@rapidmx/web-client 0.30.0 → 0.32.0

package/dist/apps/www/settings/encryption/index.js

@@ -18,6 +18,7 @@ import { getMailbox } from "../../../../lib/mail/mailApi.js";
 import { useApiClient } from "../../../../lib/util/apiClientContext.js";
 import SettingsShell, { useSettingsShell } from "../../../shared/components/settings/layout/SettingsShell.js";
 import KeyEnrollmentGate from "../../../shared/components/layout/KeyEnrollmentGate.js";
+import { MIN_PASSWORD_LENGTH } from "../../../shared/components/layout/RecoveryCodeUnlock.js";
 import { useUnlockPrompt } from "../../../shared/components/layout/UnlockPromptProvider.js";
 import { destroyLocalIndex } from "../../../shared/search/localIndexRpcClient.js";
 import { notifyApiError } from "../../../shared/notifications/apiErrors.js";
@@ -29,7 +30,6 @@ import { readStoredSignEnrollment, storeSignEnrollment } from "../../../shared/s
 import { checkEnrollmentNow, forgetEnrollment, recordEnrollmentResult, useEnrollmentSnapshot, watchCurrentEnrollment, watchEnrollment, } from "../../../shared/signing/enrollmentTracker.js";
 import { STALE_REQUEST_TEXT, beforeRequestText, healthWarning, isInstalling, timeOf } from "../../../shared/signing/enrollmentView.js";
 import { useSigningEnrollmentInfo } from "../../../shared/signing/signingInfo.js";
-const MIN_PASSWORD_LENGTH = 8;
 /** Mirrors restapi's `BaseKeyVaultRoute` `MAX_MASTER_KEY_WRAPS` - `addMasterKeyWrap()` refuses a vault
  * already holding this many wraps (escrow included). */
 export const MAX_MASTER_KEY_WRAPS = 20;
@@ -185,6 +185,7 @@ function EncryptionContent({ canManageKeys }) {
     // Distinguishes the "Save your new recovery codes" screen's copy for the two different actions that
     // land on it - a plain regeneration only invalidates old recovery codes, while a rotation also
     // invalidates every other unlock method, which the copy needs to say plainly.
+    const [confirmingRotation, setConfirmingRotation] = useState(false);
     const [recoveryCodesReason, setRecoveryCodesReason] = useState("regenerate");
     const [codesSaved, setCodesSaved] = useState(false);
     const [codesCopied, setCodesCopied] = useState(false);
@@ -228,6 +229,7 @@ function EncryptionContent({ canManageKeys }) {
     const hasEscrowWrap = vault?.masterKeyWraps.some((w) => w.method === "escrow") ?? false;
     const [wrappingEscrow, setWrappingEscrow] = useState(false);
     const [escrowError, setEscrowError] = useState(null);
+    const [pendingEscrow, setPendingEscrow] = useState(null);
     /**
      * This mailbox's unlocked keys *right now* - never a copy read at render time, which a lock (idle
      * timeout, another tab's sign-out) may since have destroyed. Prompts for the password when locked;
@@ -270,13 +272,29 @@ function EncryptionContent({ canManageKeys }) {
         }
         return err instanceof ApiRequestError ? err.message : fallback;
     }
+    /** Looks up the certificate the server says this mailbox's escrow scope holds, and asks the owner to confirm it
+     * before the master key is wrapped to it: nothing else vouches for that certificate, and whoever holds its
+     * private key can read this mailbox's encrypted mail. */
     async function handleWrapEscrow() {
         setEscrowError(null);
         setWrappingEscrow(true);
         try {
             // Only reachable when mailbox.escrowScopeId is set (see the render guard below).
+            await verifiedUnlockedKeys();
+            setPendingEscrow(await getEscrowInfo(mailboxUid, client));
+        }
+        catch (err) {
+            setEscrowError(errorMessage(err, "Could not add escrow protection for this mailbox."));
+        }
+        finally {
+            setWrappingEscrow(false);
+        }
+    }
+    async function handleConfirmEscrow(escrowInfo) {
+        setPendingEscrow(null);
+        setWrappingEscrow(true);
+        try {
             const { current } = await verifiedUnlockedKeys();
-            const escrowInfo = await getEscrowInfo(mailboxUid, client);
             const wrap = await buildEscrowWrap(current.masterKey, escrowInfo.escrowScopeId, fromBase64(escrowInfo.publicKey.publicKey));
             await addMasterKeyWrap(mailboxUid, wrap, undefined, client);
             await loadVault();
@@ -635,7 +653,7 @@ function EncryptionContent({ canManageKeys }) {
      * working the instant this succeeds, since `rekey()` replaces `masterKeyWraps` wholesale - the whole
      * point, for a captured-wrap scenario where it's unclear which method was compromised.
      */
-    async function handleRotateKeys(e) {
+    function handleRotateKeys(e) {
         e.preventDefault();
         if (rotationBlockedBySigning) {
             // The form's controls are disabled in this state too; this also covers an implicit submit.
@@ -650,6 +668,12 @@ function EncryptionContent({ canManageKeys }) {
             return;
         }
         setActionError(null);
+        // One press must not end every other unlock method and every other device's password: say so, and wait for a yes.
+        setConfirmingRotation(true);
+    }
+    async function rotateKeys() {
+        setConfirmingRotation(false);
+        setActionError(null);
         setEscrowError(null);
         setRotating(true);
         let keys;
@@ -775,12 +799,12 @@ function EncryptionContent({ canManageKeys }) {
                     : null;
     const certificateEnrollment = certificateMode === "issued" && enrollmentResult?.status !== "issued" ? null : certificateMode === "expired" ? null : enrollmentResult;
     return (_jsx("div", { className: "flex-1 min-w-0 overflow-y-auto p-6", children: _jsxs("div", { className: "max-w-xl flex flex-col gap-6", children: [_jsxs("div", { children: [_jsx("h1", { className: "text-lg font-bold tracking-tight mb-1", children: "Encryption" }), _jsxs("p", { className: "text-sm text-text-muted", children: ["Manage how ", mailbox.displayName, " unlocks its encryption keys on this and other devices."] })] }), loadError && _jsx(Alert, { children: loadError }), actionError && _jsx(Alert, { children: actionError }), !canManageKeys && (_jsx("p", { className: "text-sm text-text-muted", children: "Only this mailbox\u2019s owner, signed in as themselves, can change its encryption keys and unlock methods." })), _jsxs("div", { children: [_jsx("h2", { className: "text-sm font-semibold mb-2", children: "Encryption keys" }), displayedKeys.length > 0 ? (_jsx("ul", { className: "flex flex-col gap-1 text-sm", children: displayedKeys.map((key) => (_jsxs("li", { className: "font-mono text-xs", children: [key.useType === "sign" ? "Signing" : "Encryption", " key: ", key.fingerprint, key.revokedAt &&
-                                        (key.revocationReason === "superseded" ? (_jsx("span", { className: "text-text-muted", children: " (superseded)" })) : (_jsx("span", { className: "text-danger", children: " (revoked)" })))] }, key.fingerprint))) })) : (_jsx("p", { className: "text-sm text-text-muted", children: "No keys enrolled yet." }))] }), _jsxs("div", { children: [_jsx("h2", { className: "text-sm font-semibold mb-2", children: "Digital signatures" }), activeSigningKey && signingStatus !== "pending" && (_jsx("p", { className: ["text-sm text-text-muted", certificateMode ? "mb-3" : ""].join(" "), children: "Enabled \u2014 outgoing mail from this mailbox is signed with a publicly-trusted certificate." })), certificateMode && (_jsxs("div", { className: "flex flex-col gap-2", children: [certificateMode === "failed" && signingError && _jsx(Alert, { children: signingError }), _jsx(SigningCertificateCard, { mode: certificateMode, enrollment: certificateEnrollment, snapshot: enrollment, info: signingInfo, address: mailbox.primarySmtpAddress, keyNotAfter: certificateMode === "expired" ? expiredSigningKey?.notAfter : activeSigningKey?.notAfter, canRequest: canManageKeys, requesting: signingStatus === "enrolling", onCheck: canManageKeys ? () => void checkEnrollmentNow(mailboxUid) : undefined, onRequest: handleEnrollSigning })] })), !activeSigningKey && !certificateMode && !canManageKeys ? (_jsx("p", { className: "text-sm text-text-muted", children: "Not enabled." })) : activeSigningKey || certificateMode ? null : (_jsxs("div", { className: "flex flex-col gap-2", children: [_jsx("p", { className: "text-xs text-text-muted", children: "Lets recipients verify that mail from this mailbox is genuinely from you. Optional \u2014 encryption already works without it." }), beforeRequestText(signingInfo, mailbox.primarySmtpAddress) && (_jsx("p", { className: "text-xs text-text-muted", children: beforeRequestText(signingInfo, mailbox.primarySmtpAddress) })), healthWarning(signingInfo) && _jsx(Alert, { children: healthWarning(signingInfo) }), enrollment?.gone && _jsx(Alert, { children: STALE_REQUEST_TEXT }), signingError && _jsx(Alert, { children: signingError }), signingInfo?.backend !== "none" && (_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", loading: signingStatus === "enrolling", disabled: signingStatus !== "idle", onClick: handleEnrollSigning, children: "Enable digital signatures" }))] }))] }), mailbox.escrowScopeId && (_jsxs("div", { children: [_jsx("h2", { className: "text-sm font-semibold mb-2", children: "Escrow" }), escrowError && _jsx(Alert, { children: escrowError }), hasEscrowWrap ? (_jsx("p", { className: "text-sm text-text-muted", children: "This mailbox is under legal/compliance escrow \u2014 an authorized holder in your organization can recover its encrypted mail if needed. This does not weaken protection against anyone else." })) : (_jsxs("div", { className: "flex flex-col gap-2", children: [_jsxs("p", { className: "text-xs text-text-muted", children: ["Your organization has assigned this mailbox to an escrow scope, but nothing has been protected yet \u2014 an authorized holder cannot recover this mailbox\u2019s encrypted mail until you complete this step.", " ", "This does not weaken protection against anyone else."] }), canManageKeys && (_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", loading: wrappingEscrow, disabled: wrappingEscrow, onClick: handleWrapEscrow, children: "Add escrow protection" }))] }))] })), _jsxs("div", { children: [_jsx("h2", { className: "text-sm font-semibold mb-2", children: "Unlock methods" }), _jsxs("p", { className: "text-xs text-text-muted mb-3", children: ["Removing a method here stops it from being usable to unlock this mailbox going forward, but it is ", _jsx("strong", { children: "not" }), " full revocation \u2014 anyone who already captured a wrapped copy and knows its secret could still use it. For real revocation (e.g. after a lost device), rotate your keys entirely below instead."] }), vault && vault.masterKeyWraps.length > 0 ? (_jsx("ul", { className: "flex flex-col gap-2", children: [...passwordWraps, ...recoveryWraps, ...otherWraps].map((wrap) => {
