@rapidmx/web-client 0.36.0 → 0.37.0

package/dist/apps/shared/mail/outbox/sendOutcomes.js

@@ -2,7 +2,7 @@
 // Copyright (C) 2026 Jean-Philippe Steinmetz
 // SPDX-License-Identifier: MPL-2.0
 ///////////////////////////////////////////////////////////////////////////////
-import { cancelScheduledSend, getMessage, listAttachments, listFolders, queueMessageSend } from "../../../../lib/mail/mailApi.js";
+import { cancelScheduledSend, deleteMessage, getMessage, listAttachments, listFolders, queueMessageSend } from "../../../../lib/mail/mailApi.js";
 import { describeSendEventError } from "../../../../lib/mail/sendEvents.js";
 import { formatRecipient } from "../../components/mail/compose/recipients.js";
 import { loadOriginalMessage } from "../../components/mail/compose/quotedBody.js";
@@ -11,7 +11,7 @@ import { dismiss, notify } from "../../notifications/store.js";
 import { beginPendingSend, finishPendingSend, setPendingStage } from "./pendingSends.js";
 import { failOutgoing, forgetOutgoing, markOutgoingSending, markOutgoingSent } from "./outgoingReplies.js";
 import { openComposeFromOutside } from "./composeBridge.js";
-import { describeMessage, forgetRetainedRequest, notifySent, openDraftFromRequest, retainedRequest } from "./sendJob.js";
+import { copyFailed, copyRetried, describeMessage, forgetCopies, forgetRetainedRequest, notifySent, openDraftFromRequest, retainedRequest, unsentCopies, } from "./sendJob.js";
 /**
  * What the user is told when the server reports how a queued message went (`send-succeeded`, `send-failed`, `send-retrying` push events,
  * see `@rapidmx/react-shared`'s `parseSendEvent()`): a quiet, single "Message sent" for a message this tab sent (several close together are
@@ -36,14 +36,39 @@ async function moveBackToDrafts(uid, mailboxUid, client) {
 function escapeHtml(text) {
     return text.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
 }
-/** "Open draft" for a message the server failed to relay: back into Drafts, and into a compose window with what was written. */
-async function openFailedDraft(event, client) {
+/** "Open draft" for a message the server failed to relay: back into Drafts, and into a compose window with what was written. `request`: the
+ * one it was queued from, when this tab holds it. */
+async function openFailedDraft(event, client, request) {
+    // A message sent as several copies (one per encryption format) is written again only when none of them went: while another copy has
+    // gone or may still go, the whole message sent again would reach its recipients a second time - however the action came to be offered.
+    const copies = unsentCopies(request);
+    if (request?.copyFates && !copies) {
+        notify({
+            id: `open-draft:${event.uid}`,
+            kind: "info",
+            title: "Only this copy didn't go",
+            message: "The copy for its other recipients is sent on its own. Use Retry to send this one to its own recipients.",
+            timeoutMs: 8000,
+        });
+        return;
+    }
     try {
-        const moved = await moveBackToDrafts(event.uid, event.mailboxUid ?? "", client);
+        // Of a message sent as several copies, its own draft is the one written again.
+        const moved = await moveBackToDrafts(copies ? request.draft.uid : event.uid, event.mailboxUid ?? "", client);
         // Back in Drafts it is no longer a message on its way in its conversation.
         forgetOutgoing(event.uid);
-        const request = retainedRequest(event.uid);
         if (request) {
+            // The other copies (the OpenPGP one's own draft) go: the message is encrypted afresh when it is sent again, and none of them may
+            // be retried meanwhile.
+            for (const uid of copies?.filter((uid) => uid !== request.draft.uid) ?? []) {
+                const extra = await moveBackToDrafts(uid, event.mailboxUid ?? "", client);
+                await deleteMessage(extra.uid, extra.version, client);
+                dismiss(failedId(uid));
+                forgetOutgoing(uid);
+            }
+            if (request.copyFates) {
+                forgetCopies(request.copyFates);
+            }
             openDraftFromRequest({ ...request, draft: moved });
             return;
         }
@@ -81,21 +106,25 @@ async function openFailedDraft(event, client) {
         notifyApiError(err, "Couldn't open this draft");
     }
 }
-/** "Retry" for a message the server failed to relay: the same send call again - a failed message stays in Outbox and the server queues it afresh (with a new retry budget). */
-async function retryFailed(event, client) {
+/** "Retry" for a message the server failed to relay: the same send call again - a failed message stays in Outbox and the server queues it afresh (with a new retry budget).
