@rapidmx/web-client 0.35.0 → 0.36.0

package/dist/apps/shared/components/mail/layout/MailShell.js

@@ -15,6 +15,7 @@ import KeyEnrollmentGate from "../../layout/KeyEnrollmentGate.js";
 import MailboxProvisioning from "../../layout/MailboxProvisioning.js";
 import { prefetchComposeWindow, useCompose } from "../compose/ComposeContext.js";
 import LocalIndexLifecycle from "../../../search/LocalIndexLifecycle.js";
+import SharedMailboxKeyManager from "../../layout/SharedMailboxKeyManager.js";
 import { NO_LIVE_UPDATES } from "../../../mail/useMailLiveUpdates.js";
 import { MAILBOX_LIST_LIMIT, MailConnectionContext, useMailConnection } from "../../../mail/useMailConnection.js";
 import { folderRows } from "../../../mail/folderTree.js";
@@ -264,7 +265,7 @@ export default function MailShell({ userUid, authServerUrl, impersonating, imper
         // A shared/delegated mailbox the caller doesn't own is never provisioned from here - its keys
         // belong to its owner (or its admins), not to whoever happens to open it first - and neither is
         // the impersonated user's own mailbox: an administrator must never choose its password/recovery codes.
-        canProvision: !impersonating && activeMailbox?.ownerUserUid === userUid, children: [_jsx(LocalIndexLifecycle, { mailboxUid: activeMailboxUid, mailboxKeys: activeMailbox?.keys, folders: mailboxFolders.find((mf) => mf.mailbox.uid === activeMailboxUid)?.folders ?? [], 
+        canProvision: !impersonating && activeMailbox?.ownerUserUid === userUid, children: [_jsx(SharedMailboxKeyManager, { mailboxes: mailboxes, userUid: userUid }), _jsx(LocalIndexLifecycle, { mailboxUid: activeMailboxUid, mailboxKeys: activeMailbox?.keys, folders: mailboxFolders.find((mf) => mf.mailbox.uid === activeMailboxUid)?.folders ?? [], 
                 // A full page may be truncated - pruning against it would delete indexes of accessible mailboxes
                 // beyond the limit, so it's only trusted as the complete list when it came back short.
                 accessibleMailboxUids: status === "ready" && mailboxes.length < MAILBOX_LIST_LIMIT ? mailboxes.map((mb) => mb.uid) : undefined }), _jsx(AppShell, { active: "mail", userUid: userUid, authServerUrl: authServerUrl, impersonating: impersonating, impersonationBaseUrl: impersonationBaseUrl, trusted: trusted, trustedRoles: trustedRoles, pluginNav: pluginNav, children: inner })] }));

package/dist/apps/shared/components/mail/reading/useMessageActions.js

@@ -11,6 +11,7 @@ import { resolveFolderOfType } from "../../../mail/folderOfType.js";
 import { setReadStateMany } from "../../../mail/messageReadState.js";
 import { usePermanentDelete } from "../../../mail/usePermanentDelete.js";
 import { reportFolderName, reportNotice, reportNoun, reportTitle, senderListsHref } from "../../../mail/reportNotices.js";
+import { zeroAccessSourceBase64 } from "../../../mail/zeroAccessSource.js";
 import { blockSender, neverBlockSender, normalizeAddresses, removeSenderRule } from "../../../mail/senderBlocking.js";
 import { notifyApiError } from "../../../notifications/apiErrors.js";
 import { notify } from "../../../notifications/store.js";
@@ -122,7 +123,9 @@ export function useMessageActions(params) {
         await exclusive(async () => {
             let result;
             try {
-                result = await reportMessage(message.uid, kind, { alwaysTrustSender }, client);
+                // The server holds only the sealed copy of a zero-access message: its spam filter learns from the source decrypted here.
+                const rawMessage = await zeroAccessSourceBase64(message, client);
+                result = await reportMessage(message.uid, kind, { alwaysTrustSender, ...(rawMessage ? { rawMessage } : {}) }, client);
             }
             catch (err) {
                 if (isNotFound(err)) {

package/dist/apps/shared/components/settings/KeyExportSetting.d.ts

@@ -0,0 +1,13 @@
+import React from "react";
+import type { Mailbox } from "../../../../lib/mail/mailApi.js";
+export interface KeyExportSettingProps {
+    mailbox: Mailbox;
+    /** The caller owns the mailbox and isn't impersonating: restapi records an export only for the owner. */
+    canManage: boolean;
+}
+/**
+ * "Export keys for Outlook/phone" (`lib/crypto/keyExport.ts`): a passphrase-protected `.p12` with the mailbox's zero-access
+ * and end-to-end encryption keys - and its signing key, if the user ticks the box - so a mail app that isn't RapidMX can read
+ * mail stored encrypted. Asks for the master password again however long the mailbox has been unlocked.
+ */
+export default function KeyExportSetting({ mailbox, canManage }: KeyExportSettingProps): React.JSX.Element;

