@rapidmx/web-client 0.36.0 → 0.37.0

package/lib/calendar/calendarMutations.ts

@@ -22,12 +22,17 @@ import {
     UpdateCalendarEventInput,
     createCalendarEvent,
     deleteCalendarEvent,
+    fullyOpenedEvent,
     getCalendarEvent,
     listCalendarEvents,
     updateCalendarEvent,
 } from "./calendarApi.js";
-import { CalendarOccurrence, fromEventWallClock, toEventWallClock } from "./recurrence.js";
-import { ApiClient } from "../util/api.js";
+import { CalendarOccurrence, fromEventWallClock, seriesEndDate, toEventWallClock } from "./recurrence.js";
+import { ApiClient, ApiRequestError } from "../util/api.js";
+import { KeysLockedError } from "../crypto/masterKey.js";
+import { isOpenedRecord, isProtectedRecord } from "../zeroAccess/sealedRecords.js";
+import { followMeetingKeyExpiry } from "../videoconf/protectedMeetings.js";
+import { isSealedContentOpened, markSealedContentOpened } from "./protectedEvents.js";
 
 /** `client`, given by every function below, is an explicit `ApiClient` from `createApiClient()` (e.g. one
  * account of a multi-account app) to call instead of the default global `apiFetch()` - see `withClient()`'s
@@ -36,6 +41,24 @@ import { ApiClient } from "../util/api.js";
 
 const MS_PER_DAY = 24 * 60 * 60 * 1000;
 
+/** What `SealedOccurrenceError` says. */
+export const SEALED_OCCURRENCE_MESSAGE =
+    "This event came from an invitation to a zero-access mailbox, so one occurrence of it can't be changed on its own when it moves to another calendar or the server can't keep it protected. Change the entire series, or ask the organizer to.";
+
+/**
+ * One occurrence of an event made from an invitation that reached a zero-access mailbox (`sealedContent`) that `detachOccurrence()` can't
+ * split off without its content being stored readable: one moved to another calendar (restapi re-seals a detached occurrence's content
+ * only in the calendar of the series it belongs to; it refuses to move a sealed event for the same reason), or one a server stored
+ * unsealed (one from before restapi re-sealed such a create - the copy is deleted at once). An `ApiRequestError` (409), as
+ * `SealedMoveError` is, so the event dialog and the drag handler show its message.
+ */
+export class SealedOccurrenceError extends ApiRequestError {
+    constructor() {
+        super(SEALED_OCCURRENCE_MESSAGE, 409, "sealed-occurrence");
+        this.name = "SealedOccurrenceError";
+    }
+}
+
 function positiveModulo(value: number, modulus: number): number {
     return ((value % modulus) + modulus) % modulus;
 }
@@ -49,6 +72,7 @@ function addException(event: CalendarEvent, occurrenceStart: string, client?: Ap
             recurrenceRule: { ...rule, exceptions: [...rule.exceptions, occurrenceStart] },
         },
         client,
+        event,
     );
 }
 
@@ -84,7 +108,7 @@ export async function saveEventSeries(
     // master's existing (unchanged) instant onto a different wall clock, exactly as the doc comment above
     // promises - so all three fields, not just startDate, gate entry into the shift path below.
     if (fields.startDate === undefined && fields.timezone === undefined && fields.allDay === undefined) {
-        return updateCalendarEvent(update, client);
+        return updateCalendarEvent(update, client, occurrence);
     }
     const master = await getCalendarEvent(occurrence.uid, client);
     const newTimezone = fields.timezone ?? master.timezone;
@@ -93,7 +117,7 @@ export async function saveEventSeries(
     const newStartInstant = Date.parse(fields.startDate ?? master.startDate);
     const deltaWallMs = toEventWallClock(newStartInstant, newTimezone, newAllDay) - oldStartWall;
     if (deltaWallMs === 0 && newTimezone === master.timezone && newAllDay === master.allDay) {
-        return updateCalendarEvent(update, client);
+        return updateCalendarEvent(update, client, occurrence);
     }
     // An occurrence is identified by its nominal wall-clock start (the rule's date + the master's time of day),
     // not by the instant's own wall time: one that fell in a DST gap was pushed forward (02:30 -> 03:30 EDT),
@@ -112,7 +136,7 @@ export async function saveEventSeries(
     if (rule) {
         update.recurrenceRule = { ...rule, exceptions: rule.exceptions.map(shift) };
     }
-    const saved = await updateCalendarEvent(update, client);
+    const saved = await updateCalendarEvent(update, client, occurrence);
 
