@rapidmx/web-client 0.35.0 → 0.36.0

package/apps/escrow/matters/[uid].tsx

@@ -213,7 +213,7 @@ function MatterDetailContent({ uid }: { uid: string }) {
         setLoadingMaterial(true);
         try {
             const material = await getAccessRequestMaterial(request.uid);
-            if (seq === materialSeq.current) setMaterialText(JSON.stringify(material.masterKeyWraps, null, 2));
+            if (seq === materialSeq.current) setMaterialText(JSON.stringify(material, null, 2));
         } catch (err) {
             if (seq === materialSeq.current) {
                 setMaterialError(err instanceof ApiRequestError ? err.message : "Could not read this request's material.");
@@ -631,8 +631,9 @@ function MatterDetailContent({ uid }: { uid: string }) {
                 ) : (
                     <>
                         <p className="text-sm text-text-muted mb-3">
-                            Still-encrypted master key wraps for <strong>{materialFor?.mailboxUid}</strong> — this
-                            server cannot decrypt these either. Copy the JSON below into your own offline tooling.
+                            Still-encrypted key material for <strong>{materialFor?.mailboxUid}</strong>: the escrow master key wrap,
+                            and the private keys that read its mail, sealed under that master key. This server cannot decrypt any of it
+                            either. Copy the JSON below into your own offline tooling.
                         </p>
                         <pre className="text-xs font-mono bg-surface-alt border border-border rounded-sm p-3 overflow-x-auto whitespace-pre-wrap break-all">
                             {materialText}

package/apps/shared/calendar/sealedEvents.ts

@@ -0,0 +1,80 @@
+///////////////////////////////////////////////////////////////////////////////
+// Copyright (C) 2026 Jean-Philippe Steinmetz
+// SPDX-License-Identifier: MPL-2.0
+///////////////////////////////////////////////////////////////////////////////
+/**
+ * Calendar events the server made from invitations that reached a zero-access mailbox keep their title, location and description only
+ * sealed to the mailbox's zero-access key (`CalendarEvent.sealedContent`; the row's `title` is `[...]`). These are opened here with the
+ * mailbox's unlocked keys so the calendar shows the real ones; while the mailbox is locked the event keeps its placeholder. The
+ * decryption code is loaded only when a sealed event is actually seen.
+ */
+import type { CalendarEvent } from "../../../lib/calendar/calendarApi.js";
+import { getUnlockedKeys } from "../../../lib/crypto/keySession.js";
+import { fromBase64 } from "../../../lib/crypto/encoding.js";
+import { onSigningOut } from "../components/mail/compose/composeFlushRegistry.js";
+
+/** What `sealedContent.sealed` decrypts to. */
+interface SealedEventFields {
+    title?: unknown;
+    location?: unknown;
+    description?: unknown;
+    descriptionHtml?: unknown;
+}
+
+/** Opened fields by sealed text - the same sealed content always opens to the same fields. Cleared with `clearSealedEvents()`. */
+const opened: Map<string, Partial<CalendarEvent>> = new Map();
+
+/** Forgets every opened event (sign-out, or the test seam). */
+export function clearSealedEvents(): void {
+    opened.clear();
+}
+
+async function openFields(event: CalendarEvent): Promise<Partial<CalendarEvent> | undefined> {
+    const sealed: string = event.sealedContent!.sealed;
+    const known = opened.get(sealed);
+    if (known) {
+        return known;
+    }
+    const keys = getUnlockedKeys(event.mailboxUid)?.zeroAccessKeys;
+    if (!keys?.length) {
+        return undefined;
+    }
+    try {
+        const { decryptEnvelopedDataWithKeys } = await import("../../../lib/crypto/smime.js");
+        const fields = JSON.parse(new TextDecoder().decode(await decryptEnvelopedDataWithKeys(fromBase64(sealed), keys))) as SealedEventFields;
+        const text = (value: unknown): string | undefined => (typeof value === "string" ? value : undefined);
+        const result: Partial<CalendarEvent> = {
+            title: text(fields.title) ?? event.title,
+            location: text(fields.location),
+            description: text(fields.description) ?? null,
+            descriptionHtml: text(fields.descriptionHtml) ?? null,
+        };
+        opened.set(sealed, result);
+        return result;
+    } catch {
+        return undefined;
+    }
+}
+
+/** `events` with every sealed one this device can open shown with its real title, location and description. Never rejects. */
+export async function openSealedEvents(events: CalendarEvent[]): Promise<CalendarEvent[]> {
+    if (!events.some((event) => event.sealedContent)) {
+        return events;
+    }
+    return Promise.all(
+        events.map(async (event) => {
+            if (!event.sealedContent) {
+                return event;
+            }
+            const fields = await openFields(event);
+            return fields ? { ...event, ...fields } : event;
+        }),
+    );
+}
+
+/** `openSealedEvents()` for one event. */
+export async function openSealedEvent(event: CalendarEvent): Promise<CalendarEvent> {
+    return (await openSealedEvents([event]))[0];
+}
+
+onSigningOut(clearSealedEvents);

