@rapidmx/web-client 0.35.0 → 0.37.0

package/dist/lib/mail/mailApi.d.ts

@@ -10,7 +10,7 @@
  */
 import { ApiClient, ApiRequestError } from "../util/api.js";
 import { ListParams } from "../util/apiQuery.js";
-import type { EncryptionPreference, PublicKey } from "../crypto/keyvaultApi.js";
+import type { EncryptionPreference, PublicKey, ZeroAccessKey } from "../crypto/keyvaultApi.js";
 import type { ResolvedPrincipal } from "./mailboxAccessApi.js";
 export type { ListParams };
 export type { EncryptionPreference, PublicKey };
@@ -95,6 +95,18 @@ export interface Mailbox {
      * per the spec's own `PublicKey` doc comment. Absent/empty means no keys enrolled yet
      * (`KeyEnrollmentGate` handles that state). */
     keys?: PublicKey[];
+    /** The mailbox's zero-access certificates, managed by the server (never written by a client). Read them from
+     * `KeyVault.zeroAccessKeys` to unlock; here only so a settings page can tell whether one is enrolled. */
+    zeroAccessKeys?: ZeroAccessKey[];
+    /** "Enable zero-access encryption": unset means on. Only the mailbox's owner can change it - restapi drops anybody
+     * else's value. Has no effect while the server's `EncryptionPolicy.allowZeroAccess` is off. */
+    zeroAccessEnabled?: boolean;
+    /** Which data types zero-access encryption covers - see `ZeroAccessTypes`. Owner only. */
+    zeroAccessTypes?: ZeroAccessTypes;
+    /** The ActiveSync and Outlook clients that sync this mailbox, as the server last saw them. Server-written. */
+    syncClients?: SyncClients;
+    /** When the owner last exported a zero-access key for a phone or Outlook. Server-written. */
+    zeroAccessKeysExportedAt?: number;
     /** How the caller reaches this mailbox: `"owner"` (theirs) or `"delegate"` (shared with them). Set by the plain list and read of
      * mailboxes - not in an administration-scope answer - so a client can label the shared ones; see `isSharedWithMe()`. */
     accessRole?: "owner" | "delegate";
@@ -191,6 +203,25 @@ export declare function autoProvisionMailbox(selection?: {
  * `null` clears them - `JSON.stringify()` drops an `undefined` value entirely, which would instead leave
  * the old value in place.
  */
+/** The data types zero-access encryption can cover (restapi `specs/search.md` §3 *What It Covers*). */
+export type ZeroAccessDataType = "mail" | "calendar" | "contacts" | "tasks";
+/** `Mailbox.zeroAccessTypes`: per data type, whether zero-access covers it. A type left out is undecided: mail counts as on, the others
+ * as off, until the server decides them from the owner's devices. */
+export type ZeroAccessTypes = Partial<Record<ZeroAccessDataType, boolean>>;
+/** `Mailbox.syncClients`: the ActiveSync devices (each with the data types it syncs) and Outlook. */
+export interface SyncClients {
+    activesync?: {
+        devices: {
+            id: string;
+            model?: string;
+            types: ZeroAccessDataType[];
+            lastSeenAt: number;
+        }[];
+    };
+    mapi?: {
+        lastSeenAt: number;
+    };
+}
 export interface UpdateMailboxInput {
     uid: string;
     version: number;
@@ -215,6 +246,12 @@ export interface UpdateMailboxInput {
     autoSendReceiptsInternal?: boolean;
     autoSendReceiptsFederated?: boolean;
     autoSendReceiptsExternal?: boolean;
+    /** Owner-only server-side (anybody else's value is dropped) - see `Mailbox.zeroAccessEnabled`. */
+    zeroAccessEnabled?: boolean;
+    /** Owner-only server-side; a partial choice is merged into the stored one - see `Mailbox.zeroAccessTypes`. */
+    zeroAccessTypes?: ZeroAccessTypes;
+    /** The mailbox's own encryption preference, replaced whole - see `Mailbox.encryptPreference`. */
+    encryptPreference?: EncryptionPreference;
     /** Trusted-caller-only server-side. `null` (or `""`) unassigns the mailbox's escrow scope; the
      * referenced `EscrowScope` must exist otherwise. See `Mailbox.escrowScopeId`. */
     escrowScopeId?: string | null;
@@ -424,6 +461,13 @@ export interface Message {
