@rapidmx/web-client 0.35.0 → 0.36.0

package/apps/shared/components/mail/compose/quotedBody.ts

@@ -94,10 +94,10 @@ function withTimeout<T>(promise: Promise<T>, ms: number): Promise<T> {
 /**
  * Starts fetching what a Reply/Forward of `message` will quote, without waiting for the click - called when the pointer or
  * keyboard reaches a Reply/Reply All/Forward button - so the request is usually already answered when it is clicked.
- * Nothing to fetch for an encrypted message (`loadOriginalMessage()` never asks the server for one's body).
+ * Nothing to fetch for an encrypted or zero-access message (`loadOriginalMessage()` never asks the server for one's body).
  */
 export function prefetchOriginalMessage(message: Message, client?: ApiClient): void {
-    if (!message.encrypted) {
+    if (!message.encrypted && !message.zeroAccess) {
         void fetchContentHtml(message.uid, client);
     }
 }
@@ -201,7 +201,8 @@ export async function loadOriginalMessage(
         ? [...headerRecipients(protectedHeaders.to, "to"), ...headerRecipients(protectedHeaders.cc, "cc")]
         : [];
     const result: OriginalMessage = { body: recovered ?? {}, ...(protectedRecipients.length > 0 ? { recipients: protectedRecipients } : {}) };
-    if (message.encrypted) {
+    // The server holds only ciphertext of an encrypted or zero-access message: its body is what `security` decrypted, or nothing.
+    if (message.encrypted || message.zeroAccess) {
         return result;
     }
     let needsRaw = !!options.recipients && result.recipients === undefined;

package/apps/shared/components/mail/invite/inviteStore.ts

@@ -4,6 +4,8 @@
 ///////////////////////////////////////////////////////////////////////////////
 import { useCallback, useEffect, useReducer } from "react";
 import { MessageInvite, getMessageInvite } from "../../../../../lib/calendar/inviteApi.js";
+import { clearSealedInvites, sealedInviteCalendar } from "../../../../../lib/calendar/sealedInvites.js";
+import { onSigningOut } from "../compose/composeFlushRegistry.js";
 import { ApiClient } from "../../../../../lib/util/api.js";
 import { useApiClient } from "../../../../../lib/util/apiClientContext.js";
 
@@ -51,7 +53,9 @@ function normalize(invite: MessageInvite | null): MessageInvite | null {
  */
 export function loadInvite(uid: string, client?: ApiClient): Promise<MessageInvite | null> {
     const existing = entries.get(uid);
-    if (existing && (existing.value === undefined || Date.now() - existing.at < INVITE_TTL_MS)) {
+    // "No invitation" for a zero-access message is asked again once its calendar file has been decrypted here (the list asks before that).
+    const stale = existing?.value === null && sealedInviteCalendar(uid) !== undefined;
+    if (existing && !stale && (existing.value === undefined || Date.now() - existing.at < INVITE_TTL_MS)) {
         return existing.promise;
     }
     const entry: Entry = {
@@ -120,3 +124,5 @@ export function useMessageInvite(uid: string, enabled = true): { invite: Message
     const value = enabled ? entries.get(uid)?.value : undefined;
     return { invite: value ?? null, settled: value !== undefined, setInvite };
 }
+
+onSigningOut(clearSealedInvites);

package/apps/shared/components/mail/layout/MailShell.tsx

@@ -15,6 +15,7 @@ import KeyEnrollmentGate from "../../layout/KeyEnrollmentGate.js";
 import MailboxProvisioning from "../../layout/MailboxProvisioning.js";
 import { prefetchComposeWindow, useCompose } from "../compose/ComposeContext.js";
 import LocalIndexLifecycle from "../../../search/LocalIndexLifecycle.js";
+import SharedMailboxKeyManager from "../../layout/SharedMailboxKeyManager.js";
 import { LiveUpdates, NO_LIVE_UPDATES } from "../../../mail/useMailLiveUpdates.js";
 import { MAILBOX_LIST_LIMIT, MailConnectionContext, useMailConnection } from "../../../mail/useMailConnection.js";
 import { folderRows } from "../../../mail/folderTree.js";
@@ -538,6 +539,7 @@ export default function MailShell({
             // the impersonated user's own mailbox: an administrator must never choose its password/recovery codes.
             canProvision={!impersonating && activeMailbox?.ownerUserUid === userUid}
         >
+            <SharedMailboxKeyManager mailboxes={mailboxes} userUid={userUid} />
             <LocalIndexLifecycle
                 mailboxUid={activeMailboxUid}
                 mailboxKeys={activeMailbox?.keys}

