@rapidmx/web-client 0.36.0 → 0.37.1

package/dist/lib/zeroAccess/sealedMoves.d.ts

@@ -0,0 +1,41 @@
+/**
+ * A calendar event, contact or task whose content is sealed to its mailbox's zero-access key - field by field (`sealedFields`), as one
+ * blob (`sealedContent`, an event from a zero-access invitation) or its photo (`photoSealed`) - can't move to another mailbox: what it
+ * keeps sealed is addressed to the mailbox it is in, and the server can't seal it again to the destination's key. restapi refuses such a
+ * move with a `409` (`ZeroAccessRouteSealing.refuseSealedMove()`).
+ *
+ * The record API wrappers (`updateContact()`, `updateCalendarEvent()`, `updateTask()`) refuse it before sending anything when they know the
+ * record (`guardSealedMove()`), and turn the server's refusal into the same `SealedMoveError` when they don't - one request, so nothing is
+ * left half moved. A UI offering a move asks `canMoveToMailbox()` first, and shows `SealedMoveError`'s message.
+ */
+import { ApiRequestError } from "../util/api.js";
+/** The fields of a record that say whether its content is sealed, and where. */
+export interface MovableRecord {
+    mailboxUid: string;
+    sealedFields?: Record<string, string> | null;
+    sealedContent?: unknown;
+    photoSealed?: boolean | null;
+}
+/** What a refused move says. */
+export declare const SEALED_MOVE_MESSAGE = "This item is protected by its mailbox's zero-access encryption, so it can't be moved to another mailbox. Create a copy there instead.";
+/** `SealedMoveError.code`. */
+export declare const SEALED_MOVE_CODE = "sealed-move";
+/** restapi's `ApiErrors.INVALID_REQUEST`, the code of its sealed-move refusal and of its other zero-access refusals (a version conflict,
+ * also a `409`, is `api-012`; an identifier already taken, `api-011`). */
+export declare const INVALID_REQUEST_CODE = "api-003";
+/** A move of a protected record to another mailbox, refused - by this client before sending it, or by the server. Nothing was written. */
+export declare class SealedMoveError extends ApiRequestError {
+    constructor(message?: string);
+}
+/** Whether `record` keeps any of its content sealed to its mailbox's key. */
+export declare function isSealedRecord(record: MovableRecord): boolean;
+/** Whether `record` may move to mailbox `targetMailboxUid`: always within its own mailbox, and to another only when nothing of it is sealed. */
+export declare function canMoveToMailbox(record: MovableRecord, targetMailboxUid: string): boolean;
+/** Whether `err` is restapi's refusal of a sealed record's move. */
+export declare function isSealedMoveRefusal(err: unknown): err is ApiRequestError;
+/**
+ * Runs `write`, a save of a record that sets its `mailboxUid` to `targetMailboxUid` (`undefined`: the save doesn't set it). With `current`,
+ * the record as this device has it, a move of a sealed one is refused before anything is sent. A move the server refuses for the same reason
+ * rejects with `SealedMoveError` too.
+ */
+export declare function guardSealedMove<T>(current: MovableRecord | undefined, targetMailboxUid: string | undefined, write: () => Promise<T>): Promise<T>;