     let detachedOccurrenceSyncFailed = false;
     try {
@@ -126,6 +150,7 @@ export async function saveEventSeries(
                 await updateCalendarEvent(
                     { uid: event.uid, version: event.version, recurrenceId: shift(event.recurrenceId!) } as UpdateCalendarEventInput,
                     client,
+                    event,
                 );
             } catch {
                 detachedOccurrenceSyncFailed = true;
@@ -148,12 +173,34 @@ export async function saveEventSeries(
  * original start as its `recurrenceId` (the RFC5545 way of identifying a modified instance), and never
  * carries the series' `recurrenceRule` — even if `fields` includes one (e.g. the event modal's full
  * field set).
+ *
+ * A protected occurrence (zero-access) is copied from its opened content: one that can't be opened here - its mailbox is locked - holds
+ * only placeholders, which the new event would store as its real title, location and description. It throws `KeysLockedError` instead,
+ * before anything is written. One of an event made from a zero-access invitation (`sealedContent`) is sent opened too: restapi's create
+ * seals it again to the series' key (`prepareCreate()` finds the series by `icalUid` in the same mailbox), storing only placeholders, and
+ * the event returned is marked opened with the content sent. Moved to another calendar it throws `SealedOccurrenceError` before anything
+ * is sent (the series isn't there to seal it to), and a copy the server returns unsealed is deleted and refused the same way.
  */
 export async function detachOccurrence(
     occurrence: CalendarOccurrence,
     fields: Partial<CalendarEventInput>,
     client?: ApiClient,
 ): Promise<CalendarEvent> {
+    occurrence = await fullyOpenedEvent(occurrence);
+    // Nor one of an event made from an invitation to a zero-access mailbox (`sealedContent`) whose content wasn't opened - asked of the
+    // mark, not of its title: an untitled one opens to an empty title, and a title can be anything.
+    if ((isProtectedRecord(occurrence) && !isOpenedRecord(occurrence)) || (occurrence.sealedContent && !isSealedContentOpened(occurrence))) {
+        throw new KeysLockedError("This event is protected and your mailbox is locked. Unlock it to change one occurrence of the event.");
+    }
+    const sealedContent: boolean = !!occurrence.sealedContent;
+    // Sealed again only in the series' own calendar (see `SealedOccurrenceError`).
+    if (
+        sealedContent &&
+        ((fields.mailboxUid !== undefined && fields.mailboxUid !== occurrence.mailboxUid) ||
+            (fields.folderUid !== undefined && fields.folderUid !== occurrence.folderUid))
+    ) {
+        throw new SealedOccurrenceError();
+    }
     const originalStart = occurrence.recurrenceId!;
     // `icalUid`/`recurrenceId` aren't part of `CalendarEventInput`, but `@rapidmx/restapi`'s
     // `CalendarEvent` model accepts both on create (and `createCalendarEvent` already sends `icalUid`).
@@ -186,13 +233,27 @@ export async function detachOccurrence(
         recurrenceId: originalStart,
     };
     const created = await createCalendarEvent(input, client);
+    if (sealedContent && !created.sealedContent) {
+        // A server that stored the opened content readable: taken back at once, and the occurrence left as it was.
+        await deleteCalendarEvent(created.uid, created.version, client).catch(() => undefined);
+        throw new SealedOccurrenceError();
+    }
     try {
         await addException(occurrence, originalStart, client);
     } catch (err) {
         await deleteCalendarEvent(created.uid, created.version, client).catch(() => undefined);
         throw err;
     }
-    return created;
+    // Stored with placeholders: shown with the content it was given, as an opened event.
+    return sealedContent
+        ? markSealedContentOpened({
+              ...created,
+              title: input.title,
+              location: input.location,
+              description: input.description ?? null,
+              descriptionHtml: input.descriptionHtml ?? null,
+          })
+        : created;
 }
 
 /** Deletes an entire recurring series (or a genuinely non-recurring event) outright. */
@@ -211,14 +272,22 @@ export function deleteEventOccurrence(occurrence: CalendarOccurrence, client?: A
  * drag behavior, which never silently reschedules an entire series from a single dragged instance;
  * moving the whole series is only ever done explicitly, via the event modal's "entire series" option.
  */
+/** Saves new times of non-recurring `occurrence`, then moves its video meeting's key expiry to follow the new end: a protected meeting's key is
+ * discarded an hour after the end it was made for, so a meeting dragged later couldn't be joined. Best effort - it never fails the move. */
+async function reschedule(occurrence: CalendarOccurrence, times: { startDate?: string; endDate: string }, client: ApiClient | undefined): Promise<CalendarEvent> {
+    const saved = await updateCalendarEvent({ uid: occurrence.uid, version: occurrence.version, ...times }, client, occurrence);
+    if (saved.videoMeetingUid) {
+        await followMeetingKeyExpiry(saved.videoMeetingUid, seriesEndDate(saved), client);
+    }
+    return saved;
+}
+
 export function moveOccurrence(occurrence: CalendarOccurrence, deltaMs: number, client?: ApiClient): Promise<CalendarEvent> {
     const fields = {
         startDate: new Date(new Date(occurrence.startDate).getTime() + deltaMs).toISOString(),
         endDate: new Date(new Date(occurrence.endDate).getTime() + deltaMs).toISOString(),
     };
-    return occurrence.isRecurringOccurrence
-        ? detachOccurrence(occurrence, fields, client)
-        : updateCalendarEvent({ uid: occurrence.uid, version: occurrence.version, ...fields }, client);
+    return occurrence.isRecurringOccurrence ? detachOccurrence(occurrence, fields, client) : reschedule(occurrence, fields, client);
 }
 
