@rapidmx/web-client 0.9.0 → 0.11.0

package/dist/apps/shared/components/mail/compose/ComposeWindowPlaceholder.d.ts

@@ -0,0 +1,19 @@
+import React from "react";
+import type { ComposeSession } from "./ComposeContext.js";
+export interface ComposeWindowPlaceholderProps {
+    session: ComposeSession;
+    /** The compose window's code couldn't be downloaded. */
+    failed: boolean;
+    onRetry: () => void;
+    onClose: () => void;
+    onToggleMinimize: () => void;
+}
+/**
+ * What stands in for the compose window in the moment between clicking Compose/Reply/Forward and the window's code being
+ * loaded (already there when it was prefetched, so usually not seen at all): the window's own frame at its own size and
+ * place, its title and the recipients and subject the window will open with, all of which are known without the network -
+ * so the click is answered on the same frame. It is deliberately tiny and lives in the page's own chunk.
+ *
+ * Nothing here can be typed into yet, and there is no draft to save or discard, so Close just closes.
+ */
+export default function ComposeWindowPlaceholder({ session, failed, onRetry, onClose, onToggleMinimize }: ComposeWindowPlaceholderProps): React.JSX.Element;

package/dist/apps/shared/components/mail/compose/ComposeWindowPlaceholder.js

@@ -0,0 +1,33 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+///////////////////////////////////////////////////////////////////////////////
+// Copyright (C) 2026 Jean-Philippe Steinmetz
+// SPDX-License-Identifier: MPL-2.0
+///////////////////////////////////////////////////////////////////////////////
+import { useEffect } from "react";
+import { HiOutlineMinus, HiOutlineXMark } from "react-icons/hi2";
+import Skeleton from "@rapidmx/react-shared/components/feedback/Skeleton.js";
+import Alert from "@rapidmx/react-shared/components/feedback/Alert.js";
+import Button from "@rapidmx/react-shared/components/buttons/Button.js";
+import useIsMobile from "@rapidmx/react-shared/util/useIsMobile.js";
+import { markComposePhase } from "./composePerf.js";
+/**
+ * What stands in for the compose window in the moment between clicking Compose/Reply/Forward and the window's code being
+ * loaded (already there when it was prefetched, so usually not seen at all): the window's own frame at its own size and
+ * place, its title and the recipients and subject the window will open with, all of which are known without the network -
+ * so the click is answered on the same frame. It is deliberately tiny and lives in the page's own chunk.
+ *
+ * Nothing here can be typed into yet, and there is no draft to save or discard, so Close just closes.
+ */
+export default function ComposeWindowPlaceholder({ session, failed, onRetry, onClose, onToggleMinimize }) {
+    const isMobile = useIsMobile();
+    const title = session.initialSubject?.trim() || "New Message";
+    const titleId = `compose-title-${session.id}`;
+    useEffect(() => markComposePhase(session.id, "shell"), [session.id]);
+    if (session.minimized) {
+        return (_jsx("div", { role: "dialog", "aria-label": title, className: "w-64 shrink-0 bg-surface border border-border border-b-0 rounded-t-md shadow-modal", children: _jsx("div", { className: "h-10 flex items-center justify-between gap-2 px-3 rounded-t-md bg-primary-darker text-white cursor-pointer", onClick: onToggleMinimize, children: _jsx("span", { className: "text-sm font-medium truncate", children: title }) }) }));
+    }
+    return (_jsxs("div", { role: "dialog", "aria-labelledby": titleId, "aria-busy": !failed, className: [
+            "relative shrink-0 flex flex-col bg-surface border border-border shadow-modal overflow-hidden",
+            isMobile ? "fixed inset-0 w-full h-full rounded-none border-0" : "border-b-0 rounded-t-md w-[480px] h-[520px]",
+        ].join(" "), children: [_jsxs("div", { className: "h-10 shrink-0 flex items-center justify-between gap-2 px-3 bg-primary-darker text-white cursor-pointer", onClick: onToggleMinimize, children: [_jsx("span", { id: titleId, className: "text-sm font-medium truncate", children: title }), _jsxs("div", { className: "flex items-center gap-0.5", onClick: (e) => e.stopPropagation(), children: [_jsx("button", { type: "button", "aria-label": "Minimize", title: "Minimize", onClick: onToggleMinimize, className: "w-6 h-6 flex items-center justify-center rounded-sm text-white/80 hover:bg-white/15 hover:text-white", children: _jsx(HiOutlineMinus, { size: 14 }) }), _jsx("button", { type: "button", "aria-label": "Close", title: "Close", onClick: onClose, className: "w-6 h-6 flex items-center justify-center rounded-sm text-white/80 hover:bg-white/15 hover:text-white", children: _jsx(HiOutlineXMark, { size: 14 }) })] })] }), failed ? (_jsx("div", { className: "px-3 pt-2", children: _jsxs(Alert, { children: [_jsx("p", { className: "mb-2", children: "The compose window couldn\u2019t be loaded. Check your connection and try again." }), _jsx(Button, { type: "button", variant: "secondary", className: "!w-auto", onClick: onRetry, children: "Retry" })] }) })) : (_jsxs("div", { role: "status", className: "flex-1 min-h-0 flex flex-col", children: [_jsx("span", { className: "sr-only", children: "Opening the compose window" }), _jsxs("div", { className: "flex items-center gap-2 px-3 py-1.5 border-b border-border text-sm", children: [_jsx("span", { className: "text-text-muted", children: "To" }), _jsx("span", { className: "truncate", children: session.initialTo })] }), _jsx("div", { className: "flex items-center gap-2 px-3 py-1.5 border-b border-border text-sm", children: _jsx("span", { className: "truncate", children: session.initialSubject || _jsx("span", { className: "text-text-muted", children: "Subject" }) }) }), _jsxs("div", { className: "flex-1 p-3 flex flex-col gap-2", "aria-hidden": "true", children: [_jsx(Skeleton, { height: "h-4" }), _jsx(Skeleton, { height: "h-4" }), _jsx(Skeleton, { height: "h-4" })] })] }))] }));
+}