package/dist/apps/shared/components/settings/KeyExportSetting.js

@@ -0,0 +1,88 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+///////////////////////////////////////////////////////////////////////////////
+// Copyright (C) 2026 Jean-Philippe Steinmetz
+// SPDX-License-Identifier: MPL-2.0
+///////////////////////////////////////////////////////////////////////////////
+import { useState } from "react";
+import { exportKeysAsPkcs12, MIN_EXPORT_PASSPHRASE_LENGTH, NothingToExportError } from "../../../../lib/crypto/keyExport.js";
+import { ApiRequestError } from "../../../../lib/util/api.js";
+import { useApiClient } from "../../../../lib/util/apiClientContext.js";
+import Alert from "../../../../lib/components/feedback/Alert.js";
+import Button from "../../../../lib/components/buttons/Button.js";
+import { notifyApiError } from "../../notifications/apiErrors.js";
+import PolicyLockedNotice from "./PolicyLockedNotice.js";
+const INPUT_CLASS = "w-full text-sm border border-border rounded-sm py-1.5 px-2 bg-surface";
+/** Hands `bytes` to the browser as a file download. */
+function saveFile(bytes, filename) {
+    const url = URL.createObjectURL(new Blob([bytes], { type: "application/x-pkcs12" }));
+    const link = document.createElement("a");
+    link.href = url;
+    link.download = filename;
+    document.body.appendChild(link);
+    link.click();
+    link.remove();
+    URL.revokeObjectURL(url);
+}
+/**
+ * "Export keys for Outlook/phone" (`lib/crypto/keyExport.ts`): a passphrase-protected `.p12` with the mailbox's zero-access
+ * and end-to-end encryption keys - and its signing key, if the user ticks the box - so a mail app that isn't RapidMX can read
+ * mail stored encrypted. Asks for the master password again however long the mailbox has been unlocked.
+ */
+export default function KeyExportSetting({ mailbox, canManage }) {
+    const client = useApiClient();
+    const [open, setOpen] = useState(false);
+    const [password, setPassword] = useState("");
+    const [passphrase, setPassphrase] = useState("");
+    const [confirmPassphrase, setConfirmPassphrase] = useState("");
+    const [includeSigningKey, setIncludeSigningKey] = useState(false);
+    const [exporting, setExporting] = useState(false);
+    const [error, setError] = useState(null);
+    function reset() {
+        setOpen(false);
+        setPassword("");
+        setPassphrase("");
+        setConfirmPassphrase("");
+        setIncludeSigningKey(false);
+        setError(null);
+    }
+    async function handleExport(e) {
+        e.preventDefault();
+        if (passphrase.length < MIN_EXPORT_PASSPHRASE_LENGTH) {
+            setError(`The file's passphrase must be at least ${MIN_EXPORT_PASSPHRASE_LENGTH} characters.`);
+            return;
+        }
+        if (passphrase !== confirmPassphrase) {
+            setError("The passphrases don't match.");
+            return;
+        }
+        setExporting(true);
+        setError(null);
+        try {
+            const result = await exportKeysAsPkcs12({
+                mailboxUid: mailbox.uid,
+                mailboxAddress: mailbox.primarySmtpAddress,
+                mailboxKeys: mailbox.keys ?? [],
+                masterPassword: password,
+                exportPassphrase: passphrase,
+                includeSigningKey,
+            }, client);
+            saveFile(result.pkcs12, `${mailbox.primarySmtpAddress}-keys.p12`);
+            reset();
+        }
+        catch (err) {
+            if (err instanceof ApiRequestError) {
+                notifyApiError(err, "Couldn't export your keys");
+            }
+            else if (err instanceof NothingToExportError || (err instanceof Error && err.message.startsWith("This mailbox has no password"))) {
+                setError(err.message);
+            }
+            else {
+                setError("Incorrect password.");
+            }
+        }
+        finally {
+            setExporting(false);
+        }
+    }
+    return (_jsxs("div", { children: [_jsx("h2", { className: "text-sm font-semibold mb-2", children: "Export keys for Outlook or a phone" }), _jsx("p", { className: "text-sm text-text-muted mb-2", children: "Mail apps other than RapidMX need your keys to read encrypted mail. The exported file holds your zero-access and end-to-end encryption keys, protected by a passphrase you choose. Anyone with the file and its passphrase can read all of this mailbox\u2019s mail, so keep it safe and delete it once it\u2019s installed." }), !canManage ? (_jsx(PolicyLockedNotice, { children: "Only this mailbox\u2019s owner, signed in as themselves, can export its keys." })) : !open ? (_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", onClick: () => setOpen(true), children: "Export keys\u2026" })) : (_jsxs("form", { onSubmit: (e) => void handleExport(e), className: "flex flex-col gap-2", children: [_jsx("input", { type: "password", "aria-label": "Encryption password", placeholder: "Encryption password", className: INPUT_CLASS, value: password, onChange: (e) => setPassword(e.target.value), disabled: exporting, autoComplete: "current-password" }), _jsx("input", { type: "password", "aria-label": "File passphrase", placeholder: `File passphrase (at least ${MIN_EXPORT_PASSPHRASE_LENGTH} characters)`, className: INPUT_CLASS, value: passphrase, onChange: (e) => setPassphrase(e.target.value), disabled: exporting, autoComplete: "new-password" }), _jsx("input", { type: "password", "aria-label": "Confirm file passphrase", placeholder: "Confirm file passphrase", className: INPUT_CLASS, value: confirmPassphrase, onChange: (e) => setConfirmPassphrase(e.target.value), disabled: exporting, autoComplete: "new-password" }), _jsxs("label", { className: "flex items-start gap-2 text-sm", children: [_jsx("input", { type: "checkbox", className: "mt-1", checked: includeSigningKey, onChange: (e) => setIncludeSigningKey(e.target.checked), disabled: exporting }), _jsxs("span", { children: [_jsx("span", { className: "font-semibold block", children: "Include my signing key" }), _jsx("span", { className: "text-xs text-text-muted", children: "Only if that app will sign mail you send. Anyone with the file could sign as you." })] })] }), error && _jsx(Alert, { children: error }), _jsxs("div", { className: "flex gap-2", children: [_jsx(Button, { type: "submit", className: "!w-auto", disabled: exporting || !password || !passphrase, children: exporting ? "Exporting…" : "Export" }), _jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", onClick: reset, disabled: exporting, children: "Cancel" })] })] }))] }));
+}