package/apps/shared/components/mail/reading/useMessageActions.ts

@@ -28,6 +28,7 @@ import { resolveFolderOfType } from "../../../mail/folderOfType.js";
 import { setReadStateMany } from "../../../mail/messageReadState.js";
 import { usePermanentDelete } from "../../../mail/usePermanentDelete.js";
 import { reportFolderName, reportNotice, reportNoun, reportTitle, senderListsHref } from "../../../mail/reportNotices.js";
+import { zeroAccessSourceBase64 } from "../../../mail/zeroAccessSource.js";
 import { blockSender, neverBlockSender, normalizeAddresses, removeSenderRule } from "../../../mail/senderBlocking.js";
 import { notifyApiError } from "../../../notifications/apiErrors.js";
 import { notify } from "../../../notifications/store.js";
@@ -190,7 +191,9 @@ export function useMessageActions(params: MessageActionsParams): MessageActions
         await exclusive(async () => {
             let result: MessageReportResult;
             try {
-                result = await reportMessage(message.uid, kind, { alwaysTrustSender }, client);
+                // The server holds only the sealed copy of a zero-access message: its spam filter learns from the source decrypted here.
+                const rawMessage: string | undefined = await zeroAccessSourceBase64(message, client);
+                result = await reportMessage(message.uid, kind, { alwaysTrustSender, ...(rawMessage ? { rawMessage } : {}) }, client);
             } catch (err) {
                 if (isNotFound(err)) {
                     await reportByMoving(kind, alwaysTrustSender);