package/apps/shared/components/admin/settings/EncryptionPolicyForm.tsx

@@ -12,7 +12,9 @@ import { actionErrorMessage } from "../elevation.js";
 const SELECT_CLASS =
     "w-full text-sm py-2 px-3 border border-border rounded-sm bg-surface text-text focus:outline-none focus:border-primary";
 
-const TIERS: { key: keyof EncryptionPolicy; label: string; help: string }[] = [
+type TierKey = "encryptSameOrg" | "encryptFederated" | "encryptExternal";
+
+const TIERS: { key: TierKey; label: string; help: string }[] = [
     { key: "encryptSameOrg", label: "Mail within this server", help: "Messages between mailboxes hosted on this server." },
     {
         key: "encryptFederated",
@@ -52,11 +54,16 @@ export default function EncryptionPolicyForm({ policy, onChange, onDirtyChange,
 
     // Edits are unsaved until they match what was loaded or last saved.
     const [savedValues, setSavedValues] = useState<EncryptionPolicy>(policy);
-    const dirty: boolean = TIERS.some((tier) => values[tier.key] !== savedValues[tier.key]);
+    // A server without zero-access encryption sends no `allowZeroAccess`; the checkbox is then not shown at all.
+    const zeroAccessSupported: boolean = policy.allowZeroAccess !== undefined;
+    const dirty: boolean =
+        TIERS.some((tier) => values[tier.key] !== savedValues[tier.key]) || (zeroAccessSupported && values.allowZeroAccess !== savedValues.allowZeroAccess);
     useEffect(() => onDirtyChange?.(dirty), [dirty]);
 
     // Tiers this save would newly set to "Never encrypt", which switches encryption off for everyone's mail of that kind: confirmed first.
     const [confirmingProhibit, setConfirmingProhibit] = useState<string[] | null>(null);
+    // Turning zero-access encryption off makes new mail readable by this server again for every mailbox: confirmed first.
+    const [confirmingZeroAccessOff, setConfirmingZeroAccessOff] = useState(false);
 
     function handleSubmit(e: FormEvent) {
         e.preventDefault();
@@ -65,11 +72,21 @@ export default function EncryptionPolicyForm({ policy, onChange, onDirtyChange,
             setConfirmingProhibit(newlyProhibited.map((tier) => tier.label));
             return;
         }
+        confirmZeroAccessThenSave();
+    }
+
+    function confirmZeroAccessThenSave() {
+        setConfirmingProhibit(null);
+        if (zeroAccessSupported && values.allowZeroAccess === false && savedValues.allowZeroAccess !== false) {
+            setConfirmingZeroAccessOff(true);
+            return;
+        }
         void save();
     }
 
