@rapidmx/web-client 0.35.0 → 0.37.0

package/apps/shared/mail/outbox/sendOutcomes.ts

@@ -2,7 +2,7 @@
 // Copyright (C) 2026 Jean-Philippe Steinmetz
 // SPDX-License-Identifier: MPL-2.0
 ///////////////////////////////////////////////////////////////////////////////
-import { Message, cancelScheduledSend, getMessage, listAttachments, listFolders, queueMessageSend } from "../../../../lib/mail/mailApi.js";
+import { Message, cancelScheduledSend, deleteMessage, getMessage, listAttachments, listFolders, queueMessageSend } from "../../../../lib/mail/mailApi.js";
 import { SendEvent, describeSendEventError } from "../../../../lib/mail/sendEvents.js";
 import type { ApiClient } from "../../../../lib/util/api.js";
 import { formatRecipient } from "../../components/mail/compose/recipients.js";
@@ -12,7 +12,18 @@ import { dismiss, notify } from "../../notifications/store.js";
 import { beginPendingSend, finishPendingSend, setPendingStage } from "./pendingSends.js";
 import { failOutgoing, forgetOutgoing, markOutgoingSending, markOutgoingSent } from "./outgoingReplies.js";
 import { openComposeFromOutside } from "./composeBridge.js";
-import { describeMessage, forgetRetainedRequest, notifySent, openDraftFromRequest, retainedRequest } from "./sendJob.js";
+import {
+    SendRequest,
+    copyFailed,
+    copyRetried,
+    describeMessage,
+    forgetCopies,
+    forgetRetainedRequest,
+    notifySent,
+    openDraftFromRequest,
+    retainedRequest,
+    unsentCopies,
+} from "./sendJob.js";
 
 /**
  * What the user is told when the server reports how a queued message went (`send-succeeded`, `send-failed`, `send-retrying` push events,
@@ -43,14 +54,42 @@ function escapeHtml(text: string): string {
     return text.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
 }
 
-/** "Open draft" for a message the server failed to relay: back into Drafts, and into a compose window with what was written. */
-async function openFailedDraft(event: SendEvent, client: ApiClient | undefined): Promise<void> {
+/** The message a failure is about: as the server reports it (a `SendEvent`), or as this tab sent it. */
+export type FailedSend = Pick<SendEvent, "uid" | "mailboxUid" | "subject" | "recipients">;
+
+/** "Open draft" for a message the server failed to relay: back into Drafts, and into a compose window with what was written. `request`: the
+ * one it was queued from, when this tab holds it. */
+async function openFailedDraft(event: FailedSend, client: ApiClient | undefined, request: SendRequest | undefined): Promise<void> {
+    // A message sent as several copies (one per encryption format) is written again only when none of them went: while another copy has
+    // gone or may still go, the whole message sent again would reach its recipients a second time - however the action came to be offered.
+    const copies = unsentCopies(request);
+    if (request?.copyFates && !copies) {
+        notify({
+            id: `open-draft:${event.uid}`,
+            kind: "info",
+            title: "Only this copy didn't go",
+            message: "The copy for its other recipients is sent on its own. Use Retry to send this one to its own recipients.",
+            timeoutMs: 8_000,
+        });
+        return;
+    }
     try {
-        const moved = await moveBackToDrafts(event.uid, event.mailboxUid ?? "", client);
+        // Of a message sent as several copies, its own draft is the one written again.
+        const moved = await moveBackToDrafts(copies ? request!.draft.uid : event.uid, event.mailboxUid ?? "", client);
         // Back in Drafts it is no longer a message on its way in its conversation.
         forgetOutgoing(event.uid);
-        const request = retainedRequest(event.uid);
         if (request) {
+            // The other copies (the OpenPGP one's own draft) go: the message is encrypted afresh when it is sent again, and none of them may
+            // be retried meanwhile.
+            for (const uid of copies?.filter((uid) => uid !== request.draft.uid) ?? []) {
+                const extra = await moveBackToDrafts(uid, event.mailboxUid ?? "", client);
+                await deleteMessage(extra.uid, extra.version, client);
+                dismiss(failedId(uid));
+                forgetOutgoing(uid);
+            }
+            if (request.copyFates) {
+                forgetCopies(request.copyFates);
+            }
             openDraftFromRequest({ ...request, draft: moved });
             return;
         }
@@ -88,20 +127,24 @@ async function openFailedDraft(event: SendEvent, client: ApiClient | undefined):
     }
 }
 
