@rapidmx/web-client 0.36.0 → 0.37.0

package/dist/lib/crypto/smimeMessage.js

@@ -38,7 +38,8 @@ const BASE64_LINE_WIDTH = 76;
 export function applyBaselineOuterHeaders(headers) {
     return { ...headers, subject: "[...]" };
 }
-function base64Wrapped(bytes) {
+/** @internal Shared with `pgpMessage.ts`. */
+export function base64Wrapped(bytes) {
     const encoded = toBase64(bytes);
     const lines = [];
     for (let i = 0; i < encoded.length; i += BASE64_LINE_WIDTH) {
@@ -46,14 +47,15 @@ function base64Wrapped(bytes) {
     }
     return lines.join(CRLF);
 }
-function generateBoundary() {
+/** @internal Shared with `pgpMessage.ts`. */
+export function generateBoundary() {
     const bytes = crypto.getRandomValues(new Uint8Array(16));
     return `----=_RapidMX_${Array.from(bytes)
         .map((b) => b.toString(16).padStart(2, "0"))
         .join("")}`;
 }
 /** Strips CR/LF/NUL from a header value that has no further encoding (Date, Message-ID, Content-Type). */
-function flattenHeaderValue(value) {
+export function flattenHeaderValue(value) {
     return value.replace(/[\r\n\0]+/g, " ");
 }
 /**
@@ -73,7 +75,8 @@ function headerLines(headers, prefix = "") {
         ...(prefix ? [] : [`Message-ID: ${flattenHeaderValue(headers.messageId)}`]),
     ];
 }
-function protectedHeaderLines(headers, hpOuter) {
+/** @internal Shared with `pgpMessage.ts`: the protected header block of an inner entity (with `HP-Outer:` copies of `hpOuter`). */
+export function protectedHeaderLines(headers, hpOuter) {
     const lines = headerLines(headers);
     if (hpOuter) {
         // RFC 9788 Section 2.2.1's `hp-outer` field: the literal string "HP-Outer:" followed by the
@@ -237,7 +240,7 @@ export function assembleOutboundMime(outerHeaders, part) {
  * (a real bug if reused for this - JSON/`Record` keys aren't multi-valued). Scans the raw header block
  * text directly instead. Returns `undefined` when no `HP-Outer:` lines are present at all, so a caller
  * can distinguish "nothing to compare" from "compared and everything matched". */
-function extractHpOuterHeaders(fields) {
+export function extractHpOuterHeaders(fields) {
     const result = {};
     let found = false;
     for (const { name, value } of fields) {
@@ -253,7 +256,7 @@ function extractHpOuterHeaders(fields) {
 /** `true` when every field `hpOuter` actually carries matches `actualOuterHeaders`' value for that same
  * field - a field `hpOuter` doesn't carry (e.g. no `Cc` on this message) is not compared, since RFC
  * 9788 never claims coverage for it either way. */
-function outerHeadersMatch(hpOuter, actualOuterHeaders) {
+export function outerHeadersMatch(hpOuter, actualOuterHeaders) {
     return Object.keys(hpOuter).every((field) => hpOuter[field] === actualOuterHeaders[field]);
 }
 /** Decrypts (and, if present, verifies the inner signature of) a message built by
@@ -327,7 +330,8 @@ export function splitHeadersAndBody(entity) {
     const { headers, body, rawHeaderBlock } = parseMimeEntity(entity);
     return { headers, contentType: headers["content-type"], body, rawHeaderBlock };
 }
-function headersToProtectedHeaders(headers) {
+/** @internal Shared with `pgpMessage.ts`. */
+export function headersToProtectedHeaders(headers) {
     return {
         from: headers["from"] ?? "",
         to: headers["to"] ?? "",

package/dist/lib/crypto/zeroAccessKey.js

@@ -1,5 +1,6 @@
 import { fromBase64 } from "./encoding.js";
 import { enrollKey, getKeyVault } from "./keyvaultApi.js";
+import { certificateHoldsKey } from "./keyPairMatch.js";
 import { exportPrivateKeyPkcs8, generateKeyPairWithCsr, importPrivateKeyPkcs8 } from "./keys.js";
 import { addZeroAccessKey, getUnlockedKeys, ZERO_ACCESS_PRIVATE_KEY_AAD_PURPOSE } from "./keySession.js";
 import { buildAad, sealWithKey } from "./masterKey.js";
@@ -26,6 +27,10 @@ export async function provisionZeroAccessKey(mailboxUid, mailboxAddress, masterK
         if (!enrolled || !certificate) {
             throw new Error("The server did not return the enrolled zero-access key.");
         }
+        // The certificate is the server's: this device seals to it (index segments, protected meetings' keys), so it must be the new key's.
+        if (!(await certificateHoldsKey(fromBase64(certificate.publicKey), raw))) {
+            throw new Error("The server returned a zero-access certificate that isn't the enrolled key's.");
+        }
         const privateKey = await importPrivateKeyPkcs8(raw, { name: "ECDH", namedCurve: "P-256" }, ["deriveBits"], false);
         return { vault, key: { fingerprint: enrolled.fingerprint, certDer: fromBase64(certificate.publicKey), privateKey } };
     }

