@rapidmx/web-client 0.30.0 → 0.31.0

package/dist/apps/shared/components/mail/compose/RecipientInput.js

@@ -44,7 +44,8 @@ function dropdownPosition(anchor) {
  */
 export default function RecipientInput({ id, label, value, onChange, onBlur, onCommit, mailboxUid, fetchSuggestions = fetchRecipientSuggestions, debounceMs = RECIPIENT_SUGGESTION_DEBOUNCE_MS, disabled, autoFocus, onEdit, initialPending = "", hideChip, placeholder, ariaLabel, listLabel, className, dropdownZIndex, }) {
     const [pending, setPending] = useState(initialPending);
-    const [suggestions, setSuggestions] = useState([]);
+    // With the query they were loaded for: a list for earlier text is not offered (Enter or Tab would put somebody else in place of what was typed).
+    const [suggestionList, setSuggestionList] = useState({ query: "", items: [] });
     const [open, setOpen] = useState(false);
     const [activeIndex, setActiveIndex] = useState(0);
     const [position, setPosition] = useState(null);
@@ -69,24 +70,24 @@ export default function RecipientInput({ id, label, value, onChange, onBlur, onC
         }
     }, [pending, pendingActive]);
     const committedAddresses = new Set(chips.map((chip) => parseRecipient(chip).address.toLowerCase()));
-    const visible = suggestions.filter((suggestion) => !committedAddresses.has(suggestion.address.toLowerCase()));
+    const visible = (suggestionList.query === query ? suggestionList.items : []).filter((suggestion) => !committedAddresses.has(suggestion.address.toLowerCase()));
     const expanded = open && visible.length > 0 && query.length >= RECIPIENT_SUGGESTION_MIN_QUERY_LENGTH;
     const active = Math.min(activeIndex, visible.length - 1);
     useEffect(() => {
         if (query.length < RECIPIENT_SUGGESTION_MIN_QUERY_LENGTH) {
-            setSuggestions([]);
+            setSuggestionList({ query: "", items: [] });
             return;
         }
         const controller = new AbortController();
         const timer = setTimeout(() => {
             fetchRef.current(query, { mailboxUid, signal: controller.signal }).then((result) => {
                 if (!controller.signal.aborted) {
-                    setSuggestions(result);
+                    setSuggestionList({ query, items: result });
                     setActiveIndex(0);
                 }
             }, () => {
                 if (!controller.signal.aborted) {
-                    setSuggestions([]);
+                    setSuggestionList({ query: "", items: [] });
                 }
             });
         }, debounceMs);
@@ -139,7 +140,7 @@ export default function RecipientInput({ id, label, value, onChange, onBlur, onC
         const next = committed.join(", ");
         setPending("");
         setOpen(false);
-        setSuggestions([]);
+        setSuggestionList({ query: "", items: [] });
         onChange(next);
         onEdit?.(committed, "");
         onCommit?.(next);
@@ -204,7 +205,8 @@ export default function RecipientInput({ id, label, value, onChange, onBlur, onC
     return (_jsxs("div", { ref: anchorRef, className: `flex-1 min-w-0 flex flex-wrap items-center gap-1${className ? ` ${className}` : ""}`, children: [drawn.length > 0 && (_jsx("ul", { role: "list", "aria-label": listLabel ?? `${label} recipients`, className: "contents", children: drawn.map(({ chip, index }) => {
                     const recipient = parseRecipient(chip);
                     const valid = isValidRecipientAddress(recipient.address);
-                    const name = recipient.displayName || recipient.address;
+                    // A name that is itself an address (`"billing@bank.com" <x@evil.tld>`) would hide the one it is really sent to: both are shown.
+                    const name = /[@＠﹫]/.test(recipient.displayName ?? "") ? `${recipient.displayName} <${recipient.address}>` : recipient.displayName || recipient.address;
                     return (_jsxs("li", { title: chip, className: `flex items-center gap-1 max-w-full min-w-0 rounded-pill border pl-2 pr-0.5 py-px text-xs ${valid ? "bg-surface-alt border-border text-text" : "bg-danger-bg border-danger text-danger"}`, children: [_jsx("span", { className: "truncate", children: name }), !valid && _jsx("span", { className: "sr-only", children: " (not a valid email address)" }), _jsx("button", { type: "button", tabIndex: -1, "aria-label": `Remove ${recipient.address}`, disabled: disabled, onMouseDown: (e) => e.preventDefault(), onClick: () => removeChip(index), className: "shrink-0 w-4 h-4 flex items-center justify-center rounded-pill text-text-muted hover:bg-border hover:text-text", children: _jsx(HiOutlineXMark, { size: 10 }) })] }, `${index}-${chip}`));
                 }) })), _jsx("input", { ref: inputRef, id: id, type: "text", role: "combobox", autoComplete: "off", "aria-autocomplete": "list", "aria-label": ariaLabel, placeholder: placeholder, "aria-expanded": expanded, "aria-controls": listboxId, "aria-activedescendant": expanded ? optionId(active) : undefined, disabled: disabled, autoFocus: autoFocus, className: "flex-1 min-w-[6rem] text-sm bg-transparent outline-none py-0.5", value: inputValue, onChange: handleInputChange, onKeyDown: handleKeyDown, onBlur: handleBlur }), _jsx("span", { className: "sr-only", "aria-live": "polite", children: expanded ? `${visible.length} ${visible.length === 1 ? "suggestion" : "suggestions"}` : "" }), expanded &&
                 position &&