      * stored body, not from a flag this API exposes. Always present on a real `Message` (defaults
      * `false` server-side), same optional-for-old-fixtures caveat as `Mailbox.oofEnabled`. */
     encrypted?: boolean;
+    /** Set when the server sealed this message at rest on arrival (zero-access, restapi `specs/search.md` §3): its stored body is an
+     * S/MIME message only the mailbox's zero-access key opens, `subject` is `[...]` and `bodyPreview` empty - the real ones are in
+     * `sealedSummary`. */
+    zeroAccess?: {
+        keyFingerprint: string;
+        sealedSummary: string;
+    };
     /** The raw RFC 2369/8058 `List-Unsubscribe` header value, if present — computed server-side by
      * `@rapidmx/restapi`'s `ScanPipeline` from the stored MIME, the strongest single bulk-mail signal it
      * captures. Used client-side to detect list traffic when replying, per
@@ -560,7 +604,7 @@ export type MessageReportKind = "junk" | "phishing" | "not_junk";
 /** Why the server did not teach its spam filter from a report: `encrypted` (it has no plaintext to teach), `disabled` (learning is switched off),
  * `unsupported` (no spam engine, or one that cannot learn), `too_large` (over the size it reads) or `failed` (the engine could not be reached,
  * refused, or the message could not be read). The report itself still happened. */
-export type MessageLearnSkipped = "encrypted" | "disabled" | "unsupported" | "too_large" | "failed";
+export type MessageLearnSkipped = "encrypted" | "zero_access" | "disabled" | "unsupported" | "too_large" | "failed";
 /** What `reportMessage()` answers. */
 export interface MessageReportResult {
     uid: string;
@@ -581,6 +625,9 @@ export interface ReportMessageOptions {
     /** With `not_junk` only (else a 400): also add the message's From address to the mailbox's safe senders. Needs full access to the mailbox (403 otherwise,
      * before anything is done). */
     alwaysTrustSender?: boolean;
+    /** For a zero-access message only (else a 400): its original source, base64-encoded, decrypted here - the server holds only the sealed
+     * copy, so this is what its spam filter learns from (never stored). Without it the server skips learning (`learnSkipped: "zero_access"`). */
+    rawMessage?: string;
 }
 /**
  * Reports a message as junk, phishing or not junk - `POST /mail/messages/:uid/report`. The SERVER moves it (`junk` and `phishing` to the mailbox's Junk Email,
@@ -708,7 +755,19 @@ export interface AssembleDraftInput {
     bcc?: ComposeRecipientInput[];
     subject?: string;
     html: string;
+    /** See `AssembleIntent`. */
+    intent?: AssembleIntent;
+    /** The addresses this copy is delivered to, when not all of `to`/`cc`/`bcc`: one copy of a message sent in two end-to-end
+     * formats (an S/MIME and an OpenPGP copy, each listing every recipient) goes only to the recipients of its own format. Each
+     * must be one of the recipients. */
+    deliverTo?: string[];
 }
+/**
+ * Why a draft is being assembled (server `ComposeIntent`). `"save"`, the default, keeps an edit: in a zero-access mailbox the server
+ * stores it sealed, which it can't send. `"send"` is the assemble right before `sendMessage()`/`queueMessageSend()`: stored readable
+ * until it is relayed, then sealed as the Sent Items copy.
+ */
+export type AssembleIntent = "save" | "send";
 /** What a draft records about the thread it belongs to - see `createDraft()`. */
 export interface DraftThreading {
     /** The `messageId` of the message being replied to (`Message.inReplyTo`). */
@@ -774,6 +833,8 @@ export interface AssembleDraftRawInput {
      * `crypto/smimeMessage.ts`'s `buildSignedOnlyMessage()`/`buildEncryptedMessage()`, combined with
      * the outer envelope headers (`From`/`To`/`Cc`/`Date`/`Message-ID`/`MIME-Version`) by the caller. */
     rawMime: string;
+    /** See `AssembleIntent`. */
+    intent?: AssembleIntent;
 }
 /**
  * Stores an already-signed/encrypted draft's raw MIME source as its `bodyBlobKey`, completely

