@rapidmx/web-client 0.34.0 → 0.36.0

package/dist/apps/shared/components/mail/reading/bodyContent.js

@@ -23,28 +23,39 @@ export function cachedBodyContent(uid, version) {
 /**
  * The message's body from the server's `GET /mail/messages/:id/content`: the HTML the server sanitized when it ingested the message
  * (`sanitizedHtmlBlobKey`), or - for a message with none - the plain-text preview. A request that fails throws an `ApiRequestError`.
- * Successful answers are remembered per uid and version.
+ * Successful answers are remembered per uid and version. With an explicit `client` the request goes through it (its origin and token) instead of
+ * the `jwt` cookie; without one it is the cookie request it always was.
  */
-export async function fetchBodyContent(uid, version, signal) {
+export async function fetchBodyContent(uid, version, signal, client) {
     const cached = cachedBodyContent(uid, version);
     if (cached) {
         return cached;
     }
-    // Says what it can show, as a document request would: the server answers with the sanitized HTML, or its plain-text fallback.
-    const res = await fetch(apiUrl(`/mail/messages/${encodeURIComponent(uid)}/content`), {
-        credentials: "include",
-        headers: { Accept: ACCEPT },
-        signal,
-    });
-    if (!res.ok) {
-        const contentType = res.headers.get("content-type") ?? "";
-        const body = contentType.includes("application/json") ? await res.json().catch(() => undefined) : undefined;
-        throw new ApiRequestError((body && (body.message || body.error)) || res.statusText || "Could not load this message.", res.status, body?.code, body);
+    const path = `/mail/messages/${encodeURIComponent(uid)}/content`;
+    let text;
+    let contentType;
+    if (client) {
+        // `fetchBlob()` rejects with the same `ApiRequestError` a failed response gives, and its blob carries the response's own type.
+        const blob = await client.fetchBlob(path, { headers: { Accept: ACCEPT }, signal });
+        text = await blob.text();
+        contentType = blob.type;
     }
-    const text = await res.text();
-    const content = (res.headers.get("content-type") ?? "").toLowerCase().includes("text/html")
-        ? { kind: "html", html: text }
-        : { kind: "text", text };
+    else {
+        // Says what it can show, as a document request would: the server answers with the sanitized HTML, or its plain-text fallback.
+        const res = await fetch(apiUrl(path), {
+            credentials: "include",
+            headers: { Accept: ACCEPT },
+            signal,
+        });
+        if (!res.ok) {
+            const resType = res.headers.get("content-type") ?? "";
+            const body = resType.includes("application/json") ? await res.json().catch(() => undefined) : undefined;
+            throw new ApiRequestError((body && (body.message || body.error)) || res.statusText || "Could not load this message.", res.status, body?.code, body);
+        }
+        text = await res.text();
+        contentType = res.headers.get("content-type") ?? "";
+    }
+    const content = contentType.toLowerCase().includes("text/html") ? { kind: "html", html: text } : { kind: "text", text };
     if (cache.size >= CACHE_LIMIT) {
         cache.delete(cache.keys().next().value);
     }

package/dist/apps/shared/components/mail/reading/conversationPrint.d.ts

@@ -10,6 +10,7 @@ export declare function printHeaders(message: Message, from: string): PrintableM
 export declare function olderConversationMessages(message: Message, client?: ApiClient): Promise<Message[]>;
 /**
  * One earlier message of a conversation as it prints: the body the reading pane would show. An encrypted one is decrypted here when this device has
- * its mailbox's keys unlocked; when it can't be, it prints a line saying so rather than the ciphertext.
+ * its mailbox's keys unlocked; when it can't be, it prints a line saying so rather than the ciphertext. `client` is the explicit `ApiClient` every
+ * request goes through when given (see `useApiClient()`); without one they are the cookie requests they always were.
  */
-export declare function printableOlderMessage(message: Message): Promise<PrintableMessage>;
+export declare function printableOlderMessage(message: Message, client?: ApiClient): Promise<PrintableMessage>;

