@rapidmx/web-client 0.34.0 → 0.36.0

package/dist/lib/mail/mailApi.d.ts

@@ -10,7 +10,7 @@
  */
 import { ApiClient, ApiRequestError } from "../util/api.js";
 import { ListParams } from "../util/apiQuery.js";
-import type { EncryptionPreference, PublicKey } from "../crypto/keyvaultApi.js";
+import type { EncryptionPreference, PublicKey, ZeroAccessKey } from "../crypto/keyvaultApi.js";
 import type { ResolvedPrincipal } from "./mailboxAccessApi.js";
 export type { ListParams };
 export type { EncryptionPreference, PublicKey };
@@ -95,6 +95,12 @@ export interface Mailbox {
      * per the spec's own `PublicKey` doc comment. Absent/empty means no keys enrolled yet
      * (`KeyEnrollmentGate` handles that state). */
     keys?: PublicKey[];
+    /** The mailbox's zero-access certificates, managed by the server (never written by a client). Read them from
+     * `KeyVault.zeroAccessKeys` to unlock; here only so a settings page can tell whether one is enrolled. */
+    zeroAccessKeys?: ZeroAccessKey[];
+    /** "Enable zero-access encryption": unset means on. Only the mailbox's owner can change it - restapi drops anybody
+     * else's value. Has no effect while the server's `EncryptionPolicy.allowZeroAccess` is off. */
+    zeroAccessEnabled?: boolean;
     /** How the caller reaches this mailbox: `"owner"` (theirs) or `"delegate"` (shared with them). Set by the plain list and read of
      * mailboxes - not in an administration-scope answer - so a client can label the shared ones; see `isSharedWithMe()`. */
     accessRole?: "owner" | "delegate";
@@ -215,6 +221,8 @@ export interface UpdateMailboxInput {
     autoSendReceiptsInternal?: boolean;
     autoSendReceiptsFederated?: boolean;
     autoSendReceiptsExternal?: boolean;
+    /** Owner-only server-side (anybody else's value is dropped) - see `Mailbox.zeroAccessEnabled`. */
+    zeroAccessEnabled?: boolean;
     /** Trusted-caller-only server-side. `null` (or `""`) unassigns the mailbox's escrow scope; the
      * referenced `EscrowScope` must exist otherwise. See `Mailbox.escrowScopeId`. */
     escrowScopeId?: string | null;
@@ -424,6 +432,13 @@ export interface Message {
      * stored body, not from a flag this API exposes. Always present on a real `Message` (defaults
      * `false` server-side), same optional-for-old-fixtures caveat as `Mailbox.oofEnabled`. */
     encrypted?: boolean;
+    /** Set when the server sealed this message at rest on arrival (zero-access, restapi `specs/search.md` §3): its stored body is an
+     * S/MIME message only the mailbox's zero-access key opens, `subject` is `[...]` and `bodyPreview` empty - the real ones are in
+     * `sealedSummary`. */
+    zeroAccess?: {
+        keyFingerprint: string;
+        sealedSummary: string;
+    };
     /** The raw RFC 2369/8058 `List-Unsubscribe` header value, if present — computed server-side by
      * `@rapidmx/restapi`'s `ScanPipeline` from the stored MIME, the strongest single bulk-mail signal it
      * captures. Used client-side to detect list traffic when replying, per
@@ -560,7 +575,7 @@ export type MessageReportKind = "junk" | "phishing" | "not_junk";
 /** Why the server did not teach its spam filter from a report: `encrypted` (it has no plaintext to teach), `disabled` (learning is switched off),
  * `unsupported` (no spam engine, or one that cannot learn), `too_large` (over the size it reads) or `failed` (the engine could not be reached,
  * refused, or the message could not be read). The report itself still happened. */
-export type MessageLearnSkipped = "encrypted" | "disabled" | "unsupported" | "too_large" | "failed";
+export type MessageLearnSkipped = "encrypted" | "zero_access" | "disabled" | "unsupported" | "too_large" | "failed";
 /** What `reportMessage()` answers. */
 export interface MessageReportResult {
     uid: string;
@@ -581,6 +596,9 @@ export interface ReportMessageOptions {
     /** With `not_junk` only (else a 400): also add the message's From address to the mailbox's safe senders. Needs full access to the mailbox (403 otherwise,
      * before anything is done). */
     alwaysTrustSender?: boolean;
+    /** For a zero-access message only (else a 400): its original source, base64-encoded, decrypted here - the server holds only the sealed
+     * copy, so this is what its spam filter learns from (never stored). Without it the server skips learning (`learnSkipped: "zero_access"`). */
+    rawMessage?: string;
 }
 /**
  * Reports a message as junk, phishing or not junk - `POST /mail/messages/:uid/report`. The SERVER moves it (`junk` and `phishing` to the mailbox's Junk Email,
@@ -708,7 +726,15 @@ export interface AssembleDraftInput {
     bcc?: ComposeRecipientInput[];
     subject?: string;
     html: string;
+    /** See `AssembleIntent`. */
+    intent?: AssembleIntent;
 }
+/**
+ * Why a draft is being assembled (server `ComposeIntent`). `"save"`, the default, keeps an edit: in a zero-access mailbox the server
+ * stores it sealed, which it can't send. `"send"` is the assemble right before `sendMessage()`/`queueMessageSend()`: stored readable
+ * until it is relayed, then sealed as the Sent Items copy.
+ */
+export type AssembleIntent = "save" | "send";
 /** What a draft records about the thread it belongs to - see `createDraft()`. */
 export interface DraftThreading {
     /** The `messageId` of the message being replied to (`Message.inReplyTo`). */
@@ -774,6 +800,8 @@ export interface AssembleDraftRawInput {
      * `crypto/smimeMessage.ts`'s `buildSignedOnlyMessage()`/`buildEncryptedMessage()`, combined with
      * the outer envelope headers (`From`/`To`/`Cc`/`Date`/`Message-ID`/`MIME-Version`) by the caller. */
     rawMime: string;
+    /** See `AssembleIntent`. */
+    intent?: AssembleIntent;
 }
 /**
  * Stores an already-signed/encrypted draft's raw MIME source as its `bodyBlobKey`, completely

