@rapidmx/web-client 0.36.0 → 0.37.1

package/dist/apps/shared/components/contacts/ContactForm.d.ts

@@ -17,4 +17,7 @@ export interface ContactFormProps {
  * mobile detail route's own edit mode (`apps/www/contacts/[uid].tsx`) — creation itself stays
  * desktop-and-mobile-inline (see that route's own doc comment on why "new" never gets a dedicated route).
  */
-export default function ContactForm({ contact, mailboxUid, folderUid, mailboxes, onSaved, onCancel }: ContactFormProps): React.JSX.Element;
+/** The form for `props.contact` opened in full - its fields are read once, when it mounts, so it waits for a protected contact to open. One
+ * that can't be opened here (the mailbox is locked, or this device has no key for it) is never edited: its form would hold placeholders,
+ * and saving them would replace - or clear for good - the real details. */
+export default function ContactForm(props: ContactFormProps): React.JSX.Element;

package/dist/apps/shared/components/contacts/ContactForm.js

@@ -15,6 +15,8 @@ import { useApiClient } from "../../../../lib/util/apiClientContext.js";
 import { useContactPhotoSrc } from "../../../../lib/contacts/useContactPhotoSrc.js";
 import { findWellKnownFolderUid } from "../../mail/findWellKnownFolderUid.js";
 import { clearPinnedSignerCache } from "../mail/pinnedSigners.js";
+import { useOpenedRecord } from "../../zeroAccess/useOpenedRecord.js";
+import { isOpenedRecord, isProtectedRecord, openSealedRecord, protectedRecordWrite } from "../../../../lib/zeroAccess/sealedRecords.js";
 const INPUT_CLASS = "w-full text-sm py-2 px-3 border border-border rounded-sm bg-surface text-text focus:outline-none focus:border-primary";
 const SELECT_CLASS = "text-sm py-2 px-2 border border-border rounded-sm bg-surface text-text focus:outline-none focus:border-primary";
 const ADDRESS_KINDS = ["home", "work", "other"];
@@ -23,8 +25,30 @@ const ADDRESS_KINDS = ["home", "work", "other"];
  * mobile detail route's own edit mode (`apps/www/contacts/[uid].tsx`) — creation itself stays
  * desktop-and-mobile-inline (see that route's own doc comment on why "new" never gets a dedicated route).
  */
-export default function ContactForm({ contact, mailboxUid, folderUid, mailboxes, onSaved, onCancel }) {
+/** The form for `props.contact` opened in full - its fields are read once, when it mounts, so it waits for a protected contact to open. One
+ * that can't be opened here (the mailbox is locked, or this device has no key for it) is never edited: its form would hold placeholders,
+ * and saving them would replace - or clear for good - the real details. */
+export default function ContactForm(props) {
+    const { record, ready } = useOpenedRecord(props.contact);
+    // Bumped by the view's "Reload" to fill it again from the contact as it is now.
+    const [reloads, setReloads] = useState(0);
+    if (!ready) {
+        return _jsx("p", { className: "text-sm text-text-muted", children: "Opening this contact\u2026" });
+    }
+    if (isProtectedRecord(record) && !isOpenedRecord(record)) {
+        return (_jsxs("div", { className: "flex max-w-xl flex-col items-start gap-3 p-6", children: [_jsx("p", { role: "status", className: "text-sm", children: "This contact is protected and can\u2019t be edited while your mailbox is locked. Unlock it to edit." }), _jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", onClick: props.onCancel, children: "Back" })] }));
+    }
+    // The server answers a save with the protected details sealed: what goes back is opened again.
+    const onSaved = (saved) => void openSealedRecord(saved).then(props.onSaved);
+    // Another contact is another form: its fields are filled from it.
+    return _jsx(ContactFormView, { ...props, contact: record, onSaved: onSaved, onReload: () => setReloads((n) => n + 1) }, `${record?.uid ?? ""}:${reloads}`);
+}
+function ContactFormView({ contact, mailboxUid, folderUid, mailboxes, onSaved, onCancel, onReload }) {
     const client = useApiClient();
+    // The contact as the form was filled from. A live update hands the open form the contact as changed elsewhere (`contact`), but the fields
+    // still hold this one's values: an update is sent at this version, and compared with it, so that change is refused (409) - never
+    // overwritten with what the form still shows.
+    const [seeded] = useState(contact);
     const currentPhotoUrl = useContactPhotoSrc(contact, client);
     const [targetMailboxUid, setTargetMailboxUid] = useState(mailboxUid);
     const [displayName, setDisplayName] = useState(contact?.displayName ?? "");
@@ -48,7 +72,7 @@ export default function ContactForm({ contact, mailboxUid, folderUid, mailboxes,
     const [error, setError] = useState(null);
     const [saving, setSaving] = useState(false);
     // The contact as stored, once it has been saved and only the picture is left to do (that is a second request, which can fail on its own):
-    // a retry must not create the contact again or send the version it started from. `key` is the form's content that was saved.
+    // a retry must not create the contact again or send the version it started from. `key` is the form's content that was saved, `input` its fields.
     const [stored, setStored] = useState(null);
     function updateEmail(index, patch) {
         setEmails((prev) => prev.map((e, i) => (i === index ? { ...e, ...patch } : e)));
@@ -83,7 +107,7 @@ export default function ContactForm({ contact, mailboxUid, folderUid, mailboxes,
                 .filter(Boolean);
             // An update merges only the fields in its body, so a field the user cleared is sent as an
             // explicit `null` (an omitted/undefined one would keep its stored value); a create just omits it.
-            const existing = stored?.contact ?? contact;
+            const existing = stored?.contact ?? seeded;
             const cleared = existing ? null : undefined;
             const input = {