package/dist/apps/shared/components/mail/reading/conversationPrint.js

@@ -34,15 +34,16 @@ export async function olderConversationMessages(message, client) {
 }
 /**
  * One earlier message of a conversation as it prints: the body the reading pane would show. An encrypted one is decrypted here when this device has
- * its mailbox's keys unlocked; when it can't be, it prints a line saying so rather than the ciphertext.
+ * its mailbox's keys unlocked; when it can't be, it prints a line saying so rather than the ciphertext. `client` is the explicit `ApiClient` every
+ * request goes through when given (see `useApiClient()`); without one they are the cookie requests they always were.
  */
-export async function printableOlderMessage(message) {
-    const attachments = await listAttachments(message.folderUid, message.uid).catch(() => []);
+export async function printableOlderMessage(message, client) {
+    const attachments = await listAttachments(message.folderUid, message.uid, client).catch(() => []);
     if (message.encrypted) {
         const unlocked = getUnlockedKeys(message.mailboxUid);
         if (unlocked) {
             const { evaluateMessageSecurity } = await import("../../../../../lib/crypto/messageSecurity.js");
-            const security = await evaluateMessageSecurity(await getMessageRawContent(message.uid), unlocked);
+            const security = await evaluateMessageSecurity(await getMessageRawContent(message.uid, client), unlocked);
             const content = security.text !== undefined ? { kind: "text", text: security.text } : security.html !== undefined ? { kind: "html", html: security.html } : undefined;
             if (content) {
                 return {
@@ -63,7 +64,8 @@ export async function printableOlderMessage(message) {
     return {
         subject: message.subject || "(no subject)",
         headers: printHeaders(message, formatMailAddress(message.from)),
-        content: await fetchBodyContent(message.uid, message.version),
+        // Without a client this is exactly the cookie request it always was.
+        content: await (client ? fetchBodyContent(message.uid, message.version, undefined, client) : fetchBodyContent(message.uid, message.version)),
         attachments,
     };
 }

package/dist/apps/shared/components/mail/reading/useMessageActions.js

@@ -11,6 +11,7 @@ import { resolveFolderOfType } from "../../../mail/folderOfType.js";
 import { setReadStateMany } from "../../../mail/messageReadState.js";
 import { usePermanentDelete } from "../../../mail/usePermanentDelete.js";
 import { reportFolderName, reportNotice, reportNoun, reportTitle, senderListsHref } from "../../../mail/reportNotices.js";
+import { zeroAccessSourceBase64 } from "../../../mail/zeroAccessSource.js";
 import { blockSender, neverBlockSender, normalizeAddresses, removeSenderRule } from "../../../mail/senderBlocking.js";
 import { notifyApiError } from "../../../notifications/apiErrors.js";
 import { notify } from "../../../notifications/store.js";
@@ -122,7 +123,9 @@ export function useMessageActions(params) {
         await exclusive(async () => {
             let result;
             try {
-                result = await reportMessage(message.uid, kind, { alwaysTrustSender }, client);
+                // The server holds only the sealed copy of a zero-access message: its spam filter learns from the source decrypted here.
+                const rawMessage = await zeroAccessSourceBase64(message, client);
+                result = await reportMessage(message.uid, kind, { alwaysTrustSender, ...(rawMessage ? { rawMessage } : {}) }, client);
             }
             catch (err) {
                 if (isNotFound(err)) {

package/dist/apps/shared/components/settings/KeyExportSetting.d.ts

@@ -0,0 +1,13 @@
+import React from "react";
+import type { Mailbox } from "../../../../lib/mail/mailApi.js";
+export interface KeyExportSettingProps {
+    mailbox: Mailbox;
+    /** The caller owns the mailbox and isn't impersonating: restapi records an export only for the owner. */
+    canManage: boolean;
+}
+/**
+ * "Export keys for Outlook/phone" (`lib/crypto/keyExport.ts`): a passphrase-protected `.p12` with the mailbox's zero-access
+ * and end-to-end encryption keys - and its signing key, if the user ticks the box - so a mail app that isn't RapidMX can read
+ * mail stored encrypted. Asks for the master password again however long the mailbox has been unlocked.
+ */
+export default function KeyExportSetting({ mailbox, canManage }: KeyExportSettingProps): React.JSX.Element;

