@rapidmx/web-client 0.35.0 → 0.37.0

package/dist/apps/shared/components/contacts/ContactForm.d.ts

@@ -17,4 +17,7 @@ export interface ContactFormProps {
  * mobile detail route's own edit mode (`apps/www/contacts/[uid].tsx`) — creation itself stays
  * desktop-and-mobile-inline (see that route's own doc comment on why "new" never gets a dedicated route).
  */
-export default function ContactForm({ contact, mailboxUid, folderUid, mailboxes, onSaved, onCancel }: ContactFormProps): React.JSX.Element;
+/** The form for `props.contact` opened in full - its fields are read once, when it mounts, so it waits for a protected contact to open. One
+ * that can't be opened here (the mailbox is locked, or this device has no key for it) is never edited: its form would hold placeholders,
+ * and saving them would replace - or clear for good - the real details. */
+export default function ContactForm(props: ContactFormProps): React.JSX.Element;

package/dist/apps/shared/components/contacts/ContactForm.js

@@ -15,6 +15,8 @@ import { useApiClient } from "../../../../lib/util/apiClientContext.js";
 import { useContactPhotoSrc } from "../../../../lib/contacts/useContactPhotoSrc.js";
 import { findWellKnownFolderUid } from "../../mail/findWellKnownFolderUid.js";
 import { clearPinnedSignerCache } from "../mail/pinnedSigners.js";
+import { useOpenedRecord } from "../../zeroAccess/useOpenedRecord.js";
+import { isOpenedRecord, isProtectedRecord, openSealedRecord, protectedRecordWrite } from "../../../../lib/zeroAccess/sealedRecords.js";
 const INPUT_CLASS = "w-full text-sm py-2 px-3 border border-border rounded-sm bg-surface text-text focus:outline-none focus:border-primary";
 const SELECT_CLASS = "text-sm py-2 px-2 border border-border rounded-sm bg-surface text-text focus:outline-none focus:border-primary";
 const ADDRESS_KINDS = ["home", "work", "other"];
@@ -23,8 +25,30 @@ const ADDRESS_KINDS = ["home", "work", "other"];
  * mobile detail route's own edit mode (`apps/www/contacts/[uid].tsx`) — creation itself stays
  * desktop-and-mobile-inline (see that route's own doc comment on why "new" never gets a dedicated route).
  */
-export default function ContactForm({ contact, mailboxUid, folderUid, mailboxes, onSaved, onCancel }) {
+/** The form for `props.contact` opened in full - its fields are read once, when it mounts, so it waits for a protected contact to open. One
+ * that can't be opened here (the mailbox is locked, or this device has no key for it) is never edited: its form would hold placeholders,
+ * and saving them would replace - or clear for good - the real details. */
+export default function ContactForm(props) {
+    const { record, ready } = useOpenedRecord(props.contact);
+    // Bumped by the view's "Reload" to fill it again from the contact as it is now.
+    const [reloads, setReloads] = useState(0);
+    if (!ready) {
+        return _jsx("p", { className: "text-sm text-text-muted", children: "Opening this contact\u2026" });
+    }
+    if (isProtectedRecord(record) && !isOpenedRecord(record)) {
+        return (_jsxs("div", { className: "flex max-w-xl flex-col items-start gap-3 p-6", children: [_jsx("p", { role: "status", className: "text-sm", children: "This contact is protected and can\u2019t be edited while your mailbox is locked. Unlock it to edit." }), _jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", onClick: props.onCancel, children: "Back" })] }));
+    }
+    // The server answers a save with the protected details sealed: what goes back is opened again.
+    const onSaved = (saved) => void openSealedRecord(saved).then(props.onSaved);
+    // Another contact is another form: its fields are filled from it.
+    return _jsx(ContactFormView, { ...props, contact: record, onSaved: onSaved, onReload: () => setReloads((n) => n + 1) }, `${record?.uid ?? ""}:${reloads}`);
+}
+function ContactFormView({ contact, mailboxUid, folderUid, mailboxes, onSaved, onCancel, onReload }) {
     const client = useApiClient();
+    // The contact as the form was filled from. A live update hands the open form the contact as changed elsewhere (`contact`), but the fields
+    // still hold this one's values: an update is sent at this version, and compared with it, so that change is refused (409) - never
+    // overwritten with what the form still shows.
+    const [seeded] = useState(contact);
     const currentPhotoUrl = useContactPhotoSrc(contact, client);
     const [targetMailboxUid, setTargetMailboxUid] = useState(mailboxUid);
     const [displayName, setDisplayName] = useState(contact?.displayName ?? "");
@@ -48,7 +72,7 @@ export default function ContactForm({ contact, mailboxUid, folderUid, mailboxes,
     const [error, setError] = useState(null);
     const [saving, setSaving] = useState(false);
     // The contact as stored, once it has been saved and only the picture is left to do (that is a second request, which can fail on its own):
-    // a retry must not create the contact again or send the version it started from. `key` is the form's content that was saved.
+    // a retry must not create the contact again or send the version it started from. `key` is the form's content that was saved, `input` its fields.
     const [stored, setStored] = useState(null);
     function updateEmail(index, patch) {
         setEmails((prev) => prev.map((e, i) => (i === index ? { ...e, ...patch } : e)));
@@ -83,7 +107,7 @@ export default function ContactForm({ contact, mailboxUid, folderUid, mailboxes,
                 .filter(Boolean);
             // An update merges only the fields in its body, so a field the user cleared is sent as an
             // explicit `null` (an omitted/undefined one would keep its stored value); a create just omits it.
-            const existing = stored?.contact ?? contact;
+            const existing = stored?.contact ?? seeded;
             const cleared = existing ? null : undefined;
             const input = {
