@rapidmx/web-client 0.5.0 → 0.7.0

package/dist/apps/shared/components/mail/pinnedSigners.d.ts

@@ -0,0 +1,33 @@
+/**
+ * The trusted signing-key fingerprints for a received message's sender, for `evaluateMessageSecurity()`'s
+ * `pinnedSignerFingerprints`: the keys key discovery already pinned on the contacts in the reading mailbox's own
+ * contacts folder(s). Reads only stored contacts - never triggers a Discovery lookup, which must not happen on
+ * message receipt.
+ *
+ * `MessageDetailPane` renders once per opened message (and once per message in a thread), so each mailbox's
+ * contact list is fetched once and reused for `CONTACTS_CACHE_TTL_MS`; a failed load isn't cached. Any failure
+ * leaves the caller with no pins, which `evaluateMessageSecurity()` reports as an unverified signer - never as
+ * verified.
+ *
+ * The cache is dropped (`clearPinnedSignerCache()`) whenever a key session locks (subscribed on first use), on sign-out
+ * (`AppShell`), and after the reader adds, edits or deletes contacts (the contacts pages) - so a contact removed
+ * because its key was revoked doesn't keep vouching for signatures until the TTL runs out.
+ */
+import { SignerKeyState } from "@rapidmx/react-shared/contacts/contactsApi.js";
+/** How long one mailbox's loaded contact list is reused before it is fetched again. */
+export declare const CONTACTS_CACHE_TTL_MS = 60000;
+/** Forgets every cached contact list - on sign-out, a key-session lock, after the reader changes their contacts, and
+ * in tests. */
+export declare function clearPinnedSignerCache(): void;
+/** The sender `address`'s pinned signing fingerprints from `mailboxUid`'s contacts. Rejects if they can't be loaded. */
+export declare function getPinnedSignerFingerprints(mailboxUid: string, address: string): Promise<string[]>;
+/** A sender's signing-key state (`signerKeyStateFor()`) plus what a key-changed notice needs to show and link. */
+export interface SenderKeyState extends SignerKeyState {
+    /** The contact holding the first pinned signing key, else the one holding the conflict, else the first match. */
+    contactUid?: string;
+    /** When the first pinned signing key started being trusted - see `keyPinnedSince()`. */
+    pinnedSince?: number;
+}
+/** The sender `address`'s signing-key state from `mailboxUid`'s (cached) contacts, for a "signing key changed" comparison
+ * or to spot a recorded conflict. Reads stored contacts only. Rejects if they can't be loaded. */
+export declare function getSignerKeyState(mailboxUid: string, address: string): Promise<SenderKeyState>;

package/dist/apps/shared/components/mail/verificationSeals.d.ts

@@ -0,0 +1,22 @@
+import { type Message } from "@rapidmx/react-shared/mail/mailApi.js";
+import type { SealToWrite } from "@rapidmx/react-shared/crypto/messageSecurity.js";
+/** How long one mailbox's vault generation is reused before it is read again. */
+export declare const VAULT_GENERATION_TTL_MS = 60000;
+/** Forgets the cached vault generations and this session's seal writes - in tests. */
+export declare function clearVerificationSealCache(): void;
+/** Reads `mailboxUid`'s current vault `masterKeyGeneration`, uncached: `undefined` when the vault can't be read or
+ * reports none. Never rejects. */
+export declare function readVaultGeneration(mailboxUid: string): Promise<number | undefined>;
+/** `mailboxUid`'s current vault `masterKeyGeneration`, or `undefined` when it can't be read. Never rejects. */
+export declare function getVaultGeneration(mailboxUid: string): Promise<number | undefined>;
+/** The seal to check `message` against: the one this session stored for it when that is newer than the message's own
+ * copy (which may predate the write), else the message's `verificationSeal`/`verificationSealGeneration`. */
+export declare function currentVerificationSeal(message: Pick<Message, "uid" | "verificationSeal" | "verificationSealGeneration">): {
+    seal?: string;
+    sealGeneration?: number;
+};
+/** Whether `sendVerificationSeal()` would still send a seal for `messageUid` at `generation`. */
+export declare function verificationSealPending(messageUid: string, generation: number): boolean;
+/** Stores `sealToWrite` on `messageUid`, best effort - see this module's doc comment. Resolves `true` when a request was
+ * sent, `false` when the write was skipped as already attempted. Never rejects. */
+export declare function sendVerificationSeal(messageUid: string, sealToWrite: SealToWrite): Promise<boolean>;

package/dist/apps/shared/components/mail/writableMailboxes.d.ts

@@ -0,0 +1,15 @@
+import type { Mailbox } from "@rapidmx/react-shared/mail/mailApi.js";
+/** `true` writable, `false` known view-only, `undefined` couldn't tell (treated as writable). */
+export type MailboxWritability = boolean | undefined;
+/** Forgets every cached answer - for tests, and anything that changes the caller's access mid-session. */
+export declare function clearMailboxWritabilityCache(): void;
+/** The already-known answer for `mailbox`, without making a request. */
+export declare function peekMailboxWritability(mailbox: Mailbox, userUid: string | undefined, trusted?: boolean): MailboxWritability;
+/** Whether the caller can create items in `mailbox`. Never rejects. */
+export declare function getMailboxWritability(mailbox: Mailbox, userUid: string | undefined, trusted?: boolean): Promise<MailboxWritability>;
+/** Per-mailbox writability answers for `mailboxes`, filled in as each one arrives (already-known answers are
+ * present from the first render). */
+export declare function useMailboxWritability(mailboxes: Mailbox[], userUid: string | undefined, trusted?: boolean): Record<string, MailboxWritability>;
+/** `mailboxes` minus any known to be view-only, always keeping `keepUid` (the picker's current/default value,
+ * so the control never shows a value missing from its own options). Lists everything until told otherwise. */
+export declare function useWritableMailboxes(mailboxes: Mailbox[], userUid: string | undefined, keepUid?: string, trusted?: boolean): Mailbox[];

