@rapidmx/web-client 0.30.0 → 0.32.0

package/dist/lib/crypto/messageSecurity.js

@@ -63,7 +63,7 @@ function isEncryptedContentType(contentType) {
     return smimeType === "enveloped-data" || smimeType === "authenveloped-data";
 }
 const NO_KEY_ERROR = "This device doesn't have the key needed to decrypt this message.";
-const UNSUPPORTED_ENCRYPTION_ERROR = "This message uses an older, unauthenticated encryption algorithm that RapidMX doesn't accept, so it can't be opened safely.";
+const UNSUPPORTED_ENCRYPTION_ERROR = "This message uses an older, unauthenticated encryption algorithm, or an encryption format, that RapidMX doesn't accept, so it can't be opened safely.";
 function renderDisplayBody(display) {
     if (display?.html !== undefined) {
         return { html: display.html };
@@ -94,6 +94,14 @@ function hasRepeatedAddressField(fields) {
     }
     return SINGLETON_ADDRESS_FIELDS.some((name) => (counts.get(name) ?? 0) > 1);
 }
+/** Whether the unsigned (outer) `Date:` header value `outer` names the same instant as the signed one, `signed`. A signed date
+ * that is missing or unreadable leaves nothing to compare, but when there is one the outer must match it: a replayed message
+ * that dropped or garbled its outer Date is as changed as one that carries a new one. */
+function sameInstant(signed, outer) {
+    // `String(undefined)` is not a date either.
+    const left = Date.parse(String(signed));
+    return Number.isNaN(left) || left === Date.parse(String(outer));
+}
 function normalizePins(pins) {
     return (Array.isArray(pins) ? pins : pins === undefined ? [] : [pins]).map((pin) => pin.toLowerCase());
 }
@@ -138,7 +146,11 @@ function checkIdentityAndHeaders(input, certDer) {
         if (!sameAddressSet(extractAddresses(protectedHeaders?.cc), extractAddresses(outerHeaders["cc"]))) {
             return "header_mismatch";
         }
-        if (input.compareSubject && normalizeSubject(protectedHeaders?.subject) !== normalizeSubject(outerHeaders["subject"])) {
+        // A signed-only message's outer Date is unsigned too: a signed message replayed later carries a new one. (An encrypted
+        // message's outer Date is checked against its HP-Outer copy instead - see `headerTamperDetected`.)
+        if (input.compareSubject &&
+            (normalizeSubject(protectedHeaders?.subject) !== normalizeSubject(outerHeaders["subject"]) ||
+                !sameInstant(protectedHeaders?.date, outerHeaders["date"]))) {
             return "header_mismatch";
         }
     }
@@ -250,14 +262,16 @@ async function evaluateLive(rawMime, unlocked, pinnedSignerFingerprints, readerA
         if (!parsed.decrypted) {
             return { result: { state: "encrypted", decryptError: parsed.unsupportedContentEncryption ? UNSUPPORTED_ENCRYPTION_ERROR : NO_KEY_ERROR }, kind: "encrypted" };
         }
+        // Anyone holding the reader's public certificate can encrypt a message with any protected headers they like, so they
+        // are only exposed once a signature over them verified - and a key-changed message keeps them aside for a seal.
         const content = {
             ...renderDisplayBody(parsed.displayBody),
             headerTamperDetected: parsed.headerTamperDetected,
             subject: parsed.protectedHeaders?.subject || undefined,
-            ...exposedHeaders(parsed.protectedHeaders),
             attachments: parsed.attachments,
             ...addressing(parsed.protectedHeaders),
         };
+        const signedHeaders = exposedHeaders(parsed.protectedHeaders);
         if (parsed.signatureVerified === undefined) {
             return { result: { state: "encrypted", ...content }, kind: "encrypted" };
         }
@@ -266,9 +280,13 @@ async function evaluateLive(rawMime, unlocked, pinnedSignerFingerprints, readerA
         }
         const { failure, trusted, signer, acceptedSigner } = await checkSigner(parsed.signerCertificateDer, parsed.protectedHeaders, parsed.protectedHeaderFields, false);
         if (failure) {
-            return { result: { state: "signature_failed", signatureFailureReason: failure, ...content, ...(failure === "signer_key_changed" ? acceptedSigner : signer) }, kind: "encrypted" };
+            return {
+                result: { state: "signature_failed", signatureFailureReason: failure, ...content, ...(failure === "signer_key_changed" ? acceptedSigner : signer) },
+                kind: "encrypted",
+                ...(failure === "signer_key_changed" ? { signedContent: signedHeaders } : {}),
+            };
         }
-        return { result: { state: trusted ? "encrypted_verified" : "encrypted_unverified_signer", ...content, ...acceptedSigner }, kind: "encrypted" };
+        return { result: { state: trusted ? "encrypted_verified" : "encrypted_unverified_signer", ...content, ...signedHeaders, ...acceptedSigner }, kind: "encrypted" };
     }
     return { result: { state: "unprotected" }, kind: "other" };
 }