-/** "Retry" for a message the server failed to relay: the same send call again - a failed message stays in Outbox and the server queues it afresh (with a new retry budget). */
-async function retryFailed(event: SendEvent, client: ApiClient | undefined): Promise<void> {
+/** "Retry" for a message the server failed to relay: the same send call again - a failed message stays in Outbox and the server queues it afresh (with a new retry budget).
+ * `request`: the one it was queued from, when this tab holds it - a copy of a message sent as several is then awaited again. */
+async function retryFailed(event: FailedSend, client: ApiClient | undefined, request: SendRequest | undefined): Promise<void> {
     if (!beginPendingSend({ draftUid: event.uid, mailboxUid: event.mailboxUid ?? "", subject: event.subject, recipients: event.recipients, scheduled: false })) {
         return;
     }
     dismiss(failedId(event.uid));
     markOutgoingSending(event.uid);
+    copyRetried(request, event.uid);
     try {
         setPendingStage(event.uid, "queuing");
         const result = await queueMessageSend(event.uid, client);
-        if (!result.queued) {
+        // Relayed before the server answered - and so, when it is one copy of several, maybe the last of them.
+        if (!result.queued && forgetRetainedRequest(event.uid)) {
             notifySent();
         }
     } catch (err) {
+        copyFailed(request, event.uid);
         notifyApiError(err, "This message wasn't sent", { dedupeKey: failedId(event.uid) });
     } finally {
         finishPendingSend(event.uid);
@@ -114,26 +157,29 @@ async function retryFailed(event: SendEvent, client: ApiClient | undefined): Pro
 export function handleSendEvent(event: SendEvent, client?: ApiClient): void {
     if (event.action === "send-succeeded") {
         dismiss(retryId(event.uid));
-        dismiss(failedId(event.uid));
+        // A partly-sent message's failure (`notifyFailure()`) is shown under its first copy's uid but is of a copy that was never handed over:
+        // it stays, with the Retry that hands that copy over.
+        if (![...(retainedRequest(event.uid)?.copyFates?.values() ?? [])].includes("unsent")) {
+            dismiss(failedId(event.uid));
+        }
         // The conversation on screen swaps the message it drew for the Sent Items copy (a message this tab did not send has nothing drawn).
         markOutgoingSent(event.uid);
         // The server reports every message it relays, scheduled ones from long ago included: only a message this tab queued in the background is
         // worth a confirmation (several are one pop-up counting up). Anything else - a send-later message going out, another tab's send - is quiet.
-        if (retainedRequest(event.uid)) {
-            forgetRetainedRequest(event.uid);
+        // A message sent as several copies (one per encryption format) is confirmed once, when the last of them has gone.
+        if (retainedRequest(event.uid) && forgetRetainedRequest(event.uid)) {
             notifySent();
         }
         return;
     }
     const failure = describeSendEventError(event.error, event.action === "send-failed" ? "The server couldn't send this message." : "The server couldn't send this message yet.");
-    const what = describeMessage(event.subject, summary(event.recipients));
     if (event.action === "send-retrying") {
         const next = event.nextAttemptAt ? Date.parse(event.nextAttemptAt) : NaN;
         notify({
             id: retryId(event.uid),
             kind: "info",
             title: "Retrying to send",
-            message: `${what} (attempt ${event.attempt + 1}${Number.isNaN(next) ? "" : `, at ${new Date(next).toLocaleTimeString()}`}). ${failure.message}`,
+            message: `${describeMessage(event.subject, summary(event.recipients))} (attempt ${event.attempt + 1}${Number.isNaN(next) ? "" : `, at ${new Date(next).toLocaleTimeString()}`}). ${failure.message}`,
             details: failure.lines,
             sticky: false,
             timeoutMs: 8_000,
@@ -141,18 +187,43 @@ export function handleSendEvent(event: SendEvent, client?: ApiClient): void {
         return;
     }
     dismiss(retryId(event.uid));
-    const actions = [
-        { label: "Retry", onClick: () => void retryFailed(event, client) },
-        { label: "Open draft", onClick: () => void openFailedDraft(event, client) },
-    ];
+    const request = retainedRequest(event.uid);
+    copyFailed(request, event.uid);
+    notifySendFailure(event, failure, request, client);
+}
+
+/**
+ * The sticky "This message wasn't sent" for a message that failed, `failure` saying why, with what can be done about it - for one the server
+ * failed to relay, and for a message sent as several copies (`SendRequest.copyUids`) of which this tab couldn't hand over the rest after the
+ * server had failed one (`sendJob.ts`'s `notifyFailure()`). `request`: the one it was queued from, when this tab holds it.
+ */
+export function notifySendFailure(event: FailedSend, failure: { message: string; lines: string[] }, request: SendRequest | undefined, client: ApiClient | undefined): void {
+    // Every copy of a message sent as several (one per encryption format, `SendRequest.copyUids`) failed or never went: nobody has it, and it
+    // is the whole message's failure - one pop-up, whose Retry hands each copy over again and whose "Open draft" writes the message again.
+    const copies = unsentCopies(request);
+    // One copy of several, while another has gone or may still go: the others' recipients have theirs or will, and "Open draft" would send
+    // the whole message to them again - Retry sends just this copy, to just its own recipients.
+    const oneCopy = !!request?.copyFates && !copies;
+    const retry = () => {
+        for (const uid of copies ?? [event.uid]) {
+            void retryFailed({ ...event, uid }, client, request);
+        }
+    };
+    const actions = [{ label: "Retry", onClick: retry }, ...(oneCopy ? [] : [{ label: "Open draft", onClick: () => void openFailedDraft(event, client, request) }])];
+    const message: string = oneCopy ? `The copy for some of its recipients didn't go - the others' copy is sent on its own. ${failure.message}` : failure.message;
+    // What an earlier copy's failure said of the others is no longer so: this pop-up stands for the whole message.
+    for (const uid of copies?.filter((uid) => uid !== event.uid) ?? []) {
+        dismiss(failedId(uid));
+        failOutgoing(uid, message, actions);
+    }
     notify({
         id: failedId(event.uid),
         kind: "error",
         title: "This message wasn't sent",
-        message: `${what}: ${failure.message}`,
+        message: `${describeMessage(event.subject, summary(event.recipients))}: ${message}`,
         details: failure.lines,
         actions,
     });
     // The conversation on screen shows the same failure under the message, with the same ways out.
-    failOutgoing(event.uid, failure.message, actions);
+    failOutgoing(event.uid, message, actions);
 }

