@rapidmx/web-client 0.35.0 → 0.37.0

package/dist/apps/www/settings/encryption/index.js

@@ -6,8 +6,8 @@ import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-run
 import { pageTitle } from "../../../shared/navigation/pageTitle.js";
 import { useEffect, useState } from "react";
 import { ApiRequestError } from "../../../../lib/util/api.js";
-import { addMasterKeyWrap, cancelSignEnrollment, findActivePublicKey, getCurrentSignEnrollment, getEscrowInfo, getKeyVault, rekey, removeMasterKeyWrap, startSignEnrollment, } from "../../../../lib/crypto/keyvaultApi.js";
-import { ENCRYPTION_PRIVATE_KEY_AAD_PURPOSE, SIGNING_PRIVATE_KEY_AAD_PURPOSE, destroyUnlockedKeys, getUnlockedKeys, unlockWithPassword, } from "../../../../lib/crypto/keySession.js";
+import { addMasterKeyWrap, cancelSignEnrollment, findActivePublicKey, getCurrentSignEnrollment, getEscrowInfo, getKeyVault, isOpenPgpKey, rekey, removeMasterKeyWrap, startSignEnrollment, } from "../../../../lib/crypto/keyvaultApi.js";
+import { ENCRYPTION_PRIVATE_KEY_AAD_PURPOSE, OPENPGP_PRIVATE_KEY_AAD_PURPOSE, SIGNING_PRIVATE_KEY_AAD_PURPOSE, ZERO_ACCESS_PRIVATE_KEY_AAD_PURPOSE, destroyUnlockedKeys, getUnlockedKeys, unlockWithPassword, } from "../../../../lib/crypto/keySession.js";
 import { IDLE_TIMEOUT_OPTIONS_MINUTES, getIdleTimeoutMinutes, setIdleTimeoutMinutes } from "../../../../lib/crypto/idleTimeout.js";
 import { LOCAL_INDEX_SIZE_OPTIONS, getDefaultLocalIndexByteBudget, getLocalIndexByteBudget, setLocalIndexByteBudget, } from "../../../shared/search/localIndexSizePreference.js";
 import { fromBase64 } from "../../../../lib/crypto/encoding.js";
@@ -25,6 +25,9 @@ import { notifyApiError } from "../../../shared/notifications/apiErrors.js";
 import Alert from "../../../../lib/components/feedback/Alert.js";
 import Button from "../../../../lib/components/buttons/Button.js";
 import Modal from "../../../../lib/components/overlays/Modal.js";
+import ZeroAccessSetting from "../../../shared/components/settings/ZeroAccessSetting.js";
+import KeyExportSetting from "../../../shared/components/settings/KeyExportSetting.js";
+import OpenPgpKeySetting from "../../../shared/components/settings/OpenPgpKeySetting.js";
 import SigningCertificateCard from "../../../shared/components/settings/SigningCertificateCard.js";
 import { readStoredSignEnrollment, storeSignEnrollment } from "../../../shared/signing/enrollmentStorage.js";
 import { checkEnrollmentNow, forgetEnrollment, recordEnrollmentResult, useEnrollmentSnapshot, watchCurrentEnrollment, watchEnrollment, } from "../../../shared/signing/enrollmentTracker.js";
@@ -61,7 +64,14 @@ class StaleSessionKeysError extends Error {
     }
 }
 const STALE_KEYS_MESSAGE = "Your encryption keys were changed on another device (for example, rotated), so the copy unlocked in this session no longer works. Nothing was changed. Unlock again with your current password, then try again.";
+/** The AAD a vault key is sealed with - by what it is: an OpenPGP secret key, a zero-access key, a signing key or an encryption key. */
 function wrappedKeyAad(mailboxUid, entry) {
+    if (isOpenPgpKey(entry)) {
+        return buildAad(mailboxUid, OPENPGP_PRIVATE_KEY_AAD_PURPOSE);
+    }
+    if (entry.useType === "zero-access") {
+        return buildAad(mailboxUid, ZERO_ACCESS_PRIVATE_KEY_AAD_PURPOSE);
+    }
     return buildAad(mailboxUid, entry.useType === "sign" ? SIGNING_PRIVATE_KEY_AAD_PURPOSE : ENCRYPTION_PRIVATE_KEY_AAD_PURPOSE);
 }
 /**
@@ -123,6 +133,8 @@ async function rewrapVaultPrivateKeys(mailboxUid, currentMasterKey, wrappedKeys)
                 algorithm: "AES-256-GCM",
                 fingerprint: entry.fingerprint,
                 useType: entry.useType,
+                // An OpenPGP secret key stays one: without its type it would read back as an S/MIME key.
+                ...(isOpenPgpKey(entry) ? { type: entry.type } : {}),
             });
         }
         return { mk, wrappedKeys: rewrapped };
@@ -165,7 +177,7 @@ function EncryptionGate({ userUid, impersonating }) {
     // restapi only lets the mailbox's actual owner write its key vault (`requireMailboxOwner()`), so a
     // delegate (or an admin impersonating the owner) never provisions keys here, and sees no write actions.
     const isOwner = mailbox.ownerUserUid !== undefined && mailbox.ownerUserUid === userUid && !impersonating;
-    return (_jsx(KeyEnrollmentGate, { mailboxUid: mailboxUid, mailboxAddress: mailbox.primarySmtpAddress, mailboxKeys: mailbox.keys, canProvision: isOwner, children: _jsx(EncryptionContent, { canManageKeys: isOwner }) }));
+    return (_jsx(KeyEnrollmentGate, { mailboxUid: mailboxUid, mailboxAddress: mailbox.primarySmtpAddress, mailboxKeys: mailbox.keys, canProvision: isOwner, children: _jsx(EncryptionContent, { canManageKeys: isOwner }, mailboxUid) }));
 }
 function EncryptionContent({ canManageKeys }) {
     const { mailboxUid, mailboxes } = useSettingsShell();
@@ -799,7 +811,7 @@ function EncryptionContent({ canManageKeys }) {
                     : null;
     const certificateEnrollment = certificateMode === "issued" && enrollmentResult?.status !== "issued" ? null : certificateMode === "expired" ? null : enrollmentResult;
     return (_jsx("div", { className: "flex-1 min-w-0 overflow-y-auto p-6", children: _jsxs("div", { className: "max-w-xl flex flex-col gap-6", children: [_jsxs("div", { children: [_jsx("h1", { className: "text-lg font-bold tracking-tight mb-1", children: "Encryption" }), _jsxs("p", { className: "text-sm text-text-muted", children: ["Manage how ", mailbox.displayName, " unlocks its encryption keys on this and other devices."] })] }), loadError && _jsx(Alert, { children: loadError }), actionError && _jsx(Alert, { children: actionError }), !canManageKeys && (_jsx("p", { className: "text-sm text-text-muted", children: "Only this mailbox\u2019s owner, signed in as themselves, can change its encryption keys and unlock methods." })), _jsxs("div", { children: [_jsx("h2", { className: "text-sm font-semibold mb-2", children: "Encryption keys" }), displayedKeys.length > 0 ? (_jsx("ul", { className: "flex flex-col gap-1 text-sm", children: displayedKeys.map((key) => (_jsxs("li", { className: "font-mono text-xs", children: [key.useType === "sign" ? "Signing" : "Encryption", " key: ", key.fingerprint, key.revokedAt &&