package/dist/lib/crypto/passwordUnlock.d.ts

@@ -9,6 +9,10 @@ export interface Argon2idParams {
  * matching the doc comment on `EncryptionCertificateAuthority`'s own conservative defaults elsewhere in
  * this system). */
 export declare const DEFAULT_ARGON2ID_PARAMS: Argon2idParams;
+/** The most a `MasterKeyWrap.kdf` label read back from the server may ask this device to spend: 1 GiB (in KiB),
+ * 10 passes and 16 lanes - well above every default this system has used, but far from what a hostile or buggy
+ * server could name (`m=4294967295`) to freeze the tab or exhaust WebAssembly memory. */
+export declare const MAX_ARGON2ID_PARAMS: Argon2idParams;
 /** Builds the `kdf` string stored alongside a password-method `MasterKeyWrap`, so parameters can be
  * upgraded over time without breaking existing accounts (each wrap records the parameters it was
  * actually created with). */
@@ -17,7 +21,8 @@ export declare function argon2idKdfLabel(params: Argon2idParams): string;
  * created with, so unlocking always re-derives with the *original* parameters even if
  * `DEFAULT_ARGON2ID_PARAMS` has since changed (the spec's own "KDF parameters ... MUST be stored
  * alongside each wrap, so costs can be raised over time without breaking existing accounts"). Returns
- * `undefined` for anything that isn't a well-formed `argon2id:m=...,t=...,p=...` label — including a
+ * `undefined` for anything that isn't a well-formed `argon2id:m=...,t=...,p=...` label, or whose parameters are
+ * zero or beyond `MAX_ARGON2ID_PARAMS` — including a
  * different KDF entirely (e.g. recovery codes' own `"hkdf-sha256"` label), which callers must not
  * attempt to unlock as if it were password-derived.
  */

package/dist/lib/crypto/passwordUnlock.js

@@ -23,6 +23,10 @@ import { hkdfDerive } from "./masterKey.js";
  * this system). */
 export const DEFAULT_ARGON2ID_PARAMS = { memorySize: 65536, iterations: 3, parallelism: 4 };
 const ARGON2ID_HASH_LENGTH_BYTES = 32;
+/** The most a `MasterKeyWrap.kdf` label read back from the server may ask this device to spend: 1 GiB (in KiB),
+ * 10 passes and 16 lanes - well above every default this system has used, but far from what a hostile or buggy
+ * server could name (`m=4294967295`) to freeze the tab or exhaust WebAssembly memory. */
+export const MAX_ARGON2ID_PARAMS = { memorySize: 1048576, iterations: 10, parallelism: 16 };
 /** Builds the `kdf` string stored alongside a password-method `MasterKeyWrap`, so parameters can be
  * upgraded over time without breaking existing accounts (each wrap records the parameters it was
  * actually created with). */
@@ -33,7 +37,8 @@ export function argon2idKdfLabel(params) {
  * created with, so unlocking always re-derives with the *original* parameters even if
  * `DEFAULT_ARGON2ID_PARAMS` has since changed (the spec's own "KDF parameters ... MUST be stored
  * alongside each wrap, so costs can be raised over time without breaking existing accounts"). Returns
- * `undefined` for anything that isn't a well-formed `argon2id:m=...,t=...,p=...` label — including a
+ * `undefined` for anything that isn't a well-formed `argon2id:m=...,t=...,p=...` label, or whose parameters are
+ * zero or beyond `MAX_ARGON2ID_PARAMS` — including a
  * different KDF entirely (e.g. recovery codes' own `"hkdf-sha256"` label), which callers must not
  * attempt to unlock as if it were password-derived.
  */
@@ -42,7 +47,13 @@ export function parseArgon2idKdfLabel(label) {
     if (!match) {
         return undefined;
     }
-    return { memorySize: Number(match[1]), iterations: Number(match[2]), parallelism: Number(match[3]) };
+    const params = { memorySize: Number(match[1]), iterations: Number(match[2]), parallelism: Number(match[3]) };
+    const inRange = (value, max) => value >= 1 && value <= max;
+    return inRange(params.memorySize, MAX_ARGON2ID_PARAMS.memorySize) &&
+        inRange(params.iterations, MAX_ARGON2ID_PARAMS.iterations) &&
+        inRange(params.parallelism, MAX_ARGON2ID_PARAMS.parallelism)
+        ? params
+        : undefined;
 }
 /** A fresh random salt for a new password enrollment. 16 bytes is Argon2id's own recommended minimum. */
 export function generateSalt(lengthBytes = 16) {