package/dist/lib/zeroAccess/sealedMoves.js

@@ -0,0 +1,63 @@
+///////////////////////////////////////////////////////////////////////////////
+// Copyright (C) 2026 Jean-Philippe Steinmetz
+// SPDX-License-Identifier: MPL-2.0
+///////////////////////////////////////////////////////////////////////////////
+/**
+ * A calendar event, contact or task whose content is sealed to its mailbox's zero-access key - field by field (`sealedFields`), as one
+ * blob (`sealedContent`, an event from a zero-access invitation) or its photo (`photoSealed`) - can't move to another mailbox: what it
+ * keeps sealed is addressed to the mailbox it is in, and the server can't seal it again to the destination's key. restapi refuses such a
+ * move with a `409` (`ZeroAccessRouteSealing.refuseSealedMove()`).
+ *
+ * The record API wrappers (`updateContact()`, `updateCalendarEvent()`, `updateTask()`) refuse it before sending anything when they know the
+ * record (`guardSealedMove()`), and turn the server's refusal into the same `SealedMoveError` when they don't - one request, so nothing is
+ * left half moved. A UI offering a move asks `canMoveToMailbox()` first, and shows `SealedMoveError`'s message.
+ */
+import { ApiRequestError } from "../util/api.js";
+/** What a refused move says. */
+export const SEALED_MOVE_MESSAGE = "This item is protected by its mailbox's zero-access encryption, so it can't be moved to another mailbox. Create a copy there instead.";
+/** `SealedMoveError.code`. */
+export const SEALED_MOVE_CODE = "sealed-move";
+/** restapi's `ApiErrors.INVALID_REQUEST`, the code of its sealed-move refusal and of its other zero-access refusals (a version conflict,
+ * also a `409`, is `api-012`; an identifier already taken, `api-011`). */
+export const INVALID_REQUEST_CODE = "api-003";
+/** A move of a protected record to another mailbox, refused - by this client before sending it, or by the server. Nothing was written. */
+export class SealedMoveError extends ApiRequestError {
+    constructor(message = SEALED_MOVE_MESSAGE) {
+        super(message, 409, SEALED_MOVE_CODE);
+        this.name = "SealedMoveError";
+    }
+}
+/** Whether `record` keeps any of its content sealed to its mailbox's key. */
+export function isSealedRecord(record) {
+    return (!!record.sealedFields && Object.keys(record.sealedFields).length > 0) || !!record.sealedContent || !!record.photoSealed;
+}
+/** Whether `record` may move to mailbox `targetMailboxUid`: always within its own mailbox, and to another only when nothing of it is sealed. */
+export function canMoveToMailbox(record, targetMailboxUid) {
+    return targetMailboxUid === record.mailboxUid || !isSealedRecord(record);
+}
+/** Whether `err` is restapi's refusal of a sealed record's move. */
+export function isSealedMoveRefusal(err) {
+    return err instanceof SealedMoveError || (err instanceof ApiRequestError && err.status === 409 && err.code === INVALID_REQUEST_CODE);
+}
+/**
+ * Runs `write`, a save of a record that sets its `mailboxUid` to `targetMailboxUid` (`undefined`: the save doesn't set it). With `current`,
+ * the record as this device has it, a move of a sealed one is refused before anything is sent. A move the server refuses for the same reason
+ * rejects with `SealedMoveError` too.
+ */
+export async function guardSealedMove(current, targetMailboxUid, write) {
+    if (targetMailboxUid === undefined) {
+        return write();
+    }
+    if (current && !canMoveToMailbox(current, targetMailboxUid)) {
+        throw new SealedMoveError();
+    }
+    try {
+        return await write();
+    }
+    catch (err) {
+        if (current?.mailboxUid !== targetMailboxUid && isSealedMoveRefusal(err) && !(err instanceof SealedMoveError)) {
+            throw new SealedMoveError();
+        }
+        throw err;
+    }
+}