package/dist/apps/shared/components/mail/compose/RichTextEditor.d.ts

@@ -18,6 +18,14 @@ export interface RichTextEditorProps {
      * quote). That normalization happens on the editor's first transaction - even one that only moves the caret -
      * and isn't reported through `onChange`, so a caller can compare later edits against this instead of `value`. */
     onInitialized?: (value: string) => void;
+    /**
+     * HTML to add at the end of the document, once, as soon as there is some (it may be undefined when the editor is created and
+     * defined later). A reply opens its editor before the quoted original has been fetched and hands the quote in through this when
+     * it arrives - so whatever has been typed above stays, and the quote lands where it always did, under the signature.
+     */
+    appendHtml?: string;
+    /** Called with the document as the editor serializes it, right after `appendHtml` was added. */
+    onAppended?: (value: string) => void;
 }
 /**
  * A WYSIWYG rich-text editor for the Compose window's message body — replaces `MonacoHtmlEditor` (an HTML
@@ -40,4 +48,4 @@ export interface RichTextEditorProps {
  * sufficient here since TipTap (unlike Monaco) never touches the DOM at module-evaluation time, only when
  * an editor view actually mounts.
  */
-export default function RichTextEditor({ value, onChange, height, fill, onUploadImage, autoFocusStart, onInitialized, }: RichTextEditorProps): React.JSX.Element;
+export default function RichTextEditor({ value, onChange, height, fill, onUploadImage, autoFocusStart, onInitialized, appendHtml, onAppended, }: RichTextEditorProps): React.JSX.Element;