package/dist/lib/crypto/smime.js

@@ -36,6 +36,9 @@ const CONTENT_ENCRYPTION_ALGORITHM = { name: "AES-GCM", length: 256 };
 const ID_DATA = pkijs.ContentInfo.DATA;
 /** AES-GCM content-encryption OIDs (id-aes128-GCM, id-aes192-GCM, id-aes256-GCM - RFC 5084). The only
  * content encryption `decryptEnvelopedData()` accepts: see `UnsupportedContentEncryptionError`. */
+/** The CMS content type of RFC 5083 `AuthEnvelopedData` (`smime-type="authenveloped-data"`): authenticated, but not the
+ * structure `decryptEnvelopedDataWithKeys()` reads - it is reported as unsupported rather than as a missing key. */
+const AUTH_ENVELOPED_DATA_OID = "1.2.840.113549.1.9.16.1.23";
 const AEAD_CONTENT_ENCRYPTION_OIDS = new Set(["2.16.840.1.101.3.4.1.6", "2.16.840.1.101.3.4.1.26", "2.16.840.1.101.3.4.1.46"]);
 /**
  * Thrown by `decryptEnvelopedData()` for content encrypted with a non-AEAD algorithm (e.g. AES-CBC, 3DES).
@@ -48,7 +51,7 @@ const AEAD_CONTENT_ENCRYPTION_OIDS = new Set(["2.16.840.1.101.3.4.1.6", "2.16.84
  */
 export class UnsupportedContentEncryptionError extends Error {
     constructor(algorithmOid) {
-        super(`This message uses unauthenticated content encryption (${algorithmOid}), which is not accepted.`);
+        super(`This message uses content encryption (${algorithmOid}) that is not accepted: only AES-GCM EnvelopedData is.`);
         this.name = "UnsupportedContentEncryptionError";
         this.algorithmOid = algorithmOid;
     }
@@ -155,10 +158,12 @@ export function extractCertificateEmails(certDer) {
         return [];
     }
     const sanEmails = [];
+    let hasSan = false;
     for (const extension of cert.extensions ?? []) {
         if (extension.extnID !== "2.5.29.17") {
             continue;
         }
+        hasSan = true;
         // pkijs parses a well-formed SubjectAlternativeName into an AltName automatically, and leaves
         // `parsedValue` unset for a malformed one - a certificate asserting an unreadable SAN names nobody.
         const altNames = extension.parsedValue?.altNames;
@@ -172,7 +177,9 @@ export function extractCertificateEmails(certDer) {
             }
         }
     }
-    if (sanEmails.length > 0) {
+    // The SAN is authoritative whenever the certificate has one: DNS names alone name no mailbox, so a subject email
+    // address next to them must not stand in for it.
+    if (hasSan) {
         return sanEmails;
     }
     const subjectEmails = [];
@@ -322,6 +329,9 @@ function recipientMatchesCertificate(recipientInfo, certificate) {
  */
 export async function decryptEnvelopedDataWithKeys(envelopedDer, keys) {
     const contentInfo = pkijs.ContentInfo.fromBER(toArrayBuffer(envelopedDer));
+    if (contentInfo.contentType === AUTH_ENVELOPED_DATA_OID) {
+        throw new UnsupportedContentEncryptionError(AUTH_ENVELOPED_DATA_OID);
+    }
     if (contentInfo.contentType !== pkijs.ContentInfo.ENVELOPED_DATA) {
         throw new Error("This CMS content is not EnvelopedData.");
     }

package/dist/lib/mail/compose/composeQuoting.js

@@ -13,7 +13,7 @@
  * a stricter tag list for the editor. `message.bodyPreview` - a server-derived excerpt, truncated - is only the last
  * resort, when no body could be loaded.
  */
-import { sanitizeQuotedHtml } from "../messageBodySanitizer.js";
+import { sanitizeQuotedHtml, sanitizeSignatureHtml } from "../messageBodySanitizer.js";
 function escapeHtml(text) {
     return text
         .replace(/&/g, "&")
@@ -126,7 +126,8 @@ export function buildComposeBodyHtml(signatureHtml, quotedHtml) {
     }
     const separator = signatureHtml && quotedHtml ? "<p></p>" : "";
     const aboveQuote = quotedHtml ? "<p></p>" : "";
-    return `<p></p>${signatureHtml ?? ""}${separator}${aboveQuote}${quotedHtml ?? ""}`;
+    // A signature can be written by someone else (a shared mailbox's delegate): it is sanitized like anything else the editor is given.
+    return `<p></p>${signatureHtml ? sanitizeSignatureHtml(signatureHtml) : ""}${separator}${aboveQuote}${quotedHtml ?? ""}`;
 }
 /**
  * The longest `References` chain `buildReplyThreading()` reports. A chain grows by one entry per reply forever

package/dist/lib/mail/compose/quotedImages.d.ts

@@ -15,7 +15,10 @@ export interface QuotedImageReference {
 }
 /**
  * `html` with each of its embedded images (`cid:`, or no source at all) replaced by the `data:` URI `resolve` gives for it. An image
- * `resolve` has no picture for is left as it is (the quote's sanitizer then drops it); images that already are `data:` URIs and remote
- * ones are not asked about. `html` is returned as given when it has no such image, or where there is no DOM to parse it with.
+ * `resolve` has no picture for (or fails on) is left as it is (the quote's sanitizer then drops it); images that already are `data:` URIs and
+ * remote ones are not asked about. `html` is returned as given when it has no such image, or where there is no DOM to parse it with.
+ *
+ * The images are resolved a few at a time. When `signal` aborts (the caller's deadline) the wait ends there: the pictures that have arrived
+ * are embedded, the rest left as they were, and `resolve` - which is given `signal` to cancel its own request with - is asked for no more.
  */
-export declare function embedQuotedImages(html: string, resolve: (reference: QuotedImageReference) => Promise<string | undefined>): Promise<string>;
+export declare function embedQuotedImages(html: string, resolve: (reference: QuotedImageReference, signal?: AbortSignal) => Promise<string | undefined>, signal?: AbortSignal): Promise<string>;

