@rapidmx/web-client 0.30.0 → 0.31.0

package/dist/apps/www/index.js

@@ -21,6 +21,7 @@ import { searchLocalIndex } from "../shared/search/searchTier2.js";
 import { SEARCH_LIMITS, classifyFailure, describeFailures, hitKey, mergeSearchResults, runLimited, searchPageSize, tagHits, withTimeout, } from "../shared/search/crossMailboxSearch.js";
 import { getUnlockedKeys, subscribeKeySession } from "../../lib/crypto/keySession.js";
 import { useMessageAttachments } from "../../lib/mail/mailDetailHooks.js";
+import { settleWithLimit } from "../../lib/util/settleWithLimit.js";
 import useIsMobile from "../../lib/util/useIsMobile.js";
 import MailShell, { useMailShell, } from "../shared/components/mail/layout/MailShell.js";
 import MailAddress from "../shared/components/mail/MailAddress.js";
@@ -34,7 +35,7 @@ import { setReadStateMany } from "../shared/mail/messageReadState.js";
 import { useMarkMessageRead } from "../shared/mail/useMarkMessageRead.js";
 import { ROW_FOCUS_CLASS, UnreadBar, UnreadLabel, dateClass, isUnread, rowClass, senderClass, subjectClass } from "../shared/components/mail/unreadStyle.js";
 import { LazyConversationThreadPane, LazyMessageDetailPane, prefetchReadingPane } from "../shared/components/mail/LazyReadingPane.js";
-import { rememberDecrypted } from "../shared/mail/decryptedMessages.js";
+import { decryptFailedBefore, mapWithConcurrency, markDecryptFailed, rememberDecrypted } from "../shared/mail/decryptedMessages.js";
 import ConversationList, { conversationRowKey } from "../shared/components/mail/ConversationList.js";
 import SwipeRow from "../shared/components/mail/SwipeRow.js";
 import InviteRowChip from "../shared/components/mail/invite/InviteRowChip.js";
@@ -57,6 +58,8 @@ import { notifyApiError } from "../shared/notifications/apiErrors.js";
 const MESSAGE_PAGE_SIZE = 50;
 const SEARCH_DEBOUNCE_MS = 300;
 const LIST_PREVIEW_MAX_LENGTH = 160;
+/** How many encrypted rows are fetched and decrypted at once. */
+const DECRYPT_CONCURRENCY = 4;
 /** The literal outer-envelope `Subject` every encrypted message carries server-side - RFC 9788's
  * `hcp_baseline` policy obscures it to this exact string (see `smimeMessage.ts`'s
  * `applyBaselineOuterHeaders()`), which is also all `Message.subject` ever shows for one of these until
@@ -90,10 +93,12 @@ function stripHtmlToText(html) {
  * and `handleUnlockList()`), and a single row's fetch/decrypt failure never blocks the rest.
  */
 async function decryptEncryptedRows(messages, unlocked) {
-    const encrypted = messages.filter((m) => m.subject === ENCRYPTED_SUBJECT_PLACEHOLDER);
+    // A row that already came to nothing since the last unlock is not downloaded again by every refresh of the list.
+    const encrypted = messages.filter((m) => m.subject === ENCRYPTED_SUBJECT_PLACEHOLDER && !decryptFailedBefore(m.uid));
     // Imported once for all the rows, by whichever needs it first.
     let securityModule;
-    const entries = await Promise.all(encrypted.map(async (message) => {
+    // A few at a time: each is a download and a public-key decryption.
+    const entries = await mapWithConcurrency(encrypted, DECRYPT_CONCURRENCY, async (message) => {
         try {
             const rawMime = await getMessageRawContent(message.uid);
             // Loaded here, on first use: the S/MIME code (PKI.js, ASN.1, X.509) is over half a megabyte and an inbox with
@@ -101,6 +106,7 @@ async function decryptEncryptedRows(messages, unlocked) {
             const { evaluateMessageSecurity } = await (securityModule ?? (securityModule = import("../../lib/crypto/messageSecurity.js")));
             const security = await evaluateMessageSecurity(rawMime, unlocked);
             if (!security.subject && !security.html) {
+                markDecryptFailed(message.uid);
                 return null;
             }
             const preview = security.html ? stripHtmlToText(security.html).slice(0, LIST_PREVIEW_MAX_LENGTH) : undefined;
@@ -108,9 +114,10 @@ async function decryptEncryptedRows(messages, unlocked) {
             return [message.uid, { subject: security.subject, preview }];
         }
         catch {
+            markDecryptFailed(message.uid);
             return null;
         }
-    }));
+    });
     const result = {};
     for (const entry of entries) {
         if (entry) {
@@ -319,6 +326,10 @@ function appendUnseenRows(shown, more, idOf, cap) {
 }
 const messageUid = (message) => message.uid;
 const conversationKey = conversationRowKey;
+/** How many conversations' messages are requested at once when many are ticked together (Select all on a long list). */
+const RESOLVE_CONVERSATIONS_AT_ONCE = 5;
+/** What of a conversation's summary changes when one of its messages does: a different one means the messages fetched for it are out of date. */
+const conversationSignature = (row) => [row.messageUids.join(","), row.unreadCount, row.flagged, row.folderUids.join(","), row.latestFolderUid].join("|");
 /** Flattens and sorts a per-mailbox fetch into one merged, newest-first list - the aggregate ("All
  * Inboxes" etc.) equivalent of `mergeSearchResults()` above, but simpler: an aggregated message has no
  * natural relevance score to normalize, so this only ever sorts by `receivedDate`. */
@@ -330,7 +341,9 @@ function mergeInboxMessages(perMailbox) {
 /**
  * Fans out one `listMessages()` call per accessible mailbox that has a folder of `type`, merges the
  * results newest-first. A mailbox with no matching folder, or whose fetch fails, simply contributes
- * nothing - one mailbox's absence/failure must not blank out every other mailbox's messages.
+ * nothing - one mailbox's absence/failure must not blank out every other mailbox's messages. `listed`, the
+ * rows on screen when this is a refresh of them, makes a mailbox whose fetch fails keep the rows it has there
+ * instead of contributing none (a timeout must not make its mail vanish until the next success).
  *
  * **Pagination scope trim (deliberate, matching this file's own documented Tier 2/3 tradeoffs)**: there is
  * no composite cursor across an arbitrary number of independently-paginated mailboxes in this pass - this
@@ -339,7 +352,7 @@ function mergeInboxMessages(perMailbox) {
  * composite-cursor "load more" per mailbox is a natural v2 if usage shows people scrolling past the first
  * page in aggregate view often.
  */
-async function fetchAggregateMessages(mailboxFolders, type, filter, client) {
+async function fetchAggregateMessages(mailboxFolders, type, filter, client, listed) {
     const perMailbox = await Promise.all(mailboxFolders.map(async ({ mailbox, folders }) => {
         const folder = folders.find((f) => f.type === type);
         if (!folder) {
@@ -349,7 +362,7 @@ async function fetchAggregateMessages(mailboxFolders, type, filter, client) {
         // this function's own pagination scope trim) - each mailbox contributes its own newest page and
         // they're merged newest-first, which a different sort key couldn't be made honest across an
         // arbitrary number of independently-paged folders.
-        const messages = await listMessages(folder.uid, { limit: MESSAGE_PAGE_SIZE, filter }, client).catch(() => []);
+        const messages = await listMessages(folder.uid, { limit: MESSAGE_PAGE_SIZE, filter }, client).catch(() => (listed ?? []).filter((m) => m.mailboxUid === mailbox.uid));
         return { mailbox, messages };
     }));
     return mergeInboxMessages(perMailbox);
@@ -358,16 +371,17 @@ async function fetchAggregateMessages(mailboxFolders, type, filter, client) {
  * The conversation-list counterpart of `fetchAggregateMessages()`: one `listConversations()` per accessible mailbox that has a folder of
  * `type`, each scoped to *that folder* (so "All Inboxes" groups only Inbox mail - not the Sent Items copy of a reply, which a mailbox-wide
  * grouping pulls in) and each row tagged with its mailbox, then merged newest activity first. Same first-page-only scope, and the same
- * rule that a mailbox that has no such folder or fails to answer contributes nothing rather than blanking the rest.
+ * rule that a mailbox that has no such folder or fails to answer contributes nothing rather than blanking the rest - or, with `listed` (the rows on
+ * screen, for a refresh of them), keeps the rows it has there.
  */
-async function fetchAggregateConversations(mailboxFolders, type, params, client) {
+async function fetchAggregateConversations(mailboxFolders, type, params, client, listed) {
     const perMailbox = await Promise.all(mailboxFolders.map(async ({ mailbox, folders }) => {
         const folder = folders.find((f) => f.type === type);
         if (!folder) {
             return [];
         }
-        const rows = await listConversations(mailbox.uid, { ...params, folderUid: folder.uid, page: 0 }, client).catch(() => []);
-        return rows.map((row) => ({ ...row, mailboxUid: mailbox.uid }));
+        const rows = await listConversations(mailbox.uid, { ...params, folderUid: folder.uid, page: 0 }, client).catch(() => null);
+        return rows ? rows.map((row) => ({ ...row, mailboxUid: mailbox.uid })) : (listed ?? []).filter((row) => row.mailboxUid === mailbox.uid);