     async function save() {
         setConfirmingProhibit(null);
+        setConfirmingZeroAccessOff(false);
         setError(null);
         setSaved(false);
         setSaving(true);
@@ -122,6 +139,31 @@ export default function EncryptionPolicyForm({ policy, onChange, onDirtyChange,
                         <span className="text-xs text-text-muted">{tier.help}</span>
                     </label>
                 ))}
+                {zeroAccessSupported && (
+                    <div className="mt-2 pt-4 border-t border-border">
+                        <span className="font-semibold text-sm block mb-1">Zero-access encryption</span>
+                        <label className="flex items-start gap-2 text-sm">
+                            <input
+                                type="checkbox"
+                                className="mt-1"
+                                checked={values.allowZeroAccess !== false}
+                                onChange={(e) => {
+                                    setSaved(false);
+                                    setValues({ ...values, allowZeroAccess: e.target.checked });
+                                }}
+                            />
+                            <span>
+                                <span className="font-semibold block">Allow zero-access encryption</span>
+                                <span className="text-xs text-text-muted">
+                                    Mail that arrives unencrypted is encrypted the moment it is received, to a key only the mailbox&rsquo;s
+                                    owner can unlock, and this server keeps no readable copy - administrators can&rsquo;t read it either,
+                                    except through an escrow scope. People can still turn it off for their own mailbox. Search of message
+                                    contents then happens in the app instead of on the server.
+                                </span>
+                            </span>
+                        </label>
+                    </div>
+                )}
                 <div>
                     <Button type="submit" loading={saving} disabled={saving} className="!w-auto">
                         Save
@@ -138,11 +180,27 @@ export default function EncryptionPolicyForm({ policy, onChange, onDirtyChange,
                     <Button type="button" variant="secondary" className="!w-auto" onClick={() => setConfirmingProhibit(null)}>
                         Cancel
                     </Button>
-                    <Button type="button" className="!w-auto !bg-none !bg-danger !border-danger hover:!bg-danger" onClick={() => void save()}>
+                    <Button type="button" className="!w-auto !bg-none !bg-danger !border-danger hover:!bg-danger" onClick={confirmZeroAccessThenSave}>
                         Save and turn off encryption
                     </Button>
                 </div>
             </Modal>
+
+            <Modal open={confirmingZeroAccessOff} onClose={() => setConfirmingZeroAccessOff(false)} title="Turn off zero-access encryption?">
+                <p className="text-sm mb-3">
+                    Mail that arrives from now on will be stored in a form this server can read, for every mailbox. Mail that is already
+                    encrypted stays encrypted - this server can&rsquo;t decrypt it. Everyone sees in their settings that an administrator
+                    turned it off.
+                </p>
+                <div className="flex gap-3 justify-end">
+                    <Button type="button" variant="secondary" className="!w-auto" onClick={() => setConfirmingZeroAccessOff(false)}>
+                        Cancel
+                    </Button>
+                    <Button type="button" className="!w-auto !bg-none !bg-danger !border-danger hover:!bg-danger" onClick={() => void save()}>
+                        Save and turn off zero-access encryption
+                    </Button>
+                </div>
+            </Modal>
         </div>
     );
 }

package/apps/shared/components/contacts/contactCardData.ts

@@ -9,6 +9,7 @@
  */
 import { addDays } from "date-fns";
 import { CalendarEvent, listCalendarEvents } from "../../../../lib/calendar/calendarApi.js";
+import { openSealedEvents } from "../../calendar/sealedEvents.js";
 import { type CalendarOccurrence, expandAllOccurrences } from "../../../../lib/calendar/recurrence.js";
 import { type Contact, createContact, listContactsInFolders } from "../../../../lib/contacts/contactsApi.js";
 import { type ParsedVCardContact, parseVCards } from "../../../../lib/contacts/vcard.js";
@@ -90,7 +91,7 @@ export async function loadRecentMessages(mailboxes: readonly Mailbox[], address:
 export async function loadUpcomingEvents(folders: readonly Folder[], address: string, now: Date, client?: ApiClient): Promise<CalendarOccurrence[]> {
     const wanted = normalizeAddress(address);
     const calendars = folders.filter((folder) => folder.type === "calendar");
-    const lists = await Promise.all(calendars.map((folder) => listCalendarEvents(folder.uid, client)));
+    const lists = await Promise.all(calendars.map((folder) => listCalendarEvents(folder.uid, client).then(openSealedEvents)));
     const involved = lists
         .flat()
         .filter(

package/apps/shared/components/layout/KeyEnrollmentGate.tsx

@@ -20,9 +20,11 @@ import {
 import {
     ENCRYPTION_PRIVATE_KEY_AAD_PURPOSE,
     getUnlockedKeys,
+    subscribeKeySession,
     unlockWithPassword,
     type UnlockResult,
 } from "../../../../lib/crypto/keySession.js";
+import { ensureZeroAccessKey, provisionZeroAccessKey } from "../../../../lib/crypto/zeroAccessKey.js";
 import { buildAad, generateMasterKey, sealWithKey } from "../../../../lib/crypto/masterKey.js";
 import { buildPasswordWrap, buildRecoveryWraps } from "../../../../lib/crypto/masterKeyWraps.js";
 import { exportPrivateKeyPkcs8, generateKeyPairWithCsr } from "../../../../lib/crypto/keys.js";
@@ -46,13 +48,17 @@ async function provisionEncryptionKey(
     const privateKeyRaw = await exportPrivateKeyPkcs8(keyPair.privateKey);
     const wrappedKeySealed = await sealWithKey(mk, privateKeyRaw, buildAad(mailboxUid, ENCRYPTION_PRIVATE_KEY_AAD_PURPOSE));
 
-    await enrollKey(mailboxUid, {
+    const vault = await enrollKey(mailboxUid, {
         useType: "encrypt",
         csr: csrPem,
         wrappedKey: { ciphertext: wrappedKeySealed.ciphertext, nonce: wrappedKeySealed.nonce, algorithm: "AES-256-GCM" },
         masterKeyWraps: [passwordWrap, ...recoveryWraps],
     });
 
