@rapidmx/web-client 0.34.0 → 0.36.0

package/apps/www/tasks/index.tsx

@@ -11,6 +11,7 @@ import {
     TaskPriority,
     createTask,
     deleteTask,
+    getTask,
     listTasks,
     setTaskCompleted,
     setTaskMyDay,
@@ -34,6 +35,13 @@ import { SHORTCUTS } from "../../shared/keyboard/keymap.js";
 import { useShortcut } from "../../shared/keyboard/useShortcut.js";
 import { useShortcutProps } from "../../shared/keyboard/useShortcutProps.js";
 import { notifyApiError } from "../../shared/notifications/apiErrors.js";
+import { changedItemOf, useFolderLiveUpdates } from "../../shared/live/useFolderLiveUpdates.js";
+
+/** The published model class name of a task on either database (`TaskMongo`, `TaskSQL`) - not a `TaskList`'s. */
+const TASK_MODEL = /^Task(Mongo|SQL)$/;
+
+/** The push client channel group (`PushClient.setChannels()`) the page's tasks folder is subscribed under. */
+const TASKS_CHANNEL_GROUP = "tasks";
 
 const INPUT_CLASS =
     "text-sm py-1.5 px-2 border border-border rounded-sm bg-surface text-text focus:outline-none focus:border-primary";
@@ -146,6 +154,40 @@ function TasksContent() {
         void reload();
     }, [folderUid]);
 
+    // A task created, changed or deleted anywhere - another tab, a phone over ActiveSync - is announced on its folder's channel. It is fetched again by its
+    // uid and replaces (or joins) the list while it is still in this folder; one that is gone (a delete, a 404, or moved to another folder) leaves it. A
+    // failed fetch changes nothing: the next load shows it as it is.
+    useFolderLiveUpdates(
+        TASKS_CHANNEL_GROUP,
+        folderUid ? [folderUid] : [],
+        (event) => changedItemOf(event, TASK_MODEL),
+        (change) => {
+            const remove = () => setTasks((previous) => previous.filter((existing) => existing.uid !== change.uid));
+            if (change.deleted) {
+                remove();
+                return;
+            }
+            void getTask(change.uid, client).then(
+                (fresh) => {
+                    if (fresh.folderUid !== folderUid) {
+                        remove();
+                        return;
+                    }
+                    setTasks((previous) =>
+                        previous.some((existing) => existing.uid === fresh.uid)
+                            ? previous.map((existing) => (existing.uid === fresh.uid ? fresh : existing))
+                            : [...previous, fresh],
+                    );
+                },
+                (err: unknown) => {
+                    if (err instanceof ApiRequestError && err.status === 404) {
+                        remove();
+                    }
+                },
+            );
+        },
+    );
+
     useEffect(() => {
         setTargetMailboxUid(undefined);
         setAddedElsewhere(null);