package/dist/lib/mail/mailApi.js

@@ -274,7 +274,11 @@ export function moveMessage(message, folderUid, client) {
 export function reportMessage(uid, kind, options = {}, client) {
     return withClient(client, `/mail/messages/${encodeURIComponent(uid)}/report`, {
         method: "POST",
-        body: JSON.stringify({ kind, ...(options.alwaysTrustSender ? { alwaysTrustSender: true } : {}) }),
+        body: JSON.stringify({
+            kind,
+            ...(options.alwaysTrustSender ? { alwaysTrustSender: true } : {}),
+            ...(options.rawMessage ? { rawMessage: options.rawMessage } : {}),
+        }),
     });
 }
 /**

package/dist/lib/mail/pushClient.d.ts

@@ -28,6 +28,8 @@ export type PushStatus = "idle" | "connecting" | "open" | "reconnecting" | "clos
  * caller orders its channels most important first.
  */
 export declare const PUSH_MAX_CHANNELS = 40;
+/** The group `setChannels()` sets when no other is named: Mail's. */
+export declare const DEFAULT_CHANNEL_GROUP = "mail";
 /** The first reconnect waits about this long, and each further failure doubles it ... */
 export declare const PUSH_BACKOFF_BASE_MS = 1000;
 /** ... up to this. */
@@ -55,6 +57,8 @@ export declare class PushClient {
     private current;
     /** What the caller wants to hear about, most important first. */
     private desired;
+    /** The channels each caller asked for (`setChannels()`'s `group`), merged into `desired`. */
+    private groups;
     /** What this socket is subscribed to (including whatever the server put it on at connect). */
     private subscribed;
     /** The channels this client itself asked for and was granted - the only ones it may unsubscribe. */
@@ -73,10 +77,13 @@ export declare class PushClient {
      */
     close(): void;
     /**
-     * Sets the channels (folder and mailbox uids) to receive events for. Deduplicated and cut to `PUSH_MAX_CHANNELS`; on
-     * an open socket the difference is subscribed/unsubscribed at once, otherwise it is sent when the socket opens.
+     * Sets the channels (folder and mailbox uids) one caller wants events for: Mail's, in the default group, or a page's
+     * own (the Calendar's calendars - Mail subscribes to mail folders only). Every group's channels are wanted together,
+     * each page's own group ahead of the default one, since a page's are what is on screen; deduplicated and cut to
+     * `PUSH_MAX_CHANNELS`. An empty list drops the group. On an open socket the difference is subscribed/unsubscribed at
+     * once, otherwise it is sent when the socket opens.
      */
-    setChannels(channels: readonly string[]): void;
+    setChannels(channels: readonly string[], group?: string): void;
     /** Calls `listener` with every event; returns the function that stops it. */
     onEvent(listener: (event: PushEvent) => void): () => void;
     /** Calls `listener` whenever `status` changes; returns the function that stops it. */