package/dist/apps/shared/components/rules/RuleBuilder.d.ts

@@ -0,0 +1,70 @@
+import React, { ReactNode } from "react";
+/** One condition field this scope's `Conditions` shape supports — `"list"` renders an add/remove chip
+ * editor for a `string[]` field, `"boolean"` a plain checkbox, `"select"` a fixed-choice dropdown for a
+ * field with a small closed set of string values (e.g. `MailFilterConditions.importance`). */
+export interface ConditionFieldDef {
+    key: string;
+    label: string;
+    kind: "list" | "boolean" | "select";
+    placeholder?: string;
+    /** Required when `kind` is `"select"` — the fixed set of values this field may hold, plus an
+     * implicit "Any" option that clears the field entirely. */
+    options?: {
+        value: string;
+        label: string;
+    }[];
+}
+/** One action type this scope's `Action` union supports — the per-scope registry the shared condition
+ * editor/chrome below is deliberately kept out of (transport-rule and mail-filter actions are
+ * different enough vocabularies that one component special-casing both would be worse than this). */
+export interface ActionTypeDef<A> {
+    value: string;
+    label: string;
+    /** Builds a fresh default action of this type when picked from "Add action". */
+    createDefault: () => A;
+    /** Renders this action's own type-specific fields (e.g. header name/value). `null` for an action
+     * type with nothing further to configure. */
+    render: (action: A, onChange: (next: A) => void) => ReactNode;
+}
+export interface RuleBuilderValue<C extends object, A extends {
+    type: string;
+}> {
+    enabled: boolean;
+    sequence: number;
+    stopProcessingRules: boolean;
+    conditions: C;
+    actions: A[];
+}
+export interface RuleBuilderProps<C extends object, A extends {
+    type: string;
+}> {
+    value: RuleBuilderValue<C, A>;
+    onChange: (next: RuleBuilderValue<C, A>) => void;
+    conditionFields: ConditionFieldDef[];
+    actionTypes: ActionTypeDef<A>[];
+    /** Set by the page once the user has tried to save a rule `hasConditions()` rejects - turns the
+     * "add at least one condition" hint into an error. */
+    showValidation?: boolean;
+}
+/**
+ * Whether `conditions` holds at least one real condition: a list with a non-blank entry, a ticked
+ * boolean, or a chosen select value. A rule with none would match *every* message, so the pages that save
+ * a `RuleBuilder` value (mail filters, transport rules) must refuse to save unless this returns `true`.
+ */
+export declare function hasConditions(conditions: object): boolean;
+/**
+ * Shared condition-row editor and enabled/sequence/stop-processing chrome for a rule that matches
+ * conditions and runs actions in order — `TransportRule` (admin, org-wide) and `MailFilterRule`
+ * (mailbox-scoped) both have this same `{enabled, sequence, stopProcessingRules, conditions, actions}`
+ * shape. Conditions are driven by a declarative `conditionFields` list so both scopes share this one
+ * editor despite their `Conditions` types not being identical — `MailFilterConditions.importance`
+ * (`MailFilterRule`'s one condition field `TransportRuleConditions` has no equivalent of) is what forced
+ * this list beyond `"list"`/`"boolean"` to add a third `"select"` kind for a small fixed-choice field,
+ * confirming the shared editor still generalizes rather than needing a fork; actions are driven by a
+ * small per-scope `actionTypes` registry instead, since the two action vocabularies (reject/quarantine/
+ * add-header/add-recipient vs. move/copy/delete/mark-read/forward) are different enough that one
+ * component special-casing both would be worse than this split.
+ */
+export default function RuleBuilder<C extends object, A extends {
+    type: string;
+}>({ value, onChange, conditionFields, actionTypes, showValidation, }: RuleBuilderProps<C, A>): React.JSX.Element;