 /**
@@ -230,7 +299,5 @@ export function resizeOccurrenceEnd(occurrence: CalendarOccurrence, newEndDate:
     const start = new Date(occurrence.startDate);
     const minEnd = new Date(start.getTime() + 15 * 60_000);
     const endDate = (newEndDate.getTime() > minEnd.getTime() ? newEndDate : minEnd).toISOString();
-    return occurrence.isRecurringOccurrence
-        ? detachOccurrence(occurrence, { endDate }, client)
-        : updateCalendarEvent({ uid: occurrence.uid, version: occurrence.version, endDate }, client);
+    return occurrence.isRecurringOccurrence ? detachOccurrence(occurrence, { endDate }, client) : reschedule(occurrence, { endDate }, client);
 }

package/lib/calendar/inviteApi.ts

@@ -9,7 +9,11 @@
  * it now stands, ready to draw. */
 
 import { ApiClient, ApiRequestError, withClient } from "../util/api.js";
-import type { EventVisibility, GuestPermissions } from "./calendarApi.js";
+import { followMeetingKeyExpiry, meetingLinkSecrets } from "../videoconf/protectedMeetings.js";
+import { isProtectedRecord } from "../zeroAccess/sealedRecords.js";
+import { type CalendarEvent, type EventVisibility, type GuestPermissions, getCalendarEvent } from "./calendarApi.js";
+import { type InvitationContent, invitationContentOf } from "./protectedEvents.js";
+import { seriesEndDate } from "./recurrence.js";
 import { sealedInviteCalendar } from "./sealedInvites.js";
 
 /** The calendar file to send for `messageUid` - a zero-access message this device decrypted (`sealedInvites.ts`) - as the request body's
@@ -167,11 +171,77 @@ export function proposeNewTime(messageUid: string, proposal: ProposedTime, clien
     });
 }
 