-                                        (key.revocationReason === "superseded" ? (_jsx("span", { className: "text-text-muted", children: " (superseded)" })) : (_jsx("span", { className: "text-danger", children: " (revoked)" })))] }, key.fingerprint))) })) : (_jsx("p", { className: "text-sm text-text-muted", children: "No keys enrolled yet." }))] }), _jsxs("div", { children: [_jsx("h2", { className: "text-sm font-semibold mb-2", children: "Digital signatures" }), activeSigningKey && signingStatus !== "pending" && (_jsx("p", { className: ["text-sm text-text-muted", certificateMode ? "mb-3" : ""].join(" "), children: "Enabled \u2014 outgoing mail from this mailbox is signed with a publicly-trusted certificate." })), certificateMode && (_jsxs("div", { className: "flex flex-col gap-2", children: [certificateMode === "failed" && signingError && _jsx(Alert, { children: signingError }), _jsx(SigningCertificateCard, { mode: certificateMode, enrollment: certificateEnrollment, snapshot: enrollment, info: signingInfo, address: mailbox.primarySmtpAddress, keyNotAfter: certificateMode === "expired" ? expiredSigningKey?.notAfter : activeSigningKey?.notAfter, canRequest: canManageKeys, requesting: signingStatus === "enrolling", onCheck: canManageKeys ? () => void checkEnrollmentNow(mailboxUid) : undefined, onRequest: handleEnrollSigning })] })), !activeSigningKey && !certificateMode && !canManageKeys ? (_jsx("p", { className: "text-sm text-text-muted", children: "Not enabled." })) : activeSigningKey || certificateMode ? null : (_jsxs("div", { className: "flex flex-col gap-2", children: [_jsx("p", { className: "text-xs text-text-muted", children: "Lets recipients verify that mail from this mailbox is genuinely from you. Optional \u2014 encryption already works without it." }), beforeRequestText(signingInfo, mailbox.primarySmtpAddress) && (_jsx("p", { className: "text-xs text-text-muted", children: beforeRequestText(signingInfo, mailbox.primarySmtpAddress) })), healthWarning(signingInfo) && _jsx(Alert, { children: healthWarning(signingInfo) }), enrollment?.gone && _jsx(Alert, { children: STALE_REQUEST_TEXT }), signingError && _jsx(Alert, { children: signingError }), signingInfo?.backend !== "none" && (_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", loading: signingStatus === "enrolling", disabled: signingStatus !== "idle", onClick: handleEnrollSigning, children: "Enable digital signatures" }))] }))] }), mailbox.escrowScopeId && (_jsxs("div", { children: [_jsx("h2", { className: "text-sm font-semibold mb-2", children: "Escrow" }), escrowError && _jsx(Alert, { children: escrowError }), hasEscrowWrap ? (_jsx("p", { className: "text-sm text-text-muted", children: "This mailbox is under legal/compliance escrow \u2014 an authorized holder in your organization can recover its encrypted mail if needed. This does not weaken protection against anyone else." })) : (_jsxs("div", { className: "flex flex-col gap-2", children: [_jsxs("p", { className: "text-xs text-text-muted", children: ["Your organization has assigned this mailbox to an escrow scope, but nothing has been protected yet \u2014 an authorized holder cannot recover this mailbox\u2019s encrypted mail until you complete this step.", " ", "This does not weaken protection against anyone else."] }), canManageKeys && (_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", loading: wrappingEscrow, disabled: wrappingEscrow, onClick: handleWrapEscrow, children: "Add escrow protection" }))] })), _jsxs(Modal, { open: pendingEscrow !== null, onClose: () => setPendingEscrow(null), title: "Confirm escrow certificate", children: [_jsx("p", { className: "text-sm mb-3", children: "Anyone holding the private key for this certificate will be able to recover this mailbox\u2019s encrypted mail. Confirm it is the escrow certificate your organization expects before continuing." }), _jsxs("dl", { className: "text-sm mb-5 flex flex-col gap-1", children: [_jsxs("div", { children: [_jsx("dt", { className: "text-xs text-text-muted", children: "Escrow scope" }), _jsx("dd", { className: "break-all", children: pendingEscrow?.escrowScopeId })] }), _jsxs("div", { children: [_jsx("dt", { className: "text-xs text-text-muted", children: "Certificate fingerprint" }), _jsx("dd", { className: "font-mono break-all", children: pendingEscrow?.publicKey.fingerprint })] })] }), _jsxs("div", { className: "flex gap-3 justify-end", children: [_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", onClick: () => setPendingEscrow(null), children: "Cancel" }), _jsx(Button, { type: "button", className: "!w-auto", onClick: () => void handleConfirmEscrow(pendingEscrow), children: "Trust this certificate" })] })] })] })), _jsxs("div", { children: [_jsx("h2", { className: "text-sm font-semibold mb-2", children: "Unlock methods" }), _jsxs("p", { className: "text-xs text-text-muted mb-3", children: ["Removing a method here stops it from being usable to unlock this mailbox going forward, but it is ", _jsx("strong", { children: "not" }), " full revocation \u2014 anyone who already captured a wrapped copy and knows its secret could still use it. For real revocation (e.g. after a lost device), rotate your keys entirely below instead."] }), vault && vault.masterKeyWraps.length > 0 ? (_jsx("ul", { className: "flex flex-col gap-2", children: [...passwordWraps, ...recoveryWraps, ...otherWraps].map((wrap) => {
+                                        (key.revocationReason === "superseded" ? (_jsx("span", { className: "text-text-muted", children: " (superseded)" })) : (_jsx("span", { className: "text-danger", children: " (revoked)" })))] }, key.fingerprint))) })) : (_jsx("p", { className: "text-sm text-text-muted", children: "No keys enrolled yet." }))] }), _jsx(ZeroAccessSetting, { mailbox: mailbox, canManage: canManageKeys }), _jsx(KeyExportSetting, { mailbox: mailbox, canManage: canManageKeys }), _jsx(OpenPgpKeySetting, { mailbox: mailbox, canManage: canManageKeys }), _jsxs("div", { children: [_jsx("h2", { className: "text-sm font-semibold mb-2", children: "Digital signatures" }), activeSigningKey && signingStatus !== "pending" && (_jsx("p", { className: ["text-sm text-text-muted", certificateMode ? "mb-3" : ""].join(" "), children: "Enabled \u2014 outgoing mail from this mailbox is signed with a publicly-trusted certificate." })), certificateMode && (_jsxs("div", { className: "flex flex-col gap-2", children: [certificateMode === "failed" && signingError && _jsx(Alert, { children: signingError }), _jsx(SigningCertificateCard, { mode: certificateMode, enrollment: certificateEnrollment, snapshot: enrollment, info: signingInfo, address: mailbox.primarySmtpAddress, keyNotAfter: certificateMode === "expired" ? expiredSigningKey?.notAfter : activeSigningKey?.notAfter, canRequest: canManageKeys, requesting: signingStatus === "enrolling", onCheck: canManageKeys ? () => void checkEnrollmentNow(mailboxUid) : undefined, onRequest: handleEnrollSigning })] })), !activeSigningKey && !certificateMode && !canManageKeys ? (_jsx("p", { className: "text-sm text-text-muted", children: "Not enabled." })) : activeSigningKey || certificateMode ? null : (_jsxs("div", { className: "flex flex-col gap-2", children: [_jsx("p", { className: "text-xs text-text-muted", children: "Lets recipients verify that mail from this mailbox is genuinely from you. Optional \u2014 encryption already works without it." }), beforeRequestText(signingInfo, mailbox.primarySmtpAddress) && (_jsx("p", { className: "text-xs text-text-muted", children: beforeRequestText(signingInfo, mailbox.primarySmtpAddress) })), healthWarning(signingInfo) && _jsx(Alert, { children: healthWarning(signingInfo) }), enrollment?.gone && _jsx(Alert, { children: STALE_REQUEST_TEXT }), signingError && _jsx(Alert, { children: signingError }), signingInfo?.backend !