package/apps/shared/components/settings/KeyExportSetting.tsx

@@ -0,0 +1,170 @@
+///////////////////////////////////////////////////////////////////////////////
+// Copyright (C) 2026 Jean-Philippe Steinmetz
+// SPDX-License-Identifier: MPL-2.0
+///////////////////////////////////////////////////////////////////////////////
+import React, { useState } from "react";
+import { exportKeysAsPkcs12, MIN_EXPORT_PASSPHRASE_LENGTH, NothingToExportError } from "../../../../lib/crypto/keyExport.js";
+import type { Mailbox } from "../../../../lib/mail/mailApi.js";
+import { ApiRequestError } from "../../../../lib/util/api.js";
+import { useApiClient } from "../../../../lib/util/apiClientContext.js";
+import Alert from "../../../../lib/components/feedback/Alert.js";
+import Button from "../../../../lib/components/buttons/Button.js";
+import { notifyApiError } from "../../notifications/apiErrors.js";
+import PolicyLockedNotice from "./PolicyLockedNotice.js";
+
+export interface KeyExportSettingProps {
+    mailbox: Mailbox;
+    /** The caller owns the mailbox and isn't impersonating: restapi records an export only for the owner. */
+    canManage: boolean;
+}
+
+const INPUT_CLASS = "w-full text-sm border border-border rounded-sm py-1.5 px-2 bg-surface";
+
+/** Hands `bytes` to the browser as a file download. */
+function saveFile(bytes: Uint8Array, filename: string): void {
+    const url = URL.createObjectURL(new Blob([bytes as BlobPart], { type: "application/x-pkcs12" }));
+    const link = document.createElement("a");
+    link.href = url;
+    link.download = filename;
+    document.body.appendChild(link);
+    link.click();
+    link.remove();
+    URL.revokeObjectURL(url);
+}
+
+/**
+ * "Export keys for Outlook/phone" (`lib/crypto/keyExport.ts`): a passphrase-protected `.p12` with the mailbox's zero-access
+ * and end-to-end encryption keys - and its signing key, if the user ticks the box - so a mail app that isn't RapidMX can read
+ * mail stored encrypted. Asks for the master password again however long the mailbox has been unlocked.
+ */
+export default function KeyExportSetting({ mailbox, canManage }: KeyExportSettingProps) {
+    const client = useApiClient();
+    const [open, setOpen] = useState(false);
+    const [password, setPassword] = useState("");
+    const [passphrase, setPassphrase] = useState("");
+    const [confirmPassphrase, setConfirmPassphrase] = useState("");
+    const [includeSigningKey, setIncludeSigningKey] = useState(false);
+    const [exporting, setExporting] = useState(false);
+    const [error, setError] = useState<string | null>(null);
+
+    function reset() {
+        setOpen(false);
+        setPassword("");
+        setPassphrase("");
+        setConfirmPassphrase("");
+        setIncludeSigningKey(false);
+        setError(null);
+    }
+
+    async function handleExport(e: React.FormEvent) {
+        e.preventDefault();
+        if (passphrase.length < MIN_EXPORT_PASSPHRASE_LENGTH) {
+            setError(`The file's passphrase must be at least ${MIN_EXPORT_PASSPHRASE_LENGTH} characters.`);
+            return;
+        }
+        if (passphrase !== confirmPassphrase) {
+            setError("The passphrases don't match.");
+            return;
+        }
+        setExporting(true);
+        setError(null);
+        try {
+            const result = await exportKeysAsPkcs12(
+                {
+                    mailboxUid: mailbox.uid,
+                    mailboxAddress: mailbox.primarySmtpAddress,
+                    mailboxKeys: mailbox.keys ?? [],
+                    masterPassword: password,
+                    exportPassphrase: passphrase,
+                    includeSigningKey,
+                },
+                client,
+            );
+            saveFile(result.pkcs12, `${mailbox.primarySmtpAddress}-keys.p12`);
+            reset();
+        } catch (err) {
+            if (err instanceof ApiRequestError) {
+                notifyApiError(err, "Couldn't export your keys");
+            } else if (err instanceof NothingToExportError || (err instanceof Error && err.message.startsWith("This mailbox has no password"))) {
+                setError(err.message);
+            } else {
+                setError("Incorrect password.");
+            }
+        } finally {
+            setExporting(false);
+        }
+    }
+
+    return (
+        <div>
+            <h2 className="text-sm font-semibold mb-2">Export keys for Outlook or a phone</h2>
+            <p className="text-sm text-text-muted mb-2">
+                Mail apps other than RapidMX need your keys to read encrypted mail. The exported file holds your zero-access and
+                end-to-end encryption keys, protected by a passphrase you choose. Anyone with the file and its passphrase can read
+                all of this mailbox&rsquo;s mail, so keep it safe and delete it once it&rsquo;s installed.
+            </p>
+            {!canManage ? (
+                <PolicyLockedNotice>Only this mailbox&rsquo;s owner, signed in as themselves, can export its keys.</PolicyLockedNotice>
+            ) : !open ? (
+                <Button type="button" variant="secondary" className="!w-auto" onClick={() => setOpen(true)}>
+                    Export keys&hellip;
+                </Button>
+            ) : (
+                <form onSubmit={(e) => void handleExport(e)} className="flex flex-col gap-2">
+                    <input
+                        type="password"
+                        aria-label="Encryption password"
+                        placeholder="Encryption password"
+                        className={INPUT_CLASS}
+                        value={password}
+                        onChange={(e) => setPassword(e.target.value)}
+                        disabled={exporting}
+                        autoComplete="current-password"
+                    />
+                    <input
+                        type="password"
+                        aria-label="File passphrase"
+                        placeholder={`File passphrase (at least ${MIN_EXPORT_PASSPHRASE_LENGTH} characters)`}
+                        className={INPUT_CLASS}
+                        value={passphrase}
+                        onChange={(e) => setPassphrase(e.target.value)}
+                        disabled={exporting}
+                        autoComplete="new-password"
+                    />
+                    <input
+                        type="password"
+                        aria-label="Confirm file passphrase"
+                        placeholder="Confirm file passphrase"
+                        className={INPUT_CLASS}
+                        value={confirmPassphrase}
+                        onChange={(e) => setConfirmPassphrase(e.target.value)}
+                        disabled={exporting}
+                        autoComplete="new-password"
+                    />
+                    <label className="flex items-start gap-2 text-sm">
+                        <input
+                            type="checkbox"
+                            className="mt-1"
+                            checked={includeSigningKey}
+                            onChange={(e) => setIncludeSigningKey(e.target.checked)}
+                            disabled={exporting}
+                        />
+                        <span>
+                            <span className="font-semibold block">Include my signing key</span>
+                            <span className="text-xs text-text-muted">Only if that app will sign mail you send. Anyone with the file could sign as you.</span>
+                        </span>
+                    </label>
+                    {error && <Alert>{error}</Alert>}
+                    <div className="flex gap-2">
+                        <Button type="submit" className="!w-auto" disabled={exporting || !password || !passphrase}>
+                            {exporting ? "Exporting…" : "Export"}
+                        </Button>
+                        <Button type="button" variant="secondary" className="!w-auto" onClick={reset} disabled={exporting}>
+                            Cancel
+                        </Button>
+                    </div>
+                </form>
+            )}
+        </div>
+    );
+}