package/apps/shared/mail/reportNotices.ts

@@ -61,6 +61,8 @@ export function reportNotice(result: MessageReportResult, subject: string, alway
             ? "The spam filter could not be trained from this report."
             : result.learnSkipped === "encrypted"
               ? "Not used to train the spam filter: the message is encrypted."
-              : undefined;
+              : result.learnSkipped === "zero_access"
+                ? "Not used to train the spam filter: unlock your mailbox to let it learn from protected mail."
+                : undefined;
     return { title: kind.title, message: parts.join(" "), hint };
 }

package/apps/shared/mail/zeroAccessSource.ts

@@ -0,0 +1,27 @@
+///////////////////////////////////////////////////////////////////////////////
+// Copyright (C) 2026 Jean-Philippe Steinmetz
+// SPDX-License-Identifier: MPL-2.0
+///////////////////////////////////////////////////////////////////////////////
+import { getUnlockedKeys } from "../../../lib/crypto/keySession.js";
+import { openZeroAccessMessage } from "../../../lib/crypto/messageSecurity.js";
+import { getMessageRawContent, type Message } from "../../../lib/mail/mailApi.js";
+import type { ApiClient } from "../../../lib/util/api.js";
+
+/**
+ * The original source of a zero-access `message`, decrypted with its mailbox's unlocked keys and base64-encoded - what the server, which holds
+ * only the sealed copy, needs for an action that reads the message itself (`reportMessage()`'s `rawMessage`). `undefined` for any other
+ * message, while the mailbox is locked, or when it can't be fetched or opened: the action then goes ahead without it.
+ */
+export async function zeroAccessSourceBase64(message: Pick<Message, "uid" | "mailboxUid" | "zeroAccess">, client?: ApiClient): Promise<string | undefined> {
+    const unlocked = message.zeroAccess ? getUnlockedKeys(message.mailboxUid) : undefined;
+    if (!unlocked) {
+        return undefined;
+    }
+    try {
+        const original = await openZeroAccessMessage(await getMessageRawContent(message.uid, client), unlocked);
+        // A binary string (one char per byte), which `btoa()` encodes as the bytes themselves.
+        return original === undefined ? undefined : btoa(original);
+    } catch {
+        return undefined;
+    }
+}