+                                        (key.revocationReason === "superseded" ? (_jsx("span", { className: "text-text-muted", children: " (superseded)" })) : (_jsx("span", { className: "text-danger", children: " (revoked)" })))] }, key.fingerprint))) })) : (_jsx("p", { className: "text-sm text-text-muted", children: "No keys enrolled yet." }))] }), _jsxs("div", { children: [_jsx("h2", { className: "text-sm font-semibold mb-2", children: "Digital signatures" }), activeSigningKey && signingStatus !== "pending" && (_jsx("p", { className: ["text-sm text-text-muted", certificateMode ? "mb-3" : ""].join(" "), children: "Enabled \u2014 outgoing mail from this mailbox is signed with a publicly-trusted certificate." })), certificateMode && (_jsxs("div", { className: "flex flex-col gap-2", children: [certificateMode === "failed" && signingError && _jsx(Alert, { children: signingError }), _jsx(SigningCertificateCard, { mode: certificateMode, enrollment: certificateEnrollment, snapshot: enrollment, info: signingInfo, address: mailbox.primarySmtpAddress, keyNotAfter: certificateMode === "expired" ? expiredSigningKey?.notAfter : activeSigningKey?.notAfter, canRequest: canManageKeys, requesting: signingStatus === "enrolling", onCheck: canManageKeys ? () => void checkEnrollmentNow(mailboxUid) : undefined, onRequest: handleEnrollSigning })] })), !activeSigningKey && !certificateMode && !canManageKeys ? (_jsx("p", { className: "text-sm text-text-muted", children: "Not enabled." })) : activeSigningKey || certificateMode ? null : (_jsxs("div", { className: "flex flex-col gap-2", children: [_jsx("p", { className: "text-xs text-text-muted", children: "Lets recipients verify that mail from this mailbox is genuinely from you. Optional \u2014 encryption already works without it." }), beforeRequestText(signingInfo, mailbox.primarySmtpAddress) && (_jsx("p", { className: "text-xs text-text-muted", children: beforeRequestText(signingInfo, mailbox.primarySmtpAddress) })), healthWarning(signingInfo) && _jsx(Alert, { children: healthWarning(signingInfo) }), enrollment?.gone && _jsx(Alert, { children: STALE_REQUEST_TEXT }), signingError && _jsx(Alert, { children: signingError }), signingInfo?.backend !== "none" && (_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", loading: signingStatus === "enrolling", disabled: signingStatus !== "idle", onClick: handleEnrollSigning, children: "Enable digital signatures" }))] }))] }), mailbox.escrowScopeId && (_jsxs("div", { children: [_jsx("h2", { className: "text-sm font-semibold mb-2", children: "Escrow" }), escrowError && _jsx(Alert, { children: escrowError }), hasEscrowWrap ? (_jsx("p", { className: "text-sm text-text-muted", children: "This mailbox is under legal/compliance escrow \u2014 an authorized holder in your organization can recover its encrypted mail if needed. This does not weaken protection against anyone else." })) : (_jsxs("div", { className: "flex flex-col gap-2", children: [_jsxs("p", { className: "text-xs text-text-muted", children: ["Your organization has assigned this mailbox to an escrow scope, but nothing has been protected yet \u2014 an authorized holder cannot recover this mailbox\u2019s encrypted mail until you complete this step.", " ", "This does not weaken protection against anyone else."] }), canManageKeys && (_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", loading: wrappingEscrow, disabled: wrappingEscrow, onClick: handleWrapEscrow, children: "Add escrow protection" }))] })), _jsxs(Modal, { open: pendingEscrow !== null, onClose: () => setPendingEscrow(null), title: "Confirm escrow certificate", children: [_jsx("p", { className: "text-sm mb-3", children: "Anyone holding the private key for this certificate will be able to recover this mailbox\u2019s encrypted mail. Confirm it is the escrow certificate your organization expects before continuing." }), _jsxs("dl", { className: "text-sm mb-5 flex flex-col gap-1", children: [_jsxs("div", { children: [_jsx("dt", { className: "text-xs text-text-muted", children: "Escrow scope" }), _jsx("dd", { className: "break-all", children: pendingEscrow?.escrowScopeId })] }), _jsxs("div", { children: [_jsx("dt", { className: "text-xs text-text-muted", children: "Certificate fingerprint" }), _jsx("dd", { className: "font-mono break-all", children: pendingEscrow?.publicKey.fingerprint })] })] }), _jsxs("div", { className: "flex gap-3 justify-end", children: [_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", onClick: () => setPendingEscrow(null), children: "Cancel" }), _jsx(Button, { type: "button", className: "!w-auto", onClick: () => void handleConfirmEscrow(pendingEscrow), children: "Trust this certificate" })] })] })] })), _jsxs("div", { children: [_jsx("h2", { className: "text-sm font-semibold mb-2", children: "Unlock methods" }), _jsxs("p", { className: "text-xs text-text-muted mb-3", children: ["Removing a method here stops it from being usable to unlock this mailbox going forward, but it is ", _jsx("strong", { children: "not" }), " full revocation \u2014 anyone who already captured a wrapped copy and knows its secret could still use it. For real revocation (e.g. after a lost device), rotate your keys entirely below instead."] }), vault && vault.masterKeyWraps.length > 0 ? (_jsx("ul", { className: "flex flex-col gap-2", children: [...passwordWraps, ...recoveryWraps, ...otherWraps].map((wrap) => {
                                 const key = `${wrap.method}:${wrap.methodId ?? ""}`;
                                 return (_jsxs("li", { className: "flex items-center justify-between gap-3 text-sm py-1.5 px-3 bg-surface-alt rounded-sm", children: [_jsx("span", { children: METHOD_LABELS[wrap.method] ?? wrap.method }), wrap.method !== "escrow" &&
                                             canManageKeys &&
                                             (canRemoveWrap(wrap) ? (_jsx(Button, { type: "button", variant: "text", className: "!w-auto text-danger", loading: removingMethod === key, disabled: removingMethod !== null, onClick: () => setPendingRemoval(wrap), children: "Remove" })) : (_jsx("span", { className: "text-xs text-text-muted", children: ownUnlockWrapCount > 1 ? "Needed to unlock" : "Your only unlock method" })))] }, key));
-                            }) })) : (_jsx("p", { className: "text-sm text-text-muted", children: "No unlock methods on file." })), _jsxs(Modal, { open: pendingRemoval !== null, onClose: () => setPendingRemoval(null), title: "Remove unlock method", children: [_jsx("p", { className: "text-sm mb-5", children: "Remove this unlock method? It will no longer unlock this mailbox\u2019s encrypted mail on any device." }), _jsxs("div", { className: "flex gap-3 justify-end", children: [_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", onClick: () => setPendingRemoval(null), children: "Cancel" }), _jsx(Button, { type: "button", className: "!w-auto !bg-none !bg-danger !border-danger hover:!bg-danger", onClick: () => handleRemove(pendingRemoval), children: "Remove method" })] })] })] }), canManageKeys && (_jsxs(_Fragment, { children: [passwordWraps.length === 0 ? (vault && (_jsxs("form", { onSubmit: handleAddPassword, className: "flex flex-col gap-2", children: [_jsx("h2", { className: "text-sm font-semibold", children: "Add a password" }), _jsx("input", { type: "password", "aria-label": "New password", placeholder: "New password", className: "w-full text-sm border border-border rounded-sm py-1.5 px-2 bg-surface", value: newPassword, onChange: (e) => setNewPassword(e.target.value), disabled: addingPassword, autoComplete: "new-password" }), _jsx("input", { type: "password", "aria-label": "Confirm new password", placeholder: "Confirm new password", className: "w-full text-sm border border-border rounded-sm py-1.5 px-2 bg-surface", value: confirmNewPassword, onChange: (e) => setConfirmNewPassword(e.target.value), disabled: addingPassword, autoComplete: "new-password" }), _jsx("div", { children: _jsx(Button, { type: "submit", loading: addingPassword, disabled: addingPassword, className: "!w-auto", children: "Add password" }) })] }))) : (_jsxs("div", { children: [_jsx("h2", { className: "text-sm font-semibold mb-2", children: "Changing your password" }), _jsx("p", { className: "text-xs text-text-muted", children: "Only one password can unlock this mailbox. To change it, rotate your keys below - that sets a new password and replaces every other unlock method." })] })), _jsxs("div", { children: [_jsx("h2", { className: "text-sm font-semibold mb-2", children: "Recovery codes" }), _jsx("p", { className: "text-xs text-text-muted mb-3", children: "Regenerating replaces all of your existing recovery codes \u2014 old ones stop working immediately." }), _jsx(Button, { type: "button", variant: "secondary", loading: regenerating, disabled: regenerating || !vault, onClick: handleRegenerateRecoveryCodes, className: "!w-auto", children: "Regenerate recovery codes" })] }), _jsxs("form", { onSubmit: handleRotateKeys, className: "flex flex-col gap-2 border-t border-border pt-6", children: [_jsx("h2", { className: "text-sm font-semibold", children: "Rotate keys" }), _jsx("p", { className: "text-xs text-text-muted mb-1", children: "Real revocation, for when a device or an unlock method may have been compromised. Re-protects your existing encryption key under a brand new master key - your signing/ encryption keypair itself doesn\u2019t change, so mail you\u2019ve already sent or received still decrypts normally. Every current unlock method (password, recovery codes, and anything else on file) stops working immediately; you\u2019ll set a new password and get new recovery codes below." }), rotationBlockedBySigning && (_jsx("p", { className: "text-xs text-text-muted", children: signingStatus === "checking"