     }));
     return perMailbox.flat().sort((a, b) => Date.parse(b.latestDate) - Date.parse(a.latestDate));
 }
@@ -621,6 +635,8 @@ function InboxContent({ userUid }) {
     messagesRef.current = messages;
     const conversationsRef = useRef(conversations);
     conversationsRef.current = conversations;
+    const selectedConversationIdsRef = useRef(selectedConversationIds);
+    selectedConversationIdsRef.current = selectedConversationIds;
     // Reset to a fresh Map at the start of every new search pass (see the search effect below) - see
     // resolveHitsToMessages()'s own doc comment on why this needs to persist *within* one pass but not
     // across passes (a stale `null` for a uid that's since become resolvable elsewhere must not stick).
@@ -1256,8 +1272,9 @@ function InboxContent({ userUid }) {
             try {
                 if (asConversations && aggregateFolderType) {
                     // No paging here either: the fresh merged first pages are the list.
-                    const fresh = await fetchAggregateConversations(mailboxFolders, aggregateFolderType, conversationParams(0), client);
+                    const fresh = await fetchAggregateConversations(mailboxFolders, aggregateFolderType, conversationParams(0), client, conversationsRef.current);
                     if (isCurrent()) {
+                        refreshConversationMessages(conversationsRef.current, fresh);
                         setConversations(fresh);
                     }
                 }
@@ -1267,13 +1284,14 @@ function InboxContent({ userUid }) {
                         return;
                     }
                     const merged = mergeFirstPage(conversationsRef.current, fresh, conversationKey, MESSAGE_PAGE_SIZE);
+                    refreshConversationMessages(conversationsRef.current, merged.rows);
                     setConversations(merged.rows);
                     listedOffsetRef.current = merged.complete ? fresh.length : listedOffsetRef.current + merged.added;
                     setHasMore(!merged.complete);
                 }
                 else if (aggregateFolderType) {
                     // No paging here (see `fetchAggregateMessages()`): the fresh merged first pages are the list.
-                    const fresh = await fetchAggregateMessages(mailboxFolders, aggregateFolderType, effectiveFilter, client);
+                    const fresh = await fetchAggregateMessages(mailboxFolders, aggregateFolderType, effectiveFilter, client, messagesRef.current);
                     if (isCurrent()) {
                         setMessages(fresh);
                     }
@@ -1685,35 +1703,66 @@ function InboxContent({ userUid }) {
             return next;
         });
     }
-    /** Loads (once) the messages behind each of `ids`, so a ticked conversation resolves to the messages
-     * every bulk action below acts on. If any of them fails to load, none of that batch stays ticked and
-     * a pop-up says why - better than acting on the part of a selection that happened to arrive. */
-    async function resolveConversations(rows) {
-        const missing = rows.filter((row) => !conversationMessagesById[conversationKey(row)]);
+    /** Loads (once, or again with `refetch`) the messages behind each of `rows`, so a ticked conversation resolves to the messages
+     * every bulk action below acts on - a few requests at a time (Select all on a long list is hundreds of rows). A conversation
+     * that fails to load is unticked, with one pop-up saying why - better than acting on a part of it - and the rest stay ticked.
+     * What arrives after the list was loaded again is dropped: those rows are gone. */
+    async function resolveConversations(rows, refetch = false) {
+        const missing = rows.filter((row) => refetch || !conversationMessagesById[conversationKey(row)]);
         if (missing.length === 0) {
             return;
         }
+        const listRun = searchRunIdRef.current;
         setResolvingSelection((n) => n + 1);
         try {
-            const loaded = await Promise.all(
+            const outcomes = await settleWithLimit(missing, RESOLVE_CONVERSATIONS_AT_ONCE, (row) => 
             // A row of the "All mailboxes" view names its own mailbox; any other list is the open mailbox's.
-            missing.map(async (row) => [conversationKey(row), await listConversationMessages(row.mailboxUid ?? activeMailboxUid, row.conversationId, {}, client)]));
-            setConversationMessagesById((prev) => ({ ...prev, ...Object.fromEntries(loaded) }));
-        }
-        catch (err) {
-            notifyApiError(err, "Couldn't load the messages in one of those conversations");
-            setSelectedConversationIds((prev) => {
-                const next = new Set(prev);
-                for (const row of missing) {
-                    next.delete(conversationKey(row));
+            searchRunIdRef.current === listRun
+                ? listConversationMessages(row.mailboxUid ?? activeMailboxUid, row.conversationId, {}, client)
+                : Promise.reject(new Error("The list was loaded again")));
+            if (searchRunIdRef.current !== listRun) {
+                return;
+            }
+            const loaded = {};
+            const failed = new Set();
+            let firstFailure;
+            outcomes.forEach((outcome, index) => {
+                const key = conversationKey(missing[index]);
+                if (outcome.status === "fulfilled") {
+                    loaded[key] = outcome.value;
+                }
+                else {
+                    failed.add(key);
+                    firstFailure ?? (firstFailure = outcome.reason);
                 }
-                return next;
             });
+            setConversationMessagesById((prev) => ({ ...prev, ...loaded }));
+            if (failed.size > 0) {
+                notifyApiError(firstFailure, "Couldn't load the messages in one of those conversations");
+                setSelectedConversationIds((prev) => new Set([...prev].filter((key) => !failed.has(key))));
+            }
         }
         finally {
             setResolvingSelection((n) => n - 1);
         }
     }
+    /**
+     * Called as a refresh of the list swaps in `after` for `before`: the messages kept for a conversation whose summary changed (a reply arrived, a
+     * message was read or moved) are out of date - the next action on it would act on a list missing the new message, or send an old `version`. The
+     * cached messages of one that is not ticked are dropped, to be fetched when next wanted; a ticked one's are fetched again now, the old ones standing
+     * until they arrive.
+     */
+    function refreshConversationMessages(before, after) {
+        const was = new Map(before.map((row) => [conversationKey(row), conversationSignature(row)]));
+        const changed = after.filter((row) => was.has(conversationKey(row)) && was.get(conversationKey(row)) !== conversationSignature(row));
+        if (changed.length === 0) {
+            return;
+        }
+        const ticked = changed.filter((row) => selectedConversationIdsRef.current.has(conversationKey(row)));
+        const stale = new Set(changed.filter((row) => !ticked.includes(row)).flatMap((row) => [conversationKey(row), row.conversationId]));
+        setConversationMessagesById((prev) => Object.fromEntries(Object.entries(prev).filter(([key]) => !stale.has(key))));
+        void resolveConversations(ticked, true);
+    }
     function toggleConversationSelected(conversation) {
         const id = conversationKey(conversation);
         const ticking = !selectedConversationIds.has(id);
@@ -1955,7 +2004,7 @@ function InboxContent({ userUid }) {
     }
     /** Empty folder: permanently deletes everything in the folder being listed (Deleted Items or Junk Email) after the reader has confirmed. */
     async function emptyListedFolder(folder, count) {
-        const outcome = await permanent.requestEmptyFolder({ uid: folder.uid, name: folder.name }, count);
+        const outcome = await permanent.requestEmptyFolder(folder, count);
         if (!outcome) {
             return;
         }
@@ -2325,6 +2374,12 @@ function InboxContent({ userUid }) {
             uid: emptiableFolders[0].uid,
             name: aggregateFolderType ? (emptiableFolders[0].type === "junk" ? "Junk Email" : "Deleted Items") : emptiableFolders[0].name,
             uids: aggregateFolderType ? emptiableFolders.map((f) => f.uid) : undefined,
+            // The mailboxes whose folders these are, for the confirmation to name (it empties each of them, a share included).
+            scope: aggregateFolderType
+                ? mailboxFolders
+                    .filter((entry) => entry.folders.some((f) => f.type === aggregateFolderType))
+                    .map(({ mailbox }) => `${mailbox.displayName}${mailbox.ownerUserUid ? "" : " (shared)"}`)
+                : undefined,
         };
     // How many it holds as the sidebar's counts have it (kept right as messages leave), unless that says none while the list shows some.
     const emptiableTotal = emptiableFolders.reduce((sum, f) => sum + folderCountOf(f).total, 0);