+ * `request`: the one it was queued from, when this tab holds it - a copy of a message sent as several is then awaited again. */
+async function retryFailed(event, client, request) {
     if (!beginPendingSend({ draftUid: event.uid, mailboxUid: event.mailboxUid ?? "", subject: event.subject, recipients: event.recipients, scheduled: false })) {
         return;
     }
     dismiss(failedId(event.uid));
     markOutgoingSending(event.uid);
+    copyRetried(request, event.uid);
     try {
         setPendingStage(event.uid, "queuing");
         const result = await queueMessageSend(event.uid, client);
-        if (!result.queued) {
+        // Relayed before the server answered - and so, when it is one copy of several, maybe the last of them.
+        if (!result.queued && forgetRetainedRequest(event.uid)) {
             notifySent();
         }
     }
     catch (err) {
+        copyFailed(request, event.uid);
         notifyApiError(err, "This message wasn't sent", { dedupeKey: failedId(event.uid) });
     }
     finally {
@@ -108,26 +137,29 @@ async function retryFailed(event, client) {
 export function handleSendEvent(event, client) {
     if (event.action === "send-succeeded") {
         dismiss(retryId(event.uid));
-        dismiss(failedId(event.uid));
+        // A partly-sent message's failure (`notifyFailure()`) is shown under its first copy's uid but is of a copy that was never handed over:
+        // it stays, with the Retry that hands that copy over.
+        if (![...(retainedRequest(event.uid)?.copyFates?.values() ?? [])].includes("unsent")) {
+            dismiss(failedId(event.uid));
+        }
         // The conversation on screen swaps the message it drew for the Sent Items copy (a message this tab did not send has nothing drawn).
         markOutgoingSent(event.uid);
         // The server reports every message it relays, scheduled ones from long ago included: only a message this tab queued in the background is
         // worth a confirmation (several are one pop-up counting up). Anything else - a send-later message going out, another tab's send - is quiet.
-        if (retainedRequest(event.uid)) {
-            forgetRetainedRequest(event.uid);
+        // A message sent as several copies (one per encryption format) is confirmed once, when the last of them has gone.
+        if (retainedRequest(event.uid) && forgetRetainedRequest(event.uid)) {
             notifySent();
         }
         return;
     }
     const failure = describeSendEventError(event.error, event.action === "send-failed" ? "The server couldn't send this message." : "The server couldn't send this message yet.");
-    const what = describeMessage(event.subject, summary(event.recipients));
     if (event.action === "send-retrying") {
         const next = event.nextAttemptAt ? Date.parse(event.nextAttemptAt) : NaN;
         notify({
             id: retryId(event.uid),
             kind: "info",
             title: "Retrying to send",
-            message: `${what} (attempt ${event.attempt + 1}${Number.isNaN(next) ? "" : `, at ${new Date(next).toLocaleTimeString()}`}). ${failure.message}`,
+            message: `${describeMessage(event.subject, summary(event.recipients))} (attempt ${event.attempt + 1}${Number.isNaN(next) ? "" : `, at ${new Date(next).toLocaleTimeString()}`}). ${failure.message}`,
             details: failure.lines,
             sticky: false,
             timeoutMs: 8000,
@@ -135,18 +167,42 @@ export function handleSendEvent(event, client) {
         return;
     }
     dismiss(retryId(event.uid));
-    const actions = [
-        { label: "Retry", onClick: () => void retryFailed(event, client) },
-        { label: "Open draft", onClick: () => void openFailedDraft(event, client) },
-    ];
+    const request = retainedRequest(event.uid);
+    copyFailed(request, event.uid);
+    notifySendFailure(event, failure, request, client);
+}
+/**
+ * The sticky "This message wasn't sent" for a message that failed, `failure` saying why, with what can be done about it - for one the server
+ * failed to relay, and for a message sent as several copies (`SendRequest.copyUids`) of which this tab couldn't hand over the rest after the
+ * server had failed one (`sendJob.ts`'s `notifyFailure()`). `request`: the one it was queued from, when this tab holds it.
+ */
+export function notifySendFailure(event, failure, request, client) {
+    // Every copy of a message sent as several (one per encryption format, `SendRequest.copyUids`) failed or never went: nobody has it, and it
+    // is the whole message's failure - one pop-up, whose Retry hands each copy over again and whose "Open draft" writes the message again.
+    const copies = unsentCopies(request);
+    // One copy of several, while another has gone or may still go: the others' recipients have theirs or will, and "Open draft" would send
+    // the whole message to them again - Retry sends just this copy, to just its own recipients.
+    const oneCopy = !!request?.copyFates && !copies;
+    const retry = () => {
+        for (const uid of copies ?? [event.uid]) {
+            void retryFailed({ ...event, uid }, client, request);
+        }
+    };
+    const actions = [{ label: "Retry", onClick: retry }, ...(oneCopy ? [] : [{ label: "Open draft", onClick: () => void openFailedDraft(event, client, request) }])];
+    const message = oneCopy ? `The copy for some of its recipients didn't go - the others' copy is sent on its own. ${failure.message}` : failure.message;
+    // What an earlier copy's failure said of the others is no longer so: this pop-up stands for the whole message.