-/** Accepts an attendee's proposed time (a `COUNTER`) for a meeting the reader organizes: the server moves the event and sends the attendees the update. Resolves with the invitation as it now stands. */
-export function acceptProposal(messageUid: string, client?: ApiClient): Promise<MessageInvite> {
+/** Opens an event's `sealedContent` with the mailbox's unlocked keys (`apps/shared/calendar/sealedEvents.ts` `openSealedEvent()`), marking it
+ * opened, or returns it as it is when it can't. */
+export type SealedContentOpener = (event: CalendarEvent) => Promise<CalendarEvent>;
+
+/** What `acceptProposal()` refuses with, before sending anything, for a protected meeting this device can't open (its mailbox is locked). */
+export const PROTECTED_PROPOSAL_MESSAGE = "This meeting is protected. Unlock your mailbox to accept the proposed time, so its guests can be sent the new time.";
+
+/**
+ * What the server needs to send the moved meeting's invitations itself (`invitationContent`): for a meeting of a protected calendar
+ * (`sealedFields`), or made from a zero-access invitation (`sealedContent`, opened with `openSealedContent`), its real title, location and
+ * description, and for a meeting protected by a per-meeting key every guest's link key
+ * (`meetingLinkSecrets`) - with the event as read. No content for a meeting that needs neither (the server's scheduling job invites for it),
+ * and nothing at all for one that isn't on the calendar or can't be read. A protected meeting this device can't open is refused (`PROTECTED_PROPOSAL_MESSAGE`) rather than left to the server's 400.
+ */
+async function proposalInvitations(
+    calendarEventUid: string | undefined,
+    client: ApiClient | undefined,
+    openSealedContent: SealedContentOpener | undefined,
+): Promise<{ event?: CalendarEvent; invitationContent?: Partial<InvitationContent> & { meetingLinkSecrets?: Record<string, string> } }> {
+    if (!calendarEventUid) {
+        return {};
+    }
+    let event: CalendarEvent;
+    try {
+        event = await getCalendarEvent(calendarEventUid, client);
+    } catch {
+        // Unreadable here: the server, which reads it, decides whether the proposal can be accepted without them.
+        return {};
+    }
+    // A meeting made from a zero-access invitation keeps its content sealed whole (`sealedContent`), which `getCalendarEvent()` doesn't
+    // open: opened here, it is invited for with its real title, location and description.
+    if (event.sealedContent && openSealedContent) {
+        event = await openSealedContent(event);
+    }
+    const content = invitationContentOf(event);
+    if ((isProtectedRecord(event) || event.sealedContent) && !content && (event as { encryptionOrigin?: string }).encryptionOrigin !== "originated") {
+        throw new ApiRequestError(PROTECTED_PROPOSAL_MESSAGE, 400);
+    }
+    const secrets = await meetingLinkSecrets({ videoMeetingUid: event.videoMeetingUid, attendees: event.attendees, organizer: event.organizer }, client);
+    if (!content && !secrets) {
+        return { event };
+    }
+    return { event, invitationContent: { ...(content ?? {}), ...(secrets ? { meetingLinkSecrets: secrets } : {}) } };
+}
+
+/**
+ * Accepts an attendee's proposed time (a `COUNTER`) for a meeting the reader organizes (`calendarEventUid`, the invitation's
+ * `calendarEventUid`): the server moves the event and sends the attendees the update. For a protected meeting - of a calendar zero-access
+ * encryption protects, or with a per-meeting key - the server can't compose the invitations by itself: this sends the decrypted title,
+ * location and description and the guests' link keys with it (`invitationContent`). Without them (the mailbox locked, or the meeting's key
+ * doesn't open here) the server answers 400 and nothing moves. A meeting made from a zero-access invitation (`sealedContent`) is opened
+ * with `openSealedContent` (the app passes `openSealedEvent()`); one that can't be is refused before anything is sent. A meeting with a
+ * video meeting has its key expiry moved to follow the new time (`followMeetingKeyExpiry()`, best effort). Resolves with the invitation as
+ * it now stands.
+ */
+export async function acceptProposal(
+    messageUid: string,
+    client?: ApiClient,
+    calendarEventUid?: string,
+    openSealedContent?: SealedContentOpener,
+): Promise<MessageInvite> {
     const source = sealedSource(messageUid);
-    return withClient(client, `/mail/calendar-events/invite/${encodeURIComponent(messageUid)}/accept-proposal`, {
+    const { event, invitationContent } = await proposalInvitations(calendarEventUid, client, openSealedContent);
+    const body = { ...source, ...(invitationContent ? { invitationContent } : {}) };
+    const accepted = await withClient<MessageInvite>(client, `/mail/calendar-events/invite/${encodeURIComponent(messageUid)}/accept-proposal`, {
         method: "POST",
-        ...(source.ics !== undefined ? { body: JSON.stringify(source) } : {}),
+        ...(Object.keys(body).length > 0 ? { body: JSON.stringify(body) } : {}),
     });
+    // A `COUNTER`'s `startDate`/`endDate` are the proposed time, which the meeting now has.
+    if (event?.videoMeetingUid && accepted.startDate && accepted.endDate) {
+        await followMeetingKeyExpiry(event.videoMeetingUid, seriesEndDate({ ...event, startDate: accepted.startDate, endDate: accepted.endDate }), client);
+    }
+    return accepted;
 }

