@rapidmx/web-client 0.36.0 → 0.37.0

package/lib/crypto/sharedMailboxKeys.ts

@@ -32,8 +32,10 @@ import {
     type ZeroAccessEscrowWrapInput,
     type ZeroAccessKey,
 } from "./keyvaultApi.js";
+import { certificateHoldsKey } from "./keyPairMatch.js";
 import { exportPrivateKeyPkcs8, generateKeyPairWithCsr, importPrivateKeyPkcs8 } from "./keys.js";
 import {
+    addZeroAccessKey,
     getUnlockedKeys,
     installSharedSession,
     personalSessions,
@@ -106,9 +108,13 @@ function keyOrder(status: Pick<SharedKeyStatus, "activeKeyFingerprint" | "zeroAc
 /**
  * Opens shared mailbox `mailboxUid` for its member, with no password: their member wraps, opened with the zero-access keys of a mailbox they
  * own and have unlocked, become this session's keys for it (`installSharedSession()`). See `SharedUnlockOutcome` for when it can't.
+ *
+ * `refresh`: a shared session already open is opened again when it lacks the mailbox's active key and the member now holds a wrap of it -
+ * after a rotation, new mail is sealed to a key the session doesn't have. Its `masterKey` secret is kept, so the local index stays readable.
  */
-export async function unlockSharedMailbox(mailboxUid: string, client?: ApiClient): Promise<SharedUnlockOutcome> {
-    if (getUnlockedKeys(mailboxUid)) {
+export async function unlockSharedMailbox(mailboxUid: string, client?: ApiClient, refresh = false): Promise<SharedUnlockOutcome> {
+    const existing: UnlockedKeys | undefined = getUnlockedKeys(mailboxUid);
+    if (existing && !(refresh && existing.shared)) {
         return "unlocked";
     }
     const generation: string = sharedUnlockGeneration(mailboxUid);
@@ -117,14 +123,22 @@ export async function unlockSharedMailbox(mailboxUid: string, client?: ApiClient
         status = await getSharedKeyStatus(mailboxUid, client);
     } catch (err) {
         if (err instanceof ApiRequestError && (err.status === 403 || err.status === 404)) {
-            return "not_shared";
+            return existing ? "unlocked" : "not_shared";
         }
         throw err;
     }
+    const holdsActive = (keys: { fingerprint: string }[] | undefined): boolean => !!keys?.some((key) => key.fingerprint === status.activeKeyFingerprint);
+    if (existing && (!status.activeKeyFingerprint || holdsActive(existing.zeroAccessKeys))) {
+        return "unlocked";
+    }
     if (status.role !== "member") {
-        return "not_shared";
+        return existing ? "unlocked" : "not_shared";
     }
     const wraps: MemberKeyWrap[] = await getMyMemberKeyWraps(mailboxUid, client);
+    // Nothing new to open yet: the active key's wrap is still on its way.
+    if (existing && !holdsActive(wraps.map((wrap) => ({ fingerprint: wrap.zeroAccessKeyFingerprint })))) {
+        return "unlocked";
+    }
     if (wraps.length === 0) {
         return "pending";
     }
@@ -141,18 +155,27 @@ export async function unlockSharedMailbox(mailboxUid: string, client?: ApiClient
         }
         const pkcs8 = unwrapped.pkcs8;
         try {
+            // The certificate is the server's: one that isn't this key's must never be what this session seals to.
+            if (!(await certificateHoldsKey(fromBase64(certificate.publicKey), pkcs8))) {
+                continue;
+            }
             secret ??= await sessionSecret(pkcs8);
             const privateKey = await importPrivateKeyPkcs8(pkcs8, { name: "ECDH", namedCurve: "P-256" }, ["deriveBits"]);
             opened.push({ fingerprint: wrap.zeroAccessKeyFingerprint, certDer: fromBase64(certificate.publicKey), privateKey });
             openedWith.add(unwrapped.openedWith);
         } catch {
-            // A wrap that doesn't hold a usable key is skipped; the others still open the mailbox.
+            // A wrap that doesn't hold a usable key (or one its certificate doesn't match) is skipped; the others still open the mailbox.
         } finally {
             pkcs8.fill(0);
         }
     }
     if (!secret || opened.length === 0) {
-        return "own_keys_locked";
+        return existing ? "unlocked" : "own_keys_locked";
+    }
+    if (existing) {
+        // Opened again: the secret the local index key is derived from stays the one the session started with.
+        secret.fill(0);
+        secret = new Uint8Array(existing.masterKey);
     }
     const unlocked: UnlockedKeys = { masterKey: secret, zeroAccessKeys: opened, openedWith: [...openedWith] };
     installSharedSession(mailboxUid, unlocked, generation);
@@ -160,7 +183,8 @@ export async function unlockSharedMailbox(mailboxUid: string, client?: ApiClient
 }
 