package/dist/apps/www/messages/[uid].js

@@ -34,12 +34,17 @@ function MessageDetailContent({ uid }) {
     const [labels, setLabels] = useState([]);
     const conversationId = useSearchParams()[0].get("conversation");
     useEffect(() => {
+        // An answer for a message since replaced (the uid changed without the page remounting) must not be shown as the current one.
+        let cancelled = false;
         setLoading(true);
         setError(null);
         getMessage(uid, client)
-            .then(setMessage)
-            .catch((err) => setError(err instanceof ApiRequestError ? err.message : "Could not load this message."))
-            .finally(() => setLoading(false));
+            .then((loaded) => !cancelled && setMessage(loaded))
+            .catch((err) => !cancelled && setError(err instanceof ApiRequestError ? err.message : "Could not load this message."))
+            .finally(() => !cancelled && setLoading(false));
+        return () => {
+            cancelled = true;
+        };
     }, [uid, client]);
     // See `apps/www/index.tsx`'s identical effect's own doc comment - a failure here just hides the
     // Labels control rather than blocking the rest of the page. Keyed on the message's own mailbox, not the

package/dist/apps/www/settings/auto-reply/index.js

@@ -10,6 +10,7 @@ import { updateMailbox } from "../../../../lib/mail/mailApi.js";
 import { useApiClient } from "../../../../lib/util/apiClientContext.js";
 import SettingsShell, { useSettingsShell } from "../../../shared/components/settings/layout/SettingsShell.js";
 import Button from "../../../../lib/components/buttons/Button.js";
+import Alert from "../../../../lib/components/feedback/Alert.js";
 import { notifyApiError } from "../../../shared/notifications/apiErrors.js";
 const INPUT_CLASS = "w-full text-sm py-2 px-3 border border-border rounded-sm bg-surface text-text focus:outline-none focus:border-primary";
 function SettingsAutoReplyPage(props) {
@@ -31,9 +32,20 @@ function AutoReplyContent() {
     const [version, setVersion] = useState(mailbox.version);
     const [saving, setSaving] = useState(false);
     const [saved, setSaved] = useState(false);
+    const [error, setError] = useState(null);
     async function handleSubmit(e) {
         e.preventDefault();
         setSaved(false);
+        // Turned on with nothing to send, or over a window that ends before it starts, would answer people with an empty message or never at all.
+        if (oofEnabled && !oofMessage.trim()) {
+            setError("Write the message to send while automatic replies are on.");
+            return;
+        }
+        if (oofEnabled && oofStartTime && oofEndTime && new Date(oofEndTime) <= new Date(oofStartTime)) {
+            setError("The end must be after the start.");
+            return;
+        }
+        setError(null);
         setSaving(true);
         try {
             const updated = await updateMailbox({
@@ -55,7 +67,7 @@ function AutoReplyContent() {
             setSaving(false);
         }
     }
-    return (_jsx("div", { className: "flex-1 min-w-0 overflow-y-auto p-6", children: _jsxs("div", { className: "max-w-xl", children: [_jsx("h1", { className: "text-lg font-bold tracking-tight mb-1", children: "Automatic Replies" }), _jsxs("p", { className: "text-sm text-text-muted mb-4", children: ["Send an automatic reply to anyone who emails ", mailbox.displayName, " while you\u2019re away. A calendar event with its own automatic reply enabled takes over for its own start/end window."] }), saved && _jsx("div", { className: "mb-4 text-sm text-success font-medium", children: "Saved." }), _jsxs("form", { onSubmit: handleSubmit, className: "flex flex-col gap-4", children: [_jsxs("label", { className: "flex items-center gap-2 text-sm font-medium", children: [_jsx("input", { type: "checkbox", checked: oofEnabled, onChange: (e) => setOofEnabled(e.target.checked) }), "Automatic replies are on"] }), oofEnabled && (_jsxs(_Fragment, { children: [_jsxs("label", { className: "flex flex-col gap-1.5 text-sm", children: [_jsx("span", { className: "font-semibold", children: "Message" }), _jsx("textarea", { "aria-label": "Automatic reply message", className: INPUT_CLASS, rows: 5, value: oofMessage, onChange: (e) => setOofMessage(e.target.value) })] }), _jsxs("div", { className: "grid grid-cols-2 gap-3", children: [_jsxs("label", { className: "flex flex-col gap-1.5 text-sm", children: [_jsx("span", { className: "font-semibold", children: "Start (optional)" }), _jsx("input", { type: "datetime-local", "aria-label": "Automatic reply start", className: INPUT_CLASS, value: oofStartTime, onChange: (e) => setOofStartTime(e.target.value) })] }), _jsxs("label", { className: "flex flex-col gap-1.5 text-sm", children: [_jsx("span", { className: "font-semibold", children: "End (optional)" }), _jsx("input", { type: "datetime-local", "aria-label": "Automatic reply end", className: INPUT_CLASS, value: oofEndTime, onChange: (e) => setOofEndTime(e.target.value) })] })] }), _jsx("p", { className: "text-xs text-text-muted -mt-2", children: "Leave both blank to stay on indefinitely until turned off." })] })), _jsx("div", { children: _jsx(Button, { type: "submit", loading: saving, disabled: saving, className: "!w-auto", children: "Save" }) })] })] }) }));
+    return (_jsx("div", { className: "flex-1 min-w-0 overflow-y-auto p-6", children: _jsxs("div", { className: "max-w-xl", children: [_jsx("h1", { className: "text-lg font-bold tracking-tight mb-1", children: "Automatic Replies" }), _jsxs("p", { className: "text-sm text-text-muted mb-4", children: ["Send an automatic reply to anyone who emails ", mailbox.displayName, " while you\u2019re away. A calendar event with its own automatic reply enabled takes over for its own start/end window."] }), saved && _jsx("div", { className: "mb-4 text-sm text-success font-medium", children: "Saved." }), error && _jsx(Alert, { children: error }), _jsxs("form", { onSubmit: handleSubmit, className: "flex flex-col gap-4", children: [_jsxs("label", { className: "flex items-center gap-2 text-sm font-medium", children: [_jsx("input", { type: "checkbox", checked: oofEnabled, onChange: (e) => setOofEnabled(e.target.checked) }), "Automatic replies are on"] }), oofEnabled && (_jsxs(_Fragment, { children: [_jsxs("label", { className: "flex flex-col gap-1.5 text-sm", children: [_jsx("span", { className: "font-semibold", children: "Message" }), _jsx("textarea", { "aria-label": "Automatic reply message", className: INPUT_CLASS, rows: 5, value: oofMessage, onChange: (e) => setOofMessage(e.target.value) })] }), _jsxs("div", { className: "grid grid-cols-2 gap-3", children: [_jsxs("label", { className: "flex flex-col gap-1.5 text-sm", children: [_jsx("span", { className: "font-semibold", children: "Start (optional)" }), _jsx("input", { type: "datetime-local", "aria-label": "Automatic reply start", className: INPUT_CLASS, value: oofStartTime, onChange: (e) => setOofStartTime(e.target.value) })] }), _jsxs("label", { className: "flex flex-col gap-1.5 text-sm", children: [_jsx("span", { className: "font-semibold", children: "End (optional)" }), _jsx("input", { type: "datetime-local", "aria-label": "Automatic reply end", className: INPUT_CLASS, value: oofEndTime, onChange: (e) => setOofEndTime(e.target.value) })] })] }), _jsx("p", { className: "text-xs text-text-muted -mt-2", children: "Leave both blank to stay on indefinitely until turned off." })] })), _jsx("div", { children: _jsx(Button, { type: "submit", loading: saving, disabled: saving, className: "!w-auto", children: "Save" }) })] })] }) }));
 }
 export default SettingsAutoReplyPage;
 /** The tab's title: `Brand: Settings` (see `pageTitle()`). */