package/dist/lib/mail/mailApi.js

@@ -274,7 +274,11 @@ export function moveMessage(message, folderUid, client) {
 export function reportMessage(uid, kind, options = {}, client) {
     return withClient(client, `/mail/messages/${encodeURIComponent(uid)}/report`, {
         method: "POST",
-        body: JSON.stringify({ kind, ...(options.alwaysTrustSender ? { alwaysTrustSender: true } : {}) }),
+        body: JSON.stringify({
+            kind,
+            ...(options.alwaysTrustSender ? { alwaysTrustSender: true } : {}),
+            ...(options.rawMessage ? { rawMessage: options.rawMessage } : {}),
+        }),
     });
 }
 /**

package/dist/lib/mail/mailboxImportApi.d.ts

@@ -7,6 +7,7 @@
  */
 import { ApiClient } from "../util/api.js";
 import { RequestListParams } from "../util/apiQuery.js";
+import type { Mailbox } from "./mailApi.js";
 export type { RequestListParams };
 export type MailboxImportFormat = "mbox" | "pst";
 export type MailboxImportStatus = "pending" | "processing" | "completed" | "failed";
@@ -51,3 +52,12 @@ export declare function uploadMailboxImport(file: File, input: UploadMailboxImpo
  * first; `params` pages through them (`limit` capped at 500 server-side). */
 export declare function listImportRequests(params?: RequestListParams, client?: ApiClient): Promise<MailboxImportRequest[]>;
 export declare function getImportRequest(uid: string, client?: ApiClient): Promise<MailboxImportRequest>;
+/** Why server-side import is refused for a mailbox whose mail is zero-access (restapi answers such an upload 409). */
+export declare const ZERO_ACCESS_IMPORT_MESSAGE: string;
+/**
+ * Whether `mailbox`'s mail is stored zero-access encrypted, so restapi refuses a server-side import into it (`specs/search.md` §3: the
+ * uploaded archive would wait readable in the blob store). Decided as restapi's `zeroAccessStatus()` decides it for mail: the
+ * administrator's "Allow zero-access encryption" (`allowZeroAccess`; unknown counts as allowed, so an import is never offered only to be
+ * refused), the owner's switch (unset is on), mail among the protected types (undecided is on), and a key that isn't revoked.
+ */
+export declare function mailIsZeroAccess(mailbox: Pick<Mailbox, "zeroAccessEnabled" | "zeroAccessTypes" | "zeroAccessKeys">, allowZeroAccess: boolean | undefined): boolean;

package/dist/lib/mail/mailboxImportApi.js

@@ -37,3 +37,18 @@ export function listImportRequests(params = {}, client) {
 export function getImportRequest(uid, client) {
     return withClient(client, `/mail/mailbox-import-requests/${encodeURIComponent(uid)}`);
 }
+/** Why server-side import is refused for a mailbox whose mail is zero-access (restapi answers such an upload 409). */
+export const ZERO_ACCESS_IMPORT_MESSAGE = "Importing an archive isn't available while zero-access encryption protects this mailbox's mail: the server would have to keep " +
+    "the uploaded archive readable until the import ran, which zero-access encryption doesn't allow.";
+/**
+ * Whether `mailbox`'s mail is stored zero-access encrypted, so restapi refuses a server-side import into it (`specs/search.md` §3: the
+ * uploaded archive would wait readable in the blob store). Decided as restapi's `zeroAccessStatus()` decides it for mail: the
+ * administrator's "Allow zero-access encryption" (`allowZeroAccess`; unknown counts as allowed, so an import is never offered only to be
+ * refused), the owner's switch (unset is on), mail among the protected types (undecided is on), and a key that isn't revoked.
+ */
+export function mailIsZeroAccess(mailbox, allowZeroAccess) {
+    return (allowZeroAccess !== false &&
+        mailbox.zeroAccessEnabled !== false &&
+        mailbox.zeroAccessTypes?.mail !== false &&
+        (mailbox.zeroAccessKeys ?? []).some((key) => !key.revokedAt));
+}