package/dist/apps/shared/components/settings/PolicyLockedNotice.d.ts

@@ -0,0 +1,11 @@
+import React from "react";
+export interface PolicyLockedNoticeProps {
+    /** Why the setting next to this notice can't be changed - e.g. that an administrator turned it off for the server. */
+    children: React.ReactNode;
+}
+/**
+ * Explains why a settings control is disabled by a policy the user can't change themselves (an administrator's server-wide
+ * setting, say), shown right under that control. A disabled control with no reason reads as a defect; this says who decided
+ * and that the user isn't the one who can undo it.
+ */
+export default function PolicyLockedNotice({ children }: PolicyLockedNoticeProps): React.JSX.Element;

package/dist/apps/shared/components/settings/PolicyLockedNotice.js

@@ -0,0 +1,9 @@
+import { jsx as _jsx } from "react/jsx-runtime";
+/**
+ * Explains why a settings control is disabled by a policy the user can't change themselves (an administrator's server-wide
+ * setting, say), shown right under that control. A disabled control with no reason reads as a defect; this says who decided
+ * and that the user isn't the one who can undo it.
+ */
+export default function PolicyLockedNotice({ children }) {
+    return (_jsx("p", { role: "note", className: "mt-1.5 text-xs text-text-muted border-l-2 border-border pl-2", children: children }));
+}

package/dist/apps/shared/components/settings/ZeroAccessSetting.d.ts

@@ -0,0 +1,14 @@
+import React from "react";
+import { type Mailbox } from "../../../../lib/mail/mailApi.js";
+export interface ZeroAccessSettingProps {
+    mailbox: Mailbox;
+    /** The caller owns the mailbox and isn't impersonating: only then can the setting be changed (restapi drops anybody else's value). */
+    canManage: boolean;
+}
+/**
+ * "Enable zero-access encryption" for one mailbox (restapi `specs/search.md` §3): unencrypted mail is encrypted to the
+ * mailbox's zero-access key as it arrives and the server keeps no readable copy. On by default. Shown disabled, with the
+ * reason, when the administrator has turned "Allow zero-access encryption" off for the server, or when the server doesn't
+ * support it. A shared mailbox is covered too: its members read it through member key wraps (`sharedMailboxKeys.ts`).
+ */
+export default function ZeroAccessSetting({ mailbox, canManage }: ZeroAccessSettingProps): React.JSX.Element;

package/dist/apps/shared/components/settings/ZeroAccessSetting.js

@@ -0,0 +1,71 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+///////////////////////////////////////////////////////////////////////////////
+// Copyright (C) 2026 Jean-Philippe Steinmetz
+// SPDX-License-Identifier: MPL-2.0
+///////////////////////////////////////////////////////////////////////////////
+import { useEffect, useState } from "react";
+import { getEncryptionPolicy } from "../../../../lib/crypto/keyvaultApi.js";
+import { getMailbox, updateMailbox } from "../../../../lib/mail/mailApi.js";
+import { ApiRequestError } from "../../../../lib/util/api.js";
+import { useApiClient } from "../../../../lib/util/apiClientContext.js";
+import { notifyApiError } from "../../notifications/apiErrors.js";
+import PolicyLockedNotice from "./PolicyLockedNotice.js";
+/**
+ * "Enable zero-access encryption" for one mailbox (restapi `specs/search.md` §3): unencrypted mail is encrypted to the
+ * mailbox's zero-access key as it arrives and the server keeps no readable copy. On by default. Shown disabled, with the
+ * reason, when the administrator has turned "Allow zero-access encryption" off for the server, or when the server doesn't
+ * support it. A shared mailbox is covered too: its members read it through member key wraps (`sharedMailboxKeys.ts`).
+ */
+export default function ZeroAccessSetting({ mailbox, canManage }) {
+    const client = useApiClient();
+    const [enabled, setEnabled] = useState(mailbox.zeroAccessEnabled !== false);
+    const [blocker, setBlocker] = useState(undefined);
+    const [saving, setSaving] = useState(false);
+    useEffect(() => {
+        let cancelled = false;
+        void (async () => {
+            const policy = await getEncryptionPolicy(client).catch(() => undefined);
+            let next = null;
+            if (policy?.allowZeroAccess === undefined) {
+                next = "unsupported";
+            }
+            else if (!policy.allowZeroAccess) {
+                next = "disabled_by_admin";
+            }
+            if (!cancelled) {
+                setBlocker(next);
+            }
+        })();
+        return () => {
+            cancelled = true;
+        };
+    }, [mailbox.uid, client]);
+    async function save(next) {
+        setSaving(true);
+        const previous = enabled;
+        setEnabled(next);
+        try {
+            const write = (version) => updateMailbox({ uid: mailbox.uid, version, zeroAccessEnabled: next }, client);
+            try {
+                await write(mailbox.version);
+            }
+            catch (err) {
+                // Enrolling a key (which happens on unlock) moves the mailbox's version on, so the copy this page was given may be
+                // behind: read it again and retry once.
+                if (!(err instanceof ApiRequestError && err.status === 409)) {
+                    throw err;
+                }
+                await write((await getMailbox(mailbox.uid, {}, client)).version);
+            }
+        }
+        catch (err) {
+            setEnabled(previous);
+            notifyApiError(err, "Couldn't save the zero-access encryption setting");
+        }
+        finally {
+            setSaving(false);
+        }
+    }
+    const locked = blocker !== null;
+    return (_jsxs("div", { children: [_jsx("h2", { className: "text-sm font-semibold mb-2", children: "Zero-access encryption" }), _jsxs("label", { className: "flex items-start gap-2 text-sm", children: [_jsx("input", { type: "checkbox", className: "mt-1", checked: !locked && enabled, disabled: !canManage || locked || saving, onChange: (e) => void save(e.target.checked) }), _jsxs("span", { children: [_jsx("span", { className: "font-semibold block", children: "Enable zero-access encryption" }), _jsx("span", { className: "text-xs text-text-muted", children: "Mail that arrives unencrypted is encrypted the moment it is received, and the server keeps no copy it can read - nobody else, administrators included, can read it. You unlock it with your encryption password, and search of message contents happens on your device. Outlook and phone mail apps need your exported keys to read it. Turning this off only affects mail that arrives afterwards." })] })] }), blocker === "disabled_by_admin" && (_jsx(PolicyLockedNotice, { children: "Your administrator has turned off zero-access encryption for this server, so new mail is stored without it. Mail already encrypted stays encrypted." })), blocker === "unsupported" && _jsx(PolicyLockedNotice, { children: "This server doesn\u2019t offer zero-access encryption." }), !mailbox.ownerUserUid && !locked && (_jsx(PolicyLockedNotice, { children: "This shared mailbox has no owner: it is protected for its members, whose apps share its key with each other." })), !canManage && !locked && mailbox.ownerUserUid && (_jsx(PolicyLockedNotice, { children: "Only this mailbox\u2019s owner, signed in as themselves, can change this." }))] }));
+}