package/dist/lib/zeroAccess/sealedRecords.d.ts

@@ -0,0 +1,29 @@
+/** A record that may carry sealed fields. */
+export interface SealedRecord {
+    mailboxUid: string;
+    /** Protected field name -> base64 CMS of its JSON value. */
+    sealedFields?: Record<string, string> | null;
+}
+/** Forgets every opened value (a mailbox locking, or the test seam). */
+export declare function clearSealedRecords(): void;
+/** Whether every protected field of `record` holds its real value - opened on this device - rather than its placeholder. */
+export declare function isOpenedRecord(record: SealedRecord | undefined): boolean;
+/** Whether `record` has protected fields. */
+export declare function isProtectedRecord(record: SealedRecord | undefined): boolean;
+/** `records` with every protected one this device can open shown with its real values - only the fields in `only`, when given (a list
+ * shows a contact's name before anyone asks for its phone numbers: each field is one decryption). Never rejects. */
+export declare function openSealedRecords<T extends SealedRecord>(records: T[], only?: readonly string[]): Promise<T[]>;
+/** `der` (a blob the server sealed to `mailboxUid`'s zero-access key, e.g. a protected contact's photo) opened, or `undefined` when this
+ * device can't (the mailbox is locked, or it isn't its key). */
+export declare function openSealedBytes(mailboxUid: string, der: Uint8Array): Promise<Uint8Array | undefined>;
+/**
+ * `input` as written to `shown` - the record the edit started from, as this device showed it: unchanged when `shown` isn't protected.
+ * Otherwise without the protected fields (those `shown.sealedFields` names) whose values are what `shown` has: an opened record's write
+ * sends only what changed, and a placeholder a record that couldn't be opened showed is never sent back as its value. A field of an opened
+ * record that held a value and is emptied is named in `clearedFields`: restapi applies an empty value of a sealed field as a clear only
+ * then (`ZeroAccessRouteSealing.takeClearedFields()`), since an empty placeholder sent back by a client that couldn't open the record would
+ * otherwise wipe the sealed value for good. `opened`: `shown` holds the real values (by default, whether it was opened here).
+ */
+export declare function protectedRecordWrite<T extends object>(shown: SealedRecord | undefined, input: T, opened?: boolean): T;
+/** `openSealedRecords()` for one record. */
+export declare function openSealedRecord<T extends SealedRecord>(record: T, only?: readonly string[]): Promise<T>;