                 displayName: displayName.trim(),
@@ -106,10 +130,13 @@ export default function ContactForm({ contact, mailboxUid, folderUid, mailboxes,
                 saved = stored.contact;
             }
             else if (existing) {
+                // A protected contact's details go only when they changed from what the form was shown (or last saved): the server stores
+                // them sealed and can't tell an unchanged value from a new one.
+                const shown = seeded && (stored?.input ? { ...seeded, ...stored.input } : seeded);
                 saved = await updateContact({
                     uid: existing.uid,
                     version: existing.version,
-                    ...input,
+                    ...protectedRecordWrite(shown, input, isOpenedRecord(seeded)),
                 }, client);
             }
             else {
@@ -126,7 +153,7 @@ export default function ContactForm({ contact, mailboxUid, folderUid, mailboxes,
                     ...input,
                 }, client);
             }
-            setStored({ contact: saved, key });
+            setStored({ contact: saved, key, input });
             const changePhoto = async (current) => {
                 if (pickedPhoto) {
                     return uploadContactPhoto(current.uid, current.version, pickedPhoto, client);
@@ -143,7 +170,7 @@ export default function ContactForm({ contact, mailboxUid, folderUid, mailboxes,
                     }
                     // A version that is stale means an earlier try had been applied after all (its answer never arrived): read the contact as it is and go again, once.
                     const current = await getContact(saved.uid, client);
-                    setStored({ contact: current, key });
+                    setStored({ contact: current, key, input });
                     saved = await changePhoto(current);
                 }
             }
@@ -162,12 +189,15 @@ export default function ContactForm({ contact, mailboxUid, folderUid, mailboxes,
             setSaving(false);
         }
     }
+    // Changed elsewhere since the form was filled (or last saved): a save would be refused.
+    const baseline = stored?.contact ?? seeded;
+    const changedElsewhere = !!contact && !!baseline && contact.version > baseline.version;
     function finish(saved) {
         // A message opened later in this page load must see the changed contact's signing keys.
         clearPinnedSignerCache();
         onSaved(saved);
     }
-    return (_jsxs("form", { onSubmit: handleSubmit, className: "@container flex min-h-0 flex-1 flex-col", children: [_jsx("div", { className: "min-h-0 flex-1 overflow-y-auto p-6", children: _jsxs("div", { className: "flex max-w-xl flex-col gap-1", children: [_jsx("h1", { className: "text-xl font-bold uppercase tracking-wide mb-3", children: contact ? "Edit contact" : "New contact" }), error && _jsx(Alert, { children: error }), !contact && mailboxes && mailboxes.length > 1 && (_jsx(FormField, { label: "Mailbox", htmlFor: "contact-mailbox", children: _jsx("select", { id: "contact-mailbox", className: `${SELECT_CLASS} w-full`, value: targetMailboxUid, onChange: (e) => setTargetMailboxUid(e.target.value), children: mailboxes.map((mb) => (_jsxs("option", { value: mb.uid, children: [mb.displayName, mb.ownerUserUid ? "" : " (shared)"] }, mb.uid))) }) })), _jsx(FormField, { label: "Display name", htmlFor: "contact-displayName", children: _jsx("input", { id: "contact-displayName", type: "text", className: INPUT_CLASS, value: displayName, onChange: (e) => setDisplayName(e.target.value) }) }), _jsxs("div", { className: "flex items-start gap-2", children: [_jsx("div", { className: "min-w-0 flex-1", children: _jsx(ContactPhotoField, { displayName: displayName, email: emails[0]?.address, currentUrl: currentPhotoUrl, picked: pickedPhoto, removed: removePhoto, onPick: (file) => {
+    return (_jsxs("form", { onSubmit: handleSubmit, className: "@container flex min-h-0 flex-1 flex-col", children: [_jsx("div", { className: "min-h-0 flex-1 overflow-y-auto p-6", children: _jsxs("div", { className: "flex max-w-xl flex-col gap-1", children: [_jsx("h1", { className: "text-xl font-bold uppercase tracking-wide mb-3", children: contact ? "Edit contact" : "New contact" }), error && _jsx(Alert, { children: error }), changedElsewhere && (_jsxs("div", { role: "status", className: "mb-3 flex flex-wrap items-center gap-3 text-sm", children: [_jsx("span", { children: "This contact was changed elsewhere while you were editing it, so saving would be refused. Reload it to edit the changed contact - what you typed here is lost." }), _jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", disabled: saving, onClick: onReload, children: "Reload" })] })), !contact && mailboxes && mailboxes.length > 1 && (_jsx(FormField, { label: "Mailbox", htmlFor: "contact-mailbox", children: _jsx("select", { id: "contact-mailbox", className: `${SELECT_CLASS} w-full`, value: targetMailboxUid, onChange: (e) => setTargetMailboxUid(e.target.value), children: mailboxes.map((mb) => (_jsxs("option", { value: mb.uid, children: [mb.displayName, mb.ownerUserUid ? "" : " (shared)"] }, mb.uid))) }) })), _jsx(FormField, { label: "Display name", htmlFor: "contact-displayName", children: _jsx("input", { id: "contact-displayName", type: "text", className: INPUT_CLASS, value: displayName, onChange: (e) => setDisplayName(e.target.value) }) }), _jsxs("div", { className: "flex items-start gap-2", children: [_jsx("div", { className: "min-w-0 flex-1", children: _jsx(ContactPhotoField, { displayName: displayName, email: emails[0]?.address, currentUrl: currentPhotoUrl, picked: pickedPhoto, removed: removePhoto, onPick: (file) => {
                                             setPickedPhoto(file);
                                             setRemovePhoto(false);
                                             setError(null);

