@rapidmx/web-client 0.30.0 → 0.32.0

package/lib/mail/mailApi.ts

@@ -13,12 +13,23 @@
  * `@rapidmx/restapi` and this repo's `.claude/NOTES.md`.
  */
 
-import { ApiClient, ApiRequestError, apiFetch, apiUrl, authApiFetch, withClient, withCsrfHeader } from "../util/api.js";
-import { ListParams, buildQuery } from "../util/apiQuery.js";
+import {
+    ApiClient,
+    ApiRequestError,
+    apiFetch,
+    apiUrl,
+    authApiFetch,
+    withClient,
+    withClientBlob,
+    withClientRaw,
+    withCsrfHeader,
+} from "../util/api.js";
+import { ListParams, buildQuery, sortQuery } from "../util/apiQuery.js";
 import { deviceTimeZone } from "../util/timeZone.js";
 import type { EncryptionPreference, PublicKey } from "../crypto/keyvaultApi.js";
 import { bytesToBinaryString } from "../crypto/mime.js";
-import { newContentId, parseDataImage } from "./inlineImages.js";
+import { EMBEDDED_IMAGE_TYPES, newContentId, parseDataImage } from "./inlineImages.js";
+import { MAX_QUOTED_IMAGE_BYTES } from "./compose/quotedImages.js";
 import type { ResolvedPrincipal } from "./mailboxAccessApi.js";
 
 export type { ListParams };
@@ -156,7 +167,7 @@ export function safeSendersOf(mailbox: Pick<Mailbox, "safeSenders">): string[] {
 /** Lists the mailboxes the caller owns or has been granted - the same for everyone, an administrator included. With
  * `scope: "admin"` (admin console only) it lists every mailbox as administrative metadata instead. */
 export function listMailboxes(params: ListParams & AdminScopeParams = {}, client?: ApiClient): Promise<Mailbox[]> {
-    return withClient(client, `/mail/mailboxes?${buildQuery(params, scopeQuery(params))}`);
+    return withClient(client, `/mail/mailboxes?${buildQuery(params, { ...scopeQuery(params), ...(params.scope === "admin" ? sortQuery({ uid: "ASC" }) : {}) })}`);
 }
 
 /** One mailbox the caller owns or has been granted; with `scope: "admin"` (admin console only), its administrative metadata. */
@@ -320,7 +331,7 @@ export function listQuarantine(
     params: ListParams & AdminScopeParams = {},
     client?: ApiClient,
 ): Promise<QuarantineEntry[]> {
-    return withClient(client, `/mail/quarantine?${buildQuery(params, { mailboxUid, ...scopeQuery(params) })}`);
+    return withClient(client, `/mail/quarantine?${buildQuery(params, { mailboxUid, ...scopeQuery(params), ...sortQuery({ dateCreated: "DESC", uid: "ASC" }) })}`);
 }
 
 /**
@@ -368,7 +379,7 @@ export function listIngestQueue(
     params: ListParams & AdminScopeParams = {},
     client?: ApiClient,
 ): Promise<IngestQueueEntry[]> {
-    return withClient(client, `/mail/ingest-queue?${buildQuery(params, { mailboxUid, ...scopeQuery(params) })}`);
+    return withClient(client, `/mail/ingest-queue?${buildQuery(params, { mailboxUid, ...scopeQuery(params), ...sortQuery({ dateCreated: "DESC", uid: "ASC" }) })}`);
 }
 