package/dist/apps/shared/components/mail/compose/RichTextEditor.js

@@ -3,7 +3,7 @@ import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 // Copyright (C) 2026 Jean-Philippe Steinmetz
 // SPDX-License-Identifier: MPL-2.0
 ///////////////////////////////////////////////////////////////////////////////
-import { useRef, useState } from "react";
+import { useEffect, useRef, useState } from "react";
 import { EditorContent, useEditor } from "@tiptap/react";
 import StarterKit from "@tiptap/starter-kit";
 import { TextStyleKit } from "@tiptap/extension-text-style";
@@ -34,11 +34,14 @@ import ComposeToolbar from "./ComposeToolbar.js";
  * sufficient here since TipTap (unlike Monaco) never touches the DOM at module-evaluation time, only when
  * an editor view actually mounts.
  */
-export default function RichTextEditor({ value, onChange, height = "360px", fill = false, onUploadImage, autoFocusStart = false, onInitialized, }) {
+export default function RichTextEditor({ value, onChange, height = "360px", fill = false, onUploadImage, autoFocusStart = false, onInitialized, appendHtml, onAppended, }) {
     const onChangeRef = useRef(onChange);
     onChangeRef.current = onChange;
     const onInitializedRef = useRef(onInitialized);
     onInitializedRef.current = onInitialized;
+    const onAppendedRef = useRef(onAppended);
+    onAppendedRef.current = onAppended;
+    const appendedRef = useRef(undefined);
     // Transactions before `create` (the autofocus, and the normalizing one below) aren't edits.
     const initializedRef = useRef(false);
     // Held for this editor's lifetime: TipTap focuses a tick after creating the editor, and a re-render passing a
@@ -57,6 +60,12 @@ export default function RichTextEditor({ value, onChange, height = "360px", fill
         content: value,
         autofocus,
         immediatelyRender: false,
+        editorProps: {
+            // Ctrl/Cmd+Enter is the compose window's Send. TipTap binds it to a hard break, and a key it handles never reaches the
+            // window's shortcut (which skips what a widget already took), so it inserted a line break and sent nothing. Returning true here
+            // stops ProseMirror handling it without preventing the event, which goes on to the shortcut. Shift+Enter is still the hard break.
+            handleDOMEvents: { keydown: (_view, event) => event.key === "Enter" && (event.ctrlKey || event.metaKey) },
+        },
         onCreate: ({ editor: created }) => {
             // An empty transaction runs the schema's append-transaction normalization now, before any edit.
             created.view.dispatch(created.state.tr);
@@ -69,6 +78,15 @@ export default function RichTextEditor({ value, onChange, height = "360px", fill
             }
         },
     });
+    // Added once, at the end, whatever the reader has typed meanwhile (the caret stays where it is).
+    useEffect(() => {
+        if (!editor || appendHtml === undefined || appendedRef.current === appendHtml) {
+            return;
+        }
+        appendedRef.current = appendHtml;
+        editor.commands.insertContentAt(editor.state.doc.content.size, appendHtml);
+        onAppendedRef.current?.(editor.getHTML());
+    }, [editor, appendHtml]);
     return (_jsxs("div", { className: ["border border-border rounded-sm overflow-hidden", fill ? "h-full flex flex-col" : ""].filter(Boolean).join(" "), children: [_jsx(ComposeToolbar, { editor: editor, onUploadImage: onUploadImage }), _jsx(EditorContent, { editor: editor, style: fill ? undefined : { height }, className: [
                     "overflow-y-auto px-3 py-2 text-sm [&_.tiptap]:outline-none [&_.tiptap]:h-full",
                     fill ? "flex-1 min-h-0" : "",

package/dist/apps/shared/components/mail/compose/composePerf.d.ts

@@ -0,0 +1,16 @@
+/**
+ * `performance.mark()`/`measure()` around the phases between clicking Compose/Reply/Forward and the window being usable,
+ * for the browser's Performance panel (or `performance.getEntriesByType("measure")`). Marks are named
+ * `compose:<window id>:<phase>`; the measures are named `compose:<from>-><to>` and carry the window id in `detail`.
+ *
+ * Phases, in order: `click` (the handler ran), `shell` (the window's frame is on screen - the placeholder, or the real
+ * window once its chunk has loaded), `chunk` (the window's code has loaded and rendered), `body` (the seeded body -
+ * signature and quoted original - is ready), `editor` (the editor has mounted and can be typed into), `draft` (the server
+ * draft exists).
+ *
+ * On in development builds, and in a production build when `window.__RAPIDMX_PERF__` is set to `true` (from the console:
+ * `window.__RAPIDMX_PERF__ = true`). Off otherwise, when each call is a no-op.
+ */
+export type ComposePhase = "click" | "shell" | "chunk" | "body" | "editor" | "draft";
+/** Marks `phase` of window `id` once (later calls for the same phase are ignored), and measures it from `click`. */
+export declare function markComposePhase(id: string, phase: ComposePhase): void;