                 displayName: displayName.trim(),
@@ -106,10 +130,13 @@ export default function ContactForm({ contact, mailboxUid, folderUid, mailboxes,
                 saved = stored.contact;
             }
             else if (existing) {
+                // A protected contact's details go only when they changed from what the form was shown (or last saved): the server stores
+                // them sealed and can't tell an unchanged value from a new one.
+                const shown = seeded && (stored?.input ? { ...seeded, ...stored.input } : seeded);
                 saved = await updateContact({
                     uid: existing.uid,
                     version: existing.version,
-                    ...input,
+                    ...protectedRecordWrite(shown, input, isOpenedRecord(seeded)),
                 }, client);
             }
             else {
@@ -126,7 +153,7 @@ export default function ContactForm({ contact, mailboxUid, folderUid, mailboxes,
                     ...input,
                 }, client);
             }
-            setStored({ contact: saved, key });
+            setStored({ contact: saved, key, input });
             const changePhoto = async (current) => {
                 if (pickedPhoto) {
                     return uploadContactPhoto(current.uid, current.version, pickedPhoto, client);
@@ -143,7 +170,7 @@ export default function ContactForm({ contact, mailboxUid, folderUid, mailboxes,
                     }
                     // A version that is stale means an earlier try had been applied after all (its answer never arrived): read the contact as it is and go again, once.
                     const current = await getContact(saved.uid, client);
-                    setStored({ contact: current, key });
+                    setStored({ contact: current, key, input });
                     saved = await changePhoto(current);
                 }
             }
@@ -162,12 +189,15 @@ export default function ContactForm({ contact, mailboxUid, folderUid, mailboxes,
             setSaving(false);
         }
     }
+    // Changed elsewhere since the form was filled (or last saved): a save would be refused.
+    const baseline = stored?.contact ?? seeded;
+    const changedElsewhere = !!contact && !!baseline && contact.version > baseline.version;
     function finish(saved) {
         // A message opened later in this page load must see the changed contact's signing keys.
         clearPinnedSignerCache();
         onSaved(saved);
     }
-    return (_jsxs("form", { onSubmit: handleSubmit, className: "@container flex min-h-0 flex-1 flex-col", children: [_jsx("div", { className: "min-h-0 flex-1 overflow-y-auto p-6", children: _jsxs("div", { className: "flex max-w-xl flex-col gap-1", children: [_jsx("h1", { className: "text-xl font-bold uppercase tracking-wide mb-3", children: contact ? "Edit contact" : "New contact" }), error && _jsx(Alert, { children: error }), !contact && mailboxes && mailboxes.length > 1 && (_jsx(FormField, { label: "Mailbox", htmlFor: "contact-mailbox", children: _jsx("select", { id: "contact-mailbox", className: `${SELECT_CLASS} w-full`, value: targetMailboxUid, onChange: (e) => setTargetMailboxUid(e.target.value), children: mailboxes.map((mb) => (_jsxs("option", { value: mb.uid, children: [mb.displayName, mb.ownerUserUid ? "" : " (shared)"] }, mb.uid))) }) })), _jsx(FormField, { label: "Display name", htmlFor: "contact-displayName", children: _jsx("input", { id: "contact-displayName", type: "text", className: INPUT_CLASS, value: displayName, onChange: (e) => setDisplayName(e.target.value) }) }), _jsxs("div", { className: "flex items-start gap-2", children: [_jsx("div", { className: "min-w-0 flex-1", children: _jsx(ContactPhotoField, { displayName: displayName, email: emails[0]?.address, currentUrl: currentPhotoUrl, picked: pickedPhoto, removed: removePhoto, onPick: (file) => {
+    return (_jsxs("form", { onSubmit: handleSubmit, className: "@container flex min-h-0 flex-1 flex-col", children: [_jsx("div", { className: "min-h-0 flex-1 overflow-y-auto p-6", children: _jsxs("div", { className: "flex max-w-xl flex-col gap-1", children: [_jsx("h1", { className: "text-xl font-bold uppercase tracking-wide mb-3", children: contact ? "Edit contact" : "New contact" }), error && _jsx(Alert, { children: error }), changedElsewhere && (_jsxs("div", { role: "status", className: "mb-3 flex flex-wrap items-center gap-3 text-sm", children: [_jsx("span", { children: "This contact was changed elsewhere while you were editing it, so saving would be refused. Reload it to edit the changed contact - what you typed here is lost." }), _jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", disabled: saving, onClick: onReload, children: "Reload" })] })), !contact && mailboxes && mailboxes.length > 1 && (_jsx(FormField, { label: "Mailbox", htmlFor: "contact-mailbox", children: _jsx("select", { id: "contact-mailbox", className: `${SELECT_CLASS} w-full`, value: targetMailboxUid, onChange: (e) => setTargetMailboxUid(e.target.value), children: mailboxes.map((mb) => (_jsxs("option", { value: mb.uid, children: [mb.displayName, mb.ownerUserUid ? "" : " (shared)"] }, mb.uid))) }) })), _jsx(FormField, { label: "Display name", htmlFor: "contact-displayName", children: _jsx("input", { id: "contact-displayName", type: "text", className: INPUT_CLASS, value: displayName, onChange: (e) => setDisplayName(e.target.value) }) }), _jsxs("div", { className: "flex items-start gap-2", children: [_jsx("div", { className: "min-w-0 flex-1", children: _jsx(ContactPhotoField, { displayName: displayName, email: emails[0]?.address, currentUrl: currentPhotoUrl, picked: pickedPhoto, removed: removePhoto, onPick: (file) => {
                                             setPickedPhoto(file);
                                             setRemovePhoto(false);
                                             setError(null);