 export interface AclRecord {
@@ -1029,9 +1040,14 @@ export function attachmentContentUrl(uid: string): string {
 /**
  * Uploads a file's raw bytes as a new attachment on a not-yet-sent draft. Bypasses `apiFetch` — that helper
  * always forces `Content-Type: application/json`, which would corrupt binary content; this sends the file's
- * own bytes/type directly instead, matching `BaseAttachmentRoute.upload`'s expectation of a raw request body.
+ * own bytes/type directly instead (through `client` when one is given), matching `BaseAttachmentRoute.upload`'s expectation of a raw request body.
  */
-export async function uploadAttachment(messageUid: string, file: File, options: { inline?: boolean; contentId?: string } = {}): Promise<Attachment> {
+export function uploadAttachment(
+    messageUid: string,
+    file: File,
+    options: { inline?: boolean; contentId?: string } = {},
+    client?: ApiClient,
+): Promise<Attachment> {
     // Percent-encoded, not form-encoded (`URLSearchParams` writes a space as `+`, which the server reads as a plus sign: "My+photo.png").
     const query: Record<string, string> = { messageUid, filename: file.name, mimeType: file.type || "application/octet-stream" };
     if (options.inline) {
@@ -1043,19 +1059,7 @@ export async function uploadAttachment(messageUid: string, file: File, options:
     const params = Object.entries(query)
         .map(([key, value]) => `${key}=${encodeURIComponent(value)}`)
         .join("&");
-    const res = await fetch(apiUrl(`/mail/attachments/upload?${params}`), {
-        method: "POST",
-        credentials: "include",
-        headers: withCsrfHeader({ "Content-Type": file.type || "application/octet-stream" }),
-        body: file,
-    });
-    const contentType = res.headers.get("content-type") ?? "";
-    const responseBody = contentType.includes("application/json") ? await res.json().catch(() => undefined) : undefined;
-    if (!res.ok) {
-        const message = (responseBody && (responseBody.message || responseBody.error)) || res.statusText || "Upload failed.";
-        throw new ApiRequestError(message, res.status, responseBody?.code);
-    }
-    return responseBody as Attachment;
+    return withClientRaw(client, `/mail/attachments/upload?${params}`, "POST", file, file.type || "application/octet-stream");
 }
 
 export interface ComposeRecipientInput {
@@ -1149,15 +1153,58 @@ export function emptyFolder(folderUid: string, client?: ApiClient): Promise<void
  * itself does no MIME composition). Does not send the message.
  */
 export async function assembleDraft(messageUid: string, input: AssembleDraftInput, client?: ApiClient): Promise<Message> {
-    const html = await attachDataImages(messageUid, input.html);
+    const html = await attachDataImages(messageUid, input.html, client);
     return withClient(client, `/mail/compose/${encodeURIComponent(messageUid)}/assemble`, {
         method: "POST",
         body: JSON.stringify({ ...input, html }),
     });
 }
 
-/** `data:` images already attached to a draft: its uid and the image, to the URL of the attachment it became. */
+/** `data:` images already attached to a draft: its uid and a fingerprint of the image, to the URL of the attachment it became. */
 const attachedDataImages = new Map<string, string>();
+/** The most pictures remembered; the oldest go first (a draft that was never sent or discarded here would otherwise keep its pictures forever). */
+const MAX_ATTACHED_DATA_IMAGES = 256;
+
+/** The SHA-256 of the whole of `text`, in hex - what stands for a `data:` URI of up to megabytes without holding it, and which no two quoted pictures can be made to share. Where Web Crypto is not available the text itself stands for it. */
+async function fingerprint(text: string): Promise<string> {
+    if (!globalThis.crypto?.subtle) {
+        return text;
+    }
+    const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(text));
+    return Array.from(new Uint8Array(digest), (byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+
+/** The most pictures attached to one draft from its text; a quote cannot make a person's reply upload (and be charged for) any number of them. */
+const MAX_DATA_IMAGES_PER_DRAFT = 20;
+
+/** Whether `bytes` start the way a picture of `contentType` does - the type a quote declares is its own word, and the bytes are what the server stores and shows. */
+function hasImageSignature(contentType: string, bytes: Uint8Array): boolean {
+    const at = (offset: number, text: string) => Array.from(text).every((char, i) => bytes[offset + i] === char.charCodeAt(0));
+    switch (contentType.split("/")[1]) {
+        case "png":
+            return at(0, "\x89PNG");
+        case "jpg":
+        case "jpeg":
+            return at(0, "\xff\xd8\xff");
+        case "gif":
+            return at(0, "GIF8");
+        case "webp":
+            return at(0, "RIFF") && at(8, "WEBP");
+        case "avif":
+            return at(4, "ftypavi");
+        default:
+            return at(0, "BM");
+    }
+}
+
+/** Forgets the pictures attached to draft `messageUid`, for when it has been sent or deleted (they are only remembered to avoid attaching one twice). */
+export function forgetDraftImages(messageUid: string): void {
+    for (const key of Array.from(attachedDataImages.keys())) {
+        if (key.startsWith(`${messageUid}\n`)) {
+            attachedDataImages.delete(key);
+        }
+    }
+}
 
 const DATA_IMAGE_TAG = /(<img\b[^>]*?\bsrc\s*=\s*)(["'])(data:image\/[^"']*)\2/gi;
 