package/dist/apps/shared/components/settings/KeyExportSetting.js

@@ -0,0 +1,88 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+///////////////////////////////////////////////////////////////////////////////
+// Copyright (C) 2026 Jean-Philippe Steinmetz
+// SPDX-License-Identifier: MPL-2.0
+///////////////////////////////////////////////////////////////////////////////
+import { useState } from "react";
+import { exportKeysAsPkcs12, MIN_EXPORT_PASSPHRASE_LENGTH, NothingToExportError } from "../../../../lib/crypto/keyExport.js";
+import { ApiRequestError } from "../../../../lib/util/api.js";
+import { useApiClient } from "../../../../lib/util/apiClientContext.js";
+import Alert from "../../../../lib/components/feedback/Alert.js";
+import Button from "../../../../lib/components/buttons/Button.js";
+import { notifyApiError } from "../../notifications/apiErrors.js";
+import PolicyLockedNotice from "./PolicyLockedNotice.js";
+const INPUT_CLASS = "w-full text-sm border border-border rounded-sm py-1.5 px-2 bg-surface";
+/** Hands `bytes` to the browser as a file download. */
+function saveFile(bytes, filename) {
+    const url = URL.createObjectURL(new Blob([bytes], { type: "application/x-pkcs12" }));
+    const link = document.createElement("a");
+    link.href = url;
+    link.download = filename;
+    document.body.appendChild(link);
+    link.click();
+    link.remove();
+    URL.revokeObjectURL(url);
+}
+/**
+ * "Export keys for Outlook/phone" (`lib/crypto/keyExport.ts`): a passphrase-protected `.p12` with the mailbox's zero-access
+ * and end-to-end encryption keys - and its signing key, if the user ticks the box - so a mail app that isn't RapidMX can read
+ * mail stored encrypted. Asks for the master password again however long the mailbox has been unlocked.
+ */
+export default function KeyExportSetting({ mailbox, canManage }) {
+    const client = useApiClient();
+    const [open, setOpen] = useState(false);
+    const [password, setPassword] = useState("");
+    const [passphrase, setPassphrase] = useState("");
+    const [confirmPassphrase, setConfirmPassphrase] = useState("");
+    const [includeSigningKey, setIncludeSigningKey] = useState(false);
+    const [exporting, setExporting] = useState(false);
+    const [error, setError] = useState(null);
+    function reset() {
+        setOpen(false);
+        setPassword("");
+        setPassphrase("");
+        setConfirmPassphrase("");
+        setIncludeSigningKey(false);
+        setError(null);
+    }
+    async function handleExport(e) {
+        e.preventDefault();
+        if (passphrase.length < MIN_EXPORT_PASSPHRASE_LENGTH) {
+            setError(`The file's passphrase must be at least ${MIN_EXPORT_PASSPHRASE_LENGTH} characters.`);
+            return;
+        }
+        if (passphrase !== confirmPassphrase) {
+            setError("The passphrases don't match.");
+            return;
+        }
+        setExporting(true);
+        setError(null);
+        try {
+            const result = await exportKeysAsPkcs12({
+                mailboxUid: mailbox.uid,
+                mailboxAddress: mailbox.primarySmtpAddress,
+                mailboxKeys: mailbox.keys ?? [],
+                masterPassword: password,
+                exportPassphrase: passphrase,
+                includeSigningKey,
+            }, client);
+            saveFile(result.pkcs12, `${mailbox.primarySmtpAddress}-keys.p12`);
+            reset();
+        }
+        catch (err) {
+            if (err instanceof ApiRequestError) {
+                notifyApiError(err, "Couldn't export your keys");
+            }
+            else if (err instanceof NothingToExportError || (err instanceof Error && err.message.startsWith("This mailbox has no password"))) {
+                setError(err.message);
+            }
+            else {
+                setError("Incorrect password.");
+            }
+        }
+        finally {
+            setExporting(false);
+        }
+    }
+    return (_jsxs("div", { children: [_jsx("h2", { className: "text-sm font-semibold mb-2", children: "Export keys for Outlook or a phone" }), _jsx("p", { className: "text-sm text-text-muted mb-2", children: "Mail apps other than RapidMX need your keys to read encrypted mail. The exported file holds your zero-access and end-to-end encryption keys, protected by a passphrase you choose. Anyone with the file and its passphrase can read all of this mailbox\u2019s mail, so keep it safe and delete it once it\u2019s installed." }), !canManage ? (_jsx(PolicyLockedNotice, { children: "Only this mailbox\u2019s owner, signed in as themselves, can export its keys." })) : !open ? (_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", onClick: () => setOpen(true), children: "Export keys\u2026" })) : (_jsxs("form", { onSubmit: (e) => void handleExport(e), className: "flex flex-col gap-2", children: [_jsx("input", { type: "password", "aria-label": "Encryption password", placeholder: "Encryption password", className: INPUT_CLASS, value: password, onChange: (e) => setPassword(e.target.value), disabled: exporting, autoComplete: "current-password" }), _jsx("input", { type: "password", "aria-label": "File passphrase", placeholder: `File passphrase (at least ${MIN_EXPORT_PASSPHRASE_LENGTH} characters)`, className: INPUT_CLASS, value: passphrase, onChange: (e) => setPassphrase(e.target.value), disabled: exporting, autoComplete: "new-password" }), _jsx("input", { type: "password", "aria-label": "Confirm file passphrase", placeholder: "Confirm file passphrase", className: INPUT_CLASS, value: confirmPassphrase, onChange: (e) => setConfirmPassphrase(e.target.value), disabled: exporting, autoComplete: "new-password" }), _jsxs("label", { className: "flex items-start gap-2 text-sm", children: [_jsx("input", { type: "checkbox", className: "mt-1", checked: includeSigningKey, onChange: (e) => setIncludeSigningKey(e.target.checked), disabled: exporting }), _jsxs("span", { children: [_jsx("span", { className: "font-semibold block", children: "Include my signing key" }), _jsx("span", { className: "text-xs text-text-muted", children: "Only if that app will sign mail you send. Anyone with the file could sign as you." })] })] }), error && _jsx(Alert, { children: error }), _jsxs("div", { className: "flex gap-2", children: [_jsx(Button, { type: "submit", className: "!w-auto", disabled: exporting || !password || !passphrase, children: exporting ? "Exporting…" : "Export" }), _jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", onClick: reset, disabled: exporting, children: "Cancel" })] })] }))] }));
+}