package/dist/apps/www/settings/blocked-senders/index.js

@@ -61,6 +61,10 @@ function ListSection({ kind, entries, otherEntries, ownAddresses, editable, onAd
             setError("That is one of your own addresses, so it cannot be blocked.");
             return;
         }
+        if (kind === "blocked" && checked.entry.startsWith("@") && ownAddresses.some((address) => address.toLowerCase().endsWith(checked.entry))) {
+            setError("That is your own domain: blocking it would send the mail of everyone at it - yours included - to Junk.");
+            return;
+        }
         setError(null);
         setBusy(true);
         try {

package/dist/apps/www/settings/encryption/index.js

@@ -18,6 +18,7 @@ import { getMailbox } from "../../../../lib/mail/mailApi.js";
 import { useApiClient } from "../../../../lib/util/apiClientContext.js";
 import SettingsShell, { useSettingsShell } from "../../../shared/components/settings/layout/SettingsShell.js";
 import KeyEnrollmentGate from "../../../shared/components/layout/KeyEnrollmentGate.js";
+import { MIN_PASSWORD_LENGTH } from "../../../shared/components/layout/RecoveryCodeUnlock.js";
 import { useUnlockPrompt } from "../../../shared/components/layout/UnlockPromptProvider.js";
 import { destroyLocalIndex } from "../../../shared/search/localIndexRpcClient.js";
 import { notifyApiError } from "../../../shared/notifications/apiErrors.js";
@@ -29,7 +30,6 @@ import { readStoredSignEnrollment, storeSignEnrollment } from "../../../shared/s
 import { checkEnrollmentNow, forgetEnrollment, recordEnrollmentResult, useEnrollmentSnapshot, watchCurrentEnrollment, watchEnrollment, } from "../../../shared/signing/enrollmentTracker.js";
 import { STALE_REQUEST_TEXT, beforeRequestText, healthWarning, isInstalling, timeOf } from "../../../shared/signing/enrollmentView.js";
 import { useSigningEnrollmentInfo } from "../../../shared/signing/signingInfo.js";
-const MIN_PASSWORD_LENGTH = 8;
 /** Mirrors restapi's `BaseKeyVaultRoute` `MAX_MASTER_KEY_WRAPS` - `addMasterKeyWrap()` refuses a vault
  * already holding this many wraps (escrow included). */
 export const MAX_MASTER_KEY_WRAPS = 20;
@@ -185,6 +185,7 @@ function EncryptionContent({ canManageKeys }) {
     // Distinguishes the "Save your new recovery codes" screen's copy for the two different actions that
     // land on it - a plain regeneration only invalidates old recovery codes, while a rotation also
     // invalidates every other unlock method, which the copy needs to say plainly.
+    const [confirmingRotation, setConfirmingRotation] = useState(false);
     const [recoveryCodesReason, setRecoveryCodesReason] = useState("regenerate");
     const [codesSaved, setCodesSaved] = useState(false);
     const [codesCopied, setCodesCopied] = useState(false);
@@ -228,6 +229,7 @@ function EncryptionContent({ canManageKeys }) {
     const hasEscrowWrap = vault?.masterKeyWraps.some((w) => w.method === "escrow") ?? false;
     const [wrappingEscrow, setWrappingEscrow] = useState(false);
     const [escrowError, setEscrowError] = useState(null);
+    const [pendingEscrow, setPendingEscrow] = useState(null);
     /**
      * This mailbox's unlocked keys *right now* - never a copy read at render time, which a lock (idle
      * timeout, another tab's sign-out) may since have destroyed. Prompts for the password when locked;
@@ -270,13 +272,29 @@ function EncryptionContent({ canManageKeys }) {
         }
         return err instanceof ApiRequestError ? err.message : fallback;
     }
+    /** Looks up the certificate the server says this mailbox's escrow scope holds, and asks the owner to confirm it
+     * before the master key is wrapped to it: nothing else vouches for that certificate, and whoever holds its
+     * private key can read this mailbox's encrypted mail. */
     async function handleWrapEscrow() {
         setEscrowError(null);
         setWrappingEscrow(true);
         try {
             // Only reachable when mailbox.escrowScopeId is set (see the render guard below).
+            await verifiedUnlockedKeys();
+            setPendingEscrow(await getEscrowInfo(mailboxUid, client));
+        }
+        catch (err) {
+            setEscrowError(errorMessage(err, "Could not add escrow protection for this mailbox."));
+        }
+        finally {
+            setWrappingEscrow(false);
+        }
+    }
+    async function handleConfirmEscrow(escrowInfo) {
+        setPendingEscrow(null);
+        setWrappingEscrow(true);
+        try {
             const { current } = await verifiedUnlockedKeys();
-            const escrowInfo = await getEscrowInfo(mailboxUid, client);
             const wrap = await buildEscrowWrap(current.masterKey, escrowInfo.escrowScopeId, fromBase64(escrowInfo.publicKey.publicKey));
             await addMasterKeyWrap(mailboxUid, wrap, undefined, client);
             await loadVault();
@@ -635,7 +653,7 @@ function EncryptionContent({ canManageKeys }) {
      * working the instant this succeeds, since `rekey()` replaces `masterKeyWraps` wholesale - the whole
      * point, for a captured-wrap scenario where it's unclear which method was compromised.
      */
-    async function handleRotateKeys(e) {
+    function handleRotateKeys(e) {
         e.preventDefault();
         if (rotationBlockedBySigning) {
             // The form's controls are disabled in this state too; this also covers an implicit submit.
@@ -650,6 +668,12 @@ function EncryptionContent({ canManageKeys }) {
             return;
         }
         setActionError(null);
+        // One press must not end every other unlock method and every other device's password: say so, and wait for a yes.
+        setConfirmingRotation(true);
+    }
+    async function rotateKeys() {
+        setConfirmingRotation(false);
+        setActionError(null);
         setEscrowError(null);
         setRotating(true);
         let keys;
@@ -775,12 +799,12 @@ function EncryptionContent({ canManageKeys }) {
                     : null;
     const certificateEnrollment = certificateMode === "issued" && enrollmentResult?.status !== "issued" ? null : certificateMode === "expired" ? null : enrollmentResult;
     return (_jsx("div", { className: "flex-1 min-w-0 overflow-y-auto p-6", children: _jsxs("div", { className: "max-w-xl flex flex-col gap-6", children: [_jsxs("div", { children: [_jsx("h1", { className: "text-lg font-bold tracking-tight mb-1", children: "Encryption" }), _jsxs("p", { className: "text-sm text-text-muted", children: ["Manage how ", mailbox.displayName, " unlocks its encryption keys on this and other devices."] })] }), loadError && _jsx(Alert, { children: loadError }), actionError && _jsx(Alert, { children: actionError }), !canManageKeys && (_jsx("p", { className: "text-sm text-text-muted", children: "Only this mailbox\u2019s owner, signed in as themselves, can change its encryption keys and unlock methods." })), _jsxs("div", { children: [_jsx("h2", { className: "text-sm font-semibold mb-2", children: "Encryption keys" }), displayedKeys.length > 0 ? (_jsx("ul", { className: "flex flex-col gap-1 text-sm", children: displayedKeys.map((key) => (_jsxs("li", { className: "font-mono text-xs", children: [key.useType === "sign" ? "Signing" : "Encryption", " key: ", key.fingerprint, key.revokedAt &&
-                                        (key.revocationReason === "superseded" ? (_jsx("span", { className: "text-text-muted", children: " (superseded)" })) : (_jsx("span", { className: "text-danger", children: " (revoked)" })))] }, key.fingerprint))) })) : (_jsx("p", { className: "text-sm text-text-muted", children: "No keys enrolled yet." }))] }), _jsxs("div", { children: [_jsx("h2", { className: "text-sm font-semibold mb-2", children: "Digital signatures" }), activeSigningKey && signingStatus !== "pending" && (_jsx("p", { className: ["text-sm text-text-muted", certificateMode ? "mb-3" : ""].join(" "), children: "Enabled \u2014 outgoing mail from this mailbox is signed with a publicly-trusted certificate." })), certificateMode && (_jsxs("div", { className: "flex flex-col gap-2", children: [certificateMode === "failed" && signingError && _jsx(Alert, { children: signingError }), _jsx(SigningCertificateCard, { mode: certificateMode, enrollment: certificateEnrollment, snapshot: enrollment, info: signingInfo, address: mailbox.primarySmtpAddress, keyNotAfter: certificateMode === "expired" ? expiredSigningKey?.notAfter : activeSigningKey?.notAfter, canRequest: canManageKeys, requesting: signingStatus === "enrolling", onCheck: canManageKeys ? () => void checkEnrollmentNow(mailboxUid) : undefined, onRequest: handleEnrollSigning })] })), !activeSigningKey && !certificateMode && !canManageKeys ? (_jsx("p", { className: "text-sm text-text-muted", children: "Not enabled." })) : activeSigningKey || certificateMode ? null : (_jsxs("div", { className: "flex flex-col gap-2", children: [_jsx("p", { className: "text-xs text-text-muted", children: "Lets recipients verify that mail from this mailbox is genuinely from you. Optional \u2014 encryption already works without it." }), beforeRequestText(signingInfo, mailbox.primarySmtpAddress) && (_jsx("p", { className: "text-xs text-text-muted", children: beforeRequestText(signingInfo, mailbox.primarySmtpAddress) })), healthWarning(signingInfo) && _jsx(Alert, { children: healthWarning(signingInfo) }), enrollment?.gone && _jsx(Alert, { children: STALE_REQUEST_TEXT }), signingError && _jsx(Alert, { children: signingError }), signingInfo?.backend !== "none" && (_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", loading: signingStatus === "enrolling", disabled: signingStatus !