+    for (const uid of copies?.filter((uid) => uid !== event.uid) ?? []) {
+        dismiss(failedId(uid));
+        failOutgoing(uid, message, actions);
+    }
     notify({
         id: failedId(event.uid),
         kind: "error",
         title: "This message wasn't sent",
-        message: `${what}: ${failure.message}`,
+        message: `${describeMessage(event.subject, summary(event.recipients))}: ${message}`,
         details: failure.lines,
         actions,
     });
     // The conversation on screen shows the same failure under the message, with the same ways out.
-    failOutgoing(event.uid, failure.message, actions);
+    failOutgoing(event.uid, message, actions);
 }

package/dist/apps/shared/search/LocalIndexLifecycle.js

@@ -8,20 +8,23 @@
  * "MUST be destroyed on the same events that destroy private keys: explicit logout, session revocation,
  * and the configurable idle timeout").
  *
- * **Why polling, not hooking the existing destroy call sites directly**: `destroyUnlockedKeys()`
- * (`react-shared/src/crypto/keySession.ts`) has no observer/callback hook. Watching `getUnlockedKeys()`
- * for a present-to-absent transition catches *every* destroy path uniformly - idle timeout, the manual
- * button, or anything else that calls it - without needing to know which one fired.
+ * **Locks**: `localIndexRpcClient.ts` itself destroys an index it opened the moment `subscribeKeySession()` reports its mailbox locked,
+ * whatever destroyed the keys (idle timeout, the manual button, a sign-out) and whether or not this component is still mounted. This
+ * component subscribes to the same `locked` event to reset what it remembers of the mailbox (built, synced) at that moment, so a re-unlock
+ * builds again - even one made before the next poll tick, which a poll alone would never see as a lock, leaving the destroyed index
+ * unbuilt and every zero-access sync failing against it. Keys only ever go away through `destroyUnlockedKeys()`, which always reports
+ * the lock, so the poll doesn't watch for a lock itself. A lock while a build is still deriving its index key, before anything is open
+ * for the index client to destroy, is the builder's own to catch (`localIndexBuilder.ts`): it opens nothing with destroyed keys.
  *
  * Every mailbox this component has seen unlocked is tracked for the life of the mount - not just whichever
  * is active right now - so switching mailboxes (or a folders-list refresh re-running the build effect)
  * can never lose a pending unlocked-to-locked transition for a mailbox whose index was already built.
  *
- * **Explicit logout** navigates away immediately, which may not leave time for a poll tick - `AppShell.tsx`
+ * **Explicit logout** navigates away immediately, which may not leave time for the lock's asynchronous destroy - `AppShell.tsx`
  * handles that case itself via `destroyAllLocalIndexes()`.
  */
 import { useEffect, useRef } from "react";
-import { getUnlockedKeys } from "../../../lib/crypto/keySession.js";
+import { getUnlockedKeys, subscribeKeySession } from "../../../lib/crypto/keySession.js";
 import { useApiClient } from "../../../lib/util/apiClientContext.js";
 /**
  * The index builder (with the message security code it decrypts through - PKI.js and the ASN.1/X.509 libraries, over half a
@@ -40,7 +43,7 @@ const loadSyncer = () => (syncer ?? (syncer = import("./zeroAccessIndexSync.js")
     syncer = undefined;
     throw err;
 })));
-import { destroyLocalIndex, pruneInaccessibleLocalIndexes } from "./localIndexRpcClient.js";
+import { pruneInaccessibleLocalIndexes } from "./localIndexRpcClient.js";
 export const POLL_INTERVAL_MS = 5000;
 /** How often an unlocked zero-access mailbox's local index is brought up to date with the server's sealed index. */
 export const ZERO_ACCESS_SYNC_INTERVAL_MS = 120000;
@@ -50,29 +53,40 @@ export default function LocalIndexLifecycle({ mailboxUid, folders, accessibleMai
     // apps, Electron), which keeps building the index against the default global cookie-based session exactly as before. A native,
     // multi-account host that renders this under an ApiClientContext.Provider gets its own account's client threaded through instead.
     const client = useApiClient();
-    // mailboxUid -> whether it was unlocked at the last check. An entry exists for every mailbox whose
-    // build this component started; only ever changed by a real observed transition, never reset by an
-    // effect re-run.