package/apps/shared/search/LocalIndexLifecycle.tsx

@@ -8,20 +8,23 @@
  * "MUST be destroyed on the same events that destroy private keys: explicit logout, session revocation,
  * and the configurable idle timeout").
  *
- * **Why polling, not hooking the existing destroy call sites directly**: `destroyUnlockedKeys()`
- * (`react-shared/src/crypto/keySession.ts`) has no observer/callback hook. Watching `getUnlockedKeys()`
- * for a present-to-absent transition catches *every* destroy path uniformly - idle timeout, the manual
- * button, or anything else that calls it - without needing to know which one fired.
+ * **Locks**: `localIndexRpcClient.ts` itself destroys an index it opened the moment `subscribeKeySession()` reports its mailbox locked,
+ * whatever destroyed the keys (idle timeout, the manual button, a sign-out) and whether or not this component is still mounted. This
+ * component subscribes to the same `locked` event to reset what it remembers of the mailbox (built, synced) at that moment, so a re-unlock
+ * builds again - even one made before the next poll tick, which a poll alone would never see as a lock, leaving the destroyed index
+ * unbuilt and every zero-access sync failing against it. Keys only ever go away through `destroyUnlockedKeys()`, which always reports
+ * the lock, so the poll doesn't watch for a lock itself. A lock while a build is still deriving its index key, before anything is open
+ * for the index client to destroy, is the builder's own to catch (`localIndexBuilder.ts`): it opens nothing with destroyed keys.
  *
  * Every mailbox this component has seen unlocked is tracked for the life of the mount - not just whichever
  * is active right now - so switching mailboxes (or a folders-list refresh re-running the build effect)
  * can never lose a pending unlocked-to-locked transition for a mailbox whose index was already built.
  *
- * **Explicit logout** navigates away immediately, which may not leave time for a poll tick - `AppShell.tsx`
+ * **Explicit logout** navigates away immediately, which may not leave time for the lock's asynchronous destroy - `AppShell.tsx`
  * handles that case itself via `destroyAllLocalIndexes()`.
  */
 import { useEffect, useRef } from "react";
-import { getUnlockedKeys } from "../../../lib/crypto/keySession.js";
+import { getUnlockedKeys, subscribeKeySession } from "../../../lib/crypto/keySession.js";
 import type { PublicKey } from "../../../lib/crypto/keyvaultApi.js";
 import type { Folder } from "../../../lib/mail/mailApi.js";
 import type { ApiClient } from "../../../lib/util/api.js";
@@ -39,10 +42,20 @@ const loadBuilder = () =>
         builder = undefined;
         throw err;
     }));
-import { destroyLocalIndex, pruneInaccessibleLocalIndexes } from "./localIndexRpcClient.js";
+/** The zero-access index sync (`zeroAccessIndexSync.ts`), loaded the same way: only once a zero-access mailbox is unlocked. */
+let syncer: Promise<typeof import("./zeroAccessIndexSync.js")> | undefined;
+const loadSyncer = () =>
+    (syncer ??= import("./zeroAccessIndexSync.js").catch((err) => {
+        syncer = undefined;
+        throw err;
+    }));
+import { pruneInaccessibleLocalIndexes } from "./localIndexRpcClient.js";
 
 export const POLL_INTERVAL_MS = 5_000;
 
