared/mail/decryptedMessages.js

@@ -5,12 +5,52 @@
 import { useSyncExternalStore } from "react";
 import { getUnlockedKeys, subscribeKeySession } from "../../../lib/crypto/keySession.js";
 import { getMessageRawContent } from "../../../lib/mail/mailApi.js";
+import { onSigningOut } from "../components/mail/compose/composeFlushRegistry.js";
 const PREVIEW_MAX_LENGTH = 160;
 let entries = {};
 /** Bumped whenever a mailbox's keys are unlocked, so a view can retry decrypting what it couldn't before. */
 let unlockEpoch = 0;
 const listeners = new Set();
 const inFlight = new Set();
+/** How long a message that could not be decrypted is left alone before it is tried again (it is also tried again after any unlock). */
+const DECRYPT_RETRY_MS = 10 * 60000;
+/** How many such messages are remembered. */
+const MAX_FAILED = 1000;
+/** The messages whose decrypting came to nothing (fetch failed, not for this key, nothing readable), by uid: when and in which unlock epoch. */
+const failed = new Map();
+/** Whether decrypting this message already came to nothing since the keys were last unlocked, recently enough that trying again would only repeat it. */
+export function decryptFailedBefore(uid) {
+    const known = failed.get(uid);
+    return !!known && known.epoch === unlockEpoch && Date.now() - known.at < DECRYPT_RETRY_MS;
+}
+/** Remembers that decrypting this message came to nothing, so a list that refreshes does not download and try it again each time. */
+export function markDecryptFailed(uid) {
+    failed.delete(uid);
+    if (failed.size >= MAX_FAILED) {
+        failed.delete(failed.keys().next().value);
+    }
+    failed.set(uid, { epoch: unlockEpoch, at: Date.now() });
+}
+/** Forgets everything remembered about messages that could not be decrypted (sign-out, an account switch). */
+export function clearDecryptedMessages() {
+    entries = {};
+    failed.clear();
+    emit();
+}
+onSigningOut(clearDecryptedMessages);
+/** Runs `task` over `items` with at most `limit` running at once, resolving to the results in the order of `items`. */
+export async function mapWithConcurrency(items, limit, task) {
+    const results = new Array(items.length);
+    let next = 0;
+    async function worker() {
+        while (next < items.length) {
+            const index = next++;
+            results[index] = await task(items[index]);
+        }
+    }
+    await Promise.all(Array.from({ length: Math.min(limit, items.length) }, worker));
+    return results;
+}
 function emit() {
     for (const listener of [...listeners]) {
         listener();
@@ -75,7 +115,7 @@ export function useUnlockEpoch() {
  */
 export async function decryptForDisplay(uid, mailboxUid) {
     const unlocked = getUnlockedKeys(mailboxUid);
-    if (!unlocked || entries[uid] || inFlight.has(uid)) {
+    if (!unlocked || entries[uid] || inFlight.has(uid) || decryptFailedBefore(uid)) {
         return;
     }
     inFlight.add(uid);
@@ -86,10 +126,14 @@ export async function decryptForDisplay(uid, mailboxUid) {
         // A lock while this ran: the result must not go back on screen.
         if (getUnlockedKeys(mailboxUid) === unlocked) {
             rememberDecrypted(uid, mailboxUid, { subject: security.subject, preview: security.html ? previewOf(security.html) : security.text?.slice(0, PREVIEW_MAX_LENGTH) });
+            if (!security.subject && !security.html && !security.text) {
+                markDecryptFailed(uid);
+            }
         }
     }
     catch {
-        // Left as the placeholder.
+        // Left as the placeholder - and not fetched again until the next unlock.
+        markDecryptFailed(uid);
     }
     finally {
         inFlight.delete(uid);

package/dist/apps/shared/mail/listSnapshots.js

@@ -1,3 +1,4 @@
+import { onSigningOut } from "../components/mail/compose/composeFlushRegistry.js";
 /** How long a snapshot may be shown after it was last written. Longer than that the folder is shown as loading, as before. */
 export const LIST_SNAPSHOT_TTL_MS = 5 * 60000;
 /** How many folders are remembered; the least recently written is dropped first. */
@@ -41,3 +42,4 @@ export function saveListScroll(key, scrollTop) {
 export function clearListSnapshots() {
     snapshots.clear();
 }
+onSigningOut(clearListSnapshots);