+    // The zero-access key (restapi specs/search.md §3), under the same master key. Not fatal: setup is done once the
+    // encryption key is in, and a mailbox without a zero-access key gets one on its next unlock (`ensureZeroAccessKey()`).
+    await provisionZeroAccessKey(mailboxUid, mailboxAddress, mk, vault.masterKeyGeneration).catch(() => undefined);
+
     return { recoveryCodes };
 }
 
@@ -154,6 +160,22 @@ export default function KeyEnrollmentGate({
         };
     }, [mailboxUid, canProvision]);
 
+    // A mailbox set up before zero-access encryption existed has no zero-access key: give it one whenever its owner has
+    // it unlocked - now, or on a later unlock from anywhere (this gate, an unlock prompt, recovery). Best effort: a
+    // failure is retried on the next unlock.
+    useEffect(() => {
+        if (!mailboxUid || !mailboxAddress || !canProvision) {
+            return;
+        }
+        const ensure = () => void ensureZeroAccessKey(mailboxUid, mailboxAddress).catch(() => undefined);
+        ensure();
+        return subscribeKeySession((event) => {
+            if (event.mailboxUid === mailboxUid && event.state === "unlocked") {
+                ensure();
+            }
+        });
+    }, [mailboxUid, mailboxAddress, canProvision]);
+
     async function handleUnlock(e: React.FormEvent) {
         e.preventDefault();
         setError(null);

package/apps/shared/components/layout/SharedMailboxKeyManager.tsx

@@ -0,0 +1,91 @@
+///////////////////////////////////////////////////////////////////////////////
+// Copyright (C) 2026 Jean-Philippe Steinmetz
+// SPDX-License-Identifier: MPL-2.0
+///////////////////////////////////////////////////////////////////////////////
+import { useEffect, useRef } from "react";
+import { getUnlockedKeys, personallyUnlockedKeys, subscribeKeySession } from "../../../../lib/crypto/keySession.js";
+import type { Mailbox } from "../../../../lib/mail/mailApi.js";
+import type { ApiClient } from "../../../../lib/util/api.js";
+import { useApiClient } from "../../../../lib/util/apiClientContext.js";
+
+/** How often the shared mailboxes are looked after again while some own mailbox stays unlocked. */
+export const SHARED_MAILBOX_CHECK_INTERVAL_MS = 5 * 60 * 1000;
+
+/** The shared mailbox key code (pkijs and friends), loaded only once an own mailbox is unlocked. */
+let loaded: Promise<typeof import("../../../../lib/crypto/sharedMailboxKeys.js")> | undefined;
+const loadSharedKeys = () =>
+    (loaded ??= import("../../../../lib/crypto/sharedMailboxKeys.js").catch((err) => {
+        loaded = undefined;
+        throw err;
+    }));
+
+export interface SharedMailboxKeyManagerProps {
+    /** Every mailbox the user can open. */
+    mailboxes: Mailbox[];
+    userUid?: string;
+}
+
+/**
+ * Looks after the zero-access keys of the user's shared mailboxes (`lib/crypto/sharedMailboxKeys.ts`) whenever a mailbox of their own is
+ * unlocked, and every `SHARED_MAILBOX_CHECK_INTERVAL_MS` after that: opens each mailbox shared with them through their member key wraps (no
+ * password), and - for a mailbox they own or manage - provisions, rotates and shares its key with members still waiting. Best effort and
+ * silent: a pass that fails is tried again on the next. Renders nothing; mounted by `MailShell`.
+ */
+export default function SharedMailboxKeyManager({ mailboxes, userUid }: SharedMailboxKeyManagerProps) {
+    const client = useApiClient();
+    const latest = useRef({ mailboxes, userUid, client });
+    latest.current = { mailboxes, userUid, client };
+    const running = useRef(false);
+
+    useEffect(() => {
+        async function pass(): Promise<void> {
+            if (running.current || personallyUnlockedKeys().length === 0) {
+                return;
+            }
+            running.current = true;
+            try {
+                const { maintainSharedMailbox, unlockSharedMailbox } = await loadSharedKeys();
+                const { mailboxes: current, userUid: me, client: apiClient } = latest.current;
+                for (const mailbox of current) {
+                    await look(mailbox, me, apiClient, unlockSharedMailbox, maintainSharedMailbox).catch(() => undefined);
+                }
+            } catch {
+                // Nothing to do until the next pass.
+            } finally {
+                running.current = false;
+            }
+        }
+        void pass();
+        const unsubscribe = subscribeKeySession((event) => {
+            if (event.state === "unlocked" && !getUnlockedKeys(event.mailboxUid)?.shared) {
+                void pass();
+            }
+        });
+        const interval = setInterval(() => void pass(), SHARED_MAILBOX_CHECK_INTERVAL_MS);
+        return () => {
+            unsubscribe();
+            clearInterval(interval);
+        };
+    }, []);
+
+    return null;
+}
+
+async function look(
+    mailbox: Mailbox,
+    me: string | undefined,
+    client: ApiClient | undefined,
+    unlockSharedMailbox: (uid: string, client?: ApiClient) => Promise<string>,
+    maintainSharedMailbox: (uid: string, address: string, client?: ApiClient) => Promise<unknown>,
+): Promise<void> {
+    const owned = !!mailbox.ownerUserUid && mailbox.ownerUserUid === me;
+    if (!owned && !getUnlockedKeys(mailbox.uid)) {
+        await unlockSharedMailbox(mailbox.uid, client);
+    }
+    const unlocked = getUnlockedKeys(mailbox.uid);
+    // An owner looks after their mailbox with its own keys; a member, with full access, whether or not it is open yet (a mailbox
+    // without an owner may have no key to open).
+    if (owned ? unlocked && !unlocked.shared : true) {
+        await maintainSharedMailbox(mailbox.uid, mailbox.primarySmtpAddress, client);
+    }
+}