package/dist/lib/mail/mailApi.d.ts

@@ -101,6 +101,12 @@ export interface Mailbox {
     /** "Enable zero-access encryption": unset means on. Only the mailbox's owner can change it - restapi drops anybody
      * else's value. Has no effect while the server's `EncryptionPolicy.allowZeroAccess` is off. */
     zeroAccessEnabled?: boolean;
+    /** Which data types zero-access encryption covers - see `ZeroAccessTypes`. Owner only. */
+    zeroAccessTypes?: ZeroAccessTypes;
+    /** The ActiveSync and Outlook clients that sync this mailbox, as the server last saw them. Server-written. */
+    syncClients?: SyncClients;
+    /** When the owner last exported a zero-access key for a phone or Outlook. Server-written. */
+    zeroAccessKeysExportedAt?: number;
     /** How the caller reaches this mailbox: `"owner"` (theirs) or `"delegate"` (shared with them). Set by the plain list and read of
      * mailboxes - not in an administration-scope answer - so a client can label the shared ones; see `isSharedWithMe()`. */
     accessRole?: "owner" | "delegate";
@@ -197,6 +203,25 @@ export declare function autoProvisionMailbox(selection?: {
  * `null` clears them - `JSON.stringify()` drops an `undefined` value entirely, which would instead leave
  * the old value in place.
  */
+/** The data types zero-access encryption can cover (restapi `specs/search.md` §3 *What It Covers*). */
+export type ZeroAccessDataType = "mail" | "calendar" | "contacts" | "tasks";
+/** `Mailbox.zeroAccessTypes`: per data type, whether zero-access covers it. A type left out is undecided: mail counts as on, the others
+ * as off, until the server decides them from the owner's devices. */
+export type ZeroAccessTypes = Partial<Record<ZeroAccessDataType, boolean>>;
+/** `Mailbox.syncClients`: the ActiveSync devices (each with the data types it syncs) and Outlook. */
+export interface SyncClients {
+    activesync?: {
+        devices: {
+            id: string;
+            model?: string;
+            types: ZeroAccessDataType[];
+            lastSeenAt: number;
+        }[];
+    };
+    mapi?: {
+        lastSeenAt: number;
+    };
+}
 export interface UpdateMailboxInput {
     uid: string;
     version: number;
@@ -223,6 +248,10 @@ export interface UpdateMailboxInput {
     autoSendReceiptsExternal?: boolean;
     /** Owner-only server-side (anybody else's value is dropped) - see `Mailbox.zeroAccessEnabled`. */
     zeroAccessEnabled?: boolean;
+    /** Owner-only server-side; a partial choice is merged into the stored one - see `Mailbox.zeroAccessTypes`. */
+    zeroAccessTypes?: ZeroAccessTypes;
+    /** The mailbox's own encryption preference, replaced whole - see `Mailbox.encryptPreference`. */
+    encryptPreference?: EncryptionPreference;
     /** Trusted-caller-only server-side. `null` (or `""`) unassigns the mailbox's escrow scope; the
      * referenced `EscrowScope` must exist otherwise. See `Mailbox.escrowScopeId`. */
     escrowScopeId?: string | null;
@@ -728,6 +757,10 @@ export interface AssembleDraftInput {
     html: string;
     /** See `AssembleIntent`. */
     intent?: AssembleIntent;
+    /** The addresses this copy is delivered to, when not all of `to`/`cc`/`bcc`: one copy of a message sent in two end-to-end
+     * formats (an S/MIME and an OpenPGP copy, each listing every recipient) goes only to the recipients of its own format. Each
+     * must be one of the recipients. */
+    deliverTo?: string[];
 }
 /**
  * Why a draft is being assembled (server `ComposeIntent`). `"save"`, the default, keeps an edit: in a zero-access mailbox the server