package/dist/lib/mail/compose/quotedImages.js

@@ -12,26 +12,52 @@
 export const MAX_QUOTED_IMAGE_BYTES = 2000000;
 /** The most picture data a quote carries, in all (as `data:` URI characters). */
 export const MAX_QUOTED_IMAGES_CHARS = 6000000;
+/** How many pictures are fetched at once. */
+const QUOTED_IMAGE_CONCURRENCY = 4;
 /**
  * `html` with each of its embedded images (`cid:`, or no source at all) replaced by the `data:` URI `resolve` gives for it. An image
- * `resolve` has no picture for is left as it is (the quote's sanitizer then drops it); images that already are `data:` URIs and remote
- * ones are not asked about. `html` is returned as given when it has no such image, or where there is no DOM to parse it with.
+ * `resolve` has no picture for (or fails on) is left as it is (the quote's sanitizer then drops it); images that already are `data:` URIs and
+ * remote ones are not asked about. `html` is returned as given when it has no such image, or where there is no DOM to parse it with.
+ *
+ * The images are resolved a few at a time. When `signal` aborts (the caller's deadline) the wait ends there: the pictures that have arrived
+ * are embedded, the rest left as they were, and `resolve` - which is given `signal` to cancel its own request with - is asked for no more.
  */
-export async function embedQuotedImages(html, resolve) {
+export async function embedQuotedImages(html, resolve, signal) {
     if (typeof DOMParser === "undefined" || !/<img\b/i.test(html)) {
         return html;
     }
     const doc = new DOMParser().parseFromString(html, "text/html");
-    let budget = MAX_QUOTED_IMAGES_CHARS;
-    let changed = false;
+    const targets = [];
     for (const image of Array.from(doc.querySelectorAll("img"))) {
         const src = (image.getAttribute("src") ?? "").trim();
         const cid = /^cid:/i.test(src);
-        if (!cid && src !== "") {
-            continue;
+        if (cid || src === "") {
+            targets.push({ image, reference: { ...(cid ? { cid: src.slice(4) } : {}), alt: image.getAttribute("alt") ?? undefined } });
+        }
+    }
+    let next = 0;
+    const worker = async () => {
+        while (next < targets.length && !signal?.aborted) {
+            const target = targets[next++];
+            target.uri = await resolve(target.reference, signal).catch(() => undefined);
         }
-        const uri = await resolve({ ...(cid ? { cid: src.slice(4) } : {}), alt: image.getAttribute("alt") ?? undefined });
-        if (uri !== undefined && uri.length <= budget) {
+    };
+    let onAbort;
+    const deadline = new Promise((done) => {
+        onAbort = done;
+        if (signal?.aborted) {
+            done();
+        }
+        signal?.addEventListener("abort", onAbort, { once: true });
+    });
+    await Promise.race([Promise.all(Array.from({ length: Math.min(QUOTED_IMAGE_CONCURRENCY, targets.length) }, worker)), deadline]);
+    signal?.removeEventListener("abort", onAbort);
+    // Whatever has arrived by now is embedded, in document order, for as long as the budget lasts.
+    let budget = MAX_QUOTED_IMAGES_CHARS;
+    let changed = false;
+    for (const { image, uri } of targets) {
+        // Only a picture of the original's own is ever put in: whatever a resolver answers, a `src` that is not a `data:` image never gets in.
+        if (uri !== undefined && /^data:image\//i.test(uri) && uri.length <= budget) {
             budget -= uri.length;
             image.setAttribute("src", uri);
             changed = true;

package/dist/lib/mail/labelsApi.js

@@ -10,12 +10,12 @@
  * automatically for inbound mail; there is no separate "assign" endpoint.
  */
 import { withClient } from "../util/api.js";
-import { buildQuery } from "../util/apiQuery.js";
+import { SETTINGS_LIST_LIMIT, buildQuery } from "../util/apiQuery.js";
 /** `client`, given by every function below, is an explicit `ApiClient` from `createApiClient()` (e.g. one
  * account of a multi-account app) to call instead of the default global `apiFetch()` - see `withClient()`'s
  * own doc comment in `util/api.ts`. Omitted (the default), every function here behaves exactly as before. */
 export function listLabels(mailboxUid, params = {}, client) {
-    return withClient(client, `/mail/labels?${buildQuery(params, { mailboxUid })}`);
+    return withClient(client, `/mail/labels?${buildQuery({ limit: SETTINGS_LIST_LIMIT, ...params }, { mailboxUid })}`);
 }
 export function getLabel(uid, client) {
     return withClient(client, `/mail/labels/${encodeURIComponent(uid)}`);