+                            }) })) : (_jsx("p", { className: "text-sm text-text-muted", children: "No unlock methods on file." })), _jsxs(Modal, { open: pendingRemoval !== null, onClose: () => setPendingRemoval(null), title: "Remove unlock method", children: [_jsx("p", { className: "text-sm mb-5", children: "Remove this unlock method? It will no longer unlock this mailbox\u2019s encrypted mail on any device." }), _jsxs("div", { className: "flex gap-3 justify-end", children: [_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", onClick: () => setPendingRemoval(null), children: "Cancel" }), _jsx(Button, { type: "button", className: "!w-auto !bg-none !bg-danger !border-danger hover:!bg-danger", onClick: () => handleRemove(pendingRemoval), children: "Remove method" })] })] })] }), canManageKeys && (_jsxs(_Fragment, { children: [passwordWraps.length === 0 ? (vault && (_jsxs("form", { onSubmit: handleAddPassword, className: "flex flex-col gap-2", children: [_jsx("h2", { className: "text-sm font-semibold", children: "Add a password" }), _jsx("input", { type: "password", "aria-label": "New password", placeholder: "New password", className: "w-full text-sm border border-border rounded-sm py-1.5 px-2 bg-surface", value: newPassword, onChange: (e) => setNewPassword(e.target.value), disabled: addingPassword, autoComplete: "new-password" }), _jsx("input", { type: "password", "aria-label": "Confirm new password", placeholder: "Confirm new password", className: "w-full text-sm border border-border rounded-sm py-1.5 px-2 bg-surface", value: confirmNewPassword, onChange: (e) => setConfirmNewPassword(e.target.value), disabled: addingPassword, autoComplete: "new-password" }), _jsx("div", { children: _jsx(Button, { type: "submit", loading: addingPassword, disabled: addingPassword, className: "!w-auto", children: "Add password" }) })] }))) : (_jsxs("div", { children: [_jsx("h2", { className: "text-sm font-semibold mb-2", children: "Changing your password" }), _jsx("p", { className: "text-xs text-text-muted", children: "Only one password can unlock this mailbox. To change it, rotate your keys below - that sets a new password and replaces every other unlock method." })] })), _jsxs("div", { children: [_jsx("h2", { className: "text-sm font-semibold mb-2", children: "Recovery codes" }), _jsx("p", { className: "text-xs text-text-muted mb-3", children: "Regenerating replaces all of your existing recovery codes \u2014 old ones stop working immediately." }), _jsx(Button, { type: "button", variant: "secondary", loading: regenerating, disabled: regenerating || !vault, onClick: handleRegenerateRecoveryCodes, className: "!w-auto", children: "Regenerate recovery codes" })] }), _jsxs(Modal, { open: confirmingRotation, onClose: () => setConfirmingRotation(false), title: "Rotate your keys?", children: [_jsx("p", { className: "text-sm mb-3", children: "Every other way of unlocking this mailbox - its password, its recovery codes, and every other device\u2019s saved password - stops working the moment this finishes, and cannot be brought back. You will be shown new recovery codes once." }), _jsxs("div", { className: "flex gap-3 justify-end", children: [_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", onClick: () => setConfirmingRotation(false), children: "Cancel" }), _jsx(Button, { type: "button", className: "!w-auto !bg-none !bg-danger !border-danger hover:!bg-danger", onClick: () => void rotateKeys(), children: "Yes, rotate my keys" })] })] }), _jsxs("form", { onSubmit: handleRotateKeys, className: "flex flex-col gap-2 border-t border-border pt-6", children: [_jsx("h2", { className: "text-sm font-semibold", children: "Rotate keys" }), _jsx("p", { className: "text-xs text-text-muted mb-1", children: "Real revocation, for when a device or an unlock method may have been compromised. Re-protects your existing encryption key under a brand new master key - your signing/ encryption keypair itself doesn\u2019t change, so mail you\u2019ve already sent or received still decrypts normally. Every current unlock method (password, recovery codes, and anything else on file) stops working immediately; you\u2019ll set a new password and get new recovery codes below." }), rotationBlockedBySigning && (_jsx("p", { className: "text-xs text-text-muted", children: signingStatus === "checking"
                                         ? "Checking whether a signing certificate enrollment is still in progress..."
                                         : "Rotation is unavailable while a signing certificate enrollment is in progress - rotating now would lose the key being enrolled. Try again once it finishes, or cancel the enrollment." })), signingStatus === "pending" && signingEnrollmentId && (_jsxs("div", { className: "flex flex-col gap-2", children: [cancelEnrollmentError && _jsx(Alert, { children: cancelEnrollmentError }), _jsx("div", { children: _jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", loading: cancelingEnrollment, disabled: cancelingEnrollment, onClick: () => handleCancelEnrollment(signingEnrollmentId), children: "Cancel enrollment" }) })] })), _jsx("input", { type: "password", "aria-label": "New password for rotated keys", placeholder: "New password", className: "w-full text-sm border border-border rounded-sm py-1.5 px-2 bg-surface", value: rotationPassword, onChange: (e) => setRotationPassword(e.target.value), disabled: rotating || rotationBlockedBySigning, autoComplete: "new-password" }), _jsx("input", { type: "password", "aria-label": "Confirm new password for rotated keys", placeholder: "Confirm new password", className: "w-full text-sm border border-border rounded-sm py-1.5 px-2 bg-surface", value: rotationConfirmPassword, onChange: (e) => setRotationConfirmPassword(e.target.value), disabled: rotating || rotationBlockedBySigning, autoComplete: "new-password" }), _jsx("div", { children: _jsx(Button, { type: "submit", variant: "secondary", className: "!w-auto text-danger", loading: rotating, disabled: rotating || rotationBlockedBySigning, children: "Rotate keys now" }) })] })] })), _jsxs("div", { children: [_jsx("h2", { className: "text-sm font-semibold mb-2", children: "Session timeout" }), _jsx("p", { className: "text-xs text-text-muted mb-3", children: "Automatically destroys your unlocked keys on this device after this much time with no activity anywhere in the app - not just Mail or Settings. Applies the next time you open or reload the app." }), _jsx("select", { "aria-label": "Session timeout", className: "text-sm border border-border rounded-sm py-1.5 px-2 bg-surface", value: idleTimeoutMinutes, onChange: handleIdleTimeoutChange, children: IDLE_TIMEOUT_OPTIONS_MINUTES.map((minutes) => (_jsx("option", { value: minutes, children: idleTimeoutLabel(minutes) }, minutes))) })] }), _jsxs("div", { children: [_jsx("h2", { className: "text-sm font-semibold mb-2", children: "Local search index size" }), _jsxs("p", { className: "text-xs text-text-muted mb-3", children: ["How much decrypted mail this device keeps in a local encrypted search index, so recent search results and inbox previews work instantly without contacting the server every time. Defaults to ", localIndexDefaultByteBudgetLabel, " on this device. Applies the next time this mailbox\u2019s index rebuilds (e.g. the next time you unlock it) \u2014 lowering it doesn\u2019t delete anything already indexed elsewhere, it just narrows what this device keeps a local copy of."] }), _jsx("select", { "aria-label": "Local search index size", className: "text-sm border border-border rounded-sm py-1.5 px-2 bg-surface", value: localIndexByteBudget, onChange: handleLocalIndexByteBudgetChange, children: LOCAL_INDEX_SIZE_OPTIONS.map((option) => (_jsx("option", { value: option.bytes, children: option.label }, option.bytes))) })] }), _jsxs("div", { children: [_jsx("h2", { className: "text-sm font-semibold mb-2", children: "This session" }), _jsx("p", { className: "text-xs text-text-muted mb-3", children: "Removes your unlocked keys from this browser tab\u2019s memory right now, without affecting any other device. You\u2019ll be asked to unlock again the next time you read or send encrypted mail here." }), _jsx(Button, { type: "button", variant: "secondary", className: "!w-auto text-danger", onClick: handleDestroyKeysNow, children: "Destroy keys on this device now" })] })] }) }));
 }