package/dist/lib/mail/mailboxImportApi.d.ts

@@ -7,6 +7,7 @@
  */
 import { ApiClient } from "../util/api.js";
 import { RequestListParams } from "../util/apiQuery.js";
+import type { Mailbox } from "./mailApi.js";
 export type { RequestListParams };
 export type MailboxImportFormat = "mbox" | "pst";
 export type MailboxImportStatus = "pending" | "processing" | "completed" | "failed";
@@ -51,3 +52,12 @@ export declare function uploadMailboxImport(file: File, input: UploadMailboxImpo
  * first; `params` pages through them (`limit` capped at 500 server-side). */
 export declare function listImportRequests(params?: RequestListParams, client?: ApiClient): Promise<MailboxImportRequest[]>;
 export declare function getImportRequest(uid: string, client?: ApiClient): Promise<MailboxImportRequest>;
+/** Why server-side import is refused for a mailbox whose mail is zero-access (restapi answers such an upload 409). */
+export declare const ZERO_ACCESS_IMPORT_MESSAGE: string;
+/**
+ * Whether `mailbox`'s mail is stored zero-access encrypted, so restapi refuses a server-side import into it (`specs/search.md` §3: the
+ * uploaded archive would wait readable in the blob store). Decided as restapi's `zeroAccessStatus()` decides it for mail: the
+ * administrator's "Allow zero-access encryption" (`allowZeroAccess`; unknown counts as allowed, so an import is never offered only to be
+ * refused), the owner's switch (unset is on), mail among the protected types (undecided is on), and a key that isn't revoked.
+ */
+export declare function mailIsZeroAccess(mailbox: Pick<Mailbox, "zeroAccessEnabled" | "zeroAccessTypes" | "zeroAccessKeys">, allowZeroAccess: boolean | undefined): boolean;

package/dist/lib/mail/mailboxImportApi.js

@@ -37,3 +37,18 @@ export function listImportRequests(params = {}, client) {
 export function getImportRequest(uid, client) {
     return withClient(client, `/mail/mailbox-import-requests/${encodeURIComponent(uid)}`);
 }
+/** Why server-side import is refused for a mailbox whose mail is zero-access (restapi answers such an upload 409). */
+export const ZERO_ACCESS_IMPORT_MESSAGE = "Importing an archive isn't available while zero-access encryption protects this mailbox's mail: the server would have to keep " +
+    "the uploaded archive readable until the import ran, which zero-access encryption doesn't allow.";
+/**
+ * Whether `mailbox`'s mail is stored zero-access encrypted, so restapi refuses a server-side import into it (`specs/search.md` §3: the
+ * uploaded archive would wait readable in the blob store). Decided as restapi's `zeroAccessStatus()` decides it for mail: the
+ * administrator's "Allow zero-access encryption" (`allowZeroAccess`; unknown counts as allowed, so an import is never offered only to be
+ * refused), the owner's switch (unset is on), mail among the protected types (undecided is on), and a key that isn't revoked.
+ */
+export function mailIsZeroAccess(mailbox, allowZeroAccess) {
+    return (allowZeroAccess !== false &&
+        mailbox.zeroAccessEnabled !== false &&
+        mailbox.zeroAccessTypes?.mail !== false &&
+        (mailbox.zeroAccessKeys ?? []).some((key) => !key.revokedAt));
+}

package/dist/lib/search/zeroAccessIndexApi.d.ts

@@ -23,6 +23,10 @@ export interface IndexWeekEntries {
     latestEntryAt: string;
     /** The week has closed and its grace period has passed: a client may compact it. */
     compactable: boolean;
+    /** When the week becomes (or became) compactable - where the platform stagger starts. Absent from a server before it. */
+    compactableAt?: string;
+    /** Size of the week's pending sealed entries (bytes of base64). Absent from a server before it. */
+    pendingBytes?: number;
 }
 export interface SegmentManifest {
     mailboxUid: string;

package/dist/lib/tasks/tasksApi.d.ts

@@ -24,6 +24,9 @@ export interface Task {
     myDay?: boolean;
     /** The uid of the user this task is assigned to, if any. */
     assignedTo?: string;
+    /** The title and notes sealed to the mailbox's zero-access key while it protects tasks (`title` is then a placeholder) - opened with
+     * `openSealedRecords()`. Server-written. */
+    sealedFields?: Record<string, string> | null;
 }
 /** `client`, given by every function below, is an explicit `ApiClient` from `createApiClient()` (e.g. one
  * account of a multi-account app) to call instead of the default global `apiFetch()` - see `withClient()`'s
@@ -56,8 +59,15 @@ export interface UpdateTaskInput {
     taskListUid?: string;
     myDay?: boolean;
     assignedTo?: string;
+    /** A move to another mailbox, with `folderUid` there - refused for a protected task (`SealedMoveError`). */
+    mailboxUid?: string;
+    folderUid?: string;
 }
-export declare function updateTask(input: UpdateTaskInput, client?: ApiClient): Promise<Task>;
+/** Saves `input`. One moving the task to another mailbox (`mailboxUid`) is refused with `SealedMoveError` when the task is protected -
+ * before sending anything when `current` (the task as this device has it) says so, else from the server's refusal. With `current`, a
+ * protected task's sealed fields go only when they changed from it, and an emptied one is named in `clearedFields` when `current` was
+ * opened here (`protectedRecordWrite()`). */
+export declare function updateTask(input: UpdateTaskInput, client?: ApiClient, current?: Task): Promise<Task>;
 /** Toggles a task's `completed` flag in place — same pattern as `mailApi.ts`'s `setMessageRead`. */
 export declare function setTaskCompleted(task: Task, completed: boolean, client?: ApiClient): Promise<Task>;
 /** Adds/removes a task from the caller's curated "My Day" working set — same thin-wrapper pattern as

