@rapidmx/web-client 0.36.0 → 0.37.0

package/dist/lib/calendar/protectedEvents.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Writes to an event of a calendar zero-access encryption protects (restapi `specs/search.md` §3 *What It Covers*, *Calendar invitations*).
+ * The server stores its title, location and description sealed, with placeholders in their place, so it can't tell what changed or invite
+ * with them by itself. A write therefore sends only the content fields that differ from what this device shows, and - when the event was
+ * opened here - the whole content as `invitationContent`, which the server invites with and never stores. A content field of an opened
+ * event that held a value and is emptied is named in `clearedFields`, the only way restapi applies an empty sealed field as a clear.
+ */
+import type { CalendarEvent } from "./calendarApi.js";
+/** The fields zero-access encryption seals on an event. */
+export declare const EVENT_CONTENT_FIELDS: readonly ["title", "location", "description", "descriptionHtml"];
+/** What the server composes a protected event's invitations with. */
+export interface InvitationContent {
+    title: string;
+    location?: string;
+    description?: string;
+    descriptionHtml?: string;
+}
+/** `event` marked as holding its opened `sealedContent` (its real title, location and description). */
+export declare function markSealedContentOpened<T extends CalendarEvent>(event: T): T;
+/** Whether `event`'s `sealedContent` was opened on this device: its title, location and description are the real ones. */
+export declare function isSealedContentOpened(event: CalendarEvent | undefined): boolean;
+/** `current`'s content with `changes` applied, for the server to invite (or name a reply or change request) with - `undefined` unless
+ * `current` is protected (`sealedFields`) or made from a zero-access invitation (`sealedContent`) and was opened on this device (its values
+ * are otherwise placeholders). */
+export declare function invitationContentOf(current: CalendarEvent | undefined, changes?: Record<string, unknown>): InvitationContent | undefined;
+/**
+ * `input` as written to `current`: unchanged when `current` isn't protected. Otherwise without the content fields whose values `current`
+ * already shows (a placeholder is "unchanged" too, so a locked device's write never overwrites the sealed value), and with
+ * `invitationContent` when `current` was opened - and `clearedFields` naming the sealed ones it empties.
+ */
+export declare function protectedEventWrite<T extends object>(current: CalendarEvent | undefined, input: T): T;