package/dist/apps/escrow/matters/[uid].js

@@ -182,7 +182,7 @@ function MatterDetailContent({ uid }) {
         try {
             const material = await getAccessRequestMaterial(request.uid);
             if (seq === materialSeq.current)
-                setMaterialText(JSON.stringify(material.masterKeyWraps, null, 2));
+                setMaterialText(JSON.stringify(material, null, 2));
         }
         catch (err) {
             if (seq === materialSeq.current) {
@@ -270,5 +270,5 @@ function MatterDetailContent({ uid }) {
                                                         ? "bg-surface-alt text-text-muted"
                                                         : "bg-success text-white",
                                             ].join(" "), children: request.status })] }), actionErrors[request.uid] && _jsx(Alert, { children: actionErrors[request.uid] }), _jsxs("div", { className: "flex gap-3 mt-3", children: [!matter.closedAt && request.status === "pending" && (_jsxs(_Fragment, { children: [_jsx(Button, { type: "button", className: "!w-auto", loading: actingOn[request.uid], disabled: actingOn[request.uid], onClick: () => setApproveTarget(request), children: "Approve" }), _jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", loading: actingOn[request.uid], disabled: actingOn[request.uid], onClick: () => setDenyTarget(request), children: "Deny" })] })), !matter.closedAt && (request.status === "approved" || request.status === "fulfilled") && (_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", onClick: () => handleGetMaterial(request), children: "Get material" }))] })] }, request.uid))) })), _jsx(LoadMoreButton, { list: requests, label: "Load more access requests" })] }), _jsxs("div", { className: "bg-surface border border-border rounded-md p-6", children: [_jsxs("div", { className: "flex items-center justify-between mb-3", children: [_jsx("h2", { className: "text-base font-bold uppercase tracking-wide", children: "Export this matter" }), !matter.closedAt && (_jsx(Button, { type: "button", className: "!w-auto", loading: creatingExport, disabled: creatingExport, onClick: handleCreateExport, children: "+ New export" }))] }), _jsx("p", { className: "text-xs text-text-muted mb-3", children: "Exports messages (narrowed to this matter\u2019s own date range), plus full contacts, calendar events, tasks, and notes, from every custodian mailbox actually assigned to this matter\u2019s escrow scope, as one combined NDJSON file." }), exportError && _jsx(Alert, { children: exportError }), exportRequests.loadError && _jsx(Alert, { children: exportRequests.loadError }), matterExportRequests.length === 0 ? (_jsx("p", { className: "text-sm text-text-muted", children: exportRequests.loading ? "Loading…" : "No export requests yet." })) : (_jsx("ul", { className: "flex flex-col gap-2", children: matterExportRequests.map((request) => (_jsxs("li", { className: "flex items-center justify-between gap-3 text-sm py-1.5 px-3 bg-surface-alt rounded-sm", children: [_jsxs("span", { children: [new Date(request.dateCreated).toLocaleString(), request.status === "failed" && request.errorMessage && (_jsxs("span", { className: "text-danger", children: [" \u2014 ", request.errorMessage] }))] }), _jsxs("span", { className: "flex items-center gap-3", children: [_jsx("span", { className: `text-xs font-bold uppercase tracking-wide py-0.5 px-2 rounded-pill ${statusBadgeClass(request.status)}`, children: statusLabel(request.status) }), !matter.closedAt && request.status === "ready" && (_jsx("a", { href: matterExportRequestDownloadUrl(request.uid), className: "text-primary-dark hover:underline font-medium", children: "Download" }))] })] }, request.uid))) }))] }), _jsxs("div", { className: "bg-surface border border-border rounded-md p-6", children: [_jsx("h2", { className: "text-base font-bold uppercase tracking-wide mb-3", children: "Search this matter\u2019s custodians" }), matter.closedAt ? (_jsx("p", { className: "text-sm text-text-muted", children: "This matter is closed, so its custodians can no longer be searched or exported." })) : (_jsxs("form", { onSubmit: handleSearch, className: "flex gap-3 mb-4", children: [_jsx("input", { "aria-label": "Search this matter", className: INPUT_CLASS, value: searchText, onChange: (e) => setSearchText(e.target.value), placeholder: "Free text or an operator filter, e.g. from:alice@example.com" }), _jsx(Button, { type: "submit", className: "!w-auto shrink-0", loading: searching, disabled: searching || !searchText.trim(), children: "Search" })] })), searchError && _jsx(Alert, { children: searchError }), searchResults &&
-                        (Object.keys(searchResults).length === 0 ? (_jsx("p", { className: "text-sm text-text-muted", children: "No custodian mailboxes could be searched." })) : (_jsx("div", { className: "flex flex-col gap-4", children: Object.entries(searchResults).map(([mailboxUid, page]) => (_jsxs("div", { children: [_jsx("h3", { className: "text-sm font-semibold mb-2", children: mailboxUid }), page.results.length === 0 ? (_jsx("p", { className: "text-xs text-text-muted", children: "No matches." })) : (_jsx("ul", { className: "flex flex-col gap-1", children: page.results.map((result) => (_jsxs("li", { className: "text-sm py-1 px-2 bg-surface-alt rounded-sm", children: [result.entityType, " \u00B7 ", result.entityUid, result.snippet && _jsxs("span", { className: "text-text-muted", children: [" \u2014 ", result.snippet] })] }, `${result.entityType}-${result.entityUid}`))) }))] }, mailboxUid))) })))] }), _jsxs(Modal, { open: confirmingClose, onClose: closeCloseModal, title: "Close matter", children: [_jsxs("p", { className: "text-sm mb-3", children: ["Close ", _jsx("strong", { children: matter.name }), "? Once closed, no new access requests, exports, searches, or key material reads are allowed under it. This cannot be reopened here."] }), _jsxs("dl", { className: "grid grid-cols-[auto_1fr] gap-x-4 gap-y-1 text-sm mb-4", children: [_jsx("dt", { className: "text-text-muted", children: "Custodians" }), _jsx("dd", { className: "break-all", children: matter.custodianMailboxUids.join(", ") }), _jsx("dt", { className: "text-text-muted", children: "Date range" }), _jsx("dd", { children: formatDateRange(matter) })] }), closeError && _jsx(Alert, { children: closeError }), _jsxs("div", { className: "flex gap-3 justify-end", children: [_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", disabled: closing, onClick: closeCloseModal, children: "Cancel" }), _jsx(Button, { type: "button", className: "!w-auto !bg-none !bg-danger !border-danger hover:!bg-danger", loading: closing, disabled: closing, onClick: handleClose, children: "Close matter" })] })] }), _jsxs(Modal, { open: approveTarget !== null, onClose: () => setApproveTarget(null), title: "Approve access request", children: [_jsx("p", { className: "text-sm mb-3", children: "Approving lets holders of this matter\u2019s escrow scope read the key material for this mailbox once enough holders have approved." }), _jsxs("dl", { className: "grid grid-cols-[auto_1fr] gap-x-4 gap-y-1 text-sm mb-4", children: [_jsx("dt", { className: "text-text-muted", children: "Matter" }), _jsx("dd", { children: matter.name }), _jsx("dt", { className: "text-text-muted", children: "Mailbox" }), _jsx("dd", { className: "break-all", children: approveTarget?.mailboxUid }), _jsx("dt", { className: "text-text-muted", children: "Date range" }), _jsx("dd", { children: formatDateRange(matter) }), _jsx("dt", { className: "text-text-muted", children: "Approvals" }), _jsxs("dd", { children: [approveTarget?.approvals.length, " of ", approveTarget?.requiredHoldersAtCreation, " so far, including requester ", approveTarget?.requestedByUserUid] })] }), _jsxs("div", { className: "flex gap-3 justify-end", children: [_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", onClick: () => setApproveTarget(null), children: "Cancel" }), _jsx(Button, { type: "button", className: "!w-auto", onClick: () => void handleApprove(), children: "Approve request" })] })] }), _jsxs(Modal, { open: denyTarget !