== "none" && (_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", loading: signingStatus === "enrolling", disabled: signingStatus !== "idle", onClick: handleEnrollSigning, children: "Enable digital signatures" }))] }))] }), mailbox.escrowScopeId && (_jsxs("div", { children: [_jsx("h2", { className: "text-sm font-semibold mb-2", children: "Escrow" }), escrowError && _jsx(Alert, { children: escrowError }), hasEscrowWrap ? (_jsx("p", { className: "text-sm text-text-muted", children: "This mailbox is under legal/compliance escrow \u2014 an authorized holder in your organization can recover its encrypted mail if needed. This does not weaken protection against anyone else." })) : (_jsxs("div", { className: "flex flex-col gap-2", children: [_jsxs("p", { className: "text-xs text-text-muted", children: ["Your organization has assigned this mailbox to an escrow scope, but nothing has been protected yet \u2014 an authorized holder cannot recover this mailbox\u2019s encrypted mail until you complete this step.", " ", "This does not weaken protection against anyone else."] }), canManageKeys && (_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", loading: wrappingEscrow, disabled: wrappingEscrow, onClick: handleWrapEscrow, children: "Add escrow protection" }))] })), _jsxs(Modal, { open: pendingEscrow !== null, onClose: () => setPendingEscrow(null), title: "Confirm escrow certificate", children: [_jsx("p", { className: "text-sm mb-3", children: "Anyone holding the private key for this certificate will be able to recover this mailbox\u2019s encrypted mail. Confirm it is the escrow certificate your organization expects before continuing." }), _jsxs("dl", { className: "text-sm mb-5 flex flex-col gap-1", children: [_jsxs("div", { children: [_jsx("dt", { className: "text-xs text-text-muted", children: "Escrow scope" }), _jsx("dd", { className: "break-all", children: pendingEscrow?.escrowScopeId })] }), _jsxs("div", { children: [_jsx("dt", { className: "text-xs text-text-muted", children: "Certificate fingerprint" }), _jsx("dd", { className: "font-mono break-all", children: pendingEscrow?.publicKey.fingerprint })] })] }), _jsxs("div", { className: "flex gap-3 justify-end", children: [_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", onClick: () => setPendingEscrow(null), children: "Cancel" }), _jsx(Button, { type: "button", className: "!w-auto", onClick: () => void handleConfirmEscrow(pendingEscrow), children: "Trust this certificate" })] })] })] })), _jsxs("div", { children: [_jsx("h2", { className: "text-sm font-semibold mb-2", children: "Unlock methods" }), _jsxs("p", { className: "text-xs text-text-muted mb-3", children: ["Removing a method here stops it from being usable to unlock this mailbox going forward, but it is ", _jsx("strong", { children: "not" }), " full revocation \u2014 anyone who already captured a wrapped copy and knows its secret could still use it. For real revocation (e.g. after a lost device), rotate your keys entirely below instead."] }), vault && vault.masterKeyWraps.length > 0 ? (_jsx("ul", { className: "flex flex-col gap-2", children: [...passwordWraps, ...recoveryWraps, ...otherWraps].map((wrap) => {
                                 const key = `${wrap.method}:${wrap.methodId ?? ""}`;
                                 return (_jsxs("li", { className: "flex items-center justify-between gap-3 text-sm py-1.5 px-3 bg-surface-alt rounded-sm", children: [_jsx("span", { children: METHOD_LABELS[wrap.method] ?? wrap.method }), wrap.method !== "escrow" &&
                                             canManageKeys &&

package/dist/apps/www/settings/privacy/index.js

@@ -7,7 +7,8 @@ import { pageTitle } from "../../../shared/navigation/pageTitle.js";
 import { useEffect, useRef, useState } from "react";
 import { ApiRequestError } from "../../../../lib/util/api.js";
 import { createExportRequest, exportRequestDownloadUrl, listExportRequests, } from "../../../../lib/mail/dataExportApi.js";
-import { listImportRequests, uploadMailboxImport, } from "../../../../lib/mail/mailboxImportApi.js";
+import { ZERO_ACCESS_IMPORT_MESSAGE, listImportRequests, mailIsZeroAccess, uploadMailboxImport, } from "../../../../lib/mail/mailboxImportApi.js";
+import { getEncryptionPolicy } from "../../../../lib/crypto/keyvaultApi.js";
 import { createErasureRequest, listErasureRequests, } from "../../../../lib/mail/erasureRequestApi.js";
 import { listFolders } from "../../../../lib/mail/mailApi.js";
 import { useApiClient } from "../../../../lib/util/apiClientContext.js";
@@ -16,6 +17,7 @@ import Alert from "../../../../lib/components/feedback/Alert.js";
 import Button from "../../../../lib/components/buttons/Button.js";
 import Modal from "../../../../lib/components/overlays/Modal.js";
 import { notifyApiError } from "../../../shared/notifications/apiErrors.js";
+import { INVALID_REQUEST_CODE } from "../../../../lib/zeroAccess/sealedMoves.js";
 import GravatarSetting from "../../../shared/components/settings/GravatarSetting.js";
 const NON_MAIL_FOLDER_TYPES = new Set(["calendar", "contacts", "tasks", "notes"]);
 function importFormatFromFilename(filename) {
@@ -50,7 +52,7 @@ function PrivacyContent({ userUid }) {
     const ownedMailboxes = mailboxes.filter((mb) => mb.ownerUserUid !== undefined && mb.ownerUserUid === userUid);
     const ownMailbox = ownedMailboxes.length === 1 ? ownedMailboxes[0] : undefined;
     const selectedIsOwn = selected.uid === ownMailbox?.uid;
-    return (_jsx("div", { className: "flex-1 min-w-0 overflow-y-auto p-6", children: _jsxs("div", { className: "max-w-xl flex flex-col gap-8", children: [_jsxs("div", { children: [_jsx("h1", { className: "text-lg font-bold tracking-tight mb-1", children: "Privacy & Data" }), _jsx("p", { className: "text-sm text-text-muted", children: "Export or manage the data associated with this mailbox." })] }), _jsx(GravatarSetting, {}), selectedIsOwn ? (_jsxs(_Fragment, { children: [_jsx(ExportSection, { mailboxUid: mailboxUid, mailboxLabel: `${selected.displayName} (${selected.primarySmtpAddress})` }), _jsx(ImportSection, { mailboxUid: mailboxUid }), _jsx(ErasureSection, { mailboxLabel: `${selected.displayName} (${selected.primarySmtpAddress})` })] })) : (_jsx(OwnMailboxOnlyNotice, { ownedMailboxCount: ownedMailboxes.length, ownMailboxLabel: ownMailbox && `${ownMailbox.displayName} (${ownMailbox.primarySmtpAddress})` }))] }) }));