package/dist/apps/shared/components/mail/compose/composePerf.js

@@ -0,0 +1,41 @@
+///////////////////////////////////////////////////////////////////////////////
+// Copyright (C) 2026 Jean-Philippe Steinmetz
+// SPDX-License-Identifier: MPL-2.0
+///////////////////////////////////////////////////////////////////////////////
+/**
+ * `performance.mark()`/`measure()` around the phases between clicking Compose/Reply/Forward and the window being usable,
+ * for the browser's Performance panel (or `performance.getEntriesByType("measure")`). Marks are named
+ * `compose:<window id>:<phase>`; the measures are named `compose:<from>-><to>` and carry the window id in `detail`.
+ *
+ * Phases, in order: `click` (the handler ran), `shell` (the window's frame is on screen - the placeholder, or the real
+ * window once its chunk has loaded), `chunk` (the window's code has loaded and rendered), `body` (the seeded body -
+ * signature and quoted original - is ready), `editor` (the editor has mounted and can be typed into), `draft` (the server
+ * draft exists).
+ *
+ * On in development builds, and in a production build when `window.__RAPIDMX_PERF__` is set to `true` (from the console:
+ * `window.__RAPIDMX_PERF__ = true`). Off otherwise, when each call is a no-op.
+ */
+function enabled() {
+    if (typeof performance === "undefined" || typeof performance.mark !== "function") {
+        return false;
+    }
+    return import.meta.env?.DEV === true || globalThis.__RAPIDMX_PERF__ === true;
+}
+/** The compose sessions a `click` mark was made for, so the first mark of each phase is the only one that counts. */
+const marked = new Set();
+/** Marks `phase` of window `id` once (later calls for the same phase are ignored), and measures it from `click`. */
+export function markComposePhase(id, phase) {
+    if (!enabled()) {
+        return;
+    }
+    const key = `compose:${id}:${phase}`;
+    if (marked.has(key)) {
+        return;
+    }
+    marked.add(key);
+    performance.mark(key);
+    const start = `compose:${id}:click`;
+    if (phase !== "click" && marked.has(start)) {
+        performance.measure(`compose:click->${phase}`, { start, end: key, detail: { id } });
+    }
+}

package/dist/apps/shared/components/mail/compose/encryptionRequirement.d.ts

@@ -0,0 +1,49 @@
+import { RecipientEncryptionStatus } from "@rapidmx/react-shared/crypto/composeSecurity.js";
+import type { EncryptionPolicy } from "@rapidmx/react-shared/crypto/keyvaultApi.js";
+/**
+ * Whether a message must be treated as encrypted - the one place that decides it, as a pure function of what is *known*.
+ *
+ * **The rule is fail open.** A message is plain, its draft is saved, and nothing about encryption is ever shown, unless encryption is
+ * actually in play. Encryption is in play only when
+ *
+ * 1. the user asked for it ("Encrypt this message", or a reply to encrypted mail, whose quote may carry decrypted text) - that is local
+ * knowledge and needs no request to have succeeded; or
+ * 2. the system's encryption policy **was loaded successfully**, this sender has an encryption key (enrolled on their mailbox, or unlocked
+ * in this tab), the message has recipients, **every** recipient's key lookup succeeded, and the policy auto-applies encryption to all
+ * of them (`decideMessageEncryption().autoEncrypt`: policy `automatic` for their tier, both sides preferring "mutual", a key found).
+ *
+ * Anything that failed to load, is still loading or is slow (the policy, the mailbox, a recipient's lookup) is **unknown**, and unknown
+ * counts as "not encrypted": that is what stops a gateway that flaps, a slow request, or a user who has never set encryption up from
+ * ever blocking a draft, blocking Close, blocking Send or showing an "encryption can't be checked" message. What was unknown is
+ * reported in `unknown`, so a caller that is about to send can give the loads a moment - and only a caller that finds out later that the
+ * message *does* need encryption acts on it (see `ComposeWindow`'s transition rules).
+ *
+ * Why this is safe enough: the requirement only ever protects *this client's* plaintext drafts and sends from being unencrypted when the
+ * server's policy says they should be; it is not the enforcement point (the keys are the user's, the server never sees them). A missing
+ * policy therefore does not mean "encrypt or refuse" - it means the client cannot tell, and the honest default is the one that works.
+ */
+export interface EncryptionFacts {
+    /** The user turned encryption on, or this compose is a reply to / forward of an encrypted message. */
+    encryptRequested: boolean;
+    /** The policy, once it has loaded; `undefined` while loading, failed or slow. */
+    policy: EncryptionPolicy | undefined;
+    /** The sender's mailbox has loaded (its enrolled keys are known). */
+    mailboxLoaded: boolean;
+    /** The sender has an encryption key to encrypt with: enrolled on the mailbox, unlocked in this tab, or offered earlier this session. */
+    hasEncryptionKey: boolean;
+    /** One entry per current recipient (To, Cc and Bcc): the resolved status, or `undefined` while that recipient's lookup is pending or failed. */
+    recipients: (RecipientEncryptionStatus | undefined)[];
+}
+export type EncryptionReason = "requested" | "policy";
+/** What was not known, and could still change the answer. */
+export type UnknownFact = "mailbox" | "policy" | "recipients";
+export interface EncryptionRequirement {
+    /** The message must be encrypted: it is never stored as a plaintext draft and never sent in the clear. */
+    required: boolean;
+    reason: EncryptionReason | null;
+    /** What was unknown (and so assumed "no encryption"). Empty when the answer cannot change with more loading. Never shown to the user. */
+    unknown: UnknownFact[];
+}
+/** Any tier of `policy` auto-encrypts - only then can what is still unknown about the recipients turn a message into an encrypted one. */
+export declare function policyCanAutoEncrypt(policy: EncryptionPolicy): boolean;
+export declare function evaluateEncryptionRequirement(facts: EncryptionFacts): EncryptionRequirement;