+/** How often an unlocked zero-access mailbox's local index is brought up to date with the server's sealed index. */
+export const ZERO_ACCESS_SYNC_INTERVAL_MS = 120_000;
+
 export interface LocalIndexLifecycleProps {
     mailboxUid?: string;
     mailboxKeys?: PublicKey[];
@@ -58,13 +71,44 @@ export default function LocalIndexLifecycle({ mailboxUid, folders, accessibleMai
     // apps, Electron), which keeps building the index against the default global cookie-based session exactly as before. A native,
     // multi-account host that renders this under an ApiClientContext.Provider gets its own account's client threaded through instead.
     const client = useApiClient();
-    // mailboxUid -> whether it was unlocked at the last check. An entry exists for every mailbox whose
-    // build this component started; only ever changed by a real observed transition, never reset by an
-    // effect re-run.
+    // mailboxUid -> whether it is unlocked as far as this component knows: set when its build starts, cleared by its lock. An entry exists
+    // for every mailbox whose build this component started; never reset by an effect re-run.
     const trackedRef = useRef(new Map<string, boolean>());
     // The latest props (and client), for the long-lived polling interval below.
     const latestRef = useRef({ mailboxUid, folders, client });
     latestRef.current = { mailboxUid, folders, client };
+    // mailboxUid -> when its last zero-access sync started. A mailbox syncs only once its build of this unlock settled (`builtRef` - the
+    // sync writes into the index the build opened), first at once and then every interval; a mailbox in `syncingRef` has a pass running,
+    // and never gets a second one alongside it. A lock forgets all three, so a pass still winding down never holds up the next unlock's.
+    const lastSyncRef = useRef(new Map<string, number>());
+    const builtRef = useRef(new Set<string>());
+    // mailboxUid -> its latest build, so only that one's end starts the sync (not one a lock overtook).
+    const buildsRef = useRef(new Map<string, symbol>());
+    const syncingRef = useRef(new Map<string, symbol>());
+
+    function syncIfDue(targetMailboxUid: string, targetClient: ApiClient | undefined) {
+        const unlocked = getUnlockedKeys(targetMailboxUid);
+        const last = lastSyncRef.current.get(targetMailboxUid);
+        if (
+            !unlocked?.zeroAccessKeys?.length ||
+            !builtRef.current.has(targetMailboxUid) ||
+            syncingRef.current.has(targetMailboxUid) ||
+            (last !== undefined && Date.now() - last < ZERO_ACCESS_SYNC_INTERVAL_MS)
+        ) {
+            return;
+        }
+        lastSyncRef.current.set(targetMailboxUid, Date.now());
+        const pass = Symbol(targetMailboxUid);
+        syncingRef.current.set(targetMailboxUid, pass);
+        loadSyncer()
+            .then(({ syncZeroAccessIndex }) => syncZeroAccessIndex(targetMailboxUid, unlocked, targetClient))
+            .catch(() => undefined)
+            .finally(() => {
+                if (syncingRef.current.get(targetMailboxUid) === pass) {
+                    syncingRef.current.delete(targetMailboxUid);
+                }
+            });
+    }
 
     function startBuildIfUnlocked(targetMailboxUid: string, targetFolders: Folder[], targetClient: ApiClient | undefined) {
         const unlocked = getUnlockedKeys(targetMailboxUid);
@@ -72,11 +116,21 @@ export default function LocalIndexLifecycle({ mailboxUid, folders, accessibleMai
             return;
         }
         trackedRef.current.set(targetMailboxUid, true);
+        const build = Symbol(targetMailboxUid);
+        buildsRef.current.set(targetMailboxUid, build);
         // Never an unhandled rejection - a broken local index is best-effort infrastructure, not a build
         // the rest of the app depends on.
-        loadBuilder()
+        // The sync runs however the build ended: zero-access mail reaches the index only through it, and a build that failed part-way
+        // isn't tried again until the next unlock. (Locked meanwhile, there are no keys to sync with.)
+        void loadBuilder()
             .then(({ buildLocalIndex }) => buildLocalIndex(targetMailboxUid, unlocked, targetFolders, undefined, targetClient))
-            .catch(() => undefined);
+            .catch(() => undefined)
+            .then(() => {
+                if (buildsRef.current.get(targetMailboxUid) === build && trackedRef.current.get(targetMailboxUid)) {
+                    builtRef.current.add(targetMailboxUid);
+                    syncIfDue(targetMailboxUid, targetClient);
+                }
+            });
     }
 
     useEffect(() => {
@@ -85,24 +139,30 @@ export default function LocalIndexLifecycle({ mailboxUid, folders, accessibleMai
         }
     }, [mailboxUid, folders, client]);
 
+    // A lock forgets the mailbox at once: no build of this unlock counts as built any more (the cancelled build's end finds `buildsRef`
+    // cleared and starts no sync), and the next unlock's tick starts a new build. The cancel and destroy themselves are
+    // `localIndexRpcClient.ts`'s, which reacts to the same event.
+    useEffect(
+        () =>
+            subscribeKeySession(({ mailboxUid: lockedUid, state }) => {
+                if (state === "locked" && trackedRef.current.get(lockedUid)) {
+                    trackedRef.current.set(lockedUid, false);
+                    lastSyncRef.current.delete(lockedUid);
+                    builtRef.current.delete(lockedUid);
+                    syncingRef.current.delete(lockedUid);
+                    buildsRef.current.delete(lockedUid);
+                }
+            }),
+        [],
+    );
+
     useEffect(() => {
         const interval = setInterval(() => {
-            for (const [trackedUid, wasUnlocked] of trackedRef.current) {
-                if (wasUnlocked && !getUnlockedKeys(trackedUid)) {
-                    // A present-to-absent transition: something just destroyed this mailbox's keys.
-                    trackedRef.current.set(trackedUid, false);
-                    // Stop the pass still running with the now-destroyed keys; the destroy itself also makes
-                    // the Worker reject anything that pass still sends.
-                    loadBuilder()
-                        .then(({ cancelLocalIndexBuild }) => cancelLocalIndexBuild(trackedUid))
-                        .catch(() => undefined);
-                    void destroyLocalIndex(trackedUid);
-                }
-            }
             // The active mailbox was (re-)unlocked since the last check, e.g. via an on-demand unlock prompt.
             const { mailboxUid: activeUid, folders: activeFolders, client: activeClient } = latestRef.current;
             if (activeUid) {
                 startBuildIfUnlocked(activeUid, activeFolders, activeClient);
+                syncIfDue(activeUid, activeClient);
             }
         }, POLL_INTERVAL_MS);
         return () => clearInterval(interval);