+    return (_jsx("div", { className: "flex-1 min-w-0 overflow-y-auto p-6", children: _jsxs("div", { className: "max-w-xl flex flex-col gap-8", children: [_jsxs("div", { children: [_jsx("h1", { className: "text-lg font-bold tracking-tight mb-1", children: "Privacy & Data" }), _jsx("p", { className: "text-sm text-text-muted", children: "Export or manage the data associated with this mailbox." })] }), _jsx(GravatarSetting, {}), selectedIsOwn ? (_jsxs(_Fragment, { children: [_jsx(ExportSection, { mailboxUid: mailboxUid, mailboxLabel: `${selected.displayName} (${selected.primarySmtpAddress})` }), _jsx(ImportSection, { mailboxUid: mailboxUid, mailbox: selected }), _jsx(ErasureSection, { mailboxLabel: `${selected.displayName} (${selected.primarySmtpAddress})` })] })) : (_jsx(OwnMailboxOnlyNotice, { ownedMailboxCount: ownedMailboxes.length, ownMailboxLabel: ownMailbox && `${ownMailbox.displayName} (${ownMailbox.primarySmtpAddress})` }))] }) }));
 }
 function OwnMailboxOnlyNotice({ ownedMailboxCount, ownMailboxLabel }) {
     let detail;
@@ -108,10 +110,38 @@ function ExportSection({ mailboxUid, mailboxLabel }) {
             setCreating(false);
         }
     }
-    return (_jsxs("div", { children: [_jsx("h2", { className: "text-sm font-semibold mb-2", children: "Export my data" }), _jsxs("p", { className: "text-xs text-text-muted mb-3", children: ["Requests a copy of ", _jsx("strong", { children: mailboxLabel }), "\u2019s messages, contacts, calendar, tasks, and notes. This runs in the background and can take a few minutes \u2014 check back here for a download link once it\u2019s ready."] }), _jsxs("form", { onSubmit: handleCreate, className: "flex items-end gap-3 mb-5", children: [_jsxs("label", { className: "flex flex-col gap-1.5 text-sm", children: [_jsx("span", { className: "font-semibold", children: "Format" }), _jsxs("select", { "aria-label": "Export format", className: "text-sm border border-border rounded-sm py-1.5 px-2 bg-surface", value: format, onChange: (e) => setFormat(e.target.value), children: [_jsx("option", { value: "json", children: "JSON" }), _jsx("option", { value: "mbox", children: "Mbox" })] })] }), _jsx(Button, { type: "submit", variant: "secondary", className: "!w-auto", loading: creating, disabled: creating, children: "Request export" })] }), loadError && _jsx(Alert, { children: loadError }), loading ? (_jsx("p", { className: "text-sm text-text-muted", children: "Loading\u2026" })) : requests.length === 0 ? (_jsx("p", { className: "text-sm text-text-muted", children: "No export requests yet." })) : (_jsx("ul", { className: "flex flex-col gap-2", children: requests.map((request) => (_jsxs("li", { className: "flex items-center justify-between gap-3 text-sm py-1.5 px-3 bg-surface-alt rounded-sm", children: [_jsxs("span", { children: [request.format.toUpperCase(), " \u00B7 ", new Date(request.dateCreated).toLocaleString(), request.status === "failed" && request.errorMessage && (_jsxs("span", { className: "text-danger", children: [" \u2014 ", request.errorMessage] }))] }), _jsxs("span", { className: "flex items-center gap-3", children: [_jsx("span", { className: `text-xs font-bold uppercase tracking-wide py-0.5 px-2 rounded-pill ${statusBadgeClass(request.status)}`, children: statusLabel(request.status) }), request.status === "ready" && (_jsx("a", { href: exportRequestDownloadUrl(request.uid), className: "text-primary-dark hover:underline font-medium", children: "Download" }))] })] }, request.uid))) }))] }));
+    return (_jsxs("div", { children: [_jsx("h2", { className: "text-sm font-semibold mb-2", children: "Export my data" }), _jsxs("p", { className: "text-xs text-text-muted mb-3", children: ["Requests a copy of ", _jsx("strong", { children: mailboxLabel }), "\u2019s messages, contacts, calendar, tasks, and notes. This runs in the background and can take a few minutes \u2014 check back here for a download link once it\u2019s ready. Mail stored with zero-access encryption is exported encrypted: open it in a mail app that has your exported keys (Settings \u203A Encryption)."] }), _jsxs("form", { onSubmit: handleCreate, className: "flex items-end gap-3 mb-5", children: [_jsxs("label", { className: "flex flex-col gap-1.5 text-sm", children: [_jsx("span", { className: "font-semibold", children: "Format" }), _jsxs("select", { "aria-label": "Export format", className: "text-sm border border-border rounded-sm py-1.5 px-2 bg-surface", value: format, onChange: (e) => setFormat(e.target.value), children: [_jsx("option", { value: "json", children: "JSON" }), _jsx("option", { value: "mbox", children: "Mbox" })] })] }), _jsx(Button, { type: "submit", variant: "secondary", className: "!w-auto", loading: creating, disabled: creating, children: "Request export" })] }), loadError && _jsx(Alert, { children: loadError }), loading ? (_jsx("p", { className: "text-sm text-text-muted", children: "Loading\u2026" })) : requests.length === 0 ? (_jsx("p", { className: "text-sm text-text-muted", children: "No export requests yet." })) : (_jsx("ul", { className: "flex flex-col gap-2", children: requests.map((request) => (_jsxs("li", { className: "flex items-center justify-between gap-3 text-sm py-1.5 px-3 bg-surface-alt rounded-sm", children: [_jsxs("span", { children: [request.format.toUpperCase(), " \u00B7 ", new Date(request.dateCreated).toLocaleString(), request.status === "failed" && request.errorMessage && (_jsxs("span", { className: "text-danger", children: [" \u2014 ", request.errorMessage] }))] }), _jsxs("span", { className: "flex items-center gap-3", children: [_jsx("span", { className: `text-xs font-bold uppercase tracking-wide py-0.5 px-2 rounded-pill ${statusBadgeClass(request.status)}`, children: statusLabel(request.status) }), request.status === "ready" && (_jsx("a", { href: exportRequestDownloadUrl(request.uid), className: "text-primary-dark hover:underline font-medium", children: "Download" }))] })] }, request.uid))) }))] }));
 }
-function ImportSection({ mailboxUid }) {
+/**
+ * Uploads a mail archive for restapi's server-side import. Not offered for a mailbox whose mail is zero-access (`mailIsZeroAccess()`):
+ * restapi refuses it (409), since the archive would wait readable in its blob store until the import ran, and the reason is shown
+ * instead. The server's zero-access refusal given anyway (zero-access turned on since the page loaded) is shown in its place too; its other
+ * 409, an import already in progress, is not.
+ */
+function ImportSection({ mailboxUid, mailbox }) {
     const client = useApiClient();
+    // Only when the mailbox's own fields say its mail is zero-access is the administrator's policy asked: `undefined` until it answers
+    // (counted as allowed), and a failed read counts as allowed too, so the upload is never offered only to be refused.