package/dist/apps/shared/components/contacts/KeyChangeReview.d.ts

@@ -6,6 +6,8 @@ export interface KeyChangeReviewProps {
     /** The contact's address `resolveKeyConflict()` looks the contact up by; absent hides the actions. */
     address?: string;
     useType: "sign" | "encrypt";
+    /** `"openpgp"` for an OpenPGP certificate (pinned as `useType: "encrypt"`; it signs too); omitted for an S/MIME certificate. */
+    keyType?: "openpgp";
     /** Who the key belongs to, for the advice ("confirm with <name>"). */
     ownerName: string;
     /** The currently pinned key and when it was first trusted; absent (couldn't be loaded) hides the actions. */
@@ -37,4 +39,4 @@ export interface KeyChangeReviewProps {
  * key, calling `resolveKeyConflict()` against the pinned fingerprint shown. Shared by a message's "signing key changed"
  * notice and a contact's recorded key conflicts.
  */
-export default function KeyChangeReview({ mailboxUid, address, useType, ownerName, current, proposed, certificate, canReject, canResolve, onResolved, onPinnedKeyChanged, }: KeyChangeReviewProps): React.JSX.Element;
+export default function KeyChangeReview({ mailboxUid, address, useType, keyType, ownerName, current, proposed, certificate, canReject, canResolve, onResolved, onPinnedKeyChanged, }: KeyChangeReviewProps): React.JSX.Element;

package/dist/apps/shared/components/contacts/KeyChangeReview.js

@@ -15,12 +15,12 @@ import { conflictSourceLabel, formatDate, groupFingerprint, keyChangeErrorMessag
  * key, calling `resolveKeyConflict()` against the pinned fingerprint shown. Shared by a message's "signing key changed"
  * notice and a contact's recorded key conflicts.
  */
-export default function KeyChangeReview({ mailboxUid, address, useType, ownerName, current, proposed, certificate, canReject, canResolve, onResolved, onPinnedKeyChanged, }) {
+export default function KeyChangeReview({ mailboxUid, address, useType, keyType, ownerName, current, proposed, certificate, canReject, canResolve, onResolved, onPinnedKeyChanged, }) {
     const [confirmOpen, setConfirmOpen] = useState(false);
     const [busy, setBusy] = useState(null);
     const [error, setError] = useState(null);
     const [forbidden, setForbidden] = useState(false);
-    const kind = useType === "sign" ? "signing" : "encryption";
+    const kind = keyType === "openpgp" ? "OpenPGP" : useType === "sign" ? "signing" : "encryption";
     const actionable = !!address && !!current && canResolve !== false && !forbidden;
     async function resolve(action) {
         setBusy(action);
@@ -32,6 +32,7 @@ export default function KeyChangeReview({ mailboxUid, address, useType, ownerNam
                 action,
                 expectedPinnedFingerprint: current.fingerprint,
                 ...(action === "accept" && certificate !== undefined ? { certificate } : {}),
+                ...(keyType ? { type: keyType } : {}),
             });
             setConfirmOpen(false);
             onResolved(action);