package/dist/lib/calendar/protectedEvents.js

@@ -0,0 +1,113 @@
+import { isOpenedRecord, isProtectedRecord } from "../zeroAccess/sealedRecords.js";
+import { KeysLockedError } from "../crypto/masterKey.js";
+/** The fields zero-access encryption seals on an event. */
+export const EVENT_CONTENT_FIELDS = ["title", "location", "description", "descriptionHtml"];
+const text = (value) => (typeof value === "string" ? value : "");
+/** Set on an event made from a zero-access invitation (`sealedContent`) whose sealed content was opened on this device
+ * (`apps/shared/calendar/sealedEvents.ts`). A symbol, so it survives a spread copy (an occurrence) and is never sent. */
+const CONTENT_OPENED = Symbol("openedSealedContent");
+/** `event` marked as holding its opened `sealedContent` (its real title, location and description). */
+export function markSealedContentOpened(event) {
+    return { ...event, [CONTENT_OPENED]: true };
+}
+/** Whether `event`'s `sealedContent` was opened on this device: its title, location and description are the real ones. */
+export function isSealedContentOpened(event) {
+    return !!event && event[CONTENT_OPENED] === true;
+}
+/** Whether `event` shows its real content: nothing of it is sealed, or every sealed part (`sealedFields`, `sealedContent`) was opened. */
+function shownOpened(event) {
+    return (!isProtectedRecord(event) || isOpenedRecord(event)) && (!event.sealedContent || isSealedContentOpened(event));
+}
+/** `current`'s content with `changes` applied, for the server to invite (or name a reply or change request) with - `undefined` unless
+ * `current` is protected (`sealedFields`) or made from a zero-access invitation (`sealedContent`) and was opened on this device (its values
+ * are otherwise placeholders). */
+export function invitationContentOf(current, changes = {}) {
+    if (!current || !(isProtectedRecord(current) || current.sealedContent) || !shownOpened(current)) {
+        return undefined;
+    }
+    const value = (field) => text(field in changes ? changes[field] : current[field]);
+    const title = value("title");
+    if (!title) {
+        return undefined;
+    }
+    const optional = (field) => value(field) || undefined;
+    return { title, location: optional("location"), description: optional("description"), descriptionHtml: optional("descriptionHtml") };
+}
+/**
+ * `input` as written to `current`: unchanged when `current` isn't protected. Otherwise without the content fields whose values `current`
+ * already shows (a placeholder is "unchanged" too, so a locked device's write never overwrites the sealed value), and with
+ * `invitationContent` when `current` was opened - and `clearedFields` naming the sealed ones it empties.
+ */
+export function protectedEventWrite(current, input) {
+    if (current?.sealedContent) {
+        return sealedContentWrite(current, input);
+    }
+    if (!isProtectedRecord(current)) {
+        return input;
+    }
+    const changes = { ...input };
+    const clearedFields = [];
+    for (const field of EVENT_CONTENT_FIELDS) {
+        if (!(field in changes)) {
+            continue;
+        }
+        if (text(changes[field]) === text(current[field])) {
+            delete changes[field];
+        }
+        else if (!text(changes[field]) && current.sealedFields[field] !== undefined && isOpenedRecord(current)) {
+            clearedFields.push(field);
+        }
+    }
+    if (clearedFields.length > 0) {
+        changes.clearedFields = clearedFields;
+    }
+    const invitationContent = invitationContentOf(current, changes);
+    return (invitationContent ? { ...changes, invitationContent } : changes);
+}
+/**
+ * `input` as written to `current`, an event made from a zero-access invitation (`sealedContent`). restapi seals its whole content again
+ * from the content fields a write sends (`BaseCalendarEventRoute.keepSealed()`), dropping one the write leaves out, since it can't read the
+ * sealed value to keep it. So a write that sends any of them sends them all: those it leaves out (the event dialog sends an unchanged
+ * description not at all) are filled in with what `current` shows opened - the description and its HTML as one, as the dialog sends them.
+ * This holds too for a row that also keeps its title sealed field by field (`sealedFields.title`), whose sealed content's title is empty.
+ * Shown with placeholders (its mailbox is locked), the placeholders it would send back are left out, so nothing is sealed again, and a
+ * changed content field is refused (`KeysLockedError`) before anything is sent: the rest of the content can't be sent with it. Opened, a
+ * write whose location, description or description HTML differs from the one shown raises `sequence` past `current`'s, the only way
+ * restapi learns it changed.
+ */
+function sealedContentWrite(current, input) {
+    const given = input;
+    if (!EVENT_CONTENT_FIELDS.some((field) => given[field] !== undefined)) {
+        return input;
+    }
+    const changes = { ...given };
+    if (!shownOpened(current)) {
+        for (const field of EVENT_CONTENT_FIELDS) {
+            if (field in changes && text(changes[field]) === text(current[field])) {
+                delete changes[field];
+            }
+        }
+        if (EVENT_CONTENT_FIELDS.some((field) => changes[field] !== undefined)) {
+            throw new KeysLockedError("This event is protected and your mailbox is locked. Unlock it to change its title, location or description.");
+        }
+        return changes;
+    }
+    for (const field of ["title", "location"]) {
+        if (changes[field] === undefined) {
+            changes[field] = current[field] ?? null;
+        }
+    }
+    if (changes.description === undefined && changes.descriptionHtml === undefined) {
+        changes.description = current.description ?? null;
+        changes.descriptionHtml = current.descriptionHtml ?? null;
+    }
+    // restapi can't compare a location or description sealed whole (it holds placeholders), so a real change raises the sequence here: an
+    // organizer-owned meeting then invites again, as for a readable event's new location or description. A description field the write
+    // doesn't send is compared no more than restapi compares it for a readable event. An unchanged one leaves it alone.
+    const descriptionChanged = ["description", "descriptionHtml"].some((field) => changes[field] !== undefined && text(changes[field]) !== text(current[field]));
+    if (descriptionChanged || text(changes.location) !== text(current.location)) {
+        changes.sequence = (current.sequence ?? 0) + 1;
+    }
+    const invitationContent = isProtectedRecord(current) ? invitationContentOf(current, changes) : undefined;
+    return (invitationContent ? { ...changes, invitationContent } : changes);
+}

package/dist/lib/calendar/recurrence.d.ts

@@ -58,3 +58,5 @@ export declare function expandAllOccurrences(events: CalendarEvent[], rangeStart
 export declare function describeRecurrence(rule: RecurrenceRule): string;
 export declare const WEEKDAY_CODES: WeekdayCode[];
 export declare const WEEKDAY_LABELS: Record<WeekdayCode, string>;
+/** When `event`'s last occurrence ends: its own end, or a series' last occurrence's - far ahead for a series without an end. */
+export declare function seriesEndDate(event: CalendarEvent): Date;

package/dist/lib/calendar/recurrence.js

@@ -271,3 +271,19 @@ export const WEEKDAY_LABELS = {
     SA: "Sat",
     SU: "Sun",
 };
+/** When `event`'s last occurrence ends: its own end, or a series' last occurrence's - far ahead for a series without an end. */
+export function seriesEndDate(event) {
+    const rule = event.recurrenceRule;
+    const end = new Date(event.endDate);
+    if (!rule) {
+        return end;
+    }
+    if (!rule.until && !rule.count) {
+        return new Date(8.64e15);
+    }
+    const duration = end.valueOf() - new Date(event.startDate).valueOf();
+    const horizon = new Date(rule.until ? new Date(rule.until).valueOf() + 86400000 : Date.now() + 5 * 365 * 86400000);
+    const occurrences = expandOccurrences(event, new Date(event.startDate), horizon);
+    const last = occurrences[occurrences.length - 1];
+    return last ? new Date(new Date(last.startDate).valueOf() + duration) : end;
+}