package/apps/shared/components/settings/PolicyLockedNotice.tsx

@@ -0,0 +1,23 @@
+///////////////////////////////////////////////////////////////////////////////
+// Copyright (C) 2026 Jean-Philippe Steinmetz
+// SPDX-License-Identifier: MPL-2.0
+///////////////////////////////////////////////////////////////////////////////
+import React from "react";
+
+export interface PolicyLockedNoticeProps {
+    /** Why the setting next to this notice can't be changed - e.g. that an administrator turned it off for the server. */
+    children: React.ReactNode;
+}
+
+/**
+ * Explains why a settings control is disabled by a policy the user can't change themselves (an administrator's server-wide
+ * setting, say), shown right under that control. A disabled control with no reason reads as a defect; this says who decided
+ * and that the user isn't the one who can undo it.
+ */
+export default function PolicyLockedNotice({ children }: PolicyLockedNoticeProps) {
+    return (
+        <p role="note" className="mt-1.5 text-xs text-text-muted border-l-2 border-border pl-2">
+            {children}
+        </p>
+    );
+}

package/apps/shared/components/settings/ZeroAccessSetting.tsx

@@ -0,0 +1,117 @@
+///////////////////////////////////////////////////////////////////////////////
+// Copyright (C) 2026 Jean-Philippe Steinmetz
+// SPDX-License-Identifier: MPL-2.0
+///////////////////////////////////////////////////////////////////////////////
+import React, { useEffect, useState } from "react";
+import { getEncryptionPolicy } from "../../../../lib/crypto/keyvaultApi.js";
+import { getMailbox, type Mailbox, updateMailbox } from "../../../../lib/mail/mailApi.js";
+import { ApiRequestError } from "../../../../lib/util/api.js";
+import { useApiClient } from "../../../../lib/util/apiClientContext.js";
+import { notifyApiError } from "../../notifications/apiErrors.js";
+import PolicyLockedNotice from "./PolicyLockedNotice.js";
+
+/** Why zero-access encryption can't be changed here, when it can't - mirrors restapi's `ZeroAccessStatus` reasons that the user can't fix
+ * by ticking the box. */
+type Blocker = "disabled_by_admin" | "unsupported";
+
+export interface ZeroAccessSettingProps {
+    mailbox: Mailbox;
+    /** The caller owns the mailbox and isn't impersonating: only then can the setting be changed (restapi drops anybody else's value). */
+    canManage: boolean;
+}
+
+/**
+ * "Enable zero-access encryption" for one mailbox (restapi `specs/search.md` §3): unencrypted mail is encrypted to the
+ * mailbox's zero-access key as it arrives and the server keeps no readable copy. On by default. Shown disabled, with the
+ * reason, when the administrator has turned "Allow zero-access encryption" off for the server, or when the server doesn't
+ * support it. A shared mailbox is covered too: its members read it through member key wraps (`sharedMailboxKeys.ts`).
+ */
+export default function ZeroAccessSetting({ mailbox, canManage }: ZeroAccessSettingProps) {
+    const client = useApiClient();
+    const [enabled, setEnabled] = useState(mailbox.zeroAccessEnabled !== false);
+    const [blocker, setBlocker] = useState<Blocker | null | undefined>(undefined);
+    const [saving, setSaving] = useState(false);
+
+    useEffect(() => {
+        let cancelled = false;
+        void (async () => {
+            const policy = await getEncryptionPolicy(client).catch(() => undefined);
+            let next: Blocker | null = null;
+            if (policy?.allowZeroAccess === undefined) {
+                next = "unsupported";
+            } else if (!policy.allowZeroAccess) {
+                next = "disabled_by_admin";
+            }
+            if (!cancelled) {
+                setBlocker(next);
+            }
+        })();
+        return () => {
+            cancelled = true;
+        };
+    }, [mailbox.uid, client]);
+
+    async function save(next: boolean) {
+        setSaving(true);
+        const previous = enabled;
+        setEnabled(next);
+        try {
+            const write = (version: number) => updateMailbox({ uid: mailbox.uid, version, zeroAccessEnabled: next }, client);
+            try {
+                await write(mailbox.version);
+            } catch (err) {
+                // Enrolling a key (which happens on unlock) moves the mailbox's version on, so the copy this page was given may be
+                // behind: read it again and retry once.
+                if (!(err instanceof ApiRequestError && err.status === 409)) {
+                    throw err;
+                }
+                await write((await getMailbox(mailbox.uid, {}, client)).version);
+            }
+        } catch (err) {
+            setEnabled(previous);
+            notifyApiError(err, "Couldn't save the zero-access encryption setting");
+        } finally {
+            setSaving(false);
+        }
+    }
+
+    const locked = blocker !== null;
+    return (
+        <div>
+            <h2 className="text-sm font-semibold mb-2">Zero-access encryption</h2>
+            <label className="flex items-start gap-2 text-sm">
+                <input
+                    type="checkbox"
+                    className="mt-1"
+                    checked={!locked && enabled}
+                    disabled={!canManage || locked || saving}
+                    onChange={(e) => void save(e.target.checked)}
+                />
+                <span>
+                    <span className="font-semibold block">Enable zero-access encryption</span>
+                    <span className="text-xs text-text-muted">
+                        Mail that arrives unencrypted is encrypted the moment it is received, and the server keeps no copy it can read -
+                        nobody else, administrators included, can read it. You unlock it with your encryption password, and search
+                        of message contents happens on your device. Outlook and phone mail apps need your exported keys to read it.
+                        Turning this off only affects mail that arrives afterwards.
+                    </span>
+                </span>
+            </label>
+            {blocker === "disabled_by_admin" && (
+                <PolicyLockedNotice>
+                    Your administrator has turned off zero-access encryption for this server, so new mail is stored without it. Mail
+                    already encrypted stays encrypted.
+                </PolicyLockedNotice>
+            )}
+            {blocker === "unsupported" && <PolicyLockedNotice>This server doesn&rsquo;t offer zero-access encryption.</PolicyLockedNotice>}
+            {!mailbox.ownerUserUid && !locked && (
+                <PolicyLockedNotice>
+                    This shared mailbox has no owner: it is protected for its members, whose apps share its key with each other.
+                </PolicyLockedNotice>
+            )}
+            {!canManage && !locked && mailbox.ownerUserUid && (
+                <PolicyLockedNotice>Only this mailbox&rsquo;s owner, signed in as themselves, can change this.</PolicyLockedNotice>
+            )}
+        </div>
+    );
+}