package/dist/apps/www/settings/privacy/index.js

@@ -16,6 +16,7 @@ import Alert from "../../../../lib/components/feedback/Alert.js";
 import Button from "../../../../lib/components/buttons/Button.js";
 import Modal from "../../../../lib/components/overlays/Modal.js";
 import { notifyApiError } from "../../../shared/notifications/apiErrors.js";
+import GravatarSetting from "../../../shared/components/settings/GravatarSetting.js";
 const NON_MAIL_FOLDER_TYPES = new Set(["calendar", "contacts", "tasks", "notes"]);
 function importFormatFromFilename(filename) {
     return filename.toLowerCase().endsWith(".pst") ? "pst" : "mbox";
@@ -49,7 +50,7 @@ function PrivacyContent({ userUid }) {
     const ownedMailboxes = mailboxes.filter((mb) => mb.ownerUserUid !== undefined && mb.ownerUserUid === userUid);
     const ownMailbox = ownedMailboxes.length === 1 ? ownedMailboxes[0] : undefined;
     const selectedIsOwn = selected.uid === ownMailbox?.uid;
-    return (_jsx("div", { className: "flex-1 min-w-0 overflow-y-auto p-6", children: _jsxs("div", { className: "max-w-xl flex flex-col gap-8", children: [_jsxs("div", { children: [_jsx("h1", { className: "text-lg font-bold tracking-tight mb-1", children: "Privacy & Data" }), _jsx("p", { className: "text-sm text-text-muted", children: "Export or manage the data associated with this mailbox." })] }), selectedIsOwn ? (_jsxs(_Fragment, { children: [_jsx(ExportSection, { mailboxUid: mailboxUid, mailboxLabel: `${selected.displayName} (${selected.primarySmtpAddress})` }), _jsx(ImportSection, { mailboxUid: mailboxUid }), _jsx(ErasureSection, { mailboxLabel: `${selected.displayName} (${selected.primarySmtpAddress})` })] })) : (_jsx(OwnMailboxOnlyNotice, { ownedMailboxCount: ownedMailboxes.length, ownMailboxLabel: ownMailbox && `${ownMailbox.displayName} (${ownMailbox.primarySmtpAddress})` }))] }) }));
+    return (_jsx("div", { className: "flex-1 min-w-0 overflow-y-auto p-6", children: _jsxs("div", { className: "max-w-xl flex flex-col gap-8", children: [_jsxs("div", { children: [_jsx("h1", { className: "text-lg font-bold tracking-tight mb-1", children: "Privacy & Data" }), _jsx("p", { className: "text-sm text-text-muted", children: "Export or manage the data associated with this mailbox." })] }), _jsx(GravatarSetting, {}), selectedIsOwn ? (_jsxs(_Fragment, { children: [_jsx(ExportSection, { mailboxUid: mailboxUid, mailboxLabel: `${selected.displayName} (${selected.primarySmtpAddress})` }), _jsx(ImportSection, { mailboxUid: mailboxUid }), _jsx(ErasureSection, { mailboxLabel: `${selected.displayName} (${selected.primarySmtpAddress})` })] })) : (_jsx(OwnMailboxOnlyNotice, { ownedMailboxCount: ownedMailboxes.length, ownMailboxLabel: ownMailbox && `${ownMailbox.displayName} (${ownMailbox.primarySmtpAddress})` }))] }) }));
 }
 function OwnMailboxOnlyNotice({ ownedMailboxCount, ownMailboxLabel }) {
     let detail;
@@ -158,7 +159,7 @@ function ImportSection({ mailboxUid }) {
             return;
         }
         setUploading(true);
-        uploadMailboxImport(file, { format: importFormatFromFilename(file.name), targetFolderUid })
+        uploadMailboxImport(file, { format: importFormatFromFilename(file.name), targetFolderUid, mailboxUid: mailboxUid }, client)
             .then(() => loadRequests())
             .catch((err) => notifyApiError(err, "Couldn't upload the file"))
             .finally(() => setUploading(false));

package/dist/apps/www/settings/profile/index.js

@@ -119,7 +119,10 @@ function ProfileContent() {
                                             }, "aria-describedby": "profile-time-zone-help" }), timezone !== deviceZone && (_jsxs(Button, { type: "button", variant: "text", className: "!w-auto", onClick: () => {
                                                 setTimezone(deviceZone);
                                                 setSaved(false);
-                                            }, children: ["Use this device\u2019s time zone (", describeTimeZone(deviceZone), ")"] }))] }), zoneWasPreselected && (_jsx("p", { className: "mt-1 text-xs text-text-muted", children: "Your mailbox has no time zone chosen yet; this device\u2019s is preselected. Save to keep it." })), _jsx("p", { id: "profile-time-zone-help", className: "mt-1 text-xs text-text-muted", children: "How calendar times and reminders are shown and scheduled for this mailbox, such as when an event or a reminder falls." })] }), _jsxs(FormField, { label: "Free/busy visibility", htmlFor: "profile-free-busy", children: [_jsx("select", { id: "profile-free-busy", className: SELECT_CLASS, value: freeBusy, disabled: !canChangeFreeBusy, onChange: (e) => {
+                                            }, children: ["Use this device\u2019s time zone (", describeTimeZone(deviceZone), ")"] }))] }), zoneWasPreselected && (_jsxs("p", { className: "mt-1 text-xs text-text-muted", children: ["Your mailbox has no time zone chosen yet (it uses UTC); this device\u2019s is preselected, and Save sets it - whatever else you change.", " ", _jsx(Button, { type: "button", variant: "text", className: "!w-auto !inline !p-0 !text-xs", onClick: () => {
+                                                setTimezone(DEFAULT_TIME_ZONE);
+                                                setSaved(false);
+                                            }, children: "Keep UTC" })] })), _jsx("p", { id: "profile-time-zone-help", className: "mt-1 text-xs text-text-muted", children: "How calendar times and reminders are shown and scheduled for this mailbox, such as when an event or a reminder falls." })] }), _jsxs(FormField, { label: "Free/busy visibility", htmlFor: "profile-free-busy", children: [_jsx("select", { id: "profile-free-busy", className: SELECT_CLASS, value: freeBusy, disabled: !canChangeFreeBusy, onChange: (e) => {
                                         setFreeBusy(e.target.value);
                                         setSaved(false);
                                     }, "aria-describedby": "profile-free-busy-help", children: FREE_BUSY_CHOICES.map((choice) => (_jsx("option", { value: choice.value, children: choice.label }, choice.value))) }), _jsx("p", { id: "profile-free-busy-help", className: "mt-1 text-xs text-text-muted", children: FREE_BUSY_CHOICES.find((choice) => choice.value === freeBusy).help }), _jsx("p", { className: "mt-1 text-xs text-text-muted", children: "Who can see the hours you are busy when they look for a time to meet - never the title, place or guests of an event." }), !canChangeFreeBusy && (_jsx("p", { className: "mt-1 text-xs text-text-muted", children: "This mailbox is shared with you: only its owner can change who sees its free/busy times." }))] }), _jsx("div", { children: _jsx(Button, { type: "submit", loading: saving, disabled: saving, className: "!w-auto", children: "Save" }) })] })] }) }));