package/apps/shared/search/localIndexBuilder.ts

@@ -19,11 +19,16 @@
  * cross-folder interleaving imprecision here does not affect *what* ultimately survives the window, only
  * the exact order entities are inserted (and therefore briefly evicted-and-reinserted) in.
  *
- * Only encrypted messages (`subject === "[...]"`) are indexed - see `ENCRYPTED_SUBJECT_PLACEHOLDER`'s
+ * Only encrypted messages (`subject === "[...]"`, or flagged `encrypted` by the server - OpenPGP mail keeps its real outer subject) are indexed - see `ENCRYPTED_SUBJECT_PLACEHOLDER`'s
  * own precedent in `apps/www/index.tsx`'s inbox-list decrypt work. An unencrypted message is already
  * fully searchable via Tier 1; indexing it here too would spend this index's bounded byte budget on
  * content that didn't need it.
  *
+ * **Shared with the mailbox's other devices (Source C).** In a mailbox with a zero-access key, a pass first imports the end-to-end mail
+ * other devices already decrypted (`importClientSegments()`), at each message's version, so it isn't decrypted again here; and what this
+ * pass decrypts it uploads for them, sealed to the zero-access key (`uploadClientDocuments()`). Both are best effort - see
+ * `zeroAccessIndexSync.ts`.
+ *
  * **Verification seals.** A message this pass decrypts that has no seal for the vault's current `masterKeyGeneration` is
  * evaluated with `evaluateMessageSecurityWithSeal()`, against the sender's pinned signing keys from the reader's
  * contacts (`pinnedSigners.ts`, the message pane's own source, looked up once per sender per pass), so a verified
@@ -36,14 +41,16 @@
  * above), and fetching it only to seal would cost a download per message; they are sealed when opened.
  */
 import { getMessageRawContent, listFolders, listMessages, type Folder, type Message } from "../../../lib/mail/mailApi.js";
-import { type MessageSecurityResult, evaluateMessageSecurity, evaluateMessageSecurityWithSeal } from "../../../lib/crypto/messageSecurity.js";
+import { type MessageSecurityResult, type SignerPinsInput, evaluateMessageSecurity, evaluateMessageSecurityWithSeal } from "../../../lib/crypto/messageSecurity.js";
 import type { UnlockedKeys } from "../../../lib/crypto/keySession.js";
+import { KeysLockedError } from "../../../lib/crypto/masterKey.js";
 import type { ApiClient } from "../../../lib/util/api.js";
-import { getPinnedSignerFingerprints } from "../components/mail/pinnedSigners.js";
+import { getPinnedSigners } from "../components/mail/pinnedSigners.js";
 import { currentVerificationSeal, readVaultGeneration, sendVerificationSeal, verificationSealPending } from "../components/mail/verificationSeals.js";
-import type { LocalIndexEntity } from "./localIndexSchema.js";
+import { type LocalIndexEntity, messageRowFlags, messageRowVersion } from "./localIndexSchema.js";
 import {
     getIndexedVersions,
+    moveLocalEntity,
     indexLocalEntities,
     initLocalIndex,
     nextLocalIndexGeneration,
@@ -53,6 +60,7 @@ import {
 } from "./localIndexRpcClient.js";
 import { deriveLocalIndexKey } from "./localIndexKey.js";
 import { getLocalIndexByteBudget } from "./localIndexSizePreference.js";
+import { importClientSegments, rememberZeroAccessMetadata, uploadClientDocuments } from "./zeroAccessIndexSync.js";
 