package/apps/shared/components/layout/UnlockPromptProvider.tsx

@@ -15,6 +15,7 @@ import Modal from "../../../../lib/components/overlays/Modal.js";
 import Alert from "../../../../lib/components/feedback/Alert.js";
 import Button from "../../../../lib/components/buttons/Button.js";
 import FormField from "../../../../lib/components/forms/FormField.js";
+import { notify } from "../../notifications/store.js";
 import {
     RECOVERY_CODE_ERROR,
     RecoveryFollowUp,
@@ -98,6 +99,34 @@ const UnlockPromptContext = createContext<UnlockPromptContextValue | null>(null)
  * mailbox happens to resolve - see `KeyEnrollmentGate`'s `blocking` prop, which `MailShell` now sets to
  * `false` for exactly this reason.
  */
+/** Messages for a shared mailbox `openShared()` can't open. */
+export const SHARED_ACCESS_PENDING_MESSAGE = "This mailbox is shared with you, and is waiting for another member to share its key with you. Try again shortly.";
+export const SHARED_OWN_KEYS_LOCKED_MESSAGE = "Unlock your own mailbox first: it holds the key that opens the mailboxes shared with you.";
+
+/**
+ * Opens `mailboxUid` through the user's member key wraps when it is a mailbox shared with them (`sharedMailboxKeys.ts`): its keys, or
+ * `undefined` when it isn't one of theirs (the password prompt applies). Rejects, after saying why, when it is shared with them but can't
+ * open yet. The shared key code is loaded only here.
+ */
+async function openShared(mailboxUid: string): Promise<UnlockedKeys | undefined> {
+    let outcome: string;
+    try {
+        const { unlockSharedMailbox } = await import("../../../../lib/crypto/sharedMailboxKeys.js");
+        outcome = await unlockSharedMailbox(mailboxUid);
+    } catch {
+        return undefined;
+    }
+    if (outcome === "unlocked") {
+        return getUnlockedKeys(mailboxUid);
+    }
+    if (outcome === "pending" || outcome === "own_keys_locked") {
+        const message = outcome === "pending" ? SHARED_ACCESS_PENDING_MESSAGE : SHARED_OWN_KEYS_LOCKED_MESSAGE;
+        notify({ kind: "info", title: "Shared mailbox", message });
+        throw new Error(message);
+    }
+    return undefined;
+}
+
 export function UnlockPromptProvider({ children }: { children: React.ReactNode }) {
     const [pending, setPendingState] = useState<PendingUnlock | null>(null);
     // Mirrors `pending` synchronously, so two requests issued in the same tick see each other.
@@ -122,6 +151,11 @@ export function UnlockPromptProvider({ children }: { children: React.ReactNode }
         if (existing) {
             return Promise.resolve(existing);
         }
+        // A mailbox shared with the user opens through their member key wraps, not a password - and its password, if it has one, isn't theirs.
+        return openShared(mailboxUid).then((shared) => shared ?? promptForPassword(mailboxUid, mailboxKeys));
+    }, []);
+
+    const promptForPassword = useCallback((mailboxUid: string, mailboxKeys: PublicKey[]): Promise<UnlockedKeys> => {
         return new Promise<UnlockedKeys>((resolve, reject) => {
             const current = pendingRef.current;
             if (current?.mailboxUid === mailboxUid) {