package/apps/shared/mail/decryptedMessages.ts

@@ -139,16 +139,24 @@ export function useUnlockEpoch(): number {
  * Decrypts one message to recover its subject and preview, when its mailbox's keys are unlocked and it isn't already known. Best effort: a
  * message that can't be fetched or opened is simply left as it was. Never prompts.
  */
-export async function decryptForDisplay(uid: string, mailboxUid: string): Promise<void> {
+export async function decryptForDisplay(uid: string, mailboxUid: string, sealedSummary?: string): Promise<void> {
     const unlocked = getUnlockedKeys(mailboxUid);
     if (!unlocked || entries[uid] || inFlight.has(uid) || decryptFailedBefore(uid)) {
         return;
     }
     inFlight.add(uid);
     try {
+        const securityApi = await import("../../../lib/crypto/messageSecurity.js");
+        // A message sealed at rest has its subject and preview sealed on its row: opening that small summary saves downloading it.
+        const summary = sealedSummary ? await securityApi.openZeroAccessSummary(sealedSummary, unlocked.zeroAccessKeys) : undefined;
+        if (summary) {
+            if (getUnlockedKeys(mailboxUid) === unlocked) {
+                rememberDecrypted(uid, mailboxUid, { subject: summary.subject, preview: summary.preview.slice(0, PREVIEW_MAX_LENGTH) });
+            }
+            return;
+        }
         const rawMime = await getMessageRawContent(uid);
-        const { evaluateMessageSecurity } = await import("../../../lib/crypto/messageSecurity.js");
-        const security = await evaluateMessageSecurity(rawMime, unlocked);
+        const security = await securityApi.evaluateMessageSecurity(rawMime, unlocked);
         // A lock while this ran: the result must not go back on screen.
         if (getUnlockedKeys(mailboxUid) === unlocked) {
             rememberDecrypted(uid, mailboxUid, { subject: security.subject, preview: security.html ? previewOf(security.html) : security.text?.slice(0, PREVIEW_MAX_LENGTH) });