package/dist/lib/mail/pushClient.js

@@ -37,6 +37,8 @@ const SOCKET_OPEN = 1;
  * caller orders its channels most important first.
  */
 export const PUSH_MAX_CHANNELS = 40;
+/** The group `setChannels()` sets when no other is named: Mail's. */
+export const DEFAULT_CHANNEL_GROUP = "mail";
 /** The first reconnect waits about this long, and each further failure doubles it ... */
 export const PUSH_BACKOFF_BASE_MS = 1000;
 /** ... up to this. */
@@ -61,6 +63,8 @@ export class PushClient {
         this.current = "idle";
         /** What the caller wants to hear about, most important first. */
         this.desired = [];
+        /** The channels each caller asked for (`setChannels()`'s `group`), merged into `desired`. */
+        this.groups = new Map();
         /** What this socket is subscribed to (including whatever the server put it on at connect). */
         this.subscribed = new Set();
         /** The channels this client itself asked for and was granted - the only ones it may unsubscribe. */
@@ -107,11 +111,21 @@ export class PushClient {
         this.setStatus("closed");
     }
     /**
-     * Sets the channels (folder and mailbox uids) to receive events for. Deduplicated and cut to `PUSH_MAX_CHANNELS`; on
-     * an open socket the difference is subscribed/unsubscribed at once, otherwise it is sent when the socket opens.
+     * Sets the channels (folder and mailbox uids) one caller wants events for: Mail's, in the default group, or a page's
+     * own (the Calendar's calendars - Mail subscribes to mail folders only). Every group's channels are wanted together,
+     * each page's own group ahead of the default one, since a page's are what is on screen; deduplicated and cut to
+     * `PUSH_MAX_CHANNELS`. An empty list drops the group. On an open socket the difference is subscribed/unsubscribed at
+     * once, otherwise it is sent when the socket opens.
      */
-    setChannels(channels) {
-        this.desired = [...new Set(channels)].slice(0, PUSH_MAX_CHANNELS);
+    setChannels(channels, group = DEFAULT_CHANNEL_GROUP) {
+        if (channels.length > 0) {
+            this.groups.set(group, [...channels]);
+        }
+        else {
+            this.groups.delete(group);
+        }
+        const ordered = [...this.groups.entries()].sort(([a], [b]) => Number(a === DEFAULT_CHANNEL_GROUP) - Number(b === DEFAULT_CHANNEL_GROUP));
+        this.desired = [...new Set(ordered.flatMap(([, list]) => list))].slice(0, PUSH_MAX_CHANNELS);
         if (this.ready) {
             this.syncSubscriptions();
         }