package/dist/lib/mail/mailApi.d.ts

@@ -692,12 +692,12 @@ export declare function attachmentContentUrl(uid: string): string;
 /**
  * Uploads a file's raw bytes as a new attachment on a not-yet-sent draft. Bypasses `apiFetch` — that helper
  * always forces `Content-Type: application/json`, which would corrupt binary content; this sends the file's
- * own bytes/type directly instead, matching `BaseAttachmentRoute.upload`'s expectation of a raw request body.
+ * own bytes/type directly instead (through `client` when one is given), matching `BaseAttachmentRoute.upload`'s expectation of a raw request body.
  */
 export declare function uploadAttachment(messageUid: string, file: File, options?: {
     inline?: boolean;
     contentId?: string;
-}): Promise<Attachment>;
+}, client?: ApiClient): Promise<Attachment>;
 export interface ComposeRecipientInput {
     address: string;
     displayName?: string;
@@ -760,6 +760,8 @@ export declare function emptyFolder(folderUid: string, client?: ApiClient): Prom
  * itself does no MIME composition). Does not send the message.
  */
 export declare function assembleDraft(messageUid: string, input: AssembleDraftInput, client?: ApiClient): Promise<Message>;
+/** Forgets the pictures attached to draft `messageUid`, for when it has been sent or deleted (they are only remembered to avoid attaching one twice). */
+export declare function forgetDraftImages(messageUid: string): void;
 export interface AssembleDraftRawInput {
     to: ComposeRecipientInput[];
     cc?: ComposeRecipientInput[];
@@ -812,8 +814,9 @@ export interface QueuedSend {
 export declare function queueMessageSend(messageUid: string, client?: ApiClient): Promise<QueuedSend>;
 /**
  * Fetches a message's raw RFC 5322 MIME source — for client-side E2E decrypt/signature-verification
- * only (`crypto/smimeMessage.ts`), never for display. Bypasses `apiFetch()` (which only ever decodes a
- * JSON response body): this server-local route (`BaseMessageRawContentRoute.ts` in `server`, mounted
+ * only (`crypto/smimeMessage.ts`), never for display. Goes through `withClientBlob()` rather than `apiFetch()` (which
+ * only ever decodes a JSON response body, and renews an expired session) - the same session renewal and, given a
+ * `client`, the same account and token as every other call: this server-local route (`BaseMessageRawContentRoute.ts` in `server`, mounted
  * alongside `@rapidmx/restapi`'s own `MessageRoute`) returns `message/rfc822`, not JSON — the one thing
  * that library's own `GET /:id/content` deliberately never serves (see that route's own doc comment).
  *
@@ -823,7 +826,7 @@ export declare function queueMessageSend(messageUid: string, client?: ApiClient)
  * straight to `evaluateMessageSecurity()` (see `crypto/mime.ts`'s doc comment on binary strings); it is
  * not display text.
  */
-export declare function getMessageRawContent(messageUid: string): Promise<string>;
+export declare function getMessageRawContent(messageUid: string, client?: ApiClient): Promise<string>;
 export interface ImpersonationResult {
     token: string;
     user: {