package/dist/apps/shared/mail/decryptedMessages.d.ts

@@ -32,4 +32,4 @@ export declare function useUnlockEpoch(): number;
  * Decrypts one message to recover its subject and preview, when its mailbox's keys are unlocked and it isn't already known. Best effort: a
  * message that can't be fetched or opened is simply left as it was. Never prompts.
  */
-export declare function decryptForDisplay(uid: string, mailboxUid: string): Promise<void>;
+export declare function decryptForDisplay(uid: string, mailboxUid: string, sealedSummary?: string): Promise<void>;

package/dist/apps/shared/mail/decryptedMessages.js

@@ -113,16 +113,24 @@ export function useUnlockEpoch() {
  * Decrypts one message to recover its subject and preview, when its mailbox's keys are unlocked and it isn't already known. Best effort: a
  * message that can't be fetched or opened is simply left as it was. Never prompts.
  */
-export async function decryptForDisplay(uid, mailboxUid) {
+export async function decryptForDisplay(uid, mailboxUid, sealedSummary) {
     const unlocked = getUnlockedKeys(mailboxUid);
     if (!unlocked || entries[uid] || inFlight.has(uid) || decryptFailedBefore(uid)) {
         return;
     }
     inFlight.add(uid);
     try {
+        const securityApi = await import("../../../lib/crypto/messageSecurity.js");
+        // A message sealed at rest has its subject and preview sealed on its row: opening that small summary saves downloading it.
+        const summary = sealedSummary ? await securityApi.openZeroAccessSummary(sealedSummary, unlocked.zeroAccessKeys) : undefined;
+        if (summary) {
+            if (getUnlockedKeys(mailboxUid) === unlocked) {
+                rememberDecrypted(uid, mailboxUid, { subject: summary.subject, preview: summary.preview.slice(0, PREVIEW_MAX_LENGTH) });
+            }
+            return;
+        }
         const rawMime = await getMessageRawContent(uid);
-        const { evaluateMessageSecurity } = await import("../../../lib/crypto/messageSecurity.js");
-        const security = await evaluateMessageSecurity(rawMime, unlocked);
+        const security = await securityApi.evaluateMessageSecurity(rawMime, unlocked);
         // A lock while this ran: the result must not go back on screen.
         if (getUnlockedKeys(mailboxUid) === unlocked) {
             rememberDecrypted(uid, mailboxUid, { subject: security.subject, preview: security.html ? previewOf(security.html) : security.text?.slice(0, PREVIEW_MAX_LENGTH) });

package/dist/apps/shared/mail/outbox/sendJob.js

@@ -106,7 +106,7 @@ async function completeContext(request, client) {
 async function assemble(request, mailbox, mode, statuses, withSignature, client) {
     const { draft, to, cc, bcc, subject, html } = request;
     if (mode === "plain") {
-        return assembleDraft(draft.uid, { to, cc, bcc, subject, html }, client);
+        return assembleDraft(draft.uid, { to, cc, bcc, subject, html, intent: "send" }, client);
     }
     const keys = readSendKeys(request.mailboxUid, request.signEnabled, mailbox);
     const own = mailbox;
@@ -131,7 +131,7 @@ async function assemble(request, mailbox, mode, statuses, withSignature, client)
         ? await buildEncryptedMessage(bodyContentType, html, protectedHeaders, outerHeaders, [keys.unlocked.encryptionCertDer, ...statuses.map((status) => fromBase64(status.encryptCert.publicKey))], signing)
         : await buildSignedOnlyMessage(bodyContentType, html, protectedHeaders, signing.certDer, signing.privateKey);
     const rawMime = assembleOutboundMime(outerHeaders, mimePart);
-    return assembleDraftRaw(draft.uid, { to, cc, bcc, subject: outerHeaders.subject, rawMime }, client);
+    return assembleDraftRaw(draft.uid, { to, cc, bcc, subject: outerHeaders.subject, rawMime, intent: "send" }, client);
 }
 function failureOf(err, fallback) {
     const failure = describeSendFailure(err, fallback);