package/dist/apps/shared/components/mail/compose/composeFlushRegistry.d.ts

@@ -1,11 +1,17 @@
 /** Saves a compose window's unsaved edits (or waits for a save already on the wire), resolving to `false` when
  * something the window holds is still unsaved afterwards (any other value counts as saved). Never rejects. */
 export type ComposeFlush = () => Promise<unknown>;
+/**
+ * Registers something to run the moment the app starts signing out (explicitly, or forced by another tab): a cache that holds message content,
+ * which must not outlive the session it was read in. Called once, when the module that owns the cache is loaded.
+ */
+export declare function onSigningOut(cleanup: () => void): void;
 /**
  * Marks the app as signing out (explicitly, or forced by a sign-out in another tab), so compose windows stop
  * asking the browser to confirm leaving the page - the "Leave site?" prompt would otherwise let the user cancel
  * the sign-out's own navigation and stay on a page whose session is being ended. Call it before flushing drafts
- * and navigating. `clearSigningOut()` undoes it (a sign-out that didn't leave the page after all).
+ * and navigating. `clearSigningOut()` undoes it (a sign-out that didn't leave the page after all). It also runs what was registered
+ * with `onSigningOut()`.
  */
 export declare function markSigningOut(): void;
 /** Undoes `markSigningOut()`. */

package/dist/apps/shared/components/mail/compose/composeFlushRegistry.js

@@ -3,15 +3,27 @@
 // SPDX-License-Identifier: MPL-2.0
 ///////////////////////////////////////////////////////////////////////////////
 const flushers = new Set();
+const signOutCleanups = new Set();
 let signingOut = false;
+/**
+ * Registers something to run the moment the app starts signing out (explicitly, or forced by another tab): a cache that holds message content,
+ * which must not outlive the session it was read in. Called once, when the module that owns the cache is loaded.
+ */
+export function onSigningOut(cleanup) {
+    signOutCleanups.add(cleanup);
+}
 /**
  * Marks the app as signing out (explicitly, or forced by a sign-out in another tab), so compose windows stop
  * asking the browser to confirm leaving the page - the "Leave site?" prompt would otherwise let the user cancel
  * the sign-out's own navigation and stay on a page whose session is being ended. Call it before flushing drafts
- * and navigating. `clearSigningOut()` undoes it (a sign-out that didn't leave the page after all).
+ * and navigating. `clearSigningOut()` undoes it (a sign-out that didn't leave the page after all). It also runs what was registered
+ * with `onSigningOut()`.
  */
 export function markSigningOut() {
     signingOut = true;
+    for (const cleanup of signOutCleanups) {
+        cleanup();
+    }
 }
 /** Undoes `markSigningOut()`. */
 export function clearSigningOut() {

package/dist/apps/shared/components/mail/compose/encryptionRequirement.d.ts

@@ -18,6 +18,11 @@ import type { EncryptionPolicy } from "../../../../../lib/crypto/keyvaultApi.js"
  * reported in `unknown`, so a caller that is about to send can give the loads a moment - and only a caller that finds out later that the
  * message *does* need encryption acts on it (see `ComposeWindow`'s transition rules).
  *
+ * That is this function's answer, and it stays fail open for everything that is about a draft or the compose window. The background send
+ * (`sendDecision.ts`'s `decideSend()` with `lookupsComplete`) reads `unknown` once its loads are in: a sender who has an encryption key, and
+ * whose policy or recipients' keys could not be checked, is blocked with the `lookup-failed` decision (the sender may still send without
+ * encryption) rather than sent in the clear on a guess.
+ *
  * Why this is safe enough: the requirement only ever protects *this client's* plaintext drafts and sends from being unencrypted when the
  * server's policy says they should be; it is not the enforcement point (the keys are the user's, the server never sees them). A missing
  * policy therefore does not mean "encrypt or refuse" - it means the client cannot tell, and the honest default is the one that works.