@@ -1169,28 +1216,39 @@ function pictureName(contentType: string): string {
 /**
  * `html` with each `<img>` that embeds its picture as a `data:` URI (a quoted original's image, one pasted into the editor) pointed at an
  * attachment of the draft instead: the server drops `data:` images from the message it composes, and an attachment is what it makes an
- * inline part of. A picture is attached once per draft however often the draft is saved.
+ * inline part of. A picture is attached once per draft however often the draft is saved. Only what a quote itself embeds is attached - a raster
+ * image (`EMBEDDED_IMAGE_TYPES`, never SVG) of at most `MAX_QUOTED_IMAGE_BYTES` whose bytes are of the type it declares, and no more than
+ * `MAX_DATA_IMAGES_PER_DRAFT` of them; any other is left as it is, and the server drops it.
  */
-async function attachDataImages(messageUid: string, html: string): Promise<string> {
+async function attachDataImages(messageUid: string, html: string, client?: ApiClient): Promise<string> {
     const found = Array.from(html.matchAll(DATA_IMAGE_TAG));
     if (found.length === 0) {
         return html;
     }
     const urls = new Map<string, string>();
     for (const [, , , uri] of found) {
-        const key = `${messageUid}\n${uri}`;
+        if (urls.has(uri)) {
+            continue;
+        }
+        if (urls.size >= MAX_DATA_IMAGES_PER_DRAFT) {
+            break;
+        }
+        const key = `${messageUid}\n${await fingerprint(uri)}`;
         const known = attachedDataImages.get(key);
         if (known) {
             urls.set(uri, known);
             continue;
         }
         const image = parseDataImage(uri);
-        if (!image) {
+        if (!image || !EMBEDDED_IMAGE_TYPES.test(image.contentType) || image.bytes.length > MAX_QUOTED_IMAGE_BYTES || !hasImageSignature(image.contentType, image.bytes)) {
             continue;
         }
-        const attachment = await uploadAttachment(messageUid, new File([image.bytes as BlobPart], pictureName(image.contentType), { type: image.contentType }), { inline: true });
+        const attachment = await uploadAttachment(messageUid, new File([image.bytes as BlobPart], pictureName(image.contentType), { type: image.contentType }), { inline: true }, client);
         const url = attachmentContentUrl(attachment.uid);
         attachedDataImages.set(key, url);
+        if (attachedDataImages.size > MAX_ATTACHED_DATA_IMAGES) {
+            attachedDataImages.delete(attachedDataImages.keys().next().value!);
+        }
         urls.set(uri, url);
     }
     return html.replace(DATA_IMAGE_TAG, (match, start: string, quote: string, uri: string) => (urls.has(uri) ? `${start}${quote}${urls.get(uri)}${quote}` : match));
@@ -1283,8 +1341,9 @@ export async function queueMessageSend(messageUid: string, client?: ApiClient):
 