package/dist/lib/tasks/tasksApi.js

@@ -6,6 +6,8 @@
  * comment for the shared ACL/authorization model every wrapper file here follows. */
 import { withClient } from "../util/api.js";
 import { SETTINGS_LIST_LIMIT, buildQuery } from "../util/apiQuery.js";
+import { guardSealedMove } from "../zeroAccess/sealedMoves.js";
+import { protectedRecordWrite } from "../zeroAccess/sealedRecords.js";
 /** `client`, given by every function below, is an explicit `ApiClient` from `createApiClient()` (e.g. one
  * account of a multi-account app) to call instead of the default global `apiFetch()` - see `withClient()`'s
  * own doc comment in `util/api.ts`. Omitted (the default), every function here behaves exactly as before. */
@@ -22,11 +24,15 @@ export function createTask(input, client) {
         body: JSON.stringify({ completed: false, priority: "normal", ...input }),
     });
 }
-export function updateTask(input, client) {
-    return withClient(client, `/mail/tasks/${encodeURIComponent(input.uid)}`, {
+/** Saves `input`. One moving the task to another mailbox (`mailboxUid`) is refused with `SealedMoveError` when the task is protected -
+ * before sending anything when `current` (the task as this device has it) says so, else from the server's refusal. With `current`, a
+ * protected task's sealed fields go only when they changed from it, and an emptied one is named in `clearedFields` when `current` was
+ * opened here (`protectedRecordWrite()`). */
+export function updateTask(input, client, current) {
+    return guardSealedMove(current, input.mailboxUid, () => withClient(client, `/mail/tasks/${encodeURIComponent(input.uid)}`, {
         method: "PUT",
-        body: JSON.stringify(input),
-    });
+        body: JSON.stringify(protectedRecordWrite(current, input)),
+    }));
 }
 /** Toggles a task's `completed` flag in place — same pattern as `mailApi.ts`'s `setMessageRead`. */
 export function setTaskCompleted(task, completed, client) {

package/dist/lib/util/clientPlatform.d.ts

@@ -0,0 +1,14 @@
+/**
+ * What kind of client this is, for work that should prefer one over another - the search index's week compaction, which a phone
+ * should leave to a computer (restapi `specs/search.md` §8 *Who compacts*).
+ *
+ * - `"desktop"`: a native app on a computer (`tauri-client`, `electron-client`), which installs `window.rapidmx`.
+ * - `"mobile"`: a native app on a phone or tablet (the host sets `window.rapidmx.formFactor: "mobile"`), or a phone or tablet browser.
+ * - `"web"`: any other browser.
+ */
+export type ClientPlatform = "desktop" | "web" | "mobile";
+/** This client's platform (see the module comment). */
+export declare function clientPlatform(): ClientPlatform;
+/** Whether the connection is one to spare: cellular, or the user asked to save data (Network Information API, where the browser
+ * has it - absent, the connection is taken as unconstrained). */
+export declare function isConstrainedConnection(): boolean;

package/dist/lib/util/clientPlatform.js

@@ -0,0 +1,26 @@
+const MOBILE_USER_AGENT = /Android|iPhone|iPad|iPod|Mobile/i;
+function navigatorHints() {
+    return typeof navigator === "undefined" ? undefined : navigator;
+}
+/** Whether this browser runs on a phone or tablet, by its User-Agent Client Hints, else its user agent string. */
+function isMobileBrowser() {
+    const hints = navigatorHints();
+    if (typeof hints?.userAgentData?.mobile === "boolean") {
+        return hints.userAgentData.mobile;
+    }
+    return MOBILE_USER_AGENT.test(hints?.userAgent ?? "");
+}
+/** This client's platform (see the module comment). */
+export function clientPlatform() {
+    const host = typeof window === "undefined" ? undefined : window.rapidmx;
+    if (host) {
+        return host.formFactor === "mobile" ? "mobile" : "desktop";
+    }
+    return isMobileBrowser() ? "mobile" : "web";
+}
+/** Whether the connection is one to spare: cellular, or the user asked to save data (Network Information API, where the browser
+ * has it - absent, the connection is taken as unconstrained). */
+export function isConstrainedConnection() {
+    const connection = navigatorHints()?.connection;
+    return connection?.saveData === true || connection?.type === "cellular";
+}