package/lib/calendar/protectedEvents.ts

@@ -0,0 +1,143 @@
+///////////////////////////////////////////////////////////////////////////////
+// Copyright (C) 2026 Jean-Philippe Steinmetz
+// SPDX-License-Identifier: MPL-2.0
+///////////////////////////////////////////////////////////////////////////////
+/**
+ * Writes to an event of a calendar zero-access encryption protects (restapi `specs/search.md` §3 *What It Covers*, *Calendar invitations*).
+ * The server stores its title, location and description sealed, with placeholders in their place, so it can't tell what changed or invite
+ * with them by itself. A write therefore sends only the content fields that differ from what this device shows, and - when the event was
+ * opened here - the whole content as `invitationContent`, which the server invites with and never stores. A content field of an opened
+ * event that held a value and is emptied is named in `clearedFields`, the only way restapi applies an empty sealed field as a clear.
+ */
+import type { CalendarEvent } from "./calendarApi.js";
+import { isOpenedRecord, isProtectedRecord } from "../zeroAccess/sealedRecords.js";
+import { KeysLockedError } from "../crypto/masterKey.js";
+
+/** The fields zero-access encryption seals on an event. */
+export const EVENT_CONTENT_FIELDS = ["title", "location", "description", "descriptionHtml"] as const;
+
+/** What the server composes a protected event's invitations with. */
+export interface InvitationContent {
+    title: string;
+    location?: string;
+    description?: string;
+    descriptionHtml?: string;
+}
+
+const text = (value: unknown): string => (typeof value === "string" ? value : "");
+
+/** Set on an event made from a zero-access invitation (`sealedContent`) whose sealed content was opened on this device
+ * (`apps/shared/calendar/sealedEvents.ts`). A symbol, so it survives a spread copy (an occurrence) and is never sent. */
+const CONTENT_OPENED = Symbol("openedSealedContent");
+
+/** `event` marked as holding its opened `sealedContent` (its real title, location and description). */
+export function markSealedContentOpened<T extends CalendarEvent>(event: T): T {
+    return { ...event, [CONTENT_OPENED]: true };
+}
+
+/** Whether `event`'s `sealedContent` was opened on this device: its title, location and description are the real ones. */
+export function isSealedContentOpened(event: CalendarEvent | undefined): boolean {
+    return !!event && (event as any)[CONTENT_OPENED] === true;
+}
+
+/** Whether `event` shows its real content: nothing of it is sealed, or every sealed part (`sealedFields`, `sealedContent`) was opened. */
+function shownOpened(event: CalendarEvent): boolean {
+    return (!isProtectedRecord(event) || isOpenedRecord(event)) && (!event.sealedContent || isSealedContentOpened(event));
+}
+
+/** `current`'s content with `changes` applied, for the server to invite (or name a reply or change request) with - `undefined` unless
+ * `current` is protected (`sealedFields`) or made from a zero-access invitation (`sealedContent`) and was opened on this device (its values
+ * are otherwise placeholders). */
+export function invitationContentOf(current: CalendarEvent | undefined, changes: Record<string, unknown> = {}): InvitationContent | undefined {
+    if (!current || !(isProtectedRecord(current) || current.sealedContent) || !shownOpened(current)) {
+        return undefined;
+    }
+    const value = (field: (typeof EVENT_CONTENT_FIELDS)[number]): string => text(field in changes ? changes[field] : current[field]);
+    const title = value("title");
+    if (!title) {
+        return undefined;
+    }
+    const optional = (field: (typeof EVENT_CONTENT_FIELDS)[number]): string | undefined => value(field) || undefined;
+    return { title, location: optional("location"), description: optional("description"), descriptionHtml: optional("descriptionHtml") };
+}
+
+/**
+ * `input` as written to `current`: unchanged when `current` isn't protected. Otherwise without the content fields whose values `current`
+ * already shows (a placeholder is "unchanged" too, so a locked device's write never overwrites the sealed value), and with
+ * `invitationContent` when `current` was opened - and `clearedFields` naming the sealed ones it empties.
+ */
+export function protectedEventWrite<T extends object>(current: CalendarEvent | undefined, input: T): T {
+    if (current?.sealedContent) {
+        return sealedContentWrite(current, input);
+    }
+    if (!isProtectedRecord(current)) {
+        return input;
+    }
+    const changes: Record<string, unknown> = { ...(input as Record<string, unknown>) };
+    const clearedFields: string[] = [];
+    for (const field of EVENT_CONTENT_FIELDS) {
+        if (!(field in changes)) {
+            continue;
+        }
+        if (text(changes[field]) === text(current![field])) {
+            delete changes[field];
+        } else if (!text(changes[field]) && current!.sealedFields![field] !== undefined && isOpenedRecord(current)) {
+            clearedFields.push(field);
+        }
+    }
+    if (clearedFields.length > 0) {
+        changes.clearedFields = clearedFields;
+    }
+    const invitationContent = invitationContentOf(current, changes);
+    return (invitationContent ? { ...changes, invitationContent } : changes) as T;
+}
+
+/**
+ * `input` as written to `current`, an event made from a zero-access invitation (`sealedContent`). restapi seals its whole content again
+ * from the content fields a write sends (`BaseCalendarEventRoute.keepSealed()`), dropping one the write leaves out, since it can't read the
+ * sealed value to keep it. So a write that sends any of them sends them all: those it leaves out (the event dialog sends an unchanged
+ * description not at all) are filled in with what `current` shows opened - the description and its HTML as one, as the dialog sends them.
+ * This holds too for a row that also keeps its title sealed field by field (`sealedFields.title`), whose sealed content's title is empty.
+ * Shown with placeholders (its mailbox is locked), the placeholders it would send back are left out, so nothing is sealed again, and a
+ * changed content field is refused (`KeysLockedError`) before anything is sent: the rest of the content can't be sent with it. Opened, a
+ * write whose location, description or description HTML differs from the one shown raises `sequence` past `current`'s, the only way
+ * restapi learns it changed.
+ */
+function sealedContentWrite<T extends object>(current: CalendarEvent, input: T): T {
+    const given = input as Record<string, unknown>;
+    if (!EVENT_CONTENT_FIELDS.some((field) => given[field] !== undefined)) {
+        return input;
+    }
+    const changes: Record<string, unknown> = { ...given };
+    if (!shownOpened(current)) {
+        for (const field of EVENT_CONTENT_FIELDS) {
+            if (field in changes && text(changes[field]) === text(current[field])) {
+                delete changes[field];
+            }
+        }
+        if (EVENT_CONTENT_FIELDS.some((field) => changes[field] !== undefined)) {
+            throw new KeysLockedError("This event is protected and your mailbox is locked. Unlock it to change its title, location or description.");
+        }
+        return changes as T;
+    }
+    for (const field of ["title", "location"] as const) {
+        if (changes[field] === undefined) {
+            changes[field] = current[field] ?? null;
+        }
+    }
+    if (changes.description === undefined && changes.descriptionHtml === undefined) {
+        changes.description = current.description ?? null;
+        changes.descriptionHtml = current.descriptionHtml ?? null;
+    }
+    // restapi can't compare a location or description sealed whole (it holds placeholders), so a real change raises the sequence here: an
+    // organizer-owned meeting then invites again, as for a readable event's new location or description. A description field the write
+    // doesn't send is compared no more than restapi compares it for a readable event. An unchanged one leaves it alone.
+    const descriptionChanged = (["description", "descriptionHtml"] as const).some(
+        (field) => changes[field] !== undefined && text(changes[field]) !== text(current[field])
+    );
+    if (descriptionChanged || text(changes.location) !== text(current.location)) {
+        changes.sequence = (current.sequence ?? 0) + 1;
+    }
+    const invitationContent = isProtectedRecord(current) ? invitationContentOf(current, changes) : undefined;
+    return (invitationContent ? { ...changes, invitationContent } : changes) as T;
+}