package/dist/apps/shared/components/settings/PolicyLockedNotice.d.ts

@@ -0,0 +1,11 @@
+import React from "react";
+export interface PolicyLockedNoticeProps {
+    /** Why the setting next to this notice can't be changed - e.g. that an administrator turned it off for the server. */
+    children: React.ReactNode;
+}
+/**
+ * Explains why a settings control is disabled by a policy the user can't change themselves (an administrator's server-wide
+ * setting, say), shown right under that control. A disabled control with no reason reads as a defect; this says who decided
+ * and that the user isn't the one who can undo it.
+ */
+export default function PolicyLockedNotice({ children }: PolicyLockedNoticeProps): React.JSX.Element;

package/dist/apps/shared/components/settings/PolicyLockedNotice.js

@@ -0,0 +1,9 @@
+import { jsx as _jsx } from "react/jsx-runtime";
+/**
+ * Explains why a settings control is disabled by a policy the user can't change themselves (an administrator's server-wide
+ * setting, say), shown right under that control. A disabled control with no reason reads as a defect; this says who decided
+ * and that the user isn't the one who can undo it.
+ */
+export default function PolicyLockedNotice({ children }) {
+    return (_jsx("p", { role: "note", className: "mt-1.5 text-xs text-text-muted border-l-2 border-border pl-2", children: children }));
+}

package/dist/apps/shared/components/settings/ZeroAccessSetting.d.ts

@@ -0,0 +1,14 @@
+import React from "react";
+import { type Mailbox } from "../../../../lib/mail/mailApi.js";
+export interface ZeroAccessSettingProps {
+    mailbox: Mailbox;
+    /** The caller owns the mailbox and isn't impersonating: only then can the setting be changed (restapi drops anybody else's value). */
+    canManage: boolean;
+}
+/**
+ * "Enable zero-access encryption" for one mailbox (restapi `specs/search.md` §3): unencrypted mail is encrypted to the
+ * mailbox's zero-access key as it arrives and the server keeps no readable copy. On by default. Shown disabled, with the
+ * reason, when the administrator has turned "Allow zero-access encryption" off for the server, or when the server doesn't
+ * support it. A shared mailbox is covered too: its members read it through member key wraps (`sharedMailboxKeys.ts`).
+ */
+export default function ZeroAccessSetting({ mailbox, canManage }: ZeroAccessSettingProps): React.JSX.Element;

package/dist/apps/shared/components/settings/ZeroAccessSetting.js

@@ -0,0 +1,71 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+///////////////////////////////////////////////////////////////////////////////
+// Copyright (C) 2026 Jean-Philippe Steinmetz
+// SPDX-License-Identifier: MPL-2.0
+///////////////////////////////////////////////////////////////////////////////
+import { useEffect, useState } from "react";
+import { getEncryptionPolicy } from "../../../../lib/crypto/keyvaultApi.js";
+import { getMailbox, updateMailbox } from "../../../../lib/mail/mailApi.js";
+import { ApiRequestError } from "../../../../lib/util/api.js";
+import { useApiClient } from "../../../../lib/util/apiClientContext.js";
+import { notifyApiError } from "../../notifications/apiErrors.js";
+import PolicyLockedNotice from "./PolicyLockedNotice.js";
+/**
+ * "Enable zero-access encryption" for one mailbox (restapi `specs/search.md` §3): unencrypted mail is encrypted to the
+ * mailbox's zero-access key as it arrives and the server keeps no readable copy. On by default. Shown disabled, with the
+ * reason, when the administrator has turned "Allow zero-access encryption" off for the server, or when the server doesn't
+ * support it. A shared mailbox is covered too: its members read it through member key wraps (`sharedMailboxKeys.ts`).
+ */
+export default function ZeroAccessSetting({ mailbox, canManage }) {
+    const client = useApiClient();
+    const [enabled, setEnabled] = useState(mailbox.zeroAccessEnabled !== false);
+    const [blocker, setBlocker] = useState(undefined);
+    const [saving, setSaving] = useState(false);
+    useEffect(() => {
+        let cancelled = false;
+        void (async () => {
+            const policy = await getEncryptionPolicy(client).catch(() => undefined);
+            let next = null;
+            if (policy?.allowZeroAccess === undefined) {
+                next = "unsupported";
+            }
+            else if (!policy.allowZeroAccess) {
+                next = "disabled_by_admin";
+            }
+            if (!cancelled) {
+                setBlocker(next);
+            }
+        })();
+        return () => {
+            cancelled = true;
+        };
+    }, [mailbox.uid, client]);
+    async function save(next) {
+        setSaving(true);
+        const previous = enabled;
+        setEnabled(next);
+        try {
+            const write = (version) => updateMailbox({ uid: mailbox.uid, version, zeroAccessEnabled: next }, client);
+            try {
+                await write(mailbox.version);
+            }
+            catch (err) {
+                // Enrolling a key (which happens on unlock) moves the mailbox's version on, so the copy this page was given may be
+                // behind: read it again and retry once.
+                if (!(err instanceof ApiRequestError && err.status === 409)) {
+                    throw err;
+                }
+                await write((await getMailbox(mailbox.uid, {}, client)).version);
+            }
+        }
+        catch (err) {
+            setEnabled(previous);
+            notifyApiError(err, "Couldn't save the zero-access encryption setting");
+        }
+        finally {
+            setSaving(false);
+        }
+    }
+    const locked = blocker !== null;
+    return (_jsxs("div", { children: [_jsx("h2", { className: "text-sm font-semibold mb-2", children: "Zero-access encryption" }), _jsxs("label", { className: "flex items-start gap-2 text-sm", children: [_jsx("input", { type: "checkbox", className: "mt-1", checked: !locked && enabled, disabled: !canManage || locked || saving, onChange: (e) => void save(e.target.checked) }), _jsxs("span", { children: [_jsx("span", { className: "font-semibold block", children: "Enable zero-access encryption" }), _jsx("span", { className: "text-xs text-text-muted", children: "Mail that arrives unencrypted is encrypted the moment it is received, and the server keeps no copy it can read - nobody else, administrators included, can read it. You unlock it with your encryption password, and search of message contents happens on your device. Outlook and phone mail apps need your exported keys to read it. Turning this off only affects mail that arrives afterwards." })] })] }), blocker === "disabled_by_admin" && (_jsx(PolicyLockedNotice, { children: "Your administrator has turned off zero-access encryption for this server, so new mail is stored without it. Mail already encrypted stays encrypted." })), blocker === "unsupported" && _jsx(PolicyLockedNotice, { children: "This server doesn\u2019t offer zero-access encryption." }), !mailbox.ownerUserUid && !locked && (_jsx(PolicyLockedNotice, { children: "This shared mailbox has no owner: it is protected for its members, whose apps share its key with each other." })), !canManage && !locked && mailbox.ownerUserUid && (_jsx(PolicyLockedNotice, { children: "Only this mailbox\u2019s owner, signed in as themselves, can change this." }))] }));
+}