package/dist/lib/search/zeroAccessIndexApi.d.ts

@@ -0,0 +1,85 @@
+/**
+ * Typed wrappers over `@rapidmx/restapi`'s zero-access search index (`/mail/mailboxes/:id/search-index`, `specs/search.md` §7-8): the
+ * sealed index entries the server writes at delivery and the weekly segments clients compact them into. Everything here is
+ * ciphertext encrypted to the mailbox's zero-access key - `apps/shared/search/zeroAccessIndexSync.ts` decrypts and imports it.
+ */
+import { type ApiClient } from "../util/api.js";
+export type SegmentOrigin = "zero-access" | "client";
+/** A compacted segment as the manifest lists it. */
+export interface IndexSegment {
+    weekId: string;
+    generation: number;
+    origin: SegmentOrigin;
+    bytes: number;
+    etag: string;
+    schemaVersion: number;
+    keyFingerprint: string;
+    entryCount: number;
+}
+/** A week's entries not yet compacted. */
+export interface IndexWeekEntries {
+    weekId: string;
+    pendingEntries: number;
+    latestEntryAt: string;
+    /** The week has closed and its grace period has passed: a client may compact it. */
+    compactable: boolean;
+    /** When the week becomes (or became) compactable - where the platform stagger starts. Absent from a server before it. */
+    compactableAt?: string;
+    /** Size of the week's pending sealed entries (bytes of base64). Absent from a server before it. */
+    pendingBytes?: number;
+}
+export interface SegmentManifest {
+    mailboxUid: string;
+    segments: IndexSegment[];
+    weeks: IndexWeekEntries[];
+}
+/** One pending entry: `sealed` is base64 CMS `EnvelopedData` of a gzipped JSON `ZeroAccessIndexDocument`. */
+export interface SealedIndexEntry {
+    uid: string;
+    weekId: string;
+    messageUid: string;
+    createdAt: string;
+    keyFingerprint: string;
+    sealed: string;
+}
+export interface SealedIndexEntryPage {
+    entries: SealedIndexEntry[];
+    next?: string;
+}
+/** What a sealed entry (and each document of a segment) decrypts to - restapi's `ZeroAccessIndexDocument`. */
+export interface ZeroAccessIndexDocument {
+    v: 1;
+    messageUid: string;
+    subject: string;
+    body: string;
+    attachmentText: string[];
+    attachmentNames: string[];
+    deferredAttachments: string[];
+    from: string;
+    to: string[];
+    cc: string[];
+    participants: string[];
+    dateForSort: number;
+}
+/** `PUT .../segments/:weekId`. */
+export interface SegmentUpload {
+    expectedGeneration: number;
+    /** Base64 of the sealed file. */
+    segment: string;
+    keyFingerprint: string;
+    schemaVersion: number;
+    origin?: SegmentOrigin;
+    foldedEntryUids?: string[];
+}
+export declare function getSearchIndexManifest(mailboxUid: string, client?: ApiClient): Promise<SegmentManifest>;
+/** One page of pending entries: of `week` when given, written at or after `since` when given, after uid `after`. */
+export declare function listSearchIndexEntries(mailboxUid: string, options?: {
+    week?: string;
+    since?: string;
+    after?: string;
+    limit?: number;
+}, client?: ApiClient): Promise<SealedIndexEntryPage>;
+/** The sealed file of a week's segment generation. */
+export declare function getSearchIndexSegment(mailboxUid: string, segment: Pick<IndexSegment, "weekId" | "generation" | "origin">, client?: ApiClient): Promise<Uint8Array>;
+/** Stores a compaction. Rejects with a `409` when the week's segment changed since `upload.expectedGeneration` was read. */
+export declare function putSearchIndexSegment(mailboxUid: string, weekId: string, upload: SegmentUpload, client?: ApiClient): Promise<IndexSegment>;