package/apps/shared/mail/outbox/sendJob.ts

@@ -193,7 +193,7 @@ async function assemble(
 ): Promise<Message> {
     const { draft, to, cc, bcc, subject, html } = request;
     if (mode === "plain") {
-        return assembleDraft(draft.uid, { to, cc, bcc, subject, html }, client);
+        return assembleDraft(draft.uid, { to, cc, bcc, subject, html, intent: "send" }, client);
     }
     const keys = readSendKeys(request.mailboxUid, request.signEnabled, mailbox);
     const own = mailbox!;
@@ -227,7 +227,7 @@ async function assemble(
           )
         : await buildSignedOnlyMessage(bodyContentType, html, protectedHeaders, signing!.certDer, signing!.privateKey);
     const rawMime = assembleOutboundMime(outerHeaders, mimePart);
-    return assembleDraftRaw(draft.uid, { to, cc, bcc, subject: outerHeaders.subject, rawMime }, client);
+    return assembleDraftRaw(draft.uid, { to, cc, bcc, subject: outerHeaders.subject, rawMime, intent: "send" }, client);
 }
 
 function failureOf(err: unknown, fallback: string): Failure {

package/apps/shared/mail/reportNotices.ts

@@ -61,6 +61,8 @@ export function reportNotice(result: MessageReportResult, subject: string, alway
             ? "The spam filter could not be trained from this report."
             : result.learnSkipped === "encrypted"
               ? "Not used to train the spam filter: the message is encrypted."
-              : undefined;
+              : result.learnSkipped === "zero_access"
+                ? "Not used to train the spam filter: unlock your mailbox to let it learn from protected mail."
+                : undefined;
     return { title: kind.title, message: parts.join(" "), hint };
 }

package/apps/shared/mail/zeroAccessSource.ts

@@ -0,0 +1,27 @@
+///////////////////////////////////////////////////////////////////////////////
+// Copyright (C) 2026 Jean-Philippe Steinmetz
+// SPDX-License-Identifier: MPL-2.0
+///////////////////////////////////////////////////////////////////////////////
+import { getUnlockedKeys } from "../../../lib/crypto/keySession.js";
+import { openZeroAccessMessage } from "../../../lib/crypto/messageSecurity.js";
+import { getMessageRawContent, type Message } from "../../../lib/mail/mailApi.js";
+import type { ApiClient } from "../../../lib/util/api.js";
+
+/**
+ * The original source of a zero-access `message`, decrypted with its mailbox's unlocked keys and base64-encoded - what the server, which holds
+ * only the sealed copy, needs for an action that reads the message itself (`reportMessage()`'s `rawMessage`). `undefined` for any other
+ * message, while the mailbox is locked, or when it can't be fetched or opened: the action then goes ahead without it.
+ */
+export async function zeroAccessSourceBase64(message: Pick<Message, "uid" | "mailboxUid" | "zeroAccess">, client?: ApiClient): Promise<string | undefined> {
+    const unlocked = message.zeroAccess ? getUnlockedKeys(message.mailboxUid) : undefined;
+    if (!unlocked) {
+        return undefined;
+    }
+    try {
+        const original = await openZeroAccessMessage(await getMessageRawContent(message.uid, client), unlocked);
+        // A binary string (one char per byte), which `btoa()` encodes as the bytes themselves.
+        return original === undefined ? undefined : btoa(original);
+    } catch {
+        return undefined;
+    }
+}

package/apps/shared/search/LocalIndexLifecycle.tsx

@@ -39,10 +39,20 @@ const loadBuilder = () =>
         builder = undefined;
         throw err;
     }));
+/** The zero-access index sync (`zeroAccessIndexSync.ts`), loaded the same way: only once a zero-access mailbox is unlocked. */
+let syncer: Promise<typeof import("./zeroAccessIndexSync.js")> | undefined;
+const loadSyncer = () =>
+    (syncer ??= import("./zeroAccessIndexSync.js").catch((err) => {
+        syncer = undefined;
+        throw err;
+    }));
 import { destroyLocalIndex, pruneInaccessibleLocalIndexes } from "./localIndexRpcClient.js";
 
 export const POLL_INTERVAL_MS = 5_000;
 