 /** The PKCS#8 of every zero-access key of `mailboxUid` the caller can open, by fingerprint - from the vault with the owner's unlocked master
- * key, or from the caller's own member wraps. The caller zeroes them. */
+ * key, or from the caller's own member wraps. Only keys whose certificate in `status` (the server's) is really theirs: a key is wrapped
+ * for members and escrow under that certificate's fingerprint, so a mismatched one is left out. The caller zeroes them. */
 async function openPrivateKeys(
     mailboxUid: string,
     status: SharedKeyStatus,
@@ -168,6 +192,14 @@ async function openPrivateKeys(
     client?: ApiClient,
 ): Promise<Map<string, Uint8Array>> {
     const keys = new Map<string, Uint8Array>();
+    const keep = async (fingerprint: string, pkcs8: Uint8Array): Promise<void> => {
+        const certificate = status.zeroAccessKeys.find((key) => key.fingerprint === fingerprint);
+        if (certificate && (await certificateHoldsKey(fromBase64(certificate.publicKey), pkcs8))) {
+            keys.set(fingerprint, pkcs8);
+        } else {
+            pkcs8.fill(0);
+        }
+    };
     if (ownerUnlocked) {
         const vault = await getKeyVault(mailboxUid, client);
         const aad = buildAad(mailboxUid, ZERO_ACCESS_PRIVATE_KEY_AAD_PURPOSE);
@@ -175,7 +207,7 @@ async function openPrivateKeys(
             const wrapped = vault.wrappedKeys.find((w) => w.fingerprint === key.fingerprint && w.useType === "zero-access");
             if (wrapped) {
                 try {
-                    keys.set(key.fingerprint, await openWithKey(ownerUnlocked.masterKey, wrapped, aad));
+                    await keep(key.fingerprint, await openWithKey(ownerUnlocked.masterKey, wrapped, aad));
                 } catch {
                     // Sealed under a master key since replaced: not this device's to share.
                 }
@@ -187,7 +219,7 @@ async function openPrivateKeys(
     for (const wrap of await getMyMemberKeyWraps(mailboxUid, client)) {
         const unwrapped = await openWrap(wrap, own);
         if (unwrapped) {
-            keys.set(wrap.zeroAccessKeyFingerprint, unwrapped.pkcs8);
+            await keep(wrap.zeroAccessKeyFingerprint, unwrapped.pkcs8);
         }
     }
     return keys;
@@ -201,9 +233,22 @@ async function wrapFor(member: { userUid: string; certificate: ZeroAccessKey },
     };
 }
 