package/dist/apps/shared/components/settings/layout/SettingsShell.d.ts

@@ -0,0 +1,41 @@
+import React, { PropsWithChildren } from "react";
+import { Mailbox } from "@rapidmx/react-shared/mail/mailApi.js";
+import { AppShellProps } from "../../layout/AppShell.js";
+import { PluginNav } from "../../../plugins/pluginNav.js";
+export interface SettingsSectionDef {
+    id: string;
+    href: string;
+    label: string;
+}
+/** Every settings section with its own sidebar entry. */
+export declare const SETTINGS_SECTIONS: SettingsSectionDef[];
+/** A `SETTINGS_SECTIONS` id, or a plugin's `settingsSections` item id (see `PluginNav`). */
+export type SettingsSectionId = string;
+/** `SETTINGS_SECTIONS` followed by the plugins' `settingsSections` items, core ids winning - see
+ * `mergePluginNavItems`. */
+export declare function settingsSections(pluginNav?: PluginNav): SettingsSectionDef[];
+export interface SettingsShellProps extends Omit<AppShellProps, "active"> {
+    /** Which entry in `SETTINGS_SECTIONS` (or plugin `settingsSections` item) is highlighted in this shell's own sidebar — distinct from
+     * `AppShell`'s own `active` (always hardcoded to `"settings"` below), since Settings isn't a rail
+     * icon (see `AppShell.tsx`'s `AppShellApp` doc comment) but still needs its own section
+     * highlighting. Each settings page passes its own section id explicitly, the same "gotcha" this
+     * plan already calls out for every shell's `active` prop. */
+    active: SettingsSectionId;
+}
+export interface SettingsShellContextValue {
+    /** The mailbox currently selected (`?mailboxUid=`, or the caller's first accessible mailbox) —
+     * every settings section so far (Automatic Replies) edits mailbox-scoped fields. */
+    mailboxUid?: string;
+    mailboxes: Mailbox[];
+}
+/** Reads the mailbox Settings is currently scoped to, as resolved by the enclosing `SettingsShell`. */
+export declare function useSettingsShell(): SettingsShellContextValue;
+/**
+ * The Settings area's shell — reached via a `UserMenu` entry rather than a 5th `AppShell` icon (per
+ * this plan's own confirmed decision), so it always passes `active="settings"` to `AppShell` regardless
+ * of which section is showing. Unlike `ContactsShell`/`TasksShell` (whose sidebar is just a mailbox
+ * switcher, since each has exactly one well-known folder), this shell's sidebar is a real list of
+ * settings sections (`SETTINGS_SECTIONS`) — full-page navigation between them, same as the top-level
+ * app rail, since this framework has no client-side router.
+ */
+export default function SettingsShell({ active, userUid, authServerUrl, impersonating, impersonationBaseUrl, trusted, pluginNav, children, }: PropsWithChildren<SettingsShellProps>): React.JSX.Element;

package/dist/apps/shared/components/settings/layout/SettingsShell.js

@@ -12,19 +12,27 @@ import Alert from "@rapidmx/react-shared/components/feedback/Alert.js";
 import Skeleton, { SkeletonList } from "@rapidmx/react-shared/components/feedback/Skeleton.js";
 import AppShell from "../../layout/AppShell.js";
 import MailboxProvisioning from "../../layout/MailboxProvisioning.js";
+import { mergePluginNavItems } from "../../../plugins/pluginNav.js";
 /** Every settings section with its own sidebar entry. */
 export const SETTINGS_SECTIONS = [
     { id: "auto-reply", href: "/settings/auto-reply", label: "Automatic Replies" },
     { id: "filters", href: "/settings/filters", label: "Mail Filters" },
     { id: "signatures", href: "/settings/signatures", label: "Signatures" },
     { id: "labels", href: "/settings/labels", label: "Labels" },
-    { id: "focused-inbox", href: "/settings/focused-inbox", label: "Focused Inbox" },
     { id: "read-receipts", href: "/settings/read-receipts", label: "Read Receipts" },
-    { id: "booking-types", href: "/settings/booking-types", label: "Booking Links" },
     { id: "encryption", href: "/settings/encryption", label: "Encryption" },
     { id: "sharing", href: "/settings/sharing", label: "Sharing" },
     { id: "privacy", href: "/settings/privacy", label: "Privacy & Data" },
 ];
+/** `SETTINGS_SECTIONS` followed by the plugins' `settingsSections` items, core ids winning - see
+ * `mergePluginNavItems`. */
+export function settingsSections(pluginNav) {
+    return mergePluginNavItems(SETTINGS_SECTIONS, pluginNav?.settingsSections, ({ id, href, label }) => ({
+        id,
+        href,
+        label,
+    }));
+}
 const SettingsShellContext = createContext({ mailboxes: [] });
 /** Reads the mailbox Settings is currently scoped to, as resolved by the enclosing `SettingsShell`. */
 export function useSettingsShell() {
@@ -38,7 +46,7 @@ export function useSettingsShell() {
  * settings sections (`SETTINGS_SECTIONS`) — full-page navigation between them, same as the top-level
  * app rail, since this framework has no client-side router.
  */
-export default function SettingsShell({ active, userUid, authServerUrl, impersonating, impersonationBaseUrl, trusted, children, }) {
+export default function SettingsShell({ active, userUid, authServerUrl, impersonating, impersonationBaseUrl, trusted, pluginNav, children, }) {
     const [status, setStatus] = useState("checking");
     const [error, setError] = useState(null);
     const [mailboxes, setMailboxes] = useState([]);
@@ -77,16 +85,17 @@ export default function SettingsShell({ active, userUid, authServerUrl, imperson
         inner = (_jsx("div", { className: "flex-1 flex items-center justify-center p-8", children: _jsx("div", { className: "w-full max-w-md", children: _jsx(Alert, { children: error }) }) }));
     }
     else if (userUid && status === "ready") {
+        const sections = settingsSections(pluginNav);
         // A function, not a plain JSX constant — same reasoning as ContactsShell's identical comment:
         // rendered twice (desktop `<aside>` + mobile `Drawer`), possibly simultaneously mounted, so the
         // `<select>`'s `id`/its `<label>`'s `htmlFor` need a distinct value per instance.
         const sidebarContent = (idPrefix) => (_jsxs(_Fragment, { children: [mailboxes.length > 1 && (_jsxs("div", { children: [_jsx("label", { className: "block text-xs font-bold uppercase tracking-wide text-text-muted mb-1", htmlFor: `${idPrefix}-settings-mailbox-switcher`, children: "Mailbox" }), _jsx("select", { id: `${idPrefix}-settings-mailbox-switcher`, className: "w-full text-sm border border-border rounded-sm py-1.5 px-2 bg-surface", value: mailboxUid, onChange: (e) => {
-                                // `active` always names a real entry in `SETTINGS_SECTIONS` — every settings
-                                // page passes its own section id explicitly (see `SettingsShellProps.active`'s
-                                // own doc comment), so this lookup can't miss.
-                                const section = SETTINGS_SECTIONS.find((s) => s.id === active);
-                                window.location.href = `${section.href}?mailboxUid=${encodeURIComponent(e.target.value)}`;
-                            }, children: mailboxes.map((mb) => (_jsxs("option", { value: mb.uid, children: [mb.displayName, mb.ownerUserUid ? "" : " (shared)"] }, mb.uid))) })] })), _jsx("nav", { "aria-label": "Settings sections", className: "flex flex-col gap-0.5", children: SETTINGS_SECTIONS.map((section) => (_jsx("a", { 
+                                // Every core settings page passes its own section id (see
+                                // `SettingsShellProps.active`), but a plugin page's section is missing when the
+                                // server didn't send its nav item, so that falls back to the current path.
+                                const href = sections.find((s) => s.id === active)?.href ?? window.location.pathname;
+                                window.location.href = `${href}?mailboxUid=${encodeURIComponent(e.target.value)}`;
+                            }, children: mailboxes.map((mb) => (_jsxs("option", { value: mb.uid, children: [mb.displayName, mb.ownerUserUid ? "" : " (shared)"] }, mb.uid))) })] })), _jsx("nav", { "aria-label": "Settings sections", className: "flex flex-col gap-0.5", children: sections.map((section) => (_jsx("a", { 
                         // `inner` (this whole branch) is only ever computed once `status === "ready"`
                         // and `mailboxUid` has already resolved truthy — a falsy `mailboxUid` returns
                         // `<MailboxProvisioning />` above instead (and TypeScript's own narrowing of
@@ -100,5 +109,5 @@ export default function SettingsShell({ active, userUid, authServerUrl, imperson
                         ].join(" "), children: section.label }, section.id))) })] }));
         inner = (_jsxs(_Fragment, { children: [_jsx("aside", { className: "hidden md:flex w-56 shrink-0 bg-surface border-r border-border flex-col p-3 gap-3", children: sidebarContent("desktop") }), _jsx(Drawer, { open: drawerOpen, onClose: () => setDrawerOpen(false), title: "Settings", children: _jsx("div", { className: "flex flex-col gap-3", children: sidebarContent("mobile") }) }), _jsxs("main", { className: "flex-1 min-w-0 flex flex-col", children: [_jsx("button", { type: "button", className: "md:hidden m-3 self-start w-9 h-9 flex items-center justify-center rounded-sm text-text-muted hover:bg-surface-alt hover:text-text", "aria-label": "Open settings menu", onClick: () => setDrawerOpen(true), children: _jsx(HiOutlineBars3, { size: 20, "aria-hidden": "true" }) }), _jsx(SettingsShellContext.Provider, { value: contextValue, children: children })] })] }));
     }
-    return (_jsx(AppShell, { active: "settings", userUid: userUid, authServerUrl: authServerUrl, impersonating: impersonating, impersonationBaseUrl: impersonationBaseUrl, trusted: trusted, children: inner }));
+    return (_jsx(AppShell, { active: "settings", userUid: userUid, authServerUrl: authServerUrl, impersonating: impersonating, impersonationBaseUrl: impersonationBaseUrl, trusted: trusted, pluginNav: pluginNav, children: inner }));
 }