+    const zeroAccessCandidate = mailIsZeroAccess(mailbox, undefined);
+    const [allowZeroAccess, setAllowZeroAccess] = useState(undefined);
+    const [refused, setRefused] = useState(null);
+    useEffect(() => {
+        if (!zeroAccessCandidate) {
+            return;
+        }
+        let cancelled = false;
+        void getEncryptionPolicy(client)
+            .then((policy) => {
+            if (!cancelled) {
+                setAllowZeroAccess(policy.allowZeroAccess);
+            }
+        })
+            .catch(() => undefined);
+        return () => {
+            cancelled = true;
+        };
+    }, [zeroAccessCandidate, client]);
+    const zeroAccess = mailIsZeroAccess(mailbox, allowZeroAccess);
     const [folders, setFolders] = useState([]);
     const [targetFolderUid, setTargetFolderUid] = useState("");
     const [foldersError, setFoldersError] = useState(null);
@@ -161,10 +191,21 @@ function ImportSection({ mailboxUid }) {
         setUploading(true);
         uploadMailboxImport(file, { format: importFormatFromFilename(file.name), targetFolderUid, mailboxUid: mailboxUid }, client)
             .then(() => loadRequests())
-            .catch((err) => notifyApiError(err, "Couldn't upload the file"))
+            .catch((err) => {
+            if (err instanceof ApiRequestError && err.status === 409 && err.code === INVALID_REQUEST_CODE) {
+                // The server refuses an import into this mailbox (its mail is zero-access): say why, in place of the upload.
+                setRefused(err.message);
+                return;
+            }
+            // Any other refusal - an import already in progress is a 409 too - leaves the upload offered, and shows that import.
+            notifyApiError(err, "Couldn't upload the file");
+            if (err instanceof ApiRequestError && err.status === 409) {
+                void loadRequests();
+            }
+        })
             .finally(() => setUploading(false));
     }
-    return (_jsxs("div", { children: [_jsx("h2", { className: "text-sm font-semibold mb-2", children: "Import mail" }), _jsx("p", { className: "text-xs text-text-muted mb-3", children: "Uploads an Mbox or PST archive and imports every message it contains into the folder you choose below. This runs in the background \u2014 check back here for its progress." }), folders.length > 0 && (_jsxs("label", { className: "flex flex-col gap-1.5 text-sm mb-3 max-w-xs", children: [_jsx("span", { className: "font-semibold", children: "Destination folder" }), _jsx("select", { "aria-label": "Destination folder", className: "text-sm border border-border rounded-sm py-1.5 px-2 bg-surface", value: targetFolderUid, onChange: (e) => setTargetFolderUid(e.target.value), children: folders.map((folder) => (_jsx("option", { value: folder.uid, children: folder.name }, folder.uid))) })] })), _jsx(Button, { type: "button", variant: "secondary", className: "!w-auto mb-3", loading: uploading, disabled: uploading || !targetFolderUid, onClick: () => fileInputRef.current?.click(), children: "Upload Mbox or PST file" }), _jsx("input", { ref: fileInputRef, type: "file", accept: ".mbox,.pst", "aria-label": "Upload mail archive", className: "hidden", onChange: handleFileChange }), foldersError && _jsx(Alert, { children: foldersError }), loadError && _jsx(Alert, { children: loadError }), loading ? (_jsx("p", { className: "text-sm text-text-muted", children: "Loading\u2026" })) : requests.length === 0 ? (_jsx("p", { className: "text-sm text-text-muted", children: "No import requests yet." })) : (_jsx("ul", { className: "flex flex-col gap-2", children: requests.map((request) => (_jsxs("li", { className: "flex items-center justify-between gap-3 text-sm py-1.5 px-3 bg-surface-alt rounded-sm", children: [_jsxs("span", { children: [request.format.toUpperCase(), " \u00B7 ", new Date(request.dateCreated).toLocaleString(), request.status === "completed" && (_jsxs("span", { className: "text-text-muted", children: [" ", "\u2014 ", request.importedCount ?? 0, " imported", request.failedCount ? `, ${request.failedCount} failed` : ""] })), request.status === "failed" && request.errorMessage && (_jsxs("span", { className: "text-danger", children: [" \u2014 ", request.errorMessage] }))] }), _jsx("span", { className: `text-xs font-bold uppercase tracking-wide py-0.5 px-2 rounded-pill ${statusBadgeClass(request.status)}`, children: statusLabel(request.status) })] }, request.uid))) }))] }));
+    return (_jsxs("div", { children: [_jsx("h2", { className: "text-sm font-semibold mb-2", children: "Import mail" }), _jsx("p", { className: "text-xs text-text-muted mb-3", children: "Uploads an Mbox or PST archive and imports every message it contains into the folder you choose below. This runs in the background \u2014 check back here for its progress." }), zeroAccess || refused ? (_jsx(Alert, { children: refused ?? ZERO_ACCESS_IMPORT_MESSAGE })) : (_jsxs(_Fragment, { children: [folders.length > 0 && (_jsxs("label", { className: "flex flex-col gap-1.5 text-sm mb-3 max-w-xs", children: [_jsx("span", { className: "font-semibold", children: "Destination folder" }), _jsx("select", { "aria-label": "Destination folder", className: "text-sm border border-border rounded-sm py-1.5 px-2 bg-surface", value: targetFolderUid, onChange: (e) => setTargetFolderUid(e.target.value), children: folders.map((folder) => (_jsx("option", { value: folder.uid, children: folder.name }, folder.uid))) })] })), _jsx(Button, { type: "button", variant: "secondary", className: "!w-auto mb-3", loading: uploading, disabled: uploading || !targetFolderUid, onClick: () => fileInputRef.current?.click(), children: "Upload Mbox or PST file" }), _jsx("input", { ref: fileInputRef, type: "file", accept: ".mbox,.pst", "aria-label": "Upload mail archive", className: "hidden", onChange: handleFileChange })] })), foldersError && _jsx(Alert, { children: foldersError }), loadError && _jsx(Alert, { children: loadError }), loading ? (_jsx("p", { className: "text-sm text-text-muted", children: "Loading\u2026" })) : requests.length === 0 ? (_jsx("p", { className: "text-sm text-text-muted", children: "No import requests yet." })) : (_jsx("ul", { className: "flex flex-col gap-2", children: requests.map((request) => (_jsxs("li", { className: "flex items-center justify-between gap-3 text-sm py-1.5 px-3 bg-surface-alt rounded-sm", children: [_jsxs("span", { children: [request.format.toUpperCase(), " \u00B7 ", new Date(request.dateCreated).toLocaleString(), request.status === "completed" && (_jsxs("span", { className: "text-text-muted", children: [" ", "\u2014 ", request.importedCount ?? 0, " imported", request.failedCount ? `, ${request.failedCount} failed` : ""] })), request.status === "failed" && request.errorMessage && (_jsxs("span", { className: "text-danger", children: [" \u2014 ", request.errorMessage] }))] }), _jsx("span", { className: `text-xs font-bold uppercase tracking-wide py-0.5 px-2 rounded-pill ${statusBadgeClass(request.status)}`, children: statusLabel(request.status) })] }, request.uid))) }))] }));
 }
 function ErasureSection({ mailboxLabel }) {
     const client = useApiClient();

package/dist/apps/www/tasks/index.js

@@ -26,6 +26,9 @@ import { useShortcut } from "../../shared/keyboard/useShortcut.js";
 import { useShortcutProps } from "../../shared/keyboard/useShortcutProps.js";
 import { notifyApiError } from "../../shared/notifications/apiErrors.js";
 import { changedItemOf, useFolderLiveUpdates } from "../../shared/live/useFolderLiveUpdates.js";
+import ProtectedMark from "../../shared/zeroAccess/ProtectedMark.js";
+import { useKeysLocked } from "../../shared/zeroAccess/useKeysLocked.js";
+import { isProtectedRecord, openSealedRecord, openSealedRecords } from "../../../lib/zeroAccess/sealedRecords.js";
 /** The published model class name of a task on either database (`TaskMongo`, `TaskSQL`) - not a `TaskList`'s. */
 const TASK_MODEL = /^Task(Mongo|SQL)$/;
 /** The push client channel group (`PushClient.setChannels()`) the page's tasks folder is subscribed under. */
@@ -106,6 +109,7 @@ function TasksContent() {
         setLoading(true);
         setError(null);
         return listAllPages((page) => listTasks(folderUid, { limit: LIST_PAGE_SIZE, page }, client))
+            .then(async (result) => ({ ...result, items: await openSealedRecords(result.items) }))
             .then((result) => {
             if (run === loadRun.current) {
                 setTasks(result.items);
@@ -126,6 +130,14 @@ function TasksContent() {
     useEffect(() => {
         void reload();
     }, [folderUid]);
+    // The list holds protected tasks opened with the mailbox's keys: its lock takes them off screen, read again with their placeholders. They
+    // leave the list first, so a reload that fails can't leave them shown.