package/dist/apps/shared/live/useFolderLiveUpdates.d.ts

@@ -0,0 +1,19 @@
+import { type PushEvent } from "../../../lib/mail/pushClient.js";
+/** An item a push event says was created, changed or deleted: its uid, and whether it is gone. */
+export interface FolderItemChange {
+    uid: string;
+    deleted: boolean;
+}
+/**
+ * The item a push event says was created, changed or deleted, when the event's `type` - the published model class name (`ContactMongo`,
+ * `TaskSQL`, ...) - matches `model`, or `undefined` for anything else the shared push connection delivers. Only the uid is taken: the payload
+ * is whatever every subscriber of the folder may see (a private calendar event's busy block), so a page fetches the item again by its uid.
+ */
+export declare function changedItemOf(event: PushEvent, model: RegExp): FolderItemChange | undefined;
+/**
+ * Keeps a page's folders live: while the page is mounted the tab's push connection is subscribed to `folderUids` (under the page's own
+ * `group` - see `PushClient.setChannels()`; Mail's connection subscribes to mail folders only, so nothing else asks for a calendar,
+ * contacts or tasks folder), and `onChange` is called with every item `parse` recognizes - created, changed or deleted anywhere: another
+ * tab, a phone over ActiveSync, the server itself. `onChange` may change between renders; the latest is called.
+ */
+export declare function useFolderLiveUpdates(group: string, folderUids: readonly string[], parse: (event: PushEvent) => FolderItemChange | undefined, onChange: (change: FolderItemChange) => void): void;

package/dist/apps/shared/live/useFolderLiveUpdates.js

@@ -0,0 +1,41 @@
+///////////////////////////////////////////////////////////////////////////////
+// Copyright (C) 2026 Jean-Philippe Steinmetz
+// SPDX-License-Identifier: MPL-2.0
+///////////////////////////////////////////////////////////////////////////////
+import { useEffect, useRef } from "react";
+import { getPushClient } from "../../../lib/mail/pushClient.js";
+/**
+ * The item a push event says was created, changed or deleted, when the event's `type` - the published model class name (`ContactMongo`,
+ * `TaskSQL`, ...) - matches `model`, or `undefined` for anything else the shared push connection delivers. Only the uid is taken: the payload
+ * is whatever every subscriber of the folder may see (a private calendar event's busy block), so a page fetches the item again by its uid.
+ */
+export function changedItemOf(event, model) {
+    if (!model.test(event.type) || (event.action !== "create" && event.action !== "update" && event.action !== "delete")) {
+        return undefined;
+    }
+    const data = event.data;
+    return typeof data?.uid === "string" ? { uid: data.uid, deleted: event.action === "delete" } : undefined;
+}
+/**
+ * Keeps a page's folders live: while the page is mounted the tab's push connection is subscribed to `folderUids` (under the page's own
+ * `group` - see `PushClient.setChannels()`; Mail's connection subscribes to mail folders only, so nothing else asks for a calendar,
+ * contacts or tasks folder), and `onChange` is called with every item `parse` recognizes - created, changed or deleted anywhere: another
+ * tab, a phone over ActiveSync, the server itself. `onChange` may change between renders; the latest is called.
+ */
+export function useFolderLiveUpdates(group, folderUids, parse, onChange) {
+    const key = [...new Set(folderUids)].sort().join(",");
+    useEffect(() => {
+        const client = getPushClient();
+        client.setChannels(key ? key.split(",") : [], group);
+        client.start();
+        return () => client.setChannels([], group);
+    }, [group, key]);
+    const latest = useRef({ parse, onChange });
+    latest.current = { parse, onChange };
+    useEffect(() => getPushClient().onEvent((event) => {
+        const change = latest.current.parse(event);
+        if (change) {
+            latest.current.onChange(change);
+        }
+    }), []);
+}

