Merge branch 'main' into feature/scheduled-send

# Conflicts:
#	app/(main)/[locale]/page.tsx
#	components/email/email-list.tsx
#	components/email/email-viewer.tsx

.dockerignore

@@ -9,8 +9,3 @@ scripts/
 TODO.md
 *.md
 !README.md
-# Sibling projects / test harness - not part of the webmail image
-examples/
-integration/
-e2e/
-**/node_modules

.env.dev.example

@@ -47,8 +47,3 @@ LOG_LEVEL=debug
 # LOGIN_IMPRINT_URL=https://example.com/imprint
 # LOGIN_PRIVACY_POLICY_URL=https://example.com/privacy
 # LOGIN_WEBSITE_URL=https://example.com
-
-# Per-domain branding overrides. Each entry must have "host" (exact or
-# "*.subdomain" wildcard) plus any subset of branding fields to override.
-# Unset fields fall through to the global values above.
-# DOMAIN_BRANDING=[{"host":"localhost","loginCompanyName":"Local Dev"}]

.env.example

@@ -49,11 +49,6 @@ JMAP_SERVER_URL=https://your-jmap-server.com
 # OpenID Connect issuer URL for discovery
 # OAUTH_ISSUER_URL=https://your-idp.example.com
 
-# Overrides only the user-facing authorize endpoint (e.g. a per-brand login
-# host). Discovery, token exchange and refresh keep using OAUTH_ISSUER_URL.
-# Leave unset to use the authorization_endpoint from discovery.
-# OAUTH_AUTHORIZE_URL=https://login.your-brand.example.com/application/o/authorize/
-
 # Allow OAuth discovery to resolve to private (RFC-1918 / loopback) addresses.
 # Off by default as an SSRF guard. Enable for split-DNS deployments where the
 # OAuth issuer's public hostname resolves to an internal IP from this server.
@@ -115,16 +110,12 @@ JMAP_SERVER_URL=https://your-jmap-server.com
 # Anonymous Telemetry
 # =============================================================================
 
-# Anonymous instance telemetry is OPT-IN and disabled by default. Enabling it
-# helps us understand how Bulwark is used so we can make the product better.
-# Heartbeats contain no PII: version, platform, bucketed account counts, and
-# feature toggles only - never email addresses, hostnames, or IPs. See
+# Anonymous instance telemetry is enabled by default. Heartbeats contain no PII:
+# version, platform, bucketed account counts, and feature toggles only. See
 # https://bulwarkmail.org/docs/legal/privacy/telemetry for the full schema.
 #
-# Enable telemetry (also toggleable in the admin UI):
-# BULWARK_TELEMETRY=on
-#
-# Setting this (on or off) locks the choice and disables the admin UI toggle.
+# Disable telemetry entirely (overrides the admin UI):
+# BULWARK_TELEMETRY=off
 
 # Directory for telemetry state: instance id, consent, login HMACs
 # (default: ./data/telemetry). For Docker, the default resolves to
@@ -234,29 +225,6 @@ LOGIN_COMPANY_NAME=Bulwark Webmail
 # URL for the company website link on the login page.
 LOGIN_WEBSITE_URL=https://bulwarkmail.org
 
-# ---------------------------------------------------------------------------
-# Per-domain branding overrides (optional)
-# ---------------------------------------------------------------------------
-#
-# When you serve the webmail on multiple hostnames, each hostname can override
-# a subset of branding fields. Unset fields fall back to the global values
-# above. Match is on the request's Host (or X-Forwarded-Host) header.
-#
-# Use the leftmost label "*." to match any subdomain (e.g. "*.example.com"
-# matches mail.example.com and any deeper subdomain, but NOT example.com).
-# Exact matches always win over wildcards; the longest wildcard suffix wins
-# among multiple wildcard matches.
-#
-# Overridable keys: appName, appShortName, appDescription, faviconUrl,
-# pwaIconUrl, pwaThemeColor, pwaBackgroundColor, appLogoLightUrl,
-# appLogoDarkUrl, loginLogoLightUrl, loginLogoDarkUrl, loginCompanyName,
-# loginImprintUrl, loginPrivacyPolicyUrl, loginWebsiteUrl.
-#
-# Prefer setting this from the admin dashboard (PATCH /api/admin/config).
-# The env-var form is provided for stateless deployments.
-#
-# DOMAIN_BRANDING=[{"host":"maildomain1.com","loginCompanyName":"Company One","loginLogoLightUrl":"/branding/one-color.svg","loginLogoDarkUrl":"/branding/one-white.svg","loginWebsiteUrl":"https://one.example"},{"host":"maildomain2.com","loginCompanyName":"Company Two","faviconUrl":"/branding/two-favicon.svg"},{"host":"*.intranet.example.com","loginCompanyName":"Internal"}]
-
 # =============================================================================
 # Extension Directory / Marketplace
 # =============================================================================