package/dist/lib/videoconf/protectedMeetings.d.ts

@@ -0,0 +1,74 @@
+import type { ApiClient } from "../util/api.js";
+import { type VideoMeetingDetail, type VideoMeetingInvitee } from "./videoMeetingsApi.js";
+/** How long after the meeting ends its key is kept (`mail:videoconf:key_grace_minutes`' default). */
+export declare const MEETING_KEY_GRACE_MS: number;
+/** What `createVideoMeeting()` sends to protect a meeting. */
+export interface MeetingProtectionInput {
+    meetingKey: {
+        certificate: string;
+    };
+    keyExpiresAt: string;
+    keyWraps: {
+        mailboxUid: string;
+        recipientFingerprint: string;
+        kind: "meeting-key";
+        cms: string;
+    }[];
+    sealedFields: {
+        title: string;
+    };
+}
+/** A protected meeting's fields, as the server returns them to its organizer. */
+export interface ProtectedMeetingFields {
+    keyProtected?: boolean | null;
+    keyWraps?: {
+        mailboxUid: string;
+        recipientFingerprint: string;
+        kind: string;
+        cms: string;
+    }[] | null;
+    /** When the meeting key is discarded (ISO). */
+    keyExpiresAt?: string | null;
+}
+/** Forgets every opened meeting key (sign-out, or the test seam). */
+export declare function clearMeetingKeys(): void;
+/** When a meeting ending at `endDate` - the last occurrence's end, for a series that has one - has its key discarded. */
+export declare function meetingKeyExpiry(endDate: Date, now?: number): Date;
+/** What protects a new meeting of `mailboxUid` titled `title` with `invitees`, its key discarded at `expiresAt` - or `undefined` when
+ * the mailbox has no zero-access key unlocked here (the meeting is then not protected). `fragment` is every participant's link key. */
+export declare function protectMeeting(mailboxUid: string, title: string, invitees: VideoMeetingInvitee[], expiresAt: Date): Promise<{
+    protection: MeetingProtectionInput;
+    invitees: {
+        email: string;
+        sealedFields?: {
+            displayName: string;
+        };
+    }[];
+    fragment: string;
+} | undefined>;
+/** Remembers a just-created meeting's link key - `null` for one that isn't protected - so the save that invites to it needn't fetch the
+ * meeting or reopen its wrap. `mailboxUid` is the organizer's mailbox: its lock forgets the key. */
+export declare function rememberMeetingKey(meetingUid: string, fragment: string | null, mailboxUid: string): void;
+/** `meeting`'s link key - remembered, or opened from the organizer's wrap with the mailbox's unlocked zero-access keys - or `undefined`
+ * when it isn't protected or can't be opened here. Never rejects. */
+export declare function meetingKeyFragmentOf(meeting: VideoMeetingDetail & ProtectedMeetingFields): Promise<string | undefined>;
+/** `meeting`'s organizer join link, with the meeting key after `#` when it is protected - `null` when there is none, or the key can't
+ * be opened here (a protected meeting can't be joined without it). */
+export declare function organizerJoinLink(meeting: VideoMeetingDetail & ProtectedMeetingFields): Promise<string | null>;
+/** For a save of `event` that may invite: every attendee's link key (`invitationContent.meetingLinkSecrets`), when its video meeting is
+ * protected and its key opens here - else `undefined`. Never rejects. */
+export declare function meetingLinkSecrets(event: {
+    videoMeetingUid?: string | null;
+    attendees?: {
+        address: string;
+    }[];
+    organizer?: {
+        address: string;
+    };
+}, client?: ApiClient): Promise<Record<string, string> | undefined>;
+/**
+ * Moves the key expiry of meeting `meetingUid` - when it is protected - to follow its event's new end, `endDate` (the last occurrence's
+ * end, for a series): its key is discarded an hour after the end it was made for, so a meeting moved later (or a series extended) would
+ * otherwise be unjoinable by then. Best effort, after the event itself is saved: a failure is logged, never thrown.
+ */
+export declare function followMeetingKeyExpiry(meetingUid: string, endDate: Date, client?: ApiClient): Promise<void>;