package/dist/lib/zeroAccess/sealedRecords.js

@@ -0,0 +1,136 @@
+///////////////////////////////////////////////////////////////////////////////
+// Copyright (C) 2026 Jean-Philippe Steinmetz
+// SPDX-License-Identifier: MPL-2.0
+///////////////////////////////////////////////////////////////////////////////
+/**
+ * Calendar events, contacts and tasks of a mailbox whose zero-access encryption covers their type keep their protected fields only
+ * sealed, field by field, to the mailbox's zero-access key (`sealedFields`; the readable column holds a placeholder - restapi
+ * `specs/search.md` §3 *What It Covers*). They are opened here with the mailbox's unlocked keys; while it is locked a record keeps its
+ * placeholders. The decryption code is loaded only when a sealed record is actually seen.
+ *
+ * Writing needs nothing here: the client sends plaintext and the server seals it on arrival.
+ */
+import { fromBase64 } from "../crypto/encoding.js";
+import { getUnlockedKeys, subscribeKeySession } from "../crypto/keySession.js";
+/** Opened values by sealed text - the same sealed text always opens to the same value. Cleared with `clearSealedRecords()`. */
+const opened = new Map();
+/** Forgets every opened value (a mailbox locking, or the test seam). */
+export function clearSealedRecords() {
+    opened.clear();
+}
+/** Set on a record whose every sealed field was opened. A symbol, so it survives a spread copy (an occurrence of an event) and is never sent. */
+const OPENED = Symbol("openedSealedRecord");
+/** Whether every protected field of `record` holds its real value - opened on this device - rather than its placeholder. */
+export function isOpenedRecord(record) {
+    return !!record && record[OPENED] === true;
+}
+/** Whether `record` has protected fields. */
+export function isProtectedRecord(record) {
+    return !!record?.sealedFields && Object.keys(record.sealedFields).length > 0;
+}
+/** `record` with every sealed field (of `only`, when given) this device can open set to its value; `undefined` when it can't open them
+ * (locked, or not its key). */
+async function openRecord(record, only) {
+    const keys = getUnlockedKeys(record.mailboxUid)?.zeroAccessKeys;
+    if (!keys?.length) {
+        return undefined;
+    }
+    try {
+        const values = {};
+        for (const [name, sealed] of Object.entries(record.sealedFields)) {
+            if (only && !only.includes(name)) {
+                continue;
+            }
+            if (!opened.has(sealed)) {
+                const { decryptEnvelopedDataWithKeys } = await import("../crypto/smime.js");
+                const value = JSON.parse(new TextDecoder().decode(await decryptEnvelopedDataWithKeys(fromBase64(sealed), keys)));
+                // The mailbox locked while this was opened: the lock's clear has already run, so nothing is kept or shown.
+                if (!getUnlockedKeys(record.mailboxUid)) {
+                    return undefined;
+                }
+                opened.set(sealed, value);
+            }
+            values[name] = opened.get(sealed);
+        }
+        return only ? { ...record, ...values } : { ...record, ...values, [OPENED]: true };
+    }
+    catch {
+        return undefined;
+    }
+}
+let watchingKeys = false;
+/** Opened values go when keys are locked (which signing out does), so nothing opened outlives its key session. Subscribed when the
+ * first protected record is opened, not on import. */
+function forgetOnLock() {
+    if (watchingKeys) {
+        return;
+    }
+    watchingKeys = true;
+    subscribeKeySession((event) => {
+        if (event.state === "locked") {
+            clearSealedRecords();
+        }
+    });
+}
+/** `records` with every protected one this device can open shown with its real values - only the fields in `only`, when given (a list
+ * shows a contact's name before anyone asks for its phone numbers: each field is one decryption). Never rejects. */
+export async function openSealedRecords(records, only) {
+    if (!records.some(isProtectedRecord)) {
+        return records;
+    }
+    forgetOnLock();
+    return Promise.all(records.map(async (record) => (isProtectedRecord(record) ? ((await openRecord(record, only)) ?? record) : record)));
+}
+/** `der` (a blob the server sealed to `mailboxUid`'s zero-access key, e.g. a protected contact's photo) opened, or `undefined` when this
+ * device can't (the mailbox is locked, or it isn't its key). */
+export async function openSealedBytes(mailboxUid, der) {
+    const keys = getUnlockedKeys(mailboxUid)?.zeroAccessKeys;
+    if (!keys?.length) {
+        return undefined;
+    }
+    try {
+        const { decryptEnvelopedDataWithKeys } = await import("../crypto/smime.js");
+        const bytes = await decryptEnvelopedDataWithKeys(der, keys);
+        // Locked while it was opened: not handed out.
+        return getUnlockedKeys(mailboxUid) ? bytes : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** A field's value for comparing what a write sends with what was shown: every empty form (`null`, `undefined`, `""`, `[]`) is one. */
+function comparable(value) {
+    return value === null || value === undefined || value === "" || (Array.isArray(value) && value.length === 0) ? "" : JSON.stringify(value);
+}
+/**
+ * `input` as written to `shown` - the record the edit started from, as this device showed it: unchanged when `shown` isn't protected.
+ * Otherwise without the protected fields (those `shown.sealedFields` names) whose values are what `shown` has: an opened record's write
+ * sends only what changed, and a placeholder a record that couldn't be opened showed is never sent back as its value. A field of an opened
+ * record that held a value and is emptied is named in `clearedFields`: restapi applies an empty value of a sealed field as a clear only
+ * then (`ZeroAccessRouteSealing.takeClearedFields()`), since an empty placeholder sent back by a client that couldn't open the record would
+ * otherwise wipe the sealed value for good. `opened`: `shown` holds the real values (by default, whether it was opened here).
+ */
+export function protectedRecordWrite(shown, input, opened = isOpenedRecord(shown)) {
+    if (!isProtectedRecord(shown)) {
+        return input;
+    }
+    const changes = { ...input };
+    const clearedFields = [];
+    for (const field of Object.keys(shown.sealedFields)) {
+        if (!(field in changes)) {
+            continue;
+        }
+        const value = comparable(changes[field]);
+        if (value === comparable(shown[field])) {
+            delete changes[field];
+        }
+        else if (value === "" && opened) {
+            clearedFields.push(field);
+        }
+    }
+    return (clearedFields.length > 0 ? { ...changes, clearedFields } : changes);
+}
+/** `openSealedRecords()` for one record. */
+export async function openSealedRecord(record, only) {
+    return (await openSealedRecords([record], only))[0];
+}