 /**
  * Fetches a message's raw RFC 5322 MIME source — for client-side E2E decrypt/signature-verification
- * only (`crypto/smimeMessage.ts`), never for display. Bypasses `apiFetch()` (which only ever decodes a
- * JSON response body): this server-local route (`BaseMessageRawContentRoute.ts` in `server`, mounted
+ * only (`crypto/smimeMessage.ts`), never for display. Goes through `withClientBlob()` rather than `apiFetch()` (which
+ * only ever decodes a JSON response body, and renews an expired session) - the same session renewal and, given a
+ * `client`, the same account and token as every other call: this server-local route (`BaseMessageRawContentRoute.ts` in `server`, mounted
  * alongside `@rapidmx/restapi`'s own `MessageRoute`) returns `message/rfc822`, not JSON — the one thing
  * that library's own `GET /:id/content` deliberately never serves (see that route's own doc comment).
  *
@@ -1294,17 +1353,15 @@ export async function queueMessageSend(messageUid: string, client?: ApiClient):
  * straight to `evaluateMessageSecurity()` (see `crypto/mime.ts`'s doc comment on binary strings); it is
  * not display text.
  */
-export async function getMessageRawContent(messageUid: string): Promise<string> {
-    const res = await fetch(apiUrl(`/mail/messages/${encodeURIComponent(messageUid)}/raw`), { credentials: "include" });
-    if (!res.ok) {
-        const contentType = res.headers.get("content-type") ?? "";
-        const body = contentType.includes("application/json") ? await res.json().catch(() => undefined) : undefined;
-        const message = (body && (body.message || body.error)) || res.statusText || "Could not load this message's raw content.";
-        throw new ApiRequestError(message, res.status, body?.code);
-    }
+export async function getMessageRawContent(messageUid: string, client?: ApiClient): Promise<string> {
+    const raw = await withClientBlob(
+        client,
+        `/mail/messages/${encodeURIComponent(messageUid)}/raw`,
+        "Could not load this message's raw content.",
+    );
     // Not `new TextDecoder("latin1")`: WHATWG maps that label to windows-1252, which remaps 0x80-0x9F and so
     // isn't byte-preserving. `bytesToBinaryString()` is an exact byte -> code unit conversion.
-    return bytesToBinaryString(new Uint8Array(await res.arrayBuffer()));
+    return bytesToBinaryString(new Uint8Array(await raw.arrayBuffer()));
 }
 
 export interface ImpersonationResult {

package/lib/mail/mailDetailHooks.ts

@@ -14,9 +14,14 @@ export function useMessageAttachments(message: Message | null): Attachment[] {
             setAttachments([]);
             return;
         }
+        // A response for a message since replaced must not overwrite the one now shown.
+        let cancelled = false;
         listAttachments(message.folderUid, message.uid)
-            .then(setAttachments)
-            .catch(() => setAttachments([]));
+            .then((listed) => !cancelled && setAttachments(listed))
+            .catch(() => !cancelled && setAttachments([]));
+        return () => {
+            cancelled = true;
+        };
         // Only the fields the fetch actually depends on — not the whole `message` object, which gets a new
         // reference on every metadata-only patch (e.g. `useMarkMessageRead`'s `onUpdated(updated)`, or a
         // star/flag/label change wired to the same state) and would otherwise trigger a needless re-fetch.
@@ -53,5 +58,8 @@ export function useMarkMessageRead(message: Message | null, onUpdated: (updated:
         return () => {
             cancelled = true;
         };
-    }, [message]);
+        // Only the message's identity and read flag: a metadata-only patch swaps the object while the request is in flight, and
+        // restarting then would drop the first answer and send a second request with the old version (a 409 that leaves the
+        // message unread).
+    }, [message?.uid, message?.flags.read]);
 }

package/lib/mail/mailFilterRulesApi.ts

@@ -12,7 +12,7 @@
  */
 
 import { ApiClient, withClient } from "../util/api.js";
-import { ListParams, buildQuery } from "../util/apiQuery.js";
+import { ListParams, SETTINGS_LIST_LIMIT, buildQuery } from "../util/apiQuery.js";
 import { MessageImportance } from "./mailApi.js";
 
 export type { ListParams };
@@ -62,7 +62,7 @@ export interface MailFilterRule {
  * account of a multi-account app) to call instead of the default global `apiFetch()` - see `withClient()`'s
  * own doc comment in `util/api.ts`. Omitted (the default), every function here behaves exactly as before. */
 export function listMailFilterRules(mailboxUid: string, params: ListParams = {}, client?: ApiClient): Promise<MailFilterRule[]> {
-    return withClient(client, `/mail/mail-filter-rules?${buildQuery(params, { mailboxUid })}`);
+    return withClient(client, `/mail/mail-filter-rules?${buildQuery({ limit: SETTINGS_LIST_LIMIT, ...params }, { mailboxUid })}`);
 }
 
 export function getMailFilterRule(uid: string, client?: ApiClient): Promise<MailFilterRule> {

package/lib/mail/mailSignaturesApi.ts

@@ -11,7 +11,7 @@
  */
 
 import { ApiClient, withClient } from "../util/api.js";
-import { ListParams, buildQuery } from "../util/apiQuery.js";
+import { ListParams, SETTINGS_LIST_LIMIT, buildQuery } from "../util/apiQuery.js";
 
 export type { ListParams };
 