-/** The members with a certificate of their own - the ones a key can be wrapped for. */
+/** The members with a certificate of their own - the ones a key can be wrapped for. A certificate listed under the fingerprint of one of
+ * this user's own opened zero-access keys must be that key's certificate (checked against its private key at unlock): one the server
+ * swapped is left out, so a wrap meant for this user never goes to a key that isn't theirs. */
 function wrappable(status: SharedKeyStatus): { userUid: string; certificate: ZeroAccessKey; wrapped: string[] }[] {
-    return status.members.filter((member): member is typeof member & { certificate: ZeroAccessKey } => !!member.certificate);
+    const own = ownZeroAccessKeys();
+    return status.members.filter((member): member is typeof member & { certificate: ZeroAccessKey } => {
+        if (!member.certificate) {
+            return false;
+        }
+        const mine = own.find((key) => key.fingerprint === member.certificate!.fingerprint);
+        return !mine || sameBytes(mine.certDer, fromBase64(member.certificate.publicKey));
+    });
+}
+
+function sameBytes(a: Uint8Array, b: Uint8Array): boolean {
+    return a.length === b.length && a.every((byte, index) => byte === b[index]);
 }
 
 /** `pkcs8` wrapped to the certificate of the escrow scope `escrow` describes. */
@@ -232,10 +277,17 @@ export interface SharedMaintenance {
     rotated: boolean;
     /** Wraps added for waiting members. */
     wrapped: number;
+    /** Wraps of older keys the server refused for waiting members (tried again on the next pass). */
+    refused: number;
     /** Departed users whose wraps were removed. */
     removed: number;
     /** Keys wrapped for the mailbox's escrow scope. */
     escrowed: number;
+    /**
+     * The server's reason when it refused (400) the new key of a pending rotation - e.g. the vault couldn't hold the new key's member wraps
+     * next to those it holds - so the current key stays active and members keep reading; the rotation is tried again on the next pass.
+     */
+    rotationRefused?: string;
 }
 