package/dist/apps/shared/components/contacts/contactCardData.js

@@ -9,14 +9,16 @@
  */
 import { addDays } from "date-fns";
 import { listCalendarEvents } from "../../../../lib/calendar/calendarApi.js";
+import { openSealedEvents } from "../../calendar/sealedEvents.js";
 import { expandAllOccurrences } from "../../../../lib/calendar/recurrence.js";
-import { createContact, listContactsInFolders } from "../../../../lib/contacts/contactsApi.js";
+import { CONTACT_MATCH_FIELDS, createContact, listContactsInFolders } from "../../../../lib/contacts/contactsApi.js";
 import { parseVCards } from "../../../../lib/contacts/vcard.js";
 import { attachmentContentUrl, getMessage, listAttachments, listFolders, } from "../../../../lib/mail/mailApi.js";
 import { search } from "../../../../lib/search/searchApi.js";
 import { ApiRequestError } from "../../../../lib/util/api.js";
 import { ownMailboxes, primaryMailbox } from "../../mail/primaryMailbox.js";
 import { cardForAddress, contactInputFor, contactInputFromCard, findContactByAddress, isVCardAttachment, normalizeAddress, ownContactCard, withoutDuplicates, } from "./participantDetails.js";
+import { openSealedRecord, openSealedRecords } from "../../../../lib/zeroAccess/sealedRecords.js";
 /** How many recent messages and upcoming events the card lists. */
 export const CARD_LIST_SIZE = 5;
 /** How far ahead "upcoming" looks, in days. */
@@ -39,7 +41,9 @@ export async function loadFolders(mailboxes, client) {
 /** The contact the address belongs to in `folders`' contacts folders, if any. */
 export async function findContact(folders, address, client) {
     const uids = folders.filter((folder) => folder.type === "contacts").map((folder) => folder.uid);
-    return findContactByAddress(await listContactsInFolders(uids, client), address);
+    const found = findContactByAddress(await listContactsInFolders(uids, client), address);
+    // The card shows the one contact in full.
+    return found && (await openSealedRecord(found));
 }
 /** The last `CARD_LIST_SIZE` messages to or from `address` in `mailboxes`, newest first. */
 export async function loadRecentMessages(mailboxes, address, client) {
@@ -53,7 +57,7 @@ export async function loadRecentMessages(mailboxes, address, client) {
 export async function loadUpcomingEvents(folders, address, now, client) {
     const wanted = normalizeAddress(address);
     const calendars = folders.filter((folder) => folder.type === "calendar");
-    const lists = await Promise.all(calendars.map((folder) => listCalendarEvents(folder.uid, client)));
+    const lists = await Promise.all(calendars.map((folder) => listCalendarEvents(folder.uid, client).then(openSealedEvents)));
     const involved = lists
         .flat()
         .filter((event) => event.status !== "cancelled" &&
@@ -138,7 +142,7 @@ export async function buildOwnCardFile(mailbox, mailboxes, userUid, client) {
  * card's in the same file). A card that cannot be stored fails the whole call after the earlier ones were added - `AddCardsError` says how many.
  */
 export async function addCardsToAddressBook(cards, scope, client) {
-    const { fresh, skipped } = withoutDuplicates(cards, await listContactsInFolders([scope.folderUid], client));
+    const { fresh, skipped } = withoutDuplicates(cards, await openSealedRecords(await listContactsInFolders([scope.folderUid], client), CONTACT_MATCH_FIELDS));
     let added = 0;
     for (const card of fresh) {
         try {

package/dist/apps/shared/components/contacts/contactKeys.d.ts

@@ -23,7 +23,7 @@ type ContactWithFirstSeen = Pick<Contact, "previousKeys"> & {
     keysFirstSeen?: number;
 };
 /** When `key` (one of `contact`'s pinned keys) started being trusted: when it replaced the newest previous key of its
- * use, else the contact's `keysFirstSeen`, else the key's own `notBefore`. */
+ * use and format, else the contact's `keysFirstSeen`, else the key's own `notBefore`. */
 export declare function keyPinnedSince(contact: ContactWithFirstSeen, key: PublicKey): number;
 export declare function formatDate(ms: number): string;
 export {};

package/dist/apps/shared/components/contacts/contactKeys.js

@@ -5,7 +5,7 @@
 /** Display and error helpers for a contact's pinned keys and key changes (`KeyChangeReview`, `ContactDetailPane`,
  * `MessageDetailPane`). */
 import { ApiRequestError } from "../../../../lib/util/api.js";
-import { PinnedKeyChangedError } from "../../../../lib/crypto/keyvaultApi.js";
+import { keyFormat, PinnedKeyChangedError } from "../../../../lib/crypto/keyvaultApi.js";
 export const KEY_CHANGE_STALE_MESSAGE = "This contact's keys changed while you were looking; reload to see the latest.";
 export const KEY_CHANGE_INVALID_MESSAGE = "The new key isn't a valid, current certificate for this address, so it can't be accepted. Nothing was changed.";
 export const KEY_CHANGE_FORBIDDEN_MESSAGE = "You don't have permission to change this contact's keys.";
@@ -51,9 +51,9 @@ export function conflictSourceLabel(source) {
     return source === "header" ? "from an incoming message" : "by key discovery";
 }
 /** When `key` (one of `contact`'s pinned keys) started being trusted: when it replaced the newest previous key of its
- * use, else the contact's `keysFirstSeen`, else the key's own `notBefore`. */
+ * use and format, else the contact's `keysFirstSeen`, else the key's own `notBefore`. */
 export function keyPinnedSince(contact, key) {
-    const replaced = (contact.previousKeys ?? []).filter((previous) => previous.useType === key.useType).map((previous) => previous.replacedAt);
+    const replaced = (contact.previousKeys ?? []).filter((previous) => previous.useType === key.useType && keyFormat(previous) === keyFormat(key)).map((previous) => previous.replacedAt);
     if (replaced.length > 0) {
         return Math.max(...replaced);
     }