== null, onClose: () => setDenyTarget(null), title: "Deny access request", children: [_jsxs("p", { className: "text-sm mb-3", children: ["Denying refuses this request for good: it can\u2019t be approved afterwards, and holders can\u2019t read the key material for mailbox ", _jsx("span", { className: "break-all font-semibold", children: denyTarget?.mailboxUid }), " through it. A new request has to be made to ask again."] }), _jsxs("div", { className: "flex gap-3 justify-end", children: [_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", onClick: () => setDenyTarget(null), children: "Cancel" }), _jsx(Button, { type: "button", className: "!w-auto !bg-none !bg-danger !border-danger hover:!bg-danger", onClick: () => void handleDeny(), children: "Deny request" })] })] }), _jsx(Modal, { open: showNewRequest, onClose: () => setShowNewRequest(false), title: "New access request", children: _jsxs("form", { onSubmit: handleCreateRequest, className: "flex flex-col gap-4", children: [newRequestError && _jsx(Alert, { children: newRequestError }), _jsx(FormField, { label: "Mailbox uid", htmlFor: "newRequestMailboxUid", children: _jsx("input", { id: "newRequestMailboxUid", type: "text", className: INPUT_CLASS, value: newRequestMailboxUid, onChange: (e) => setNewRequestMailboxUid(e.target.value) }) }), _jsx("p", { className: "text-xs text-text-muted", children: "Must be one of this matter's own custodian mailboxes, currently assigned to this matter's escrow scope. Your own creation counts as the first approval." }), _jsxs("div", { className: "flex gap-3 justify-end", children: [_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", disabled: creatingRequest, onClick: () => setShowNewRequest(false), children: "Cancel" }), _jsx(Button, { type: "submit", className: "!w-auto", loading: creatingRequest, disabled: creatingRequest, children: "Create request" })] })] }) }), _jsx(Modal, { open: materialFor !== null, onClose: closeMaterialModal, title: "Escrow key material", children: loadingMaterial ? (_jsx("p", { className: "text-sm text-text-muted", children: "Loading\u2026" })) : materialError ? (_jsx(Alert, { children: materialError })) : (_jsxs(_Fragment, { children: [_jsxs("p", { className: "text-sm text-text-muted mb-3", children: ["Still-encrypted master key wraps for ", _jsx("strong", { children: materialFor?.mailboxUid }), " \u2014 this server cannot decrypt these either. Copy the JSON below into your own offline tooling."] }), _jsx("pre", { className: "text-xs font-mono bg-surface-alt border border-border rounded-sm p-3 overflow-x-auto whitespace-pre-wrap break-all", children: materialText })] })) })] }));
+                        (Object.keys(searchResults).length === 0 ? (_jsx("p", { className: "text-sm text-text-muted", children: "No custodian mailboxes could be searched." })) : (_jsx("div", { className: "flex flex-col gap-4", children: Object.entries(searchResults).map(([mailboxUid, page]) => (_jsxs("div", { children: [_jsx("h3", { className: "text-sm font-semibold mb-2", children: mailboxUid }), page.results.length === 0 ? (_jsx("p", { className: "text-xs text-text-muted", children: "No matches." })) : (_jsx("ul", { className: "flex flex-col gap-1", children: page.results.map((result) => (_jsxs("li", { className: "text-sm py-1 px-2 bg-surface-alt rounded-sm", children: [result.entityType, " \u00B7 ", result.entityUid, result.snippet && _jsxs("span", { className: "text-text-muted", children: [" \u2014 ", result.snippet] })] }, `${result.entityType}-${result.entityUid}`))) }))] }, mailboxUid))) })))] }), _jsxs(Modal, { open: confirmingClose, onClose: closeCloseModal, title: "Close matter", children: [_jsxs("p", { className: "text-sm mb-3", children: ["Close ", _jsx("strong", { children: matter.name }), "? Once closed, no new access requests, exports, searches, or key material reads are allowed under it. This cannot be reopened here."] }), _jsxs("dl", { className: "grid grid-cols-[auto_1fr] gap-x-4 gap-y-1 text-sm mb-4", children: [_jsx("dt", { className: "text-text-muted", children: "Custodians" }), _jsx("dd", { className: "break-all", children: matter.custodianMailboxUids.join(", ") }), _jsx("dt", { className: "text-text-muted", children: "Date range" }), _jsx("dd", { children: formatDateRange(matter) })] }), closeError && _jsx(Alert, { children: closeError }), _jsxs("div", { className: "flex gap-3 justify-end", children: [_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", disabled: closing, onClick: closeCloseModal, children: "Cancel" }), _jsx(Button, { type: "button", className: "!w-auto !bg-none !bg-danger !border-danger hover:!bg-danger", loading: closing, disabled: closing, onClick: handleClose, children: "Close matter" })] })] }), _jsxs(Modal, { open: approveTarget !== null, onClose: () => setApproveTarget(null), title: "Approve access request", children: [_jsx("p", { className: "text-sm mb-3", children: "Approving lets holders of this matter\u2019s escrow scope read the key material for this mailbox once enough holders have approved." }), _jsxs("dl", { className: "grid grid-cols-[auto_1fr] gap-x-4 gap-y-1 text-sm mb-4", children: [_jsx("dt", { className: "text-text-muted", children: "Matter" }), _jsx("dd", { children: matter.name }), _jsx("dt", { className: "text-text-muted", children: "Mailbox" }), _jsx("dd", { className: "break-all", children: approveTarget?.mailboxUid }), _jsx("dt", { className: "text-text-muted", children: "Date range" }), _jsx("dd", { children: formatDateRange(matter) }), _jsx("dt", { className: "text-text-muted", children: "Approvals" }), _jsxs("dd", { children: [approveTarget?.approvals.length, " of ", approveTarget?.requiredHoldersAtCreation, " so far, including requester ", approveTarget?.requestedByUserUid] })] }), _jsxs("div", { className: "flex gap-3 justify-end", children: [_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", onClick: () => setApproveTarget(null), children: "Cancel" }), _jsx(Button, { type: "button", className: "!w-auto", onClick: () => void handleApprove(), children: "Approve request" })] })] }), _jsxs(Modal, { open: denyTarget !== null, onClose: () => setDenyTarget(null), title: "Deny access request", children: [_jsxs("p", { className: "text-sm mb-3", children: ["Denying refuses this request for good: it can\u2019t be approved afterwards, and holders can\u2019t read the key material for mailbox ", _jsx("span", { className: "break-all font-semibold", children: denyTarget?.mailboxUid }), " through it. A new request has to be made to ask again."] }), _jsxs("div", { className: "flex gap-3 justify-end", children: [_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", onClick: () => setDenyTarget(null), children: "Cancel" }), _jsx(Button, { type: "button", className: "!w-auto !bg-none !bg-danger !border-danger hover:!bg-danger", onClick: () => void handleDeny(), children: "Deny request" })] })] }), _jsx(Modal, { open: showNewRequest, onClose: () => setShowNewRequest(false), title: "New access request", children: _jsxs("form", { onSubmit: handleCreateRequest, className: "flex flex-col gap-4", children: [newRequestError && _jsx(Alert, { children: newRequestError }), _jsx(FormField, { label: "Mailbox uid", htmlFor: "newRequestMailboxUid", children: _jsx("input", { id: "newRequestMailboxUid", type: "text", className: INPUT_CLASS, value: newRequestMailboxUid, onChange: (e) => setNewRequestMailboxUid(e.target.value) }) }), _jsx("p", { className: "text-xs text-text-muted", children: "Must be one of this matter's own custodian mailboxes, currently assigned to this matter's escrow scope. Your own creation counts as the first approval." }), _jsxs("div", { className: "flex gap-3 justify-end", children: [_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", disabled: creatingRequest, onClick: () => setShowNewRequest(false), children: "Cancel" }), _jsx(Button, { type: "submit", className: "!w-auto", loading: creatingRequest, disabled: creatingRequest, children: "Create request" })] })] }) }), _jsx(Modal, { open: materialFor !== null, onClose: closeMaterialModal, title: "Escrow key material", children: loadingMaterial ? (_jsx("p", { className: "text-sm text-text-muted", children: "Loading\u2026" })) : materialError ? (_jsx(Alert, { children: materialError })) : (_jsxs(_Fragment, { children: [_jsxs("p", { className: "text-sm text-text-muted mb-3", children: ["Still-encrypted key material for ", _jsx("strong", { children: materialFor?.mailboxUid }), ": the escrow master key wrap, and the private keys that read its mail, sealed under that master key. This server cannot decrypt any of it either. Copy the JSON below into your own offline tooling."] }), _jsx("pre", { className: "text-xs font-mono bg-surface-alt border border-border rounded-sm p-3 overflow-x-auto whitespace-pre-wrap break-all", children: materialText })] })) })] }));
 }