 /**
@@ -245,11 +297,13 @@ export interface SharedMaintenance {
  * A mailbox without an owner and without a key gets one (unless the administrator disallows zero-access), wrapped for every member who has a
  * certificate. Once a user who held the active key has left (`rotationPending`), a new key replaces it - enrolled by the owner with their
  * master key (`provisionZeroAccessKey()`), or for a mailbox without an owner with the members' wraps - and then the departed users' wraps
- * are removed. Members still waiting (`pending`) get wraps of every key this client can open, and the escrow scope of a mailbox without an
- * owner gets copies of the keys it is missing (`escrowPending`).
+ * are removed. Members still waiting (`pending`) get wraps of every key this client can open, one write per key with the active key's
+ * first (a refused older key doesn't stop the rest), and the escrow scope of a mailbox without an owner gets copies of the keys it is
+ * missing (`escrowPending`). A rotation the server refuses (400) is reported in `rotationRefused`, not thrown: the current key stays active
+ * and the rest of the pass goes ahead.
  */
 export async function maintainSharedMailbox(mailboxUid: string, mailboxAddress: string, client?: ApiClient): Promise<SharedMaintenance> {
-    const result: SharedMaintenance = { provisioned: false, rotated: false, wrapped: 0, removed: 0, escrowed: 0 };
+    const result: SharedMaintenance = { provisioned: false, rotated: false, wrapped: 0, refused: 0, removed: 0, escrowed: 0 };
     let status: SharedKeyStatus = await getSharedKeyStatus(mailboxUid, client);
     if (!status.manager || (status.members.length === 0 && status.departed.length === 0)) {
         return result;
@@ -267,14 +321,25 @@ export async function maintainSharedMailbox(mailboxUid: string, mailboxAddress:
         status = await enrollNewSharedKey(mailboxUid, mailboxAddress, status, client);
         result.provisioned = true;
     } else if (status.rotationPending) {
-        if (status.ownerless) {
-            status = await enrollNewSharedKey(mailboxUid, mailboxAddress, status, client);
-        } else {
-            const vault = await getKeyVault(mailboxUid, client);
-            await provisionZeroAccessKey(mailboxUid, mailboxAddress, ownerUnlocked!.masterKey, vault.masterKeyGeneration, client);
-            status = await getSharedKeyStatus(mailboxUid, client);
+        try {
+            if (status.ownerless) {
+                status = await enrollNewSharedKey(mailboxUid, mailboxAddress, status, client);
+            } else {
+                const vault = await getKeyVault(mailboxUid, client);
+                const { key } = await provisionZeroAccessKey(mailboxUid, mailboxAddress, ownerUnlocked!.masterKey, vault.masterKeyGeneration, client);
+                // The owner's open session gets the new key as its active one, as `ensureZeroAccessKey()` does: new mail is sealed to it.
+                addZeroAccessKey(mailboxUid, ownerUnlocked!, key);
+                status = await getSharedKeyStatus(mailboxUid, client);
+            }
+            result.rotated = true;
+        } catch (err) {
+            // Refused before any key was issued (restapi: the vault can't hold the new key's member wraps next to those it holds): the
+            // current key stays active, so the rest of the pass - waiting members' wraps of it - still goes ahead. Anything else throws.
+            if (!(err instanceof ApiRequestError) || err.status !== 400) {
+                throw err;
+            }
+            result.rotationRefused = err.message;
         }
-        result.rotated = true;
     }
     // The departed hold no wrap of the active key any more (or never did): their old wraps go.
     if (!status.rotationPending) {
@@ -289,17 +354,30 @@ export async function maintainSharedMailbox(mailboxUid: string, mailboxAddress:
     if (missing.length > 0 || escrowPending.length > 0) {
         const keys = await openPrivateKeys(mailboxUid, status, ownerUnlocked, client);
         try {
-            const wraps: MemberKeyWrap[] = [];
-            for (const member of missing) {
-                for (const [fingerprint, pkcs8] of keys) {
+            // One write per key, the active key's first: it alone opens new mail, so a refused backfill of an older key (the server bounds
+            // each key's wraps and the vault's total) never keeps a member from it. A failed older key is left for the next pass.
+            const order = keyOrder(status);
+            for (const [fingerprint, pkcs8] of [...keys].sort(([a], [b]) => order(a) - order(b))) {
+                const wraps: MemberKeyWrap[] = [];
+                for (const member of missing) {
                     if (!member.wrapped.includes(fingerprint)) {
                         wraps.push({ ...(await wrapFor(member, pkcs8)), zeroAccessKeyFingerprint: fingerprint });
                     }
                 }
-            }
-            if (wraps.length > 0) {
-                await putMemberKeyWraps(mailboxUid, wraps, client);
-                result.wrapped = wraps.length;
+                if (wraps.length === 0) {
+                    continue;
+                }
+                if (fingerprint === status.activeKeyFingerprint) {
+                    await putMemberKeyWraps(mailboxUid, wraps, client);
+                    result.wrapped += wraps.length;
+                } else {
+                    try {
+                        await putMemberKeyWraps(mailboxUid, wraps, client);
+                        result.wrapped += wraps.length;
+                    } catch {
+                        result.refused += wraps.length;
+                    }
+                }
             }
             const held: string[] = escrowPending.filter((fingerprint) => keys.has(fingerprint));
             if (held.length > 0) {

package/lib/crypto/smimeMessage.ts

@@ -77,7 +77,8 @@ export function applyBaselineOuterHeaders(headers: ProtectedHeaders): ProtectedH
     return { ...headers, subject: "[...]" };
 }
 
-function base64Wrapped(bytes: Uint8Array): string {
+/** @internal Shared with `pgpMessage.ts`. */
+export function base64Wrapped(bytes: Uint8Array): string {
     const encoded = toBase64(bytes);
     const lines: string[] = [];
     for (let i = 0; i < encoded.length; i += BASE64_LINE_WIDTH) {
@@ -86,7 +87,8 @@ function base64Wrapped(bytes: Uint8Array): string {
     return lines.join(CRLF);
 }
 
-function generateBoundary(): string {
+/** @internal Shared with `pgpMessage.ts`. */
+export function generateBoundary(): string {
     const bytes = crypto.getRandomValues(new Uint8Array(16));
     return `----=_RapidMX_${Array.from(bytes)
         .map((b) => b.toString(16).padStart(2, "0"))
@@ -94,7 +96,7 @@ function generateBoundary(): string {
 }
 