package/dist/apps/shared/components/mail/compose/quotedBody.js

@@ -7,12 +7,23 @@ import { attachmentContentUrl, getMessageRawContent, listAttachments } from "../
 import { MAX_QUOTED_IMAGE_BYTES, embedQuotedImages } from "../../../../../lib/mail/compose/quotedImages.js";
 import { EMBEDDED_IMAGE_TYPES, findInlineAttachment, toDataUri } from "../../../../../lib/mail/inlineImages.js";
 import { decodeHeaderText, extractDisplayBody, parseMimeEntity } from "../../../../../lib/crypto/mime.js";
+import { onSigningOut } from "./composeFlushRegistry.js";
 import { parseRecipientList } from "./recipients.js";
+/** The security states whose `protectedHeaders` a signature covers - the only ones Reply All takes recipients from. */
+const TRUSTED_HEADER_STATES = new Set([
+    "signed_verified",
+    "encrypted_verified",
+    "signed_unverified_signer",
+    "encrypted_unverified_signer",
+    "verified_at_first_open",
+]);
 /** How long a reply waits for the original's body before it goes ahead with the preview - a slow or hung request must not
  * leave the window waiting on it (or, before it opened at once, keep it from opening) indefinitely. */
 export const QUOTE_FETCH_TIMEOUT_MS = 10000;
 /** How long a fetched (or prefetched) body is remembered, so hovering Reply and then clicking it costs one request. */
 export const QUOTE_CACHE_MS = 30000;
+/** How many bodies are remembered at most: each is a whole message body, and a mailbox read for hours would otherwise keep every one it was asked about. */
+const QUOTE_CACHE_MAX = 20;
 const contentCache = new Map();
 /**
  * The server's sanitized HTML body of a message (`GET /mail/messages/:id/content`), or `undefined` when it has none (a
@@ -38,6 +49,12 @@ function fetchContentHtml(uid) {
             clearTimeout(timer);
         }
     })();
+    // Whatever has expired goes, and the oldest of the rest once there are too many.
+    for (const [key, entry] of contentCache) {
+        if (Date.now() - entry.at >= QUOTE_CACHE_MS || contentCache.size >= QUOTE_CACHE_MAX) {
+            contentCache.delete(key);
+        }
+    }
     contentCache.set(uid, { at: Date.now(), promise });
     void promise.then((html) => {
         if (html === undefined && contentCache.get(uid)?.promise === promise) {
@@ -68,6 +85,7 @@ export function prefetchOriginalMessage(message) {
 export function clearOriginalMessageCache() {
     contentCache.clear();
 }
+onSigningOut(clearOriginalMessageCache);
 /** The recipients one address-list header names, RFC 2047-decoded, with their display names. */
 function headerRecipients(value, type) {
     if (!value) {
@@ -81,7 +99,7 @@ function headerRecipients(value, type) {
  * or `undefined` when there is none, it is not a raster image, it is too large or it could not be had. Never rejects. */
 function serverImageResolver(message) {
     let attachments;
-    return async (reference) => {
+    return async (reference, signal) => {
         try {
             attachments ?? (attachments = listAttachments(message.folderUid, message.uid));
             const attachment = findInlineAttachment(await attachments, reference);
@@ -89,7 +107,7 @@ function serverImageResolver(message) {
             if (!attachment || !type || !EMBEDDED_IMAGE_TYPES.test(type) || attachment.sizeBytes > MAX_QUOTED_IMAGE_BYTES) {
                 return undefined;
             }
-            const res = await fetch(attachmentContentUrl(attachment.uid), { credentials: "include" });
+            const res = await fetch(attachmentContentUrl(attachment.uid), { credentials: "include", signal });
             const bytes = res.ok ? new Uint8Array(await res.arrayBuffer()) : undefined;
             return bytes && bytes.length <= MAX_QUOTED_IMAGE_BYTES ? toDataUri(type, bytes) : undefined;
         }
@@ -136,7 +154,9 @@ function partImageResolver(parts) {
  */
 export async function loadOriginalMessage(message, security, options = {}) {
     const recovered = security?.text !== undefined ? { text: security.text } : security?.html !== undefined ? { html: security.html } : undefined;
-    const protectedHeaders = security?.protectedHeaders;
+    // Headers inside an unsigned (or badly signed) encrypted message are whatever its encrypter chose to write, so only a
+    // verified signature makes them a source of recipients.
+    const protectedHeaders = security && TRUSTED_HEADER_STATES.has(security.state) ? security.protectedHeaders : undefined;
     const protectedRecipients = protectedHeaders
         ? [...headerRecipients(protectedHeaders.to, "to"), ...headerRecipients(protectedHeaders.cc, "cc")]
         : [];
@@ -176,8 +196,11 @@ export async function loadOriginalMessage(message, security, options = {}) {
     if (result.body.html !== undefined) {
         const resolver = recovered ? partImageResolver(security?.attachments ?? []) : serverImageResolver(message);
         const html = result.body.html;
-        // Bounded like the body's own request: a picture that will not arrive is left out of the quote, not waited for.
-        result.body = { html: await withTimeout(embedQuotedImages(html, resolver), QUOTE_FETCH_TIMEOUT_MS).catch(() => html) };
+        // Bounded like the body's own request: a picture that has not arrived by then is cancelled and left out of the quote, not waited for -
+        // the ones that have arrived stay.
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(), QUOTE_FETCH_TIMEOUT_MS);
+        result.body = { html: await embedQuotedImages(html, resolver, controller.signal).finally(() => clearTimeout(timer)) };
     }
     return result;
 }

package/dist/apps/shared/components/mail/layout/MailShell.js

@@ -204,7 +204,7 @@ export default function MailShell({ userUid, authServerUrl, impersonating, imper
     // `mailboxes.length` directly (not `!mailboxUid`) since `mailboxUid` is legitimately undefined in
     // aggregate mode even with mailboxes present.
     if (userUid && status === "ready" && mailboxes.length === 0) {
-        return _jsx(MailboxProvisioning, {});
+        return _jsx(MailboxProvisioning, { impersonating: impersonating, impersonationBaseUrl: impersonationBaseUrl });
     }
     let inner = null;
     if (userUid && status === "checking") {