+    // mailboxUid -> whether it is unlocked as far as this component knows: set when its build starts, cleared by its lock. An entry exists
+    // for every mailbox whose build this component started; never reset by an effect re-run.
     const trackedRef = useRef(new Map());
     // The latest props (and client), for the long-lived polling interval below.
     const latestRef = useRef({ mailboxUid, folders, client });
     latestRef.current = { mailboxUid, folders, client };
-    // mailboxUid -> when its last zero-access sync started. Set only once its first build finished (the sync writes into the index the
-    // build opened); a mailbox in `syncingRef` has a pass running, and never gets a second one alongside it.
+    // mailboxUid -> when its last zero-access sync started. A mailbox syncs only once its build of this unlock settled (`builtRef` - the
+    // sync writes into the index the build opened), first at once and then every interval; a mailbox in `syncingRef` has a pass running,
+    // and never gets a second one alongside it. A lock forgets all three, so a pass still winding down never holds up the next unlock's.
     const lastSyncRef = useRef(new Map());
-    const syncingRef = useRef(new Set());
-    function syncIfDue(targetMailboxUid, targetClient, first = false) {
+    const builtRef = useRef(new Set());
+    // mailboxUid -> its latest build, so only that one's end starts the sync (not one a lock overtook).
+    const buildsRef = useRef(new Map());
+    const syncingRef = useRef(new Map());
+    function syncIfDue(targetMailboxUid, targetClient) {
         const unlocked = getUnlockedKeys(targetMailboxUid);
         const last = lastSyncRef.current.get(targetMailboxUid);
-        if (!unlocked?.zeroAccessKeys?.length || syncingRef.current.has(targetMailboxUid) || (!first && (last === undefined || Date.now() - last < ZERO_ACCESS_SYNC_INTERVAL_MS))) {
+        if (!unlocked?.zeroAccessKeys?.length ||
+            !builtRef.current.has(targetMailboxUid) ||
+            syncingRef.current.has(targetMailboxUid) ||
+            (last !== undefined && Date.now() - last < ZERO_ACCESS_SYNC_INTERVAL_MS)) {
             return;
         }
         lastSyncRef.current.set(targetMailboxUid, Date.now());
-        syncingRef.current.add(targetMailboxUid);
+        const pass = Symbol(targetMailboxUid);
+        syncingRef.current.set(targetMailboxUid, pass);
         loadSyncer()
             .then(({ syncZeroAccessIndex }) => syncZeroAccessIndex(targetMailboxUid, unlocked, targetClient))
             .catch(() => undefined)
-            .finally(() => syncingRef.current.delete(targetMailboxUid));
+            .finally(() => {
+            if (syncingRef.current.get(targetMailboxUid) === pass) {
+                syncingRef.current.delete(targetMailboxUid);
+            }
+        });
     }
     function startBuildIfUnlocked(targetMailboxUid, targetFolders, targetClient) {
         const unlocked = getUnlockedKeys(targetMailboxUid);
@@ -80,33 +94,41 @@ export default function LocalIndexLifecycle({ mailboxUid, folders, accessibleMai
             return;
         }
         trackedRef.current.set(targetMailboxUid, true);
+        const build = Symbol(targetMailboxUid);
+        buildsRef.current.set(targetMailboxUid, build);
         // Never an unhandled rejection - a broken local index is best-effort infrastructure, not a build
         // the rest of the app depends on.
-        loadBuilder()
+        // The sync runs however the build ended: zero-access mail reaches the index only through it, and a build that failed part-way
+        // isn't tried again until the next unlock. (Locked meanwhile, there are no keys to sync with.)
+        void loadBuilder()
             .then(({ buildLocalIndex }) => buildLocalIndex(targetMailboxUid, unlocked, targetFolders, undefined, targetClient))
-            .then(() => syncIfDue(targetMailboxUid, targetClient, true))
-            .catch(() => undefined);
+            .catch(() => undefined)
+            .then(() => {
+            if (buildsRef.current.get(targetMailboxUid) === build && trackedRef.current.get(targetMailboxUid)) {
+                builtRef.current.add(targetMailboxUid);
+                syncIfDue(targetMailboxUid, targetClient);
+            }
+        });
     }
     useEffect(() => {
         if (mailboxUid) {
             startBuildIfUnlocked(mailboxUid, folders, client);
         }
     }, [mailboxUid, folders, client]);
+    // A lock forgets the mailbox at once: no build of this unlock counts as built any more (the cancelled build's end finds `buildsRef`
+    // cleared and starts no sync), and the next unlock's tick starts a new build. The cancel and destroy themselves are
+    // `localIndexRpcClient.ts`'s, which reacts to the same event.