package/lib/calendar/recurrence.ts

@@ -334,3 +334,20 @@ export const WEEKDAY_LABELS: Record<WeekdayCode, string> = {
     SA: "Sat",
     SU: "Sun",
 };
+
+/** When `event`'s last occurrence ends: its own end, or a series' last occurrence's - far ahead for a series without an end. */
+export function seriesEndDate(event: CalendarEvent): Date {
+    const rule = event.recurrenceRule;
+    const end = new Date(event.endDate);
+    if (!rule) {
+        return end;
+    }
+    if (!rule.until && !rule.count) {
+        return new Date(8.64e15);
+    }
+    const duration = end.valueOf() - new Date(event.startDate).valueOf();
+    const horizon = new Date(rule.until ? new Date(rule.until).valueOf() + 86_400_000 : Date.now() + 5 * 365 * 86_400_000);
+    const occurrences = expandOccurrences(event, new Date(event.startDate), horizon);
+    const last = occurrences[occurrences.length - 1];
+    return last ? new Date(new Date(last.startDate).valueOf() + duration) : end;
+}

package/lib/calendar/sealedInvites.ts

@@ -5,26 +5,66 @@
 /**
  * The calendar files of zero-access messages, as decrypted on this device (`MessageSecurityResult.calendar`). The server holds only
  * the sealed copy of such a message, so every invitation call for it (`inviteApi.ts`) sends the file along. Kept in memory for the
- * messages read most recently, and cleared on sign-out (`clearSealedInvites()`).
+ * messages read most recently, only while their mailbox is unlocked: its lock forgets them (telling `onSealedInvitesForgotten()`
+ * listeners, so what was read with them goes too), and so does sign-out (`clearSealedInvites()`).
  */
+import { getUnlockedKeys, subscribeKeySession } from "../crypto/keySession.js";
 
 /** How many messages' calendar files are kept. */
 const MAX_SEALED_INVITES = 100;
 
-const calendars: Map<string, string> = new Map();
+const calendars: Map<string, { mailboxUid: string; ics: string }> = new Map();
+const forgottenListeners = new Set<(messageUids: string[]) => void>();
 
-/** Remembers the decrypted calendar file of zero-access message `messageUid`. */
-export function rememberSealedInvite(messageUid: string, ics: string): void {
+let watchingKeys = false;
+
+/** A mailbox's files go the moment it locks, so nothing opened outlives its key session. Subscribed on the first file, not on import. */
+function forgetOnLock(): void {
+    if (watchingKeys) {
+        return;
+    }
+    watchingKeys = true;
+    subscribeKeySession(({ mailboxUid, state }) => {
+        if (state !== "locked") {
+            return;
+        }
+        const forgotten: string[] = [];
+        for (const [messageUid, entry] of calendars) {
+            if (entry.mailboxUid === mailboxUid) {
+                calendars.delete(messageUid);
+                forgotten.push(messageUid);
+            }
+        }
+        if (forgotten.length) {
+            forgottenListeners.forEach((listener) => listener(forgotten));
+        }
+    });
+}
+
+/** Remembers the decrypted calendar file of zero-access message `messageUid` of `mailboxUid` - not while that mailbox is locked (a
+ * pane still drawing what it decrypted before the lock). */
+export function rememberSealedInvite(messageUid: string, ics: string, mailboxUid: string): void {
+    if (!getUnlockedKeys(mailboxUid)) {
+        return;
+    }
+    forgetOnLock();
     calendars.delete(messageUid);
-    calendars.set(messageUid, ics);
+    calendars.set(messageUid, { mailboxUid, ics });
     while (calendars.size > MAX_SEALED_INVITES) {
         calendars.delete(calendars.keys().next().value!);
     }
 }
 