package/dist/apps/shared/calendar/calendarLiveUpdates.js

@@ -3,6 +3,7 @@
 // SPDX-License-Identifier: MPL-2.0
 ///////////////////////////////////////////////////////////////////////////////
 /** Pure helper behind the calendar page's live updates: which push events say "an event changed". */
+import { changedItemOf } from "../live/useFolderLiveUpdates.js";
 /** The published model name of a calendar event on either database (`CalendarEventMongo`, `CalendarEventSQL`) - and not the reminder's `"CalendarEvent"`,
  * which has its own action. */
 const EVENT_MODEL = /^CalendarEvent(Mongo|SQL)$/;
@@ -16,9 +17,5 @@ const EVENT_MODEL = /^CalendarEvent(Mongo|SQL)$/;
  * changed event is handled that way, an ordinary one (an invitation arriving, an edit on another device) included.
  */
 export function changedEventOf(event) {
-    if (!EVENT_MODEL.test(event.type) || (event.action !== "create" && event.action !== "update" && event.action !== "delete")) {
-        return undefined;
-    }
-    const data = event.data;
-    return typeof data?.uid === "string" ? { uid: data.uid, deleted: event.action === "delete" } : undefined;
+    return changedItemOf(event, EVENT_MODEL);
 }

package/dist/apps/shared/calendar/sealedEvents.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Calendar events the server made from invitations that reached a zero-access mailbox keep their title, location and description only
+ * sealed to the mailbox's zero-access key (`CalendarEvent.sealedContent`; the row's `title` is `[...]`). These are opened here with the
+ * mailbox's unlocked keys so the calendar shows the real ones; while the mailbox is locked the event keeps its placeholder. The
+ * decryption code is loaded only when a sealed event is actually seen.
+ */
+import type { CalendarEvent } from "../../../lib/calendar/calendarApi.js";
+/** Forgets every opened event (sign-out, or the test seam). */
+export declare function clearSealedEvents(): void;
+/** `events` with every sealed one this device can open shown with its real title, location and description. Never rejects. */
+export declare function openSealedEvents(events: CalendarEvent[]): Promise<CalendarEvent[]>;
+/** `openSealedEvents()` for one event. */
+export declare function openSealedEvent(event: CalendarEvent): Promise<CalendarEvent>;