package/lib/admin/domainsApi.ts

@@ -90,7 +90,7 @@ export function verifyDomain(uid: string, client?: ApiClient): Promise<Domain> {
     return withClient(client, `/mail/domains/${encodeURIComponent(uid)}/verify`, { method: "POST" });
 }
 
-export type DnsRecordType = "ownership" | "mx" | "spf" | "dkim" | "dmarc" | "autodiscover_cname" | "autodiscover_srv";
+export type DnsRecordType = "ownership" | "mx" | "spf" | "dkim" | "dmarc" | "openpgpkey_cname" | "autodiscover_cname" | "autodiscover_srv";
 
 /** One mail-related DNS record this server recommends for a domain, live-checked against real DNS —
  * purely diagnostic, never mutates anything (unlike `verifyDomain`). The two `autodiscover_*` types are only

package/lib/calendar/calendarApi.ts

@@ -7,8 +7,12 @@
  * expansion happens entirely client-side (see `apps/shared/lib/recurrence.ts`) — the backend stores/returns
  * `RecurrenceRule` as-is and does no RFC5545 expansion of its own. */
 
-import { ApiClient, withClient } from "../util/api.js";
+import { ApiClient, ApiRequestError, withClient } from "../util/api.js";
 import { ListParams, buildQuery } from "../util/apiQuery.js";
+import { INVALID_REQUEST_CODE, guardSealedMove } from "../zeroAccess/sealedMoves.js";
+import { isOpenedRecord, isProtectedRecord, openSealedRecord, openSealedRecords } from "../zeroAccess/sealedRecords.js";
+import { EVENT_CONTENT_FIELDS, type InvitationContent, invitationContentOf, isSealedContentOpened, markSealedContentOpened, protectedEventWrite } from "./protectedEvents.js";
+import { meetingLinkSecrets } from "../videoconf/protectedMeetings.js";
 
 export type AttendeeRole = "required" | "optional" | "resource";
 export type AttendeeResponseStatus = "needsAction" | "accepted" | "declined" | "tentative";
@@ -138,6 +142,10 @@ export interface CalendarEvent {
     /** Response-only. An event made from an invitation that reached a zero-access mailbox: its title, location and description are only
      * sealed to the mailbox's zero-access key (`title` is `[...]`). `apps/shared/calendar/sealedEvents.ts` opens them. */
     sealedContent?: { keyFingerprint: string; sealed: string };
+    /** Response-only. An event of a calendar zero-access encryption protects: its title, location and description, each sealed to the
+     * mailbox's zero-access key (the readable `title` is "Protected event"). Every function here returns events with them opened when the
+     * mailbox is unlocked (`lib/zeroAccess/sealedRecords.ts`); writes go through `protectedEvents.ts`. */
+    sealedFields?: Record<string, string> | null;
     /** Who may see the event's details - absent (or `null`, on a row stored before this existed) reads as `"default"`; see `visibilityOf()`. */
     visibility?: EventVisibility | null;
     /** Whether the guests may ask for the event to change (default `false`). Absent or `null` reads as the default; see `guestPermissionsOf()`. */
@@ -173,6 +181,22 @@ const EVENT_SORT = JSON.stringify({ uid: "ASC" });
  * `LIST_CALENDAR_EVENTS_MAX_PAGES` pages guards against looping forever should a server ever ignore
  * `page` and keep returning full pages.
  */
+/** What a list opens of a protected event: what the calendar views draw. Each field is one decryption, and a calendar lists every event
+ * it has - the rest (the description) is opened by the view that shows or edits it, by a search, and by a save. */
+export const EVENT_LIST_FIELDS = ["title", "location"] as const;
+
+/** `event` with every protected field opened, when only some were (a listed event) - for a write, which sends only what changed and
+ * invites with the whole content. The title of one whose `sealedContent` was opened stays: a row can hold both, and its per-field copy
+ * (`sealedFields.title`) is then an older title the sealed content's replaced (renamed since) - or, sealed without one, the same title
+ * `openSealedEvents()` already shows. */
+export async function fullyOpenedEvent<T extends CalendarEvent | undefined>(event: T): Promise<T> {
+    if (!event || !isProtectedRecord(event) || isOpenedRecord(event)) {
+        return event;
+    }
+    const full = await openSealedRecord(event);
+    return isSealedContentOpened(event) ? { ...full, title: event.title } : full;
+}
+
 export async function listCalendarEvents(folderUid: string, client?: ApiClient): Promise<CalendarEvent[]> {
     const events: CalendarEvent[] = [];
     for (let page = 0; page < LIST_CALENDAR_EVENTS_MAX_PAGES; page++) {
@@ -185,11 +209,14 @@ export async function listCalendarEvents(folderUid: string, client?: ApiClient):
             break;
         }
     }
-    return events;
+    return openSealedRecords(events, EVENT_LIST_FIELDS);
 }
 