package/dist/apps/www/settings/sharing/index.js

@@ -4,7 +4,7 @@ import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-run
 // SPDX-License-Identifier: MPL-2.0
 ///////////////////////////////////////////////////////////////////////////////
 import { pageTitle } from "../../../shared/navigation/pageTitle.js";
-import { useEffect, useState } from "react";
+import { useEffect, useRef, useState } from "react";
 import { ApiRequestError } from "../../../../lib/util/api.js";
 import { listMailboxAccess, removeMailboxAccess, setMailboxAccess, } from "../../../../lib/mail/mailboxAccessApi.js";
 import SettingsShell, { useSettingsShell } from "../../../shared/components/settings/layout/SettingsShell.js";
@@ -40,15 +40,24 @@ function SharingContent() {
     // `SettingsShell` only ever renders its children once `mailboxUid` has resolved (a mailbox-less caller
     // gets `<MailboxProvisioning />` instead) - same established precedent as the Labels/Focused Inbox
     // settings pages, so none of the handlers below need their own `!mailboxUid` guard.
+    // Only the latest request's answer is shown (a reload after a change can overtake a slower earlier one).
+    const latestLoad = useRef(0);
     function reload() {
+        const load = ++latestLoad.current;
         setStatus("loading");
         setError(null);
         listMailboxAccess(mailboxUid)
             .then((result) => {
+            if (load !== latestLoad.current) {
+                return;
+            }
             setMembers(result);
             setStatus("ready");
         })
             .catch((err) => {
+            if (load !== latestLoad.current) {
+                return;
+            }
             // A 403 here is the live, server-verified "can this caller manage this mailbox's sharing"
             // signal - the same permission threshold (ACLAction.UPDATE) this route itself requires, so
             // no separate probe call is needed to decide which state to render.

package/dist/apps/www/settings/signatures/[uid].js

@@ -63,10 +63,7 @@ function SignatureDetailContent({ uid }) {
         setSaving(true);
         setSaved(false);
         try {
-            if (isDefaultForNewMessages || isDefaultForReplyForward) {
-                const existing = await listMailSignatures(mailboxUid, { limit: 100 });
-                await clearPreviousDefaults(existing, original.uid, isDefaultForNewMessages, isDefaultForReplyForward);
-            }
+            // This signature is saved first: were it refused (a 409, a 400) after the others had been cleared, the mailbox would be left with no default at all.
             const updated = await updateMailSignature({
                 uid: original.uid,
                 version: original.version,
@@ -76,6 +73,11 @@ function SignatureDetailContent({ uid }) {
                 isDefaultForReplyForward,
             });
             setOriginal(updated);
+            if (isDefaultForNewMessages || isDefaultForReplyForward) {
+                // The signature's own mailbox, not the one the page happens to have selected.
+                const existing = await listMailSignatures(original.mailboxUid, { limit: 100 });
+                await clearPreviousDefaults(existing, original.uid, isDefaultForNewMessages, isDefaultForReplyForward);
+            }
             setSaved(true);
         }
         catch (err) {