package/dist/apps/shared/components/layout/AppShell.d.ts

@@ -40,6 +40,23 @@ export interface AppShellProps extends PluginNavProps {
     branding?: Branding;
     /** The signed-in user's stored appearance preferences as the server rendered the page (its `appearance` prop), so the first paint already wears the theme and background - see `AppearanceProvider`. */
     appearance?: unknown;
+    /** A host that signs its account out itself - see `ShellSignOutHost`. Absent (the webmail), "Sign out" ends the one session this
+     * origin holds. */
+    signOutHost?: ShellSignOutHost;
+}
+/**
+ * How a host that keeps several accounts in one page (`tauri-client`: one webview, one key session, one local-index storage for all of
+ * them) signs out the account whose shell is mounted. The shell's own sign-out assumes one user per origin: it destroys every
+ * mailbox's unlocked keys and every local index on the device, posts auth-server's cookie logout and navigates to auth-server. With a
+ * host, "Sign out" still marks compose as signing out, clears this session's caches and notifications and saves open compose windows,
+ * but leaves the keys, the indexes, the logout and where to go next to the host.
+ */
+export interface ShellSignOutHost {
+    /** Called first, where the shell would destroy every mailbox's unlocked keys: destroys the signing-out account's. */
+    destroyKeys(): void;
+    /** Called once open compose windows are saved: destroys the account's local indexes, ends its session and leaves the page. Should
+     * not reject; a rejection is logged. */
+    finish(): Promise<void>;
 }
 export interface AppDef {
     id: AppShellApp;
@@ -67,7 +84,7 @@ export interface AppChromeProps extends AppShellProps {
  * Rendered by the webmail's app shell (`apps/www/_shell.tsx`, the router's persistent client layout), once, for the life of the
  * page, so that moving between apps replaces only `children` - see `AppShell` below for what a page's own shell renders instead.
  */
-export declare function AppChrome({ active, userUid, authServerUrl, impersonating, impersonationBaseUrl, trusted, trustedRoles, branding: initialBranding, appearance, pluginNav, busy, hideChrome, children, }: PropsWithChildren<AppChromeProps>): React.JSX.Element;
+export declare function AppChrome({ active, userUid, authServerUrl, impersonating, impersonationBaseUrl, trusted, trustedRoles, branding: initialBranding, appearance, pluginNav, busy, hideChrome, signOutHost, children, }: PropsWithChildren<AppChromeProps>): React.JSX.Element;
 /**
  * What a page's own shell (`MailShell`, `CalendarShell`, ...) renders around its content. Outside the client-side router it
  * is the whole `AppChrome`, as it always was. Inside it (the router's app shell, `apps/www/_shell.tsx`) the chrome is already mounted above the

package/dist/apps/shared/components/layout/AppShell.js

@@ -100,7 +100,7 @@ export function appRailItems(pluginNav, resolved = {}) {
  * Rendered by the webmail's app shell (`apps/www/_shell.tsx`, the router's persistent client layout), once, for the life of the
  * page, so that moving between apps replaces only `children` - see `AppShell` below for what a page's own shell renders instead.
  */
-export function AppChrome({ active, userUid, authServerUrl, impersonating, impersonationBaseUrl, trusted, trustedRoles, branding: initialBranding, appearance, pluginNav, busy, hideChrome, children, }) {
+export function AppChrome({ active, userUid, authServerUrl, impersonating, impersonationBaseUrl, trusted, trustedRoles, branding: initialBranding, appearance, pluginNav, busy, hideChrome, signOutHost, children, }) {
     const client = useApiClient();
     const [stoppingImpersonation, setStoppingImpersonation] = useState(false);
     // The keyboard shortcuts dialog: opened by `?`/Ctrl+/ (`GlobalShortcuts`) and by the account menu's item.
@@ -168,9 +168,10 @@ export function AppChrome({ active, userUid, authServerUrl, impersonating, imper
     // own, so this is what actually removes the indexes after a console sign-out (the console also records a
     // pending deletion, retried on the next mail load, in case no mail tab is open). `destroyAllLocalIndexes()`
     // announces the sign-out on this same channel, which this tab then hears itself, so the ref is set first:
-    // each tab reacts once, and the tab that started the sign-out ignores its own announcement.
+    // each tab reacts once, and the tab that started the sign-out ignores its own announcement. A host that signs out itself
+    // (`signOutHost`) keeps other accounts in this origin, so another tab's sign-out isn't this one's.
     useEffect(() => {
-        if (!userUid || typeof BroadcastChannel === "undefined") {
+        if (!userUid || signOutHost || typeof BroadcastChannel === "undefined") {
             return;
         }
         const channel = new BroadcastChannel(SIGN_OUT_CHANNEL);
@@ -193,14 +194,19 @@ export function AppChrome({ active, userUid, authServerUrl, impersonating, imper
             });
         });
         return () => channel.close();
-    }, [userUid, authServerUrl]);
+    }, [userUid, authServerUrl, signOutHost]);
     async function handleSignOut() {
         signingOutRef.current = true;
         // Before flushing and navigating: compose windows then skip their "Leave site?" prompt, which could
         // otherwise cancel the sign-out's own navigation.
         markSigningOut();
-        // Unlocked private keys never outlive an explicit sign-out.
-        destroyUnlockedKeys();
+        // Unlocked private keys never outlive an explicit sign-out - only the signing-out account's where a host keeps others.
+        if (signOutHost) {
+            signOutHost.destroyKeys();
+        }
+        else {
+            destroyUnlockedKeys();
+        }
         // Trusted signer pins read from contacts don't outlive the session either.
         clearPinnedSignerCache();
         clearAppearanceCache();
@@ -209,6 +215,11 @@ export function AppChrome({ active, userUid, authServerUrl, impersonating, imper
         // Open compose windows save edits still waiting on their autosave debounce while the session is still
         // valid - logout invalidates it. Bounded the same way as logout itself, and never rejects.
         await flushComposeDrafts(LOGOUT_TIMEOUT_MS);
+        if (signOutHost) {
+            // The host destroys its account's indexes (spec §11) and ends its session; this page can't tell its accounts apart.
+            await signOutHost.finish().catch((err) => console.warn("The host's sign-out failed:", err));
+            return;
+        }
         // The Tier 2 local index MUST be destroyed on explicit logout, the same as unlocked keys themselves
         // (spec §11). Destroys every index on this device (not only mailboxes opened this page load) and is
         // awaited before navigating - a navigation tears down the Worker mid-delete otherwise.