+    useKeysLocked((locked) => {
+        if (locked === mailboxUid) {
+            setTasks((list) => list.filter((task) => !isProtectedRecord(task)));
+            void reload();
+        }
+    });
     // A task created, changed or deleted anywhere - another tab, a phone over ActiveSync - is announced on its folder's channel. It is fetched again by its
     // uid and replaces (or joins) the list while it is still in this folder; one that is gone (a delete, a 404, or moved to another folder) leaves it. A
     // failed fetch changes nothing: the next load shows it as it is.
@@ -135,7 +147,7 @@ function TasksContent() {
             remove();
             return;
         }
-        void getTask(change.uid, client).then((fresh) => {
+        void getTask(change.uid, client).then(openSealedRecord).then((fresh) => {
             if (fresh.folderUid !== folderUid) {
                 remove();
                 return;
@@ -199,14 +211,14 @@ function TasksContent() {
                 setCreateError("That mailbox has no Tasks folder.");
                 return;
             }
-            const created = await createTask({
+            const created = await openSealedRecord(await createTask({
                 mailboxUid: target,
                 folderUid: targetFolderUid,
                 title: title.trim(),
                 // The date input's "yyyy-MM-dd" is stored as that day's UTC midnight - see `dueDateInstant()`.
                 dueDate: dueDate ? dueDateInstant(dueDate) : undefined,
                 priority,
-            }, client);
+            }, client));
             if (target === mailboxUid) {
                 setAddedElsewhere(null);
                 setTasks((prev) => [...prev, created]);
@@ -247,11 +259,13 @@ function TasksContent() {
         const nextCompleted = !task.completed;
         setTasks((prev) => prev.map((t) => (t.uid === task.uid ? { ...t, completed: nextCompleted } : t)));
         try {
-            const updated = await setTaskCompleted(task, nextCompleted, client);
+            const updated = await openSealedRecord(await setTaskCompleted(task, nextCompleted, client));
             setTasks((prev) => prev.map((t) => (t.uid === task.uid ? updated : t)));
         }
         catch (err) {
-            setTasks((prev) => prev.map((t) => (t.uid === task.uid ? task : t)));
+            // Only the flag goes back, on the row there now: `task` is the row as it was shown, opened, and a lock since may have
+            // reloaded it with its placeholders (#224), which putting it back whole would undo.
+            setTasks((prev) => prev.map((t) => (t.uid === task.uid ? { ...t, completed: task.completed } : t)));
             notifyApiError(err, "Couldn't update the task");
         }
         finally {
@@ -415,7 +429,7 @@ function CompletionToggle({ task, onToggle, pending }) {
         ].join(" "), children: "\u2713" }));
 }
 function TaskGroup({ label, tasks, checkedUids, onToggleChecked, onToggle, toggling, onDelete }) {
-    return (_jsxs("div", { children: [_jsx("h2", { className: "text-xs font-bold uppercase tracking-wide text-text-muted mb-2", children: label }), _jsx("ul", { className: "bg-surface border border-border rounded-md divide-y divide-border", children: tasks.map((task) => (_jsxs("li", { className: "flex items-center gap-3 py-2.5 px-3", children: [_jsx("input", { type: "checkbox", "aria-label": `Select ${task.title}`, checked: checkedUids.has(task.uid), onChange: () => onToggleChecked(task.uid) }), _jsx(CompletionToggle, { task: task, onToggle: onToggle, pending: toggling.has(task.uid) }), _jsx("span", { className: ["flex-1 text-sm", task.completed ? "line-through text-text-muted" : ""].join(" "), children: task.title }), task.priority !== "normal" && (_jsx("span", { className: ["text-xs font-medium", PRIORITY_CLASS[task.priority]].join(" "), children: PRIORITY_LABEL[task.priority] })), task.dueDate && (_jsx("span", { className: "text-xs text-text-muted shrink-0", children: parseDueDate(task.dueDate).toLocaleDateString() })), _jsx("button", { type: "button", onClick: () => onDelete(task), "aria-label": `Delete "${task.title}"`, className: "text-text-muted hover:text-danger text-sm px-1", children: "\u00D7" })] }, task.uid))) })] }));
+    return (_jsxs("div", { children: [_jsx("h2", { className: "text-xs font-bold uppercase tracking-wide text-text-muted mb-2", children: label }), _jsx("ul", { className: "bg-surface border border-border rounded-md divide-y divide-border", children: tasks.map((task) => (_jsxs("li", { className: "flex items-center gap-3 py-2.5 px-3", children: [_jsx("input", { type: "checkbox", "aria-label": `Select ${task.title}`, checked: checkedUids.has(task.uid), onChange: () => onToggleChecked(task.uid) }), _jsx(CompletionToggle, { task: task, onToggle: onToggle, pending: toggling.has(task.uid) }), _jsxs("span", { className: ["flex-1 text-sm", task.completed ? "line-through text-text-muted" : ""].join(" "), children: [task.title, _jsx(ProtectedMark, { record: task })] }), task.priority !== "normal" && (_jsx("span", { className: ["text-xs font-medium", PRIORITY_CLASS[task.priority]].join(" "), children: PRIORITY_LABEL[task.priority] })), task.dueDate && (_jsx("span", { className: "text-xs text-text-muted shrink-0", children: parseDueDate(task.dueDate).toLocaleDateString() })), _jsx("button", { type: "button", onClick: () => onDelete(task), "aria-label": `Delete "${task.title}"`, className: "text-text-muted hover:text-danger text-sm px-1", children: "\u00D7" })] }, task.uid))) })] }));
 }
 function TaskTable({ tasks, checkedUids, onToggleChecked, onToggle, toggling, onDelete }) {
     const allChecked = tasks.length > 0 && tasks.every((t) => checkedUids.has(t.uid));
@@ -435,7 +449,7 @@ function TaskTable({ tasks, checkedUids, onToggleChecked, onToggle, toggling, on
             }
         }
     }
-    return (_jsx("div", { className: "overflow-x-auto", children: _jsxs("table", { className: "w-full text-sm bg-surface border border-border rounded-md", children: [_jsx("thead", { children: _jsxs("tr", { className: "border-b border-border text-left", children: [_jsx("th", { className: "w-8 px-3 py-2", children: _jsx("input", { type: "checkbox", "aria-label": "Select all tasks", checked: allChecked, onChange: toggleAll }) }), _jsx("th", { className: "w-8 px-3 py-2" }), _jsx("th", { className: "px-3 py-2 text-xs font-bold uppercase tracking-wide text-text-muted", children: "Title" }), _jsx("th", { className: "px-3 py-2 text-xs font-bold uppercase tracking-wide text-text-muted", children: "Due Date" }), _jsx("th", { className: "px-3 py-2 text-xs font-bold uppercase tracking-wide text-text-muted", children: "Importance" }), _jsx("th", { className: "w-8 px-3 py-2" })] }) }), _jsx("tbody", { children: tasks.map((task) => (_jsxs("tr", { className: "border-b border-border last:border-0", children: [_jsx("td", { className: "px-3 py-2", children: _jsx("input", { type: "checkbox", "aria-label": `Select ${task.title}`, checked: checkedUids.has(task.uid), onChange: () => onToggleChecked(task.uid) }) }), _jsx("td", { className: "px-3 py-2", children: _jsx(CompletionToggle, { task: task, onToggle: onToggle, pending: toggling.has(task.uid) }) }), _jsx("td", { className: ["px-3 py-2", task.completed ? "line-through text-text-muted" : ""].join(" "), children: task.title }), _jsx("td", { className: "px-3 py-2 text-text-muted", children: task.dueDate ? parseDueDate(task.dueDate).toLocaleDateString() : "" }), _jsx("td", { className: ["px-3 py-2", PRIORITY_CLASS[task.priority]].join(" "), children: PRIORITY_LABEL[task.priority] }), _jsx("td", { className: "px-3 py-2", children: _jsx("button", { type: "button", onClick: () => onDelete(task), "aria-label": `Delete "${task.title}"`, className: "text-text-muted hover:text-danger text-sm px-1", children: "\u00D7" }) })] }, task.uid))) })] }) }));