+    useEffect(() => subscribeKeySession(({ mailboxUid: lockedUid, state }) => {
+        if (state === "locked" && trackedRef.current.get(lockedUid)) {
+            trackedRef.current.set(lockedUid, false);
+            lastSyncRef.current.delete(lockedUid);
+            builtRef.current.delete(lockedUid);
+            syncingRef.current.delete(lockedUid);
+            buildsRef.current.delete(lockedUid);
+        }
+    }), []);
     useEffect(() => {
         const interval = setInterval(() => {
-            for (const [trackedUid, wasUnlocked] of trackedRef.current) {
-                if (wasUnlocked && !getUnlockedKeys(trackedUid)) {
-                    // A present-to-absent transition: something just destroyed this mailbox's keys.
-                    trackedRef.current.set(trackedUid, false);
-                    lastSyncRef.current.delete(trackedUid);
-                    // Stop the pass still running with the now-destroyed keys; the destroy itself also makes
-                    // the Worker reject anything that pass still sends.
-                    loadBuilder()
-                        .then(({ cancelLocalIndexBuild }) => cancelLocalIndexBuild(trackedUid))
-                        .catch(() => undefined);
-                    void destroyLocalIndex(trackedUid);
-                }
-            }
             // The active mailbox was (re-)unlocked since the last check, e.g. via an on-demand unlock prompt.
             const { mailboxUid: activeUid, folders: activeFolders, client: activeClient } = latestRef.current;
             if (activeUid) {

package/dist/apps/shared/search/localIndexBuilder.d.ts

@@ -15,7 +15,7 @@
  * cross-folder interleaving imprecision here does not affect *what* ultimately survives the window, only
  * the exact order entities are inserted (and therefore briefly evicted-and-reinserted) in.
  *
- * Only encrypted messages (`subject === "[...]"`) are indexed - see `ENCRYPTED_SUBJECT_PLACEHOLDER`'s
+ * Only encrypted messages (`subject === "[...]"`, or flagged `encrypted` by the server - OpenPGP mail keeps its real outer subject) are indexed - see `ENCRYPTED_SUBJECT_PLACEHOLDER`'s
  * own precedent in `apps/www/index.tsx`'s inbox-list decrypt work. An unencrypted message is already
  * fully searchable via Tier 1; indexing it here too would spend this index's bounded byte budget on
  * content that didn't need it.
@@ -58,6 +58,9 @@ export declare const MAX_WALK_ATTEMPTS = 3;
 /** Subtracted from the pass's start time before it's recorded as the end of guaranteed coverage - a
  * message's server-assigned `receivedDate` can be ahead of this device's clock. */
 export declare const CLOCK_SKEW_MARGIN_MS: number;
+/** Decrypted end-to-end messages are uploaded for the mailbox's other devices (`uploadClientDocuments()`) whenever this many are waiting,
+ * not all at the end of the pass: a pass cut short keeps what it shared, and the plaintext isn't all held in memory at once. */
+export declare const CLIENT_UPLOAD_BATCH = 500;
 /** How many raw-MIME fetch+decrypt calls run at once - a page of 100 encrypted messages used to fire all
  * 100 requests simultaneously. */
 export declare const FETCH_CONCURRENCY = 6;

package/dist/apps/shared/search/localIndexBuilder.js

@@ -19,7 +19,7 @@
  * cross-folder interleaving imprecision here does not affect *what* ultimately survives the window, only
  * the exact order entities are inserted (and therefore briefly evicted-and-reinserted) in.
  *
- * Only encrypted messages (`subject === "[...]"`) are indexed - see `ENCRYPTED_SUBJECT_PLACEHOLDER`'s
+ * Only encrypted messages (`subject === "[...]"`, or flagged `encrypted` by the server - OpenPGP mail keeps its real outer subject) are indexed - see `ENCRYPTED_SUBJECT_PLACEHOLDER`'s
  * own precedent in `apps/www/index.tsx`'s inbox-list decrypt work. An unencrypted message is already
  * fully searchable via Tier 1; indexing it here too would spend this index's bounded byte budget on
  * content that didn't need it.