package/dist/apps/shared/components/contacts/KeyChangeReview.d.ts

@@ -6,6 +6,8 @@ export interface KeyChangeReviewProps {
     /** The contact's address `resolveKeyConflict()` looks the contact up by; absent hides the actions. */
     address?: string;
     useType: "sign" | "encrypt";
+    /** `"openpgp"` for an OpenPGP certificate (pinned as `useType: "encrypt"`; it signs too); omitted for an S/MIME certificate. */
+    keyType?: "openpgp";
     /** Who the key belongs to, for the advice ("confirm with <name>"). */
     ownerName: string;
     /** The currently pinned key and when it was first trusted; absent (couldn't be loaded) hides the actions. */
@@ -37,4 +39,4 @@ export interface KeyChangeReviewProps {
  * key, calling `resolveKeyConflict()` against the pinned fingerprint shown. Shared by a message's "signing key changed"
  * notice and a contact's recorded key conflicts.
  */
-export default function KeyChangeReview({ mailboxUid, address, useType, ownerName, current, proposed, certificate, canReject, canResolve, onResolved, onPinnedKeyChanged, }: KeyChangeReviewProps): React.JSX.Element;
+export default function KeyChangeReview({ mailboxUid, address, useType, keyType, ownerName, current, proposed, certificate, canReject, canResolve, onResolved, onPinnedKeyChanged, }: KeyChangeReviewProps): React.JSX.Element;

package/dist/apps/shared/components/contacts/KeyChangeReview.js

@@ -15,12 +15,12 @@ import { conflictSourceLabel, formatDate, groupFingerprint, keyChangeErrorMessag
  * key, calling `resolveKeyConflict()` against the pinned fingerprint shown. Shared by a message's "signing key changed"
  * notice and a contact's recorded key conflicts.
  */
-export default function KeyChangeReview({ mailboxUid, address, useType, ownerName, current, proposed, certificate, canReject, canResolve, onResolved, onPinnedKeyChanged, }) {
+export default function KeyChangeReview({ mailboxUid, address, useType, keyType, ownerName, current, proposed, certificate, canReject, canResolve, onResolved, onPinnedKeyChanged, }) {
     const [confirmOpen, setConfirmOpen] = useState(false);
     const [busy, setBusy] = useState(null);
     const [error, setError] = useState(null);
     const [forbidden, setForbidden] = useState(false);
-    const kind = useType === "sign" ? "signing" : "encryption";
+    const kind = keyType === "openpgp" ? "OpenPGP" : useType === "sign" ? "signing" : "encryption";
     const actionable = !!address && !!current && canResolve !== false && !forbidden;
     async function resolve(action) {
         setBusy(action);
@@ -32,6 +32,7 @@ export default function KeyChangeReview({ mailboxUid, address, useType, ownerNam
                 action,
                 expectedPinnedFingerprint: current.fingerprint,
                 ...(action === "accept" && certificate !== undefined ? { certificate } : {}),
+                ...(keyType ? { type: keyType } : {}),
             });
             setConfirmOpen(false);
             onResolved(action);

package/dist/apps/shared/components/contacts/contactCardData.js

@@ -11,13 +11,14 @@ import { addDays } from "date-fns";
 import { listCalendarEvents } from "../../../../lib/calendar/calendarApi.js";
 import { openSealedEvents } from "../../calendar/sealedEvents.js";
 import { expandAllOccurrences } from "../../../../lib/calendar/recurrence.js";
-import { createContact, listContactsInFolders } from "../../../../lib/contacts/contactsApi.js";
+import { CONTACT_MATCH_FIELDS, createContact, listContactsInFolders } from "../../../../lib/contacts/contactsApi.js";
 import { parseVCards } from "../../../../lib/contacts/vcard.js";
 import { attachmentContentUrl, getMessage, listAttachments, listFolders, } from "../../../../lib/mail/mailApi.js";
 import { search } from "../../../../lib/search/searchApi.js";
 import { ApiRequestError } from "../../../../lib/util/api.js";
 import { ownMailboxes, primaryMailbox } from "../../mail/primaryMailbox.js";
 import { cardForAddress, contactInputFor, contactInputFromCard, findContactByAddress, isVCardAttachment, normalizeAddress, ownContactCard, withoutDuplicates, } from "./participantDetails.js";
+import { openSealedRecord, openSealedRecords } from "../../../../lib/zeroAccess/sealedRecords.js";
 /** How many recent messages and upcoming events the card lists. */
 export const CARD_LIST_SIZE = 5;
 /** How far ahead "upcoming" looks, in days. */
@@ -40,7 +41,9 @@ export async function loadFolders(mailboxes, client) {
 /** The contact the address belongs to in `folders`' contacts folders, if any. */
 export async function findContact(folders, address, client) {
     const uids = folders.filter((folder) => folder.type === "contacts").map((folder) => folder.uid);
-    return findContactByAddress(await listContactsInFolders(uids, client), address);
+    const found = findContactByAddress(await listContactsInFolders(uids, client), address);
+    // The card shows the one contact in full.
+    return found && (await openSealedRecord(found));
 }
 /** The last `CARD_LIST_SIZE` messages to or from `address` in `mailboxes`, newest first. */
 export async function loadRecentMessages(mailboxes, address, client) {
@@ -139,7 +142,7 @@ export async function buildOwnCardFile(mailbox, mailboxes, userUid, client) {
  * card's in the same file). A card that cannot be stored fails the whole call after the earlier ones were added - `AddCardsError` says how many.
  */
 export async function addCardsToAddressBook(cards, scope, client) {
-    const { fresh, skipped } = withoutDuplicates(cards, await listContactsInFolders([scope.folderUid], client));
+    const { fresh, skipped } = withoutDuplicates(cards, await openSealedRecords(await listContactsInFolders([scope.folderUid], client), CONTACT_MATCH_FIELDS));
     let added = 0;
     for (const card of fresh) {
         try {