package/dist/lib/mail/mailApi.js

@@ -12,11 +12,12 @@
  * to see somebody's mail impersonates them (`impersonateUser()`). See `BaseMailboxRoute`'s doc comment in
  * `@rapidmx/restapi` and this repo's `.claude/NOTES.md`.
  */
-import { ApiRequestError, apiFetch, apiUrl, authApiFetch, withClient, withCsrfHeader } from "../util/api.js";
-import { buildQuery } from "../util/apiQuery.js";
+import { ApiRequestError, apiFetch, apiUrl, authApiFetch, withClient, withClientBlob, withClientRaw, } from "../util/api.js";
+import { buildQuery, sortQuery } from "../util/apiQuery.js";
 import { deviceTimeZone } from "../util/timeZone.js";
 import { bytesToBinaryString } from "../crypto/mime.js";
-import { newContentId, parseDataImage } from "./inlineImages.js";
+import { EMBEDDED_IMAGE_TYPES, newContentId, parseDataImage } from "./inlineImages.js";
+import { MAX_QUOTED_IMAGE_BYTES } from "./compose/quotedImages.js";
 /** Whether `mailbox` is one shared with the caller rather than their own: a delegate grant on somebody's mailbox, or a mailbox with no
  * owner at all (a shared/org mailbox they were granted). */
 export function isSharedWithMe(mailbox) {
@@ -41,7 +42,7 @@ export function safeSendersOf(mailbox) {
 /** Lists the mailboxes the caller owns or has been granted - the same for everyone, an administrator included. With
  * `scope: "admin"` (admin console only) it lists every mailbox as administrative metadata instead. */
 export function listMailboxes(params = {}, client) {
-    return withClient(client, `/mail/mailboxes?${buildQuery(params, scopeQuery(params))}`);
+    return withClient(client, `/mail/mailboxes?${buildQuery(params, { ...scopeQuery(params), ...(params.scope === "admin" ? sortQuery({ uid: "ASC" }) : {}) })}`);
 }
 /** One mailbox the caller owns or has been granted; with `scope: "admin"` (admin console only), its administrative metadata. */
 export function getMailbox(uid, options = {}, client) {
@@ -103,7 +104,7 @@ export function deleteMailbox(uid, version, options = {}, client) {
 }
 /** Lists quarantined mail for a mailbox the caller owns or has been granted; with `scope: "admin"` (admin console only), for any mailbox. */
 export function listQuarantine(mailboxUid, params = {}, client) {
-    return withClient(client, `/mail/quarantine?${buildQuery(params, { mailboxUid, ...scopeQuery(params) })}`);
+    return withClient(client, `/mail/quarantine?${buildQuery(params, { mailboxUid, ...scopeQuery(params), ...sortQuery({ dateCreated: "DESC", uid: "ASC" }) })}`);
 }
 /**
  * Marks a quarantined entry released. This only updates the record's metadata — it does not re-inject the
@@ -118,7 +119,7 @@ export function releaseQuarantineEntry(uid, version, releasedByUserUid, client)
 /** Lists ingest-queue entries for a mailbox the caller owns or has been granted - useful for diagnosing stuck delivery; with
  * `scope: "admin"` (admin console only), for any mailbox. */
 export function listIngestQueue(mailboxUid, params = {}, client) {
-    return withClient(client, `/mail/ingest-queue?${buildQuery(params, { mailboxUid, ...scopeQuery(params) })}`);
+    return withClient(client, `/mail/ingest-queue?${buildQuery(params, { mailboxUid, ...scopeQuery(params), ...sortQuery({ dateCreated: "DESC", uid: "ASC" }) })}`);
 }
 /** Fetches a mailbox's own ACL — its `records` are its owner's/delegates' grants (see BaseACLRoute). The server only answers a
  * caller who holds full access to that mailbox as themselves (never through a trusted role): to list, grant or revoke a mailbox's
@@ -417,9 +418,9 @@ export function attachmentContentUrl(uid) {
 /**
  * Uploads a file's raw bytes as a new attachment on a not-yet-sent draft. Bypasses `apiFetch` — that helper
  * always forces `Content-Type: application/json`, which would corrupt binary content; this sends the file's
- * own bytes/type directly instead, matching `BaseAttachmentRoute.upload`'s expectation of a raw request body.
+ * own bytes/type directly instead (through `client` when one is given), matching `BaseAttachmentRoute.upload`'s expectation of a raw request body.
  */
-export async function uploadAttachment(messageUid, file, options = {}) {
+export function uploadAttachment(messageUid, file, options = {}, client) {
     // Percent-encoded, not form-encoded (`URLSearchParams` writes a space as `+`, which the server reads as a plus sign: "My+photo.png").
     const query = { messageUid, filename: file.name, mimeType: file.type || "application/octet-stream" };
     if (options.inline) {
@@ -431,19 +432,7 @@ export async function uploadAttachment(messageUid, file, options = {}) {
     const params = Object.entries(query)
         .map(([key, value]) => `${key}=${encodeURIComponent(value)}`)
         .join("&");
-    const res = await fetch(apiUrl(`/mail/attachments/upload?${params}`), {
-        method: "POST",
-        credentials: "include",
-        headers: withCsrfHeader({ "Content-Type": file.type || "application/octet-stream" }),
-        body: file,
-    });
-    const contentType = res.headers.get("content-type") ?? "";
-    const responseBody = contentType.includes("application/json") ? await res.json().catch(() => undefined) : undefined;
-    if (!res.ok) {
-        const message = (responseBody && (responseBody.message || responseBody.error)) || res.statusText || "Upload failed.";
-        throw new ApiRequestError(message, res.status, responseBody?.code);
-    }
-    return responseBody;
+    return withClientRaw(client, `/mail/attachments/upload?${params}`, "POST", file, file.type || "application/octet-stream");
 }
 /**
  * Creates a blank draft `Message` in the given folder (normally the mailbox's Drafts folder) to compose into.
@@ -506,14 +495,53 @@ export function emptyFolder(folderUid, client) {
  * itself does no MIME composition). Does not send the message.
  */
 export async function assembleDraft(messageUid, input, client) {
-    const html = await attachDataImages(messageUid, input.html);
+    const html = await attachDataImages(messageUid, input.html, client);
     return withClient(client, `/mail/compose/${encodeURIComponent(messageUid)}/assemble`, {
         method: "POST",
         body: JSON.stringify({ ...input, html }),
     });
 }
-/** `data:` images already attached to a draft: its uid and the image, to the URL of the attachment it became. */
+/** `data:` images already attached to a draft: its uid and a fingerprint of the image, to the URL of the attachment it became. */
 const attachedDataImages = new Map();
+/** The most pictures remembered; the oldest go first (a draft that was never sent or discarded here would otherwise keep its pictures forever). */
+const MAX_ATTACHED_DATA_IMAGES = 256;
+/** The SHA-256 of the whole of `text`, in hex - what stands for a `data:` URI of up to megabytes without holding it, and which no two quoted pictures can be made to share. Where Web Crypto is not available the text itself stands for it. */