 /** Strips CR/LF/NUL from a header value that has no further encoding (Date, Message-ID, Content-Type). */
-function flattenHeaderValue(value: string): string {
+export function flattenHeaderValue(value: string): string {
     return value.replace(/[\r\n\0]+/g, " ");
 }
 
@@ -116,7 +118,8 @@ function headerLines(headers: ProtectedHeaders, prefix = ""): string[] {
     ];
 }
 
-function protectedHeaderLines(headers: ProtectedHeaders, hpOuter?: ProtectedHeaders): string {
+/** @internal Shared with `pgpMessage.ts`: the protected header block of an inner entity (with `HP-Outer:` copies of `hpOuter`). */
+export function protectedHeaderLines(headers: ProtectedHeaders, hpOuter?: ProtectedHeaders): string {
     const lines = headerLines(headers);
     if (hpOuter) {
         // RFC 9788 Section 2.2.1's `hp-outer` field: the literal string "HP-Outer:" followed by the
@@ -369,7 +372,7 @@ export type ComparableOuterHeaders = Partial<Pick<ProtectedHeaders, "from" | "to
  * (a real bug if reused for this - JSON/`Record` keys aren't multi-valued). Scans the raw header block
  * text directly instead. Returns `undefined` when no `HP-Outer:` lines are present at all, so a caller
  * can distinguish "nothing to compare" from "compared and everything matched". */
-function extractHpOuterHeaders(fields: MimeHeaderField[]): ComparableOuterHeaders | undefined {
+export function extractHpOuterHeaders(fields: MimeHeaderField[]): ComparableOuterHeaders | undefined {
     const result: ComparableOuterHeaders = {};
     let found = false;
     for (const { name, value } of fields) {
@@ -386,7 +389,7 @@ function extractHpOuterHeaders(fields: MimeHeaderField[]): ComparableOuterHeader
 /** `true` when every field `hpOuter` actually carries matches `actualOuterHeaders`' value for that same
  * field - a field `hpOuter` doesn't carry (e.g. no `Cc` on this message) is not compared, since RFC
  * 9788 never claims coverage for it either way. */
-function outerHeadersMatch(hpOuter: ComparableOuterHeaders, actualOuterHeaders: ComparableOuterHeaders): boolean {
+export function outerHeadersMatch(hpOuter: ComparableOuterHeaders, actualOuterHeaders: ComparableOuterHeaders): boolean {
     return (Object.keys(hpOuter) as (keyof ComparableOuterHeaders)[]).every((field) => hpOuter[field] === actualOuterHeaders[field]);
 }
 
@@ -477,7 +480,8 @@ export function splitHeadersAndBody(entity: string): { headers: Record<string, s
     return { headers, contentType: headers["content-type"], body, rawHeaderBlock };
 }
 
-function headersToProtectedHeaders(headers: Record<string, string>): ProtectedHeaders {
+/** @internal Shared with `pgpMessage.ts`. */
+export function headersToProtectedHeaders(headers: Record<string, string>): ProtectedHeaders {
     return {
         from: headers["from"] ?? "",
         to: headers["to"] ?? "",

package/lib/crypto/zeroAccessKey.ts

@@ -11,6 +11,7 @@
 import type { ApiClient } from "../util/api.js";
 import { fromBase64 } from "./encoding.js";
 import { type KeyVault, enrollKey, getKeyVault } from "./keyvaultApi.js";
+import { certificateHoldsKey } from "./keyPairMatch.js";
 import { exportPrivateKeyPkcs8, generateKeyPairWithCsr, importPrivateKeyPkcs8 } from "./keys.js";
 import { addZeroAccessKey, getUnlockedKeys, type RetainedEncryptionKey, ZERO_ACCESS_PRIVATE_KEY_AAD_PURPOSE } from "./keySession.js";
 import { buildAad, sealWithKey } from "./masterKey.js";
@@ -56,6 +57,10 @@ export async function provisionZeroAccessKey(
         if (!enrolled || !certificate) {
             throw new Error("The server did not return the enrolled zero-access key.");
         }
+        // The certificate is the server's: this device seals to it (index segments, protected meetings' keys), so it must be the new key's.
+        if (!(await certificateHoldsKey(fromBase64(certificate.publicKey), raw))) {
+            throw new Error("The server returned a zero-access certificate that isn't the enrolled key's.");
+        }
         const privateKey = await importPrivateKeyPkcs8(raw, { name: "ECDH", namedCurve: "P-256" }, ["deriveBits"], false);
         return { vault, key: { fingerprint: enrolled.fingerprint, certDer: fromBase64(certificate.publicKey), privateKey } };
     } finally {