package/dist/apps/shared/components/contacts/contactKeys.d.ts

@@ -23,7 +23,7 @@ type ContactWithFirstSeen = Pick<Contact, "previousKeys"> & {
     keysFirstSeen?: number;
 };
 /** When `key` (one of `contact`'s pinned keys) started being trusted: when it replaced the newest previous key of its
- * use, else the contact's `keysFirstSeen`, else the key's own `notBefore`. */
+ * use and format, else the contact's `keysFirstSeen`, else the key's own `notBefore`. */
 export declare function keyPinnedSince(contact: ContactWithFirstSeen, key: PublicKey): number;
 export declare function formatDate(ms: number): string;
 export {};

package/dist/apps/shared/components/contacts/contactKeys.js

@@ -5,7 +5,7 @@
 /** Display and error helpers for a contact's pinned keys and key changes (`KeyChangeReview`, `ContactDetailPane`,
  * `MessageDetailPane`). */
 import { ApiRequestError } from "../../../../lib/util/api.js";
-import { PinnedKeyChangedError } from "../../../../lib/crypto/keyvaultApi.js";
+import { keyFormat, PinnedKeyChangedError } from "../../../../lib/crypto/keyvaultApi.js";
 export const KEY_CHANGE_STALE_MESSAGE = "This contact's keys changed while you were looking; reload to see the latest.";
 export const KEY_CHANGE_INVALID_MESSAGE = "The new key isn't a valid, current certificate for this address, so it can't be accepted. Nothing was changed.";
 export const KEY_CHANGE_FORBIDDEN_MESSAGE = "You don't have permission to change this contact's keys.";
@@ -51,9 +51,9 @@ export function conflictSourceLabel(source) {
     return source === "header" ? "from an incoming message" : "by key discovery";
 }
 /** When `key` (one of `contact`'s pinned keys) started being trusted: when it replaced the newest previous key of its
- * use, else the contact's `keysFirstSeen`, else the key's own `notBefore`. */
+ * use and format, else the contact's `keysFirstSeen`, else the key's own `notBefore`. */
 export function keyPinnedSince(contact, key) {
-    const replaced = (contact.previousKeys ?? []).filter((previous) => previous.useType === key.useType).map((previous) => previous.replacedAt);
+    const replaced = (contact.previousKeys ?? []).filter((previous) => previous.useType === key.useType && keyFormat(previous) === keyFormat(key)).map((previous) => previous.replacedAt);
     if (replaced.length > 0) {
         return Math.max(...replaced);
     }

package/dist/apps/shared/components/layout/AppShell.d.ts

@@ -40,6 +40,23 @@ export interface AppShellProps extends PluginNavProps {
     branding?: Branding;
     /** The signed-in user's stored appearance preferences as the server rendered the page (its `appearance` prop), so the first paint already wears the theme and background - see `AppearanceProvider`. */
     appearance?: unknown;
+    /** A host that signs its account out itself - see `ShellSignOutHost`. Absent (the webmail), "Sign out" ends the one session this
+     * origin holds. */
+    signOutHost?: ShellSignOutHost;
+}
+/**
+ * How a host that keeps several accounts in one page (`tauri-client`: one webview, one key session, one local-index storage for all of
+ * them) signs out the account whose shell is mounted. The shell's own sign-out assumes one user per origin: it destroys every
+ * mailbox's unlocked keys and every local index on the device, posts auth-server's cookie logout and navigates to auth-server. With a
+ * host, "Sign out" still marks compose as signing out, clears this session's caches and notifications and saves open compose windows,
+ * but leaves the keys, the indexes, the logout and where to go next to the host.
+ */
+export interface ShellSignOutHost {
+    /** Called first, where the shell would destroy every mailbox's unlocked keys: destroys the signing-out account's. */
+    destroyKeys(): void;
+    /** Called once open compose windows are saved: destroys the account's local indexes, ends its session and leaves the page. Should
+     * not reject; a rejection is logged. */
+    finish(): Promise<void>;
 }
 export interface AppDef {
     id: AppShellApp;
@@ -67,7 +84,7 @@ export interface AppChromeProps extends AppShellProps {
  * Rendered by the webmail's app shell (`apps/www/_shell.tsx`, the router's persistent client layout), once, for the life of the
  * page, so that moving between apps replaces only `children` - see `AppShell` below for what a page's own shell renders instead.
  */
-export declare function AppChrome({ active, userUid, authServerUrl, impersonating, impersonationBaseUrl, trusted, trustedRoles, branding: initialBranding, appearance, pluginNav, busy, hideChrome, children, }: PropsWithChildren<AppChromeProps>): React.JSX.Element;
+export declare function AppChrome({ active, userUid, authServerUrl, impersonating, impersonationBaseUrl, trusted, trustedRoles, branding: initialBranding, appearance, pluginNav, busy, hideChrome, signOutHost, children, }: PropsWithChildren<AppChromeProps>): React.JSX.Element;
 /**
  * What a page's own shell (`MailShell`, `CalendarShell`, ...) renders around its content. Outside the client-side router it
  * is the whole `AppChrome`, as it always was. Inside it (the router's app shell, `apps/www/_shell.tsx`) the chrome is already mounted above the