package/dist/apps/shared/mail/reportNotices.js

@@ -42,6 +42,8 @@ export function reportNotice(result, subject, alwaysTrust) {
         ? "The spam filter could not be trained from this report."
         : result.learnSkipped === "encrypted"
             ? "Not used to train the spam filter: the message is encrypted."
-            : undefined;
+            : result.learnSkipped === "zero_access"
+                ? "Not used to train the spam filter: unlock your mailbox to let it learn from protected mail."
+                : undefined;
     return { title: kind.title, message: parts.join(" "), hint };
 }

package/dist/apps/shared/mail/zeroAccessSource.d.ts

@@ -0,0 +1,8 @@
+import { type Message } from "../../../lib/mail/mailApi.js";
+import type { ApiClient } from "../../../lib/util/api.js";
+/**
+ * The original source of a zero-access `message`, decrypted with its mailbox's unlocked keys and base64-encoded - what the server, which holds
+ * only the sealed copy, needs for an action that reads the message itself (`reportMessage()`'s `rawMessage`). `undefined` for any other
+ * message, while the mailbox is locked, or when it can't be fetched or opened: the action then goes ahead without it.
+ */
+export declare function zeroAccessSourceBase64(message: Pick<Message, "uid" | "mailboxUid" | "zeroAccess">, client?: ApiClient): Promise<string | undefined>;

package/dist/apps/shared/mail/zeroAccessSource.js

@@ -0,0 +1,26 @@
+///////////////////////////////////////////////////////////////////////////////
+// Copyright (C) 2026 Jean-Philippe Steinmetz
+// SPDX-License-Identifier: MPL-2.0
+///////////////////////////////////////////////////////////////////////////////
+import { getUnlockedKeys } from "../../../lib/crypto/keySession.js";
+import { openZeroAccessMessage } from "../../../lib/crypto/messageSecurity.js";
+import { getMessageRawContent } from "../../../lib/mail/mailApi.js";
+/**
+ * The original source of a zero-access `message`, decrypted with its mailbox's unlocked keys and base64-encoded - what the server, which holds
+ * only the sealed copy, needs for an action that reads the message itself (`reportMessage()`'s `rawMessage`). `undefined` for any other
+ * message, while the mailbox is locked, or when it can't be fetched or opened: the action then goes ahead without it.
+ */
+export async function zeroAccessSourceBase64(message, client) {
+    const unlocked = message.zeroAccess ? getUnlockedKeys(message.mailboxUid) : undefined;
+    if (!unlocked) {
+        return undefined;
+    }
+    try {
+        const original = await openZeroAccessMessage(await getMessageRawContent(message.uid, client), unlocked);
+        // A binary string (one char per byte), which `btoa()` encodes as the bytes themselves.
+        return original === undefined ? undefined : btoa(original);
+    }
+    catch {
+        return undefined;
+    }
+}

package/dist/apps/shared/search/LocalIndexLifecycle.d.ts

@@ -1,6 +1,8 @@
 import type { PublicKey } from "../../../lib/crypto/keyvaultApi.js";
 import type { Folder } from "../../../lib/mail/mailApi.js";
 export declare const POLL_INTERVAL_MS = 5000;
+/** How often an unlocked zero-access mailbox's local index is brought up to date with the server's sealed index. */
+export declare const ZERO_ACCESS_SYNC_INTERVAL_MS = 120000;
 export interface LocalIndexLifecycleProps {
     mailboxUid?: string;
     mailboxKeys?: PublicKey[];

package/dist/apps/shared/search/LocalIndexLifecycle.js

@@ -34,8 +34,16 @@ const loadBuilder = () => (builder ?? (builder = import("./localIndexBuilder.js"
     builder = undefined;
     throw err;
 })));
+/** The zero-access index sync (`zeroAccessIndexSync.ts`), loaded the same way: only once a zero-access mailbox is unlocked. */
+let syncer;
+const loadSyncer = () => (syncer ?? (syncer = import("./zeroAccessIndexSync.js").catch((err) => {
+    syncer = undefined;
+    throw err;
+})));
 import { destroyLocalIndex, pruneInaccessibleLocalIndexes } from "./localIndexRpcClient.js";
 export const POLL_INTERVAL_MS = 5000;
+/** How often an unlocked zero-access mailbox's local index is brought up to date with the server's sealed index. */
+export const ZERO_ACCESS_SYNC_INTERVAL_MS = 120000;
 /** Renders nothing - pure side-effect component, mounted by `MailShell.tsx`. */
 export default function LocalIndexLifecycle({ mailboxUid, folders, accessibleMailboxUids }) {
     // The explicit ApiClient (from useApiClient()) this component is rendered under - undefined for every existing caller (the SSR web/admin
@@ -49,6 +57,23 @@ export default function LocalIndexLifecycle({ mailboxUid, folders, accessibleMai
     // The latest props (and client), for the long-lived polling interval below.
     const latestRef = useRef({ mailboxUid, folders, client });
     latestRef.current = { mailboxUid, folders, client };
+    // mailboxUid -> when its last zero-access sync started. Set only once its first build finished (the sync writes into the index the
+    // build opened); a mailbox in `syncingRef` has a pass running, and never gets a second one alongside it.
+    const lastSyncRef = useRef(new Map());
+    const syncingRef = useRef(new Set());
+    function syncIfDue(targetMailboxUid, targetClient, first = false) {
+        const unlocked = getUnlockedKeys(targetMailboxUid);
+        const last = lastSyncRef.current.get(targetMailboxUid);
+        if (!unlocked?.zeroAccessKeys?.length || syncingRef.current.has(targetMailboxUid) || (!first && (last === undefined || Date.now() - last < ZERO_ACCESS_SYNC_INTERVAL_MS))) {
+            return;
+        }
+        lastSyncRef.current.set(targetMailboxUid, Date.now());
+        syncingRef.current.add(targetMailboxUid);
+        loadSyncer()
+            .then(({ syncZeroAccessIndex }) => syncZeroAccessIndex(targetMailboxUid, unlocked, targetClient))
+            .catch(() => undefined)
+            .finally(() => syncingRef.current.delete(targetMailboxUid));
+    }
     function startBuildIfUnlocked(targetMailboxUid, targetFolders, targetClient) {
         const unlocked = getUnlockedKeys(targetMailboxUid);
         if (!unlocked || targetFolders.length === 0 || trackedRef.current.get(targetMailboxUid)) {
@@ -59,6 +84,7 @@ export default function LocalIndexLifecycle({ mailboxUid, folders, accessibleMai
         // the rest of the app depends on.
         loadBuilder()
             .then(({ buildLocalIndex }) => buildLocalIndex(targetMailboxUid, unlocked, targetFolders, undefined, targetClient))
+            .then(() => syncIfDue(targetMailboxUid, targetClient, true))
             .catch(() => undefined);
     }
     useEffect(() => {
@@ -72,6 +98,7 @@ export default function LocalIndexLifecycle({ mailboxUid, folders, accessibleMai
                 if (wasUnlocked && !getUnlockedKeys(trackedUid)) {
                     // A present-to-absent transition: something just destroyed this mailbox's keys.
                     trackedRef.current.set(trackedUid, false);
+                    lastSyncRef.current.delete(trackedUid);
                     // Stop the pass still running with the now-destroyed keys; the destroy itself also makes
                     // the Worker reject anything that pass still sends.
                     loadBuilder()
@@ -84,6 +111,7 @@ export default function LocalIndexLifecycle({ mailboxUid, folders, accessibleMai
             const { mailboxUid: activeUid, folders: activeFolders, client: activeClient } = latestRef.current;
             if (activeUid) {
                 startBuildIfUnlocked(activeUid, activeFolders, activeClient);
+                syncIfDue(activeUid, activeClient);
             }
         }, POLL_INTERVAL_MS);
         return () => clearInterval(interval);