package/dist/apps/shared/components/tasks/TasksSidebar.d.ts

@@ -0,0 +1,41 @@
+import React from "react";
+import { Task } from "@rapidmx/react-shared/tasks/tasksApi.js";
+export type TasksView = {
+    type: "myDay";
+} | {
+    type: "important";
+} | {
+    type: "planned";
+} | {
+    type: "assignedToMe";
+} | {
+    type: "flagged";
+} | {
+    type: "all";
+} | {
+    type: "list";
+    uid: string;
+    name: string;
+};
+export declare function tasksViewKey(view: TasksView): string;
+export interface TasksSidebarProps {
+    mailboxUid?: string;
+    /** The caller's own (incomplete) tasks — used to compute every smart-filter's count. Deliberately not
+     * fetched again here; the parent already has this loaded for the main list. */
+    tasks: Task[];
+    userUid?: string;
+    active: TasksView;
+    onSelect: (view: TasksView) => void;
+    /** Bumped by the parent to force a contact-list-style re-fetch of task lists (mirrors
+     * `ContactsSidebar`'s identical prop) — not currently used by any caller, kept for parity/future use. */
+    refreshToken?: number;
+}
+/**
+ * Tasks' Outlook To-Do-style left sidebar. "My Day"/"Assigned to me" are real persisted fields
+ * (`Task.myDay`/`assignedTo`, from Phase 0); "Important"/"Planned" are pure smart-filters derived from
+ * already-loaded fields (`priority === "high"`/`dueDate != null`) with no backend concept of their own;
+ * "Flagged email" is a `Message` smart-filter (see `flaggedMessages.ts`), not a `Task` one at all — the
+ * page renders it as a distinct list, not the task table. "Tasks" is the flat, unfiltered default. Custom
+ * lists are real `TaskList` records, fetched here (same pattern as `ContactsSidebar`'s contact lists).
+ */
+export default function TasksSidebar({ mailboxUid, tasks, userUid, active, onSelect, refreshToken }: TasksSidebarProps): React.JSX.Element;