== "idle", onClick: handleEnrollSigning, children: "Enable digital signatures" }))] }))] }), mailbox.escrowScopeId && (_jsxs("div", { children: [_jsx("h2", { className: "text-sm font-semibold mb-2", children: "Escrow" }), escrowError && _jsx(Alert, { children: escrowError }), hasEscrowWrap ? (_jsx("p", { className: "text-sm text-text-muted", children: "This mailbox is under legal/compliance escrow \u2014 an authorized holder in your organization can recover its encrypted mail if needed. This does not weaken protection against anyone else." })) : (_jsxs("div", { className: "flex flex-col gap-2", children: [_jsxs("p", { className: "text-xs text-text-muted", children: ["Your organization has assigned this mailbox to an escrow scope, but nothing has been protected yet \u2014 an authorized holder cannot recover this mailbox\u2019s encrypted mail until you complete this step.", " ", "This does not weaken protection against anyone else."] }), canManageKeys && (_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", loading: wrappingEscrow, disabled: wrappingEscrow, onClick: handleWrapEscrow, children: "Add escrow protection" }))] }))] })), _jsxs("div", { children: [_jsx("h2", { className: "text-sm font-semibold mb-2", children: "Unlock methods" }), _jsxs("p", { className: "text-xs text-text-muted mb-3", children: ["Removing a method here stops it from being usable to unlock this mailbox going forward, but it is ", _jsx("strong", { children: "not" }), " full revocation \u2014 anyone who already captured a wrapped copy and knows its secret could still use it. For real revocation (e.g. after a lost device), rotate your keys entirely below instead."] }), vault && vault.masterKeyWraps.length > 0 ? (_jsx("ul", { className: "flex flex-col gap-2", children: [...passwordWraps, ...recoveryWraps, ...otherWraps].map((wrap) => {
+                                        (key.revocationReason === "superseded" ? (_jsx("span", { className: "text-text-muted", children: " (superseded)" })) : (_jsx("span", { className: "text-danger", children: " (revoked)" })))] }, key.fingerprint))) })) : (_jsx("p", { className: "text-sm text-text-muted", children: "No keys enrolled yet." }))] }), _jsxs("div", { children: [_jsx("h2", { className: "text-sm font-semibold mb-2", children: "Digital signatures" }), activeSigningKey && signingStatus !== "pending" && (_jsx("p", { className: ["text-sm text-text-muted", certificateMode ? "mb-3" : ""].join(" "), children: "Enabled \u2014 outgoing mail from this mailbox is signed with a publicly-trusted certificate." })), certificateMode && (_jsxs("div", { className: "flex flex-col gap-2", children: [certificateMode === "failed" && signingError && _jsx(Alert, { children: signingError }), _jsx(SigningCertificateCard, { mode: certificateMode, enrollment: certificateEnrollment, snapshot: enrollment, info: signingInfo, address: mailbox.primarySmtpAddress, keyNotAfter: certificateMode === "expired" ? expiredSigningKey?.notAfter : activeSigningKey?.notAfter, canRequest: canManageKeys, requesting: signingStatus === "enrolling", onCheck: canManageKeys ? () => void checkEnrollmentNow(mailboxUid) : undefined, onRequest: handleEnrollSigning })] })), !activeSigningKey && !certificateMode && !canManageKeys ? (_jsx("p", { className: "text-sm text-text-muted", children: "Not enabled." })) : activeSigningKey || certificateMode ? null : (_jsxs("div", { className: "flex flex-col gap-2", children: [_jsx("p", { className: "text-xs text-text-muted", children: "Lets recipients verify that mail from this mailbox is genuinely from you. Optional \u2014 encryption already works without it." }), beforeRequestText(signingInfo, mailbox.primarySmtpAddress) && (_jsx("p", { className: "text-xs text-text-muted", children: beforeRequestText(signingInfo, mailbox.primarySmtpAddress) })), healthWarning(signingInfo) && _jsx(Alert, { children: healthWarning(signingInfo) }), enrollment?.gone && _jsx(Alert, { children: STALE_REQUEST_TEXT }), signingError && _jsx(Alert, { children: signingError }), signingInfo?.backend !== "none" && (_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", loading: signingStatus === "enrolling", disabled: signingStatus !== "idle", onClick: handleEnrollSigning, children: "Enable digital signatures" }))] }))] }), mailbox.escrowScopeId && (_jsxs("div", { children: [_jsx("h2", { className: "text-sm font-semibold mb-2", children: "Escrow" }), escrowError && _jsx(Alert, { children: escrowError }), hasEscrowWrap ? (_jsx("p", { className: "text-sm text-text-muted", children: "This mailbox is under legal/compliance escrow \u2014 an authorized holder in your organization can recover its encrypted mail if needed. This does not weaken protection against anyone else." })) : (_jsxs("div", { className: "flex flex-col gap-2", children: [_jsxs("p", { className: "text-xs text-text-muted", children: ["Your organization has assigned this mailbox to an escrow scope, but nothing has been protected yet \u2014 an authorized holder cannot recover this mailbox\u2019s encrypted mail until you complete this step.", " ", "This does not weaken protection against anyone else."] }), canManageKeys && (_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", loading: wrappingEscrow, disabled: wrappingEscrow, onClick: handleWrapEscrow, children: "Add escrow protection" }))] })), _jsxs(Modal, { open: pendingEscrow !== null, onClose: () => setPendingEscrow(null), title: "Confirm escrow certificate", children: [_jsx("p", { className: "text-sm mb-3", children: "Anyone holding the private key for this certificate will be able to recover this mailbox\u2019s encrypted mail. Confirm it is the escrow certificate your organization expects before continuing." }), _jsxs("dl", { className: "text-sm mb-5 flex flex-col gap-1", children: [_jsxs("div", { children: [_jsx("dt", { className: "text-xs text-text-muted", children: "Escrow scope" }), _jsx("dd", { className: "break-all", children: pendingEscrow?.escrowScopeId })] }), _jsxs("div", { children: [_jsx("dt", { className: "text-xs text-text-muted", children: "Certificate fingerprint" }), _jsx("dd", { className: "font-mono break-all", children: pendingEscrow?.publicKey.fingerprint })] })] }), _jsxs("div", { className: "flex gap-3 justify-end", children: [_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", onClick: () => setPendingEscrow(null), children: "Cancel" }), _jsx(Button, { type: "button", className: "!w-auto", onClick: () => void handleConfirmEscrow(pendingEscrow), children: "Trust this certificate" })] })] })] })), _jsxs("div", { children: [_jsx("h2", { className: "text-sm font-semibold mb-2", children: "Unlock methods" }), _jsxs("p", { className: "text-xs text-text-muted mb-3", children: ["Removing a method here stops it from being usable to unlock this mailbox going forward, but it is ", _jsx("strong", { children: "not" }), " full revocation \u2014 anyone who already captured a wrapped copy and knows its secret could still use it. For real revocation (e.g. after a lost device), rotate your keys entirely below instead."] }), vault && vault.masterKeyWraps.length > 0 ? (_jsx("ul", { className: "flex flex-col gap-2", children: [...passwordWraps, ...recoveryWraps, ...otherWraps].map((wrap) => {
                                 const key = `${wrap.method}:${wrap.methodId ?? ""}`;
                                 return (_jsxs("li", { className: "flex items-center justify-between gap-3 text-sm py-1.5 px-3 bg-surface-alt rounded-sm", children: [_jsx("span", { children: METHOD_LABELS[wrap.method] ?? wrap.method }), wrap.method !== "escrow" &&
                                             canManageKeys &&
                                             (canRemoveWrap(wrap) ? (_jsx(Button, { type: "button", variant: "text", className: "!w-auto text-danger", loading: removingMethod === key, disabled: removingMethod !== null, onClick: () => setPendingRemoval(wrap), children: "Remove" })) : (_jsx("span", { className: "text-xs text-text-muted", children: ownUnlockWrapCount > 1 ? "Needed to unlock" : "Your only unlock method" })))] }, key));
-                            }) })) : (_jsx("p", { className: "text-sm text-text-muted", children: "No unlock methods on file." })), _jsxs(Modal, { open: pendingRemoval !== null, onClose: () => setPendingRemoval(null), title: "Remove unlock method", children: [_jsx("p", { className: "text-sm mb-5", children: "Remove this unlock method? It will no longer unlock this mailbox\u2019s encrypted mail on any device." }), _jsxs("div", { className: "flex gap-3 justify-end", children: [_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", onClick: () => setPendingRemoval(null), children: "Cancel" }), _jsx(Button, { type: "button", className: "!w-auto !bg-none !bg-danger !border-danger hover:!bg-danger", onClick: () => handleRemove(pendingRemoval), children: "Remove method" })] })] })] }), canManageKeys && (_jsxs(_Fragment, { children: [passwordWraps.length === 0 ? (vault && (_jsxs("form", { onSubmit: handleAddPassword, className: "flex flex-col gap-2", children: [_jsx("h2", { className: "text-sm font-semibold", children: "Add a password" }), _jsx("input", { type: "password", "aria-label": "New password", placeholder: "New password", className: "w-full text-sm border border-border rounded-sm py-1.5 px-2 bg-surface", value: newPassword, onChange: (e) => setNewPassword(e.target.value), disabled: addingPassword, autoComplete: "new-password" }), _jsx("input", { type: "password", "aria-label": "Confirm new password", placeholder: "Confirm new password", className: "w-full text-sm border border-border rounded-sm py-1.5 px-2 bg-surface", value: confirmNewPassword, onChange: (e) => setConfirmNewPassword(e.target.value), disabled: addingPassword, autoComplete: "new-password" }), _jsx("div", { children: _jsx(Button, { type: "submit", loading: addingPassword, disabled: addingPassword, className: "!w-auto", children: "Add password" }) })] }))) : (_jsxs("div", { children: [_jsx("h2", { className: "text-sm font-semibold mb-2", children: "Changing your password" }), _jsx("p", { className: "text-xs