package/dist/apps/shared/search/localIndexBuilder.d.ts

@@ -20,6 +20,11 @@
  * fully searchable via Tier 1; indexing it here too would spend this index's bounded byte budget on
  * content that didn't need it.
  *
+ * **Shared with the mailbox's other devices (Source C).** In a mailbox with a zero-access key, a pass first imports the end-to-end mail
+ * other devices already decrypted (`importClientSegments()`), at each message's version, so it isn't decrypted again here; and what this
+ * pass decrypts it uploads for them, sealed to the zero-access key (`uploadClientDocuments()`). Both are best effort - see
+ * `zeroAccessIndexSync.ts`.
+ *
  * **Verification seals.** A message this pass decrypts that has no seal for the vault's current `masterKeyGeneration` is
  * evaluated with `evaluateMessageSecurityWithSeal()`, against the sender's pinned signing keys from the reader's
  * contacts (`pinnedSigners.ts`, the message pane's own source, looked up once per sender per pass), so a verified

package/dist/apps/shared/search/localIndexBuilder.js

@@ -24,6 +24,11 @@
  * fully searchable via Tier 1; indexing it here too would spend this index's bounded byte budget on
  * content that didn't need it.
  *
+ * **Shared with the mailbox's other devices (Source C).** In a mailbox with a zero-access key, a pass first imports the end-to-end mail
+ * other devices already decrypted (`importClientSegments()`), at each message's version, so it isn't decrypted again here; and what this
+ * pass decrypts it uploads for them, sealed to the zero-access key (`uploadClientDocuments()`). Both are best effort - see
+ * `zeroAccessIndexSync.ts`.
+ *
  * **Verification seals.** A message this pass decrypts that has no seal for the vault's current `masterKeyGeneration` is
  * evaluated with `evaluateMessageSecurityWithSeal()`, against the sender's pinned signing keys from the reader's
  * contacts (`pinnedSigners.ts`, the message pane's own source, looked up once per sender per pass), so a verified
@@ -39,9 +44,10 @@ import { getMessageRawContent, listFolders, listMessages } from "../../../lib/ma
 import { evaluateMessageSecurity, evaluateMessageSecurityWithSeal } from "../../../lib/crypto/messageSecurity.js";
 import { getPinnedSignerFingerprints } from "../components/mail/pinnedSigners.js";
 import { currentVerificationSeal, readVaultGeneration, sendVerificationSeal, verificationSealPending } from "../components/mail/verificationSeals.js";
-import { getIndexedVersions, indexLocalEntities, initLocalIndex, nextLocalIndexGeneration, pruneLocalEntities, setLocalIndexBuilding, setLocalIndexWindow, } from "./localIndexRpcClient.js";
+import { getIndexedVersions, moveLocalEntity, indexLocalEntities, initLocalIndex, nextLocalIndexGeneration, pruneLocalEntities, setLocalIndexBuilding, setLocalIndexWindow, } from "./localIndexRpcClient.js";
 import { deriveLocalIndexKey } from "./localIndexKey.js";
 import { getLocalIndexByteBudget } from "./localIndexSizePreference.js";
+import { importClientSegments, uploadClientDocuments } from "./zeroAccessIndexSync.js";
 /** The RFC 9788 placeholder subject every encrypted message's outer envelope carries server-side - see
  * `apps/www/index.tsx`'s identical constant and its own doc comment for the full citation. */
 const ENCRYPTED_SUBJECT_PLACEHOLDER = "[...]";
@@ -287,6 +293,9 @@ async function runBuildPass(mailboxUid, unlocked, folders, windowConfig, signal,
     await initLocalIndex({ mailboxUid, indexKey, generation });
     let { evictedBefore } = await setLocalIndexWindow(mailboxUid, windowConfig.timeFloorMonths, windowConfig.byteBudgetBytes, generation);
     await setLocalIndexBuilding(mailboxUid, true, { complete: false, generation });
+    // End-to-end mail another device already decrypted: imported at its version, so the walk below skips it.
+    await importClientSegments(mailboxUid, unlocked, client, { generation }).catch(() => undefined);
+    signal.throwIfAborted();
     // Mail arriving after this moment isn't guaranteed to be picked up by this pass.
     const coveredUntil = new Date(Date.now() - CLOCK_SKEW_MARGIN_MS).toISOString();
     let cutoff;