package/dist/apps/shared/components/tasks/TasksToolbar.d.ts

@@ -0,0 +1,14 @@
+import React from "react";
+export type TasksViewMode = "list" | "grid";
+export interface TasksToolbarProps {
+    viewMode: TasksViewMode;
+    onViewModeChange: (mode: TasksViewMode) => void;
+    selectedCount: number;
+    onComplete: () => void;
+    onDelete: () => void;
+    onAddToMyDay: () => void;
+}
+/** Tasks' toolbar: a Grid/List view-mode toggle (local, not persisted) plus bulk actions for whatever
+ * rows are checked (Complete, Add to My Day, Delete) — deliberately presentational, matching
+ * `ContactsToolbar`'s convention, since the page owns the actual task data/selection. */
+export default function TasksToolbar({ viewMode, onViewModeChange, selectedCount, onComplete, onDelete, onAddToMyDay }: TasksToolbarProps): React.JSX.Element;

package/dist/apps/shared/components/tasks/layout/TasksShell.d.ts

@@ -0,0 +1,24 @@
+import React, { PropsWithChildren } from "react";
+import { Mailbox } from "@rapidmx/react-shared/mail/mailApi.js";
+import { AppShellProps } from "../../layout/AppShell.js";
+export type TasksShellProps = Omit<AppShellProps, "active">;
+export interface TasksShellContextValue {
+    /** The mailbox currently selected (`?mailboxUid=`, or the caller's first accessible mailbox). */
+    mailboxUid?: string;
+    /** The selected mailbox's single `tasks`-type folder. */
+    folderUid?: string;
+    mailboxes: Mailbox[];
+    /** The caller's own uid — exposed here (rather than only as `AppShell`'s prop) so the page content
+     * can compute "assigned to me" without needing it threaded through separately. */
+    userUid?: string;
+}
+/** Reads the mailbox/folder Tasks is currently showing, as resolved by the enclosing `TasksShell`. */
+export declare function useTasksShell(): TasksShellContextValue;
+/**
+ * The Tasks app's shell — structurally identical to `ContactsShell` (a mailbox has exactly one
+ * well-known `tasks` folder, guaranteed to exist by `BaseMailboxRoute.create()`'s eager provisioning
+ * in `@rapidmx/restapi`), just bound to a different folder type. Kept as its own small component
+ * (rather than a single generic "SingleFolderShell" parameterized by type) so each app's sidebar can
+ * grow its own app-specific controls later without threading extra props through a shared one.
+ */
+export default function TasksShell({ userUid, authServerUrl, impersonating, impersonationBaseUrl, trusted, pluginNav, children, }: PropsWithChildren<TasksShellProps>): React.JSX.Element;

package/dist/apps/shared/components/tasks/layout/TasksShell.js

@@ -24,7 +24,7 @@ export function useTasksShell() {
  * (rather than a single generic "SingleFolderShell" parameterized by type) so each app's sidebar can
  * grow its own app-specific controls later without threading extra props through a shared one.
  */
-export default function TasksShell({ userUid, authServerUrl, impersonating, impersonationBaseUrl, trusted, children, }) {
+export default function TasksShell({ userUid, authServerUrl, impersonating, impersonationBaseUrl, trusted, pluginNav, children, }) {
     const [status, setStatus] = useState("checking");
     const [error, setError] = useState(null);
     const [mailboxes, setMailboxes] = useState([]);
@@ -88,5 +88,5 @@ export default function TasksShell({ userUid, authServerUrl, impersonating, impe
                             }, children: mailboxes.map((mb) => (_jsxs("option", { value: mb.uid, children: [mb.displayName, mb.ownerUserUid ? "" : " (shared)"] }, mb.uid))) })] })), folderError && _jsx(Alert, { children: folderError })] }));
         inner = (_jsxs(_Fragment, { children: [_jsx("aside", { className: "hidden md:flex w-56 shrink-0 bg-surface border-r border-border flex-col p-3 gap-3", children: sidebarContent("desktop") }), _jsx(Drawer, { open: drawerOpen, onClose: () => setDrawerOpen(false), title: "Mailbox", children: _jsx("div", { className: "flex flex-col gap-3", children: sidebarContent("mobile") }) }), _jsxs("main", { className: "flex-1 min-w-0 flex flex-col", children: [(mailboxes.length > 1 || folderError) && (_jsx("button", { type: "button", className: "md:hidden m-3 w-9 h-9 flex items-center justify-center rounded-sm text-text-muted hover:bg-surface-alt hover:text-text", "aria-label": "Open mailbox switcher", onClick: () => setDrawerOpen(true), children: _jsx(HiOutlineBars3, { size: 20, "aria-hidden": "true" }) })), _jsx(TasksShellContext.Provider, { value: contextValue, children: children })] })] }));
     }
-    return (_jsx(AppShell, { active: "tasks", userUid: userUid, authServerUrl: authServerUrl, impersonating: impersonating, impersonationBaseUrl: impersonationBaseUrl, trusted: trusted, children: inner }));
+    return (_jsx(AppShell, { active: "tasks", userUid: userUid, authServerUrl: authServerUrl, impersonating: impersonating, impersonationBaseUrl: impersonationBaseUrl, trusted: trusted, pluginNav: pluginNav, children: inner }));
 }

package/dist/apps/shared/mail/findWellKnownFolderUid.d.ts

@@ -0,0 +1,5 @@
+import { FolderType } from "@rapidmx/react-shared/mail/mailApi.js";
+/** The uid of a mailbox's well-known folder of `type` (e.g. its Contacts or Tasks folder), for creating an
+ * item in a mailbox other than the one an app currently has loaded. Resolves `undefined` if the mailbox has
+ * no such folder; rejects if the folder list can't be fetched. */
+export declare function findWellKnownFolderUid(mailboxUid: string, type: FolderType): Promise<string | undefined>;