package/dist/apps/shared/mail/decryptedMessages.d.ts

@@ -32,4 +32,4 @@ export declare function useUnlockEpoch(): number;
  * Decrypts one message to recover its subject and preview, when its mailbox's keys are unlocked and it isn't already known. Best effort: a
  * message that can't be fetched or opened is simply left as it was. Never prompts.
  */
-export declare function decryptForDisplay(uid: string, mailboxUid: string): Promise<void>;
+export declare function decryptForDisplay(uid: string, mailboxUid: string, sealedSummary?: string): Promise<void>;

package/dist/apps/shared/mail/decryptedMessages.js

@@ -113,16 +113,24 @@ export function useUnlockEpoch() {
  * Decrypts one message to recover its subject and preview, when its mailbox's keys are unlocked and it isn't already known. Best effort: a
  * message that can't be fetched or opened is simply left as it was. Never prompts.
  */
-export async function decryptForDisplay(uid, mailboxUid) {
+export async function decryptForDisplay(uid, mailboxUid, sealedSummary) {
     const unlocked = getUnlockedKeys(mailboxUid);
     if (!unlocked || entries[uid] || inFlight.has(uid) || decryptFailedBefore(uid)) {
         return;
     }
     inFlight.add(uid);
     try {
+        const securityApi = await import("../../../lib/crypto/messageSecurity.js");
+        // A message sealed at rest has its subject and preview sealed on its row: opening that small summary saves downloading it.
+        const summary = sealedSummary ? await securityApi.openZeroAccessSummary(sealedSummary, unlocked.zeroAccessKeys) : undefined;
+        if (summary) {
+            if (getUnlockedKeys(mailboxUid) === unlocked) {
+                rememberDecrypted(uid, mailboxUid, { subject: summary.subject, preview: summary.preview.slice(0, PREVIEW_MAX_LENGTH) });
+            }
+            return;
+        }
         const rawMime = await getMessageRawContent(uid);
-        const { evaluateMessageSecurity } = await import("../../../lib/crypto/messageSecurity.js");
-        const security = await evaluateMessageSecurity(rawMime, unlocked);
+        const security = await securityApi.evaluateMessageSecurity(rawMime, unlocked);
         // A lock while this ran: the result must not go back on screen.
         if (getUnlockedKeys(mailboxUid) === unlocked) {
             rememberDecrypted(uid, mailboxUid, { subject: security.subject, preview: security.html ? previewOf(security.html) : security.text?.slice(0, PREVIEW_MAX_LENGTH) });

package/dist/apps/shared/mail/outbox/sendJob.js

@@ -106,7 +106,7 @@ async function completeContext(request, client) {
 async function assemble(request, mailbox, mode, statuses, withSignature, client) {
     const { draft, to, cc, bcc, subject, html } = request;
     if (mode === "plain") {
-        return assembleDraft(draft.uid, { to, cc, bcc, subject, html }, client);
+        return assembleDraft(draft.uid, { to, cc, bcc, subject, html, intent: "send" }, client);
     }
     const keys = readSendKeys(request.mailboxUid, request.signEnabled, mailbox);
     const own = mailbox;
@@ -131,7 +131,7 @@ async function assemble(request, mailbox, mode, statuses, withSignature, client)
         ? await buildEncryptedMessage(bodyContentType, html, protectedHeaders, outerHeaders, [keys.unlocked.encryptionCertDer, ...statuses.map((status) => fromBase64(status.encryptCert.publicKey))], signing)
         : await buildSignedOnlyMessage(bodyContentType, html, protectedHeaders, signing.certDer, signing.privateKey);
     const rawMime = assembleOutboundMime(outerHeaders, mimePart);
-    return assembleDraftRaw(draft.uid, { to, cc, bcc, subject: outerHeaders.subject, rawMime }, client);
+    return assembleDraftRaw(draft.uid, { to, cc, bcc, subject: outerHeaders.subject, rawMime, intent: "send" }, client);
 }
 function failureOf(err, fallback) {
     const failure = describeSendFailure(err, fallback);