package/dist/apps/shared/components/layout/AppShell.js

@@ -100,7 +100,7 @@ export function appRailItems(pluginNav, resolved = {}) {
  * Rendered by the webmail's app shell (`apps/www/_shell.tsx`, the router's persistent client layout), once, for the life of the
  * page, so that moving between apps replaces only `children` - see `AppShell` below for what a page's own shell renders instead.
  */
-export function AppChrome({ active, userUid, authServerUrl, impersonating, impersonationBaseUrl, trusted, trustedRoles, branding: initialBranding, appearance, pluginNav, busy, hideChrome, children, }) {
+export function AppChrome({ active, userUid, authServerUrl, impersonating, impersonationBaseUrl, trusted, trustedRoles, branding: initialBranding, appearance, pluginNav, busy, hideChrome, signOutHost, children, }) {
     const client = useApiClient();
     const [stoppingImpersonation, setStoppingImpersonation] = useState(false);
     // The keyboard shortcuts dialog: opened by `?`/Ctrl+/ (`GlobalShortcuts`) and by the account menu's item.
@@ -168,9 +168,10 @@ export function AppChrome({ active, userUid, authServerUrl, impersonating, imper
     // own, so this is what actually removes the indexes after a console sign-out (the console also records a
     // pending deletion, retried on the next mail load, in case no mail tab is open). `destroyAllLocalIndexes()`
     // announces the sign-out on this same channel, which this tab then hears itself, so the ref is set first:
-    // each tab reacts once, and the tab that started the sign-out ignores its own announcement.
+    // each tab reacts once, and the tab that started the sign-out ignores its own announcement. A host that signs out itself
+    // (`signOutHost`) keeps other accounts in this origin, so another tab's sign-out isn't this one's.
     useEffect(() => {
-        if (!userUid || typeof BroadcastChannel === "undefined") {
+        if (!userUid || signOutHost || typeof BroadcastChannel === "undefined") {
             return;
         }
         const channel = new BroadcastChannel(SIGN_OUT_CHANNEL);
@@ -193,14 +194,19 @@ export function AppChrome({ active, userUid, authServerUrl, impersonating, imper
             });
         });
         return () => channel.close();
-    }, [userUid, authServerUrl]);
+    }, [userUid, authServerUrl, signOutHost]);
     async function handleSignOut() {
         signingOutRef.current = true;
         // Before flushing and navigating: compose windows then skip their "Leave site?" prompt, which could
         // otherwise cancel the sign-out's own navigation.
         markSigningOut();
-        // Unlocked private keys never outlive an explicit sign-out.
-        destroyUnlockedKeys();
+        // Unlocked private keys never outlive an explicit sign-out - only the signing-out account's where a host keeps others.
+        if (signOutHost) {
+            signOutHost.destroyKeys();
+        }
+        else {
+            destroyUnlockedKeys();
+        }
         // Trusted signer pins read from contacts don't outlive the session either.
         clearPinnedSignerCache();
         clearAppearanceCache();
@@ -209,6 +215,11 @@ export function AppChrome({ active, userUid, authServerUrl, impersonating, imper
         // Open compose windows save edits still waiting on their autosave debounce while the session is still
         // valid - logout invalidates it. Bounded the same way as logout itself, and never rejects.
         await flushComposeDrafts(LOGOUT_TIMEOUT_MS);
+        if (signOutHost) {
+            // The host destroys its account's indexes (spec §11) and ends its session; this page can't tell its accounts apart.
+            await signOutHost.finish().catch((err) => console.warn("The host's sign-out failed:", err));
+            return;
+        }
         // The Tier 2 local index MUST be destroyed on explicit logout, the same as unlocked keys themselves
         // (spec §11). Destroys every index on this device (not only mailboxes opened this page load) and is
         // awaited before navigating - a navigation tears down the Worker mid-delete otherwise.