package/dist/apps/shared/components/mail/compose/encryptionRequirement.js

@@ -0,0 +1,35 @@
+///////////////////////////////////////////////////////////////////////////////
+// Copyright (C) 2026 Jean-Philippe Steinmetz
+// SPDX-License-Identifier: MPL-2.0
+///////////////////////////////////////////////////////////////////////////////
+import { decideMessageEncryption } from "@rapidmx/react-shared/crypto/composeSecurity.js";
+/** Any tier of `policy` auto-encrypts - only then can what is still unknown about the recipients turn a message into an encrypted one. */
+export function policyCanAutoEncrypt(policy) {
+    return [policy.encryptSameOrg, policy.encryptFederated, policy.encryptExternal].includes("automatic");
+}
+export function evaluateEncryptionRequirement(facts) {
+    if (facts.encryptRequested) {
+        return { required: true, reason: "requested", unknown: [] };
+    }
+    const unknown = [];
+    if (!facts.hasEncryptionKey) {
+        // Without a key nothing can be encrypted: a user who never set encryption up sees nothing at all. Whether the mailbox has one is
+        // only *unknown* while it has not loaded.
+        return { required: false, reason: null, unknown: facts.mailboxLoaded ? [] : ["mailbox"] };
+    }
+    if (!facts.policy) {
+        return { required: false, reason: null, unknown: ["policy"] };
+    }
+    if (!policyCanAutoEncrypt(facts.policy)) {
+        return { required: false, reason: null, unknown };
+    }
+    if (facts.recipients.length === 0) {
+        // Nobody to decide by yet: plain until a recipient is added.
+        return { required: false, reason: null, unknown };
+    }
+    const statuses = facts.recipients.filter((status) => !!status);
+    if (statuses.length < facts.recipients.length) {
+        return { required: false, reason: null, unknown: ["recipients"] };
+    }
+    return decideMessageEncryption(statuses).autoEncrypt ? { required: true, reason: "policy", unknown } : { required: false, reason: null, unknown };
+}

package/dist/apps/shared/components/mail/compose/quotedBody.d.ts

@@ -9,6 +9,19 @@ export interface OriginalMessage {
      * be. Only asked for by Reply All (see `loadOriginalMessage()`). */
     recipients?: Recipient[];
 }
+/** How long a reply waits for the original's body before it goes ahead with the preview - a slow or hung request must not
+ * leave the window waiting on it (or, before it opened at once, keep it from opening) indefinitely. */
+export declare const QUOTE_FETCH_TIMEOUT_MS = 10000;
+/** How long a fetched (or prefetched) body is remembered, so hovering Reply and then clicking it costs one request. */
+export declare const QUOTE_CACHE_MS = 30000;
+/**
+ * Starts fetching what a Reply/Forward of `message` will quote, without waiting for the click - called when the pointer or
+ * keyboard reaches a Reply/Reply All/Forward button - so the request is usually already answered when it is clicked.
+ * Nothing to fetch for an encrypted message (`loadOriginalMessage()` never asks the server for one's body).
+ */
+export declare function prefetchOriginalMessage(message: Message): void;
+/** Forgets every remembered body (the sign-out and test seam). */
+export declare function clearOriginalMessageCache(): void;
 /**
  * Loads what a Reply/Reply All/Forward needs from `message`: the full body to quote - the same content
  * `MessageDetailPane` shows, never the truncated `bodyPreview` unless nothing else can be had - and, with