@@ -36,7 +36,7 @@ export interface MailSignature {
  * account of a multi-account app) to call instead of the default global `apiFetch()` - see `withClient()`'s
  * own doc comment in `util/api.ts`. Omitted (the default), every function here behaves exactly as before. */
 export function listMailSignatures(mailboxUid: string, params: ListParams = {}, client?: ApiClient): Promise<MailSignature[]> {
-    return withClient(client, `/mail/mail-signatures?${buildQuery(params, { mailboxUid })}`);
+    return withClient(client, `/mail/mail-signatures?${buildQuery({ limit: SETTINGS_LIST_LIMIT, ...params }, { mailboxUid })}`);
 }
 
 export function getMailSignature(uid: string, client?: ApiClient): Promise<MailSignature> {

package/lib/mail/mailboxImportApi.ts

@@ -9,7 +9,7 @@
  * stages the upload and returns the `pending` request; poll `getImportRequest()`/`listImportRequests()`
  * for `status` to become `"completed"` (with `importedCount`/`failedCount`) or `"failed"`.
  */
-import { ApiClient, ApiRequestError, apiUrl, withClient, withCsrfHeader } from "../util/api.js";
+import { ApiClient, withClient, withClientRaw } from "../util/api.js";
 import { RequestListParams, buildRequestListQuery } from "../util/apiQuery.js";
 
 export type { RequestListParams };
@@ -51,24 +51,18 @@ export interface UploadMailboxImportInput {
  * with `format`/`targetFolderUid`/`mailboxUid` as query-string parameters, not a JSON body — the same
  * shape `mailApi.ts`'s `uploadAttachment()` already establishes for a raw-bytes upload.
  */
-export async function uploadMailboxImport(file: File, input: UploadMailboxImportInput): Promise<MailboxImportRequest> {
+export function uploadMailboxImport(file: File, input: UploadMailboxImportInput, client?: ApiClient): Promise<MailboxImportRequest> {
     const params = new URLSearchParams({ format: input.format, targetFolderUid: input.targetFolderUid });
     if (input.mailboxUid) {
         params.set("mailboxUid", input.mailboxUid);
     }
-    const res = await fetch(apiUrl(`/mail/mailbox-import-requests?${params.toString()}`), {
-        method: "POST",
-        credentials: "include",
-        headers: withCsrfHeader({ "Content-Type": input.format === "pst" ? "application/vnd.ms-outlook" : "application/mbox" }),
-        body: file,
-    });
-    const contentType = res.headers.get("content-type") ?? "";
-    const responseBody = contentType.includes("application/json") ? await res.json().catch(() => undefined) : undefined;
-    if (!res.ok) {
-        const message = (responseBody && (responseBody.message || responseBody.error)) || res.statusText || "Upload failed.";
-        throw new ApiRequestError(message, res.status, responseBody?.code);
-    }
-    return responseBody as MailboxImportRequest;
+    return withClientRaw(
+        client,
+        `/mail/mailbox-import-requests?${params.toString()}`,
+        "POST",
+        file,
+        input.format === "pst" ? "application/vnd.ms-outlook" : "application/mbox",
+    );
 }
 
 /** `client`, given by every function below that isn't a raw-bytes upload, is an explicit `ApiClient` from

package/lib/mail/messageBodySanitizer.ts

@@ -27,6 +27,37 @@ export function stripRemoteCssUrls(css: string): string {
         .replace(/url\(\s*(["']?)(.*?)\1\s*\)/gi, (match, _quote: string, uri: string) => (EMBEDDED_URI.test(uri) ? match : "none"));
 }
 