package/dist/apps/shared/components/mail/reading/MessageBody.js

@@ -39,7 +39,7 @@ const AUTHORED_CANVAS = "rgb(255, 255, 255)";
 export default function MessageBody({ messageUid, messageVersion, title, content, attachments, inlineParts, original = false, onAdaptable }) {
     const [remote, setRemote] = useState(() => {
         const cached = cachedBodyContent(messageUid, messageVersion);
-        return cached ? { status: "ready", content: cached } : { status: "loading" };
+        return cached ? { status: "ready", content: cached, uid: messageUid } : { status: "loading" };
     });
     const [attempt, setAttempt] = useState(0);
     const supplied = content !== undefined;
@@ -49,19 +49,24 @@ export default function MessageBody({ messageUid, messageVersion, title, content
         }
         const cached = cachedBodyContent(messageUid, messageVersion);
         if (cached) {
-            setRemote({ status: "ready", content: cached });
+            setRemote({ status: "ready", content: cached, uid: messageUid });
             return;
         }
         const controller = new AbortController();
-        setRemote({ status: "loading" });
-        fetchBodyContent(messageUid, messageVersion, controller.signal).then((loaded) => setRemote({ status: "ready", content: loaded }), (err) => {
-            if (!controller.signal.aborted) {
+        // The same message under a newer version (opening it marked it read, a flag or a label changed): what is shown stays - no skeleton, and
+        // the frame is not torn down and laid out again - until the fresh copy is here, and a failed read leaves it too.
+        const revalidating = remote.status === "ready" && remote.uid === messageUid;
+        if (!revalidating) {
+            setRemote({ status: "loading" });
+        }
+        fetchBodyContent(messageUid, messageVersion, controller.signal).then((loaded) => setRemote({ status: "ready", content: loaded, uid: messageUid }), (err) => {
+            if (!controller.signal.aborted && !revalidating) {
                 setRemote({ status: "error", message: err instanceof ApiRequestError ? err.message : "Could not load this message." });
             }
         });
         return () => controller.abort();
     }, [messageUid, messageVersion, supplied, attempt]);
-    const shown = content ? { status: "ready", content } : remote;
+    const shown = content ? { status: "ready", content, uid: messageUid } : remote;
     if (shown.status === "loading") {
         return _jsx(BodySkeleton, {});
     }

package/dist/apps/shared/components/mail/reading/bodyContent.js

@@ -5,6 +5,7 @@
 import { ApiRequestError, apiUrl } from "../../../../../lib/util/api.js";
 import { attachmentContentUrl } from "../../../../../lib/mail/mailApi.js";
 import { findInlineAttachment, toDataUri } from "../../../../../lib/mail/inlineImages.js";
+import { onSigningOut } from "../compose/composeFlushRegistry.js";
 /** How many bodies are remembered for the session - a thread that is expanded, collapsed and expanded again does not ask the server twice. */
 const CACHE_LIMIT = 40;
 /** What the pane asks `/content` for. */
@@ -14,6 +15,7 @@ const cache = new Map();
 export function clearBodyContentCache() {
     cache.clear();
 }
+onSigningOut(clearBodyContentCache);
 /** The remembered body for a message at a version, if any. */
 export function cachedBodyContent(uid, version) {
     return cache.get(`${uid}:${version}`);

package/dist/apps/shared/components/mail/reading/bodyHtml.d.ts

@@ -33,7 +33,11 @@ export interface PrepareOptions {
      * server removes one it could not point at a part) is asked for with no `contentId` and its `alt`. */
     resolveCid?: (contentId: string | undefined, alt?: string) => string | undefined;
 }
-/** CSS with the constructs above neutralised. */
+/**
+ * CSS with the constructs above neutralised. The patterns run on what a browser would read, not only on the raw text: `position:\66ixed` and
+ * `min-height:200\76h` are `position:fixed` and `200vh` to it, and a comment inside a name (`position/**\/:fixed`) is no obstacle either. When the
+ * decoded text holds one, that text (escapes resolved, comments dropped) is what is kept, neutralised; CSS whose escapes hide nothing is left as written.
+ */
 export declare function sanitizeCss(css: string): string;
 /**
  * Whether a mail's own markup declares that it supports a dark scheme: `<meta name="color-scheme">` naming dark,

package/dist/apps/shared/components/mail/reading/bodyHtml.js

@@ -35,10 +35,31 @@ const STYLE_HAZARDS = [
     [/behavior\s*:/gi, "x-behavior:"],
     [/@import[^;]*;?/gi, ""],
 ];
-/** CSS with the constructs above neutralised. */
-export function sanitizeCss(css) {
+function neutraliseHazards(css) {
     return STYLE_HAZARDS.reduce((text, [pattern, replacement]) => text.replace(pattern, replacement), css);
 }
+/** `css` as a browser reads it: comments gone, and every escape resolved - repeatedly, since a decoded backslash can start another (`\5c 76h`). */
+function readAsBrowser(css) {
+    let text = css;
+    for (let pass = 0; pass < 3; pass++) {
+        const next = unescapeCss(text.replace(/\/\*[\s\S]*?\*\//g, " "));
+        if (next === text) {
+            break;
+        }
+        text = next;
+    }
+    return text;
+}
+/**
+ * CSS with the constructs above neutralised. The patterns run on what a browser would read, not only on the raw text: `position:\66ixed` and
+ * `min-height:200\76h` are `position:fixed` and `200vh` to it, and a comment inside a name (`position/**\/:fixed`) is no obstacle either. When the
+ * decoded text holds one, that text (escapes resolved, comments dropped) is what is kept, neutralised; CSS whose escapes hide nothing is left as written.
+ */
+export function sanitizeCss(css) {
+    const decoded = readAsBrowser(css);
+    const decodedClean = neutraliseHazards(decoded);
+    return decodedClean !== decoded ? decodedClean : neutraliseHazards(css);
+}
 /** Elements removed together with everything inside them. */
 const REMOVED_ELEMENTS = new Set([
     "script",