-export function getCalendarEvent(uid: string, client?: ApiClient): Promise<CalendarEvent> {
-    return withClient(client, `/mail/calendar-events/${encodeURIComponent(uid)}`);
+/** An event the server returned, opened. */
+const opened = (event: CalendarEvent): Promise<CalendarEvent> => openSealedRecord(event);
+
+export async function getCalendarEvent(uid: string, client?: ApiClient): Promise<CalendarEvent> {
+    return opened(await withClient<CalendarEvent>(client, `/mail/calendar-events/${encodeURIComponent(uid)}`));
 }
 
 export interface CalendarEventInput {
@@ -221,10 +248,18 @@ export interface CalendarEventInput {
     guestsCanModify?: boolean;
     guestsCanInviteOthers?: boolean;
     guestsCanSeeGuestList?: boolean;
+    /**
+     * What the server sends a protected event's save-time invitations with (restapi `BaseCalendarEventRoute.takeInvitationContent()`).
+     * On a create, `{ defer: true }` holds them back for the save that follows - the event editor's, which attaches the video meeting and
+     * its link keys first - so attendees get one invitation, the one with the link. On an update, `{ defer: true }` sends none with this
+     * save either (they stay pending), and a content (`title`...) is what `updateCalendarEvent()` invites with when `current` couldn't be
+     * opened on this device - the content it opened wins otherwise.
+     */
+    invitationContent?: Partial<InvitationContent> & { defer?: boolean };
 }
 
-export function createCalendarEvent(input: CalendarEventInput, client?: ApiClient): Promise<CalendarEvent> {
-    return withClient(client, "/mail/calendar-events", {
+export async function createCalendarEvent(input: CalendarEventInput, client?: ApiClient): Promise<CalendarEvent> {
+    const created = await withClient<CalendarEvent>(client, "/mail/calendar-events", {
         method: "POST",
         body: JSON.stringify({
             allDay: false,
@@ -236,6 +271,7 @@ export function createCalendarEvent(input: CalendarEventInput, client?: ApiClien
             ...input,
         }),
     });
+    return opened(created);
 }
 
 export interface UpdateCalendarEventInput extends Partial<CalendarEventInput> {
@@ -243,10 +279,87 @@ export interface UpdateCalendarEventInput extends Partial<CalendarEventInput> {
     version: number;
 }
 