package/lib/mail/mailApi.ts

@@ -135,6 +135,12 @@ export interface Mailbox {
     /** "Enable zero-access encryption": unset means on. Only the mailbox's owner can change it - restapi drops anybody
      * else's value. Has no effect while the server's `EncryptionPolicy.allowZeroAccess` is off. */
     zeroAccessEnabled?: boolean;
+    /** Which data types zero-access encryption covers - see `ZeroAccessTypes`. Owner only. */
+    zeroAccessTypes?: ZeroAccessTypes;
+    /** The ActiveSync and Outlook clients that sync this mailbox, as the server last saw them. Server-written. */
+    syncClients?: SyncClients;
+    /** When the owner last exported a zero-access key for a phone or Outlook. Server-written. */
+    zeroAccessKeysExportedAt?: number;
     /** How the caller reaches this mailbox: `"owner"` (theirs) or `"delegate"` (shared with them). Set by the plain list and read of
      * mailboxes - not in an administration-scope answer - so a client can label the shared ones; see `isSharedWithMe()`. */
     accessRole?: "owner" | "delegate";
@@ -263,6 +269,19 @@ export function autoProvisionMailbox(
  * `null` clears them - `JSON.stringify()` drops an `undefined` value entirely, which would instead leave
  * the old value in place.
  */
+/** The data types zero-access encryption can cover (restapi `specs/search.md` §3 *What It Covers*). */
+export type ZeroAccessDataType = "mail" | "calendar" | "contacts" | "tasks";
+
+/** `Mailbox.zeroAccessTypes`: per data type, whether zero-access covers it. A type left out is undecided: mail counts as on, the others
+ * as off, until the server decides them from the owner's devices. */
+export type ZeroAccessTypes = Partial<Record<ZeroAccessDataType, boolean>>;
+
+/** `Mailbox.syncClients`: the ActiveSync devices (each with the data types it syncs) and Outlook. */
+export interface SyncClients {
+    activesync?: { devices: { id: string; model?: string; types: ZeroAccessDataType[]; lastSeenAt: number }[] };
+    mapi?: { lastSeenAt: number };
+}
+
 export interface UpdateMailboxInput {
     uid: string;
     version: number;
@@ -289,6 +308,10 @@ export interface UpdateMailboxInput {
     autoSendReceiptsExternal?: boolean;
     /** Owner-only server-side (anybody else's value is dropped) - see `Mailbox.zeroAccessEnabled`. */
     zeroAccessEnabled?: boolean;
+    /** Owner-only server-side; a partial choice is merged into the stored one - see `Mailbox.zeroAccessTypes`. */
+    zeroAccessTypes?: ZeroAccessTypes;
+    /** The mailbox's own encryption preference, replaced whole - see `Mailbox.encryptPreference`. */
+    encryptPreference?: EncryptionPreference;
     /** Trusted-caller-only server-side. `null` (or `""`) unassigns the mailbox's escrow scope; the
      * referenced `EscrowScope` must exist otherwise. See `Mailbox.escrowScopeId`. */
     escrowScopeId?: string | null;
@@ -1094,6 +1117,10 @@ export interface AssembleDraftInput {
     html: string;
     /** See `AssembleIntent`. */
     intent?: AssembleIntent;
+    /** The addresses this copy is delivered to, when not all of `to`/`cc`/`bcc`: one copy of a message sent in two end-to-end
+     * formats (an S/MIME and an OpenPGP copy, each listing every recipient) goes only to the recipients of its own format. Each
+     * must be one of the recipients. */
+    deliverTo?: string[];
 }
 