package/dist/apps/shared/calendar/sealedEvents.js

@@ -0,0 +1,54 @@
+import { getUnlockedKeys } from "../../../lib/crypto/keySession.js";
+import { fromBase64 } from "../../../lib/crypto/encoding.js";
+import { onSigningOut } from "../components/mail/compose/composeFlushRegistry.js";
+/** Opened fields by sealed text - the same sealed content always opens to the same fields. Cleared with `clearSealedEvents()`. */
+const opened = new Map();
+/** Forgets every opened event (sign-out, or the test seam). */
+export function clearSealedEvents() {
+    opened.clear();
+}
+async function openFields(event) {
+    const sealed = event.sealedContent.sealed;
+    const known = opened.get(sealed);
+    if (known) {
+        return known;
+    }
+    const keys = getUnlockedKeys(event.mailboxUid)?.zeroAccessKeys;
+    if (!keys?.length) {
+        return undefined;
+    }
+    try {
+        const { decryptEnvelopedDataWithKeys } = await import("../../../lib/crypto/smime.js");
+        const fields = JSON.parse(new TextDecoder().decode(await decryptEnvelopedDataWithKeys(fromBase64(sealed), keys)));
+        const text = (value) => (typeof value === "string" ? value : undefined);
+        const result = {
+            title: text(fields.title) ?? event.title,
+            location: text(fields.location),
+            description: text(fields.description) ?? null,
+            descriptionHtml: text(fields.descriptionHtml) ?? null,
+        };
+        opened.set(sealed, result);
+        return result;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** `events` with every sealed one this device can open shown with its real title, location and description. Never rejects. */
+export async function openSealedEvents(events) {
+    if (!events.some((event) => event.sealedContent)) {
+        return events;
+    }
+    return Promise.all(events.map(async (event) => {
+        if (!event.sealedContent) {
+            return event;
+        }
+        const fields = await openFields(event);
+        return fields ? { ...event, ...fields } : event;
+    }));
+}
+/** `openSealedEvents()` for one event. */
+export async function openSealedEvent(event) {
+    return (await openSealedEvents([event]))[0];
+}
+onSigningOut(clearSealedEvents);

package/dist/apps/shared/components/admin/settings/EncryptionPolicyForm.js

@@ -36,10 +36,14 @@ export default function EncryptionPolicyForm({ policy, onChange, onDirtyChange,
     const [saved, setSaved] = useState(false);
     // Edits are unsaved until they match what was loaded or last saved.
     const [savedValues, setSavedValues] = useState(policy);
-    const dirty = TIERS.some((tier) => values[tier.key] !== savedValues[tier.key]);
+    // A server without zero-access encryption sends no `allowZeroAccess`; the checkbox is then not shown at all.
+    const zeroAccessSupported = policy.allowZeroAccess !== undefined;
+    const dirty = TIERS.some((tier) => values[tier.key] !== savedValues[tier.key]) || (zeroAccessSupported && values.allowZeroAccess !== savedValues.allowZeroAccess);
     useEffect(() => onDirtyChange?.(dirty), [dirty]);
     // Tiers this save would newly set to "Never encrypt", which switches encryption off for everyone's mail of that kind: confirmed first.
     const [confirmingProhibit, setConfirmingProhibit] = useState(null);
+    // Turning zero-access encryption off makes new mail readable by this server again for every mailbox: confirmed first.
+    const [confirmingZeroAccessOff, setConfirmingZeroAccessOff] = useState(false);
     function handleSubmit(e) {
         e.preventDefault();
         const newlyProhibited = TIERS.filter((tier) => values[tier.key] === "prohibited" && savedValues[tier.key] !== "prohibited");
@@ -47,10 +51,19 @@ export default function EncryptionPolicyForm({ policy, onChange, onDirtyChange,
             setConfirmingProhibit(newlyProhibited.map((tier) => tier.label));
             return;
         }
+        confirmZeroAccessThenSave();
+    }
+    function confirmZeroAccessThenSave() {
+        setConfirmingProhibit(null);
+        if (zeroAccessSupported && values.allowZeroAccess === false && savedValues.allowZeroAccess !== false) {
+            setConfirmingZeroAccessOff(true);
+            return;
+        }
         void save();
     }
     async function save() {
         setConfirmingProhibit(null);
+        setConfirmingZeroAccessOff(false);
         setError(null);
         setSaved(false);
         setSaving(true);
@@ -70,5 +83,8 @@ export default function EncryptionPolicyForm({ policy, onChange, onDirtyChange,
     return (_jsxs("div", { className: "max-w-xl", children: [embedded ? (_jsx("h3", { className: "text-base font-bold uppercase tracking-wide mb-1", children: "End-to-end encryption" })) : (_jsx("h2", { className: "text-lg font-bold uppercase tracking-wide mb-1", children: "End-to-end encryption" })), _jsx("p", { className: "text-sm text-text-muted mb-5", children: "Encrypted messages can only be read by their senders and recipients - not by this server or its administrators. Choose how encryption applies to each kind of mail." }), error && _jsx(Alert, { children: error }), saved && !error && _jsx("div", { className: "mb-4 text-sm text-success font-medium", children: "Saved." }), _jsxs("form", { onSubmit: handleSubmit, className: "flex flex-col gap-4", children: [TIERS.map((tier) => (_jsxs("label", { className: "flex flex-col gap-1.5 text-sm", children: [_jsx("span", { className: "font-semibold", children: tier.label }), _jsx("select", { "aria-label": tier.label, className: SELECT_CLASS, value: values[tier.key], onChange: (e) => {
                                     setSaved(false);
                                     setValues({ ...values, [tier.key]: e.target.value });
-                                }, children: STATES.map((state) => (_jsx("option", { value: state.value, children: state.label }, state.value))) }), _jsx("span", { className: "text-xs text-text-muted", children: tier.help })] }, tier.key))), _jsx("div", { children: _jsx(Button, { type: "submit", loading: saving, disabled: saving, className: "!w-auto", children: "Save" }) })] }), _jsxs(Modal, { open: confirmingProhibit !== null, onClose: () => setConfirmingProhibit(null), title: "Turn off encryption?", children: [_jsxs("p", { className: "text-sm mb-3", children: ["Saving sets ", _jsx("strong", { children: confirmingProhibit?.join(", ") }), " to Never encrypt. Nobody on this server can then encrypt that mail end to end, whatever they have chosen for themselves, until an administrator allows it again."] }), _jsxs("div", { className: "flex gap-3 justify-end", children: [_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", onClick: () => setConfirmingProhibit(null), children: "Cancel" }), _jsx(Button, { type: "button", className: "!w-auto !bg-none !bg-danger !border-danger hover:!bg-danger", onClick: () => void save(), children: "Save and turn off encryption" })] })] })] }));
+                                }, children: STATES.map((state) => (_jsx("option", { value: state.value, children: state.label }, state.value))) }), _jsx("span", { className: "text-xs text-text-muted", children: tier.help })] }, tier.key))), zeroAccessSupported && (_jsxs("div", { className: "mt-2 pt-4 border-t border-border", children: [_jsx("span", { className: "font-semibold text-sm block mb-1", children: "Zero-access encryption" }), _jsxs("label", { className: "flex items-start gap-2 text-sm", children: [_jsx("input", { type: "checkbox", className: "mt-1", checked: values.allowZeroAccess !== false, onChange: (e) => {
+                                            setSaved(false);
+                                            setValues({ ...values, allowZeroAccess: e.target.checked });
+                                        } }), _jsxs("span", { children: [_jsx("span", { className: "font-semibold block", children: "Allow zero-access encryption" }), _jsx("span", { className: "text-xs text-text-muted", children: "Mail that arrives unencrypted is encrypted the moment it is received, to a key only the mailbox\u2019s owner can unlock, and this server keeps no readable copy - administrators can\u2019t read it either, except through an escrow scope. People can still turn it off for their own mailbox. Search of message contents then happens in the app instead of on the server." })] })] })] })), _jsx("div", { children: _jsx(Button, { type: "submit", loading: saving, disabled: saving, className: "!w-auto", children: "Save" }) })] }), _jsxs(Modal, { open: confirmingProhibit !== null, onClose: () => setConfirmingProhibit(null), title: "Turn off encryption?", children: [_jsxs("p", { className: "text-sm mb-3", children: ["Saving sets ", _jsx("strong", { children: confirmingProhibit?.join(", ") }), " to Never encrypt. Nobody on this server can then encrypt that mail end to end, whatever they have chosen for themselves, until an administrator allows it again."] }), _jsxs("div", { className: "flex gap-3 justify-end", children: [_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", onClick: () => setConfirmingProhibit(null), children: "Cancel" }), _jsx(Button, { type: "button", className: "!w-auto !bg-none !bg-danger !border-danger hover:!bg-danger", onClick: confirmZeroAccessThenSave, children: "Save and turn off encryption" })] })] }), _jsxs(Modal, { open: confirmingZeroAccessOff, onClose: () => setConfirmingZeroAccessOff(false), title: "Turn off zero-access encryption?", children: [_jsx("p", { className: "text-sm mb-3", children: "Mail that arrives from now on will be stored in a form this server can read, for every mailbox. Mail that is already encrypted stays encrypted - this server can\u2019t decrypt it. Everyone sees in their settings that an administrator turned it off." }), _jsxs("div", { className: "flex gap-3 justify-end", children: [_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", onClick: () => setConfirmingZeroAccessOff(false), children: "Cancel" }), _jsx(Button, { type: "button", className: "!w-auto !bg-none !bg-danger !border-danger hover:!bg-danger", onClick: () => void save(), children: "Save and turn off zero-access encryption" })] })] })] }));
 }