package/dist/lib/calendar/sealedInvites.d.ts

@@ -1,11 +1,9 @@
-/**
- * The calendar files of zero-access messages, as decrypted on this device (`MessageSecurityResult.calendar`). The server holds only
- * the sealed copy of such a message, so every invitation call for it (`inviteApi.ts`) sends the file along. Kept in memory for the
- * messages read most recently, and cleared on sign-out (`clearSealedInvites()`).
- */
-/** Remembers the decrypted calendar file of zero-access message `messageUid`. */
-export declare function rememberSealedInvite(messageUid: string, ics: string): void;
-/** The decrypted calendar file of zero-access message `messageUid`, when this device has read it. */
+/** Remembers the decrypted calendar file of zero-access message `messageUid` of `mailboxUid` - not while that mailbox is locked (a
+ * pane still drawing what it decrypted before the lock). */
+export declare function rememberSealedInvite(messageUid: string, ics: string, mailboxUid: string): void;
+/** The decrypted calendar file of zero-access message `messageUid`, when this device has read it and its mailbox is unlocked. */
 export declare function sealedInviteCalendar(messageUid: string): string | undefined;
+/** Calls `listener` with the messages whose files a mailbox's lock forgot. Returns the unsubscribe. */
+export declare function onSealedInvitesForgotten(listener: (messageUids: string[]) => void): () => void;
 /** Forgets every remembered calendar file (sign-out). */
 export declare function clearSealedInvites(): void;

package/dist/lib/calendar/sealedInvites.js

@@ -5,22 +5,59 @@
 /**
  * The calendar files of zero-access messages, as decrypted on this device (`MessageSecurityResult.calendar`). The server holds only
  * the sealed copy of such a message, so every invitation call for it (`inviteApi.ts`) sends the file along. Kept in memory for the
- * messages read most recently, and cleared on sign-out (`clearSealedInvites()`).
+ * messages read most recently, only while their mailbox is unlocked: its lock forgets them (telling `onSealedInvitesForgotten()`
+ * listeners, so what was read with them goes too), and so does sign-out (`clearSealedInvites()`).
  */
+import { getUnlockedKeys, subscribeKeySession } from "../crypto/keySession.js";
 /** How many messages' calendar files are kept. */
 const MAX_SEALED_INVITES = 100;
 const calendars = new Map();
-/** Remembers the decrypted calendar file of zero-access message `messageUid`. */
-export function rememberSealedInvite(messageUid, ics) {
+const forgottenListeners = new Set();
+let watchingKeys = false;
+/** A mailbox's files go the moment it locks, so nothing opened outlives its key session. Subscribed on the first file, not on import. */
+function forgetOnLock() {
+    if (watchingKeys) {
+        return;
+    }
+    watchingKeys = true;
+    subscribeKeySession(({ mailboxUid, state }) => {
+        if (state !== "locked") {
+            return;
+        }
+        const forgotten = [];
+        for (const [messageUid, entry] of calendars) {
+            if (entry.mailboxUid === mailboxUid) {
+                calendars.delete(messageUid);
+                forgotten.push(messageUid);
+            }
+        }
+        if (forgotten.length) {
+            forgottenListeners.forEach((listener) => listener(forgotten));
+        }
+    });
+}
+/** Remembers the decrypted calendar file of zero-access message `messageUid` of `mailboxUid` - not while that mailbox is locked (a
+ * pane still drawing what it decrypted before the lock). */
+export function rememberSealedInvite(messageUid, ics, mailboxUid) {
+    if (!getUnlockedKeys(mailboxUid)) {
+        return;
+    }
+    forgetOnLock();
     calendars.delete(messageUid);
-    calendars.set(messageUid, ics);
+    calendars.set(messageUid, { mailboxUid, ics });
     while (calendars.size > MAX_SEALED_INVITES) {
         calendars.delete(calendars.keys().next().value);
     }
 }
-/** The decrypted calendar file of zero-access message `messageUid`, when this device has read it. */
+/** The decrypted calendar file of zero-access message `messageUid`, when this device has read it and its mailbox is unlocked. */
 export function sealedInviteCalendar(messageUid) {
-    return calendars.get(messageUid);
+    const entry = calendars.get(messageUid);
+    return entry && getUnlockedKeys(entry.mailboxUid) ? entry.ics : undefined;
+}
+/** Calls `listener` with the messages whose files a mailbox's lock forgot. Returns the unsubscribe. */
+export function onSealedInvitesForgotten(listener) {
+    forgottenListeners.add(listener);
+    return () => forgottenListeners.delete(listener);
 }
 /** Forgets every remembered calendar file (sign-out). */
 export function clearSealedInvites() {