package/dist/lib/search/zeroAccessIndexApi.d.ts

@@ -0,0 +1,81 @@
+/**
+ * Typed wrappers over `@rapidmx/restapi`'s zero-access search index (`/mail/mailboxes/:id/search-index`, `specs/search.md` §7-8): the
+ * sealed index entries the server writes at delivery and the weekly segments clients compact them into. Everything here is
+ * ciphertext encrypted to the mailbox's zero-access key - `apps/shared/search/zeroAccessIndexSync.ts` decrypts and imports it.
+ */
+import { type ApiClient } from "../util/api.js";
+export type SegmentOrigin = "zero-access" | "client";
+/** A compacted segment as the manifest lists it. */
+export interface IndexSegment {
+    weekId: string;
+    generation: number;
+    origin: SegmentOrigin;
+    bytes: number;
+    etag: string;
+    schemaVersion: number;
+    keyFingerprint: string;
+    entryCount: number;
+}
+/** A week's entries not yet compacted. */
+export interface IndexWeekEntries {
+    weekId: string;
+    pendingEntries: number;
+    latestEntryAt: string;
+    /** The week has closed and its grace period has passed: a client may compact it. */
+    compactable: boolean;
+}
+export interface SegmentManifest {
+    mailboxUid: string;
+    segments: IndexSegment[];
+    weeks: IndexWeekEntries[];
+}
+/** One pending entry: `sealed` is base64 CMS `EnvelopedData` of a gzipped JSON `ZeroAccessIndexDocument`. */
+export interface SealedIndexEntry {
+    uid: string;
+    weekId: string;
+    messageUid: string;
+    createdAt: string;
+    keyFingerprint: string;
+    sealed: string;
+}
+export interface SealedIndexEntryPage {
+    entries: SealedIndexEntry[];
+    next?: string;
+}
+/** What a sealed entry (and each document of a segment) decrypts to - restapi's `ZeroAccessIndexDocument`. */
+export interface ZeroAccessIndexDocument {
+    v: 1;
+    messageUid: string;
+    subject: string;
+    body: string;
+    attachmentText: string[];
+    attachmentNames: string[];
+    deferredAttachments: string[];
+    from: string;
+    to: string[];
+    cc: string[];
+    participants: string[];
+    dateForSort: number;
+}
+/** `PUT .../segments/:weekId`. */
+export interface SegmentUpload {
+    expectedGeneration: number;
+    /** Base64 of the sealed file. */
+    segment: string;
+    keyFingerprint: string;
+    schemaVersion: number;
+    origin?: SegmentOrigin;
+    foldedEntryUids?: string[];
+}
+export declare function getSearchIndexManifest(mailboxUid: string, client?: ApiClient): Promise<SegmentManifest>;
+/** One page of pending entries: of `week` when given, written at or after `since` when given, after uid `after`. */
+export declare function listSearchIndexEntries(mailboxUid: string, options?: {
+    week?: string;
+    since?: string;
+    after?: string;
+    limit?: number;
+}, client?: ApiClient): Promise<SealedIndexEntryPage>;
+/** The sealed file of a week's segment generation. */
+export declare function getSearchIndexSegment(mailboxUid: string, segment: Pick<IndexSegment, "weekId" | "generation" | "origin">, client?: ApiClient): Promise<Uint8Array>;
+/** Stores a compaction. Rejects with a `409` when the week's segment changed since `upload.expectedGeneration` was read. */
+export declare function putSearchIndexSegment(mailboxUid: string, weekId: string, upload: SegmentUpload, client?: ApiClient): Promise<IndexSegment>;

package/dist/lib/search/zeroAccessIndexApi.js

@@ -0,0 +1,35 @@
+///////////////////////////////////////////////////////////////////////////////
+// Copyright (C) 2026 Jean-Philippe Steinmetz
+// SPDX-License-Identifier: MPL-2.0
+///////////////////////////////////////////////////////////////////////////////
+/**
+ * Typed wrappers over `@rapidmx/restapi`'s zero-access search index (`/mail/mailboxes/:id/search-index`, `specs/search.md` §7-8): the
+ * sealed index entries the server writes at delivery and the weekly segments clients compact them into. Everything here is
+ * ciphertext encrypted to the mailbox's zero-access key - `apps/shared/search/zeroAccessIndexSync.ts` decrypts and imports it.
+ */
+import { withClient, withClientBlob } from "../util/api.js";
+const base = (mailboxUid) => `/mail/mailboxes/${encodeURIComponent(mailboxUid)}/search-index`;
+export function getSearchIndexManifest(mailboxUid, client) {
+    return withClient(client, `${base(mailboxUid)}/manifest`);
+}
+/** One page of pending entries: of `week` when given, written at or after `since` when given, after uid `after`. */
+export function listSearchIndexEntries(mailboxUid, options = {}, client) {
+    const query = new URLSearchParams();
+    for (const [key, value] of Object.entries(options)) {
+        if (value !== undefined) {
+            query.set(key, String(value));
+        }
+    }
+    const search = query.toString();
+    return withClient(client, `${base(mailboxUid)}/entries${search ? `?${search}` : ""}`);
+}
+/** The sealed file of a week's segment generation. */
+export async function getSearchIndexSegment(mailboxUid, segment, client) {
+    const query = `generation=${segment.generation}${segment.origin === "client" ? "&origin=client" : ""}`;
+    const blob = await withClientBlob(client, `${base(mailboxUid)}/segments/${encodeURIComponent(segment.weekId)}?${query}`, "Could not download a search index segment.");
+    return new Uint8Array(await blob.arrayBuffer());
+}
+/** Stores a compaction. Rejects with a `409` when the week's segment changed since `upload.expectedGeneration` was read. */
+export function putSearchIndexSegment(mailboxUid, weekId, upload, client) {
+    return withClient(client, `${base(mailboxUid)}/segments/${encodeURIComponent(weekId)}`, { method: "PUT", body: JSON.stringify(upload) });
+}