package/dist/apps/shared/mail/listAllPages.d.ts

@@ -0,0 +1,17 @@
+/** Page size the list pages (Contacts, Tasks) request per call - restapi caps `limit` at 500. */
+export declare const LIST_PAGE_SIZE = 500;
+/** Safety cap on pages fetched - stops a server that ignores `page` (and keeps returning a full first
+ * page) from looping forever. 40 pages x 500 = 20,000 items. */
+export declare const MAX_LIST_PAGES = 40;
+export interface ListAllPagesResult<T> {
+    items: T[];
+    /** `true` when fetching stopped at `maxPages` with the last page still full - there may be more items
+     * the caller isn't showing, so it should say so rather than presenting `items` as the whole list. */
+    truncated: boolean;
+}
+/**
+ * Fetches every page of a zero-based `limit`/`page` list endpoint, stopping at the first short page
+ * (fewer than `pageSize` items) - so a folder with more items than one page holds is shown in full
+ * rather than silently cut off at the first page. Stops at `maxPages` regardless, reporting `truncated`.
+ */
+export declare function listAllPages<T>(fetchPage: (page: number) => Promise<T[]>, pageSize?: number, maxPages?: number): Promise<ListAllPagesResult<T>>;

package/dist/apps/shared/plugins/pluginNav.d.ts

@@ -0,0 +1,39 @@
+/**
+ * One navigation entry a plugin contributes through its manifest's `ui` field. Structurally identical to
+ * `@rapidmx/restapi`'s `PluginUiNavItem`, defined locally so this package doesn't depend on restapi.
+ */
+export interface PluginUiNavItem {
+    /** Unique within its list. A plugin page passes this as its shell's `active` to highlight the entry. */
+    id: string;
+    label: string;
+    /** A same-origin path under the host's prefix (`/settings/...`, `/admin/...`, `/...`). */
+    href: string;
+}
+/**
+ * The navigation every enabled plugin with a successfully built UI contributes, supplied by the server's
+ * `WwwRoute`/`AdminConsoleRoute` `fetchProps` as the `pluginNav` page prop.
+ */
+export interface PluginNav {
+    /** Appended to `SettingsShell`'s section list. */
+    settingsSections?: PluginUiNavItem[];
+    /** Appended to `AdminShell`'s icon rail and mobile tab bar. */
+    adminNav?: PluginUiNavItem[];
+    /** Appended to `AppShell`'s app rail and mobile tab bar. */
+    appRail?: PluginUiNavItem[];
+}
+/** The page prop every www and admin page receives - extended by `AppShellProps` and `AdminShellProps`, so
+ * a page that spreads its props onto its shell passes `pluginNav` through with no code of its own. */
+export interface PluginNavProps {
+    pluginNav?: PluginNav;
+}
+/** A same-origin absolute path: starts with `/`, but not `//` or `/\` (both of which browsers treat as
+ * protocol-relative URLs to another host). */
+export declare function isSafePluginHref(href: string): boolean;
+/**
+ * Appends a plugin's nav items after the core ones. Skips any item that isn't well-formed, whose `href`
+ * isn't a same-origin path (see `isSafePluginHref`), or whose id is already taken - by a core item or
+ * `reservedIds` (core ids always win) or by an earlier plugin item.
+ */
+export declare function mergePluginNavItems<T extends {
+    id: string;
+}>(coreItems: T[], pluginItems: PluginUiNavItem[] | undefined, toItem: (item: PluginUiNavItem) => T, reservedIds?: string[]): T[];

package/dist/apps/shared/plugins/pluginNav.js

@@ -0,0 +1,33 @@
+///////////////////////////////////////////////////////////////////////////////
+// Copyright (C) 2026 Jean-Philippe Steinmetz
+// SPDX-License-Identifier: MPL-2.0
+///////////////////////////////////////////////////////////////////////////////
+/** A same-origin absolute path: starts with `/`, but not `//` or `/\` (both of which browsers treat as
+ * protocol-relative URLs to another host). */
+export function isSafePluginHref(href) {
+    return /^\/(?![/\\])/.test(href);
+}
+/**
+ * Appends a plugin's nav items after the core ones. Skips any item that isn't well-formed, whose `href`
+ * isn't a same-origin path (see `isSafePluginHref`), or whose id is already taken - by a core item or
+ * `reservedIds` (core ids always win) or by an earlier plugin item.
+ */
+export function mergePluginNavItems(coreItems, pluginItems, toItem, reservedIds = []) {
+    if (!pluginItems?.length) {
+        return coreItems;
+    }
+    const taken = new Set([...coreItems.map((item) => item.id), ...reservedIds]);
+    const merged = [...coreItems];
+    for (const item of pluginItems) {
+        if (typeof item?.id !== "string" ||
+            typeof item.label !== "string" ||
+            typeof item.href !== "string" ||
+            !isSafePluginHref(item.href) ||
+            taken.has(item.id)) {
+            continue;
+        }
+        taken.add(item.id);
+        merged.push(toItem(item));
+    }
+    return merged;
+}