@@ -42,12 +42,14 @@
  */
 import { getMessageRawContent, listFolders, listMessages } from "../../../lib/mail/mailApi.js";
 import { evaluateMessageSecurity, evaluateMessageSecurityWithSeal } from "../../../lib/crypto/messageSecurity.js";
-import { getPinnedSignerFingerprints } from "../components/mail/pinnedSigners.js";
+import { KeysLockedError } from "../../../lib/crypto/masterKey.js";
+import { getPinnedSigners } from "../components/mail/pinnedSigners.js";
 import { currentVerificationSeal, readVaultGeneration, sendVerificationSeal, verificationSealPending } from "../components/mail/verificationSeals.js";
+import { messageRowFlags, messageRowVersion } from "./localIndexSchema.js";
 import { getIndexedVersions, moveLocalEntity, indexLocalEntities, initLocalIndex, nextLocalIndexGeneration, pruneLocalEntities, setLocalIndexBuilding, setLocalIndexWindow, } from "./localIndexRpcClient.js";
 import { deriveLocalIndexKey } from "./localIndexKey.js";
 import { getLocalIndexByteBudget } from "./localIndexSizePreference.js";
-import { importClientSegments, uploadClientDocuments } from "./zeroAccessIndexSync.js";
+import { importClientSegments, rememberZeroAccessMetadata, uploadClientDocuments } from "./zeroAccessIndexSync.js";
 /** The RFC 9788 placeholder subject every encrypted message's outer envelope carries server-side - see
  * `apps/www/index.tsx`'s identical constant and its own doc comment for the full citation. */
 const ENCRYPTED_SUBJECT_PLACEHOLDER = "[...]";
@@ -72,6 +74,9 @@ export const MAX_WALK_ATTEMPTS = 3;
  * message's server-assigned `receivedDate` can be ahead of this device's clock. */
 export const CLOCK_SKEW_MARGIN_MS = 10 * 60 * 1000;
 const PAGE_SIZE = 100;
+/** Decrypted end-to-end messages are uploaded for the mailbox's other devices (`uploadClientDocuments()`) whenever this many are waiting,
+ * not all at the end of the pass: a pass cut short keeps what it shared, and the plaintext isn't all held in memory at once. */
+export const CLIENT_UPLOAD_BATCH = 500;
 const MAX_APPROX_BYTES_PER_MESSAGE_PADDING = 512; // subject/participants/flags overhead beyond raw text length
 const FETCH_FAILED = Symbol("fetch-failed");
 /** How many raw-MIME fetch+decrypt calls run at once - a page of 100 encrypted messages used to fire all
@@ -94,7 +99,7 @@ function createPassSealer(mailboxUid, unlocked, signal, client) {
         const key = address.toLowerCase();
         let entry = pins.get(key);
         if (!entry) {
-            entry = getPinnedSignerFingerprints(mailboxUid, address, client).then((fingerprints) => (fingerprints.length > 0 ? fingerprints : undefined), () => undefined);
+            entry = getPinnedSigners(mailboxUid, address, client).then((signers) => signers.openPgpKeys.length > 0 ? signers : signers.fingerprints.length > 0 ? signers.fingerprints : undefined, () => undefined);
             pins.set(key, entry);
         }
         return entry;
@@ -159,11 +164,8 @@ function estimateByteSize(entity) {
     const textBytes = [entity.subject, entity.body, entity.attachmentText, entity.participants].reduce((total, value) => total + (value ? encoder.encode(value).length : 0), 0);
     return textBytes + MAX_APPROX_BYTES_PER_MESSAGE_PADDING;
 }
-/** The change marker stored per row: a new server `version` (flags, content) or a folder move both
- * invalidate the indexed copy. */
-function versionOf(message) {
-    return `${message.version}:${message.folderUid}`;
-}
+const versionOf = (message) => messageRowVersion(message);
+const entityFlags = (message) => messageRowFlags(message);
 /** `Promise.all(items.map(fn))`, but with at most `limit` calls in flight. Preserves input order. */
 async function mapWithConcurrency(items, limit, fn) {
     const results = new Array(items.length);
@@ -202,12 +204,7 @@ async function buildEntity(message, sealer) {
         const participants = [message.from.address, message.from.displayName, ...message.recipients.map((r) => r.address)]
             .filter(Boolean)
             .join(" ");
-        const setFlags = Object.entries(message.flags)
-            .filter(([, value]) => value)
-            .map(([key]) => key);
-        // Leading/trailing comma so `flags LIKE '%,x,%'` (localIndexSchema.ts's buildSearchPredicates())
-        // matches correctly even for the first/last flag in the list.
-        const flags = `,${setFlags.join(",")},`;
+        const flags = entityFlags(message);
         const entity = {
             entityType: "message",
             entityUid: message.uid,
@@ -290,6 +287,11 @@ async function runBuildPass(mailboxUid, unlocked, folders, windowConfig, signal,
     const generation = nextLocalIndexGeneration();
     const indexKey = await deriveLocalIndexKey(unlocked.masterKey, mailboxUid);
     signal.throwIfAborted();
+    // A lock during the derive doesn't fail it (WebCrypto copied the master key first), and the index client only counts locks from
+    // `initLocalIndex()`'s own call on: open nothing with the destroyed keys.