-export function updateCalendarEvent(input: UpdateCalendarEventInput, client?: ApiClient): Promise<CalendarEvent> {
-    return withClient(client, `/mail/calendar-events/${encodeURIComponent(input.uid)}`, {
-        method: "PUT",
-        body: JSON.stringify(input),
+/** Saves `input`. `current` is the event as this device shows it: for an event of a protected calendar, the write then sends only the
+ * content that changed, and the content the server invites with (`protectedEventWrite()`; `input.invitationContent` when `current` isn't
+ * opened, none with `{ defer: true }`). For an event whose video meeting is protected,
+ * every attendee's link key goes with it (`meetingLinkSecrets()`), for the server to add to their links in the invitations it sends. */
+export function updateCalendarEvent(input: UpdateCalendarEventInput, client?: ApiClient, current?: CalendarEvent): Promise<CalendarEvent> {
+    // A move of a protected event to another mailbox is refused (`SealedMoveError`), before anything is opened or sent when `current` says so.
+    return guardSealedMove(current, input.mailboxUid, () => saveCalendarEvent(input, client, current));
+}
+
+/** The title restapi shows for an event whose title is sealed (its `PROTECTED_SUBJECT`). */
+const PLACEHOLDER_TITLE = "[...]";
+
+/** What `SealedEventContentError` says. */
+export const SEALED_EVENT_CONTENT_MESSAGE =
+    "This event came from an invitation to a zero-access mailbox and its details are sealed, so its location or description can only be changed together with its title. Unlock your mailbox, open the event again and make the change there.";
+
+/**
+ * restapi's refusal (409) of a location or description change to an event made from a zero-access invitation (`sealedContent`) sent
+ * with its placeholder title or none: resealing would lose the title. `saveCalendarEvent()` leaves out the placeholders of one it hasn't
+ * opened, so this comes back only when this device didn't know the event was sealed (it was filed sealed after it was loaded). An
+ * `ApiRequestError` (409), as `SealedMoveError` is, so the event dialog and the drag handler show its message.
+ */
+export class SealedEventContentError extends ApiRequestError {
+    constructor() {
+        super(SEALED_EVENT_CONTENT_MESSAGE, 409, "sealed-event-content");
+        this.name = "SealedEventContentError";
+    }
+}
+
+/** Whether `err` is restapi's refusal of `body`, a write carrying a location or description without a real title. */
+function isSealedContentTitleRefusal(err: unknown, body: Record<string, any>): boolean {
+    const hasValue = (field: string): boolean => body[field] !== undefined && body[field] !== null && body[field] !== "";
+    return (
+        err instanceof ApiRequestError &&
+        err.status === 409 &&
+        err.code === INVALID_REQUEST_CODE &&
+        (body.title === undefined || body.title === PLACEHOLDER_TITLE) &&
+        ["location", "description", "descriptionHtml"].some(hasValue)
+    );
+}
+
+async function saveCalendarEvent(input: UpdateCalendarEventInput, client: ApiClient | undefined, current: CalendarEvent | undefined): Promise<CalendarEvent> {
+    current = await fullyOpenedEvent(current);
+    const { invitationContent: given, ...changes } = input;
+    const body: Record<string, any> = protectedEventWrite(current, changes);
+    if (given?.defer) {
+        body.invitationContent = { defer: true };
+    } else if (given?.title && !body.invitationContent && isProtectedRecord(current)) {
+        body.invitationContent = { title: given.title, location: given.location, description: given.description, descriptionHtml: given.descriptionHtml };
+    }
+    // A save that defers its invitations sends no link keys either: they go with the save that invites.
+    const secrets = given?.defer
+        ? undefined
+        : await meetingLinkSecrets(
+              { videoMeetingUid: input.videoMeetingUid ?? current?.videoMeetingUid, attendees: input.attendees ?? current?.attendees, organizer: current?.organizer ?? input.organizer },
+              client,
+          );
+    if (secrets) {
+        body.invitationContent = { ...(body.invitationContent ?? {}), meetingLinkSecrets: secrets };
+    }
+    let updated: CalendarEvent;
+    try {
+        updated = await withClient<CalendarEvent>(client, `/mail/calendar-events/${encodeURIComponent(input.uid)}`, {
+            method: "PUT",
+            body: JSON.stringify(body),
+        });
+    } catch (err) {
+        throw isSealedContentTitleRefusal(err, body) ? new SealedEventContentError() : err;
+    }
+    if (!updated.sealedContent || !isSealedContentOpened(current)) {
+        return opened(updated);
+    }
+    // An event made from a zero-access invitation, opened here, comes back with its placeholders: shown with the content this save sealed
+    // again (`protectedEventWrite()` sends all of it, or none and the sealed content stays), so a save that follows still writes it whole.
+    const content = Object.fromEntries(EVENT_CONTENT_FIELDS.map((field) => [field, field in body ? body[field] : current![field]]));
+    return markSealedContentOpened({
+        ...(await opened(updated)),
+        title: content.title ?? "",
+        location: content.location ?? undefined,
+        description: content.description ?? null,
+        descriptionHtml: content.descriptionHtml ?? null,
     });
 }
 