package/dist/apps/shared/search/LocalIndexLifecycle.d.ts

@@ -0,0 +1,13 @@
+import type { PublicKey } from "@rapidmx/react-shared/crypto/keyvaultApi.js";
+import type { Folder } from "@rapidmx/react-shared/mail/mailApi.js";
+export declare const POLL_INTERVAL_MS = 5000;
+export interface LocalIndexLifecycleProps {
+    mailboxUid?: string;
+    mailboxKeys?: PublicKey[];
+    folders: Folder[];
+    /** Every mailbox the signed-in user can currently access. Once known, indexes on this device for any
+     * other mailbox (e.g. left behind by a different user who never signed out) are removed. */
+    accessibleMailboxUids?: string[];
+}
+/** Renders nothing - pure side-effect component, mounted by `MailShell.tsx`. */
+export default function LocalIndexLifecycle({ mailboxUid, folders, accessibleMailboxUids }: LocalIndexLifecycleProps): null;

package/dist/apps/shared/search/localIndexBlockCipher.d.ts

@@ -0,0 +1,36 @@
+/**
+ * The actual AES-256-GCM block cipher `localIndexVFS.ts`'s `EncryptingVFS` uses to encrypt/decrypt one
+ * physical storage block - deliberately split out from that file so it can be exercised with real
+ * WebCrypto in a plain unit test, with no OPFS/Worker/wa-sqlite involved at all (none of those are
+ * available under Vitest's jsdom environment, matching the same "node" test environment convention
+ * `react-shared`'s other crypto modules already use for exactly this reason).
+ *
+ * See `localIndexVFS.ts`'s own doc comment for the full design rationale (page layout, why a fresh
+ * random nonce per write, why AAD binds to filename+block index). This module is pure mechanism; that
+ * one is where the design is explained.
+ */
+/** The logical SQLite page size `EncryptingVFS` is designed for - MUST match the `PRAGMA page_size` the
+ * database was created with (`localIndexWorker.ts` sets this before the first write). */
+export declare const LOGICAL_BLOCK_SIZE = 4096;
+/** One physical block on disk: `nonce || ciphertext || tag`. */
+export declare const PHYSICAL_BLOCK_SIZE: number;
+/** Thrown when a stored block fails AES-GCM authentication - a wrong/rotated key, on-disk corruption, or
+ * a block moved to the wrong position (see `localIndexVFS.ts`'s doc comment on why AAD binds position).
+ * The worker's caller treats this identically to a schema-version mismatch: discard the whole index and
+ * rebuild (spec §11 "Invalidation"). */
+export declare class PageCorruptedError extends Error {
+    /** The underlying `DOMException`/error `crypto.subtle.decrypt()` threw, or an inner-VFS read failure
+     * - kept as a plain field rather than the ES2022 `Error` constructor's `cause` option, since
+     * web-client's `tsconfig.json` targets ES2020. */
+    readonly cause: unknown;
+    constructor(filename: string, blockIndex: number, cause: unknown);
+}
+export declare function importAesGcmKey(rawKey: Uint8Array): Promise<CryptoKey>;
+/** Encrypts one logical block (`plaintext`, exactly `LOGICAL_BLOCK_SIZE` bytes) into its physical,
+ * on-disk representation (`PHYSICAL_BLOCK_SIZE` bytes: a fresh random nonce followed by
+ * ciphertext+tag). */
+export declare function encryptBlock(key: CryptoKey, filename: string, blockIndex: number, plaintext: Uint8Array): Promise<Uint8Array>;
+/** Inverse of `encryptBlock()`. Throws `PageCorruptedError` (never a raw `DOMException`) on auth
+ * failure - a wrong key, tampered ciphertext, or a block swapped into the wrong position (caught by the
+ * position-bound AAD not matching). */
+export declare function decryptBlock(key: CryptoKey, filename: string, blockIndex: number, physical: Uint8Array): Promise<Uint8Array>;