+    if (unlocked.destroyed) {
+        throw new KeysLockedError();
+    }
     await initLocalIndex({ mailboxUid, indexKey, generation });
     let { evictedBefore } = await setLocalIndexWindow(mailboxUid, windowConfig.timeFloorMonths, windowConfig.byteBudgetBytes, generation);
     await setLocalIndexBuilding(mailboxUid, true, { complete: false, generation });
@@ -316,8 +318,10 @@ async function runBuildPass(mailboxUid, unlocked, folders, windowConfig, signal,
             .filter((f) => MESSAGE_FOLDER_TYPES.has(f.type))
             .sort((a, b) => (FOLDER_PRIORITY[a.type] ?? 99) - (FOLDER_PRIORITY[b.type] ?? 99));
         const seenEncryptedUids = new Set();
-        // What this pass decrypted, for the mailbox's other devices.
+        // What this pass decrypted and hasn't shared yet, for the mailbox's other devices.
         const decrypted = [];
+        // Best effort: what fails to upload is decrypted again by the other devices themselves.
+        const share = () => uploadClientDocuments(mailboxUid, unlocked, decrypted.splice(0), client).catch(() => undefined);
         async function walkFolder(folder) {
             for (let page = 0;; page++) {
                 signal.throwIfAborted();
@@ -331,17 +335,21 @@ async function runBuildPass(mailboxUid, unlocked, folders, windowConfig, signal,
                 if (messages.length === 0) {
                     return "done";
                 }
-                const encrypted = messages.filter((m) => m.subject === ENCRYPTED_SUBJECT_PLACEHOLDER);
+                // The server's `encrypted` flag too: an OpenPGP sender (Proton Mail and others) keeps the real outer subject.
+                const encrypted = messages.filter((m) => m.subject === ENCRYPTED_SUBJECT_PLACEHOLDER || m.encrypted);
                 for (const m of encrypted) {
                     seenEncryptedUids.add(m.uid);
                 }
                 // A zero-access message's content comes from the server's sealed index (`zeroAccessIndexSync.ts`), never decrypted here:
-                // only its folder is recorded on its row - and remembered by version, so an unchanged one costs nothing next time.
+                // only its folder and flags are recorded on its row - and remembered by version, so an unchanged one costs nothing next
+                // time. Its row may not be imported yet (a new device, or after a lock): the sync applies them when it imports it.
                 const sealed = encrypted.filter((m) => m.zeroAccess);
                 if (sealed.length > 0) {
                     const indexed = await getIndexedVersions(mailboxUid, sealed.map((m) => m.uid));
                     for (const m of sealed.filter((s) => indexed[s.uid] !== versionOf(s))) {
-                        await moveLocalEntity(mailboxUid, m.uid, m.folderUid, versionOf(m));
+                        const metadata = { folderUid: m.folderUid, entityVersion: versionOf(m), flags: entityFlags(m) };
+                        await moveLocalEntity(mailboxUid, m.uid, metadata.folderUid, metadata.entityVersion, metadata.flags);
+                        rememberZeroAccessMetadata(mailboxUid, m.uid, metadata);
                     }
                 }
                 // Anything older than the eviction watermark would only be inserted and evicted again.
@@ -360,6 +368,9 @@ async function runBuildPass(mailboxUid, unlocked, folders, windowConfig, signal,
                     if (entities.length > 0) {
                         ({ evictedBefore } = await indexLocalEntities(mailboxUid, entities, generation));
                         decrypted.push(...entities);
+                        if (decrypted.length >= CLIENT_UPLOAD_BATCH) {
+                            await share();
+                        }
                     }
                 }
                 const oldestOnPage = messages[messages.length - 1].receivedDate;
@@ -418,7 +429,7 @@ async function runBuildPass(mailboxUid, unlocked, folders, windowConfig, signal,
             const since = evictedBefore && isWithinTimeFloor(evictedBefore, cutoff) ? evictedBefore : cutoff?.toISOString();
             await pruneLocalEntities(mailboxUid, [...seenEncryptedUids], since, { folderUids: reliable, generation });
         }
-        await uploadClientDocuments(mailboxUid, unlocked, decrypted, client).catch(() => undefined);
+        await share();
     }
     catch (err) {
         complete = false;

package/dist/apps/shared/search/localIndexRpcClient.d.ts

@@ -1,39 +1,3 @@
-/**
- * Main-thread Promise-based RPC wrapper around `localIndexWorker.ts`. One Worker per tab (spawned
- * lazily, on first use, not at module load - a page that never touches search shouldn't pay for booting
- * the WASM module at all), shared across every mailbox `init()`-ed this session - the Worker itself keeps
- * a per-mailbox connection map (see that file's own doc comment).
- *
- * `postMessage` has no native request/response pairing, so every call generates its own numeric `id` and
- * this module correlates the eventual matching response via a pending-request map.
- *
- * **Generations**: `nextLocalIndexGeneration()` hands out one monotonic counter shared by build passes and
- * destroys, so the Worker can reject a build call issued before the index was destroyed (see
- * `GenerationParams`).