+async function fingerprint(text) {
+    if (!globalThis.crypto?.subtle) {
+        return text;
+    }
+    const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(text));
+    return Array.from(new Uint8Array(digest), (byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+/** The most pictures attached to one draft from its text; a quote cannot make a person's reply upload (and be charged for) any number of them. */
+const MAX_DATA_IMAGES_PER_DRAFT = 20;
+/** Whether `bytes` start the way a picture of `contentType` does - the type a quote declares is its own word, and the bytes are what the server stores and shows. */
+function hasImageSignature(contentType, bytes) {
+    const at = (offset, text) => Array.from(text).every((char, i) => bytes[offset + i] === char.charCodeAt(0));
+    switch (contentType.split("/")[1]) {
+        case "png":
+            return at(0, "\x89PNG");
+        case "jpg":
+        case "jpeg":
+            return at(0, "\xff\xd8\xff");
+        case "gif":
+            return at(0, "GIF8");
+        case "webp":
+            return at(0, "RIFF") && at(8, "WEBP");
+        case "avif":
+            return at(4, "ftypavi");
+        default:
+            return at(0, "BM");
+    }
+}
+/** Forgets the pictures attached to draft `messageUid`, for when it has been sent or deleted (they are only remembered to avoid attaching one twice). */
+export function forgetDraftImages(messageUid) {
+    for (const key of Array.from(attachedDataImages.keys())) {
+        if (key.startsWith(`${messageUid}\n`)) {
+            attachedDataImages.delete(key);
+        }
+    }
+}
 const DATA_IMAGE_TAG = /(<img\b[^>]*?\bsrc\s*=\s*)(["'])(data:image\/[^"']*)\2/gi;
 /** Names a picture by its type, for the attachment it becomes. */
 function pictureName(contentType) {
@@ -522,28 +550,39 @@ function pictureName(contentType) {
 /**
  * `html` with each `<img>` that embeds its picture as a `data:` URI (a quoted original's image, one pasted into the editor) pointed at an
  * attachment of the draft instead: the server drops `data:` images from the message it composes, and an attachment is what it makes an
- * inline part of. A picture is attached once per draft however often the draft is saved.
+ * inline part of. A picture is attached once per draft however often the draft is saved. Only what a quote itself embeds is attached - a raster
+ * image (`EMBEDDED_IMAGE_TYPES`, never SVG) of at most `MAX_QUOTED_IMAGE_BYTES` whose bytes are of the type it declares, and no more than
+ * `MAX_DATA_IMAGES_PER_DRAFT` of them; any other is left as it is, and the server drops it.
  */
-async function attachDataImages(messageUid, html) {
+async function attachDataImages(messageUid, html, client) {
     const found = Array.from(html.matchAll(DATA_IMAGE_TAG));
     if (found.length === 0) {
         return html;
     }
     const urls = new Map();
     for (const [, , , uri] of found) {
-        const key = `${messageUid}\n${uri}`;
+        if (urls.has(uri)) {
+            continue;
+        }
+        if (urls.size >= MAX_DATA_IMAGES_PER_DRAFT) {
+            break;
+        }
+        const key = `${messageUid}\n${await fingerprint(uri)}`;
         const known = attachedDataImages.get(key);
         if (known) {
             urls.set(uri, known);
             continue;
         }
         const image = parseDataImage(uri);
-        if (!image) {
+        if (!image || !EMBEDDED_IMAGE_TYPES.test(image.contentType) || image.bytes.length > MAX_QUOTED_IMAGE_BYTES || !hasImageSignature(image.contentType, image.bytes)) {
             continue;
         }
-        const attachment = await uploadAttachment(messageUid, new File([image.bytes], pictureName(image.contentType), { type: image.contentType }), { inline: true });
+        const attachment = await uploadAttachment(messageUid, new File([image.bytes], pictureName(image.contentType), { type: image.contentType }), { inline: true }, client);
         const url = attachmentContentUrl(attachment.uid);
         attachedDataImages.set(key, url);
+        if (attachedDataImages.size > MAX_ATTACHED_DATA_IMAGES) {
+            attachedDataImages.delete(attachedDataImages.keys().next().value);
+        }
         urls.set(uri, url);
     }
     return html.replace(DATA_IMAGE_TAG, (match, start, quote, uri) => (urls.has(uri) ? `${start}${quote}${urls.get(uri)}${quote}` : match));
@@ -599,8 +638,9 @@ export async function queueMessageSend(messageUid, client) {
 }
 /**
  * Fetches a message's raw RFC 5322 MIME source — for client-side E2E decrypt/signature-verification
- * only (`crypto/smimeMessage.ts`), never for display. Bypasses `apiFetch()` (which only ever decodes a
- * JSON response body): this server-local route (`BaseMessageRawContentRoute.ts` in `server`, mounted
+ * only (`crypto/smimeMessage.ts`), never for display. Goes through `withClientBlob()` rather than `apiFetch()` (which
+ * only ever decodes a JSON response body, and renews an expired session) - the same session renewal and, given a
+ * `client`, the same account and token as every other call: this server-local route (`BaseMessageRawContentRoute.ts` in `server`, mounted
  * alongside `@rapidmx/restapi`'s own `MessageRoute`) returns `message/rfc822`, not JSON — the one thing
  * that library's own `GET /:id/content` deliberately never serves (see that route's own doc comment).
  *
@@ -610,17 +650,11 @@ export async function queueMessageSend(messageUid, client) {
  * straight to `evaluateMessageSecurity()` (see `crypto/mime.ts`'s doc comment on binary strings); it is
  * not display text.
  */
-export async function getMessageRawContent(messageUid) {
-    const res = await fetch(apiUrl(`/mail/messages/${encodeURIComponent(messageUid)}/raw`), { credentials: "include" });
-    if (!res.ok) {
-        const contentType = res.headers.get("content-type") ?? "";
-        const body = contentType.includes("application/json") ? await res.json().catch(() => undefined) : undefined;
-        const message = (body && (body.message || body.error)) || res.statusText || "Could not load this message's raw content.";
-        throw new ApiRequestError(message, res.status, body?.code);
-    }
+export async function getMessageRawContent(messageUid, client) {
+    const raw = await withClientBlob(client, `/mail/messages/${encodeURIComponent(messageUid)}/raw`, "Could not load this message's raw content.");
     // Not `new TextDecoder("latin1")`: WHATWG maps that label to windows-1252, which remaps 0x80-0x9F and so
     // isn't byte-preserving. `bytesToBinaryString()` is an exact byte -> code unit conversion.
-    return bytesToBinaryString(new Uint8Array(await res.arrayBuffer()));
+    return bytesToBinaryString(new Uint8Array(await raw.arrayBuffer()));
 }
 /**
  * Trusted-role-only: starts an admin "log in as user" session. In production this calls auth-server