text-text-muted", children: "Only one password can unlock this mailbox. To change it, rotate your keys below - that sets a new password and replaces every other unlock method." })] })), _jsxs("div", { children: [_jsx("h2", { className: "text-sm font-semibold mb-2", children: "Recovery codes" }), _jsx("p", { className: "text-xs text-text-muted mb-3", children: "Regenerating replaces all of your existing recovery codes \u2014 old ones stop working immediately." }), _jsx(Button, { type: "button", variant: "secondary", loading: regenerating, disabled: regenerating || !vault, onClick: handleRegenerateRecoveryCodes, className: "!w-auto", children: "Regenerate recovery codes" })] }), _jsxs("form", { onSubmit: handleRotateKeys, className: "flex flex-col gap-2 border-t border-border pt-6", children: [_jsx("h2", { className: "text-sm font-semibold", children: "Rotate keys" }), _jsx("p", { className: "text-xs text-text-muted mb-1", children: "Real revocation, for when a device or an unlock method may have been compromised. Re-protects your existing encryption key under a brand new master key - your signing/ encryption keypair itself doesn\u2019t change, so mail you\u2019ve already sent or received still decrypts normally. Every current unlock method (password, recovery codes, and anything else on file) stops working immediately; you\u2019ll set a new password and get new recovery codes below." }), rotationBlockedBySigning && (_jsx("p", { className: "text-xs text-text-muted", children: signingStatus === "checking"
+                            }) })) : (_jsx("p", { className: "text-sm text-text-muted", children: "No unlock methods on file." })), _jsxs(Modal, { open: pendingRemoval !== null, onClose: () => setPendingRemoval(null), title: "Remove unlock method", children: [_jsx("p", { className: "text-sm mb-5", children: "Remove this unlock method? It will no longer unlock this mailbox\u2019s encrypted mail on any device." }), _jsxs("div", { className: "flex gap-3 justify-end", children: [_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", onClick: () => setPendingRemoval(null), children: "Cancel" }), _jsx(Button, { type: "button", className: "!w-auto !bg-none !bg-danger !border-danger hover:!bg-danger", onClick: () => handleRemove(pendingRemoval), children: "Remove method" })] })] })] }), canManageKeys && (_jsxs(_Fragment, { children: [passwordWraps.length === 0 ? (vault && (_jsxs("form", { onSubmit: handleAddPassword, className: "flex flex-col gap-2", children: [_jsx("h2", { className: "text-sm font-semibold", children: "Add a password" }), _jsx("input", { type: "password", "aria-label": "New password", placeholder: "New password", className: "w-full text-sm border border-border rounded-sm py-1.5 px-2 bg-surface", value: newPassword, onChange: (e) => setNewPassword(e.target.value), disabled: addingPassword, autoComplete: "new-password" }), _jsx("input", { type: "password", "aria-label": "Confirm new password", placeholder: "Confirm new password", className: "w-full text-sm border border-border rounded-sm py-1.5 px-2 bg-surface", value: confirmNewPassword, onChange: (e) => setConfirmNewPassword(e.target.value), disabled: addingPassword, autoComplete: "new-password" }), _jsx("div", { children: _jsx(Button, { type: "submit", loading: addingPassword, disabled: addingPassword, className: "!w-auto", children: "Add password" }) })] }))) : (_jsxs("div", { children: [_jsx("h2", { className: "text-sm font-semibold mb-2", children: "Changing your password" }), _jsx("p", { className: "text-xs text-text-muted", children: "Only one password can unlock this mailbox. To change it, rotate your keys below - that sets a new password and replaces every other unlock method." })] })), _jsxs("div", { children: [_jsx("h2", { className: "text-sm font-semibold mb-2", children: "Recovery codes" }), _jsx("p", { className: "text-xs text-text-muted mb-3", children: "Regenerating replaces all of your existing recovery codes \u2014 old ones stop working immediately." }), _jsx(Button, { type: "button", variant: "secondary", loading: regenerating, disabled: regenerating || !vault, onClick: handleRegenerateRecoveryCodes, className: "!w-auto", children: "Regenerate recovery codes" })] }), _jsxs(Modal, { open: confirmingRotation, onClose: () => setConfirmingRotation(false), title: "Rotate your keys?", children: [_jsx("p", { className: "text-sm mb-3", children: "Every other way of unlocking this mailbox - its password, its recovery codes, and every other device\u2019s saved password - stops working the moment this finishes, and cannot be brought back. You will be shown new recovery codes once." }), _jsxs("div", { className: "flex gap-3 justify-end", children: [_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", onClick: () => setConfirmingRotation(false), children: "Cancel" }), _jsx(Button, { type: "button", className: "!w-auto !bg-none !bg-danger !border-danger hover:!bg-danger", onClick: () => void rotateKeys(), children: "Yes, rotate my keys" })] })] }), _jsxs("form", { onSubmit: handleRotateKeys, className: "flex flex-col gap-2 border-t border-border pt-6", children: [_jsx("h2", { className: "text-sm font-semibold", children: "Rotate keys" }), _jsx("p", { className: "text-xs text-text-muted mb-1", children: "Real revocation, for when a device or an unlock method may have been compromised. Re-protects your existing encryption key under a brand new master key - your signing/ encryption keypair itself doesn\u2019t change, so mail you\u2019ve already sent or received still decrypts normally. Every current unlock method (password, recovery codes, and anything else on file) stops working immediately; you\u2019ll set a new password and get new recovery codes below." }), rotationBlockedBySigning && (_jsx("p", { className: "text-xs text-text-muted", children: signingStatus === "checking"
                                         ? "Checking whether a signing certificate enrollment is still in progress..."
                                         : "Rotation is unavailable while a signing certificate enrollment is in progress - rotating now would lose the key being enrolled. Try again once it finishes, or cancel the enrollment." })), signingStatus === "pending" && signingEnrollmentId && (_jsxs("div", { className: "flex flex-col gap-2", children: [cancelEnrollmentError && _jsx(Alert, { children: cancelEnrollmentError }), _jsx("div", { children: _jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", loading: cancelingEnrollment, disabled: cancelingEnrollment, onClick: () => handleCancelEnrollment(signingEnrollmentId), children: "Cancel enrollment" }) })] })), _jsx("input", { type: "password", "aria-label": "New password for rotated keys", placeholder: "New password", className: "w-full text-sm border border-border rounded-sm py-1.5 px-2 bg-surface", value: rotationPassword, onChange: (e) => setRotationPassword(e.target.value), disabled: rotating || rotationBlockedBySigning, autoComplete: "new-password" }), _jsx("input", { type: "password", "aria-label": "Confirm new password for rotated keys", placeholder: "Confirm new password", className: "w-full text-sm border border-border rounded-sm py-1.5 px-2 bg-surface", value: rotationConfirmPassword, onChange: (e) => setRotationConfirmPassword(e.target.value), disabled: rotating || rotationBlockedBySigning, autoComplete: "new-password" }), _jsx("div", { children: _jsx(Button, { type: "submit", variant: "secondary", className: "!w-auto text-danger", loading: rotating, disabled: rotating || rotationBlockedBySigning, children: "Rotate keys now" }) })] })] })), _jsxs("div", { children: [_jsx("h2", { className: "text-sm font-semibold mb-2", children: "Session timeout" }), _jsx("p", { className: "text-xs text-text-muted mb-3", children: "Automatically destroys your unlocked keys on this device after this much time with no activity anywhere in the app - not just Mail or Settings. Applies the next time you open or reload the app." }), _jsx("select", { "aria-label": "Session timeout", className: "text-sm border border-border rounded-sm py-1.5 px-2 bg-surface", value: idleTimeoutMinutes, onChange: handleIdleTimeoutChange, children: IDLE_TIMEOUT_OPTIONS_MINUTES.map((minutes) => (_jsx("option", { value: minutes, children: idleTimeoutLabel(minutes) }, minutes))) })] }), _jsxs("div", { children: [_jsx("h2", { className: "text-sm font-semibold mb-2", children: "Local search index size" }), _jsxs("p", { className: "text-xs text-text-muted mb-3", children: ["How much decrypted mail this device keeps in a local encrypted search index, so recent search results and inbox previews work instantly without contacting the server every time. Defaults to ", localIndexDefaultByteBudgetLabel, " on this device. Applies the next time this mailbox\u2019s index rebuilds (e.g. the next time you unlock it) \u2014 lowering it doesn\u2019t delete anything already indexed elsewhere, it just narrows what this device keeps a local copy of."] }), _jsx("select", { "aria-label": "Local search index size", className: "text-sm border border-border rounded-sm py-1.5 px-2 bg-surface", value: localIndexByteBudget, onChange: handleLocalIndexByteBudgetChange, children: LOCAL_INDEX_SIZE_OPTIONS.map((option) => (_jsx("option", { value: option.bytes, children: option.label }, option.bytes))) })] }), _jsxs("div", { children: [_jsx("h2", { className: "text-sm font-semibold mb-2", children: "This session" }), _jsx("p", { className: "text-xs text-text-muted mb-3", children: "Removes your unlocked keys from this browser tab\u2019s memory right now, without affecting any other device. You\u2019ll be asked to unlock again the next time you read or send encrypted mail here." }), _jsx(Button, { type: "button", variant: "secondary", className: "!w-auto text-danger", onClick: handleDestroyKeysNow, children: "Destroy keys on this device now" })] })] }) }));
 }