package/dist/lib/contacts/contactsApi.d.ts

@@ -2,7 +2,7 @@
  * comment for the shared ACL/authorization model every wrapper file here follows. */
 import { ApiClient } from "../util/api.js";
 import { ListParams } from "../util/apiQuery.js";
-import { type EncryptionPreference, type KeyConflict, type PreviousKey, type PublicKey, type RejectedKey } from "../crypto/keyvaultApi.js";
+import { type EncryptionPreference, type EndToEndFormat, type KeyConflict, type PreviousKey, type PublicKey, type RejectedKey } from "../crypto/keyvaultApi.js";
 export type ContactAddressKind = "home" | "work" | "other";
 export interface ContactEmail {
     address: string;
@@ -51,6 +51,18 @@ export interface Contact {
      * via `crypto/keyvaultApi.ts`'s `lookupKeys()` at compose time, never fetched on message receipt
      * (that would leak read timing to the sender's server). */
     encryptPreference?: EncryptionPreference;
+    /** The protected details sealed to the mailbox's zero-access key while it protects contacts (`displayName` then shows the first email
+     * address, the other protected fields are empty) - opened with `openSealedRecords()`. Server-written. */
+    sealedFields?: Record<string, string> | null;
+    /** The photo (`photoBlobKey`) is sealed to the mailbox's zero-access key: it is fetched and opened, never shown by URL. Server-written. */
+    photoSealed?: boolean | null;
+    /** The end-to-end format the user chose for this contact ("Preferred format"); absent or null for automatic. */
+    preferredFormat?: EndToEndFormat | null;
+    /** The format this address was last seen using, from authenticated mail it sent (server-written). */
+    observedFormat?: {
+        format: EndToEndFormat;
+        at: number;
+    } | null;
     /** This contact's pinned public keys. Trust is TOFU (trust-on-first-use) — see `keyConflicts` for what
      * happens when a newly observed key differs from one of these. */
     keys?: PublicKey[];
@@ -67,12 +79,21 @@ export interface Contact {
 }
 /** Lists a folder's contacts, alphabetically by display name. Never includes soft-deleted contacts — see
  * `listDeletedContacts()` for those. */
+/** The protected contact fields a list of contacts shows - all a list opens (`openSealedRecords(contacts, CONTACT_LIST_FIELDS)`); a view of
+ * one contact opens the rest. */
+export declare const CONTACT_LIST_FIELDS: readonly string[];
+/** The protected fields a duplicate check compares (an address-less card is matched by name and phone). */
+export declare const CONTACT_MATCH_FIELDS: readonly string[];
 export declare function listContacts(folderUid: string, params?: ListParams, client?: ApiClient): Promise<Contact[]>;
 /** The trusted signing-key fingerprints of every contact in `contacts` with an email equal (case-insensitively) to
  * `address`: each contact's pinned `keys` and its `previousKeys`, so mail signed before a key rotation still verifies -
  * see `keyvaultApi.ts`'s `signingKeyFingerprints()` for the rules (expired and superseded keys kept, compromised or reasonless revoked keys excluded). De-duplicated;
  * `[]` when no contact matches or none has a trusted signing key. */
 export declare function pinnedSigningFingerprintsFor(contacts: Contact[], address: string): string[];
+/** The OpenPGP certificates (base64, `PublicKey.publicKey`) pinned on every contact in `contacts` for `address` - current and
+ * previous ones still trusted for verification (`isTrustedForVerification()`) - which an OpenPGP signature from that sender is
+ * checked against (an OpenPGP signature carries only a key ID, so the key itself is needed). De-duplicated by fingerprint. */
+export declare function pinnedOpenPgpKeysFor(contacts: Contact[], address: string): string[];
 /** Page size and page cap for `fetchPinnedSigningFingerprints()` and `fetchSignerKeyState()` (500 is restapi's own
  * `limit` cap). */
 export declare const PINNED_FINGERPRINT_PAGE_SIZE = 500;
@@ -99,6 +120,9 @@ export interface SignerKeyState {
     previous: PreviousKey[];
     /** The first unresolved signing-key conflict found, if any. */
     conflict?: KeyConflict;
+    /** The pinned OpenPGP certificates (which sign as well as encrypt), de-duplicated by fingerprint - what an OpenPGP signer's
+     * key-changed comparison shows. Absent when there are none. */
+    openPgp?: PublicKey[];
 }
 /** The signing-key state of every contact in `contacts` with an email equal (case-insensitively) to `address`, merged -
  * what a UI needs to compare a `signer_key_changed` message's certificate with the pinned and previous keys (their
@@ -161,7 +185,9 @@ export interface UpdateContactInput extends ContactInput {
  * (`dateCreated`/`dateModified`/etc.), so prefer sending only what actually changed over a whole
  * fetched `Contact`. An `UpdateContactInput` is also a valid `ContactPatch`. */
 export type ContactPatch = Partial<Contact> & Pick<Contact, "uid" | "version">;
-export declare function updateContact(patch: ContactPatch, client?: ApiClient): Promise<Contact>;
+/** Saves `patch`. A patch moving the contact to another mailbox (`mailboxUid`) is refused with `SealedMoveError` when the contact is
+ * protected - before sending anything when `current` (the contact as this device has it) says so, else from the server's refusal. */
+export declare function updateContact(patch: ContactPatch, client?: ApiClient, current?: Contact): Promise<Contact>;
 /** Thin `updateContact()` wrapper for toggling favorite/star status — same pattern as `mailApi.ts`'s
  * `setMessageRead()`/`tasksApi.ts`'s `setTaskCompleted()`. Sends only `uid`/`version`/`favorite`, never
  * the rest of `contact` (the server rejects its managed fields). */
@@ -178,7 +204,7 @@ export declare const CONTACT_PHOTO_MAX_BYTES: number;
 /** Sets a contact's own picture from an image file (the file's own bytes go up, not JSON) and returns the updated contact. */
 export declare function uploadContactPhoto(uid: string, version: number, file: Blob, client?: ApiClient): Promise<Contact>;
 /** The bytes of a contact's own picture through an explicit `client` - for one that authenticates with a token, whose `<img>` cannot (see `contactPhotoUrl()`). */
-export declare function fetchContactPhoto(uid: string, version: number, client: ApiClient): Promise<Blob>;
+export declare function fetchContactPhoto(uid: string, version: number, client?: ApiClient): Promise<Blob>;
 /** Removes a contact's own picture and returns the updated contact. */
 export declare function deleteContactPhoto(uid: string, version: number, client?: ApiClient): Promise<Contact>;
 export declare function deleteContact(uid: string, version: number, client?: ApiClient): Promise<void>;