package/dist/apps/shared/components/mail/writableMailboxes.js

@@ -20,6 +20,7 @@
 import { useEffect, useMemo, useState } from "react";
 import { getMyMailboxAccess } from "../../../../lib/mail/mailboxAccessApi.js";
 import { useApiClient } from "../../../../lib/util/apiClientContext.js";
+import { onSigningOut } from "./compose/composeFlushRegistry.js";
 const inFlight = new Map();
 const settled = new Map();
 /** Forgets every cached answer - for tests, and anything that changes the caller's access mid-session. */
@@ -27,6 +28,7 @@ export function clearMailboxWritabilityCache() {
     inFlight.clear();
     settled.clear();
 }
+onSigningOut(clearMailboxWritabilityCache);
 function isImplicitlyWritable(mailbox, userUid, trusted) {
     return !!trusted || (!!userUid && mailbox.ownerUserUid === userUid);
 }

package/dist/apps/shared/components/rules/RuleBuilder.js

@@ -36,6 +36,8 @@ export function hasConditions(conditions) {
 export default function RuleBuilder({ value, onChange, conditionFields, actionTypes, showValidation = false, }) {
     const [draftText, setDraftText] = useState({});
     const [newActionType, setNewActionType] = useState(actionTypes[0]?.value ?? "");
+    // The sequence field's text while it is being edited (it may be empty, which is no number); `null` shows the rule's own.
+    const [sequenceDraft, setSequenceDraft] = useState(null);
     const conditions = value.conditions;
     function patch(next) {
         onChange({ ...value, ...next });
@@ -102,5 +104,11 @@ export default function RuleBuilder({ value, onChange, conditionFields, actionTy
                         }) })] }), _jsxs("div", { className: "bg-surface border border-border rounded-md p-6", children: [_jsx("h2", { className: "text-base font-bold uppercase tracking-wide mb-4", children: "Actions" }), _jsxs("div", { className: "flex flex-col gap-3 mb-4", children: [value.actions.length === 0 && _jsx("p", { className: "text-sm text-text-muted", children: "No actions yet." }), value.actions.map((action, index) => {
                                 const def = actionTypes.find((t) => t.value === action.type);
                                 return (_jsxs("div", { className: "border border-border rounded-sm p-3", children: [_jsxs("div", { className: "flex items-center justify-between mb-2", children: [_jsx("span", { className: "text-sm font-semibold", children: def?.label ?? action.type }), _jsx("button", { type: "button", onClick: () => removeAction(index), className: "text-sm text-danger hover:underline", children: "Remove" })] }), def?.render(action, (next) => updateAction(index, next))] }, index));
-                            })] }), _jsxs("div", { className: "flex gap-2", children: [_jsx("select", { "aria-label": "New action type", className: INPUT_CLASS, value: newActionType, onChange: (e) => setNewActionType(e.target.value), children: actionTypes.map((t) => (_jsx("option", { value: t.value, children: t.label }, t.value))) }), _jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", onClick: addAction, children: "Add action" })] })] }), _jsxs("div", { className: "bg-surface border border-border rounded-md p-6", children: [_jsx("h2", { className: "text-base font-bold uppercase tracking-wide mb-4", children: "Settings" }), _jsxs("div", { className: "flex flex-col gap-3", children: [_jsxs("label", { className: "flex items-center gap-2 text-sm", children: [_jsx("input", { type: "checkbox", checked: value.enabled, onChange: (e) => patch({ enabled: e.target.checked }) }), "Enabled"] }), _jsxs("label", { className: "flex items-center gap-2 text-sm", children: [_jsx("input", { type: "checkbox", checked: value.stopProcessingRules, onChange: (e) => patch({ stopProcessingRules: e.target.checked }) }), "Stop processing more rules once this one matches"] }), _jsxs("label", { className: "flex items-center gap-2 text-sm", children: ["Sequence (evaluation order, ascending)", _jsx("input", { type: "number", className: "w-20 text-sm py-1.5 px-2 border border-border rounded-sm bg-surface text-text focus:outline-none focus:border-primary", value: value.sequence, onChange: (e) => patch({ sequence: Number(e.target.value) }) })] })] })] })] }));
+                            })] }), _jsxs("div", { className: "flex gap-2", children: [_jsx("select", { "aria-label": "New action type", className: INPUT_CLASS, value: newActionType, onChange: (e) => setNewActionType(e.target.value), children: actionTypes.map((t) => (_jsx("option", { value: t.value, children: t.label }, t.value))) }), _jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", onClick: addAction, children: "Add action" })] })] }), _jsxs("div", { className: "bg-surface border border-border rounded-md p-6", children: [_jsx("h2", { className: "text-base font-bold uppercase tracking-wide mb-4", children: "Settings" }), _jsxs("div", { className: "flex flex-col gap-3", children: [_jsxs("label", { className: "flex items-center gap-2 text-sm", children: [_jsx("input", { type: "checkbox", checked: value.enabled, onChange: (e) => patch({ enabled: e.target.checked }) }), "Enabled"] }), _jsxs("label", { className: "flex items-center gap-2 text-sm", children: [_jsx("input", { type: "checkbox", checked: value.stopProcessingRules, onChange: (e) => patch({ stopProcessingRules: e.target.checked }) }), "Stop processing more rules once this one matches"] }), _jsxs("label", { className: "flex items-center gap-2 text-sm", children: ["Sequence (evaluation order, ascending)", _jsx("input", { type: "number", className: "w-20 text-sm py-1.5 px-2 border border-border rounded-sm bg-surface text-text focus:outline-none focus:border-primary", value: sequenceDraft ?? value.sequence, onChange: (e) => {
+                                            // What is typed is kept as typed, so the field can be cleared and typed afresh; the rule only takes a number.
+                                            setSequenceDraft(e.target.value);
+                                            if (e.target.value !== "") {
+                                                patch({ sequence: Number(e.target.value) });
+                                            }
+                                        }, onBlur: () => setSequenceDraft(null) })] })] })] })] }));
 }