package/dist/apps/shared/mail/outbox/sendDecision.d.ts

@@ -73,8 +73,11 @@ export interface SendDecisionInput {
  * can choose, or rejected outright. Used twice with the same rules - by the compose window, from what it already knows, to catch a problem
  * *before* it closes (`lookupsComplete: false`), and by the background send, once its recipient lookups are in.
  *
- * Encryption follows `evaluateEncryptionRequirement()` - fail open: only a message the user asked to encrypt, or one the loaded policy
- * encrypts, is encrypted; everything unknown is plain and sends. The one place unknown blocks is a message the user *explicitly* asked to
- * encrypt whose recipients' keys could not be looked up: they asked for encryption, and it cannot be delivered.
+ * Encryption follows `evaluateEncryptionRequirement()`. The compose window's early check (`lookupsComplete: false`) is fail open: only a message
+ * the user asked to encrypt, or one the loaded policy encrypts, is encrypted there; everything unknown is plain, so a flapping gateway never
+ * blocks a draft or Close. The background send (`lookupsComplete: true`) is not: once its loads are in, a message that might have to be encrypted
+ * because the policy or a recipient's key could not be checked (the sender having a key to encrypt with) is blocked (`lookup-failed`) rather than
+ * sent in the clear - and so is one the user *explicitly* asked to encrypt whose recipients' keys could not be looked up. Either way the sender can
+ * choose to send it without encryption.
  */
 export declare function decideSend(input: SendDecisionInput): SendDecision;

package/dist/apps/shared/mail/outbox/sendDecision.js

@@ -25,9 +25,12 @@ export const INLINE_IMAGES_UNSUPPORTED_MESSAGE = "A signed or encrypted message
  * can choose, or rejected outright. Used twice with the same rules - by the compose window, from what it already knows, to catch a problem
  * *before* it closes (`lookupsComplete: false`), and by the background send, once its recipient lookups are in.
  *
- * Encryption follows `evaluateEncryptionRequirement()` - fail open: only a message the user asked to encrypt, or one the loaded policy
- * encrypts, is encrypted; everything unknown is plain and sends. The one place unknown blocks is a message the user *explicitly* asked to
- * encrypt whose recipients' keys could not be looked up: they asked for encryption, and it cannot be delivered.
+ * Encryption follows `evaluateEncryptionRequirement()`. The compose window's early check (`lookupsComplete: false`) is fail open: only a message
+ * the user asked to encrypt, or one the loaded policy encrypts, is encrypted there; everything unknown is plain, so a flapping gateway never
+ * blocks a draft or Close. The background send (`lookupsComplete: true`) is not: once its loads are in, a message that might have to be encrypted
+ * because the policy or a recipient's key could not be checked (the sender having a key to encrypt with) is blocked (`lookup-failed`) rather than
+ * sent in the clear - and so is one the user *explicitly* asked to encrypt whose recipients' keys could not be looked up. Either way the sender can
+ * choose to send it without encryption.
  */
 export function decideSend(input) {
     const { keys } = input;
@@ -60,6 +63,13 @@ export function decideSend(input) {
         recipients: input.recipients,
     });
     const encrypting = requirement.required;
+    if (!encrypting && input.lookupsComplete && requirement.unknown.some((fact) => fact !== "mailbox")) {
+        // The sender has a key to encrypt with, the loads are all in (or gave up), and the policy or a recipient's key is still unknown: the message
+        // might have to be encrypted, and plaintext must not go out on a guess. The sender can still choose to send it without encryption. (An unknown
+        // *mailbox* is not one of these: with no key known there is nothing to say encryption applies, and a mailbox that will not load must not
+        // stop everyone's mail.)
+        return { action: "blocked", block: { kind: "lookup-failed", message: LOOKUP_UNAVAILABLE_MESSAGE, overrideLabel: "Send without encryption", keysLocked: false } };
+    }
     if (encrypting) {
         const statuses = input.recipients.filter((status) => !!status);
         const allResolved = statuses.length === input.recipients.length;

package/dist/apps/shared/mail/outbox/sendJob.d.ts

@@ -45,6 +45,7 @@ export declare const CONTEXT_GRACE_MS = 4000;
 export declare function registerOutboxCounter(tracker: (mailboxUid: string) => OutboxCountTracker, onQueued: (mailboxUid: string) => void): () => void;
 /** The request a message was queued from, while this tab still holds it: what lets "Open draft" and "Retry" work on a failure the server reports later. */
 export declare function retainedRequest(draftUid: string): SendRequest | undefined;
+/** Drops the request a message was queued from, and the pictures remembered as attached to its draft: it has gone, so neither is wanted again. */
 export declare function forgetRetainedRequest(draftUid: string): void;
 /** The sender's signing/encryption key state right now, read from the tab's key session (they can lock mid-send). */
 export declare function readSendKeys(mailboxUid: string, signEnabled: boolean, mailbox: Mailbox | undefined): {