package/dist/lib/search/zeroAccessIndexApi.js

@@ -0,0 +1,35 @@
+///////////////////////////////////////////////////////////////////////////////
+// Copyright (C) 2026 Jean-Philippe Steinmetz
+// SPDX-License-Identifier: MPL-2.0
+///////////////////////////////////////////////////////////////////////////////
+/**
+ * Typed wrappers over `@rapidmx/restapi`'s zero-access search index (`/mail/mailboxes/:id/search-index`, `specs/search.md` §7-8): the
+ * sealed index entries the server writes at delivery and the weekly segments clients compact them into. Everything here is
+ * ciphertext encrypted to the mailbox's zero-access key - `apps/shared/search/zeroAccessIndexSync.ts` decrypts and imports it.
+ */
+import { withClient, withClientBlob } from "../util/api.js";
+const base = (mailboxUid) => `/mail/mailboxes/${encodeURIComponent(mailboxUid)}/search-index`;
+export function getSearchIndexManifest(mailboxUid, client) {
+    return withClient(client, `${base(mailboxUid)}/manifest`);
+}
+/** One page of pending entries: of `week` when given, written at or after `since` when given, after uid `after`. */
+export function listSearchIndexEntries(mailboxUid, options = {}, client) {
+    const query = new URLSearchParams();
+    for (const [key, value] of Object.entries(options)) {
+        if (value !== undefined) {
+            query.set(key, String(value));
+        }
+    }
+    const search = query.toString();
+    return withClient(client, `${base(mailboxUid)}/entries${search ? `?${search}` : ""}`);
+}
+/** The sealed file of a week's segment generation. */
+export async function getSearchIndexSegment(mailboxUid, segment, client) {
+    const query = `generation=${segment.generation}${segment.origin === "client" ? "&origin=client" : ""}`;
+    const blob = await withClientBlob(client, `${base(mailboxUid)}/segments/${encodeURIComponent(segment.weekId)}?${query}`, "Could not download a search index segment.");
+    return new Uint8Array(await blob.arrayBuffer());
+}
+/** Stores a compaction. Rejects with a `409` when the week's segment changed since `upload.expectedGeneration` was read. */
+export function putSearchIndexSegment(mailboxUid, weekId, upload, client) {
+    return withClient(client, `${base(mailboxUid)}/segments/${encodeURIComponent(weekId)}`, { method: "PUT", body: JSON.stringify(upload) });
+}

package/dist/lib/tasks/tasksApi.d.ts

@@ -24,6 +24,9 @@ export interface Task {
     myDay?: boolean;
     /** The uid of the user this task is assigned to, if any. */
     assignedTo?: string;
+    /** The title and notes sealed to the mailbox's zero-access key while it protects tasks (`title` is then a placeholder) - opened with
+     * `openSealedRecords()`. Server-written. */
+    sealedFields?: Record<string, string> | null;
 }
 /** `client`, given by every function below, is an explicit `ApiClient` from `createApiClient()` (e.g. one
  * account of a multi-account app) to call instead of the default global `apiFetch()` - see `withClient()`'s
@@ -56,8 +59,15 @@ export interface UpdateTaskInput {
     taskListUid?: string;
     myDay?: boolean;
     assignedTo?: string;
+    /** A move to another mailbox, with `folderUid` there - refused for a protected task (`SealedMoveError`). */
+    mailboxUid?: string;
+    folderUid?: string;
 }
-export declare function updateTask(input: UpdateTaskInput, client?: ApiClient): Promise<Task>;
+/** Saves `input`. One moving the task to another mailbox (`mailboxUid`) is refused with `SealedMoveError` when the task is protected -
+ * before sending anything when `current` (the task as this device has it) says so, else from the server's refusal. With `current`, a
+ * protected task's sealed fields go only when they changed from it, and an emptied one is named in `clearedFields` when `current` was
+ * opened here (`protectedRecordWrite()`). */
+export declare function updateTask(input: UpdateTaskInput, client?: ApiClient, current?: Task): Promise<Task>;
 /** Toggles a task's `completed` flag in place — same pattern as `mailApi.ts`'s `setMessageRead`. */
 export declare function setTaskCompleted(task: Task, completed: boolean, client?: ApiClient): Promise<Task>;
 /** Adds/removes a task from the caller's curated "My Day" working set — same thin-wrapper pattern as