+/** The candidate URLs of a `srcset` value, parsed as the HTML spec does: a candidate's URL is a run of non-whitespace
+ * characters (it may itself contain commas - a `data:` URI always does), so a comma that ends a URL or follows its
+ * descriptors separates candidates whether or not whitespace follows it. */
+function srcsetUrls(value: string): string[] {
+    const urls: string[] = [];
+    let position = 0;
+    while (position < value.length) {
+        const start = value.slice(position).search(/[^\s,]/);
+        if (start < 0) {
+            break;
+        }
+        position += start;
+        const end = value.slice(position).search(/\s/);
+        const token = end < 0 ? value.slice(position) : value.slice(position, position + end);
+        position += token.length;
+        urls.push(token.replace(/,+$/, ""));
+        if (!token.endsWith(",")) {
+            // Skip the descriptors, up to the comma that ends the candidate.
+            const comma = value.indexOf(",", position);
+            const descriptors = value.slice(position, comma < 0 ? value.length : comma);
+            if (descriptors.includes("(")) {
+                // The spec's tokenizer ignores commas inside parentheses, so a browser may read the candidates that follow differently from
+                // the way this does. No valid descriptor has one: refuse the whole value.
+                urls.push(descriptors);
+            }
+            position = comma < 0 ? value.length : comma + 1;
+        }
+    }
+    return urls;
+}
+
 type Purifier = ReturnType<typeof DOMPurify>;
 let bodyPurifier: Purifier | undefined;
 
@@ -58,7 +89,7 @@ function getBodyPurifier(): Purifier | undefined {
         }
         const isNavigationLink = name === "href" && ["a", "area"].includes(node.nodeName.toLowerCase());
         if (RESOURCE_URI_ATTRIBUTES.has(name) || (name === "href" && !isNavigationLink)) {
-            const candidates = name === "srcset" ? data.attrValue.split(/,\s+/) : [data.attrValue];
+            const candidates = name === "srcset" ? srcsetUrls(data.attrValue) : [data.attrValue];
             if (!candidates.every((candidate) => EMBEDDED_URI.test(candidate))) {
                 data.keepAttr = false;
             }
@@ -106,6 +137,21 @@ const QUOTE_FORBIDDEN_TAGS = [
     // svg/math are already in DISPLAY_FORBIDDEN_TAGS, spread above — not repeated here.
 ];
 
+let signaturePurifier: Purifier | undefined;
+
+/**
+ * Sanitizes a signature's HTML for the compose body: DOMPurify's defaults (no scripts, handlers or `javascript:` URLs) and
+ * the quote's tag list (nothing that styles, frames or submits). Unlike a quoted message, a signature is the sender's own
+ * and may carry pictures from the web, so remote images and links stay. Returns `""` when there is no DOM to sanitize with.
+ */
+export function sanitizeSignatureHtml(html: string): string {
+    if (typeof window === "undefined") {
+        return "";
+    }
+    signaturePurifier ??= DOMPurify(window);
+    return signaturePurifier.isSupported ? signaturePurifier.sanitize(html, { FORBID_TAGS: QUOTE_FORBIDDEN_TAGS }) : "";
+}
+
 /**
  * Sanitizes message HTML for quoting into a compose body: the display policy (`sanitizeMessageBodyHtml()`), without
  * the tags in `QUOTE_FORBIDDEN_TAGS`, and without any image that isn't embedded as a `data:` URI - a `cid:` image

package/lib/search/queryGrammar.ts

@@ -64,15 +64,24 @@ const VALID_ENTITY_TYPES: ReadonlySet<string> = new Set<SearchEntityType>(["mess
  * `parseSearchQuery()` itself, after every extraction has run. */
 function extractFirst(input: string, key: string): { value?: string; rest: string } {
     const pattern = new RegExp(`(^|\\s)${key}:(?:"([^"]*)"|(\\S+))`, "i");
-    const match = pattern.exec(input);
-    if (!match) {
+    const found = pattern.exec(maskQuoted(input));
+    if (!found) {
         return { rest: input };
     }
+    // The masked text only says where the operator is - what it holds is read from the real one.
+    const match = pattern.exec(input.slice(found.index))!;
     const value = match[2] ?? match[3] ?? "";
-    const rest = input.slice(0, match.index) + match[1] + input.slice(match.index + match[0].length);
+    const rest = input.slice(0, found.index) + match[1] + input.slice(found.index + match[0].length);
     return { value, rest };
 }
 