package/dist/apps/shared/mail/outbox/sendJob.js

@@ -3,7 +3,7 @@
 // SPDX-License-Identifier: MPL-2.0
 ///////////////////////////////////////////////////////////////////////////////
 import { ApiRequestError } from "../../../../lib/util/api.js";
-import { assembleDraft, assembleDraftRaw, getMailbox, getMessage, queueMessageSend, sendMessage, setMessageRequestReceipt, } from "../../../../lib/mail/mailApi.js";
+import { assembleDraft, assembleDraftRaw, forgetDraftImages, getMailbox, getMessage, queueMessageSend, sendMessage, setMessageRequestReceipt, } from "../../../../lib/mail/mailApi.js";
 import { describeSendFailure } from "../../../../lib/mail/sendFailure.js";
 import { resolveRecipientEncryption } from "../../../../lib/crypto/composeSecurity.js";
 import { getUnlockedKeys } from "../../../../lib/crypto/keySession.js";
@@ -33,8 +33,10 @@ const RETAINED_LIMIT = 25;
 export function retainedRequest(draftUid) {
     return sendState.retained.get(draftUid);
 }
+/** Drops the request a message was queued from, and the pictures remembered as attached to its draft: it has gone, so neither is wanted again. */
 export function forgetRetainedRequest(draftUid) {
     sendState.retained.delete(draftUid);
+    forgetDraftImages(draftUid);
 }
 function retain(request) {
     sendState.retained.delete(request.draft.uid);
@@ -310,9 +312,11 @@ export function startSend(request, client) {
         else if (outcome.kind === "sent") {
             // A server with no queue relayed it before answering: the Sent Items copy exists already.
             markOutgoingSent(uid);
+            forgetDraftImages(uid);
             notifySent();
         }
         else {
+            forgetDraftImages(uid);
             notify({
                 id: `scheduled:${uid}`,
                 kind: "success",

package/dist/apps/shared/mail/useMailLiveUpdates.d.ts

@@ -8,6 +8,9 @@ import { FolderChange } from "./folderTree.js";
 export declare const LIVE_POLL_INTERVAL_MS = 45000;
 /** Events arriving this close together are answered with one refresh - a burst of new mail is one refetch, not one each. */
 export declare const LIVE_EVENT_DEBOUNCE_MS = 400;
+/** Refreshes are also at least this far apart: while mail keeps arriving (a bulk delivery, an import) the list, the folder counts and an open
+ * thread are read about once in this time - a trailing refresh then picks up whatever came since - instead of every debounce window. */
+export declare const LIVE_EVENT_MIN_INTERVAL_MS = 1500;
 /** What changed, as far as a list on screen is concerned. */
 export interface LiveUpdates {
     /** Bumped each time the list should quietly refetch its first page. `0` until the first bump. */

package/dist/apps/shared/mail/useMailLiveUpdates.js

@@ -13,6 +13,9 @@ import { sortFolders } from "./folderTree.js";
 export const LIVE_POLL_INTERVAL_MS = 45000;
 /** Events arriving this close together are answered with one refresh - a burst of new mail is one refetch, not one each. */
 export const LIVE_EVENT_DEBOUNCE_MS = 400;
+/** Refreshes are also at least this far apart: while mail keeps arriving (a bulk delivery, an import) the list, the folder counts and an open
+ * thread are read about once in this time - a trailing refresh then picks up whatever came since - instead of every debounce window. */
+export const LIVE_EVENT_MIN_INTERVAL_MS = 1500;
 export const NO_LIVE_UPDATES = { tick: 0, folderUids: null };
 /** The class names `NotificationUtils.sendMessage()` publishes are the model's (`MessageMongo`, `MessageSQL`, `FolderMongo`). */
 const MESSAGE_EVENT = /^Message/;
@@ -88,9 +91,11 @@ export function useMailLiveUpdates({ userUid, mailboxes, mailboxFolders, onFolde
         let pendingFolders = new Set();
         let pendingUnknown = false;
         let everOpen = false;
+        let lastFlushAt = -Infinity;
         // Never runs once `stopped`: whatever sets it clears the timer first.
         function flush() {
             timer = undefined;
+            lastFlushAt = Date.now();
             const folderUids = pendingUnknown ? null : new Set(pendingFolders);
             pendingFolders = new Set();
             pendingUnknown = false;
@@ -108,7 +113,7 @@ export function useMailLiveUpdates({ userUid, mailboxes, mailboxFolders, onFolde
             else {
                 pendingUnknown = true;
             }
-            timer ?? (timer = setTimeout(flush, LIVE_EVENT_DEBOUNCE_MS));
+            timer ?? (timer = setTimeout(flush, Math.max(LIVE_EVENT_DEBOUNCE_MS, lastFlushAt + LIVE_EVENT_MIN_INTERVAL_MS - Date.now())));
         }
         const offEvent = client.onEvent((event) => {
             const sendEvent = parseSendEvent(event);