package/dist/apps/shared/components/contacts/ContactsSidebar.d.ts

@@ -2,6 +2,8 @@ import React from "react";
 import { Contact } from "../../../../lib/contacts/contactsApi.js";
 export type ContactsView = {
     type: "all";
+} | {
+    type: "everyone";
 } | {
     type: "favorites";
 } | {
@@ -35,7 +37,7 @@ export interface ContactsSidebarProps {
     refreshToken?: number;
 }
 /**
- * Contacts' Outlook-style left sidebar: "Your contacts" (all, with count), "Favorites", "Suggested contacts" (the people the mailbox has corresponded with, when there are any), "Your contact
+ * Contacts' Outlook-style left sidebar: "All contacts" (the mailbox's own and its suggested ones together, when there are suggested ones), "Your contacts" (the mailbox's own, with count), "Favorites", "Suggested contacts" (the people the mailbox has corresponded with, when there are any), "Your contact
  * lists" (real `ContactList` records, fetched here), "Deleted", and "Categories" (derived from the
  * distinct `categories` values across the loaded contacts — no separate category registry exists
  * server-side). Owns its own contact-list data-fetching, per this app's convention of keeping

package/dist/apps/shared/components/contacts/ContactsSidebar.js

@@ -39,7 +39,7 @@ function NavItem({ label, count, active, onClick, swatch, }) {
         ].join(" "), children: [_jsxs("span", { className: "flex items-center gap-2 min-w-0", children: [swatch && _jsx("span", { "aria-hidden": "true", className: "w-2.5 h-2.5 rounded-full shrink-0", style: { backgroundColor: swatch } }), _jsx("span", { className: "truncate", children: label })] }), count !== undefined && _jsx("span", { className: "text-xs text-text-muted shrink-0", children: count })] }));
 }
 /**
- * Contacts' Outlook-style left sidebar: "Your contacts" (all, with count), "Favorites", "Suggested contacts" (the people the mailbox has corresponded with, when there are any), "Your contact
+ * Contacts' Outlook-style left sidebar: "All contacts" (the mailbox's own and its suggested ones together, when there are suggested ones), "Your contacts" (the mailbox's own, with count), "Favorites", "Suggested contacts" (the people the mailbox has corresponded with, when there are any), "Your contact
  * lists" (real `ContactList` records, fetched here), "Deleted", and "Categories" (derived from the
  * distinct `categories` values across the loaded contacts — no separate category registry exists
  * server-side). Owns its own contact-list data-fetching, per this app's convention of keeping
@@ -104,6 +104,6 @@ export default function ContactsSidebar({ mailboxUid, contacts, active, onSelect
     // A function, not a plain JSX constant — rendered both in the desktop `<nav>` and the mobile
     // `Drawer` (see MailShell/ContactsShell for the identical pattern and the duplicate-id reasoning
     // behind the `idPrefix`).
-    const navContent = (idPrefix) => (_jsxs(_Fragment, { children: [_jsxs("div", { className: "flex flex-col gap-0.5", children: [_jsx(NavItem, { label: "Your contacts", count: contacts.length, active: active.type === "all", onClick: () => handleSelect({ type: "all" }) }), _jsx(NavItem, { label: "Favorites", count: favoriteCount, active: active.type === "favorites", onClick: () => handleSelect({ type: "favorites" }) }), suggestedCount !== undefined && (_jsx(NavItem, { label: "Suggested contacts", count: suggestedCount, active: active.type === "suggested", onClick: () => handleSelect({ type: "suggested" }) })), showDeleted && _jsx(NavItem, { label: "Deleted", active: active.type === "deleted", onClick: () => handleSelect({ type: "deleted" }) })] }), _jsxs("div", { children: [_jsxs("div", { className: "flex items-center justify-between px-2.5 mb-1", children: [_jsx("h2", { className: "text-xs font-bold uppercase tracking-wide text-text-muted", children: "Your contact lists" }), _jsx("button", { type: "button", onClick: () => setAddingList(true), "aria-label": "New contact list", className: "text-xs font-bold text-primary-dark hover:underline", children: "+" })] }), listsError && _jsx("p", { className: "px-2.5 text-xs text-danger", children: listsError }), _jsx("div", { className: "flex flex-col gap-0.5", children: lists.map((list) => (_jsx(NavItem, { label: list.name, count: listCounts.get(list.uid) ?? 0, active: active.type === "list" && active.uid === list.uid, onClick: () => handleSelect({ type: "list", uid: list.uid, name: list.name }) }, list.uid))) }), addingList && (_jsxs("form", { onSubmit: handleAddList, className: "flex items-center gap-1 px-2.5 mt-1", children: [_jsx("input", { type: "text", autoFocus: true, "aria-label": "New list name", id: `${idPrefix}-new-list-name`, value: newListName, onChange: (e) => setNewListName(e.target.value), className: "flex-1 text-xs py-1 px-1.5 border border-border rounded-sm bg-surface" }), _jsx("button", { type: "submit", className: "text-xs font-semibold text-primary-dark", children: "Add" })] }))] }), categories.length > 0 && (_jsxs("div", { children: [_jsx("h2", { className: "text-xs font-bold uppercase tracking-wide text-text-muted px-2.5 mb-1", children: "Categories" }), _jsx("div", { className: "flex flex-col gap-0.5", children: categories.map((name) => (_jsx(NavItem, { label: name, swatch: categoryColor(name), active: active.type === "category" && active.name === name, onClick: () => handleSelect({ type: "category", name }) }, name))) })] }))] }));
+    const navContent = (idPrefix) => (_jsxs(_Fragment, { children: [_jsxs("div", { className: "flex flex-col gap-0.5", children: [suggestedCount !== undefined && (_jsx(NavItem, { label: "All contacts", count: contacts.length + suggestedCount, active: active.type === "everyone", onClick: () => handleSelect({ type: "everyone" }) })), _jsx(NavItem, { label: "Your contacts", count: contacts.length, active: active.type === "all", onClick: () => handleSelect({ type: "all" }) }), _jsx(NavItem, { label: "Favorites", count: favoriteCount, active: active.type === "favorites", onClick: () => handleSelect({ type: "favorites" }) }), suggestedCount !== undefined && (_jsx(NavItem, { label: "Suggested contacts", count: suggestedCount, active: active.type === "suggested", onClick: () => handleSelect({ type: "suggested" }) })), showDeleted && _jsx(NavItem, { label: "Deleted", active: active.type === "deleted", onClick: () => handleSelect({ type: "deleted" }) })] }), _jsxs("div", { children: [_jsxs("div", { className: "flex items-center justify-between px-2.5 mb-1", children: [_jsx("h2", { className: "text-xs font-bold uppercase tracking-wide text-text-muted", children: "Your contact lists" }), _jsx("button", { type: "button", onClick: () => setAddingList(true), "aria-label": "New contact list", className: "text-xs font-bold text-primary-dark hover:underline", children: "+" })] }), listsError && _jsx("p", { className: "px-2.5 text-xs text-danger", children: listsError }), _jsx("div", { className: "flex flex-col gap-0.5", children: lists.map((list) => (_jsx(NavItem, { label: list.name, count: listCounts.get(list.uid) ?? 0, active: active.type === "list" && active.uid === list.uid, onClick: () => handleSelect({ type: "list", uid: list.uid, name: list.name }) }, list.uid))) }), addingList && (_jsxs("form", { onSubmit: handleAddList, className: "flex items-center gap-1 px-2.5 mt-1", children: [_jsx("input", { type: "text", autoFocus: true, "aria-label": "New list name", id: `${idPrefix}-new-list-name`, value: newListName, onChange: (e) => setNewListName(e.target.value), className: "flex-1 text-xs py-1 px-1.5 border border-border rounded-sm bg-surface" }), _jsx("button", { type: "submit", className: "text-xs font-semibold text-primary-dark", children: "Add" })] }))] }), categories.length > 0 && (_jsxs("div", { children: [_jsx("h2", { className: "text-xs font-bold uppercase tracking-wide text-text-muted px-2.5 mb-1", children: "Categories" }), _jsx("div", { className: "flex flex-col gap-0.5", children: categories.map((name) => (_jsx(NavItem, { label: name, swatch: categoryColor(name), active: active.type === "category" && active.name === name, onClick: () => handleSelect({ type: "category", name }) }, name))) })] }))] }));
     return (_jsxs(_Fragment, { children: [_jsx("button", { type: "button", className: "lg:hidden m-3 mb-0 w-9 h-9 flex items-center justify-center rounded-sm text-text-muted hover:bg-surface-alt hover:text-text", "aria-label": "Open contacts menu", onClick: () => setDrawerOpen(true), children: _jsx(HiOutlineBars3, { size: 20, "aria-hidden": "true" }) }), _jsx("nav", { "aria-label": "Contacts", className: "hidden lg:flex w-56 shrink-0 border-r border-border flex-col gap-4 p-3 overflow-y-auto", children: navContent("desktop") }), _jsx(Drawer, { open: drawerOpen, onClose: () => setDrawerOpen(false), title: "Contacts", fullScreen: true, children: _jsx("div", { className: "flex flex-col gap-4", children: navContent("mobile") }) })] }));
 }

package/dist/apps/shared/components/contacts/contactCardData.d.ts

@@ -26,8 +26,8 @@ export declare function findContact(folders: readonly Folder[], address: string,
 export declare function loadRecentMessages(mailboxes: readonly Mailbox[], address: string, client?: ApiClient): Promise<Message[]>;
 /** The next `CARD_LIST_SIZE` events within `UPCOMING_DAYS` from `now` that `address` organizes or is invited to, soonest first. */
 export declare function loadUpcomingEvents(folders: readonly Folder[], address: string, now: Date, client?: ApiClient): Promise<CalendarOccurrence[]>;
-/** A vCard attachment's text. */
-export declare function fetchVCardText(attachmentUid: string): Promise<string>;
+/** A vCard attachment's text - through `client` (its origin and token) when given, else the cookie request it always was. */
+export declare function fetchVCardText(attachmentUid: string, client?: ApiClient): Promise<string>;
 /**
  * The vCard of the context message that describes `participant`: the first attachment holding a card with their address, else - only for the
  * message's sender, whose own vCard it presumably is - the first card there is. `undefined` when there is none, and for any failure to read one:

package/dist/apps/shared/components/contacts/contactCardData.js

@@ -9,6 +9,7 @@
  */
 import { addDays } from "date-fns";
 import { listCalendarEvents } from "../../../../lib/calendar/calendarApi.js";
+import { openSealedEvents } from "../../calendar/sealedEvents.js";
 import { expandAllOccurrences } from "../../../../lib/calendar/recurrence.js";
 import { createContact, listContactsInFolders } from "../../../../lib/contacts/contactsApi.js";
 import { parseVCards } from "../../../../lib/contacts/vcard.js";
@@ -53,7 +54,7 @@ export async function loadRecentMessages(mailboxes, address, client) {
 export async function loadUpcomingEvents(folders, address, now, client) {
     const wanted = normalizeAddress(address);
     const calendars = folders.filter((folder) => folder.type === "calendar");
-    const lists = await Promise.all(calendars.map((folder) => listCalendarEvents(folder.uid, client)));
+    const lists = await Promise.all(calendars.map((folder) => listCalendarEvents(folder.uid, client).then(openSealedEvents)));
     const involved = lists
         .flat()
         .filter((event) => event.status !== "cancelled" &&
@@ -63,8 +64,11 @@ export async function loadUpcomingEvents(folders, address, now, client) {
         .sort((a, b) => Date.parse(a.startDate) - Date.parse(b.startDate))
         .slice(0, CARD_LIST_SIZE);
 }
-/** A vCard attachment's text. */
-export async function fetchVCardText(attachmentUid) {
+/** A vCard attachment's text - through `client` (its origin and token) when given, else the cookie request it always was. */
+export async function fetchVCardText(attachmentUid, client) {
+    if (client) {
+        return (await client.fetchBlob(`/mail/attachments/${encodeURIComponent(attachmentUid)}/content`)).text();
+    }
     const res = await fetch(attachmentContentUrl(attachmentUid), { credentials: "include" });
     if (!res.ok) {
         throw new ApiRequestError(res.statusText || "Could not load this contact card.", res.status);
@@ -87,7 +91,7 @@ export async function loadParticipantCard(participant, context, client) {
         const isSender = !!context.message && normalizeAddress(context.message.from.address) === normalizeAddress(participant.address);
         let fallback;
         for (const attachment of await vCardAttachments(context, client)) {
-            const cards = parseVCards(await fetchVCardText(attachment.uid));
+            const cards = parseVCards(await fetchVCardText(attachment.uid, client));
             const match = cardForAddress(cards, participant.address, false);
             if (match) {
                 return match;