package/dist/apps/shared/components/layout/KeyEnrollmentGate.js

@@ -14,6 +14,7 @@ import { FrameTakeover } from "../../navigation/frameContext.js";
 import { MIN_PASSWORD_LENGTH, RecoveryFollowUpModal, UnlockModeToggle, startRecoveryUnlock, } from "./RecoveryCodeUnlock.js";
 import { ENCRYPTION_PRIVATE_KEY_AAD_PURPOSE, getUnlockedKeys, subscribeKeySession, unlockWithPassword, } from "../../../../lib/crypto/keySession.js";
 import { ensureZeroAccessKey, provisionZeroAccessKey } from "../../../../lib/crypto/zeroAccessKey.js";
+import { ensureOpenPgpKey } from "../../../../lib/crypto/openPgpKey.js";
 import { buildAad, generateMasterKey, sealWithKey } from "../../../../lib/crypto/masterKey.js";
 import { buildPasswordWrap, buildRecoveryWraps } from "../../../../lib/crypto/masterKeyWraps.js";
 import { exportPrivateKeyPkcs8, generateKeyPairWithCsr } from "../../../../lib/crypto/keys.js";
@@ -94,14 +95,19 @@ export default function KeyEnrollmentGate({ mailboxUid, mailboxAddress, mailboxK
             cancelled = true;
         };
     }, [mailboxUid, canProvision]);
-    // A mailbox set up before zero-access encryption existed has no zero-access key: give it one whenever its owner has
-    // it unlocked - now, or on a later unlock from anywhere (this gate, an unlock prompt, recovery). Best effort: a
-    // failure is retried on the next unlock.
+    // A mailbox set up before zero-access encryption existed has no zero-access key, and one set up before OpenPGP was supported
+    // has no OpenPGP key (restapi specs/end-to-end_encryption.md *OpenPGP Interoperability*): give it each whenever its owner has
+    // it unlocked - now, or on a later unlock from anywhere (this gate, an unlock prompt, recovery, first-time setup). Best
+    // effort: a failure is retried on the next unlock.
     useEffect(() => {
         if (!mailboxUid || !mailboxAddress || !canProvision) {
             return;
         }
-        const ensure = () => void ensureZeroAccessKey(mailboxUid, mailboxAddress).catch(() => undefined);
+        // One after the other: both enrollments update the vault, which a concurrent write would refuse (409).
+        const ensure = () => void ensureZeroAccessKey(mailboxUid, mailboxAddress)
+            .catch(() => undefined)
+            .then(() => ensureOpenPgpKey(mailboxUid, mailboxAddress))
+            .catch(() => undefined);
         ensure();
         return subscribeKeySession((event) => {
             if (event.mailboxUid === mailboxUid && event.state === "unlocked") {

package/dist/apps/shared/components/layout/SharedMailboxKeyManager.d.ts

@@ -1,6 +1,8 @@
 import type { Mailbox } from "../../../../lib/mail/mailApi.js";
 /** How often the shared mailboxes are looked after again while some own mailbox stays unlocked. */
 export declare const SHARED_MAILBOX_CHECK_INTERVAL_MS: number;
+/** Forgets which refused rotations were shown (tests). */
+export declare function resetSharedMailboxKeyManager(): void;
 export interface SharedMailboxKeyManagerProps {
     /** Every mailbox the user can open. */
     mailboxes: Mailbox[];
@@ -10,6 +12,6 @@ export interface SharedMailboxKeyManagerProps {
  * Looks after the zero-access keys of the user's shared mailboxes (`lib/crypto/sharedMailboxKeys.ts`) whenever a mailbox of their own is
  * unlocked, and every `SHARED_MAILBOX_CHECK_INTERVAL_MS` after that: opens each mailbox shared with them through their member key wraps (no
  * password), and - for a mailbox they own or manage - provisions, rotates and shares its key with members still waiting. Best effort and
- * silent: a pass that fails is tried again on the next. Renders nothing; mounted by `MailShell`.
+ * silent (a pass that fails is tried again on the next), except for a rotation the server refuses, shown once as a warning. Renders nothing; mounted by `MailShell`.
  */
 export default function SharedMailboxKeyManager({ mailboxes, userUid }: SharedMailboxKeyManagerProps): null;

package/dist/apps/shared/components/layout/SharedMailboxKeyManager.js

@@ -5,6 +5,7 @@
 import { useEffect, useRef } from "react";
 import { getUnlockedKeys, personallyUnlockedKeys, subscribeKeySession } from "../../../../lib/crypto/keySession.js";
 import { useApiClient } from "../../../../lib/util/apiClientContext.js";
+import { notify } from "../../notifications/store.js";
 /** How often the shared mailboxes are looked after again while some own mailbox stays unlocked. */
 export const SHARED_MAILBOX_CHECK_INTERVAL_MS = 5 * 60 * 1000;
 /** The shared mailbox key code (pkijs and friends), loaded only once an own mailbox is unlocked. */
@@ -13,11 +14,17 @@ const loadSharedKeys = () => (loaded ?? (loaded = import("../../../../lib/crypto
     loaded = undefined;
     throw err;
 })));
+/** The refused rotations already shown, per mailbox (the reason): each is shown once a session, not on every pass that retries it. */
+const shownRefusals = new Map();
+/** Forgets which refused rotations were shown (tests). */
+export function resetSharedMailboxKeyManager() {
+    shownRefusals.clear();
+}
 /**
  * Looks after the zero-access keys of the user's shared mailboxes (`lib/crypto/sharedMailboxKeys.ts`) whenever a mailbox of their own is
  * unlocked, and every `SHARED_MAILBOX_CHECK_INTERVAL_MS` after that: opens each mailbox shared with them through their member key wraps (no
  * password), and - for a mailbox they own or manage - provisions, rotates and shares its key with members still waiting. Best effort and
- * silent: a pass that fails is tried again on the next. Renders nothing; mounted by `MailShell`.
+ * silent (a pass that fails is tried again on the next), except for a rotation the server refuses, shown once as a warning. Renders nothing; mounted by `MailShell`.
  */
 export default function SharedMailboxKeyManager({ mailboxes, userUid }) {
     const client = useApiClient();
@@ -60,13 +67,32 @@ export default function SharedMailboxKeyManager({ mailboxes, userUid }) {
 }
 async function look(mailbox, me, client, unlockSharedMailbox, maintainSharedMailbox) {
     const owned = !!mailbox.ownerUserUid && mailbox.ownerUserUid === me;
-    if (!owned && !getUnlockedKeys(mailbox.uid)) {
-        await unlockSharedMailbox(mailbox.uid, client);
+    if (!owned) {
+        // Opened, or - once open - opened again when a rotation left it without the active key.
+        await unlockSharedMailbox(mailbox.uid, client, true);
     }
     const unlocked = getUnlockedKeys(mailbox.uid);
     // An owner looks after their mailbox with its own keys; a member, with full access, whether or not it is open yet (a mailbox
     // without an owner may have no key to open).
     if (owned ? unlocked && !unlocked.shared : true) {
-        await maintainSharedMailbox(mailbox.uid, mailbox.primarySmtpAddress, client);
+        const done = await maintainSharedMailbox(mailbox.uid, mailbox.primarySmtpAddress, client);
+        // The server kept the current key (its vault can't take the new key's member wraps): say so once, members keep reading.
+        if (done.rotationRefused && shownRefusals.get(mailbox.uid) !== done.rotationRefused) {
+            shownRefusals.set(mailbox.uid, done.rotationRefused);
+            notify({
+                kind: "warning",
+                title: `${mailbox.displayName || mailbox.primarySmtpAddress}: the zero-access key wasn't replaced`,
+                message: "A member has left, but the server refused a new key for this shared mailbox. The current key stays active.",
+                details: done.rotationRefused,
+                dedupeKey: `shared-rotation-refused:${mailbox.uid}`,
+            });
+        }
+        else if (!done.rotationRefused) {
+            shownRefusals.delete(mailbox.uid);
+        }
+        // A key this member just made (a mailbox without an owner) goes into their session now, not on the next pass.
+        if (!owned && (done.provisioned || done.rotated)) {
+            await unlockSharedMailbox(mailbox.uid, client, true);
+        }
     }
 }