 /**

package/lib/mail/mailboxImportApi.ts

@@ -11,6 +11,7 @@
  */
 import { ApiClient, withClient, withClientRaw } from "../util/api.js";
 import { RequestListParams, buildRequestListQuery } from "../util/apiQuery.js";
+import type { Mailbox } from "./mailApi.js";
 
 export type { RequestListParams };
 
@@ -79,3 +80,26 @@ export function listImportRequests(params: RequestListParams = {}, client?: ApiC
 export function getImportRequest(uid: string, client?: ApiClient): Promise<MailboxImportRequest> {
     return withClient(client, `/mail/mailbox-import-requests/${encodeURIComponent(uid)}`);
 }
+
+/** Why server-side import is refused for a mailbox whose mail is zero-access (restapi answers such an upload 409). */
+export const ZERO_ACCESS_IMPORT_MESSAGE =
+    "Importing an archive isn't available while zero-access encryption protects this mailbox's mail: the server would have to keep " +
+    "the uploaded archive readable until the import ran, which zero-access encryption doesn't allow.";
+
+/**
+ * Whether `mailbox`'s mail is stored zero-access encrypted, so restapi refuses a server-side import into it (`specs/search.md` §3: the
+ * uploaded archive would wait readable in the blob store). Decided as restapi's `zeroAccessStatus()` decides it for mail: the
+ * administrator's "Allow zero-access encryption" (`allowZeroAccess`; unknown counts as allowed, so an import is never offered only to be
+ * refused), the owner's switch (unset is on), mail among the protected types (undecided is on), and a key that isn't revoked.
+ */
+export function mailIsZeroAccess(
+    mailbox: Pick<Mailbox, "zeroAccessEnabled" | "zeroAccessTypes" | "zeroAccessKeys">,
+    allowZeroAccess: boolean | undefined,
+): boolean {
+    return (
+        allowZeroAccess !== false &&
+        mailbox.zeroAccessEnabled !== false &&
+        mailbox.zeroAccessTypes?.mail !== false &&
+        (mailbox.zeroAccessKeys ?? []).some((key) => !key.revokedAt)
+    );
+}

package/lib/search/zeroAccessIndexApi.ts

@@ -30,6 +30,10 @@ export interface IndexWeekEntries {
     latestEntryAt: string;
     /** The week has closed and its grace period has passed: a client may compact it. */
     compactable: boolean;
+    /** When the week becomes (or became) compactable - where the platform stagger starts. Absent from a server before it. */
+    compactableAt?: string;
+    /** Size of the week's pending sealed entries (bytes of base64). Absent from a server before it. */
+    pendingBytes?: number;
 }
 
 export interface SegmentManifest {

package/lib/tasks/tasksApi.ts

@@ -7,6 +7,8 @@
 
 import { ApiClient, withClient } from "../util/api.js";
 import { ListParams, SETTINGS_LIST_LIMIT, buildQuery } from "../util/apiQuery.js";
+import { guardSealedMove } from "../zeroAccess/sealedMoves.js";
+import { protectedRecordWrite } from "../zeroAccess/sealedRecords.js";
 
 export type TaskPriority = "low" | "normal" | "high";
 
@@ -31,6 +33,9 @@ export interface Task {
     myDay?: boolean;
     /** The uid of the user this task is assigned to, if any. */
     assignedTo?: string;
+    /** The title and notes sealed to the mailbox's zero-access key while it protects tasks (`title` is then a placeholder) - opened with
+     * `openSealedRecords()`. Server-written. */
+    sealedFields?: Record<string, string> | null;
 }
 