+/** How often an unlocked zero-access mailbox's local index is brought up to date with the server's sealed index. */
+export const ZERO_ACCESS_SYNC_INTERVAL_MS = 120_000;
+
 export interface LocalIndexLifecycleProps {
     mailboxUid?: string;
     mailboxKeys?: PublicKey[];
@@ -65,6 +75,24 @@ export default function LocalIndexLifecycle({ mailboxUid, folders, accessibleMai
     // The latest props (and client), for the long-lived polling interval below.
     const latestRef = useRef({ mailboxUid, folders, client });
     latestRef.current = { mailboxUid, folders, client };
+    // mailboxUid -> when its last zero-access sync started. Set only once its first build finished (the sync writes into the index the
+    // build opened); a mailbox in `syncingRef` has a pass running, and never gets a second one alongside it.
+    const lastSyncRef = useRef(new Map<string, number>());
+    const syncingRef = useRef(new Set<string>());
+
+    function syncIfDue(targetMailboxUid: string, targetClient: ApiClient | undefined, first = false) {
+        const unlocked = getUnlockedKeys(targetMailboxUid);
+        const last = lastSyncRef.current.get(targetMailboxUid);
+        if (!unlocked?.zeroAccessKeys?.length || syncingRef.current.has(targetMailboxUid) || (!first && (last === undefined || Date.now() - last < ZERO_ACCESS_SYNC_INTERVAL_MS))) {
+            return;
+        }
+        lastSyncRef.current.set(targetMailboxUid, Date.now());
+        syncingRef.current.add(targetMailboxUid);
+        loadSyncer()
+            .then(({ syncZeroAccessIndex }) => syncZeroAccessIndex(targetMailboxUid, unlocked, targetClient))
+            .catch(() => undefined)
+            .finally(() => syncingRef.current.delete(targetMailboxUid));
+    }
 
     function startBuildIfUnlocked(targetMailboxUid: string, targetFolders: Folder[], targetClient: ApiClient | undefined) {
         const unlocked = getUnlockedKeys(targetMailboxUid);
@@ -76,6 +104,7 @@ export default function LocalIndexLifecycle({ mailboxUid, folders, accessibleMai
         // the rest of the app depends on.
         loadBuilder()
             .then(({ buildLocalIndex }) => buildLocalIndex(targetMailboxUid, unlocked, targetFolders, undefined, targetClient))
+            .then(() => syncIfDue(targetMailboxUid, targetClient, true))
             .catch(() => undefined);
     }
 
@@ -91,6 +120,7 @@ export default function LocalIndexLifecycle({ mailboxUid, folders, accessibleMai
                 if (wasUnlocked && !getUnlockedKeys(trackedUid)) {
                     // A present-to-absent transition: something just destroyed this mailbox's keys.
                     trackedRef.current.set(trackedUid, false);
+                    lastSyncRef.current.delete(trackedUid);
                     // Stop the pass still running with the now-destroyed keys; the destroy itself also makes
                     // the Worker reject anything that pass still sends.
                     loadBuilder()
@@ -103,6 +133,7 @@ export default function LocalIndexLifecycle({ mailboxUid, folders, accessibleMai
             const { mailboxUid: activeUid, folders: activeFolders, client: activeClient } = latestRef.current;
             if (activeUid) {
                 startBuildIfUnlocked(activeUid, activeFolders, activeClient);
+                syncIfDue(activeUid, activeClient);
             }
         }, POLL_INTERVAL_MS);
         return () => clearInterval(interval);

package/apps/shared/search/localIndexBuilder.ts

@@ -24,6 +24,11 @@
  * fully searchable via Tier 1; indexing it here too would spend this index's bounded byte budget on
  * content that didn't need it.
  *
+ * **Shared with the mailbox's other devices (Source C).** In a mailbox with a zero-access key, a pass first imports the end-to-end mail
+ * other devices already decrypted (`importClientSegments()`), at each message's version, so it isn't decrypted again here; and what this
+ * pass decrypts it uploads for them, sealed to the zero-access key (`uploadClientDocuments()`). Both are best effort - see
+ * `zeroAccessIndexSync.ts`.
+ *
  * **Verification seals.** A message this pass decrypts that has no seal for the vault's current `masterKeyGeneration` is
  * evaluated with `evaluateMessageSecurityWithSeal()`, against the sender's pinned signing keys from the reader's
  * contacts (`pinnedSigners.ts`, the message pane's own source, looked up once per sender per pass), so a verified
@@ -44,6 +49,7 @@ import { currentVerificationSeal, readVaultGeneration, sendVerificationSeal, ver
 import type { LocalIndexEntity } from "./localIndexSchema.js";
 import {
     getIndexedVersions,
+    moveLocalEntity,
     indexLocalEntities,
     initLocalIndex,
     nextLocalIndexGeneration,
@@ -53,6 +59,7 @@ import {
 } from "./localIndexRpcClient.js";
 import { deriveLocalIndexKey } from "./localIndexKey.js";
 import { getLocalIndexByteBudget } from "./localIndexSizePreference.js";
+import { importClientSegments, uploadClientDocuments } from "./zeroAccessIndexSync.js";
 