package/dist/apps/shared/components/mail/InviteCard.js

@@ -7,6 +7,7 @@ import React, { useId, useState } from "react";
 import { HiOutlineCalendarDays, HiOutlineCheck } from "react-icons/hi2";
 import { acceptProposal, proposeNewTime, removeMessageInvite, respondToMessageInvite, } from "../../../../lib/calendar/inviteApi.js";
 import { guestPermissionsOf } from "../../../../lib/calendar/calendarApi.js";
+import { openSealedEvent } from "../../calendar/sealedEvents.js";
 import { formatMailAddress } from "../../../../lib/mail/mailAddress.js";
 import { useApiClient } from "../../../../lib/util/apiClientContext.js";
 import Button from "../../../../lib/components/buttons/Button.js";
@@ -134,7 +135,7 @@ export default function InviteCard({ messageUid, headingLevel = 2 }) {
     return (_jsxs("section", { "aria-labelledby": headingId, className: "rounded-sm border border-border bg-surface-alt px-3 py-3 flex flex-col gap-2 text-sm text-text", children: [_jsxs(Heading, { id: headingId, className: "flex items-center gap-2 text-sm font-semibold", children: [_jsx(HiOutlineCalendarDays, { size: 16, "aria-hidden": "true", className: "shrink-0" }), changeRequest ? CHANGE_REQUEST_HEADING : (HEADINGS[method] ?? "Calendar event")] }), isReply && (_jsxs("p", { className: "break-words", children: [senderNode, " ", (sender?.responseStatus && REPLY_VERBS[sender.responseStatus]) ?? "responded", "."] })), isCounter && !changeRequest && (_jsxs("p", { className: "break-words", children: [senderNode, " proposed a new time", when ? _jsxs(_Fragment, { children: [": ", when] }) : "."] })), changeRequest && (_jsx("p", { className: "break-words", children: changeRequest.applied ? (_jsxs(_Fragment, { children: [_jsx("span", { className: "font-semibold", children: senderName }), "\u2019s change was applied."] })) : (_jsxs(_Fragment, { children: [_jsx("span", { className: "font-semibold", children: senderName }), " requested a change."] })) })), _jsx("p", { className: "font-medium break-words", children: title }), !isReply && (_jsxs("dl", { className: "grid grid-cols-[auto_minmax(0,1fr)] gap-x-3 gap-y-1", children: [when && (!isCounter || !!changeRequest) && (_jsxs(_Fragment, { children: [_jsx("dt", { className: "text-text-muted", children: "When" }), _jsxs("dd", { className: "break-words", children: [when, invite.recurring && _jsx("span", { className: "text-text-muted", children: " (Repeats)" })] })] })), invite.location && (_jsxs(_Fragment, { children: [_jsx("dt", { className: "text-text-muted", children: "Where" }), _jsx("dd", { className: "break-words", children: invite.location })] })), hasDescription && (!isCounter || !!changeRequest) && (_jsxs(_Fragment, { children: [_jsx("dt", { className: "text-text-muted", children: "Description" }), _jsx("dd", { className: "break-words", children: _jsx(EventDescriptionView, { html: invite.descriptionHtml, text: invite.description }) })] })), invite.organizer && !isCounter && (_jsxs(_Fragment, { children: [_jsx("dt", { className: "text-text-muted", children: "Organizer" }), _jsx("dd", { className: "break-words", children: _jsx(ParticipantLink, { participant: invite.organizer, children: formatMailAddress(invite.organizer) }) })] })), attendees && (!isCounter || !!changeRequest) && (_jsxs(_Fragment, { children: [_jsx("dt", { className: "text-text-muted", children: "Attendees" }), _jsx("dd", { className: "break-words", children: attendees })] })), visibility && !isCounter && (_jsxs(_Fragment, { children: [_jsx("dt", { className: "text-text-muted", children: "Visibility" }), _jsx("dd", { className: "break-words", children: visibility })] }))] })), isReply && when && _jsx("p", { className: "text-text-muted break-words", children: when }), conflicts && (_jsxs("p", { className: "text-danger break-words", children: [_jsx("span", { className: "font-medium", children: "Conflicts with:" }), " ", conflicts] })), invite.guestPermissions && !isReply && !isCounter && method !== "CANCEL" && (_jsx("p", { className: "text-xs text-text-muted break-words", children: describeGuestPermissions(permissions) })), invite.isOrganizer && !isReply && !isCounter && _jsx("p", { className: "text-text-muted", children: "You are the organizer of this meeting." }), method === "CANCEL" && _jsx("p", { className: "font-medium text-danger", children: "This meeting was canceled." }), invite.response && !invite.isOrganizer && !isReply && !isCounter && (_jsx("p", { role: "status", className: `font-medium ${ANSWER_CLASS[invite.response]}`, children: ANSWER_TEXT[invite.response] })), isCounter && invite.response === "accepted" && !changeRequest?.applied && (_jsx("p", { role: "status", className: "font-medium text-success", children: "You accepted the proposed time." })), proposed && (_jsx("p", { role: "status", className: "font-medium text-text", children: "Your proposed time was sent to the organizer." })), requested && (_jsx("p", { role: "status", className: "font-medium text-text", children: "Your change was sent to the organizer." })), invite.outdated && _jsx("p", { className: "text-xs text-text-muted", children: "A newer version of this meeting is already on your calendar." }), hasActions && (_jsxs("div", { className: "flex flex-wrap items-center gap-2", children: [showResponses && (_jsx("div", { role: "group", "aria-label": "Respond to this meeting", "aria-busy": busy || undefined, className: "flex flex-wrap gap-2", children: RESPONSES.map(({ response, label, failure }) => {