package/dist/apps/www/tasks/index.js

@@ -5,11 +5,13 @@ import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-run
 ///////////////////////////////////////////////////////////////////////////////
 import { pageTitle } from "../../shared/navigation/pageTitle.js";
 import { useEffect, useMemo, useRef, useState } from "react";
-import { endOfWeek, isAfter, isBefore, isToday, parseISO, startOfDay } from "date-fns";
+import { endOfWeek, isAfter, isBefore, isToday, startOfDay } from "date-fns";
 import { ApiRequestError } from "../../../lib/util/api.js";
 import { createTask, deleteTask, listTasks, setTaskCompleted, setTaskMyDay, } from "../../../lib/tasks/tasksApi.js";
 import { listFlaggedMessages } from "../../../lib/mail/flaggedMessages.js";
 import { useApiClient } from "../../../lib/util/apiClientContext.js";
+import { useDayKey } from "../../../lib/calendar/useDayKey.js";
+import { dueDateInstant, parseDueDate } from "../../shared/components/tasks/dueDate.js";
 import TasksShell, { useTasksShell } from "../../shared/components/tasks/layout/TasksShell.js";
 import TasksSidebar from "../../shared/components/tasks/TasksSidebar.js";
 import TasksToolbar from "../../shared/components/tasks/TasksToolbar.js";
@@ -27,14 +29,6 @@ const INPUT_CLASS = "text-sm py-1.5 px-2 border border-border rounded-sm bg-surf
 function TasksPage(props) {
     return (_jsx(TasksShell, { ...props, children: _jsx(TasksContent, {}) }));
 }
-/**
- * Parses a task's `dueDate` - `parseISO()` rather than `new Date()`, since `new Date("2026-06-16")` reads a
- * date-only value as UTC midnight, which is the *previous* local day anywhere west of UTC. A full
- * timestamp parses identically either way.
- */
-function parseDueDate(value) {
-    return parseISO(value);
-}
 const BUCKET_ORDER = ["Overdue", "Today", "This Week", "Later", "No due date"];
 /** Buckets a task by its due date relative to `now`, matching the Outlook/To-Do convention this list mirrors. */
 function bucketFor(task, now) {
@@ -94,7 +88,10 @@ function TasksContent() {
     // Registered only while the form is rendered (`canAddTask`), so its field is there.
     useShortcut(SHORTCUTS.tasks.create, () => addTaskRef.current.focus(), { enabled: canAddTask });
     const addTaskHint = useShortcutProps("Add a task", SHORTCUTS.tasks.create, canAddTask);
+    // Which load is the latest: a slower, older one (another folder's, from before the mailbox changed) must not replace the list a newer one set.
+    const loadRun = useRef(0);
     function reload() {
+        const run = ++loadRun.current;
         if (!folderUid) {
             setTasks([]);
             setTruncated(false);
@@ -105,11 +102,21 @@ function TasksContent() {
         setError(null);
         return listAllPages((page) => listTasks(folderUid, { limit: LIST_PAGE_SIZE, page }, client))
             .then((result) => {
-            setTasks(result.items);
-            setTruncated(result.truncated);
+            if (run === loadRun.current) {
+                setTasks(result.items);
+                setTruncated(result.truncated);
+            }
+        })
+            .catch((err) => {
+            if (run === loadRun.current) {
+                setError(err instanceof ApiRequestError ? err.message : "Could not load tasks.");
+            }
         })
-            .catch((err) => setError(err instanceof ApiRequestError ? err.message : "Could not load tasks."))
-            .finally(() => setLoading(false));
+            .finally(() => {
+            if (run === loadRun.current) {
+                setLoading(false);
+            }
+        });
     }
     useEffect(() => {
         void reload();
@@ -122,12 +129,29 @@ function TasksContent() {
         if (view.type !== "flagged" || !mailboxUid) {
             return;
         }
+        // Set once the view or mailbox this load was for is no longer the one shown, so its answer is dropped.
+        let stale = false;
         setFlaggedLoading(true);
         setFlaggedError(null);
         listFlaggedMessages(mailboxUid, client)
-            .then(setFlaggedMessages)
-            .catch((err) => setFlaggedError(err instanceof ApiRequestError ? err.message : "Could not load flagged email."))
-            .finally(() => setFlaggedLoading(false));
+            .then((messages) => {
+            if (!stale) {
+                setFlaggedMessages(messages);
+            }
+        })
+            .catch((err) => {
+            if (!stale) {
+                setFlaggedError(err instanceof ApiRequestError ? err.message : "Could not load flagged email.");
+            }
+        })
+            .finally(() => {
+            if (!stale) {
+                setFlaggedLoading(false);
+            }
+        });
+        return () => {
+            stale = true;
+        };
     }, [view, mailboxUid]);
     async function handleCreate(e) {
         e.preventDefault();
@@ -151,8 +175,8 @@ function TasksContent() {
                 mailboxUid: target,
                 folderUid: targetFolderUid,
                 title: title.trim(),
-                // The date input's "yyyy-MM-dd" is the user's *local* day - see `parseDueDate()`.
-                dueDate: dueDate ? parseDueDate(dueDate).toISOString() : undefined,
+                // The date input's "yyyy-MM-dd" is stored as that day's UTC midnight - see `dueDateInstant()`.
+                dueDate: dueDate ? dueDateInstant(dueDate) : undefined,
                 priority,
             }, client);
             if (target === mailboxUid) {
@@ -174,7 +198,24 @@ function TasksContent() {
             setCreating(false);
         }
     }
+    // The tasks whose completion is being saved. The control is disabled meanwhile, and the ref (current at once, unlike state) turns away a second click that
+    // lands before the page has re-rendered: it would send the same stale `version` and be refused, rolling the task back to a state the server has left.
+    const togglingRef = useRef(new Set());
+    const [toggling, setToggling] = useState(new Set());
+    function setTogglePending(uid, pending) {
+        if (pending) {
+            togglingRef.current.add(uid);
+        }
+        else {
+            togglingRef.current.delete(uid);
+        }
+        setToggling(new Set(togglingRef.current));
+    }
     async function handleToggle(task) {
+        if (togglingRef.current.has(task.uid)) {
+            return;
+        }
+        setTogglePending(task.uid, true);
         const nextCompleted = !task.completed;
         setTasks((prev) => prev.map((t) => (t.uid === task.uid ? { ...t, completed: nextCompleted } : t)));
         try {
@@ -185,6 +226,9 @@ function TasksContent() {
             setTasks((prev) => prev.map((t) => (t.uid === task.uid ? task : t)));
             notifyApiError(err, "Couldn't update the task");
         }
+        finally {
+            setTogglePending(task.uid, false);
+        }
     }
     async function handleDelete(task) {
         try {
@@ -230,8 +274,24 @@ function TasksContent() {
         }
     }, [tasks, view, userUid]);
     const checkedTasks = viewFiltered.filter((t) => checkedUids.has(t.uid));
+    // A bulk action sends every checked row's own version: pressed again before it finishes, it would send stale ones and raise a stream of 409s.
+    const bulkRunning = useRef(false);
+    function singleFlight(run) {
+        return async () => {
+            if (bulkRunning.current) {
+                return;
+            }
+            bulkRunning.current = true;
+            try {
+                await run();
+            }
+            finally {
+                bulkRunning.current = false;
+            }
+        };
+    }
     // The bulk handlers try every task and report each failure: the same failure repeated is one pop-up with a count.
-    async function handleBulkComplete() {
+    const handleBulkComplete = singleFlight(async () => {
         for (const task of checkedTasks) {
             try {
                 await setTaskCompleted(task, true, client);
@@ -242,8 +302,8 @@ function TasksContent() {
         }
         setCheckedUids(new Set());
         await reload();
-    }
-    async function handleBulkAddToMyDay() {
+    });
+    const handleBulkAddToMyDay = singleFlight(async () => {
         for (const task of checkedTasks) {
             try {
                 await setTaskMyDay(task, true, client);
@@ -254,7 +314,7 @@ function TasksContent() {
         }
         setCheckedUids(new Set());
         await reload();
-    }
+    });
     async function handleBulkDelete() {
         for (const task of checkedTasks) {
             try {
@@ -280,6 +340,8 @@ function TasksContent() {
             void handleBulkDelete();
         }
     }
+    // Re-worked when the day changes, so a page left open past midnight moves Today's tasks to Overdue.
+    const dayKey = useDayKey();
     const grouped = useMemo(() => {
         const now = new Date();
         const map = new Map(BUCKET_ORDER.map((b) => [b, []]));
@@ -290,17 +352,17 @@ function TasksContent() {
             map.get(bucketFor(task, now)).push(task);
         }
         return map;
-    }, [viewFiltered]);
+    }, [viewFiltered, dayKey]);
     const completedTasks = viewFiltered.filter((t) => t.completed);
     return (_jsxs("div", { className: "flex-1 min-w-0 min-h-0 flex flex-col lg:flex-row", children: [_jsx(TasksSidebar, { mailboxUid: mailboxUid, tasks: tasks, userUid: userUid, active: view, onSelect: handleSelectView }), _jsxs("div", { className: "flex-1 min-w-0 flex flex-col overflow-y-auto", children: [_jsx(TasksToolbar, { viewMode: viewMode, onViewModeChange: setViewMode, selectedCount: checkedTasks.length, onComplete: handleBulkComplete, onDelete: () => setPendingDelete({ type: "bulk" }), onAddToMyDay: handleBulkAddToMyDay }), _jsxs("div", { role: "region", "aria-label": "Tasks list", className: "max-w-2xl mx-auto w-full flex flex-col gap-6 p-6", children: [_jsx("h1", { className: "text-xl font-bold uppercase tracking-wide", children: "Tasks" }), error && _jsx(Alert, { children: error }), truncated && view.type !== "flagged" && (_jsxs(Alert, { children: ["This folder has more tasks than can be shown at once - only the first ", LIST_PAGE_SIZE * MAX_LIST_PAGES, " are listed."] })), view.type === "flagged" ? (_jsx(FlaggedEmailList, { loading: flaggedLoading, error: flaggedError, messages: flaggedMessages })) : (_jsxs(_Fragment, { children: [_jsxs("form", { onSubmit: handleCreate, className: "flex flex-wrap items-center gap-2 bg-surface border border-border rounded-md p-2", children: [_jsx("input", { ref: addTaskRef, type: "text", "aria-label": "Add a task", ...addTaskHint, className: `${INPUT_CLASS} min-w-40 basis-40 flex-1`, value: title, onChange: (e) => setTitle(e.target.value), placeholder: "Add a task" }), _jsx("input", { type: "date", "aria-label": "Due date", className: INPUT_CLASS, value: dueDate, onChange: (e) => setDueDate(e.target.value) }), _jsxs("select", { "aria-label": "Priority", className: INPUT_CLASS, value: priority, onChange: (e) => setPriority(e.target.value), children: [_jsx("option", { value: "low", children: "Low" }), _jsx("option", { value: "normal", children: "Normal" }), _jsx("option", { value: "high", children: "High" })] }), writableMailboxes.length > 1 && (_jsx("select", { "aria-label": "Task mailbox", className: `${INPUT_CLASS} max-w-40`, 
                                                 // `writableMailboxes` only has entries once `mailboxUid` has resolved.
-                                                value: targetMailboxUid ?? mailboxUid, onChange: (e) => setTargetMailboxUid(e.target.value), children: writableMailboxes.map((mb) => (_jsxs("option", { value: mb.uid, children: [mb.displayName, mb.ownerUserUid === userUid ? "" : " (shared)"] }, mb.uid))) })), _jsx(Button, { type: "submit", loading: creating, disabled: creating, className: "!w-auto shrink-0", children: "Add" })] }), createError && _jsx(Alert, { children: createError }), addedElsewhere && (_jsxs("p", { role: "status", className: "text-sm py-2 px-3 rounded-sm bg-surface-alt text-text", children: ["\u201C", addedElsewhere.title, "\u201D was added to", " ", mailboxes.find((mb) => mb.uid === addedElsewhere.mailboxUid)?.displayName ?? "another mailbox", ".", " ", _jsx("a", { href: `/tasks?mailboxUid=${encodeURIComponent(addedElsewhere.mailboxUid)}`, "data-router-shallow": "", "data-router-prefetch": "false", className: "font-medium text-primary-dark hover:underline", children: "View that mailbox\u2019s tasks" })] })), loading ? (_jsx("p", { className: "text-sm text-text-muted", children: "Loading\u2026" })) : viewFiltered.length === 0 ? (_jsx("p", { className: "text-sm text-text-muted", children: "No tasks yet." })) : viewMode === "grid" ? (_jsx(TaskTable, { tasks: viewFiltered, checkedUids: checkedUids, onToggleChecked: toggleChecked, onToggle: handleToggle, onDelete: requestDelete })) : (_jsxs(_Fragment, { children: [BUCKET_ORDER.map((bucket) => {