package/apps/shared/components/mail/ConversationList.tsx

@@ -125,7 +125,7 @@ export default function ConversationList({
         let stale = false;
         void mapWithConcurrency(conversations.filter(conversationLooksEncrypted), 4, async (conversation) => {
             if (!stale) {
-                await decryptForDisplay(conversation.latestMessageUid, conversation.mailboxUid ?? mailboxUid);
+                await decryptForDisplay(conversation.latestMessageUid, conversation.mailboxUid ?? mailboxUid, conversation.latestZeroAccess?.sealedSummary);
             }
         });
         return () => {

package/apps/shared/components/mail/MessageDetailPane.tsx

@@ -48,6 +48,7 @@ import MoveToFolderDialog from "./MoveToFolderDialog.js";
 import InviteCard from "./InviteCard.js";
 import { isCalendarAttachment } from "./invite/inviteFormat.js";
 import { useMessageInvite } from "./invite/inviteStore.js";
+import { rememberSealedInvite } from "../../../../lib/calendar/sealedInvites.js";
 import { getUnlockedKeys, subscribeKeySession } from "../../../../lib/crypto/keySession.js";
 import type { MessageSecurityResult, SignatureFailureReason } from "../../../../lib/crypto/messageSecurity.js";
 import { extractAddresses, type MimeAttachment } from "../../../../lib/crypto/mime.js";
@@ -116,6 +117,9 @@ const SECURITY_INDICATOR: Record<MessageSecurityResult["state"], { label: string
     // Verified when first opened (a verification seal), but not live: muted, never the green verified pill. A signer key
     // later reported compromised switches it to `LATER_COMPROMISED_INDICATOR_CLASS`.
     verified_at_first_open: { label: "Verified when first opened", className: "bg-surface-alt text-text-muted" },
+    // Sealed by the server on arrival (zero-access): distinct from "Encrypted" - the server held this message in the clear while it
+    // delivered it - and never worded as end-to-end, per the spec's indicator table.
+    protected_at_rest: { label: "Protected at rest", className: "bg-primary/5 text-text" },
 };
 
 /** The amber `verified_at_first_open` badge for a signer key since reported compromised. */
@@ -289,11 +293,14 @@ function IconAction({
     );
 }
 
-function SecurityIndicator({ security }: { security: MessageSecurityResult }) {
-    const { label, className } = SECURITY_INDICATOR[security.state];
+function SecurityIndicator({ security, zeroAccess }: { security: MessageSecurityResult; zeroAccess?: boolean }) {
+    // A zero-access message this device can't open yet (keys locked) evaluates as an encrypted one it has no key for: it is still
+    // labelled for what it is.
+    const state = zeroAccess && security.state === "encrypted" && security.decryptError !== undefined ? "protected_at_rest" : security.state;
+    const { label, className } = SECURITY_INDICATOR[state];
     if (security.state !== "verified_at_first_open") {
         // Every encrypted state carries a small lock, so the badge reads at a glance; the words are unchanged.
-        const encrypted = security.state.startsWith("encrypted");
+        const encrypted = state.startsWith("encrypted") || state === "protected_at_rest";
         return (
             <span className={`inline-flex items-center gap-1 text-xs font-medium shrink-0 py-1 px-2.5 rounded-pill ${className}`}>
                 {encrypted && <HiOutlineLockClosed size={12} aria-hidden="true" />}
@@ -473,7 +480,7 @@ export default function MessageDetailPane(props: MessageDetailPaneProps) {
  * surfaced as an attachment - so a message with neither flag can't carry a signature to verify, and
  * fetching its full raw source (attachments included) would be pure waste. */
 function needsRawSecurityEvaluation(message: Message): boolean {
-    return !!message.encrypted || message.hasAttachments;
+    return !!message.encrypted || !!message.zeroAccess || message.hasAttachments;
 }
 
 function MessageDetailContent({
@@ -686,14 +693,14 @@ function MessageDetailContent({
             .catch(() => {
                 if (!cancelled) {
                     setSecurity(
-                        message.encrypted ? { state: "encrypted", decryptError: ENCRYPTED_LOAD_ERROR } : { state: "unprotected" },
+                        message.encrypted || message.zeroAccess ? { state: "encrypted", decryptError: ENCRYPTED_LOAD_ERROR } : { state: "unprotected" },
                     );
                 }
             });
         return () => {
             cancelled = true;
         };
-    }, [message.uid, message.mailboxUid, message.from.address, message.encrypted, rawEvaluationNeeded, unlockRefresh, readerAddressesKey, client]);
+    }, [message.uid, message.mailboxUid, message.from.address, message.encrypted, message.zeroAccess?.keyFingerprint, rawEvaluationNeeded, unlockRefresh, readerAddressesKey, client]);
 