package/dist/lib/tasks/tasksApi.d.ts

@@ -30,6 +30,7 @@ export interface Task {
  * own doc comment in `util/api.ts`. Omitted (the default), every function here behaves exactly as before. */
 /** Lists a folder's tasks, soonest due date first (tasks with no due date sort last). */
 export declare function listTasks(folderUid: string, params?: ListParams, client?: ApiClient): Promise<Task[]>;
+export declare function getTask(uid: string, client?: ApiClient): Promise<Task>;
 export interface CreateTaskInput {
     mailboxUid: string;
     folderUid: string;

package/dist/lib/tasks/tasksApi.js

@@ -13,6 +13,9 @@ import { SETTINGS_LIST_LIMIT, buildQuery } from "../util/apiQuery.js";
 export function listTasks(folderUid, params = {}, client) {
     return withClient(client, `/mail/tasks?${buildQuery(params, { folderUid, sort: JSON.stringify({ dueDate: "ASC", uid: "ASC" }) })}`);
 }
+export function getTask(uid, client) {
+    return withClient(client, `/mail/tasks/${encodeURIComponent(uid)}`);
+}
 export function createTask(input, client) {
     return withClient(client, "/mail/tasks", {
         method: "POST",

package/lib/admin/escrowAccessRequestsApi.ts

@@ -14,6 +14,7 @@
 
 import { ApiClient, withClient } from "../util/api.js";
 import { ListParams, RequestListParams, buildQuery } from "../util/apiQuery.js";
+import type { PublicKey, WrappedPrivateKey } from "../crypto/keyvaultApi.js";
 
 export type { ListParams, RequestListParams };
 
@@ -65,6 +66,11 @@ export interface MasterKeyWrap {
  * tooling, per `specs/end-to-end_encryption.md`'s "this server never holds the scope's private key". */
 export interface EscrowAccessMaterial {
     masterKeyWraps: MasterKeyWrap[];
+    /** The mailbox's wrapped private keys that read mail (zero-access and encryption keys, never signing), sealed under its master key. Absent
+     * from a server that predates releasing them. */
+    wrappedKeys?: WrappedPrivateKey[];
+    /** The certificate of each of `wrappedKeys`, matched by fingerprint. */
+    certificates?: PublicKey[];
 }
 
 /** `client`, given by every function below, is an explicit `ApiClient` from `createApiClient()` (e.g. one

package/lib/calendar/calendarApi.ts

@@ -135,6 +135,9 @@ export interface CalendarEvent {
      * `mailto` only). Still to be rendered through `sanitizeEventDescriptionHtml()` (`eventDescription.ts`), never trusted as it stands. `null` or absent:
      * the description, if any, is plain text. */
     descriptionHtml?: string | null;
+    /** Response-only. An event made from an invitation that reached a zero-access mailbox: its title, location and description are only
+     * sealed to the mailbox's zero-access key (`title` is `[...]`). `apps/shared/calendar/sealedEvents.ts` opens them. */
+    sealedContent?: { keyFingerprint: string; sealed: string };
     /** Who may see the event's details - absent (or `null`, on a row stored before this existed) reads as `"default"`; see `visibilityOf()`. */
     visibility?: EventVisibility | null;
     /** Whether the guests may ask for the event to change (default `false`). Absent or `null` reads as the default; see `guestPermissionsOf()`. */

package/lib/calendar/inviteApi.ts

@@ -10,6 +10,14 @@
 
 import { ApiClient, ApiRequestError, withClient } from "../util/api.js";
 import type { EventVisibility, GuestPermissions } from "./calendarApi.js";
+import { sealedInviteCalendar } from "./sealedInvites.js";
+
+/** The calendar file to send for `messageUid` - a zero-access message this device decrypted (`sealedInvites.ts`) - as the request body's
+ * `ics`, or nothing for a message the server reads itself. */
+function sealedSource(messageUid: string): { ics?: string } {
+    const ics = sealedInviteCalendar(messageUid);
+    return ics !== undefined ? { ics } : {};
+}
 