package/dist/apps/shared/components/mail/compose/quotedBody.js

@@ -6,6 +6,66 @@ import { apiUrl } from "@rapidmx/react-shared/util/api.js";
 import { getMessageRawContent } from "@rapidmx/react-shared/mail/mailApi.js";
 import { decodeHeaderText, extractDisplayBody, parseMimeEntity } from "@rapidmx/react-shared/crypto/mime.js";
 import { parseRecipientList } from "./recipients.js";
+/** How long a reply waits for the original's body before it goes ahead with the preview - a slow or hung request must not
+ * leave the window waiting on it (or, before it opened at once, keep it from opening) indefinitely. */
+export const QUOTE_FETCH_TIMEOUT_MS = 10000;
+/** How long a fetched (or prefetched) body is remembered, so hovering Reply and then clicking it costs one request. */
+export const QUOTE_CACHE_MS = 30000;
+const contentCache = new Map();
+/**
+ * The server's sanitized HTML body of a message (`GET /mail/messages/:id/content`), or `undefined` when it has none (a
+ * `text/plain` message is answered with its preview instead) or the request failed or timed out. Never rejects. Remembered
+ * for `QUOTE_CACHE_MS` - except a failure, which is asked again the next time.
+ */
+function fetchContentHtml(uid) {
+    const cached = contentCache.get(uid);
+    if (cached && Date.now() - cached.at < QUOTE_CACHE_MS) {
+        return cached.promise;
+    }
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), QUOTE_FETCH_TIMEOUT_MS);
+    const promise = (async () => {
+        try {
+            const res = await fetch(apiUrl(`/mail/messages/${encodeURIComponent(uid)}/content`), { credentials: "include", signal: controller.signal });
+            return res.ok && (res.headers.get("content-type") ?? "").includes("text/html") ? await res.text() : undefined;
+        }
+        catch {
+            return undefined;
+        }
+        finally {
+            clearTimeout(timer);
+        }
+    })();
+    contentCache.set(uid, { at: Date.now(), promise });
+    void promise.then((html) => {
+        if (html === undefined && contentCache.get(uid)?.promise === promise) {
+            contentCache.delete(uid);
+        }
+    });
+    return promise;
+}
+/** Rejects when `promise` hasn't settled within `ms` (`getMessageRawContent()` takes no `AbortSignal`, so it is raced rather than aborted). */
+function withTimeout(promise, ms) {
+    let timer;
+    const timeout = new Promise((_resolve, reject) => {
+        timer = setTimeout(() => reject(new Error("Timed out.")), ms);
+    });
+    return Promise.race([promise, timeout]).finally(() => clearTimeout(timer));
+}
+/**
+ * Starts fetching what a Reply/Forward of `message` will quote, without waiting for the click - called when the pointer or
+ * keyboard reaches a Reply/Reply All/Forward button - so the request is usually already answered when it is clicked.
+ * Nothing to fetch for an encrypted message (`loadOriginalMessage()` never asks the server for one's body).
+ */
+export function prefetchOriginalMessage(message) {
+    if (!message.encrypted) {
+        void fetchContentHtml(message.uid);
+    }
+}
+/** Forgets every remembered body (the sign-out and test seam). */
+export function clearOriginalMessageCache() {
+    contentCache.clear();
+}
 /** The recipients one address-list header names, RFC 2047-decoded, with their display names. */
 function headerRecipients(value, type) {
     if (!value) {
@@ -50,23 +110,19 @@ export async function loadOriginalMessage(message, security, options = {}) {
     }
     let needsRaw = !!options.recipients && result.recipients === undefined;
     if (!recovered) {
-        try {
-            const res = await fetch(apiUrl(`/mail/messages/${encodeURIComponent(message.uid)}/content`), { credentials: "include" });
-            if (res.ok && (res.headers.get("content-type") ?? "").includes("text/html")) {
-                result.body = { html: await res.text() };
-            }
-            else {
-                needsRaw = true;
-            }
+        // Never rejects; nothing (a plain-text message, a failure, a timeout) leaves the raw message below as the other way
+        // to the body.
+        const html = await fetchContentHtml(message.uid);
+        if (html !== undefined) {
+            result.body = { html };
         }
-        catch {
-            // The raw message below is the other way to the body.
+        else {
             needsRaw = true;
         }
     }
     try {
         if (needsRaw) {
-            const entity = parseMimeEntity(await getMessageRawContent(message.uid));
+            const entity = parseMimeEntity(await withTimeout(getMessageRawContent(message.uid), QUOTE_FETCH_TIMEOUT_MS));
             if (!recovered && result.body.html === undefined) {
                 const body = extractDisplayBody(entity);
                 result.body = body.html !== undefined ? { html: body.html } : body.text !== undefined ? { text: body.text } : {};