package/dist/apps/shared/components/layout/KeyEnrollmentGate.js

@@ -12,7 +12,8 @@ import { enrollKey, getKeyVault, VaultAlreadyInitializedError } from "../../../.
 import { UnopenableKeysNotice, unlockErrorMessage } from "./UnlockPromptProvider.js";
 import { FrameTakeover } from "../../navigation/frameContext.js";
 import { MIN_PASSWORD_LENGTH, RecoveryFollowUpModal, UnlockModeToggle, startRecoveryUnlock, } from "./RecoveryCodeUnlock.js";
-import { ENCRYPTION_PRIVATE_KEY_AAD_PURPOSE, getUnlockedKeys, unlockWithPassword, } from "../../../../lib/crypto/keySession.js";
+import { ENCRYPTION_PRIVATE_KEY_AAD_PURPOSE, getUnlockedKeys, subscribeKeySession, unlockWithPassword, } from "../../../../lib/crypto/keySession.js";
+import { ensureZeroAccessKey, provisionZeroAccessKey } from "../../../../lib/crypto/zeroAccessKey.js";
 import { buildAad, generateMasterKey, sealWithKey } from "../../../../lib/crypto/masterKey.js";
 import { buildPasswordWrap, buildRecoveryWraps } from "../../../../lib/crypto/masterKeyWraps.js";
 import { exportPrivateKeyPkcs8, generateKeyPairWithCsr } from "../../../../lib/crypto/keys.js";
@@ -27,12 +28,15 @@ async function provisionEncryptionKey(mailboxUid, mailboxAddress, password) {
     const { keyPair, csrPem } = await generateKeyPairWithCsr(mailboxAddress, "encrypt");
     const privateKeyRaw = await exportPrivateKeyPkcs8(keyPair.privateKey);
     const wrappedKeySealed = await sealWithKey(mk, privateKeyRaw, buildAad(mailboxUid, ENCRYPTION_PRIVATE_KEY_AAD_PURPOSE));
-    await enrollKey(mailboxUid, {
+    const vault = await enrollKey(mailboxUid, {
         useType: "encrypt",
         csr: csrPem,
         wrappedKey: { ciphertext: wrappedKeySealed.ciphertext, nonce: wrappedKeySealed.nonce, algorithm: "AES-256-GCM" },
         masterKeyWraps: [passwordWrap, ...recoveryWraps],
     });
+    // The zero-access key (restapi specs/search.md §3), under the same master key. Not fatal: setup is done once the
+    // encryption key is in, and a mailbox without a zero-access key gets one on its next unlock (`ensureZeroAccessKey()`).
+    await provisionZeroAccessKey(mailboxUid, mailboxAddress, mk, vault.masterKeyGeneration).catch(() => undefined);
     return { recoveryCodes };
 }
 /**
@@ -90,6 +94,21 @@ export default function KeyEnrollmentGate({ mailboxUid, mailboxAddress, mailboxK
             cancelled = true;
         };
     }, [mailboxUid, canProvision]);
+    // A mailbox set up before zero-access encryption existed has no zero-access key: give it one whenever its owner has
+    // it unlocked - now, or on a later unlock from anywhere (this gate, an unlock prompt, recovery). Best effort: a
+    // failure is retried on the next unlock.
+    useEffect(() => {
+        if (!mailboxUid || !mailboxAddress || !canProvision) {
+            return;
+        }
+        const ensure = () => void ensureZeroAccessKey(mailboxUid, mailboxAddress).catch(() => undefined);
+        ensure();
+        return subscribeKeySession((event) => {
+            if (event.mailboxUid === mailboxUid && event.state === "unlocked") {
+                ensure();
+            }
+        });
+    }, [mailboxUid, mailboxAddress, canProvision]);
     async function handleUnlock(e) {
         e.preventDefault();
         setError(null);

package/dist/apps/shared/components/layout/SharedMailboxKeyManager.d.ts

@@ -0,0 +1,15 @@
+import type { Mailbox } from "../../../../lib/mail/mailApi.js";
+/** How often the shared mailboxes are looked after again while some own mailbox stays unlocked. */
+export declare const SHARED_MAILBOX_CHECK_INTERVAL_MS: number;
+export interface SharedMailboxKeyManagerProps {
+    /** Every mailbox the user can open. */
+    mailboxes: Mailbox[];
+    userUid?: string;
+}
+/**
+ * Looks after the zero-access keys of the user's shared mailboxes (`lib/crypto/sharedMailboxKeys.ts`) whenever a mailbox of their own is
+ * unlocked, and every `SHARED_MAILBOX_CHECK_INTERVAL_MS` after that: opens each mailbox shared with them through their member key wraps (no
+ * password), and - for a mailbox they own or manage - provisions, rotates and shares its key with members still waiting. Best effort and
+ * silent: a pass that fails is tried again on the next. Renders nothing; mounted by `MailShell`.
+ */
+export default function SharedMailboxKeyManager({ mailboxes, userUid }: SharedMailboxKeyManagerProps): null;