.github/workflows/docker-publish-releases.yml

@@ -118,114 +118,3 @@ jobs:
       - name: Inspect image
         run: |
           docker buildx imagetools inspect ${{ env.IMAGE_NAME }}:${{ steps.meta.outputs.version }}
-
-  build-always:
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - platform: linux/amd64
-            runner: ubuntu-latest
-          - platform: linux/arm64
-            runner: ubuntu-24.04-arm
-    runs-on: ${{ matrix.runner }}
-    permissions:
-      contents: read
-      packages: write
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-
-      - name: Log in to GHCR
-        uses: docker/login-action@v3
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Extract metadata
-        id: meta
-        uses: docker/metadata-action@v5
-        with:
-          images: ${{ env.IMAGE_NAME }}
-
-      - name: Build and push by digest
-        id: build
-        uses: docker/build-push-action@v6
-        with:
-          context: .
-          platforms: ${{ matrix.platform }}
-          labels: ${{ steps.meta.outputs.labels }}
-          build-args: |
-            GIT_COMMIT=${{ github.sha }}
-            NEXT_PUBLIC_LOCALE_PREFIX=always
-          outputs: type=image,name=${{ env.IMAGE_NAME }},push-by-digest=true,name-canonical=true,push=true
-          cache-from: type=gha,scope=always-${{ matrix.platform }}
-          cache-to: type=gha,mode=max,scope=always-${{ matrix.platform }}
-
-      - name: Export digest
-        run: |
-          mkdir -p /tmp/digests-always
-          digest="${{ steps.build.outputs.digest }}"
-          touch "/tmp/digests-always/${digest#sha256:}"
-
-      - name: Upload digest
-        uses: actions/upload-artifact@v4
-        with:
-          name: digests-always-${{ matrix.platform == 'linux/amd64' && 'amd64' || 'arm64' }}
-          path: /tmp/digests-always/*
-          if-no-files-found: error
-          retention-days: 1
-
-  merge-always:
-    runs-on: ubuntu-latest
-    needs: build-always
-    permissions:
-      contents: read
-      packages: write
-    steps:
-      - name: Download digests
-        uses: actions/download-artifact@v4
-        with:
-          path: /tmp/digests-always
-          pattern: digests-always-*
-          merge-multiple: true
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-
-      - name: Log in to GHCR
-        uses: docker/login-action@v3
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Extract metadata
-        id: meta
-        uses: docker/metadata-action@v5
-        with:
-          images: ${{ env.IMAGE_NAME }}
-          flavor: |
-            suffix=-always,onlatest=true
-          tags: |
-            type=raw,value=latest
-            type=semver,pattern=v{{version}}
-            type=semver,pattern={{version}}
-            type=semver,pattern=v{{major}}.{{minor}}
-            type=semver,pattern={{major}}.{{minor}}
-            type=semver,pattern=v{{major}}
-            type=semver,pattern={{major}}
-
-      - name: Create manifest list and push
-        working-directory: /tmp/digests-always
-        run: |
-          docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
-            $(printf '${{ env.IMAGE_NAME }}@sha256:%s ' *)
-
-      - name: Inspect image
-        run: |
-          docker buildx imagetools inspect ${{ env.IMAGE_NAME }}:${{ steps.meta.outputs.version }}