package/dist/apps/shared/search/localIndexBuilder.d.ts

@@ -0,0 +1,85 @@
+/**
+ * The Tier 2 local index's background builder (`specs/search.md` §11 "Initial build... incrementally,
+ * newest-first"). Runs on the main thread - the actual storage I/O and encryption happen in
+ * `localIndexWorker.ts` (off the UI thread, per that file's own doc comment); this module's own work is
+ * orchestration (deciding what to fetch) plus already-async fetch/decrypt calls, not CPU-heavy work that
+ * would itself need to move off-thread.
+ *
+ * **Known scoping simplification**: walks the mailbox's real mail folders one at a time (a fixed,
+ * reasonable priority order - Inbox and Sent first), each already newest-first via `listMessages()`'s own
+ * default sort, rather than a true interleaved k-way merge producing one single globally-newest-first
+ * stream across folders. A message in, say, Sent slightly older than the *oldest-processed-so-far*
+ * message in Inbox can therefore be indexed slightly out of true global date order relative to it. Given
+ * the byte-budget eviction below is itself date-based (oldest `date_for_sort` first, enforced by
+ * `localIndexWorker.ts`'s own `applyEviction()` after every insert - see that file), a small amount of
+ * cross-folder interleaving imprecision here does not affect *what* ultimately survives the window, only
+ * the exact order entities are inserted (and therefore briefly evicted-and-reinserted) in.
+ *
+ * Only encrypted messages (`subject === "[...]"`) are indexed - see `ENCRYPTED_SUBJECT_PLACEHOLDER`'s
+ * own precedent in `apps/www/index.tsx`'s inbox-list decrypt work. An unencrypted message is already
+ * fully searchable via Tier 1; indexing it here too would spend this index's bounded byte budget on
+ * content that didn't need it.
+ *
+ * **Verification seals.** A message this pass decrypts that has no seal for the vault's current `masterKeyGeneration` is
+ * evaluated with `evaluateMessageSecurityWithSeal()`, against the sender's pinned signing keys from the reader's
+ * contacts (`pinnedSigners.ts`, the message pane's own source, looked up once per sender per pass), so a verified
+ * message gets its seal without being opened (see `apps/shared/components/mail/verificationSeals.ts`). Pins only change
+ * the security state, never the recovered subject or body this index stores. Seal writes are best effort and bounded:
+ * at most `SEAL_WRITE_CONCURRENCY` in flight, at most `MAX_SEAL_WRITES_PER_PASS` per pass (past it, messages are
+ * evaluated without seals), failures ignored, and nothing new starts once the pass is aborted or its keys are destroyed.
+ * A seal carries only a hash, fingerprint, state and time, never plaintext. With no readable vault generation the pass
+ * seals nothing. Signed-only (unencrypted) messages aren't sealed here: this pass never fetches their raw MIME (see
+ * above), and fetching it only to seal would cost a download per message; they are sealed when opened.
+ */
+import { type Folder } from "@rapidmx/react-shared/mail/mailApi.js";
+import type { UnlockedKeys } from "@rapidmx/react-shared/crypto/keySession.js";
+/** §11's Window Sizing table's time-floor column - explicitly unvalidated starting-point default per the
+ * spec's own §16 "Measurement Task" ("cannot be supplied by design work... MUST NOT be treated as
+ * validated"). Used as-is rather than invented/adjusted here. Not user-adjustable today (unlike the byte
+ * budget - see `localIndexSizePreference.ts`) - nothing in this codebase has asked for that yet. */
+export declare const WEB_TIME_FLOOR_MONTHS = 12;
+/** Either bound as `0` means "no limit": `applyEviction()` (`localIndexWorker.ts`) already treats a
+ * falsy byte budget as unconfigured/unenforced, and `buildLocalIndex()` below mirrors that same
+ * convention for `timeFloorMonths` so a single `0` means the same thing in both dimensions. */
+export interface LocalIndexWindowConfig {
+    timeFloorMonths: number;
+    byteBudgetBytes: number;
+}
+/** How many times a pass walks a folder whose total count changed during the walk. `listMessages()` only
+ * pages by offset, so a message removed from an already-walked page shifts a later one onto it unseen;
+ * only a folder whose count held steady across a whole walk is trusted for completeness and pruning. */
+export declare const MAX_WALK_ATTEMPTS = 3;
+/** Subtracted from the pass's start time before it's recorded as the end of guaranteed coverage - a
+ * message's server-assigned `receivedDate` can be ahead of this device's clock. */
+export declare const CLOCK_SKEW_MARGIN_MS: number;
+/** How many raw-MIME fetch+decrypt calls run at once - a page of 100 encrypted messages used to fire all
+ * 100 requests simultaneously. */
+export declare const FETCH_CONCURRENCY = 6;
+/** How many verification seal writes run at once during a pass. */
+export declare const SEAL_WRITE_CONCURRENCY = 2;
+/** The most verification seals one pass writes. */
+export declare const MAX_SEAL_WRITES_PER_PASS = 200;
+/** Runs one full incremental build pass for `mailboxUid`: sets the window, walks mail folders newest-first
+ * (per this module's own doc comment on the folder-order simplification), decrypts and indexes only
+ * `"[...]"`-subject messages until each folder's own coverage passes the time floor, then clears the
+ * `building` flag. Messages already indexed at the same version are skipped, fetches run at most
+ * `FETCH_CONCURRENCY` at a time, and messages older than the eviction watermark (`WindowState.evictedBefore`)
+ * are neither fetched nor walked past. A failure partway through leaves whatever was indexed so far in place
+ * and records the pass as incomplete (spec §11's "incomplete-index UX... MUST indicate that coverage is
+ * partial" - see `Coverage.complete`). Rows the server no longer lists (deleted or moved elsewhere by any
+ * client) are pruned only within folders whose count held steady for a whole walk (see `MAX_WALK_ATTEMPTS`).
+ *
+ * Only one pass runs per mailbox (a newer call cancels the older), and every Worker call carries this pass's
+ * generation, so a pass outlived by a destroy can't write anything (see `cancelLocalIndexBuild()`).
+ *
+ * `windowConfig` defaults to this device's own configured byte budget (`getLocalIndexByteBudget()` -
+ * 500 MB in a browser tab, 1 GB in Electron, or whatever the user has since set in Settings > Encryption)
+ * alongside the fixed time floor above. Evaluated fresh on every call with no explicit override, so a
+ * preference change in Settings takes effect starting with this mailbox's next build pass (its next
+ * unlock), without requiring a reload.
+ */
+export declare function buildLocalIndex(mailboxUid: string, unlocked: UnlockedKeys, folders: Folder[], windowConfig?: LocalIndexWindowConfig): Promise<void>;
+/** Stops a mailbox's running build pass, if any (e.g. its keys were just destroyed), resolving once it has
+ * wound down. The Worker independently rejects the pass's later calls once the index is destroyed (see
+ * `GenerationParams`); this just stops the fetching and decrypting too. Never rejects. */
+export declare function cancelLocalIndexBuild(mailboxUid: string): Promise<void>;

package/dist/apps/shared/search/localIndexKey.d.ts

@@ -0,0 +1,4 @@
+/** Derives this mailbox's local-index page-encryption key from its already-unlocked master key. Every
+ * call with the same `(masterKey, mailboxUid)` pair returns the identical key - callers never need to
+ * persist it themselves. */
+export declare function deriveLocalIndexKey(masterKey: Uint8Array, mailboxUid: string): Promise<Uint8Array>;