package/dist/lib/tasks/tasksApi.js

@@ -6,6 +6,8 @@
  * comment for the shared ACL/authorization model every wrapper file here follows. */
 import { withClient } from "../util/api.js";
 import { SETTINGS_LIST_LIMIT, buildQuery } from "../util/apiQuery.js";
+import { guardSealedMove } from "../zeroAccess/sealedMoves.js";
+import { protectedRecordWrite } from "../zeroAccess/sealedRecords.js";
 /** `client`, given by every function below, is an explicit `ApiClient` from `createApiClient()` (e.g. one
  * account of a multi-account app) to call instead of the default global `apiFetch()` - see `withClient()`'s
  * own doc comment in `util/api.ts`. Omitted (the default), every function here behaves exactly as before. */
@@ -22,11 +24,15 @@ export function createTask(input, client) {
         body: JSON.stringify({ completed: false, priority: "normal", ...input }),
     });
 }
-export function updateTask(input, client) {
-    return withClient(client, `/mail/tasks/${encodeURIComponent(input.uid)}`, {
+/** Saves `input`. One moving the task to another mailbox (`mailboxUid`) is refused with `SealedMoveError` when the task is protected -
+ * before sending anything when `current` (the task as this device has it) says so, else from the server's refusal. With `current`, a
+ * protected task's sealed fields go only when they changed from it, and an emptied one is named in `clearedFields` when `current` was
+ * opened here (`protectedRecordWrite()`). */
+export function updateTask(input, client, current) {
+    return guardSealedMove(current, input.mailboxUid, () => withClient(client, `/mail/tasks/${encodeURIComponent(input.uid)}`, {
         method: "PUT",
-        body: JSON.stringify(input),
-    });
+        body: JSON.stringify(protectedRecordWrite(current, input)),
+    }));
 }
 /** Toggles a task's `completed` flag in place — same pattern as `mailApi.ts`'s `setMessageRead`. */
 export function setTaskCompleted(task, completed, client) {

package/dist/lib/util/clientPlatform.d.ts

@@ -0,0 +1,14 @@
+/**
+ * What kind of client this is, for work that should prefer one over another - the search index's week compaction, which a phone
+ * should leave to a computer (restapi `specs/search.md` §8 *Who compacts*).
+ *
+ * - `"desktop"`: a native app on a computer (`tauri-client`, `electron-client`), which installs `window.rapidmx`.
+ * - `"mobile"`: a native app on a phone or tablet (the host sets `window.rapidmx.formFactor: "mobile"`), or a phone or tablet browser.
+ * - `"web"`: any other browser.
+ */
+export type ClientPlatform = "desktop" | "web" | "mobile";
+/** This client's platform (see the module comment). */
+export declare function clientPlatform(): ClientPlatform;
+/** Whether the connection is one to spare: cellular, or the user asked to save data (Network Information API, where the browser
+ * has it - absent, the connection is taken as unconstrained). */
+export declare function isConstrainedConnection(): boolean;

package/dist/lib/util/clientPlatform.js

@@ -0,0 +1,26 @@
+const MOBILE_USER_AGENT = /Android|iPhone|iPad|iPod|Mobile/i;
+function navigatorHints() {
+    return typeof navigator === "undefined" ? undefined : navigator;
+}
+/** Whether this browser runs on a phone or tablet, by its User-Agent Client Hints, else its user agent string. */
+function isMobileBrowser() {
+    const hints = navigatorHints();
+    if (typeof hints?.userAgentData?.mobile === "boolean") {
+        return hints.userAgentData.mobile;
+    }
+    return MOBILE_USER_AGENT.test(hints?.userAgent ?? "");
+}
+/** This client's platform (see the module comment). */
+export function clientPlatform() {
+    const host = typeof window === "undefined" ? undefined : window.rapidmx;
+    if (host) {
+        return host.formFactor === "mobile" ? "mobile" : "desktop";
+    }
+    return isMobileBrowser() ? "mobile" : "web";
+}
+/** Whether the connection is one to spare: cellular, or the user asked to save data (Network Information API, where the browser
+ * has it - absent, the connection is taken as unconstrained). */
+export function isConstrainedConnection() {
+    const connection = navigatorHints()?.connection;
+    return connection?.saveData === true || connection?.type === "cellular";
+}