                             const current = invite.response === response;
                             return (_jsxs(Button, { type: "button", variant: "secondary", className: ["!w-auto", current ? "!bg-primary/10 !border-primary disabled:!opacity-100" : ""].join(" "), "aria-pressed": current, "aria-busy": pending === response || undefined, loading: pending === response, disabled: busy || current, onClick: () => void run(response, failure, () => respondToMessageInvite(messageUid, response, client)), children: [current && _jsx(HiOutlineCheck, { size: 14, "aria-hidden": "true" }), label] }, response));
-                        }) })), invite.canPropose && !proposing && (_jsx(Button, { type: "button", variant: "text", disabled: busy, onClick: () => setProposing(true), children: "Propose new time" })), canRequest && !requesting && (_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", disabled: busy, onClick: () => setRequesting(true), children: invite.canRequestChange ? "Request a change" : "Add guests" })), invite.canAcceptProposal && invite.response !== "accepted" && (_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", "aria-busy": pending === "acceptProposal" || undefined, loading: pending === "acceptProposal", disabled: busy, onClick: () => void run("acceptProposal", "Couldn't accept the proposed time", () => acceptProposal(messageUid, client)), children: "Accept proposal" })), invite.canAdd && (_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", "aria-busy": pending === "add" || undefined, loading: pending === "add", disabled: busy, 
+                        }) })), invite.canPropose && !proposing && (_jsx(Button, { type: "button", variant: "text", disabled: busy, onClick: () => setProposing(true), children: "Propose new time" })), canRequest && !requesting && (_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", disabled: busy, onClick: () => setRequesting(true), children: invite.canRequestChange ? "Request a change" : "Add guests" })), invite.canAcceptProposal && invite.response !== "accepted" && (_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", "aria-busy": pending === "acceptProposal" || undefined, loading: pending === "acceptProposal", disabled: busy, onClick: () => void run("acceptProposal", "Couldn't accept the proposed time", () => acceptProposal(messageUid, client, invite.calendarEventUid, openSealedEvent)), children: "Accept proposal" })), invite.canAdd && (_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", "aria-busy": pending === "add" || undefined, loading: pending === "add", disabled: busy, 
                         // A published event has no organizer to answer, so adding it is accepting it: the server sends no reply.
                         onClick: () => void run("add", "Couldn't add this event to your calendar", () => respondToMessageInvite(messageUid, "accepted", client)), children: "Add to calendar" })), invite.canRemove && (_jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", "aria-busy": pending === "remove" || undefined, loading: pending === "remove", disabled: busy, onClick: () => void run("remove", "Couldn't remove this meeting from your calendar", () => removeMessageInvite(messageUid, client)), children: "Remove from calendar" })), invite.onCalendar && invite.calendarEventUid && (_jsx("a", { href: calendarHref(invite), className: "text-sm font-medium text-primary-dark hover:underline", children: "Open in Calendar" }))] })), requesting && (_jsx("div", { className: "rounded-md bg-surface p-3", children: _jsx(RequestChangeForm, { subject: {
                         uid: invite.calendarEventUid,
@@ -147,6 +148,15 @@ export default function InviteCard({ messageUid, headingLevel = 2 }) {
                         description: invite.description,
                         descriptionHtml: invite.descriptionHtml,
                         guestAddresses: invite.attendees.map((attendee) => attendee.address),
+                        // The invitation's own content: what a protected copy of the event is named by.
+                        invitationContent: invite.summary
+                            ? {
+                                title: invite.summary,
+                                location: invite.location ?? undefined,
+                                description: invite.description ?? undefined,
+                                descriptionHtml: invite.descriptionHtml ?? undefined,
+                            }
+                            : undefined,
                     }, canChange: !!invite.canRequestChange, canInvite: !!invite.canRequestInvite, onSent: () => {
                         setRequesting(false);
                         setRequested(true);