+    return (_jsx("div", { className: "overflow-x-auto", children: _jsxs("table", { className: "w-full text-sm bg-surface border border-border rounded-md", children: [_jsx("thead", { children: _jsxs("tr", { className: "border-b border-border text-left", children: [_jsx("th", { className: "w-8 px-3 py-2", children: _jsx("input", { type: "checkbox", "aria-label": "Select all tasks", checked: allChecked, onChange: toggleAll }) }), _jsx("th", { className: "w-8 px-3 py-2" }), _jsx("th", { className: "px-3 py-2 text-xs font-bold uppercase tracking-wide text-text-muted", children: "Title" }), _jsx("th", { className: "px-3 py-2 text-xs font-bold uppercase tracking-wide text-text-muted", children: "Due Date" }), _jsx("th", { className: "px-3 py-2 text-xs font-bold uppercase tracking-wide text-text-muted", children: "Importance" }), _jsx("th", { className: "w-8 px-3 py-2" })] }) }), _jsx("tbody", { children: tasks.map((task) => (_jsxs("tr", { className: "border-b border-border last:border-0", children: [_jsx("td", { className: "px-3 py-2", children: _jsx("input", { type: "checkbox", "aria-label": `Select ${task.title}`, checked: checkedUids.has(task.uid), onChange: () => onToggleChecked(task.uid) }) }), _jsx("td", { className: "px-3 py-2", children: _jsx(CompletionToggle, { task: task, onToggle: onToggle, pending: toggling.has(task.uid) }) }), _jsxs("td", { className: ["px-3 py-2", task.completed ? "line-through text-text-muted" : ""].join(" "), children: [task.title, _jsx(ProtectedMark, { record: task })] }), _jsx("td", { className: "px-3 py-2 text-text-muted", children: task.dueDate ? parseDueDate(task.dueDate).toLocaleDateString() : "" }), _jsx("td", { className: ["px-3 py-2", PRIORITY_CLASS[task.priority]].join(" "), children: PRIORITY_LABEL[task.priority] }), _jsx("td", { className: "px-3 py-2", children: _jsx("button", { type: "button", onClick: () => onDelete(task), "aria-label": `Delete "${task.title}"`, className: "text-text-muted hover:text-danger text-sm px-1", children: "\u00D7" }) })] }, task.uid))) })] }) }));
 }
 export default TasksPage;
 /** The tab's title: `Brand: Tasks` (see `pageTitle()`). */

package/dist/lib/admin/domainsApi.d.ts

@@ -56,7 +56,7 @@ export declare function deleteDomain(uid: string, version: number, client?: ApiC
  * Idempotent on an already-verified domain; a still-unverified result is not an error (only
  * `lastCheckedAt` advances) — always returns the domain's current state either way. */
 export declare function verifyDomain(uid: string, client?: ApiClient): Promise<Domain>;
-export type DnsRecordType = "ownership" | "mx" | "spf" | "dkim" | "dmarc" | "autodiscover_cname" | "autodiscover_srv";
+export type DnsRecordType = "ownership" | "mx" | "spf" | "dkim" | "dmarc" | "openpgpkey_cname" | "autodiscover_cname" | "autodiscover_srv";
 /** One mail-related DNS record this server recommends for a domain, live-checked against real DNS —
  * purely diagnostic, never mutates anything (unlike `verifyDomain`). The two `autodiscover_*` types are only
  * ever present while `@rapidmx/autodiscover-plugin` is active for this deployment. */

package/dist/lib/admin/escrowAccessRequestsApi.d.ts

@@ -9,6 +9,7 @@
  */
 import { ApiClient } from "../util/api.js";
 import { ListParams, RequestListParams } from "../util/apiQuery.js";
+import type { PublicKey, WrappedPrivateKey } from "../crypto/keyvaultApi.js";
 export type { ListParams, RequestListParams };
 export interface EscrowAccessRequestApproval {
     holderUserUid: string;
@@ -54,6 +55,11 @@ export interface MasterKeyWrap {
  * tooling, per `specs/end-to-end_encryption.md`'s "this server never holds the scope's private key". */
 export interface EscrowAccessMaterial {
     masterKeyWraps: MasterKeyWrap[];
+    /** The mailbox's wrapped private keys that read mail (zero-access and encryption keys, never signing), sealed under its master key. Absent
+     * from a server that predates releasing them. */
+    wrappedKeys?: WrappedPrivateKey[];
+    /** The certificate of each of `wrappedKeys`, matched by fingerprint. */
+    certificates?: PublicKey[];
 }
 /** `client`, given by every function below, is an explicit `ApiClient` from `createApiClient()` (e.g. one
  * account of a multi-account app) to call instead of the default global `apiFetch()` - see `withClient()`'s

package/dist/lib/calendar/calendarApi.d.ts

@@ -2,7 +2,8 @@
  * header comment for the shared ACL/authorization model every wrapper file here follows. Recurrence
  * expansion happens entirely client-side (see `apps/shared/lib/recurrence.ts`) — the backend stores/returns
  * `RecurrenceRule` as-is and does no RFC5545 expansion of its own. */
-import { ApiClient } from "../util/api.js";
+import { ApiClient, ApiRequestError } from "../util/api.js";
+import { type InvitationContent } from "./protectedEvents.js";
 export type AttendeeRole = "required" | "optional" | "resource";
 export type AttendeeResponseStatus = "needsAction" | "accepted" | "declined" | "tentative";
 export interface Attendee {
@@ -112,6 +113,16 @@ export interface CalendarEvent {
      * `mailto` only). Still to be rendered through `sanitizeEventDescriptionHtml()` (`eventDescription.ts`), never trusted as it stands. `null` or absent:
      * the description, if any, is plain text. */
     descriptionHtml?: string | null;
+    /** Response-only. An event made from an invitation that reached a zero-access mailbox: its title, location and description are only
+     * sealed to the mailbox's zero-access key (`title` is `[...]`). `apps/shared/calendar/sealedEvents.ts` opens them. */
+    sealedContent?: {
+        keyFingerprint: string;
+        sealed: string;
+    };
+    /** Response-only. An event of a calendar zero-access encryption protects: its title, location and description, each sealed to the
+     * mailbox's zero-access key (the readable `title` is "Protected event"). Every function here returns events with them opened when the
+     * mailbox is unlocked (`lib/zeroAccess/sealedRecords.ts`); writes go through `protectedEvents.ts`. */
+    sealedFields?: Record<string, string> | null;
     /** Who may see the event's details - absent (or `null`, on a row stored before this existed) reads as `"default"`; see `visibilityOf()`. */
     visibility?: EventVisibility | null;
     /** Whether the guests may ask for the event to change (default `false`). Absent or `null` reads as the default; see `guestPermissionsOf()`. */
@@ -141,6 +152,14 @@ export interface CalendarEvent {
  * `LIST_CALENDAR_EVENTS_MAX_PAGES` pages guards against looping forever should a server ever ignore
  * `page` and keep returning full pages.