package/dist/apps/shared/components/layout/SharedMailboxKeyManager.js

@@ -0,0 +1,72 @@
+///////////////////////////////////////////////////////////////////////////////
+// Copyright (C) 2026 Jean-Philippe Steinmetz
+// SPDX-License-Identifier: MPL-2.0
+///////////////////////////////////////////////////////////////////////////////
+import { useEffect, useRef } from "react";
+import { getUnlockedKeys, personallyUnlockedKeys, subscribeKeySession } from "../../../../lib/crypto/keySession.js";
+import { useApiClient } from "../../../../lib/util/apiClientContext.js";
+/** How often the shared mailboxes are looked after again while some own mailbox stays unlocked. */
+export const SHARED_MAILBOX_CHECK_INTERVAL_MS = 5 * 60 * 1000;
+/** The shared mailbox key code (pkijs and friends), loaded only once an own mailbox is unlocked. */
+let loaded;
+const loadSharedKeys = () => (loaded ?? (loaded = import("../../../../lib/crypto/sharedMailboxKeys.js").catch((err) => {
+    loaded = undefined;
+    throw err;
+})));
+/**
+ * Looks after the zero-access keys of the user's shared mailboxes (`lib/crypto/sharedMailboxKeys.ts`) whenever a mailbox of their own is
+ * unlocked, and every `SHARED_MAILBOX_CHECK_INTERVAL_MS` after that: opens each mailbox shared with them through their member key wraps (no
+ * password), and - for a mailbox they own or manage - provisions, rotates and shares its key with members still waiting. Best effort and
+ * silent: a pass that fails is tried again on the next. Renders nothing; mounted by `MailShell`.
+ */
+export default function SharedMailboxKeyManager({ mailboxes, userUid }) {
+    const client = useApiClient();
+    const latest = useRef({ mailboxes, userUid, client });
+    latest.current = { mailboxes, userUid, client };
+    const running = useRef(false);
+    useEffect(() => {
+        async function pass() {
+            if (running.current || personallyUnlockedKeys().length === 0) {
+                return;
+            }
+            running.current = true;
+            try {
+                const { maintainSharedMailbox, unlockSharedMailbox } = await loadSharedKeys();
+                const { mailboxes: current, userUid: me, client: apiClient } = latest.current;
+                for (const mailbox of current) {
+                    await look(mailbox, me, apiClient, unlockSharedMailbox, maintainSharedMailbox).catch(() => undefined);
+                }
+            }
+            catch {
+                // Nothing to do until the next pass.
+            }
+            finally {
+                running.current = false;
+            }
+        }
+        void pass();
+        const unsubscribe = subscribeKeySession((event) => {
+            if (event.state === "unlocked" && !getUnlockedKeys(event.mailboxUid)?.shared) {
+                void pass();
+            }
+        });
+        const interval = setInterval(() => void pass(), SHARED_MAILBOX_CHECK_INTERVAL_MS);
+        return () => {
+            unsubscribe();
+            clearInterval(interval);
+        };
+    }, []);
+    return null;
+}
+async function look(mailbox, me, client, unlockSharedMailbox, maintainSharedMailbox) {
+    const owned = !!mailbox.ownerUserUid && mailbox.ownerUserUid === me;
+    if (!owned && !getUnlockedKeys(mailbox.uid)) {
+        await unlockSharedMailbox(mailbox.uid, client);
+    }
+    const unlocked = getUnlockedKeys(mailbox.uid);
+    // An owner looks after their mailbox with its own keys; a member, with full access, whether or not it is open yet (a mailbox
+    // without an owner may have no key to open).
+    if (owned ? unlocked && !unlocked.shared : true) {
+        await maintainSharedMailbox(mailbox.uid, mailbox.primarySmtpAddress, client);
+    }
+}

package/dist/apps/shared/components/layout/UnlockPromptProvider.d.ts

@@ -36,6 +36,9 @@ interface UnlockPromptContextValue {
  * mailbox happens to resolve - see `KeyEnrollmentGate`'s `blocking` prop, which `MailShell` now sets to
  * `false` for exactly this reason.
  */
+/** Messages for a shared mailbox `openShared()` can't open. */
+export declare const SHARED_ACCESS_PENDING_MESSAGE = "This mailbox is shared with you, and is waiting for another member to share its key with you. Try again shortly.";
+export declare const SHARED_OWN_KEYS_LOCKED_MESSAGE = "Unlock your own mailbox first: it holds the key that opens the mailboxes shared with you.";
 export declare function UnlockPromptProvider({ children }: {
     children: React.ReactNode;
 }): React.JSX.Element;

package/dist/apps/shared/components/layout/UnlockPromptProvider.js

@@ -9,6 +9,7 @@ import Modal from "../../../../lib/components/overlays/Modal.js";
 import Alert from "../../../../lib/components/feedback/Alert.js";
 import Button from "../../../../lib/components/buttons/Button.js";
 import FormField from "../../../../lib/components/forms/FormField.js";
+import { notify } from "../../notifications/store.js";
 import { RECOVERY_CODE_ERROR, RecoveryFollowUpModal, UnlockModeToggle, startRecoveryUnlock, } from "./RecoveryCodeUnlock.js";
 /** Shown instead of "Incorrect password" when the password was right but the mailbox's encryption key itself
  * won't open (`UnopenableEncryptionKeyError`) - retrying can't fix that, so it must not read as a typo. */
@@ -44,6 +45,33 @@ const UnlockPromptContext = createContext(null);
  * mailbox happens to resolve - see `KeyEnrollmentGate`'s `blocking` prop, which `MailShell` now sets to
  * `false` for exactly this reason.
  */
+/** Messages for a shared mailbox `openShared()` can't open. */
+export const SHARED_ACCESS_PENDING_MESSAGE = "This mailbox is shared with you, and is waiting for another member to share its key with you. Try again shortly.";
+export const SHARED_OWN_KEYS_LOCKED_MESSAGE = "Unlock your own mailbox first: it holds the key that opens the mailboxes shared with you.";
+/**
+ * Opens `mailboxUid` through the user's member key wraps when it is a mailbox shared with them (`sharedMailboxKeys.ts`): its keys, or
+ * `undefined` when it isn't one of theirs (the password prompt applies). Rejects, after saying why, when it is shared with them but can't
+ * open yet. The shared key code is loaded only here.
+ */
+async function openShared(mailboxUid) {
+    let outcome;
+    try {
+        const { unlockSharedMailbox } = await import("../../../../lib/crypto/sharedMailboxKeys.js");
+        outcome = await unlockSharedMailbox(mailboxUid);
+    }
+    catch {
+        return undefined;
+    }
+    if (outcome === "unlocked") {
+        return getUnlockedKeys(mailboxUid);
+    }
+    if (outcome === "pending" || outcome === "own_keys_locked") {
+        const message = outcome === "pending" ? SHARED_ACCESS_PENDING_MESSAGE : SHARED_OWN_KEYS_LOCKED_MESSAGE;
+        notify({ kind: "info", title: "Shared mailbox", message });
+        throw new Error(message);
+    }
+    return undefined;
+}
 export function UnlockPromptProvider({ children }) {
     const [pending, setPendingState] = useState(null);
     // Mirrors `pending` synchronously, so two requests issued in the same tick see each other.
@@ -66,6 +94,10 @@ export function UnlockPromptProvider({ children }) {
         if (existing) {
             return Promise.resolve(existing);
         }
+        // A mailbox shared with the user opens through their member key wraps, not a password - and its password, if it has one, isn't theirs.
+        return openShared(mailboxUid).then((shared) => shared ?? promptForPassword(mailboxUid, mailboxKeys));
+    }, []);
+    const promptForPassword = useCallback((mailboxUid, mailboxKeys) => {
         return new Promise((resolve, reject) => {
             const current = pendingRef.current;
             if (current?.mailboxUid === mailboxUid) {

package/dist/apps/shared/components/mail/ConversationList.js

@@ -49,7 +49,7 @@ export default function ConversationList({ conversations, mailboxUid, selectedUi
         let stale = false;
         void mapWithConcurrency(conversations.filter(conversationLooksEncrypted), 4, async (conversation) => {
             if (!stale) {
-                await decryptForDisplay(conversation.latestMessageUid, conversation.mailboxUid ?? mailboxUid);
+                await decryptForDisplay(conversation.latestMessageUid, conversation.mailboxUid ?? mailboxUid, conversation.latestZeroAccess?.sealedSummary);
             }
         });
         return () => {