     // Whether the body is the locked state right now (an encrypted message this device holds no unlocked keys for), for the subscription below.
     const lockedRef = useRef(false);
@@ -1078,7 +1085,11 @@ function MessageDetailContent({
     // listed with a warning. A signed-only failure never carries recovered attachments.
     const innerAttachments =
         security?.attachments !== undefined &&
-        (verifiedOrSealed || security.state === "encrypted" || security.state === "encrypted_unverified_signer" || security.state === "signature_failed")
+        (verifiedOrSealed ||
+            security.zeroAccess ||
+            security.state === "encrypted" ||
+            security.state === "encrypted_unverified_signer" ||
+            security.state === "signature_failed")
             ? security.attachments
             : undefined;
     // Any state with a valid signature shows the address actually signed for (the protected From when the message
@@ -1132,7 +1143,18 @@ function MessageDetailContent({
     // Only a message the server can read and that carries a calendar file is worth asking about an invitation. An encrypted message is out: the
     // server holds only its ciphertext (the calendar file is inside it), so there is nothing for it to find. Drafts and Outbox hold messages
     // that are being written or sent, not received invitations.
-    const mayHoldInvite = !message.encrypted && !inOutbox && message.folderUid !== draftsFolderUid && attachments.some(isCalendarAttachment);
+    // A zero-access message's calendar file is inside the sealed copy: the server reads the invitation from the one decrypted here.
+    const sealedCalendar: string | undefined = security?.zeroAccess ? security.calendar : undefined;
+    // Registered while rendering, not in an effect: the invitation lookup below must find it the moment it is enabled. Writing the same
+    // file for the same message again is a no-op.
+    if (sealedCalendar !== undefined) {
+        rememberSealedInvite(message.uid, sealedCalendar);
+    }
+    const mayHoldInvite =
+        !message.encrypted &&
+        !inOutbox &&
+        message.folderUid !== draftsFolderUid &&
+        (attachments.some(isCalendarAttachment) || sealedCalendar !== undefined);
     // The calendar file of a message whose invitation card is drawn is the card, not a chip in the attachment list (a nameless "attachment" to click):
     // it is listed again if the card could not be drawn (no invitation the server can read, or the lookup failed), so the file is never out of reach.
     const { invite: shownInvite } = useMessageInvite(message.uid, mayHoldInvite);
@@ -1247,7 +1269,7 @@ function MessageDetailContent({
     /** The rules page's "New mail filter", started from this message: its sender and (for a message the server can read) its subject. */
     function handleCreateRule() {
         const params = new URLSearchParams({ mailboxUid: message.mailboxUid, from: message.from.address });
-        const subject = message.encrypted ? "" : withoutSubjectPrefixes(message.subject);
+        const subject = message.encrypted || message.zeroAccess ? "" : withoutSubjectPrefixes(message.subject);
         if (subject) {
             params.set("subject", subject);
         }
@@ -1273,7 +1295,7 @@ function MessageDetailContent({
         createRule: handleCreateRule,
     };
     // An encrypted message can be printed once it has been opened here: while it is still opening, or when it can't be, there is nothing to print.
-    const printReason = !message.encrypted
+    const printReason = !message.encrypted && !message.zeroAccess
         ? undefined
         : security === null
           ? "Still opening this message"
@@ -1325,7 +1347,7 @@ function MessageDetailContent({
                                 </ParticipantLink>
                             </p>
                         )}
-                        {security && <SecurityIndicator security={security} />}
+                        {security && <SecurityIndicator security={security} zeroAccess={!!message.zeroAccess} />}
                     </div>
                     {senderNameCheck.misleading && (
                         <p role="status" className="mt-2 py-2 px-3 rounded-sm text-sm bg-warning/15 text-text">
@@ -1711,7 +1733,7 @@ function MessageDetailContent({
                     body never came through the server's own sanitizer (the server never saw the plaintext); `MessageBody` sanitizes every body
                     client-side regardless, behind a no-remote-loads CSP, in a frame that runs no script. */}
                 <div ref={bodyRegionRef} tabIndex={-1} className="outline-none">
-                    {message.encrypted && security === null ? (
+                    {(message.encrypted || message.zeroAccess) && security === null ? (
                         <BodySkeleton />
                     ) : security?.decryptError !== undefined ? (
                         // An encrypted message that could not be read: locked (no unlocked keys - the button asks the app's own unlock prompt, and the message
@@ -1804,7 +1826,7 @@ function MessageDetailContent({
                 onClose={closeSource}
                 mode={sourceView?.mode ?? "source"}
                 source={sourceView?.source ?? { status: "loading" }}
-                encrypted={!!message.encrypted}
+                encrypted={!!message.encrypted || !!message.zeroAccess}
             />
             <Modal open={confirming} onClose={() => setConfirming(false)} title="Recall this message?">
                 <p className="text-sm text-text-muted mb-4">