 /** The RFC 9788 placeholder subject every encrypted message's outer envelope carries server-side - see
  * `apps/www/index.tsx`'s identical constant and its own doc comment for the full citation. */
@@ -91,6 +99,9 @@ export const MAX_WALK_ATTEMPTS = 3;
 export const CLOCK_SKEW_MARGIN_MS = 10 * 60 * 1000;
 
 const PAGE_SIZE = 100;
+/** Decrypted end-to-end messages are uploaded for the mailbox's other devices (`uploadClientDocuments()`) whenever this many are waiting,
+ * not all at the end of the pass: a pass cut short keeps what it shared, and the plaintext isn't all held in memory at once. */
+export const CLIENT_UPLOAD_BATCH = 500;
 const MAX_APPROX_BYTES_PER_MESSAGE_PADDING = 512; // subject/participants/flags overhead beyond raw text length
 const FETCH_FAILED = Symbol("fetch-failed");
 
@@ -114,7 +125,7 @@ interface PassSealer {
 
 function createPassSealer(mailboxUid: string, unlocked: UnlockedKeys, signal: AbortSignal, client: ApiClient | undefined): PassSealer {
     let generation: Promise<number | undefined> | undefined;
-    const pins = new Map<string, Promise<string[] | undefined>>();
+    const pins = new Map<string, Promise<SignerPinsInput>>();
     const queue: (() => Promise<unknown>)[] = [];
     let queued = 0;
     let active = 0;
@@ -127,8 +138,9 @@ function createPassSealer(mailboxUid: string, unlocked: UnlockedKeys, signal: Ab
         const key = address.toLowerCase();
         let entry = pins.get(key);
         if (!entry) {
-            entry = getPinnedSignerFingerprints(mailboxUid, address, client).then(
-                (fingerprints) => (fingerprints.length > 0 ? fingerprints : undefined),
+            entry = getPinnedSigners(mailboxUid, address, client).then(
+                (signers): SignerPinsInput =>
+                    signers.openPgpKeys.length > 0 ? signers : signers.fingerprints.length > 0 ? signers.fingerprints : undefined,
                 () => undefined,
             );
             pins.set(key, entry);
@@ -203,11 +215,8 @@ function estimateByteSize(entity: Pick<LocalIndexEntity, "subject" | "body" | "a
     return textBytes + MAX_APPROX_BYTES_PER_MESSAGE_PADDING;
 }
 
-/** The change marker stored per row: a new server `version` (flags, content) or a folder move both
- * invalidate the indexed copy. */
-function versionOf(message: Message): string {
-    return `${message.version}:${message.folderUid}`;
-}
+const versionOf = (message: Message): string => messageRowVersion(message);
+const entityFlags = (message: Message): string => messageRowFlags(message);
 
 /** `Promise.all(items.map(fn))`, but with at most `limit` calls in flight. Preserves input order. */
 async function mapWithConcurrency<T, R>(items: T[], limit: number, fn: (item: T) => Promise<R>): Promise<R[]> {
@@ -247,12 +256,7 @@ async function buildEntity(message: Message, sealer: PassSealer): Promise<LocalI
         const participants = [message.from.address, message.from.displayName, ...message.recipients.map((r) => r.address)]
             .filter(Boolean)
             .join(" ");
-        const setFlags = Object.entries(message.flags)
-            .filter(([, value]) => value)
-            .map(([key]) => key);
-        // Leading/trailing comma so `flags LIKE '%,x,%'` (localIndexSchema.ts's buildSearchPredicates())
-        // matches correctly even for the first/last flag in the list.
-        const flags = `,${setFlags.join(",")},`;
+        const flags = entityFlags(message);
         const entity: LocalIndexEntity = {
             entityType: "message",
             entityUid: message.uid,
@@ -366,9 +370,17 @@ async function runBuildPass(
     const generation = nextLocalIndexGeneration();
     const indexKey = await deriveLocalIndexKey(unlocked.masterKey, mailboxUid);
     signal.throwIfAborted();
+    // A lock during the derive doesn't fail it (WebCrypto copied the master key first), and the index client only counts locks from
+    // `initLocalIndex()`'s own call on: open nothing with the destroyed keys.
+    if (unlocked.destroyed) {
+        throw new KeysLockedError();
+    }
     await initLocalIndex({ mailboxUid, indexKey, generation });
     let { evictedBefore } = await setLocalIndexWindow(mailboxUid, windowConfig.timeFloorMonths, windowConfig.byteBudgetBytes, generation);
     await setLocalIndexBuilding(mailboxUid, true, { complete: false, generation });
+    // End-to-end mail another device already decrypted: imported at its version, so the walk below skips it.
+    await importClientSegments(mailboxUid, unlocked, client, { generation }).catch(() => undefined);
+    signal.throwIfAborted();
     // Mail arriving after this moment isn't guaranteed to be picked up by this pass.
     const coveredUntil = new Date(Date.now() - CLOCK_SKEW_MARGIN_MS).toISOString();
     let cutoff: Date | undefined;
@@ -389,6 +401,10 @@ async function runBuildPass(
             .filter((f) => MESSAGE_FOLDER_TYPES.has(f.type))
             .sort((a, b) => (FOLDER_PRIORITY[a.type] ?? 99) - (FOLDER_PRIORITY[b.type] ?? 99));
         const seenEncryptedUids = new Set<string>();
+        // What this pass decrypted and hasn't shared yet, for the mailbox's other devices.
+        const decrypted: LocalIndexEntity[] = [];
+        // Best effort: what fails to upload is decrypted again by the other devices themselves.
+        const share = (): Promise<unknown> => uploadClientDocuments(mailboxUid, unlocked, decrypted.splice(0), client).catch(() => undefined);
 