+                                                value: targetMailboxUid ?? mailboxUid, onChange: (e) => setTargetMailboxUid(e.target.value), children: writableMailboxes.map((mb) => (_jsxs("option", { value: mb.uid, children: [mb.displayName, mb.ownerUserUid === userUid ? "" : " (shared)"] }, mb.uid))) })), _jsx(Button, { type: "submit", loading: creating, disabled: creating, className: "!w-auto shrink-0", children: "Add" })] }), createError && _jsx(Alert, { children: createError }), addedElsewhere && (_jsxs("p", { role: "status", className: "text-sm py-2 px-3 rounded-sm bg-surface-alt text-text", children: ["\u201C", addedElsewhere.title, "\u201D was added to", " ", mailboxes.find((mb) => mb.uid === addedElsewhere.mailboxUid)?.displayName ?? "another mailbox", ".", " ", _jsx("a", { href: `/tasks?mailboxUid=${encodeURIComponent(addedElsewhere.mailboxUid)}`, "data-router-shallow": "", "data-router-prefetch": "false", className: "font-medium text-primary-dark hover:underline", children: "View that mailbox\u2019s tasks" })] })), loading ? (_jsx("p", { className: "text-sm text-text-muted", children: "Loading\u2026" })) : viewFiltered.length === 0 ? (_jsx("p", { className: "text-sm text-text-muted", children: "No tasks yet." })) : viewMode === "grid" ? (_jsx(TaskTable, { tasks: viewFiltered, checkedUids: checkedUids, onToggleChecked: toggleChecked, onToggle: handleToggle, toggling: toggling, onDelete: requestDelete })) : (_jsxs(_Fragment, { children: [BUCKET_ORDER.map((bucket) => {
                                                 const items = grouped.get(bucket);
                                                 if (items.length === 0) {
                                                     return null;
                                                 }
-                                                return (_jsx(TaskGroup, { label: bucket, tasks: items, checkedUids: checkedUids, onToggleChecked: toggleChecked, onToggle: handleToggle, onDelete: requestDelete }, bucket));
-                                            }), completedTasks.length > 0 && (_jsx(TaskGroup, { label: "Completed", tasks: completedTasks, checkedUids: checkedUids, onToggleChecked: toggleChecked, onToggle: handleToggle, onDelete: requestDelete }))] }))] }))] })] }), _jsxs(Modal, { open: pendingDelete !== null, onClose: () => setPendingDelete(null), title: "Delete tasks", children: [_jsx("p", { className: "text-sm mb-5", children: pendingDelete?.type === "single"
+                                                return (_jsx(TaskGroup, { label: bucket, tasks: items, checkedUids: checkedUids, onToggleChecked: toggleChecked, onToggle: handleToggle, toggling: toggling, onDelete: requestDelete }, bucket));
+                                            }), completedTasks.length > 0 && (_jsx(TaskGroup, { label: "Completed", tasks: completedTasks, checkedUids: checkedUids, onToggleChecked: toggleChecked, onToggle: handleToggle, toggling: toggling, onDelete: requestDelete }))] }))] }))] })] }), _jsxs(Modal, { open: pendingDelete !== null, onClose: () => setPendingDelete(null), title: "Delete tasks", children: [_jsx("p", { className: "text-sm mb-5", children: pendingDelete?.type === "single"
                             ? `Delete "${pendingDelete.task.title}"?`
                             : `Delete ${checkedTasks.length} selected ${checkedTasks.length === 1 ? "task" : "tasks"}?` }), _jsxs("div", { className: "flex gap-3 justify-end", children: [_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", onClick: () => setPendingDelete(null), children: "Cancel" }), _jsx(Button, { type: "button", className: "!w-auto !bg-none !bg-danger !border-danger hover:!bg-danger", onClick: handleConfirmDelete, children: "Delete" })] })] })] }));
 }
@@ -318,16 +380,16 @@ function FlaggedEmailList({ loading, error, messages }) {
 }
 /** A circular completion-toggle control matching Outlook's visual language (not a native checkbox), while
  * staying a real accessible toggle. */
-function CompletionToggle({ task, onToggle }) {
-    return (_jsx("button", { type: "button", role: "checkbox", "aria-checked": task.completed, "aria-label": `Mark "${task.title}" as ${task.completed ? "not complete" : "complete"}`, onClick: () => onToggle(task), className: [
+function CompletionToggle({ task, onToggle, pending }) {
+    return (_jsx("button", { type: "button", role: "checkbox", "aria-checked": task.completed, disabled: pending, "aria-label": `Mark "${task.title}" as ${task.completed ? "not complete" : "complete"}`, onClick: () => onToggle(task), className: [
             "w-4 h-4 rounded-full border shrink-0 flex items-center justify-center text-[10px]",
             task.completed ? "bg-primary border-primary text-white" : "border-border text-transparent",
         ].join(" "), children: "\u2713" }));
 }
-function TaskGroup({ label, tasks, checkedUids, onToggleChecked, onToggle, onDelete }) {
-    return (_jsxs("div", { children: [_jsx("h2", { className: "text-xs font-bold uppercase tracking-wide text-text-muted mb-2", children: label }), _jsx("ul", { className: "bg-surface border border-border rounded-md divide-y divide-border", children: tasks.map((task) => (_jsxs("li", { className: "flex items-center gap-3 py-2.5 px-3", children: [_jsx("input", { type: "checkbox", "aria-label": `Select ${task.title}`, checked: checkedUids.has(task.uid), onChange: () => onToggleChecked(task.uid) }), _jsx(CompletionToggle, { task: task, onToggle: onToggle }), _jsx("span", { className: ["flex-1 text-sm", task.completed ? "line-through text-text-muted" : ""].join(" "), children: task.title }), task.priority !== "normal" && (_jsx("span", { className: ["text-xs font-medium", PRIORITY_CLASS[task.priority]].join(" "), children: PRIORITY_LABEL[task.priority] })), task.dueDate && (_jsx("span", { className: "text-xs text-text-muted shrink-0", children: parseDueDate(task.dueDate).toLocaleDateString() })), _jsx("button", { type: "button", onClick: () => onDelete(task), "aria-label": `Delete "${task.title}"`, className: "text-text-muted hover:text-danger text-sm px-1", children: "\u00D7" })] }, task.uid))) })] }));
+function TaskGroup({ label, tasks, checkedUids, onToggleChecked, onToggle, toggling, onDelete }) {
+    return (_jsxs("div", { children: [_jsx("h2", { className: "text-xs font-bold uppercase tracking-wide text-text-muted mb-2", children: label }), _jsx("ul", { className: "bg-surface border border-border rounded-md divide-y divide-border", children: tasks.map((task) => (_jsxs("li", { className: "flex items-center gap-3 py-2.5 px-3", children: [_jsx("input", { type: "checkbox", "aria-label": `Select ${task.title}`, checked: checkedUids.has(task.uid), onChange: () => onToggleChecked(task.uid) }), _jsx(CompletionToggle, { task: task, onToggle: onToggle, pending: toggling.has(task.uid) }), _jsx("span", { className: ["flex-1 text-sm", task.completed ? "line-through text-text-muted" : ""].join(" "), children: task.title }), task.priority !== "normal" && (_jsx("span", { className: ["text-xs font-medium", PRIORITY_CLASS[task.priority]].join(" "), children: PRIORITY_LABEL[task.priority] })), task.dueDate && (_jsx("span", { className: "text-xs text-text-muted shrink-0", children: parseDueDate(task.dueDate).toLocaleDateString() })), _jsx("button", { type: "button", onClick: () => onDelete(task), "aria-label": `Delete "${task.title}"`, className: "text-text-muted hover:text-danger text-sm px-1", children: "\u00D7" })] }, task.uid))) })] }));
 }
-function TaskTable({ tasks, checkedUids, onToggleChecked, onToggle, onDelete }) {
+function TaskTable({ tasks, checkedUids, onToggleChecked, onToggle, toggling, onDelete }) {
     const allChecked = tasks.length > 0 && tasks.every((t) => checkedUids.has(t.uid));
     function toggleAll() {
         if (allChecked) {
@@ -345,7 +407,7 @@ function TaskTable({ tasks, checkedUids, onToggleChecked, onToggle, onDelete })
             }
         }
     }
-    return (_jsx("div", { className: "overflow-x-auto", children: _jsxs("table", { className: "w-full text-sm bg-surface border border-border rounded-md", children: [_jsx("thead", { children: _jsxs("tr", { className: "border-b border-border text-left", children: [_jsx("th", { className: "w-8 px-3 py-2", children: _jsx("input", { type: "checkbox", "aria-label": "Select all tasks", checked: allChecked, onChange: toggleAll }) }), _jsx("th", { className: "w-8 px-3 py-2" }), _jsx("th", { className: "px-3 py-2 text-xs font-bold uppercase tracking-wide text-text-muted", children: "Title" }), _jsx("th", { className: "px-3 py-2 text-xs font-bold uppercase tracking-wide text-text-muted", children: "Due Date" }), _jsx("th", { className: "px-3 py-2 text-xs font-bold uppercase tracking-wide text-text-muted", children: "Importance" }), _jsx("th", { className: "w-8 px-3 py-2" })] }) }), _jsx("tbody", { children: tasks.map((task) => (_jsxs("tr", { className: "border-b border-border last:border-0", children: [_jsx("td", { className: "px-3 py-2", children: _jsx("input", { type: "checkbox", "aria-label": `Select ${task.title}`, checked: checkedUids.has(task.uid), onChange: () => onToggleChecked(task.uid) }) }), _jsx("td", { className: "px-3 py-2", children: _jsx(CompletionToggle, { task: task, onToggle: onToggle }) }), _jsx("td", { className: ["px-3 py-2", task.completed ? "line-through text-text-muted" : ""].join(" "), children: task.title }), _jsx("td", { className: "px-3 py-2 text-text-muted", children: task.dueDate ? parseDueDate(task.dueDate).toLocaleDateString() : "" }), _jsx("td", { className: ["px-3 py-2", PRIORITY_CLASS[task.priority]].join(" "), children: PRIORITY_LABEL[task.priority] }), _jsx("td", { className: "px-3 py-2", children: _jsx("button", { type: "button", onClick: () => onDelete(task), "aria-label": `Delete "${task.title}"`, className: "text-text-muted hover:text-danger text-sm px-1", children: "\u00D7" }) })] }, task.uid))) })] }) }));
+    return (_jsx("div", { className: "overflow-x-auto", children: _jsxs("table", { className: "w-full text-sm bg-surface border border-border rounded-md", children: [_jsx("thead", { children: _jsxs("tr", { className: "border-b border-border text-left", children: [_jsx("th", { className: "w-8 px-3 py-2", children: _jsx("input", { type: "checkbox", "aria-label": "Select all tasks", checked: allChecked, onChange: toggleAll }) }), _jsx("th", { className: "w-8 px-3 py-2" }), _jsx("th", { className: "px-3 py-2 text-xs font-bold uppercase tracking-wide text-text-muted", children: "Title" }), _jsx("th", { className: "px-3 py-2 text-xs font-bold uppercase tracking-wide text-text-muted", children: "Due Date" }), _jsx("th", { className: "px-3 py-2 text-xs font-bold uppercase tracking-wide text-text-muted", children: "Importance" }), _jsx("th", { className: "w-8 px-3 py-2" })] }) }), _jsx("tbody", { children: tasks.map((task) => (_jsxs("tr", { className: "border-b border-border last:border-0", children: [_jsx("td", { className: "px-3 py-2", children: _jsx("input", { type: "checkbox", "aria-label": `Select ${task.title}`, checked: checkedUids.has(task.uid), onChange: () => onToggleChecked(task.uid) }) }), _jsx("td", { className: "px-3 py-2", children: _jsx(CompletionToggle, { task: task, onToggle: onToggle, pending: toggling.has(task.uid) }) }), _jsx("td", { className: ["px-3 py-2", task.completed ? "line-through text-text-muted" : ""].join(" "), children: task.title }), _jsx("td", { className: "px-3 py-2 text-text-muted", children: task.dueDate ? parseDueDate(task.dueDate).toLocaleDateString() : "" }), _jsx("td", { className: ["px-3 py-2", PRIORITY_CLASS[task.priority]].join(" "), children: PRIORITY_LABEL[task.priority] }), _jsx("td", { className: "px-3 py-2", children: _jsx("button", { type: "button", onClick: () => onDelete(task), "aria-label": `Delete "${task.title}"`, className: "text-text-muted hover:text-danger text-sm px-1", children: "\u00D7" }) })] }, task.uid))) })] }) }));
 }
 export default TasksPage;
 /** The tab's title: `Brand: Tasks` (see `pageTitle()`). */