package/dist/lib/contacts/contactsApi.js

@@ -4,14 +4,20 @@
 ///////////////////////////////////////////////////////////////////////////////
 /** Typed wrappers over `@rapidmx/restapi`'s `/mail/contacts` REST surface — see `mailApi.ts`'s own header
  * comment for the shared ACL/authorization model every wrapper file here follows. */
-import { apiUrl, withClient, withClientRaw } from "../util/api.js";
+import { apiUrl, withClient, withClientBlob, withClientRaw } from "../util/api.js";
 import { SETTINGS_LIST_LIMIT, buildQuery } from "../util/apiQuery.js";
-import { signingKeyFingerprints, } from "../crypto/keyvaultApi.js";
+import { guardSealedMove } from "../zeroAccess/sealedMoves.js";
+import { signingKeyFingerprints, isOpenPgpKey, isTrustedForVerification } from "../crypto/keyvaultApi.js";
 /** The order a contacts list is read in: alphabetical, with the `uid` as the tie-breaker so contacts sharing a name keep one fixed order and
  * a page boundary between them can neither skip nor repeat one. */
 const CONTACT_SORT = JSON.stringify({ displayName: "ASC", uid: "ASC" });
 /** Lists a folder's contacts, alphabetically by display name. Never includes soft-deleted contacts — see
  * `listDeletedContacts()` for those. */
+/** The protected contact fields a list of contacts shows - all a list opens (`openSealedRecords(contacts, CONTACT_LIST_FIELDS)`); a view of
+ * one contact opens the rest. */
+export const CONTACT_LIST_FIELDS = ["displayName", "phones", "categories"];
+/** The protected fields a duplicate check compares (an address-less card is matched by name and phone). */
+export const CONTACT_MATCH_FIELDS = ["displayName", "phones"];
 export function listContacts(folderUid, params = {}, client) {
     return withClient(client, `/mail/contacts?${buildQuery(params, { folderUid, sort: CONTACT_SORT })}`);
 }
@@ -26,6 +32,13 @@ function contactsMatching(contacts, address) {
 export function pinnedSigningFingerprintsFor(contacts, address) {
     return [...new Set(contactsMatching(contacts, address).flatMap((contact) => signingKeyFingerprints(contact.keys, contact.previousKeys)))];
 }
+/** The OpenPGP certificates (base64, `PublicKey.publicKey`) pinned on every contact in `contacts` for `address` - current and
+ * previous ones still trusted for verification (`isTrustedForVerification()`) - which an OpenPGP signature from that sender is
+ * checked against (an OpenPGP signature carries only a key ID, so the key itself is needed). De-duplicated by fingerprint. */
+export function pinnedOpenPgpKeysFor(contacts, address) {
+    const keys = contactsMatching(contacts, address).flatMap((contact) => [...(contact.keys ?? []), ...(contact.previousKeys ?? [])]);
+    return uniqueByFingerprint(keys.filter((key) => isOpenPgpKey(key) && isTrustedForVerification(key))).map((key) => key.publicKey);
+}
 /** Page size and page cap for `fetchPinnedSigningFingerprints()` and `fetchSignerKeyState()` (500 is restapi's own
  * `limit` cap). */
 export const PINNED_FINGERPRINT_PAGE_SIZE = 500;
@@ -77,7 +90,8 @@ export function signerKeyStateFor(contacts, address) {
     const pinned = uniqueByFingerprint(matching.flatMap((contact) => (contact.keys ?? []).filter((key) => key.useType === "sign")));
     const previous = uniqueByFingerprint(matching.flatMap((contact) => (contact.previousKeys ?? []).filter((key) => key.useType === "sign")).sort((a, b) => b.replacedAt - a.replacedAt));
     const conflict = matching.flatMap((contact) => contact.keyConflicts ?? []).find((entry) => entry.useType === "sign");
-    return { pinned, previous, ...(conflict ? { conflict } : {}) };
+    const openPgp = uniqueByFingerprint(matching.flatMap((contact) => (contact.keys ?? []).filter((key) => isOpenPgpKey(key))));
+    return { pinned, previous, ...(conflict ? { conflict } : {}), ...(openPgp.length > 0 ? { openPgp } : {}) };
 }
 /** Fetches `signerKeyStateFor()` for `address` from the contacts in `folderUids`, paging exactly like
  * `fetchPinnedSigningFingerprints()`. Reads only stored contacts - never triggers a Discovery lookup. */
@@ -117,11 +131,13 @@ export function createContact(input, client) {
         body: JSON.stringify({ emails: [], phones: [], addresses: [], ...input }),
     });
 }
-export function updateContact(patch, client) {
-    return withClient(client, `/mail/contacts/${encodeURIComponent(patch.uid)}`, {
+/** Saves `patch`. A patch moving the contact to another mailbox (`mailboxUid`) is refused with `SealedMoveError` when the contact is
+ * protected - before sending anything when `current` (the contact as this device has it) says so, else from the server's refusal. */
+export function updateContact(patch, client, current) {
+    return guardSealedMove(current, patch.mailboxUid, () => withClient(client, `/mail/contacts/${encodeURIComponent(patch.uid)}`, {
         method: "PUT",
         body: JSON.stringify(patch),
-    });
+    }));
 }
 /** Thin `updateContact()` wrapper for toggling favorite/star status — same pattern as `mailApi.ts`'s
  * `setMessageRead()`/`tasksApi.ts`'s `setTaskCompleted()`. Sends only `uid`/`version`/`favorite`, never
@@ -146,7 +162,7 @@ export function uploadContactPhoto(uid, version, file, client) {
 }
 /** The bytes of a contact's own picture through an explicit `client` - for one that authenticates with a token, whose `<img>` cannot (see `contactPhotoUrl()`). */
 export function fetchContactPhoto(uid, version, client) {
-    return client.fetchBlob(`/mail/contacts/${encodeURIComponent(uid)}/photo?v=${version}`);
+    return withClientBlob(client, `/mail/contacts/${encodeURIComponent(uid)}/photo?v=${version}`, "Could not load the contact's picture.");
 }
 /** Removes a contact's own picture and returns the updated contact. */
 export function deleteContactPhoto(uid, version, client) {