package/dist/apps/shared/mail/outbox/sendOutcomes.js

@@ -57,9 +57,7 @@ async function openFailedDraft(event, client) {
             });
             return;
         }
-        // loadOriginalMessage() (quotedBody.ts) does not yet accept an explicit ApiClient itself - out of scope here (that module is not one of
-        // this task's files); it still falls back to the default global session even under an ApiClientContext.Provider.
-        const original = await loadOriginalMessage(moved, null);
+        const original = await loadOriginalMessage(moved, null, {}, client);
         const attachments = await listAttachments(moved.folderUid, moved.uid, client).catch(() => []);
         const byType = (type) => moved.recipients.filter((recipient) => recipient.type === type).map(formatRecipient).join(", ");
         openComposeFromOutside({

package/dist/apps/shared/mail/reportNotices.js

@@ -42,6 +42,8 @@ export function reportNotice(result, subject, alwaysTrust) {
         ? "The spam filter could not be trained from this report."
         : result.learnSkipped === "encrypted"
             ? "Not used to train the spam filter: the message is encrypted."
-            : undefined;
+            : result.learnSkipped === "zero_access"
+                ? "Not used to train the spam filter: unlock your mailbox to let it learn from protected mail."
+                : undefined;
     return { title: kind.title, message: parts.join(" "), hint };
 }

package/dist/apps/shared/mail/zeroAccessSource.d.ts

@@ -0,0 +1,8 @@
+import { type Message } from "../../../lib/mail/mailApi.js";
+import type { ApiClient } from "../../../lib/util/api.js";
+/**
+ * The original source of a zero-access `message`, decrypted with its mailbox's unlocked keys and base64-encoded - what the server, which holds
+ * only the sealed copy, needs for an action that reads the message itself (`reportMessage()`'s `rawMessage`). `undefined` for any other
+ * message, while the mailbox is locked, or when it can't be fetched or opened: the action then goes ahead without it.
+ */
+export declare function zeroAccessSourceBase64(message: Pick<Message, "uid" | "mailboxUid" | "zeroAccess">, client?: ApiClient): Promise<string | undefined>;

package/dist/apps/shared/mail/zeroAccessSource.js

@@ -0,0 +1,26 @@
+///////////////////////////////////////////////////////////////////////////////
+// Copyright (C) 2026 Jean-Philippe Steinmetz
+// SPDX-License-Identifier: MPL-2.0
+///////////////////////////////////////////////////////////////////////////////
+import { getUnlockedKeys } from "../../../lib/crypto/keySession.js";
+import { openZeroAccessMessage } from "../../../lib/crypto/messageSecurity.js";
+import { getMessageRawContent } from "../../../lib/mail/mailApi.js";
+/**
+ * The original source of a zero-access `message`, decrypted with its mailbox's unlocked keys and base64-encoded - what the server, which holds
+ * only the sealed copy, needs for an action that reads the message itself (`reportMessage()`'s `rawMessage`). `undefined` for any other
+ * message, while the mailbox is locked, or when it can't be fetched or opened: the action then goes ahead without it.
+ */
+export async function zeroAccessSourceBase64(message, client) {
+    const unlocked = message.zeroAccess ? getUnlockedKeys(message.mailboxUid) : undefined;
+    if (!unlocked) {
+        return undefined;
+    }
+    try {
+        const original = await openZeroAccessMessage(await getMessageRawContent(message.uid, client), unlocked);
+        // A binary string (one char per byte), which `btoa()` encodes as the bytes themselves.
+        return original === undefined ? undefined : btoa(original);
+    }
+    catch {
+        return undefined;
+    }
+}

package/dist/apps/shared/search/LocalIndexLifecycle.d.ts

@@ -1,6 +1,8 @@
 import type { PublicKey } from "../../../lib/crypto/keyvaultApi.js";
 import type { Folder } from "../../../lib/mail/mailApi.js";
 export declare const POLL_INTERVAL_MS = 5000;
+/** How often an unlocked zero-access mailbox's local index is brought up to date with the server's sealed index. */
+export declare const ZERO_ACCESS_SYNC_INTERVAL_MS = 120000;
 export interface LocalIndexLifecycleProps {
     mailboxUid?: string;
     mailboxKeys?: PublicKey[];