 /** `client`, given by every function below, is an explicit `ApiClient` from `createApiClient()` (e.g. one
@@ -78,13 +83,22 @@ export interface UpdateTaskInput {
     taskListUid?: string;
     myDay?: boolean;
     assignedTo?: string;
+    /** A move to another mailbox, with `folderUid` there - refused for a protected task (`SealedMoveError`). */
+    mailboxUid?: string;
+    folderUid?: string;
 }
 
-export function updateTask(input: UpdateTaskInput, client?: ApiClient): Promise<Task> {
-    return withClient(client, `/mail/tasks/${encodeURIComponent(input.uid)}`, {
-        method: "PUT",
-        body: JSON.stringify(input),
-    });
+/** Saves `input`. One moving the task to another mailbox (`mailboxUid`) is refused with `SealedMoveError` when the task is protected -
+ * before sending anything when `current` (the task as this device has it) says so, else from the server's refusal. With `current`, a
+ * protected task's sealed fields go only when they changed from it, and an emptied one is named in `clearedFields` when `current` was
+ * opened here (`protectedRecordWrite()`). */
+export function updateTask(input: UpdateTaskInput, client?: ApiClient, current?: Task): Promise<Task> {
+    return guardSealedMove(current, input.mailboxUid, () =>
+        withClient<Task>(client, `/mail/tasks/${encodeURIComponent(input.uid)}`, {
+            method: "PUT",
+            body: JSON.stringify(protectedRecordWrite(current, input)),
+        }),
+    );
 }
 
 /** Toggles a task's `completed` flag in place — same pattern as `mailApi.ts`'s `setMessageRead`. */

package/lib/util/clientPlatform.ts

@@ -0,0 +1,50 @@
+///////////////////////////////////////////////////////////////////////////////
+// Copyright (C) 2026 Jean-Philippe Steinmetz
+// SPDX-License-Identifier: MPL-2.0
+///////////////////////////////////////////////////////////////////////////////
+/**
+ * What kind of client this is, for work that should prefer one over another - the search index's week compaction, which a phone
+ * should leave to a computer (restapi `specs/search.md` §8 *Who compacts*).
+ *
+ * - `"desktop"`: a native app on a computer (`tauri-client`, `electron-client`), which installs `window.rapidmx`.
+ * - `"mobile"`: a native app on a phone or tablet (the host sets `window.rapidmx.formFactor: "mobile"`), or a phone or tablet browser.
+ * - `"web"`: any other browser.
+ */
+export type ClientPlatform = "desktop" | "web" | "mobile";
+
+interface NavigatorHints {
+    userAgent?: string;
+    userAgentData?: { mobile?: boolean };
+    connection?: { type?: string; saveData?: boolean };
+}
+
+const MOBILE_USER_AGENT = /Android|iPhone|iPad|iPod|Mobile/i;
+
+function navigatorHints(): NavigatorHints | undefined {
+    return typeof navigator === "undefined" ? undefined : navigator;
+}
+
+/** Whether this browser runs on a phone or tablet, by its User-Agent Client Hints, else its user agent string. */
+function isMobileBrowser(): boolean {
+    const hints = navigatorHints();
+    if (typeof hints?.userAgentData?.mobile === "boolean") {
+        return hints.userAgentData.mobile;
+    }
+    return MOBILE_USER_AGENT.test(hints?.userAgent ?? "");
+}
+
+/** This client's platform (see the module comment). */
+export function clientPlatform(): ClientPlatform {
+    const host = typeof window === "undefined" ? undefined : (window as { rapidmx?: { formFactor?: string } }).rapidmx;
+    if (host) {
+        return host.formFactor === "mobile" ? "mobile" : "desktop";
+    }
+    return isMobileBrowser() ? "mobile" : "web";
+}
+
+/** Whether the connection is one to spare: cellular, or the user asked to save data (Network Information API, where the browser
+ * has it - absent, the connection is taken as unconstrained). */
+export function isConstrainedConnection(): boolean {
+    const connection = navigatorHints()?.connection;
+    return connection?.saveData === true || connection?.type === "cellular";
+}