@@ -307,6 +316,8 @@ async function runBuildPass(mailboxUid, unlocked, folders, windowConfig, signal,
             .filter((f) => MESSAGE_FOLDER_TYPES.has(f.type))
             .sort((a, b) => (FOLDER_PRIORITY[a.type] ?? 99) - (FOLDER_PRIORITY[b.type] ?? 99));
         const seenEncryptedUids = new Set();
+        // What this pass decrypted, for the mailbox's other devices.
+        const decrypted = [];
         async function walkFolder(folder) {
             for (let page = 0;; page++) {
                 signal.throwIfAborted();
@@ -324,8 +335,17 @@ async function runBuildPass(mailboxUid, unlocked, folders, windowConfig, signal,
                 for (const m of encrypted) {
                     seenEncryptedUids.add(m.uid);
                 }
+                // A zero-access message's content comes from the server's sealed index (`zeroAccessIndexSync.ts`), never decrypted here:
+                // only its folder is recorded on its row - and remembered by version, so an unchanged one costs nothing next time.
+                const sealed = encrypted.filter((m) => m.zeroAccess);
+                if (sealed.length > 0) {
+                    const indexed = await getIndexedVersions(mailboxUid, sealed.map((m) => m.uid));
+                    for (const m of sealed.filter((s) => indexed[s.uid] !== versionOf(s))) {
+                        await moveLocalEntity(mailboxUid, m.uid, m.folderUid, versionOf(m));
+                    }
+                }
                 // Anything older than the eviction watermark would only be inserted and evicted again.
-                const candidates = encrypted.filter((m) => !isOlderThan(m.receivedDate, evictedBefore));
+                const candidates = encrypted.filter((m) => !m.zeroAccess && !isOlderThan(m.receivedDate, evictedBefore));
                 if (candidates.length > 0) {
                     // Skip anything already indexed at the same version - a re-unlock used to re-fetch and
                     // re-decrypt the entire window every time.
@@ -339,6 +359,7 @@ async function runBuildPass(mailboxUid, unlocked, folders, windowConfig, signal,
                     const entities = built.filter((e) => e !== undefined && e !== FETCH_FAILED);
                     if (entities.length > 0) {
                         ({ evictedBefore } = await indexLocalEntities(mailboxUid, entities, generation));
+                        decrypted.push(...entities);
                     }
                 }
                 const oldestOnPage = messages[messages.length - 1].receivedDate;
@@ -397,6 +418,7 @@ async function runBuildPass(mailboxUid, unlocked, folders, windowConfig, signal,
             const since = evictedBefore && isWithinTimeFloor(evictedBefore, cutoff) ? evictedBefore : cutoff?.toISOString();
             await pruneLocalEntities(mailboxUid, [...seenEncryptedUids], since, { folderUids: reliable, generation });
         }
+        await uploadClientDocuments(mailboxUid, unlocked, decrypted, client).catch(() => undefined);
     }
     catch (err) {
         complete = false;

package/dist/apps/shared/search/localIndexRpcClient.d.ts

@@ -66,7 +66,7 @@ export declare function indexLocalEntities(mailboxUid: string, entities: LocalIn
 export declare function removeLocalEntity(mailboxUid: string, entityUid: string): Promise<void>;
 /** Re-points one indexed message at its new folder (archive, cancel-scheduled-send) so `folder:`-scoped
  * local searches stay correct. Same no-op/never-rejects rules as `removeLocalEntity()`. */
-export declare function moveLocalEntity(mailboxUid: string, entityUid: string, folderUid: string): Promise<void>;
+export declare function moveLocalEntity(mailboxUid: string, entityUid: string, folderUid: string, entityVersion?: string): Promise<void>;
 export declare function getIndexedVersions(mailboxUid: string, entityUids: string[]): Promise<Record<string, string>>;
 export declare function pruneLocalEntities(mailboxUid: string, keepEntityUids: string[], since: string | undefined, options?: PruneLocalEntitiesOptions): Promise<number>;
 export declare function searchLocal(mailboxUid: string, parsed: ParsedSearchQuery, limit: number, offset?: number): Promise<LocalSearchPage>;