 /** The RFC 9788 placeholder subject every encrypted message's outer envelope carries server-side - see
  * `apps/www/index.tsx`'s identical constant and its own doc comment for the full citation. */
@@ -369,6 +376,9 @@ async function runBuildPass(
     await initLocalIndex({ mailboxUid, indexKey, generation });
     let { evictedBefore } = await setLocalIndexWindow(mailboxUid, windowConfig.timeFloorMonths, windowConfig.byteBudgetBytes, generation);
     await setLocalIndexBuilding(mailboxUid, true, { complete: false, generation });
+    // End-to-end mail another device already decrypted: imported at its version, so the walk below skips it.
+    await importClientSegments(mailboxUid, unlocked, client, { generation }).catch(() => undefined);
+    signal.throwIfAborted();
     // Mail arriving after this moment isn't guaranteed to be picked up by this pass.
     const coveredUntil = new Date(Date.now() - CLOCK_SKEW_MARGIN_MS).toISOString();
     let cutoff: Date | undefined;
@@ -389,6 +399,8 @@ async function runBuildPass(
             .filter((f) => MESSAGE_FOLDER_TYPES.has(f.type))
             .sort((a, b) => (FOLDER_PRIORITY[a.type] ?? 99) - (FOLDER_PRIORITY[b.type] ?? 99));
         const seenEncryptedUids = new Set<string>();
+        // What this pass decrypted, for the mailbox's other devices.
+        const decrypted: LocalIndexEntity[] = [];
 
         async function walkFolder(folder: Folder): Promise<WalkOutcome> {
             for (let page = 0; ; page++) {
@@ -406,8 +418,20 @@ async function runBuildPass(
                 for (const m of encrypted) {
                     seenEncryptedUids.add(m.uid);
                 }
+                // A zero-access message's content comes from the server's sealed index (`zeroAccessIndexSync.ts`), never decrypted here:
+                // only its folder is recorded on its row - and remembered by version, so an unchanged one costs nothing next time.
+                const sealed = encrypted.filter((m) => m.zeroAccess);
+                if (sealed.length > 0) {
+                    const indexed = await getIndexedVersions(
+                        mailboxUid,
+                        sealed.map((m) => m.uid),
+                    );
+                    for (const m of sealed.filter((s) => indexed[s.uid] !== versionOf(s))) {
+                        await moveLocalEntity(mailboxUid, m.uid, m.folderUid, versionOf(m));
+                    }
+                }
                 // Anything older than the eviction watermark would only be inserted and evicted again.
-                const candidates = encrypted.filter((m) => !isOlderThan(m.receivedDate, evictedBefore));
+                const candidates = encrypted.filter((m) => !m.zeroAccess && !isOlderThan(m.receivedDate, evictedBefore));
                 if (candidates.length > 0) {
                     // Skip anything already indexed at the same version - a re-unlock used to re-fetch and
                     // re-decrypt the entire window every time.
@@ -424,6 +448,7 @@ async function runBuildPass(
                     const entities = built.filter((e): e is LocalIndexEntity => e !== undefined && e !== FETCH_FAILED);
                     if (entities.length > 0) {
                         ({ evictedBefore } = await indexLocalEntities(mailboxUid, entities, generation));
+                        decrypted.push(...entities);
                     }
                 }
                 const oldestOnPage = messages[messages.length - 1].receivedDate;
@@ -481,6 +506,7 @@ async function runBuildPass(
             const since = evictedBefore && isWithinTimeFloor(evictedBefore, cutoff) ? evictedBefore : cutoff?.toISOString();
             await pruneLocalEntities(mailboxUid, [...seenEncryptedUids], since, { folderUids: reliable, generation });
         }
+        await uploadClientDocuments(mailboxUid, unlocked, decrypted, client).catch(() => undefined);
     } catch (err) {
         complete = false;
         throw err;