package/dist/apps/shared/components/settings/GravatarSetting.d.ts

@@ -0,0 +1,6 @@
+import React from "react";
+/**
+ * The opt-in for Gravatar contact pictures. A per-browser preference (not the mailbox's), off until turned on, because looking a picture up tells
+ * gravatar.com the contact's address hash and the reader's IP address.
+ */
+export default function GravatarSetting(): React.JSX.Element;

package/dist/apps/shared/components/settings/GravatarSetting.js

@@ -0,0 +1,15 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+///////////////////////////////////////////////////////////////////////////////
+// Copyright (C) 2026 Jean-Philippe Steinmetz
+// SPDX-License-Identifier: MPL-2.0
+///////////////////////////////////////////////////////////////////////////////
+import { useSyncExternalStore } from "react";
+import { gravatarEnabled, setGravatarEnabled, subscribeGravatarPreference } from "../../../../lib/contacts/gravatar.js";
+/**
+ * The opt-in for Gravatar contact pictures. A per-browser preference (not the mailbox's), off until turned on, because looking a picture up tells
+ * gravatar.com the contact's address hash and the reader's IP address.
+ */
+export default function GravatarSetting() {
+    const enabled = useSyncExternalStore(subscribeGravatarPreference, gravatarEnabled, () => false);
+    return (_jsxs("div", { children: [_jsx("h2", { className: "text-sm font-semibold mb-2", children: "Contact pictures" }), _jsxs("label", { className: "flex items-center gap-2 text-sm", children: [_jsx("input", { type: "checkbox", checked: enabled, onChange: (e) => setGravatarEnabled(e.target.checked) }), "Show profile pictures from Gravatar"] }), _jsx("p", { className: "text-xs text-text-muted mt-2", children: "Looks up each contact's picture by sending a hash of their email address to gravatar.com, which also sees your IP address. Off by default; applies to this browser only." })] }));
+}

package/dist/apps/shared/components/settings/layout/SettingsShell.js

@@ -93,7 +93,7 @@ export default function SettingsShell({ active, userUid, authServerUrl, imperson
     // A full-screen takeover, not nested inside the rest of the app's chrome — same as ContactsShell/
     // TasksShell, there's nothing else for a mailbox-less caller to configure here yet.
     if (userUid && status === "ready" && !mailboxUid) {
-        return _jsx(MailboxProvisioning, {});
+        return _jsx(MailboxProvisioning, { impersonating: impersonating, impersonationBaseUrl: impersonationBaseUrl });
     }
     let inner = null;
     if (userUid && status === "checking") {

package/dist/apps/shared/components/tasks/dueDate.d.ts

@@ -0,0 +1,12 @@
+/**
+ * The stored value of a date-only due date (a `yyyy-MM-dd` day from a date input): UTC midnight of that day, so the task is due on the same
+ * calendar day for everyone, whatever zone they read it in - the way an all-day event is stored. (The creator's local midnight would be a
+ * different day for a reader in another zone.)
+ */
+export declare function dueDateInstant(dateKey: string): string;
+/**
+ * A task's `dueDate` as a local `Date`. An exact UTC midnight is a date-only due date (see `dueDateInstant()`) and reads as the start of that
+ * calendar day wherever the reader is; any other instant - a time on the day, or a date-only value an older version stored as the creator's local
+ * midnight - is that instant itself. (`parseISO()` rather than `new Date()`: a bare `yyyy-MM-dd` would be read as UTC.)
+ */
+export declare function parseDueDate(value: string): Date;

package/dist/apps/shared/components/tasks/dueDate.js

@@ -0,0 +1,26 @@
+///////////////////////////////////////////////////////////////////////////////
+// Copyright (C) 2026 Jean-Philippe Steinmetz
+// SPDX-License-Identifier: MPL-2.0
+///////////////////////////////////////////////////////////////////////////////
+import { parseISO } from "date-fns";
+const MS_PER_DAY = 86400000;
+/**
+ * The stored value of a date-only due date (a `yyyy-MM-dd` day from a date input): UTC midnight of that day, so the task is due on the same
+ * calendar day for everyone, whatever zone they read it in - the way an all-day event is stored. (The creator's local midnight would be a
+ * different day for a reader in another zone.)
+ */
+export function dueDateInstant(dateKey) {
+    return `${dateKey}T00:00:00.000Z`;
+}
+/**
+ * A task's `dueDate` as a local `Date`. An exact UTC midnight is a date-only due date (see `dueDateInstant()`) and reads as the start of that
+ * calendar day wherever the reader is; any other instant - a time on the day, or a date-only value an older version stored as the creator's local
+ * midnight - is that instant itself. (`parseISO()` rather than `new Date()`: a bare `yyyy-MM-dd` would be read as UTC.)
+ */
+export function parseDueDate(value) {
+    const instant = parseISO(value);
+    if (instant.getTime() % MS_PER_DAY !== 0) {
+        return instant;
+    }
+    return new Date(instant.getUTCFullYear(), instant.getUTCMonth(), instant.getUTCDate());
+}