  */
+/** What a list opens of a protected event: what the calendar views draw. Each field is one decryption, and a calendar lists every event
+ * it has - the rest (the description) is opened by the view that shows or edits it, by a search, and by a save. */
+export declare const EVENT_LIST_FIELDS: readonly ["title", "location"];
+/** `event` with every protected field opened, when only some were (a listed event) - for a write, which sends only what changed and
+ * invites with the whole content. The title of one whose `sealedContent` was opened stays: a row can hold both, and its per-field copy
+ * (`sealedFields.title`) is then an older title the sealed content's replaced (renamed since) - or, sealed without one, the same title
+ * `openSealedEvents()` already shows. */
+export declare function fullyOpenedEvent<T extends CalendarEvent | undefined>(event: T): Promise<T>;
 export declare function listCalendarEvents(folderUid: string, client?: ApiClient): Promise<CalendarEvent[]>;
 export declare function getCalendarEvent(uid: string, client?: ApiClient): Promise<CalendarEvent>;
 export interface CalendarEventInput {
@@ -172,13 +191,38 @@ export interface CalendarEventInput {
     guestsCanModify?: boolean;
     guestsCanInviteOthers?: boolean;
     guestsCanSeeGuestList?: boolean;
+    /**
+     * What the server sends a protected event's save-time invitations with (restapi `BaseCalendarEventRoute.takeInvitationContent()`).
+     * On a create, `{ defer: true }` holds them back for the save that follows - the event editor's, which attaches the video meeting and
+     * its link keys first - so attendees get one invitation, the one with the link. On an update, `{ defer: true }` sends none with this
+     * save either (they stay pending), and a content (`title`...) is what `updateCalendarEvent()` invites with when `current` couldn't be
+     * opened on this device - the content it opened wins otherwise.
+     */
+    invitationContent?: Partial<InvitationContent> & {
+        defer?: boolean;
+    };
 }
 export declare function createCalendarEvent(input: CalendarEventInput, client?: ApiClient): Promise<CalendarEvent>;
 export interface UpdateCalendarEventInput extends Partial<CalendarEventInput> {
     uid: string;
     version: number;
 }
-export declare function updateCalendarEvent(input: UpdateCalendarEventInput, client?: ApiClient): Promise<CalendarEvent>;
+/** Saves `input`. `current` is the event as this device shows it: for an event of a protected calendar, the write then sends only the
+ * content that changed, and the content the server invites with (`protectedEventWrite()`; `input.invitationContent` when `current` isn't
+ * opened, none with `{ defer: true }`). For an event whose video meeting is protected,
+ * every attendee's link key goes with it (`meetingLinkSecrets()`), for the server to add to their links in the invitations it sends. */
+export declare function updateCalendarEvent(input: UpdateCalendarEventInput, client?: ApiClient, current?: CalendarEvent): Promise<CalendarEvent>;
+/** What `SealedEventContentError` says. */
+export declare const SEALED_EVENT_CONTENT_MESSAGE = "This event came from an invitation to a zero-access mailbox and its details are sealed, so its location or description can only be changed together with its title. Unlock your mailbox, open the event again and make the change there.";
+/**
+ * restapi's refusal (409) of a location or description change to an event made from a zero-access invitation (`sealedContent`) sent
+ * with its placeholder title or none: resealing would lose the title. `saveCalendarEvent()` leaves out the placeholders of one it hasn't
+ * opened, so this comes back only when this device didn't know the event was sealed (it was filed sealed after it was loaded). An
+ * `ApiRequestError` (409), as `SealedMoveError` is, so the event dialog and the drag handler show its message.
+ */
+export declare class SealedEventContentError extends ApiRequestError {
+    constructor();
+}
 export declare function deleteCalendarEvent(uid: string, version: number, client?: ApiClient): Promise<void>;
 /** The subset of `AttendeeResponseStatus` a caller can actually respond with — `"needsAction"` is only
  * ever a default/initial value, never a valid response. */
@@ -190,9 +234,10 @@ export type AttendeeResponseInput = Exclude<AttendeeResponseStatus, "needsAction
  * `"accepted"`/`"tentative"` the whole updated `CalendarEvent` comes back, with only the calling
  * attendee's own `responseStatus` changed. On `"declined"`, the backend instead soft-deletes the
  * mailbox's own copy of the event and returns only `{ uid }` — the caller should treat a decline the
- * same as a delete rather than expecting an updated event back.
+ * same as a delete rather than expecting an updated event back. `current` (the event as this device shows it) names a protected event's
+ * reply by its real title (`invitationContentOf()`).
  */
-export declare function respondToEvent(uid: string, responseStatus: AttendeeResponseInput, client?: ApiClient): Promise<CalendarEvent | {
+export declare function respondToEvent(uid: string, responseStatus: AttendeeResponseInput, client?: ApiClient, current?: CalendarEvent): Promise<CalendarEvent | {
     uid: string;
 }>;
 /** A change a guest asks the organizer for (`requestEventChange()`): only what is to differ. */
@@ -225,6 +270,7 @@ export interface EventChangeRequestResult {
  * Asks the organizer to change an event, as a guest (not the organizer) whose copy allows it: the title, location, description or time need
  * `guestsCanModify`, added guests need `guestsCanInviteOthers` (403 otherwise; 400 when nothing differs from what the event has, or a value is invalid).
  * Nothing changes on this mailbox's own copy - the request is mailed to the organizer, and when the change is allowed it is applied there and
- * arrives back later as an ordinary update of the invitation.
+ * arrives back later as an ordinary update of the invitation. `invitationContent` (the event's real content, `invitationContentOf()`)
+ * names a protected event in the request by its real title.
  */
-export declare function requestEventChange(uid: string, request: EventChangeRequest, client?: ApiClient): Promise<EventChangeRequestResult>;
+export declare function requestEventChange(uid: string, request: EventChangeRequest, client?: ApiClient, invitationContent?: InvitationContent): Promise<EventChangeRequestResult>;