+/** `input` with the inside of every quoted phrase blanked out (the length stays the same, so positions carry over to
+ * `input`): a word that looks like an operator inside a phrase - `"meeting from:bob"` - is part of the phrase, never an
+ * operator. */
+function maskQuoted(input: string): string {
+    return input.replace(/"([^"]*)"/g, (_phrase, inner: string) => `"${"\0".repeat(inner.length)}"`);
+}
+
 /** Repeatedly applies `extractFirst()` for `key` until no more occurrences remain, splitting any
  * comma-separated value into individual entries — so `is:read is:flagged` and `is:read,flagged` both
  * produce `["read", "flagged"]`. */
@@ -98,7 +107,7 @@ function extractAll(input: string, key: string): { values: string[]; rest: strin
  * spec defines for this operator — there is no `has:<other value>` form. */
 function extractHasAttachment(input: string): { found: boolean; rest: string } {
     const pattern = /(^|\s)has:attachment\b/i;
-    const match = pattern.exec(input);
+    const match = pattern.exec(maskQuoted(input));
     if (!match) {
         return { found: false, rest: input };
     }

package/lib/search/searchTier3.ts

@@ -23,7 +23,7 @@ import { evaluateMessageSecurity, type MessageSecurityResult } from "../crypto/m
 import { getMessage, getMessageRawContent } from "../mail/mailApi.js";
 import type { ParsedSearchQuery } from "./queryGrammar.js";
 import { SEARCH_FIELD_WEIGHTS } from "./searchScoring.js";
-import { candidates, SearchResult } from "./searchApi.js";
+import { candidates, type CandidateResultPage, SearchResult } from "./searchApi.js";
 
 /** Longest decrypted HTML body `stripHtml()` examines, in UTF-16 code units - content past it is ignored
  * for Tier 3 matching. A hostile sender controls this input entirely, so it is bounded on top of the
@@ -271,6 +271,11 @@ function hasAnyFilter(parsed: ParsedSearchQuery): boolean {
  * concurrent WebCrypto work a large candidate page would otherwise fire all at once. */
 export const TIER3_DECRYPT_CONCURRENCY = 4;
 
+/** The most candidate pages one search walks (`nextCursor` onwards) while it is still short of `limit` results - a
+ * search that matches little must not download and decrypt a whole mailbox, but an encrypted message beyond the first
+ * page of candidates is still found. */
+export const TIER3_MAX_CANDIDATE_PAGES = 4;
+
 /** `Promise.allSettled()` over `items`, but never running more than `concurrency` `task`s at a time.
  * Outcomes are returned in `items`' own order. */
 async function settleWithConcurrency<T, R>(
@@ -301,7 +306,8 @@ export interface SearchEncryptedCandidatesOptions {
 }
 
 /**
- * Runs Tier 3 for one parsed query: fetches a bounded candidate set from the server, decrypts each
+ * Runs Tier 3 for one parsed query: fetches a bounded candidate set from the server (following `nextCursor` for up to
+ * `TIER3_MAX_CANDIDATE_PAGES` pages while fewer than `limit` messages have matched), decrypts each
  * candidate this device can open (at most `TIER3_DECRYPT_CONCURRENCY` at a time), and returns only the
  * ones whose real (decrypted) content actually matches - each with a raw (not yet normalized) score the
  * caller should run through `searchScoring.ts#normalizeServerScores()` alongside Tier 1's own scores
@@ -330,41 +336,68 @@ export async function searchEncryptedCandidates(
 
     const participants = [parsed.from, parsed.to, parsed.cc].filter((value): value is string => Boolean(value));
 
-    const page = await candidates({
-        types: ["message"],
-        participants: participants.length > 0 ? participants : undefined,
-        before: parsed.before,
-        after: parsed.after,
-        folderUid: parsed.folderUid,
-        flags: parsed.flags,
-        labels: parsed.labels,
-        limit,
-        mailboxUid: options.mailboxUid,
-    });
+    const results: SearchResult[] = [];
+    let cursor: string | undefined;
+    for (let pageNumber = 0; pageNumber < TIER3_MAX_CANDIDATE_PAGES; pageNumber++) {
+        let page: CandidateResultPage;
+        try {
+            page = await candidates({
+                types: ["message"],
+                participants: participants.length > 0 ? participants : undefined,
+                before: parsed.before,
+                after: parsed.after,
+                folderUid: parsed.folderUid,
+                flags: parsed.flags,
+                labels: parsed.labels,
+                limit,
+                cursor,
+                mailboxUid: options.mailboxUid,
+            });
+        } catch (err) {
+            if (pageNumber === 0) {
+                throw err;
+            }
+            // A later page failing keeps what the earlier ones found.
+            break;
+        }
 