package/dist/apps/shared/components/layout/KeyEnrollmentGate.js

@@ -12,7 +12,9 @@ import { enrollKey, getKeyVault, VaultAlreadyInitializedError } from "../../../.
 import { UnopenableKeysNotice, unlockErrorMessage } from "./UnlockPromptProvider.js";
 import { FrameTakeover } from "../../navigation/frameContext.js";
 import { MIN_PASSWORD_LENGTH, RecoveryFollowUpModal, UnlockModeToggle, startRecoveryUnlock, } from "./RecoveryCodeUnlock.js";
-import { ENCRYPTION_PRIVATE_KEY_AAD_PURPOSE, getUnlockedKeys, unlockWithPassword, } from "../../../../lib/crypto/keySession.js";
+import { ENCRYPTION_PRIVATE_KEY_AAD_PURPOSE, getUnlockedKeys, subscribeKeySession, unlockWithPassword, } from "../../../../lib/crypto/keySession.js";
+import { ensureZeroAccessKey, provisionZeroAccessKey } from "../../../../lib/crypto/zeroAccessKey.js";
+import { ensureOpenPgpKey } from "../../../../lib/crypto/openPgpKey.js";
 import { buildAad, generateMasterKey, sealWithKey } from "../../../../lib/crypto/masterKey.js";
 import { buildPasswordWrap, buildRecoveryWraps } from "../../../../lib/crypto/masterKeyWraps.js";
 import { exportPrivateKeyPkcs8, generateKeyPairWithCsr } from "../../../../lib/crypto/keys.js";
@@ -27,12 +29,15 @@ async function provisionEncryptionKey(mailboxUid, mailboxAddress, password) {
     const { keyPair, csrPem } = await generateKeyPairWithCsr(mailboxAddress, "encrypt");
     const privateKeyRaw = await exportPrivateKeyPkcs8(keyPair.privateKey);
     const wrappedKeySealed = await sealWithKey(mk, privateKeyRaw, buildAad(mailboxUid, ENCRYPTION_PRIVATE_KEY_AAD_PURPOSE));
-    await enrollKey(mailboxUid, {
+    const vault = await enrollKey(mailboxUid, {
         useType: "encrypt",
         csr: csrPem,
         wrappedKey: { ciphertext: wrappedKeySealed.ciphertext, nonce: wrappedKeySealed.nonce, algorithm: "AES-256-GCM" },
         masterKeyWraps: [passwordWrap, ...recoveryWraps],
     });
+    // The zero-access key (restapi specs/search.md §3), under the same master key. Not fatal: setup is done once the
+    // encryption key is in, and a mailbox without a zero-access key gets one on its next unlock (`ensureZeroAccessKey()`).
+    await provisionZeroAccessKey(mailboxUid, mailboxAddress, mk, vault.masterKeyGeneration).catch(() => undefined);
     return { recoveryCodes };
 }
 /**
@@ -90,6 +95,26 @@ export default function KeyEnrollmentGate({ mailboxUid, mailboxAddress, mailboxK
             cancelled = true;
         };
     }, [mailboxUid, canProvision]);
+    // A mailbox set up before zero-access encryption existed has no zero-access key, and one set up before OpenPGP was supported
+    // has no OpenPGP key (restapi specs/end-to-end_encryption.md *OpenPGP Interoperability*): give it each whenever its owner has
+    // it unlocked - now, or on a later unlock from anywhere (this gate, an unlock prompt, recovery, first-time setup). Best
+    // effort: a failure is retried on the next unlock.
+    useEffect(() => {
+        if (!mailboxUid || !mailboxAddress || !canProvision) {
+            return;
+        }
+        // One after the other: both enrollments update the vault, which a concurrent write would refuse (409).
+        const ensure = () => void ensureZeroAccessKey(mailboxUid, mailboxAddress)
+            .catch(() => undefined)
+            .then(() => ensureOpenPgpKey(mailboxUid, mailboxAddress))
+            .catch(() => undefined);
+        ensure();
+        return subscribeKeySession((event) => {
+            if (event.mailboxUid === mailboxUid && event.state === "unlocked") {
+                ensure();
+            }
+        });
+    }, [mailboxUid, mailboxAddress, canProvision]);
     async function handleUnlock(e) {
         e.preventDefault();
         setError(null);

package/dist/apps/shared/components/layout/SharedMailboxKeyManager.d.ts

@@ -0,0 +1,17 @@
+import type { Mailbox } from "../../../../lib/mail/mailApi.js";
+/** How often the shared mailboxes are looked after again while some own mailbox stays unlocked. */
+export declare const SHARED_MAILBOX_CHECK_INTERVAL_MS: number;
+/** Forgets which refused rotations were shown (tests). */
+export declare function resetSharedMailboxKeyManager(): void;
+export interface SharedMailboxKeyManagerProps {
+    /** Every mailbox the user can open. */
+    mailboxes: Mailbox[];
+    userUid?: string;
+}
+/**
+ * Looks after the zero-access keys of the user's shared mailboxes (`lib/crypto/sharedMailboxKeys.ts`) whenever a mailbox of their own is
+ * unlocked, and every `SHARED_MAILBOX_CHECK_INTERVAL_MS` after that: opens each mailbox shared with them through their member key wraps (no
+ * password), and - for a mailbox they own or manage - provisions, rotates and shares its key with members still waiting. Best effort and
+ * silent (a pass that fails is tried again on the next), except for a rotation the server refuses, shown once as a warning. Renders nothing; mounted by `MailShell`.
+ */
+export default function SharedMailboxKeyManager({ mailboxes, userUid }: SharedMailboxKeyManagerProps): null;