         async function walkFolder(folder: Folder): Promise<WalkOutcome> {
             for (let page = 0; ; page++) {
@@ -402,12 +418,28 @@ async function runBuildPass(
                 if (messages.length === 0) {
                     return "done";
                 }
-                const encrypted = messages.filter((m) => m.subject === ENCRYPTED_SUBJECT_PLACEHOLDER);
+                // The server's `encrypted` flag too: an OpenPGP sender (Proton Mail and others) keeps the real outer subject.
+                const encrypted = messages.filter((m) => m.subject === ENCRYPTED_SUBJECT_PLACEHOLDER || m.encrypted);
                 for (const m of encrypted) {
                     seenEncryptedUids.add(m.uid);
                 }
+                // A zero-access message's content comes from the server's sealed index (`zeroAccessIndexSync.ts`), never decrypted here:
+                // only its folder and flags are recorded on its row - and remembered by version, so an unchanged one costs nothing next
+                // time. Its row may not be imported yet (a new device, or after a lock): the sync applies them when it imports it.
+                const sealed = encrypted.filter((m) => m.zeroAccess);
+                if (sealed.length > 0) {
+                    const indexed = await getIndexedVersions(
+                        mailboxUid,
+                        sealed.map((m) => m.uid),
+                    );
+                    for (const m of sealed.filter((s) => indexed[s.uid] !== versionOf(s))) {
+                        const metadata = { folderUid: m.folderUid, entityVersion: versionOf(m), flags: entityFlags(m) };
+                        await moveLocalEntity(mailboxUid, m.uid, metadata.folderUid, metadata.entityVersion, metadata.flags);
+                        rememberZeroAccessMetadata(mailboxUid, m.uid, metadata);
+                    }
+                }
                 // Anything older than the eviction watermark would only be inserted and evicted again.
-                const candidates = encrypted.filter((m) => !isOlderThan(m.receivedDate, evictedBefore));
+                const candidates = encrypted.filter((m) => !m.zeroAccess && !isOlderThan(m.receivedDate, evictedBefore));
                 if (candidates.length > 0) {
                     // Skip anything already indexed at the same version - a re-unlock used to re-fetch and
                     // re-decrypt the entire window every time.
@@ -424,6 +456,10 @@ async function runBuildPass(
                     const entities = built.filter((e): e is LocalIndexEntity => e !== undefined && e !== FETCH_FAILED);
                     if (entities.length > 0) {
                         ({ evictedBefore } = await indexLocalEntities(mailboxUid, entities, generation));
+                        decrypted.push(...entities);
+                        if (decrypted.length >= CLIENT_UPLOAD_BATCH) {
+                            await share();
+                        }
                     }
                 }
                 const oldestOnPage = messages[messages.length - 1].receivedDate;
@@ -481,6 +517,7 @@ async function runBuildPass(
             const since = evictedBefore && isWithinTimeFloor(evictedBefore, cutoff) ? evictedBefore : cutoff?.toISOString();
             await pruneLocalEntities(mailboxUid, [...seenEncryptedUids], since, { folderUids: reliable, generation });
         }
+        await share();
     } catch (err) {
         complete = false;
         throw err;