-/** The decrypted calendar file of zero-access message `messageUid`, when this device has read it. */
+/** The decrypted calendar file of zero-access message `messageUid`, when this device has read it and its mailbox is unlocked. */
 export function sealedInviteCalendar(messageUid: string): string | undefined {
-    return calendars.get(messageUid);
+    const entry = calendars.get(messageUid);
+    return entry && getUnlockedKeys(entry.mailboxUid) ? entry.ics : undefined;
+}
+
+/** Calls `listener` with the messages whose files a mailbox's lock forgot. Returns the unsubscribe. */
+export function onSealedInvitesForgotten(listener: (messageUids: string[]) => void): () => void {
+    forgottenListeners.add(listener);
+    return () => forgottenListeners.delete(listener);
 }
 
 /** Forgets every remembered calendar file (sign-out). */

package/lib/contacts/contactsApi.ts

@@ -5,16 +5,10 @@
 /** Typed wrappers over `@rapidmx/restapi`'s `/mail/contacts` REST surface — see `mailApi.ts`'s own header
  * comment for the shared ACL/authorization model every wrapper file here follows. */
 
-import { ApiClient, apiUrl, withClient, withClientRaw } from "../util/api.js";
+import { ApiClient, apiUrl, withClient, withClientBlob, withClientRaw } from "../util/api.js";
 import { ListParams, SETTINGS_LIST_LIMIT, buildQuery } from "../util/apiQuery.js";
-import {
-    type EncryptionPreference,
-    type KeyConflict,
-    type PreviousKey,
-    type PublicKey,
-    type RejectedKey,
-    signingKeyFingerprints,
-} from "../crypto/keyvaultApi.js";
+import { guardSealedMove } from "../zeroAccess/sealedMoves.js";
+import { type EncryptionPreference, type EndToEndFormat, type KeyConflict, type PreviousKey, type PublicKey, type RejectedKey, signingKeyFingerprints, isOpenPgpKey, isTrustedForVerification } from "../crypto/keyvaultApi.js";
 
 export type ContactAddressKind = "home" | "work" | "other";
 
@@ -68,6 +62,15 @@ export interface Contact {
      * via `crypto/keyvaultApi.ts`'s `lookupKeys()` at compose time, never fetched on message receipt
      * (that would leak read timing to the sender's server). */
     encryptPreference?: EncryptionPreference;
+    /** The protected details sealed to the mailbox's zero-access key while it protects contacts (`displayName` then shows the first email
+     * address, the other protected fields are empty) - opened with `openSealedRecords()`. Server-written. */
+    sealedFields?: Record<string, string> | null;
+    /** The photo (`photoBlobKey`) is sealed to the mailbox's zero-access key: it is fetched and opened, never shown by URL. Server-written. */
+    photoSealed?: boolean | null;
+    /** The end-to-end format the user chose for this contact ("Preferred format"); absent or null for automatic. */
+    preferredFormat?: EndToEndFormat | null;
+    /** The format this address was last seen using, from authenticated mail it sent (server-written). */
+    observedFormat?: { format: EndToEndFormat; at: number } | null;
     /** This contact's pinned public keys. Trust is TOFU (trust-on-first-use) — see `keyConflicts` for what
      * happens when a newly observed key differs from one of these. */
     keys?: PublicKey[];
@@ -89,6 +92,13 @@ const CONTACT_SORT = JSON.stringify({ displayName: "ASC", uid: "ASC" });
 
 /** Lists a folder's contacts, alphabetically by display name. Never includes soft-deleted contacts — see
  * `listDeletedContacts()` for those. */
+/** The protected contact fields a list of contacts shows - all a list opens (`openSealedRecords(contacts, CONTACT_LIST_FIELDS)`); a view of
+ * one contact opens the rest. */
+export const CONTACT_LIST_FIELDS: readonly string[] = ["displayName", "phones", "categories"];
+
+/** The protected fields a duplicate check compares (an address-less card is matched by name and phone). */
+export const CONTACT_MATCH_FIELDS: readonly string[] = ["displayName", "phones"];
+
 export function listContacts(folderUid: string, params: ListParams = {}, client?: ApiClient): Promise<Contact[]> {
     return withClient(client, `/mail/contacts?${buildQuery(params, { folderUid, sort: CONTACT_SORT })}`);
 }
@@ -106,6 +116,14 @@ export function pinnedSigningFingerprintsFor(contacts: Contact[], address: strin
     return [...new Set(contactsMatching(contacts, address).flatMap((contact) => signingKeyFingerprints(contact.keys, contact.previousKeys)))];
 }
 