package/dist/apps/shared/components/layout/SharedMailboxKeyManager.js

@@ -0,0 +1,98 @@
+///////////////////////////////////////////////////////////////////////////////
+// Copyright (C) 2026 Jean-Philippe Steinmetz
+// SPDX-License-Identifier: MPL-2.0
+///////////////////////////////////////////////////////////////////////////////
+import { useEffect, useRef } from "react";
+import { getUnlockedKeys, personallyUnlockedKeys, subscribeKeySession } from "../../../../lib/crypto/keySession.js";
+import { useApiClient } from "../../../../lib/util/apiClientContext.js";
+import { notify } from "../../notifications/store.js";
+/** How often the shared mailboxes are looked after again while some own mailbox stays unlocked. */
+export const SHARED_MAILBOX_CHECK_INTERVAL_MS = 5 * 60 * 1000;
+/** The shared mailbox key code (pkijs and friends), loaded only once an own mailbox is unlocked. */
+let loaded;
+const loadSharedKeys = () => (loaded ?? (loaded = import("../../../../lib/crypto/sharedMailboxKeys.js").catch((err) => {
+    loaded = undefined;
+    throw err;
+})));
+/** The refused rotations already shown, per mailbox (the reason): each is shown once a session, not on every pass that retries it. */
+const shownRefusals = new Map();
+/** Forgets which refused rotations were shown (tests). */
+export function resetSharedMailboxKeyManager() {
+    shownRefusals.clear();
+}
+/**
+ * Looks after the zero-access keys of the user's shared mailboxes (`lib/crypto/sharedMailboxKeys.ts`) whenever a mailbox of their own is
+ * unlocked, and every `SHARED_MAILBOX_CHECK_INTERVAL_MS` after that: opens each mailbox shared with them through their member key wraps (no
+ * password), and - for a mailbox they own or manage - provisions, rotates and shares its key with members still waiting. Best effort and
+ * silent (a pass that fails is tried again on the next), except for a rotation the server refuses, shown once as a warning. Renders nothing; mounted by `MailShell`.
+ */
+export default function SharedMailboxKeyManager({ mailboxes, userUid }) {
+    const client = useApiClient();
+    const latest = useRef({ mailboxes, userUid, client });
+    latest.current = { mailboxes, userUid, client };
+    const running = useRef(false);
+    useEffect(() => {
+        async function pass() {
+            if (running.current || personallyUnlockedKeys().length === 0) {
+                return;
+            }
+            running.current = true;
+            try {
+                const { maintainSharedMailbox, unlockSharedMailbox } = await loadSharedKeys();
+                const { mailboxes: current, userUid: me, client: apiClient } = latest.current;
+                for (const mailbox of current) {
+                    await look(mailbox, me, apiClient, unlockSharedMailbox, maintainSharedMailbox).catch(() => undefined);
+                }
+            }
+            catch {
+                // Nothing to do until the next pass.
+            }
+            finally {
+                running.current = false;
+            }
+        }
+        void pass();
+        const unsubscribe = subscribeKeySession((event) => {
+            if (event.state === "unlocked" && !getUnlockedKeys(event.mailboxUid)?.shared) {
+                void pass();
+            }
+        });
+        const interval = setInterval(() => void pass(), SHARED_MAILBOX_CHECK_INTERVAL_MS);
+        return () => {
+            unsubscribe();
+            clearInterval(interval);
+        };
+    }, []);
+    return null;
+}
+async function look(mailbox, me, client, unlockSharedMailbox, maintainSharedMailbox) {
+    const owned = !!mailbox.ownerUserUid && mailbox.ownerUserUid === me;
+    if (!owned) {
+        // Opened, or - once open - opened again when a rotation left it without the active key.
+        await unlockSharedMailbox(mailbox.uid, client, true);
+    }
+    const unlocked = getUnlockedKeys(mailbox.uid);
+    // An owner looks after their mailbox with its own keys; a member, with full access, whether or not it is open yet (a mailbox
+    // without an owner may have no key to open).
+    if (owned ? unlocked && !unlocked.shared : true) {
+        const done = await maintainSharedMailbox(mailbox.uid, mailbox.primarySmtpAddress, client);
+        // The server kept the current key (its vault can't take the new key's member wraps): say so once, members keep reading.
+        if (done.rotationRefused && shownRefusals.get(mailbox.uid) !== done.rotationRefused) {
+            shownRefusals.set(mailbox.uid, done.rotationRefused);
+            notify({
+                kind: "warning",
+                title: `${mailbox.displayName || mailbox.primarySmtpAddress}: the zero-access key wasn't replaced`,
+                message: "A member has left, but the server refused a new key for this shared mailbox. The current key stays active.",
+                details: done.rotationRefused,
+                dedupeKey: `shared-rotation-refused:${mailbox.uid}`,
+            });
+        }
+        else if (!done.rotationRefused) {
+            shownRefusals.delete(mailbox.uid);
+        }
+        // A key this member just made (a mailbox without an owner) goes into their session now, not on the next pass.
+        if (!owned && (done.provisioned || done.rotated)) {
+            await unlockSharedMailbox(mailbox.uid, client, true);
+        }
+    }
+}