package/dist/apps/www/settings/privacy/index.js

@@ -16,6 +16,7 @@ import Alert from "../../../../lib/components/feedback/Alert.js";
 import Button from "../../../../lib/components/buttons/Button.js";
 import Modal from "../../../../lib/components/overlays/Modal.js";
 import { notifyApiError } from "../../../shared/notifications/apiErrors.js";
+import GravatarSetting from "../../../shared/components/settings/GravatarSetting.js";
 const NON_MAIL_FOLDER_TYPES = new Set(["calendar", "contacts", "tasks", "notes"]);
 function importFormatFromFilename(filename) {
     return filename.toLowerCase().endsWith(".pst") ? "pst" : "mbox";
@@ -49,7 +50,7 @@ function PrivacyContent({ userUid }) {
     const ownedMailboxes = mailboxes.filter((mb) => mb.ownerUserUid !== undefined && mb.ownerUserUid === userUid);
     const ownMailbox = ownedMailboxes.length === 1 ? ownedMailboxes[0] : undefined;
     const selectedIsOwn = selected.uid === ownMailbox?.uid;
-    return (_jsx("div", { className: "flex-1 min-w-0 overflow-y-auto p-6", children: _jsxs("div", { className: "max-w-xl flex flex-col gap-8", children: [_jsxs("div", { children: [_jsx("h1", { className: "text-lg font-bold tracking-tight mb-1", children: "Privacy & Data" }), _jsx("p", { className: "text-sm text-text-muted", children: "Export or manage the data associated with this mailbox." })] }), selectedIsOwn ? (_jsxs(_Fragment, { children: [_jsx(ExportSection, { mailboxUid: mailboxUid, mailboxLabel: `${selected.displayName} (${selected.primarySmtpAddress})` }), _jsx(ImportSection, { mailboxUid: mailboxUid }), _jsx(ErasureSection, { mailboxLabel: `${selected.displayName} (${selected.primarySmtpAddress})` })] })) : (_jsx(OwnMailboxOnlyNotice, { ownedMailboxCount: ownedMailboxes.length, ownMailboxLabel: ownMailbox && `${ownMailbox.displayName} (${ownMailbox.primarySmtpAddress})` }))] }) }));
+    return (_jsx("div", { className: "flex-1 min-w-0 overflow-y-auto p-6", children: _jsxs("div", { className: "max-w-xl flex flex-col gap-8", children: [_jsxs("div", { children: [_jsx("h1", { className: "text-lg font-bold tracking-tight mb-1", children: "Privacy & Data" }), _jsx("p", { className: "text-sm text-text-muted", children: "Export or manage the data associated with this mailbox." })] }), _jsx(GravatarSetting, {}), selectedIsOwn ? (_jsxs(_Fragment, { children: [_jsx(ExportSection, { mailboxUid: mailboxUid, mailboxLabel: `${selected.displayName} (${selected.primarySmtpAddress})` }), _jsx(ImportSection, { mailboxUid: mailboxUid }), _jsx(ErasureSection, { mailboxLabel: `${selected.displayName} (${selected.primarySmtpAddress})` })] })) : (_jsx(OwnMailboxOnlyNotice, { ownedMailboxCount: ownedMailboxes.length, ownMailboxLabel: ownMailbox && `${ownMailbox.displayName} (${ownMailbox.primarySmtpAddress})` }))] }) }));
 }
 function OwnMailboxOnlyNotice({ ownedMailboxCount, ownMailboxLabel }) {
     let detail;
@@ -158,7 +159,7 @@ function ImportSection({ mailboxUid }) {
             return;
         }
         setUploading(true);
-        uploadMailboxImport(file, { format: importFormatFromFilename(file.name), targetFolderUid })
+        uploadMailboxImport(file, { format: importFormatFromFilename(file.name), targetFolderUid, mailboxUid: mailboxUid }, client)
             .then(() => loadRequests())
             .catch((err) => notifyApiError(err, "Couldn't upload the file"))
             .finally(() => setUploading(false));