+/** The OpenPGP certificates (base64, `PublicKey.publicKey`) pinned on every contact in `contacts` for `address` - current and
+ * previous ones still trusted for verification (`isTrustedForVerification()`) - which an OpenPGP signature from that sender is
+ * checked against (an OpenPGP signature carries only a key ID, so the key itself is needed). De-duplicated by fingerprint. */
+export function pinnedOpenPgpKeysFor(contacts: Contact[], address: string): string[] {
+    const keys = contactsMatching(contacts, address).flatMap((contact) => [...(contact.keys ?? []), ...(contact.previousKeys ?? [])]);
+    return uniqueByFingerprint(keys.filter((key) => isOpenPgpKey(key) && isTrustedForVerification(key))).map((key) => key.publicKey);
+}
+
 /** Page size and page cap for `fetchPinnedSigningFingerprints()` and `fetchSignerKeyState()` (500 is restapi's own
  * `limit` cap). */
 export const PINNED_FINGERPRINT_PAGE_SIZE = 500;
@@ -149,6 +167,9 @@ export interface SignerKeyState {
     previous: PreviousKey[];
     /** The first unresolved signing-key conflict found, if any. */
     conflict?: KeyConflict;
+    /** The pinned OpenPGP certificates (which sign as well as encrypt), de-duplicated by fingerprint - what an OpenPGP signer's
+     * key-changed comparison shows. Absent when there are none. */
+    openPgp?: PublicKey[];
 }
 
 function uniqueByFingerprint<T extends PublicKey>(keys: T[]): T[] {
@@ -174,7 +195,8 @@ export function signerKeyStateFor(contacts: Contact[], address: string): SignerK
         matching.flatMap((contact) => (contact.previousKeys ?? []).filter((key) => key.useType === "sign")).sort((a, b) => b.replacedAt - a.replacedAt),
     );
     const conflict = matching.flatMap((contact) => contact.keyConflicts ?? []).find((entry) => entry.useType === "sign");
-    return { pinned, previous, ...(conflict ? { conflict } : {}) };
+    const openPgp = uniqueByFingerprint(matching.flatMap((contact) => (contact.keys ?? []).filter((key) => isOpenPgpKey(key))));
+    return { pinned, previous, ...(conflict ? { conflict } : {}), ...(openPgp.length > 0 ? { openPgp } : {}) };
 }
 
 /** Fetches `signerKeyStateFor()` for `address` from the contacts in `folderUids`, paging exactly like
@@ -258,11 +280,15 @@ export interface UpdateContactInput extends ContactInput {
  * fetched `Contact`. An `UpdateContactInput` is also a valid `ContactPatch`. */
 export type ContactPatch = Partial<Contact> & Pick<Contact, "uid" | "version">;
 
-export function updateContact(patch: ContactPatch, client?: ApiClient): Promise<Contact> {
-    return withClient(client, `/mail/contacts/${encodeURIComponent(patch.uid)}`, {
-        method: "PUT",
-        body: JSON.stringify(patch),
-    });
+/** Saves `patch`. A patch moving the contact to another mailbox (`mailboxUid`) is refused with `SealedMoveError` when the contact is
+ * protected - before sending anything when `current` (the contact as this device has it) says so, else from the server's refusal. */
+export function updateContact(patch: ContactPatch, client?: ApiClient, current?: Contact): Promise<Contact> {
+    return guardSealedMove(current, patch.mailboxUid, () =>
+        withClient<Contact>(client, `/mail/contacts/${encodeURIComponent(patch.uid)}`, {
+            method: "PUT",
+            body: JSON.stringify(patch),
+        }),
+    );
 }
 
 /** Thin `updateContact()` wrapper for toggling favorite/star status — same pattern as `mailApi.ts`'s
@@ -291,8 +317,8 @@ export function uploadContactPhoto(uid: string, version: number, file: Blob, cli
 }
 
 /** The bytes of a contact's own picture through an explicit `client` - for one that authenticates with a token, whose `<img>` cannot (see `contactPhotoUrl()`). */
-export function fetchContactPhoto(uid: string, version: number, client: ApiClient): Promise<Blob> {
-    return client.fetchBlob(`/mail/contacts/${encodeURIComponent(uid)}/photo?v=${version}`);
+export function fetchContactPhoto(uid: string, version: number, client?: ApiClient): Promise<Blob> {
+    return withClientBlob(client, `/mail/contacts/${encodeURIComponent(uid)}/photo?v=${version}`, "Could not load the contact's picture.");
 }
 
 /** Removes a contact's own picture and returns the updated contact. */