package/dist/lib/videoconf/protectedMeetings.d.ts

@@ -0,0 +1,74 @@
+import type { ApiClient } from "../util/api.js";
+import { type VideoMeetingDetail, type VideoMeetingInvitee } from "./videoMeetingsApi.js";
+/** How long after the meeting ends its key is kept (`mail:videoconf:key_grace_minutes`' default). */
+export declare const MEETING_KEY_GRACE_MS: number;
+/** What `createVideoMeeting()` sends to protect a meeting. */
+export interface MeetingProtectionInput {
+    meetingKey: {
+        certificate: string;
+    };
+    keyExpiresAt: string;
+    keyWraps: {
+        mailboxUid: string;
+        recipientFingerprint: string;
+        kind: "meeting-key";
+        cms: string;
+    }[];
+    sealedFields: {
+        title: string;
+    };
+}
+/** A protected meeting's fields, as the server returns them to its organizer. */
+export interface ProtectedMeetingFields {
+    keyProtected?: boolean | null;
+    keyWraps?: {
+        mailboxUid: string;
+        recipientFingerprint: string;
+        kind: string;
+        cms: string;
+    }[] | null;
+    /** When the meeting key is discarded (ISO). */
+    keyExpiresAt?: string | null;
+}
+/** Forgets every opened meeting key (sign-out, or the test seam). */
+export declare function clearMeetingKeys(): void;
+/** When a meeting ending at `endDate` - the last occurrence's end, for a series that has one - has its key discarded. */
+export declare function meetingKeyExpiry(endDate: Date, now?: number): Date;
+/** What protects a new meeting of `mailboxUid` titled `title` with `invitees`, its key discarded at `expiresAt` - or `undefined` when
+ * the mailbox has no zero-access key unlocked here (the meeting is then not protected). `fragment` is every participant's link key. */
+export declare function protectMeeting(mailboxUid: string, title: string, invitees: VideoMeetingInvitee[], expiresAt: Date): Promise<{
+    protection: MeetingProtectionInput;
+    invitees: {
+        email: string;
+        sealedFields?: {
+            displayName: string;
+        };
+    }[];
+    fragment: string;
+} | undefined>;
+/** Remembers a just-created meeting's link key - `null` for one that isn't protected - so the save that invites to it needn't fetch the
+ * meeting or reopen its wrap. `mailboxUid` is the organizer's mailbox: its lock forgets the key. */
+export declare function rememberMeetingKey(meetingUid: string, fragment: string | null, mailboxUid: string): void;
+/** `meeting`'s link key - remembered, or opened from the organizer's wrap with the mailbox's unlocked zero-access keys - or `undefined`
+ * when it isn't protected or can't be opened here. Never rejects. */
+export declare function meetingKeyFragmentOf(meeting: VideoMeetingDetail & ProtectedMeetingFields): Promise<string | undefined>;
+/** `meeting`'s organizer join link, with the meeting key after `#` when it is protected - `null` when there is none, or the key can't
+ * be opened here (a protected meeting can't be joined without it). */
+export declare function organizerJoinLink(meeting: VideoMeetingDetail & ProtectedMeetingFields): Promise<string | null>;
+/** For a save of `event` that may invite: every attendee's link key (`invitationContent.meetingLinkSecrets`), when its video meeting is
+ * protected and its key opens here - else `undefined`. Never rejects. */
+export declare function meetingLinkSecrets(event: {
+    videoMeetingUid?: string | null;
+    attendees?: {
+        address: string;
+    }[];
+    organizer?: {
+        address: string;
+    };
+}, client?: ApiClient): Promise<Record<string, string> | undefined>;
+/**
+ * Moves the key expiry of meeting `meetingUid` - when it is protected - to follow its event's new end, `endDate` (the last occurrence's
+ * end, for a series): its key is discarded an hour after the end it was made for, so a meeting moved later (or a series extended) would
+ * otherwise be unjoinable by then. Best effort, after the event itself is saved: a failure is logged, never thrown.
+ */
+export declare function followMeetingKeyExpiry(meetingUid: string, endDate: Date, client?: ApiClient): Promise<void>;