package/dist/lib/mail/mailDetailHooks.js

@@ -12,9 +12,14 @@ export function useMessageAttachments(message) {
             setAttachments([]);
             return;
         }
+        // A response for a message since replaced must not overwrite the one now shown.
+        let cancelled = false;
         listAttachments(message.folderUid, message.uid)
-            .then(setAttachments)
-            .catch(() => setAttachments([]));
+            .then((listed) => !cancelled && setAttachments(listed))
+            .catch(() => !cancelled && setAttachments([]));
+        return () => {
+            cancelled = true;
+        };
         // Only the fields the fetch actually depends on — not the whole `message` object, which gets a new
         // reference on every metadata-only patch (e.g. `useMarkMessageRead`'s `onUpdated(updated)`, or a
         // star/flag/label change wired to the same state) and would otherwise trigger a needless re-fetch.
@@ -49,5 +54,8 @@ export function useMarkMessageRead(message, onUpdated) {
         return () => {
             cancelled = true;
         };
-    }, [message]);
+        // Only the message's identity and read flag: a metadata-only patch swaps the object while the request is in flight, and
+        // restarting then would drop the first answer and send a second request with the old version (a 409 that leaves the
+        // message unread).
+    }, [message?.uid, message?.flags.read]);
 }

package/dist/lib/mail/mailFilterRulesApi.js

@@ -11,12 +11,12 @@
  * feature, not a data-model-only stub.
  */
 import { withClient } from "../util/api.js";
-import { buildQuery } from "../util/apiQuery.js";
+import { SETTINGS_LIST_LIMIT, buildQuery } from "../util/apiQuery.js";
 /** `client`, given by every function below, is an explicit `ApiClient` from `createApiClient()` (e.g. one
  * account of a multi-account app) to call instead of the default global `apiFetch()` - see `withClient()`'s
  * own doc comment in `util/api.ts`. Omitted (the default), every function here behaves exactly as before. */
 export function listMailFilterRules(mailboxUid, params = {}, client) {
-    return withClient(client, `/mail/mail-filter-rules?${buildQuery(params, { mailboxUid })}`);
+    return withClient(client, `/mail/mail-filter-rules?${buildQuery({ limit: SETTINGS_LIST_LIMIT, ...params }, { mailboxUid })}`);
 }
 export function getMailFilterRule(uid, client) {
     return withClient(client, `/mail/mail-filter-rules/${encodeURIComponent(uid)}`);

package/dist/lib/mail/mailSignaturesApi.js

@@ -10,12 +10,12 @@
  * resolved signature's `contentHtml` into a new draft.
  */
 import { withClient } from "../util/api.js";
-import { buildQuery } from "../util/apiQuery.js";
+import { SETTINGS_LIST_LIMIT, buildQuery } from "../util/apiQuery.js";
 /** `client`, given by every function below, is an explicit `ApiClient` from `createApiClient()` (e.g. one
  * account of a multi-account app) to call instead of the default global `apiFetch()` - see `withClient()`'s
  * own doc comment in `util/api.ts`. Omitted (the default), every function here behaves exactly as before. */
 export function listMailSignatures(mailboxUid, params = {}, client) {
-    return withClient(client, `/mail/mail-signatures?${buildQuery(params, { mailboxUid })}`);
+    return withClient(client, `/mail/mail-signatures?${buildQuery({ limit: SETTINGS_LIST_LIMIT, ...params }, { mailboxUid })}`);
 }
 export function getMailSignature(uid, client) {
     return withClient(client, `/mail/mail-signatures/${encodeURIComponent(uid)}`);

package/dist/lib/mail/mailboxImportApi.d.ts

@@ -42,7 +42,7 @@ export interface UploadMailboxImportInput {
  * with `format`/`targetFolderUid`/`mailboxUid` as query-string parameters, not a JSON body — the same
  * shape `mailApi.ts`'s `uploadAttachment()` already establishes for a raw-bytes upload.
  */
-export declare function uploadMailboxImport(file: File, input: UploadMailboxImportInput): Promise<MailboxImportRequest>;
+export declare function uploadMailboxImport(file: File, input: UploadMailboxImportInput, client?: ApiClient): Promise<MailboxImportRequest>;
 /** `client`, given by every function below that isn't a raw-bytes upload, is an explicit `ApiClient` from
  * `createApiClient()` (e.g. one account of a multi-account app) to call instead of the default global
  * `apiFetch()` - see `withClient()`'s own doc comment in `util/api.ts`. Omitted (the default), every