package/dist/lib/videoconf/protectedMeetings.js

@@ -0,0 +1,181 @@
+///////////////////////////////////////////////////////////////////////////////
+// Copyright (C) 2026 Jean-Philippe Steinmetz
+// SPDX-License-Identifier: MPL-2.0
+///////////////////////////////////////////////////////////////////////////////
+/**
+ * The organizer's side of a protected video meeting (meet-plugin `specs/meeting_privacy.md`): a meeting whose organizer has a zero-access
+ * key gets a temporary meeting key, made here. Its title and invitees' names are sealed to the meeting key and the organizer's
+ * zero-access certificate; the meeting key itself is wrapped to the organizer's zero-access certificate, so any of the organizer's
+ * devices can reopen it; and every participant's link carries the key after `#k=`, which this module supplies on each save that sends an
+ * invitation (`invitationContent.meetingLinkSecrets`) and on the organizer's own join link - never stored by the server.
+ *
+ * The meeting key is discarded an hour after the event ends (the last occurrence's end for a series with an end; five years at most).
+ */
+import { fromBase64, toBase64 } from "../crypto/encoding.js";
+import { getUnlockedKeys, subscribeKeySession } from "../crypto/keySession.js";
+import { generateMeetingKey, meetingKeyFragment } from "../crypto/meetingKeys.js";
+import { decryptEnvelopedDataWithKeys, encryptForRecipients } from "../crypto/smime.js";
+import { getVideoMeeting, updateVideoMeeting } from "./videoMeetingsApi.js";
+/** How long after the meeting ends its key is kept (`mail:videoconf:key_grace_minutes`' default). */
+export const MEETING_KEY_GRACE_MS = 60 * 60000;
+/** The longest a meeting key is kept: a series without an end keeps it this long, just inside the server's limit. */
+const MAX_KEY_LIFETIME_MS = 5 * 365 * 24 * 60 * 60000;
+/** Link keys by meeting uid, each with the organizer mailbox it belongs to: a protected meeting's key is opened once, and forgotten when
+ * that mailbox's keys are locked. `fragment: null`: a meeting known to be unprotected. */
+const fragments = new Map();
+/** Forgets every opened meeting key (sign-out, or the test seam). */
+export function clearMeetingKeys() {
+    fragments.clear();
+}
+let watchingKeys = false;
+/** Records `uid`'s link key, forgetting it - like everything opened with a mailbox's keys - once that mailbox locks. Subscribed on the
+ * first key remembered, not on import. */
+function remember(uid, mailboxUid, fragment) {
+    if (!watchingKeys) {
+        watchingKeys = true;
+        subscribeKeySession(({ mailboxUid: locked, state }) => {
+            if (state === "locked") {
+                for (const [meetingUid, entry] of fragments) {
+                    if (entry.mailboxUid === locked) {
+                        fragments.delete(meetingUid);
+                    }
+                }
+            }
+        });
+    }
+    // A key opened or minted across an await the mailbox locked during: the lock's clear has already run, so it isn't kept.
+    if (fragment !== null && !getUnlockedKeys(mailboxUid)) {
+        return;
+    }
+    fragments.set(uid, { mailboxUid, fragment });
+}
+/** Meeting `uid`'s remembered link key - `null` for one known to be unprotected - or `undefined` when none is remembered, or its mailbox
+ * isn't unlocked here (a key is never handed out past its mailbox's lock). */
+function rememberedFragment(uid) {
+    const entry = fragments.get(uid);
+    if (!entry || (entry.fragment !== null && !getUnlockedKeys(entry.mailboxUid))) {
+        return undefined;
+    }
+    return entry.fragment;
+}
+/** When a meeting ending at `endDate` - the last occurrence's end, for a series that has one - has its key discarded. */
+export function meetingKeyExpiry(endDate, now = Date.now()) {
+    return new Date(Math.min(endDate.valueOf() + MEETING_KEY_GRACE_MS, now + MAX_KEY_LIFETIME_MS));
+}
+/** The organizer mailbox's active zero-access key, while the mailbox is unlocked. */
+function organizerKey(mailboxUid) {
+    return getUnlockedKeys(mailboxUid)?.zeroAccessKeys?.[0];
+}
+/** What protects a new meeting of `mailboxUid` titled `title` with `invitees`, its key discarded at `expiresAt` - or `undefined` when
+ * the mailbox has no zero-access key unlocked here (the meeting is then not protected). `fragment` is every participant's link key. */
+export async function protectMeeting(mailboxUid, title, invitees, expiresAt) {
+    const organizer = organizerKey(mailboxUid);
+    if (!organizer) {
+        return undefined;
+    }
+    const key = await generateMeetingKey(expiresAt);
+    const seal = async (value) => toBase64(await encryptForRecipients(new TextEncoder().encode(JSON.stringify(value)), [key.certificateDer, organizer.certDer]));
+    return {
+        protection: {
+            meetingKey: { certificate: toBase64(key.certificateDer) },