package/dist/lib/contacts/useContactPhotoSrc.d.ts

@@ -1,5 +1,7 @@
 import type { ApiClient } from "../util/api.js";
 import { type Contact } from "./contactsApi.js";
+/** What a photo is fetched by: the contact's identity, and whether (and for which mailbox) it is sealed. */
+type PhotoContact = Pick<Contact, "uid" | "version" | "photoBlobKey"> & Partial<Pick<Contact, "mailboxUid" | "photoSealed">>;
 /** Forgets every cached picture (and revokes its URL). For a test, or when an account is signed out. */
 export declare function clearContactPhotoCache(): void;
 /**
@@ -8,12 +10,13 @@ export declare function clearContactPhotoCache(): void;
  * token-authenticated client (the desktop and mobile apps) cannot do that - an `<img>` sends no `Authorization` header - so the picture is fetched through the client
  * and shown as a `blob:` URL, cached per client, contact and version with a small LRU and revoked once it falls out of it and nothing shows it.
  */
-export declare function useContactPhotoSrc(contact: Pick<Contact, "uid" | "version" | "photoBlobKey"> | undefined, client?: ApiClient): string | undefined;
+export declare function useContactPhotoSrc(contact: PhotoContact | undefined, client?: ApiClient): string | undefined;
 /**
  * `useContactPhotoSrc()`, also saying whether a picture that has to be fetched could not be (`failed`: no `src` is coming), and held back until `active` - an avatar
  * that is not on screen yet has no reason to fetch its picture.
  */
-export declare function useContactPhoto(contact: Pick<Contact, "uid" | "version" | "photoBlobKey"> | undefined, client?: ApiClient, active?: boolean): {
+export declare function useContactPhoto(contact: PhotoContact | undefined, client?: ApiClient, active?: boolean): {
     src: string | undefined;
     failed: boolean;
 };
+export {};