package/dist/apps/shared/components/layout/UnlockPromptProvider.d.ts

@@ -36,6 +36,9 @@ interface UnlockPromptContextValue {
  * mailbox happens to resolve - see `KeyEnrollmentGate`'s `blocking` prop, which `MailShell` now sets to
  * `false` for exactly this reason.
  */
+/** Messages for a shared mailbox `openShared()` can't open. */
+export declare const SHARED_ACCESS_PENDING_MESSAGE = "This mailbox is shared with you, and is waiting for another member to share its key with you. Try again shortly.";
+export declare const SHARED_OWN_KEYS_LOCKED_MESSAGE = "Unlock your own mailbox first: it holds the key that opens the mailboxes shared with you.";
 export declare function UnlockPromptProvider({ children }: {
     children: React.ReactNode;
 }): React.JSX.Element;

package/dist/apps/shared/components/layout/UnlockPromptProvider.js

@@ -9,6 +9,7 @@ import Modal from "../../../../lib/components/overlays/Modal.js";
 import Alert from "../../../../lib/components/feedback/Alert.js";
 import Button from "../../../../lib/components/buttons/Button.js";
 import FormField from "../../../../lib/components/forms/FormField.js";
+import { notify } from "../../notifications/store.js";
 import { RECOVERY_CODE_ERROR, RecoveryFollowUpModal, UnlockModeToggle, startRecoveryUnlock, } from "./RecoveryCodeUnlock.js";
 /** Shown instead of "Incorrect password" when the password was right but the mailbox's encryption key itself
  * won't open (`UnopenableEncryptionKeyError`) - retrying can't fix that, so it must not read as a typo. */
@@ -44,6 +45,33 @@ const UnlockPromptContext = createContext(null);
  * mailbox happens to resolve - see `KeyEnrollmentGate`'s `blocking` prop, which `MailShell` now sets to
  * `false` for exactly this reason.
  */
+/** Messages for a shared mailbox `openShared()` can't open. */
+export const SHARED_ACCESS_PENDING_MESSAGE = "This mailbox is shared with you, and is waiting for another member to share its key with you. Try again shortly.";
+export const SHARED_OWN_KEYS_LOCKED_MESSAGE = "Unlock your own mailbox first: it holds the key that opens the mailboxes shared with you.";
+/**
+ * Opens `mailboxUid` through the user's member key wraps when it is a mailbox shared with them (`sharedMailboxKeys.ts`): its keys, or
+ * `undefined` when it isn't one of theirs (the password prompt applies). Rejects, after saying why, when it is shared with them but can't
+ * open yet. The shared key code is loaded only here.
+ */
+async function openShared(mailboxUid) {
+    let outcome;
+    try {
+        const { unlockSharedMailbox } = await import("../../../../lib/crypto/sharedMailboxKeys.js");
+        outcome = await unlockSharedMailbox(mailboxUid);
+    }
+    catch {
+        return undefined;
+    }
+    if (outcome === "unlocked") {
+        return getUnlockedKeys(mailboxUid);
+    }
+    if (outcome === "pending" || outcome === "own_keys_locked") {
+        const message = outcome === "pending" ? SHARED_ACCESS_PENDING_MESSAGE : SHARED_OWN_KEYS_LOCKED_MESSAGE;
+        notify({ kind: "info", title: "Shared mailbox", message });
+        throw new Error(message);
+    }
+    return undefined;
+}
 export function UnlockPromptProvider({ children }) {
     const [pending, setPendingState] = useState(null);
     // Mirrors `pending` synchronously, so two requests issued in the same tick see each other.
@@ -66,6 +94,10 @@ export function UnlockPromptProvider({ children }) {
         if (existing) {
             return Promise.resolve(existing);
         }
+        // A mailbox shared with the user opens through their member key wraps, not a password - and its password, if it has one, isn't theirs.
+        return openShared(mailboxUid).then((shared) => shared ?? promptForPassword(mailboxUid, mailboxKeys));
+    }, []);
+    const promptForPassword = useCallback((mailboxUid, mailboxKeys) => {
         return new Promise((resolve, reject) => {
             const current = pendingRef.current;
             if (current?.mailboxUid === mailboxUid) {

package/dist/apps/shared/components/mail/ConversationList.js

@@ -49,7 +49,7 @@ export default function ConversationList({ conversations, mailboxUid, selectedUi
         let stale = false;
         void mapWithConcurrency(conversations.filter(conversationLooksEncrypted), 4, async (conversation) => {
             if (!stale) {
-                await decryptForDisplay(conversation.latestMessageUid, conversation.mailboxUid ?? mailboxUid);
+                await decryptForDisplay(conversation.latestMessageUid, conversation.mailboxUid ?? mailboxUid, conversation.latestZeroAccess?.sealedSummary);
             }
         });
         return () => {