package/dist/apps/shared/components/tasks/layout/TasksShell.js

@@ -79,7 +79,7 @@ export default function TasksShell({ userUid, authServerUrl, impersonating, impe
     // A full-screen takeover, not nested inside the rest of the app's chrome — there's nothing else
     // for a mailbox-less caller to do here yet, so the icon rail/header don't render at all.
     if (userUid && status === "ready" && !mailboxUid) {
-        return _jsx(MailboxProvisioning, {});
+        return _jsx(MailboxProvisioning, { impersonating: impersonating, impersonationBaseUrl: impersonationBaseUrl });
     }
     let inner = null;
     if (userUid && status === "checking") {

package/dist/apps/shared/mail/decryptedMessages.d.ts

@@ -9,6 +9,14 @@ export interface DecryptedMessage {
     subject?: string;
     preview?: string;
 }
+/** Whether decrypting this message already came to nothing since the keys were last unlocked, recently enough that trying again would only repeat it. */
+export declare function decryptFailedBefore(uid: string): boolean;
+/** Remembers that decrypting this message came to nothing, so a list that refreshes does not download and try it again each time. */
+export declare function markDecryptFailed(uid: string): void;
+/** Forgets everything remembered about messages that could not be decrypted (sign-out, an account switch). */
+export declare function clearDecryptedMessages(): void;
+/** Runs `task` over `items` with at most `limit` running at once, resolving to the results in the order of `items`. */
+export declare function mapWithConcurrency<T, R>(items: T[], limit: number, task: (item: T) => Promise<R>): Promise<R[]>;
 /** Plain text of decrypted HTML for a one-line preview. Only ever feeds text display, never markup. */
 export declare function previewOf(html: string): string;
 /** Remembers what was recovered of one message. Ignored when there is nothing new to show. */

package/dist/apps/shared/mail/decryptedMessages.js

@@ -5,12 +5,52 @@
 import { useSyncExternalStore } from "react";
 import { getUnlockedKeys, subscribeKeySession } from "../../../lib/crypto/keySession.js";
 import { getMessageRawContent } from "../../../lib/mail/mailApi.js";
+import { onSigningOut } from "../components/mail/compose/composeFlushRegistry.js";
 const PREVIEW_MAX_LENGTH = 160;
 let entries = {};
 /** Bumped whenever a mailbox's keys are unlocked, so a view can retry decrypting what it couldn't before. */
 let unlockEpoch = 0;
 const listeners = new Set();
 const inFlight = new Set();
+/** How long a message that could not be decrypted is left alone before it is tried again (it is also tried again after any unlock). */
+const DECRYPT_RETRY_MS = 10 * 60000;
+/** How many such messages are remembered. */
+const MAX_FAILED = 1000;
+/** The messages whose decrypting came to nothing (fetch failed, not for this key, nothing readable), by uid: when and in which unlock epoch. */
+const failed = new Map();
+/** Whether decrypting this message already came to nothing since the keys were last unlocked, recently enough that trying again would only repeat it. */
+export function decryptFailedBefore(uid) {
+    const known = failed.get(uid);
+    return !!known && known.epoch === unlockEpoch && Date.now() - known.at < DECRYPT_RETRY_MS;
+}
+/** Remembers that decrypting this message came to nothing, so a list that refreshes does not download and try it again each time. */
+export function markDecryptFailed(uid) {
+    failed.delete(uid);
+    if (failed.size >= MAX_FAILED) {
+        failed.delete(failed.keys().next().value);
+    }
+    failed.set(uid, { epoch: unlockEpoch, at: Date.now() });
+}
+/** Forgets everything remembered about messages that could not be decrypted (sign-out, an account switch). */
+export function clearDecryptedMessages() {
+    entries = {};
+    failed.clear();
+    emit();
+}
+onSigningOut(clearDecryptedMessages);
+/** Runs `task` over `items` with at most `limit` running at once, resolving to the results in the order of `items`. */
+export async function mapWithConcurrency(items, limit, task) {
+    const results = new Array(items.length);
+    let next = 0;
+    async function worker() {
+        while (next < items.length) {
+            const index = next++;
+            results[index] = await task(items[index]);
+        }
+    }
+    await Promise.all(Array.from({ length: Math.min(limit, items.length) }, worker));
+    return results;
+}
 function emit() {
     for (const listener of [...listeners]) {
         listener();
@@ -75,7 +115,7 @@ export function useUnlockEpoch() {
  */
 export async function decryptForDisplay(uid, mailboxUid) {
     const unlocked = getUnlockedKeys(mailboxUid);
-    if (!unlocked || entries[uid] || inFlight.has(uid)) {
+    if (!unlocked || entries[uid] || inFlight.has(uid) || decryptFailedBefore(uid)) {
         return;
     }
     inFlight.add(uid);
@@ -86,10 +126,14 @@ export async function decryptForDisplay(uid, mailboxUid) {
         // A lock while this ran: the result must not go back on screen.
         if (getUnlockedKeys(mailboxUid) === unlocked) {
             rememberDecrypted(uid, mailboxUid, { subject: security.subject, preview: security.html ? previewOf(security.html) : security.text?.slice(0, PREVIEW_MAX_LENGTH) });
+            if (!security.subject && !security.html && !security.text) {
+                markDecryptFailed(uid);
+            }
         }
     }
     catch {
-        // Left as the placeholder.
+        // Left as the placeholder - and not fetched again until the next unlock.
+        markDecryptFailed(uid);
     }
     finally {
         inFlight.delete(uid);