package/dist/lib/contacts/useContactPhotoSrc.js

@@ -2,8 +2,24 @@
 // Copyright (C) 2026 Jean-Philippe Steinmetz
 // SPDX-License-Identifier: MPL-2.0
 ///////////////////////////////////////////////////////////////////////////////
-import { useEffect, useState } from "react";
+import { useEffect, useRef, useState } from "react";
+import { getUnlockedKeys, subscribeKeySession } from "../crypto/keySession.js";
+import { openSealedBytes } from "../zeroAccess/sealedRecords.js";
 import { contactPhotoUrl, fetchContactPhoto } from "./contactsApi.js";
+/** The cache identity of the global (cookie) client, for a sealed photo fetched without an explicit client. */
+const GLOBAL_CLIENT = {};
+/** A contact's photo: the bytes as stored, or - sealed to the mailbox's zero-access key - opened (rejects when it can't be: initials show). */
+async function loadPhoto(contact, client) {
+    const blob = await fetchContactPhoto(contact.uid, contact.version, client);
+    if (!contact.photoSealed) {
+        return blob;
+    }
+    const opened = await openSealedBytes(contact.mailboxUid ?? "", new Uint8Array(await blob.arrayBuffer()));
+    if (!opened) {
+        throw new Error("The contact's picture is protected and can't be opened here.");
+    }
+    return new Blob([opened]);
+}
 /** How many pictures stay loaded (as `blob:` URLs) after nothing shows them any more, so a list scrolled back over does not fetch them all again. */
 const CACHE_LIMIT = 50;
 /** Least recently used first (a `Map` iterates in insertion order, and a use moves the entry to the end). */
@@ -12,6 +28,29 @@ const entries = new Map();
 const pending = new Map();
 const clientIds = new WeakMap();
 let nextClientId = 0;
+let watchingKeys = false;
+/** A sealed picture opened with a mailbox's keys goes when that mailbox locks, like every other opened value (`sealedRecords.ts`): its URL
+ * is revoked even while an avatar shows it - each one drops it itself (`useContactPhoto()`). Subscribed with the first sealed picture. */
+function forgetOnLock() {
+    if (watchingKeys) {
+        return;
+    }
+    watchingKeys = true;
+    subscribeKeySession(({ mailboxUid, state }) => {
+        if (state === "locked") {
+            forgetSealed(mailboxUid);
+        }
+    });
+}
+/** Revokes and forgets `mailboxUid`'s sealed pictures. */
+function forgetSealed(mailboxUid) {
+    for (const [key, entry] of entries) {
+        if (entry.mailboxUid === mailboxUid) {
+            URL.revokeObjectURL(entry.url);
+            entries.delete(key);
+        }
+    }
+}
 /** One key per picture of one account: the same uid never collides across the clients of a multi-account app, and a replaced picture (new version) is a new key. */
 function keyOf(client, uid, version) {
     let id = clientIds.get(client);
@@ -63,8 +102,20 @@ function limited(task) {
         }
     });
 }
-/** The `blob:` URL for `key`, fetched with `load` unless it is cached, and counted as shown until `release()`. Concurrent callers share one fetch. */
-async function acquire(key, load) {
+/**
+ * The `blob:` URL for `key`, fetched with `load` unless it is cached, and counted as shown until `release()`. Concurrent callers share one fetch.
+ * `sealedMailboxUid` is a sealed picture's mailbox: opened only while it is unlocked, it is neither fetched, handed out from the cache nor
+ * stored once that mailbox is locked (rejects).
+ */
+async function acquire(key, load, sealedMailboxUid) {
+    if (sealedMailboxUid !== undefined) {
+        forgetOnLock();
+        if (!getUnlockedKeys(sealedMailboxUid)) {
+            // Not fetched either: it couldn't be opened, and the avatar retries it once the mailbox unlocks (`useContactPhoto()`).
+            forgetSealed(sealedMailboxUid);
+            throw new Error("The contact's mailbox is locked.");
+        }
+    }
     const entry = entries.get(key);
     if (entry) {
         entry.refs++;
@@ -78,9 +129,13 @@ async function acquire(key, load) {
             waiters: 0,
             request: limited(load)
                 .then((blob) => {
+                // Opened just before a lock came: nothing opened is kept past it.
+                if (sealedMailboxUid !== undefined && !getUnlockedKeys(sealedMailboxUid)) {
+                    throw new Error("The contact's mailbox locked while its picture was opened.");
+                }
                 const url = URL.createObjectURL(blob);
                 // Claimed by everyone waiting from the start: an entry nobody holds yet could be trimmed before its avatar got to it.
-                entries.set(key, { url, refs: created.waiters });
+                entries.set(key, { url, refs: created.waiters, mailboxUid: sealedMailboxUid });
                 return url;
             })
                 .finally(() => pending.delete(key)),
@@ -121,16 +176,41 @@ export function useContactPhotoSrc(contact, client) {
 export function useContactPhoto(contact, client, active = true) {
     const [loaded, setLoaded] = useState();
     const [failedKey, setFailedKey] = useState();
-    const key = active && client && contact?.photoBlobKey ? keyOf(client, contact.uid, contact.version) : undefined;
-    const uid = contact?.uid;
-    const version = contact?.version;
+    // Bumped to load a sealed picture again: its mailbox locked (it can't be shown any more) or unlocked (one that failed can be now).
+    const [attempt, setAttempt] = useState(0);
+    // A sealed photo is always fetched (and opened) here: a URL would show the browser ciphertext.
+    const fetched = !!client || !!contact?.photoSealed;
+    const key = active && fetched && contact?.photoBlobKey ? keyOf(client ?? GLOBAL_CLIENT, contact.uid, contact.version) : undefined;
+    const sealedMailboxUid = contact?.photoSealed ? (contact.mailboxUid ?? "") : undefined;
+    const failedRef = useRef(failedKey);
+    failedRef.current = failedKey;
+    useEffect(() => {
+        if (!key || sealedMailboxUid === undefined) {
+            return;
+        }
+        return subscribeKeySession(({ mailboxUid, state }) => {
+            if (mailboxUid !== sealedMailboxUid) {
+                return;
+            }
+            if (state === "locked") {
+                // What the <img> decoded stays on screen until its src goes: drop it, then try again (it fails while locked: initials).
+                setLoaded(undefined);
+                setFailedKey(undefined);
+                setAttempt((n) => n + 1);
+            }
+            else if (failedRef.current === key) {
+                setFailedKey(undefined);
+                setAttempt((n) => n + 1);
+            }
+        });
+    }, [key, sealedMailboxUid]);
     useEffect(() => {
-        if (!key || !client) {
+        if (!key) {
             return;
         }
         let cancelled = false;
         let held = false;
-        acquire(key, () => fetchContactPhoto(uid, version, client)).then((url) => {
+        acquire(key, () => loadPhoto(contact, client), sealedMailboxUid).then((url) => {
             if (cancelled) {
                 release(key);
             }
@@ -145,8 +225,8 @@ export function useContactPhoto(contact, client, active = true) {
                 release(key);
             }
         };
-    }, [key]);
-    if (client) {
+    }, [key, attempt]);
+    if (fetched) {
         return { src: key !== undefined && loaded?.key === key ? loaded.url : undefined, failed: key !== undefined && failedKey === key };
     }
     return { src: contact && contactPhotoUrl(contact), failed: false };