package/dist/apps/shared/mail/usePermanentDelete.d.ts

@@ -7,6 +7,8 @@ export interface EmptiableFolder {
     name: string;
     /** Every folder to empty, when "the folder" is the "All mailboxes" view of one type (each mailbox's own Deleted Items): `uid` is then the first of them. */
     uids?: string[];
+    /** The names of the mailboxes those folders are in, for the confirmation to say whose are emptied (in the "All mailboxes" view). */
+    scope?: string[];
 }
 export interface PermanentDelete {
     /**

package/dist/apps/shared/mail/usePermanentDelete.js

@@ -97,7 +97,7 @@ export function usePermanentDelete() {
                 ? "all items"
                 : folderRequest.count === 1
                     ? "the only item"
-                    : `all ${folderRequest.count} items`} in ${folderRequest.folder.name}? This can't be undone.`
+                    : `all ${folderRequest.count} items`} in ${folderRequest.folder.name}${folderRequest.folder.scope ? ` of: ${folderRequest.folder.scope.join(", ")}` : ""}? This can't be undone.`
             : `Permanently delete ${messageCount(request?.kind === "messages" ? request.messages.length : 0)}? This can't be undone.`, confirmLabel: folderRequest ? "Delete all permanently" : "Delete permanently", busy: running, onConfirm: () => void confirm(), onCancel: cancel }));
     return { requestPermanentDelete, requestEmptyFolder, busy: pending !== null, dialog };
 }

package/dist/apps/shared/notifications/apiErrors.js

@@ -2,6 +2,7 @@
 // Copyright (C) 2026 Jean-Philippe Steinmetz
 // SPDX-License-Identifier: MPL-2.0
 ///////////////////////////////////////////////////////////////////////////////
+import { logSessionEvent } from "../../../lib/auth/session.js";
 import { ApiRequestError } from "../../../lib/util/api.js";
 import { describeSendFailure } from "../../../lib/mail/sendFailure.js";
 import { notify } from "./store.js";
@@ -16,6 +17,7 @@ export function setSignInUrl(authServerUrl) {
 }
 /** The "Your session expired" pop-up: one however many requests noticed, with a "Sign in" action. Returns its id. */
 export function notifySessionExpired() {
+    logSessionEvent("notice:session-expired");
     return notify({
         kind: "error",
         title: "Your session expired",

package/dist/apps/shared/notifications/preferences.d.ts

@@ -1,7 +1,7 @@
 /**
  * The user's one switch for every pop-up (new mail, a failed send, an API error, a reminder), per browser in `localStorage`.
  * Framework-free like the store, which reads it: `notify()` keeps a notification out of sight while it is off (it is still
- * listed in "Recent notifications").
+ * listed in "Recent notifications") - except an error that carries actions (Retry, Open draft), which would otherwise be unreachable.
  */
 /**
  * `localStorage` key of the switch. Absent means on; `"off"` means the user turned pop-ups off. The name is from when the switch

package/dist/apps/shared/notifications/preferences.js

@@ -5,7 +5,7 @@
 /**
  * The user's one switch for every pop-up (new mail, a failed send, an API error, a reminder), per browser in `localStorage`.
  * Framework-free like the store, which reads it: `notify()` keeps a notification out of sight while it is off (it is still
- * listed in "Recent notifications").
+ * listed in "Recent notifications") - except an error that carries actions (Retry, Open draft), which would otherwise be unreachable.
  */
 /**
  * `localStorage` key of the switch. Absent means on; `"off"` means the user turned pop-ups off. The name is from when the switch

package/dist/apps/shared/notifications/store.js

@@ -232,7 +232,9 @@ export function notify(input) {
         paused: false,
     };
     applyInput(entry, input);
-    if (!getNotificationsEnabled()) {
+    // An error that offers something to do (a failed send's Retry and Open draft, "Sign in again") is shown whatever the switch says: it is
+    // the only way back to what the person typed, and the history has no way to carry out its actions.
+    if (!getNotificationsEnabled() && !(entry.kind === "error" && entry.actions.length > 0)) {
         // The user has pop-ups off: nothing is shown, but it is listed in the history like any other.
         record(entry);
         emit();

package/dist/apps/shared/plugins/pluginNav.d.ts

@@ -35,7 +35,8 @@ export interface PluginNavProps {
     pluginNav?: PluginNav;
 }
 /** A same-origin absolute path: starts with `/`, but not `//` or `/\` (both of which browsers treat as
- * protocol-relative URLs to another host). */
+ * protocol-relative URLs to another host), and holds no control character, space or backslash anywhere -
+ * URL parsers strip tab/CR/LF from anywhere, so `/<tab>/evil.com` would otherwise read as `//evil.com`. */
 export declare function isSafePluginHref(href: string): boolean;
 /**
  * Appends a plugin's nav items after the core ones. Skips any item that isn't well-formed, whose `href`