- *
- * **Sign-out reaches every tab**: `destroyAllLocalIndexes()` broadcasts on a `BroadcastChannel`; any other
- * tab running a Worker closes its connections and refuses further `init`s.
- *
- * **Failed deletions are retried**: a destroy that couldn't remove a directory (another tab held it, the page
- * navigated away first) is recorded in `localStorage` and retried before this tab's first `init`.
- *
- * **A crashed Worker never leaves a caller hanging**: the `error` listener registered in `getWorker()` rejects
- * every pending request and drops the module-level `worker` reference so the next `call()` spawns a
- * replacement. `searchTier2.ts` additionally races its own calls against a timeout, since a Worker that's
- * merely stuck (not crashed) posts no `error` event at all.
- *
- * **Swappable transport**: everything above is specific to this one implementation - the Worker/OPFS-backed
- * default. Every function this module exports below (`initLocalIndex`, `searchLocal`, `destroyLocalIndex`, ...)
- * is a thin delegator to whichever `LocalIndexTransport` (`localIndexTransport.ts`) is "current," which defaults
- * to `workerLocalIndexTransport` - this file's own implementation, wrapped - and can be swapped once, at startup,
- * via `setLocalIndexTransport()`. A host app with a different storage backend (no Worker, no OPFS, no WASM at
- * all - `tauri-client`'s native SQLCipher/`rusqlite` index) installs its own transport there; every call site
- * that already goes through this file's exports (`searchTier2.ts`, `LocalIndexLifecycle.tsx`,
- * `localIndexBuilder.ts`, and the rest) then runs against that backend instead, unmodified. The three
- * module-level constants below (`SIGN_OUT_CHANNEL`, `PENDING_DELETIONS_KEY`, `DESTROY_ALL_TIMEOUT_MS`) remain
- * plain exports, not part of the swappable interface - they name this one transport's own cross-tab/localStorage
- * mechanics, which a different transport has no reason to share.
- */
 import type { ParsedSearchQuery } from "../../../lib/search/queryGrammar.js";
 import type { Coverage, IndexEntitiesResult, InitParams, LocalSearchPage, WindowState } from "./localIndexWorker.js";
 import type { LocalIndexEntity } from "./localIndexSchema.js";
@@ -65,8 +29,9 @@ export declare function indexLocalEntities(mailboxUid: string, entities: LocalIn
  * this tab - a later build pass prunes it instead. Never rejects: best-effort housekeeping. */
 export declare function removeLocalEntity(mailboxUid: string, entityUid: string): Promise<void>;
 /** Re-points one indexed message at its new folder (archive, cancel-scheduled-send) so `folder:`-scoped
- * local searches stay correct. Same no-op/never-rejects rules as `removeLocalEntity()`. */
-export declare function moveLocalEntity(mailboxUid: string, entityUid: string, folderUid: string, entityVersion?: string): Promise<void>;
+ * local searches stay correct. Same no-op/never-rejects rules as `removeLocalEntity()`. `flags` (`,flag,flag,`) sets the row's flags
+ * too - a zero-access row's, which nothing else records. */
+export declare function moveLocalEntity(mailboxUid: string, entityUid: string, folderUid: string, entityVersion?: string, flags?: string): Promise<void>;
 export declare function getIndexedVersions(mailboxUid: string, entityUids: string[]): Promise<Record<string, string>>;
 export declare function pruneLocalEntities(mailboxUid: string, keepEntityUids: string[], since: string | undefined, options?: PruneLocalEntitiesOptions): Promise<number>;
 export declare function searchLocal(mailboxUid: string, parsed: ParsedSearchQuery, limit: number, offset?: number): Promise<LocalSearchPage>;
@@ -82,7 +47,8 @@ export declare function destroyLocalIndex(mailboxUid: string): Promise<boolean>;
  * on sign-out. Never rejects. Resolves `true` only if everything was removed within `timeoutMs`. */
 export declare function destroyAllLocalIndexes(timeoutMs?: number): Promise<boolean>;
 /** Removes local indexes for mailboxes outside `accessibleMailboxUids` - e.g. left behind by a different
- * user who signed in on this device without signing out. Never rejects. */
+ * user who signed in on this device without signing out. The transport decides what goes, zero-access sync state included (the
+ * Worker transport forgets it with the index; a host wrapper that skips the prune keeps both). Never rejects. */
 export declare function pruneInaccessibleLocalIndexes(accessibleMailboxUids: Iterable<string>): Promise<void>;
 /** Retries every deletion an earlier session couldn't finish. Never rejects. */
 export declare function retryPendingLocalIndexDeletions(): Promise<void>;