package/dist/lib/crypto/composeSecurity.d.ts

@@ -22,9 +22,15 @@ export declare function classifyRecipientTier(ownAddress: string, recipientAddre
 export interface RecipientEncryptionStatus {
     address: string;
     tier: RecipientTier;
-    /** The recipient's currently-active encryption certificate, if they have published (and this device
+    /** The recipient's currently-active S/MIME encryption certificate, if they have published (and this device
      * has discovered) one. */
     encryptCert?: PublicKey;
+    /** The recipient's active OpenPGP certificate - only when they have no S/MIME certificate and the server allows OpenPGP
+     * (restapi `specs/end-to-end_encryption.md` *OpenPGP Interoperability*: S/MIME is preferred whenever it can be used). */
+    openPgpKey?: PublicKey;
+    /** Which format this recipient is encrypted in: `"smime"` whenever they have an S/MIME certificate, `"openpgp"` only for
+     * a recipient whose only key is an OpenPGP one. Absent when they can't be encrypted to. */
+    format?: "smime" | "openpgp";
     /** Whether this recipient *can* be encrypted to at all right now - false when there's no usable key,
      * or the tier's policy is `prohibited`. */
     canEncrypt: boolean;
@@ -38,8 +44,10 @@ export interface RecipientEncryptionStatus {
 }
 /** Per-recipient encryption eligibility, given this device's own encryption preference and the
  * system-wide policy. One entry per (address, lookup result) pair the caller already resolved via
- * `lookupKeys()` - this function does no discovery itself. */
-export declare function resolveRecipientEncryption(ownAddress: string, ownPrefersMutual: boolean, policy: EncryptionPolicy, recipientAddress: string, lookup: KeyLookupResult | undefined): RecipientEncryptionStatus;
+ * `lookupKeys()` - this function does no discovery itself. `ownCanUseOpenPgp` false: the sender has no OpenPGP key to use here
+ * (an OpenPGP copy is encrypted to the sender too), so a recipient who prefers OpenPGP but has an S/MIME certificate gets S/MIME - a
+ * preference never leaves them unencrypted (restapi `specs/end-to-end_encryption.md` *Choosing the format*). */
+export declare function resolveRecipientEncryption(ownAddress: string, ownPrefersMutual: boolean, policy: EncryptionPolicy, recipientAddress: string, lookup: KeyLookupResult | undefined, ownCanUseOpenPgp?: boolean): RecipientEncryptionStatus;
 export interface MessageEncryptionDecision {
     /** Whether the compose window's encryption toggle should default to checked - true only when every
      * recipient independently defaults to encrypted. Seeds the toggle's *initial* state only; the user