package/dist/apps/shared/search/localIndexRpcClient.js

@@ -174,11 +174,11 @@ async function removeLocalEntityImpl(mailboxUid, entityUid) {
 }
 /** Re-points one indexed message at its new folder (archive, cancel-scheduled-send) so `folder:`-scoped
  * local searches stay correct. Same no-op/never-rejects rules as `removeLocalEntityImpl()`. */
-async function moveLocalEntityImpl(mailboxUid, entityUid, folderUid) {
+async function moveLocalEntityImpl(mailboxUid, entityUid, folderUid, entityVersion) {
     if (!initializedMailboxes.has(mailboxUid)) {
         return;
     }
-    await call("moveEntity", { mailboxUid, entityUid, folderUid }).catch(() => undefined);
+    await call("moveEntity", { mailboxUid, entityUid, folderUid, ...(entityVersion !== undefined ? { entityVersion } : {}) }).catch(() => undefined);
 }
 function getIndexedVersionsImpl(mailboxUid, entityUids) {
     return call("indexedVersions", { mailboxUid, entityUids });
@@ -318,8 +318,10 @@ export function removeLocalEntity(mailboxUid, entityUid) {
 }
 /** Re-points one indexed message at its new folder (archive, cancel-scheduled-send) so `folder:`-scoped
  * local searches stay correct. Same no-op/never-rejects rules as `removeLocalEntity()`. */
-export function moveLocalEntity(mailboxUid, entityUid, folderUid) {
-    return currentTransport.moveEntity(mailboxUid, entityUid, folderUid);
+export function moveLocalEntity(mailboxUid, entityUid, folderUid, entityVersion) {
+    return entityVersion !== undefined
+        ? currentTransport.moveEntity(mailboxUid, entityUid, folderUid, entityVersion)
+        : currentTransport.moveEntity(mailboxUid, entityUid, folderUid);
 }
 export function getIndexedVersions(mailboxUid, entityUids) {
     return currentTransport.indexedVersions(mailboxUid, entityUids);

package/dist/apps/shared/search/localIndexSchema.d.ts

@@ -62,7 +62,7 @@ export interface LocalIndexEntity {
 /** `entity_uid` upsert - `ON CONFLICT` (SQLite's UPSERT syntax) rather than a separate delete-then-insert,
  * so re-indexing an already-present message (a flag changed, a folder move) updates it in place and the
  * `entities_au` trigger keeps `entities_fts` in sync automatically. */
-export declare const UPSERT_ENTITY_SQL = "\nINSERT INTO entities (entity_type, entity_uid, mailbox_uid, folder_uid, date_for_sort, participants, flags, has_attachments, subject, body, attachment_text, byte_size, entity_version)\nVALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)\nON CONFLICT(entity_uid) DO UPDATE SET\n    folder_uid = excluded.folder_uid, date_for_sort = excluded.date_for_sort, participants = excluded.participants,\n    flags = excluded.flags, has_attachments = excluded.has_attachments, subject = excluded.subject,\n    body = excluded.body, attachment_text = excluded.attachment_text, byte_size = excluded.byte_size,\n    entity_version = excluded.entity_version\n";
+export declare const UPSERT_ENTITY_SQL = "\nINSERT INTO entities (entity_type, entity_uid, mailbox_uid, folder_uid, date_for_sort, participants, flags, has_attachments, subject, body, attachment_text, byte_size, entity_version)\nVALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)\nON CONFLICT(entity_uid) DO UPDATE SET\n    folder_uid = COALESCE(excluded.folder_uid, entities.folder_uid), date_for_sort = excluded.date_for_sort, participants = excluded.participants,\n    flags = CASE WHEN excluded.flags = '' THEN entities.flags ELSE excluded.flags END, has_attachments = excluded.has_attachments, subject = excluded.subject,\n    body = excluded.body, attachment_text = excluded.attachment_text, byte_size = excluded.byte_size,\n    entity_version = excluded.entity_version\n";
 /** Bind values for `UPSERT_ENTITY_SQL`, in column order - kept alongside it so the two can never drift
  * out of sync with each other. */
 export declare function entityBindValues(entity: LocalIndexEntity): (string | number)[];

package/dist/apps/shared/search/localIndexSchema.js

@@ -91,8 +91,8 @@ export const UPSERT_ENTITY_SQL = `
 INSERT INTO entities (entity_type, entity_uid, mailbox_uid, folder_uid, date_for_sort, participants, flags, has_attachments, subject, body, attachment_text, byte_size, entity_version)
 VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
 ON CONFLICT(entity_uid) DO UPDATE SET
-    folder_uid = excluded.folder_uid, date_for_sort = excluded.date_for_sort, participants = excluded.participants,
-    flags = excluded.flags, has_attachments = excluded.has_attachments, subject = excluded.subject,
+    folder_uid = COALESCE(excluded.folder_uid, entities.folder_uid), date_for_sort = excluded.date_for_sort, participants = excluded.participants,
+    flags = CASE WHEN excluded.flags = '' THEN entities.flags ELSE excluded.flags END, has_attachments = excluded.has_attachments, subject = excluded.subject,
     body = excluded.body, attachment_text = excluded.attachment_text, byte_size = excluded.byte_size,
     entity_version = excluded.entity_version
 `;

package/dist/apps/shared/search/localIndexTransport.d.ts

@@ -52,7 +52,8 @@ export interface LocalIndexTransport {
     /** Drops one indexed entity. */
     removeEntity(mailboxUid: string, entityUid: string): Promise<void>;
     /** Re-points one indexed entity at its new folder. */
-    moveEntity(mailboxUid: string, entityUid: string, folderUid: string): Promise<void>;
+    /** `entityVersion`, when given, is recorded with the folder (a transport that can't record it leaves the row's version cleared). */
+    moveEntity(mailboxUid: string, entityUid: string, folderUid: string, entityVersion?: string): Promise<void>;
     /** The indexed version marker (`Message.version` + folder) currently stored for each of the given entity uids. */
     indexedVersions(mailboxUid: string, entityUids: string[]): Promise<Record<string, string>>;
     /** Removes indexed rows outside `keepEntityUids` (and `since`/`options.folderUids`'s own scope). Returns how many rows were pruned. */

package/dist/apps/shared/search/localIndexWorker.d.ts

@@ -62,6 +62,8 @@ export interface MoveEntityParams {
     mailboxUid: string;
     entityUid: string;
     folderUid: string;
+    /** Recorded as the row's `entity_version`; cleared (the row then counts as changed) when absent. */
+    entityVersion?: string;
 }
 export interface IndexedVersionsParams {
     mailboxUid: string;