package/dist/lib/admin/auditLogApi.js

@@ -9,7 +9,7 @@
  * own server-internal `recordAuditLog()`.
  */
 import { withClient } from "../util/api.js";
-import { buildQuery } from "../util/apiQuery.js";
+import { buildQuery, sortQuery } from "../util/apiQuery.js";
 /** `client`, given below, is an explicit `ApiClient` from `createApiClient()` (e.g. one account of a multi-account
  * app) to call instead of the default global `apiFetch()` - see `withClient()`'s own doc comment in `util/api.ts`.
  * Omitted (the default), this behaves exactly as before. */
@@ -23,5 +23,5 @@ export function listAuditLog(filters = {}, params = {}, client) {
         extra.action = filters.action;
     if (filters.targetType)
         extra.targetType = filters.targetType;
-    return withClient(client, `/mail/audit-log?${buildQuery(params, extra)}`);
+    return withClient(client, `/mail/audit-log?${buildQuery(params, { ...extra, ...sortQuery({ dateCreated: "DESC", uid: "ASC" }) })}`);
 }

package/dist/lib/admin/distributionListsApi.js

@@ -7,12 +7,12 @@
  * trusted-role-only, no self-service creation or per-list delegated ownership (v1).
  */
 import { withClient } from "../util/api.js";
-import { buildQuery } from "../util/apiQuery.js";
+import { buildQuery, sortQuery } from "../util/apiQuery.js";
 /** `client`, given by every function below, is an explicit `ApiClient` from `createApiClient()` (e.g. one
  * account of a multi-account app) to call instead of the default global `apiFetch()` - see `withClient()`'s
  * own doc comment in `util/api.ts`. Omitted (the default), every function here behaves exactly as before. */
 export function listDistributionLists(params = {}, client) {
-    return withClient(client, `/mail/distribution-lists?${buildQuery(params)}`);
+    return withClient(client, `/mail/distribution-lists?${buildQuery(params, sortQuery({ uid: "ASC" }))}`);
 }
 export function getDistributionList(uid, client) {
     return withClient(client, `/mail/distribution-lists/${encodeURIComponent(uid)}`);

package/dist/lib/admin/domainsApi.js

@@ -8,12 +8,12 @@
  * admin-scoped entities.
  */
 import { withClient } from "../util/api.js";
-import { buildQuery } from "../util/apiQuery.js";
+import { buildQuery, sortQuery } from "../util/apiQuery.js";
 /** `client`, given by every function below, is an explicit `ApiClient` from `createApiClient()` (e.g. one
  * account of a multi-account app) to call instead of the default global `apiFetch()` - see `withClient()`'s
  * own doc comment in `util/api.ts`. Omitted (the default), every function here behaves exactly as before. */
 export function listDomains(params = {}, client) {
-    return withClient(client, `/mail/domains?${buildQuery(params)}`);
+    return withClient(client, `/mail/domains?${buildQuery(params, sortQuery({ uid: "ASC" }))}`);
 }
 export function getDomain(uid, client) {
     return withClient(client, `/mail/domains/${encodeURIComponent(uid)}`);

package/dist/lib/admin/escrowAuditLogApi.js

@@ -12,12 +12,12 @@
  * enforces it and a non-trusted caller simply gets a 403 `ApiRequestError` back.
  */
 import { withClient } from "../util/api.js";
-import { buildQuery } from "../util/apiQuery.js";
+import { buildQuery, sortQuery } from "../util/apiQuery.js";
 /** `client`, given by every function below, is an explicit `ApiClient` from `createApiClient()` (e.g. one
  * account of a multi-account app) to call instead of the default global `apiFetch()` - see `withClient()`'s
  * own doc comment in `util/api.ts`. Omitted (the default), every function here behaves exactly as before. */
 export function listAuditLogEntries(params = {}, client) {
-    return withClient(client, `/escrow/audit-log?${buildQuery(params)}`);
+    return withClient(client, `/escrow/audit-log?${buildQuery(params, sortQuery({ sequence: "DESC" }))}`);
 }
 export function getAuditLogEntry(uid, client) {
     return withClient(client, `/escrow/audit-log/${encodeURIComponent(uid)}`);