package/dist/apps/shared/search/LocalIndexLifecycle.js

@@ -34,8 +34,16 @@ const loadBuilder = () => (builder ?? (builder = import("./localIndexBuilder.js"
     builder = undefined;
     throw err;
 })));
+/** The zero-access index sync (`zeroAccessIndexSync.ts`), loaded the same way: only once a zero-access mailbox is unlocked. */
+let syncer;
+const loadSyncer = () => (syncer ?? (syncer = import("./zeroAccessIndexSync.js").catch((err) => {
+    syncer = undefined;
+    throw err;
+})));
 import { destroyLocalIndex, pruneInaccessibleLocalIndexes } from "./localIndexRpcClient.js";
 export const POLL_INTERVAL_MS = 5000;
+/** How often an unlocked zero-access mailbox's local index is brought up to date with the server's sealed index. */
+export const ZERO_ACCESS_SYNC_INTERVAL_MS = 120000;
 /** Renders nothing - pure side-effect component, mounted by `MailShell.tsx`. */
 export default function LocalIndexLifecycle({ mailboxUid, folders, accessibleMailboxUids }) {
     // The explicit ApiClient (from useApiClient()) this component is rendered under - undefined for every existing caller (the SSR web/admin
@@ -49,6 +57,23 @@ export default function LocalIndexLifecycle({ mailboxUid, folders, accessibleMai
     // The latest props (and client), for the long-lived polling interval below.
     const latestRef = useRef({ mailboxUid, folders, client });
     latestRef.current = { mailboxUid, folders, client };
+    // mailboxUid -> when its last zero-access sync started. Set only once its first build finished (the sync writes into the index the
+    // build opened); a mailbox in `syncingRef` has a pass running, and never gets a second one alongside it.
+    const lastSyncRef = useRef(new Map());
+    const syncingRef = useRef(new Set());
+    function syncIfDue(targetMailboxUid, targetClient, first = false) {
+        const unlocked = getUnlockedKeys(targetMailboxUid);
+        const last = lastSyncRef.current.get(targetMailboxUid);
+        if (!unlocked?.zeroAccessKeys?.length || syncingRef.current.has(targetMailboxUid) || (!first && (last === undefined || Date.now() - last < ZERO_ACCESS_SYNC_INTERVAL_MS))) {
+            return;
+        }
+        lastSyncRef.current.set(targetMailboxUid, Date.now());
+        syncingRef.current.add(targetMailboxUid);
+        loadSyncer()
+            .then(({ syncZeroAccessIndex }) => syncZeroAccessIndex(targetMailboxUid, unlocked, targetClient))
+            .catch(() => undefined)
+            .finally(() => syncingRef.current.delete(targetMailboxUid));
+    }
     function startBuildIfUnlocked(targetMailboxUid, targetFolders, targetClient) {
         const unlocked = getUnlockedKeys(targetMailboxUid);
         if (!unlocked || targetFolders.length === 0 || trackedRef.current.get(targetMailboxUid)) {
@@ -59,6 +84,7 @@ export default function LocalIndexLifecycle({ mailboxUid, folders, accessibleMai
         // the rest of the app depends on.
         loadBuilder()
             .then(({ buildLocalIndex }) => buildLocalIndex(targetMailboxUid, unlocked, targetFolders, undefined, targetClient))
+            .then(() => syncIfDue(targetMailboxUid, targetClient, true))
             .catch(() => undefined);
     }
     useEffect(() => {
@@ -72,6 +98,7 @@ export default function LocalIndexLifecycle({ mailboxUid, folders, accessibleMai
                 if (wasUnlocked && !getUnlockedKeys(trackedUid)) {
                     // A present-to-absent transition: something just destroyed this mailbox's keys.
                     trackedRef.current.set(trackedUid, false);
+                    lastSyncRef.current.delete(trackedUid);
                     // Stop the pass still running with the now-destroyed keys; the destroy itself also makes
                     // the Worker reject anything that pass still sends.
                     loadBuilder()
@@ -84,6 +111,7 @@ export default function LocalIndexLifecycle({ mailboxUid, folders, accessibleMai
             const { mailboxUid: activeUid, folders: activeFolders, client: activeClient } = latestRef.current;
             if (activeUid) {
                 startBuildIfUnlocked(activeUid, activeFolders, activeClient);
+                syncIfDue(activeUid, activeClient);
             }
         }, POLL_INTERVAL_MS);
         return () => clearInterval(interval);

package/dist/apps/shared/search/localIndexBuilder.d.ts

@@ -20,6 +20,11 @@
  * fully searchable via Tier 1; indexing it here too would spend this index's bounded byte budget on
  * content that didn't need it.
  *
+ * **Shared with the mailbox's other devices (Source C).** In a mailbox with a zero-access key, a pass first imports the end-to-end mail
+ * other devices already decrypted (`importClientSegments()`), at each message's version, so it isn't decrypted again here; and what this
+ * pass decrypts it uploads for them, sealed to the zero-access key (`uploadClientDocuments()`). Both are best effort - see
+ * `zeroAccessIndexSync.ts`.
+ *
  * **Verification seals.** A message this pass decrypts that has no seal for the vault's current `masterKeyGeneration` is
  * evaluated with `evaluateMessageSecurityWithSeal()`, against the sender's pinned signing keys from the reader's
  * contacts (`pinnedSigners.ts`, the message pane's own source, looked up once per sender per pass), so a verified