-    const settled = await settleWithConcurrency(
-        page.candidates.filter((candidate) => candidate.entityType === "message"),
-        TIER3_DECRYPT_CONCURRENCY,
-        async (candidate) => {
-            if (parsed.hasAttachment !== undefined) {
-                const message = await getMessage(candidate.entityUid);
-                if (Boolean(message.hasAttachments) !== parsed.hasAttachment) {
+        const settled = await settleWithConcurrency(
+            page.candidates.filter((candidate) => candidate.entityType === "message"),
+            TIER3_DECRYPT_CONCURRENCY,
+            async (candidate) => {
+                if (parsed.hasAttachment !== undefined) {
+                    const message = await getMessage(candidate.entityUid);
+                    if (Boolean(message.hasAttachments) !== parsed.hasAttachment) {
+                        return undefined;
+                    }
+                }
+                const rawMime = await getMessageRawContent(candidate.entityUid);
+                if (unlocked.destroyed) {
                     return undefined;
                 }
-            }
-            const rawMime = await getMessageRawContent(candidate.entityUid);
-            if (unlocked.destroyed) {
-                return undefined;
-            }
-            const security: MessageSecurityResult = await evaluateMessageSecurity(rawMime, unlocked);
-            return { entityUid: candidate.entityUid, security };
-        },
-    );
+                const security: MessageSecurityResult = await evaluateMessageSecurity(rawMime, unlocked);
+                return { entityUid: candidate.entityUid, security };
+            },
+        );
 
-    if (unlocked.destroyed) {
-        // Locked while candidates were being fetched/decrypted - don't surface decrypted content after a lock.
-        return [];
+        if (unlocked.destroyed) {
+            // Locked while candidates were being fetched/decrypted - don't surface decrypted content after a lock.
+            return [];
+        }
+        results.push(...matchDecrypted(parsed, settled));
+        cursor = page.nextCursor;
+        if (!cursor || results.length >= limit) {
+            break;
+        }
     }
+    return results;
+}
+
+/** The decrypted candidates of one page whose real content matches `parsed`, scored and with their snippets. */
+function matchDecrypted(
+    parsed: ParsedSearchQuery,
+    settled: PromiseSettledResult<{ entityUid: string; security: MessageSecurityResult } | undefined>[],
+): SearchResult[] {
     const subjectFilter = parsed.subject?.toLowerCase();
     const results: SearchResult[] = [];
     for (const outcome of settled) {

package/lib/tasks/tasksApi.ts

@@ -6,7 +6,7 @@
  * comment for the shared ACL/authorization model every wrapper file here follows. */
 
 import { ApiClient, withClient } from "../util/api.js";
-import { ListParams, buildQuery } from "../util/apiQuery.js";
+import { ListParams, SETTINGS_LIST_LIMIT, buildQuery } from "../util/apiQuery.js";
 
 export type TaskPriority = "low" | "normal" | "high";
 
@@ -39,7 +39,7 @@ export interface Task {
 
 /** Lists a folder's tasks, soonest due date first (tasks with no due date sort last). */
 export function listTasks(folderUid: string, params: ListParams = {}, client?: ApiClient): Promise<Task[]> {
-    return withClient(client, `/mail/tasks?${buildQuery(params, { folderUid, sort: JSON.stringify({ dueDate: "ASC" }) })}`);
+    return withClient(client, `/mail/tasks?${buildQuery(params, { folderUid, sort: JSON.stringify({ dueDate: "ASC", uid: "ASC" }) })}`);
 }
 
 export interface CreateTaskInput {
@@ -109,7 +109,7 @@ export interface TaskList {
 
 /** Lists a mailbox's task lists (Outlook To-Do-style custom lists), alphabetically by name. */
 export function listTaskLists(mailboxUid: string, params: ListParams = {}, client?: ApiClient): Promise<TaskList[]> {
-    return withClient(client, `/mail/task-lists?${buildQuery(params, { mailboxUid, sort: JSON.stringify({ name: "ASC" }) })}`);
+    return withClient(client, `/mail/task-lists?${buildQuery({ limit: SETTINGS_LIST_LIMIT, ...params }, { mailboxUid, sort: JSON.stringify({ name: "ASC", uid: "ASC" }) })}`);
 }
 
 export function createTaskList(input: { mailboxUid: string; name: string }, client?: ApiClient): Promise<TaskList> {