+            keyExpiresAt: expiresAt.toISOString(),
+            keyWraps: [{ mailboxUid, recipientFingerprint: organizer.fingerprint, kind: "meeting-key", cms: toBase64(await encryptForRecipients(key.pkcs8, [organizer.certDer])) }],
+            sealedFields: { title: await seal(title) },
+        },
+        invitees: await Promise.all(invitees.map(async (invitee) => (invitee.displayName ? { email: invitee.email, sealedFields: { displayName: await seal(invitee.displayName) } } : { email: invitee.email }))),
+        fragment: meetingKeyFragment(key.pkcs8),
+    };
+}
+/** Remembers a just-created meeting's link key - `null` for one that isn't protected - so the save that invites to it needn't fetch the
+ * meeting or reopen its wrap. `mailboxUid` is the organizer's mailbox: its lock forgets the key. */
+export function rememberMeetingKey(meetingUid, fragment, mailboxUid) {
+    remember(meetingUid, mailboxUid, fragment);
+}
+/** `meeting`'s link key - remembered, or opened from the organizer's wrap with the mailbox's unlocked zero-access keys - or `undefined`
+ * when it isn't protected or can't be opened here. Never rejects. */
+export async function meetingKeyFragmentOf(meeting) {
+    if (!meeting.keyProtected) {
+        return undefined;
+    }
+    const known = rememberedFragment(meeting.uid);
+    if (known !== undefined) {
+        return known ?? undefined;
+    }
+    const keys = getUnlockedKeys(meeting.mailboxUid)?.zeroAccessKeys;
+    const wrap = meeting.keyWraps?.find((candidate) => keys?.some((key) => key.fingerprint === candidate.recipientFingerprint));
+    if (!keys?.length || !wrap) {
+        return undefined;
+    }
+    try {
+        const fragment = meetingKeyFragment(await decryptEnvelopedDataWithKeys(fromBase64(wrap.cms), keys));
+        // Locked while it was opened: neither kept nor handed out.
+        if (!getUnlockedKeys(meeting.mailboxUid)) {
+            return undefined;
+        }
+        remember(meeting.uid, meeting.mailboxUid, fragment);
+        return fragment;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** `meeting`'s organizer join link, with the meeting key after `#` when it is protected - `null` when there is none, or the key can't
+ * be opened here (a protected meeting can't be joined without it). */
+export async function organizerJoinLink(meeting) {
+    if (!meeting.organizerJoinUrl) {
+        return null;
+    }
+    if (!meeting.keyProtected) {
+        return meeting.organizerJoinUrl;
+    }
+    const fragment = await meetingKeyFragmentOf(meeting);
+    return fragment ? `${meeting.organizerJoinUrl}#${fragment}` : null;
+}
+/** For a save of `event` that may invite: every attendee's link key (`invitationContent.meetingLinkSecrets`), when its video meeting is
+ * protected and its key opens here - else `undefined`. Never rejects. */
+export async function meetingLinkSecrets(event, client) {
+    if (!event.videoMeetingUid) {
+        return undefined;
+    }
+    try {
+        const known = rememberedFragment(event.videoMeetingUid);
+        const fragment = known !== undefined ? known : await meetingKeyFragmentOf(await getVideoMeeting(event.videoMeetingUid, client));
+        if (!fragment) {
+            return undefined;
+        }
+        const organizer = event.organizer?.address.trim().toLowerCase();
+        const secrets = {};
+        for (const attendee of event.attendees ?? []) {
+            const address = attendee.address.trim().toLowerCase();
+            if (address && address !== organizer) {
+                secrets[address] = fragment;
+            }
+        }
+        return Object.keys(secrets).length > 0 ? secrets : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Moves the key expiry of meeting `meetingUid` - when it is protected - to follow its event's new end, `endDate` (the last occurrence's
+ * end, for a series): its key is discarded an hour after the end it was made for, so a meeting moved later (or a series extended) would
+ * otherwise be unjoinable by then. Best effort, after the event itself is saved: a failure is logged, never thrown.
+ */
+export async function followMeetingKeyExpiry(meetingUid, endDate, client) {
+    try {
+        if (fragments.get(meetingUid)?.fragment === null) {
+            return;
+        }
+        const meeting = await getVideoMeeting(meetingUid, client);
+        const keyExpiresAt = meetingKeyExpiry(endDate);
+        // Unprotected, or already right to the minute (an unchanged end).
+        if (!meeting.keyProtected || (meeting.keyExpiresAt && Math.abs(new Date(meeting.keyExpiresAt).valueOf() - keyExpiresAt.valueOf()) < 60000)) {
+            return;
+        }
+        await updateVideoMeeting(meetingUid, { keyExpiresAt: keyExpiresAt.toISOString() }, client);
+    }
+    catch (err) {
+        console.warn("Could not move the video meeting's key expiry to the event's new end", err);
+    }
+}