@@ -265,17 +378,21 @@ export type AttendeeResponseInput = Exclude<AttendeeResponseStatus, "needsAction
  * `"accepted"`/`"tentative"` the whole updated `CalendarEvent` comes back, with only the calling
  * attendee's own `responseStatus` changed. On `"declined"`, the backend instead soft-deletes the
  * mailbox's own copy of the event and returns only `{ uid }` — the caller should treat a decline the
- * same as a delete rather than expecting an updated event back.
+ * same as a delete rather than expecting an updated event back. `current` (the event as this device shows it) names a protected event's
+ * reply by its real title (`invitationContentOf()`).
  */
-export function respondToEvent(
+export async function respondToEvent(
     uid: string,
     responseStatus: AttendeeResponseInput,
     client?: ApiClient,
+    current?: CalendarEvent,
 ): Promise<CalendarEvent | { uid: string }> {
-    return withClient(client, `/mail/calendar-events/${encodeURIComponent(uid)}/respond`, {
+    const invitationContent = invitationContentOf(await fullyOpenedEvent(current));
+    const result = await withClient<CalendarEvent | { uid: string }>(client, `/mail/calendar-events/${encodeURIComponent(uid)}/respond`, {
         method: "POST",
-        body: JSON.stringify({ responseStatus }),
+        body: JSON.stringify(invitationContent ? { responseStatus, invitationContent } : { responseStatus }),
     });
+    return "mailboxUid" in result ? opened(result) : result;
 }
 
 /** A change a guest asks the organizer for (`requestEventChange()`): only what is to differ. */
@@ -304,11 +421,17 @@ export interface EventChangeRequestResult {
  * Asks the organizer to change an event, as a guest (not the organizer) whose copy allows it: the title, location, description or time need
  * `guestsCanModify`, added guests need `guestsCanInviteOthers` (403 otherwise; 400 when nothing differs from what the event has, or a value is invalid).
  * Nothing changes on this mailbox's own copy - the request is mailed to the organizer, and when the change is allowed it is applied there and
- * arrives back later as an ordinary update of the invitation.
+ * arrives back later as an ordinary update of the invitation. `invitationContent` (the event's real content, `invitationContentOf()`)
+ * names a protected event in the request by its real title.
  */
-export function requestEventChange(uid: string, request: EventChangeRequest, client?: ApiClient): Promise<EventChangeRequestResult> {
+export function requestEventChange(
+    uid: string,
+    request: EventChangeRequest,
+    client?: ApiClient,
+    invitationContent?: InvitationContent,
+): Promise<EventChangeRequestResult> {
     return withClient(client, `/mail/calendar-events/${encodeURIComponent(uid)}/request-change`, {
         method: "POST",
-        body: JSON.stringify(request),
+        body: JSON.stringify(invitationContent ? { ...request, invitationContent } : request),
     });
 }