 /** What the reader can answer an invitation with. */
 export type InviteResponse = "accepted" | "tentative" | "declined";
@@ -104,8 +112,15 @@ export interface MessageInvite {
  * common, expected answer for a message that merely has an attachment - and rejects for any other failure.
  */
 export async function getMessageInvite(messageUid: string, client?: ApiClient): Promise<MessageInvite | null> {
+    const source = sealedSource(messageUid);
     try {
-        return await withClient<MessageInvite>(client, `/mail/calendar-events/invite/${encodeURIComponent(messageUid)}`);
+        // A zero-access message's invitation is read from the calendar file decrypted here (`POST .../view`).
+        return source.ics !== undefined
+            ? await withClient<MessageInvite>(client, `/mail/calendar-events/invite/${encodeURIComponent(messageUid)}/view`, {
+                  method: "POST",
+                  body: JSON.stringify(source),
+              })
+            : await withClient<MessageInvite>(client, `/mail/calendar-events/invite/${encodeURIComponent(messageUid)}`);
     } catch (err) {
         if (err instanceof ApiRequestError && err.status === 404) {
             return null;
@@ -122,13 +137,17 @@ export async function getMessageInvite(messageUid: string, client?: ApiClient):
 export function respondToMessageInvite(messageUid: string, responseStatus: InviteResponse, client?: ApiClient): Promise<MessageInvite> {
     return withClient(client, `/mail/calendar-events/invite/${encodeURIComponent(messageUid)}/respond`, {
         method: "POST",
-        body: JSON.stringify({ responseStatus }),
+        body: JSON.stringify({ responseStatus, ...sealedSource(messageUid) }),
     });
 }
 
 /** Takes a canceled meeting off the reader's calendar. Resolves with the invitation as it now stands. */
 export function removeMessageInvite(messageUid: string, client?: ApiClient): Promise<MessageInvite> {
-    return withClient(client, `/mail/calendar-events/invite/${encodeURIComponent(messageUid)}/remove`, { method: "POST" });
+    const source = sealedSource(messageUid);
+    return withClient(client, `/mail/calendar-events/invite/${encodeURIComponent(messageUid)}/remove`, {
+        method: "POST",
+        ...(source.ics !== undefined ? { body: JSON.stringify(source) } : {}),
+    });
 }
 
 /** A different time to suggest to the organizer. */
@@ -144,11 +163,15 @@ export interface ProposedTime {
 export function proposeNewTime(messageUid: string, proposal: ProposedTime, client?: ApiClient): Promise<MessageInvite> {
     return withClient(client, `/mail/calendar-events/invite/${encodeURIComponent(messageUid)}/propose`, {
         method: "POST",
-        body: JSON.stringify(proposal),
+        body: JSON.stringify({ ...proposal, ...sealedSource(messageUid) }),
     });
 }
 
 /** Accepts an attendee's proposed time (a `COUNTER`) for a meeting the reader organizes: the server moves the event and sends the attendees the update. Resolves with the invitation as it now stands. */
 export function acceptProposal(messageUid: string, client?: ApiClient): Promise<MessageInvite> {
-    return withClient(client, `/mail/calendar-events/invite/${encodeURIComponent(messageUid)}/accept-proposal`, { method: "POST" });
+    const source = sealedSource(messageUid);
+    return withClient(client, `/mail/calendar-events/invite/${encodeURIComponent(messageUid)}/accept-proposal`, {
+        method: "POST",
+        ...(source.ics !== undefined ? { body: JSON.stringify(source) } : {}),
+    });
 }

package/lib/calendar/sealedInvites.ts

@@ -0,0 +1,33 @@
+///////////////////////////////////////////////////////////////////////////////
+// Copyright (C) 2026 Jean-Philippe Steinmetz
+// SPDX-License-Identifier: MPL-2.0
+///////////////////////////////////////////////////////////////////////////////
+/**
+ * The calendar files of zero-access messages, as decrypted on this device (`MessageSecurityResult.calendar`). The server holds only
+ * the sealed copy of such a message, so every invitation call for it (`inviteApi.ts`) sends the file along. Kept in memory for the
+ * messages read most recently, and cleared on sign-out (`clearSealedInvites()`).
+ */
+
+/** How many messages' calendar files are kept. */
+const MAX_SEALED_INVITES = 100;
+
+const calendars: Map<string, string> = new Map();
+
+/** Remembers the decrypted calendar file of zero-access message `messageUid`. */
+export function rememberSealedInvite(messageUid: string, ics: string): void {
+    calendars.delete(messageUid);
+    calendars.set(messageUid, ics);
+    while (calendars.size > MAX_SEALED_INVITES) {
+        calendars.delete(calendars.keys().next().value!);
+    }
+}
+
+/** The decrypted calendar file of zero-access message `messageUid`, when this device has read it. */
+export function sealedInviteCalendar(messageUid: string): string | undefined {
+    return calendars.get(messageUid);
+}
+
+/** Forgets every remembered calendar file (sign-out). */
+export function clearSealedInvites(): void {
+    calendars.clear();
+}