package/dist/lib/videoconf/videoMeetingsApi.d.ts

@@ -16,6 +16,7 @@
  * Response bodies are typed, not runtime-validated, matching this library's convention for a plain typed
  * `apiFetch<T>()` call (see `crypto/signingProviderApi.ts`'s own note on the same choice).
  */
+import type { MeetingProtectionInput } from "./protectedMeetings.js";
 import { ApiClient } from "../util/api.js";
 import { ListParams } from "../util/apiQuery.js";
 export type { ListParams };
@@ -38,6 +39,16 @@ export interface VideoMeeting {
      * (its oldest non-cancelled public meeting - see that app's own doc comment) out of `listVideoMeetings()`'s
      * results. */
     dateCreated: string;
+    /** Protected end to end (meet-plugin `specs/meeting_privacy.md`): `title` is `"Meeting"`, the real one sealed, and every link works
+     * only with the meeting key after `#` - see `protectedMeetings.ts`. */
+    keyProtected?: boolean | null;
+    /** A protected meeting's key, sealed to the organizer's zero-access certificate. */
+    keyWraps?: {
+        mailboxUid: string;
+        recipientFingerprint: string;
+        kind: string;
+        cms: string;
+    }[] | null;
 }
 /**
  * A meeting as fetched by `getVideoMeeting()` or listed by `listVideoMeetings()` — the entity plus whichever join
@@ -67,8 +78,9 @@ export interface VideoMeetingInviteeJoinInfo extends VideoMeetingInvitee {
 export interface CreateVideoMeetingInput {
     /** The mailbox that owns the meeting — the one whose ACL every later call on it is checked against. */
     mailboxUid: string;
-    /** Non-empty, at most 200 characters (the server rejects anything else with a 400). */
-    title: string;
+    /** Non-empty, at most 200 characters (the server rejects anything else with a 400). Omitted for a protected meeting, whose title is
+     * sealed in `protection`. */
+    title?: string;
     visibility: VideoMeetingVisibility;
     /** The `CalendarEvent` this meeting is being minted for, when there is one. */
     calendarEventUid?: string;
@@ -77,7 +89,14 @@ export interface CreateVideoMeetingInput {
     /** Required, and non-empty, for a `"private"` meeting — the server mints one personal join link per entry
      * and 400s a private meeting with none. Never send the organizer here: they reach their own meeting
      * through ownership (and `organizerJoinUrl`), not as a guest. */
-    invitees?: VideoMeetingInvitee[];
+    invitees?: (VideoMeetingInvitee | {
+        email: string;
+        sealedFields?: {
+            displayName: string;
+        };
+    })[];
+    /** Makes the meeting protected end to end - `protectMeeting()` in `protectedMeetings.ts`. */
+    protection?: MeetingProtectionInput;
 }
 export interface VideoMeetingCreateResult {
     meeting: VideoMeeting;
@@ -101,8 +120,10 @@ export declare function createVideoMeeting(input: CreateVideoMeetingInput, clien
 export interface UpdateVideoMeetingInput {
     title?: string;
     status?: "cancelled";
+    /** A protected meeting's new key expiry (ISO), when its event's end moved - `followMeetingKeyExpiry()` in `protectedMeetings.ts`. */
+    keyExpiresAt?: string;
 }
-/** Renames or cancels a meeting. Requires UPDATE on its owning mailbox. */
+/** Renames, cancels or moves the key expiry of a meeting. Requires UPDATE on its owning mailbox. */
 export declare function updateVideoMeeting(uid: string, input: UpdateVideoMeetingInput, client?: ApiClient): Promise<VideoMeeting>;
 /** Fetches one meeting, with the organizer's own join link when it has one. Requires READ on its owning mailbox. */
 export declare function getVideoMeeting(uid: string, client?: ApiClient): Promise<VideoMeetingDetail>;

package/dist/lib/videoconf/videoMeetingsApi.js

@@ -29,7 +29,7 @@ import { buildQuery } from "../util/apiQuery.js";
 export function createVideoMeeting(input, client) {
     return withClient(client, "/mail/video-meetings", { method: "POST", body: JSON.stringify(input) });
 }
-/** Renames or cancels a meeting. Requires UPDATE on its owning mailbox. */
+/** Renames, cancels or moves the key expiry of a meeting. Requires UPDATE on its owning mailbox. */
 export function updateVideoMeeting(uid, input, client) {
     return withClient(client, `/mail/video-meetings/${encodeURIComponent(uid)}`, { method: "PUT", body: JSON.stringify(input) });
 }