package/dist/apps/shared/components/mail/layout/MailShell.d.ts

@@ -1,7 +1,9 @@
 import React, { PropsWithChildren } from "react";
-import { Folder, Mailbox } from "@rapidmx/react-shared/mail/mailApi.js";
+import { Folder, Mailbox, Message } from "@rapidmx/react-shared/mail/mailApi.js";
 import { AppShellProps } from "../../layout/AppShell.js";
 import { LiveUpdates } from "../../../mail/useMailLiveUpdates.js";
+import { MAILBOX_LIST_LIMIT } from "../../../mail/useMailConnection.js";
+import { CountTracker } from "../../../mail/folderCounts.js";
 export type MailShellProps = Omit<AppShellProps, "active">;
 /** One mailbox's own mail folders (already filtered to `MAIL_FOLDER_TYPES` and unsorted) - one entry per
  * mailbox in `mailboxes`, fetched in parallel so every accessible mailbox's folder tree can render
@@ -42,17 +44,25 @@ export interface MailShellContextValue {
      * A no-op on the default context value, which is only ever read outside a real shell.
      */
     onFolderCreated: (folder: Folder) => void;
+    /** Says which folders the messages on screen live in: one the sidebar does not know is looked for (see `MailConnection.noteFolderUids`). A no-op on the default context value. */
+    noteFolderUids: (folderUids: Iterable<string>) => void;
     /**
      * Bumped whenever new mail (or another change to a message) may have arrived - a push event, a reconnect or the safety-net
      * poll - so the list on screen can quietly refetch its first page. See `useMailLiveUpdates()`. Never changes on the default
      * context value, which is only ever read outside a real shell.
      */
     live: LiveUpdates;
+    /**
+     * Applies a change to a message (`previous` to `next`; `next` absent when it was deleted) to the folder badges at once, and
+     * hands back what to call when the server has answered: `settle()` keeps it, `revert()` takes it back. Every place that
+     * reads, moves or deletes a message goes through this (see `setReadState()`), so the badges follow. A no-op on the default
+     * context value, which is only ever read outside a real shell.
+     */
+    trackMessageChange: (previous: Message, next: Message | null) => CountTracker;
 }
 /** Reads the mailbox/folder a page is currently showing, as resolved by the enclosing `MailShell`. */
 export declare function useMailShell(): MailShellContextValue;
-/** Page size of the one `listMailboxes()` call this shell makes. */
-export declare const MAILBOX_LIST_LIMIT = 100;
+export { MAILBOX_LIST_LIMIT };
 /**
  * Mail's own contextual sidebar (every accessible mailbox's own folder tree, plus a merged "All Mailboxes"
  * aggregate section) + content area, rendered inside the shared `AppShell` chrome (icon rail, header,
@@ -69,4 +79,4 @@ export declare const MAILBOX_LIST_LIMIT = 100;
  * aggregate section) simultaneously, matching the shared-mailbox feature's own "display as a separate set
  * of folders" requirement.
  */
-export default function MailShell({ userUid, authServerUrl, impersonating, impersonationBaseUrl, trusted, pluginNav, children, }: PropsWithChildren<MailShellProps>): React.JSX.Element;
+export default function MailShell({ userUid, authServerUrl, impersonating, impersonationBaseUrl, trusted, trustedRoles, pluginNav, children, }: PropsWithChildren<MailShellProps>): React.JSX.Element;