package/apps/shared/components/mail/compose/draftResume.ts

@@ -2,7 +2,9 @@
 // Copyright (C) 2026 Jean-Philippe Steinmetz
 // SPDX-License-Identifier: MPL-2.0
 ///////////////////////////////////////////////////////////////////////////////
-import { type Message, type Recipient, type RecipientType, listAttachments } from "../../../../../lib/mail/mailApi.js";
+import { getUnlockedKeys } from "../../../../../lib/crypto/keySession.js";
+import { evaluateMessageSecurity, type MessageSecurityResult } from "../../../../../lib/crypto/messageSecurity.js";
+import { getMessageRawContent, type Message, type Recipient, type RecipientType, listAttachments } from "../../../../../lib/mail/mailApi.js";
 import { formatMailAddress } from "../../../../../lib/mail/mailAddress.js";
 import type { ApiClient } from "../../../../../lib/util/api.js";
 import type { ResumeCompose } from "../../../mail/outbox/composeBridge.js";
@@ -29,13 +31,22 @@ function textToHtml(text: string): string {
  * What the compose window needs to continue `draft` - a message in the Drafts folder the reader opened rather than one a window of this tab
  * saved - read back from the server: its recipients and subject from the record, its body from the server's copy (with its embedded pictures)
  * and its attachments. `undefined` for a draft that cannot be edited here: an encrypted one holds only its ciphertext, which is never opened.
+ * A draft saved in a zero-access mailbox is stored sealed to the mailbox's zero-access key: it is decrypted here with the unlocked keys (its
+ * subject comes from the decrypted message too, the record holding only `[...]`), and is `undefined` - left to read - while they're locked.
  * Never rejects for a body that could not be loaded - the draft then opens with the preview, as a reply's quote does.
  */
 export async function resumeFromDraft(draft: Message, client?: ApiClient): Promise<ResumeCompose | undefined> {
     if (draft.encrypted) {
         return undefined;
     }
-    const [original, attachments] = await Promise.all([loadOriginalMessage(draft, null), listAttachments(draft.folderUid, draft.uid, client)]);
+    let security: MessageSecurityResult | null = null;
+    if (draft.zeroAccess) {
+        security = await openSealedDraft(draft, client);
+        if (!security) {
+            return undefined;
+        }
+    }
+    const [original, attachments] = await Promise.all([loadOriginalMessage(draft, security), listAttachments(draft.folderUid, draft.uid, client)]);
     const html =
         original.body.html !== undefined ? original.body.html : original.body.text !== undefined ? textToHtml(original.body.text) : textToHtml(draft.bodyPreview ?? "");
     return {
@@ -44,7 +55,7 @@ export async function resumeFromDraft(draft: Message, client?: ApiClient): Promi
         to: recipientText(draft.recipients, "to"),
         cc: recipientText(draft.recipients, "cc"),
         bcc: recipientText(draft.recipients, "bcc"),
-        subject: draft.subject,
+        subject: security?.subject ?? draft.subject,
         html,
         attachments,
         requestReceipt: !!draft.requestReceipt,
@@ -52,3 +63,17 @@ export async function resumeFromDraft(draft: Message, client?: ApiClient): Promi
         encryptRequested: false,
     };
 }
+
+/** `draft`'s sealed message decrypted with its mailbox's unlocked keys, or `null` when they're locked or it won't open with them. */
+async function openSealedDraft(draft: Message, client?: ApiClient): Promise<MessageSecurityResult | null> {
+    const unlocked = getUnlockedKeys(draft.mailboxUid);
+    if (!unlocked) {
+        return null;
+    }
+    try {
+        const security = await evaluateMessageSecurity(await getMessageRawContent(draft.uid, client), unlocked);
+        return security.zeroAccess ? security : null;
+    } catch {
+        return null;
+    }
+}