package/dist/apps/www/settings/profile/index.js

@@ -119,7 +119,10 @@ function ProfileContent() {
                                             }, "aria-describedby": "profile-time-zone-help" }), timezone !== deviceZone && (_jsxs(Button, { type: "button", variant: "text", className: "!w-auto", onClick: () => {
                                                 setTimezone(deviceZone);
                                                 setSaved(false);
-                                            }, children: ["Use this device\u2019s time zone (", describeTimeZone(deviceZone), ")"] }))] }), zoneWasPreselected && (_jsx("p", { className: "mt-1 text-xs text-text-muted", children: "Your mailbox has no time zone chosen yet; this device\u2019s is preselected. Save to keep it." })), _jsx("p", { id: "profile-time-zone-help", className: "mt-1 text-xs text-text-muted", children: "How calendar times and reminders are shown and scheduled for this mailbox, such as when an event or a reminder falls." })] }), _jsxs(FormField, { label: "Free/busy visibility", htmlFor: "profile-free-busy", children: [_jsx("select", { id: "profile-free-busy", className: SELECT_CLASS, value: freeBusy, disabled: !canChangeFreeBusy, onChange: (e) => {
+                                            }, children: ["Use this device\u2019s time zone (", describeTimeZone(deviceZone), ")"] }))] }), zoneWasPreselected && (_jsxs("p", { className: "mt-1 text-xs text-text-muted", children: ["Your mailbox has no time zone chosen yet (it uses UTC); this device\u2019s is preselected, and Save sets it - whatever else you change.", " ", _jsx(Button, { type: "button", variant: "text", className: "!w-auto !inline !p-0 !text-xs", onClick: () => {
+                                                setTimezone(DEFAULT_TIME_ZONE);
+                                                setSaved(false);
+                                            }, children: "Keep UTC" })] })), _jsx("p", { id: "profile-time-zone-help", className: "mt-1 text-xs text-text-muted", children: "How calendar times and reminders are shown and scheduled for this mailbox, such as when an event or a reminder falls." })] }), _jsxs(FormField, { label: "Free/busy visibility", htmlFor: "profile-free-busy", children: [_jsx("select", { id: "profile-free-busy", className: SELECT_CLASS, value: freeBusy, disabled: !canChangeFreeBusy, onChange: (e) => {
                                         setFreeBusy(e.target.value);
                                         setSaved(false);
                                     }, "aria-describedby": "profile-free-busy-help", children: FREE_BUSY_CHOICES.map((choice) => (_jsx("option", { value: choice.value, children: choice.label }, choice.value))) }), _jsx("p", { id: "profile-free-busy-help", className: "mt-1 text-xs text-text-muted", children: FREE_BUSY_CHOICES.find((choice) => choice.value === freeBusy).help }), _jsx("p", { className: "mt-1 text-xs text-text-muted", children: "Who can see the hours you are busy when they look for a time to meet - never the title, place or guests of an event." }), !canChangeFreeBusy && (_jsx("p", { className: "mt-1 text-xs text-text-muted", children: "This mailbox is shared with you: only its owner can change who sees its free/busy times." }))] }), _jsx("div", { children: _jsx(Button, { type: "submit", loading: saving, disabled: saving, className: "!w-auto", children: "Save" }) })] })] }) }));

package/dist/apps/www/settings/sharing/index.js

@@ -4,7 +4,7 @@ import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-run
 // SPDX-License-Identifier: MPL-2.0
 ///////////////////////////////////////////////////////////////////////////////
 import { pageTitle } from "../../../shared/navigation/pageTitle.js";
-import { useEffect, useState } from "react";
+import { useEffect, useRef, useState } from "react";
 import { ApiRequestError } from "../../../../lib/util/api.js";
 import { listMailboxAccess, removeMailboxAccess, setMailboxAccess, } from "../../../../lib/mail/mailboxAccessApi.js";
 import SettingsShell, { useSettingsShell } from "../../../shared/components/settings/layout/SettingsShell.js";
@@ -40,15 +40,24 @@ function SharingContent() {
     // `SettingsShell` only ever renders its children once `mailboxUid` has resolved (a mailbox-less caller
     // gets `<MailboxProvisioning />` instead) - same established precedent as the Labels/Focused Inbox
     // settings pages, so none of the handlers below need their own `!mailboxUid` guard.
+    // Only the latest request's answer is shown (a reload after a change can overtake a slower earlier one).
+    const latestLoad = useRef(0);
     function reload() {
+        const load = ++latestLoad.current;
         setStatus("loading");
         setError(null);
         listMailboxAccess(mailboxUid)
             .then((result) => {
+            if (load !== latestLoad.current) {
+                return;
+            }
             setMembers(result);
             setStatus("ready");
         })
             .catch((err) => {
+            if (load !== latestLoad.current) {
+                return;
+            }
             // A 403 here is the live, server-verified "can this caller manage this mailbox's sharing"
             // signal - the same permission threshold (ACLAction.UPDATE) this route itself requires, so
             // no separate probe call is needed to decide which state to render.

package/dist/apps/www/settings/signatures/[uid].js

@@ -63,10 +63,7 @@ function SignatureDetailContent({ uid }) {
         setSaving(true);
         setSaved(false);
         try {
-            if (isDefaultForNewMessages || isDefaultForReplyForward) {
-                const existing = await listMailSignatures(mailboxUid, { limit: 100 });
-                await clearPreviousDefaults(existing, original.uid, isDefaultForNewMessages, isDefaultForReplyForward);
-            }
+            // This signature is saved first: were it refused (a 409, a 400) after the others had been cleared, the mailbox would be left with no default at all.
             const updated = await updateMailSignature({
                 uid: original.uid,
                 version: original.version,
@@ -76,6 +73,11 @@ function SignatureDetailContent({ uid }) {
                 isDefaultForReplyForward,
             });
             setOriginal(updated);
+            if (isDefaultForNewMessages || isDefaultForReplyForward) {
+                // The signature's own mailbox, not the one the page happens to have selected.
+                const existing = await listMailSignatures(original.mailboxUid, { limit: 100 });
+                await clearPreviousDefaults(existing, original.uid, isDefaultForNewMessages, isDefaultForReplyForward);
+            }
             setSaved(true);
         }
         catch (err) {