package/dist/apps/shared/mail/listSnapshots.js

@@ -1,3 +1,4 @@
+import { onSigningOut } from "../components/mail/compose/composeFlushRegistry.js";
 /** How long a snapshot may be shown after it was last written. Longer than that the folder is shown as loading, as before. */
 export const LIST_SNAPSHOT_TTL_MS = 5 * 60000;
 /** How many folders are remembered; the least recently written is dropped first. */
@@ -41,3 +42,4 @@ export function saveListScroll(key, scrollTop) {
 export function clearListSnapshots() {
     snapshots.clear();
 }
+onSigningOut(clearListSnapshots);

package/dist/apps/shared/mail/outbox/sendDecision.d.ts

@@ -73,8 +73,11 @@ export interface SendDecisionInput {
  * can choose, or rejected outright. Used twice with the same rules - by the compose window, from what it already knows, to catch a problem
  * *before* it closes (`lookupsComplete: false`), and by the background send, once its recipient lookups are in.
  *
- * Encryption follows `evaluateEncryptionRequirement()` - fail open: only a message the user asked to encrypt, or one the loaded policy
- * encrypts, is encrypted; everything unknown is plain and sends. The one place unknown blocks is a message the user *explicitly* asked to
- * encrypt whose recipients' keys could not be looked up: they asked for encryption, and it cannot be delivered.
+ * Encryption follows `evaluateEncryptionRequirement()`. The compose window's early check (`lookupsComplete: false`) is fail open: only a message
+ * the user asked to encrypt, or one the loaded policy encrypts, is encrypted there; everything unknown is plain, so a flapping gateway never
+ * blocks a draft or Close. The background send (`lookupsComplete: true`) is not: once its loads are in, a message that might have to be encrypted
+ * because the policy or a recipient's key could not be checked (the sender having a key to encrypt with) is blocked (`lookup-failed`) rather than
+ * sent in the clear - and so is one the user *explicitly* asked to encrypt whose recipients' keys could not be looked up. Either way the sender can
+ * choose to send it without encryption.
  */
 export declare function decideSend(input: SendDecisionInput): SendDecision;

package/dist/apps/shared/mail/outbox/sendDecision.js

@@ -25,9 +25,12 @@ export const INLINE_IMAGES_UNSUPPORTED_MESSAGE = "A signed or encrypted message
  * can choose, or rejected outright. Used twice with the same rules - by the compose window, from what it already knows, to catch a problem
  * *before* it closes (`lookupsComplete: false`), and by the background send, once its recipient lookups are in.
  *
- * Encryption follows `evaluateEncryptionRequirement()` - fail open: only a message the user asked to encrypt, or one the loaded policy
- * encrypts, is encrypted; everything unknown is plain and sends. The one place unknown blocks is a message the user *explicitly* asked to
- * encrypt whose recipients' keys could not be looked up: they asked for encryption, and it cannot be delivered.
+ * Encryption follows `evaluateEncryptionRequirement()`. The compose window's early check (`lookupsComplete: false`) is fail open: only a message
+ * the user asked to encrypt, or one the loaded policy encrypts, is encrypted there; everything unknown is plain, so a flapping gateway never
+ * blocks a draft or Close. The background send (`lookupsComplete: true`) is not: once its loads are in, a message that might have to be encrypted
+ * because the policy or a recipient's key could not be checked (the sender having a key to encrypt with) is blocked (`lookup-failed`) rather than
+ * sent in the clear - and so is one the user *explicitly* asked to encrypt whose recipients' keys could not be looked up. Either way the sender can
+ * choose to send it without encryption.
  */
 export function decideSend(input) {
     const { keys } = input;
@@ -60,6 +63,13 @@ export function decideSend(input) {
         recipients: input.recipients,
     });
     const encrypting = requirement.required;
+    if (!encrypting && input.lookupsComplete && requirement.unknown.some((fact) => fact !== "mailbox")) {
+        // The sender has a key to encrypt with, the loads are all in (or gave up), and the policy or a recipient's key is still unknown: the message
+        // might have to be encrypted, and plaintext must not go out on a guess. The sender can still choose to send it without encryption. (An unknown
+        // *mailbox* is not one of these: with no key known there is nothing to say encryption applies, and a mailbox that will not load must not
+        // stop everyone's mail.)
+        return { action: "blocked", block: { kind: "lookup-failed", message: LOOKUP_UNAVAILABLE_MESSAGE, overrideLabel: "Send without encryption", keysLocked: false } };
+    }
     if (encrypting) {
         const statuses = input.recipients.filter((status) => !!status);
         const allResolved = statuses.length === input.recipients.length;