CHANGELOG.md

@@ -1,326 +1,5 @@
 # Changelog
 
-## 1.7.8 (2026-07-22)
-
-### Features
-
-- **Unified Mailbox**: Account-bounded Unified Mailbox with opt-in cross-account aggregation (#509)
-- **Unified Mailbox**: Search in the unified views
-- **Unified Mailbox**: Live unified/All-Mail counters for shared and group accounts
-- **Mail**: Message-list category tabs
-- **Mail**: Drag-and-drop reorder for all folders
-- **Mail**: Collapse quoted reply text behind a "..." toggle (#480)
-- **Mail**: Bulk Not-Spam action in the junk selection toolbar
-- **Mail**: Unread count badge on the favicon
-- **Mail**: Message spacing setting (auto/always/edge-to-edge)
-- **Mail**: Open external links in a new tab (safely)
-- **Mail**: Strip external `url()`/`@import` from `<style>` blocks in the sanitizer (#457)
-- **Composer**: Text color picker in the composer toolbar
-- **Composer**: Contact groups as single expandable recipient chips
-- **Composer**: Drag-to-reorder To/Cc/Bcc recipient chips (#593)
-- **Composer**: Auto-detect paragraph text direction by default
-- **Templates**: HTML template support
-- **Vacation**: HTML body support in the vacation responder
-- **Send**: 'Send now' action on the send-delay toast
-- **Accounts**: Remove a specific account from the switcher
-- **Settings**: "Refresh cached data" recovery action
-- **i18n**: Full Arabic (ar) translation with RTL support
-- **Login**: `LOGIN_SHOW_TOTP` and `LOGIN_SHOW_VERSION` config flags (#520)
-- **Docker**: `NEXT_PUBLIC_LOCALE_PREFIX` build argument
-- **Plugins**: `ui.rerenderFetchedEmails` method (#668)
-- **Plugins**: `onEmailsFetched` and `onSearchResults` hooks and `getSomeEmails` JMAP method
-- **Plugins**: `onRecipientChipsChange` hook
-- **Plugins**: `webauthn.getOrCreate` API method
-- **Plugins**: Download files generated by a plugin (with `ui:download-file` consent permission)
-- **Plugins**: Submit mail without moving to a mailbox and import-to-mailbox APIs
-
-### Fixes
-
-- **Mail**: Render the email body on DOM parse instead of iframe load (#635)
-- **Mail**: Keep sidebar tag counts in step with read/unread changes
-- **Mail**: Enable thread expansion in the focused list
-- **Mail**: Show the quote bar in email replies
-- **Mail**: Honor part-type fallback when quoting replies (#649)
-- **Mail**: Detect typing inside the quoted-HTML shadow island (#654)
-- **Mail**: Keep `target`/`rel` on links in plain-text message bodies and open signature links in a new tab
-- **Accounts**: Eliminate the full-screen flash when switching accounts (including cached accounts)
-- **Accounts**: Recognize canonicalized login usernames in the account-switch guard
-- **Auth**: Guard account switch against slot→token desync and basic-auth identity mismatches
-- **Auth**: End refresh loops on sign-out and back off failed retries
-- **OAuth**: Harden OIDC discovery (timeout, retry, serve-stale)
-- **JMAP**: Preserve POST across redirects in the Stalwart JMAP passthrough (#627)
-- **JMAP**: File the post-send message with a full `mailboxIds` replacement
-- **JMAP**: Generate the Message-ID client-side using the sender's domain
-- **Identity**: Sync the default sender identity per account (#507)
-- **Attachments**: Download/view attachments on cross-account All-Mail messages
-- **Shared folders**: Route batch actions to the owner account
-- **Templates**: Insert a mail template at the caret in replies instead of prepending (#539)
-- **Templates**: Keep the signature when inserting a template (#621)
-- **Templates**: Hide template buttons when templates are disabled
-- **Calendar**: Honor "Show time in month view" on mobile instead of forcing dots (#666)
-- **Calendar**: Classify self-organized imported events as editable
-- **Contacts**: Assign a UID to contact cards on creation (#644)
-- **Spam**: Stop HELO `spf=none` from downgrading a MAIL FROM `spf=pass` (#650)
-- **Drafts**: Label the close-dialog draft button with the generic Save
-- **RTL**: Flip JS-positioned popovers and anchor floating menus with logical start/end
-- **RTL**: Isolate Latin address text from RTL bidi reordering and force LTR identity options
-- **i18n**: Register Arabic messages in the client IntlProvider
-- **i18n**: Fix the Hebrew Drafts folder label
-- **i18n**: Add missing translation keys across 22 locales
-- **Deps**: Bump `dompurify` to 3.4.12 and `next-intl` to 4.13.3
-
-## 1.7.7 (2026-07-09)
-
-### Features
-
-- **Plugins**: `ui.rerenderEmail` API and restyled read-receipt banner
-- **Plugins**: New hooks — `onBeforeBlobUpload`, `onBeforeDraftAutoSave`, `onBeforeEditDraft` (#586)
-- **Plugins**: `ui.prompt` dialog and first-class settings-section tabs
-- **Calendar**: Jalali (Persian/Shamsi) calendar support with Saturday as week start (#490)
-- **i18n**: Hebrew locale with full RTL support
-- **i18n**: Slovak translation
-- **i18n**: User-selectable regional date format
-- **Contacts**: Enable trusted-senders address book sync by default when contacts are available
-- **Mail**: Pin emails to the top of the folder list
-- **Mail**: Setting to disable the tag-color row tint in the message list
-- **Mail**: Click the sender avatar to select a message/thread (Thunderbird-style)
-- **Accounts**: Pin the default account on top and drag-to-reorder the account switcher
-- **Composer**: Recipient autocomplete from Sent, with on-demand server search
-- **Composer**: Preselect the identity of the active mailbox for new messages
-- **Email**: Send a quick reply with Ctrl/Cmd+Enter
-- **Headers**: Parse Stalwart spam headers
-- **Login**: Configurable logo size and hideable heading/subtitle
-- **PWA**: Apple Touch icons for the iOS home screen
-
-### Fixes
-
-- **Mail**: Hide Files when the account lacks the filenode capability (#563)
-- **Mail**: Keep advanced search filters applied when switching folders (#553)
-- **Mail**: Keep the email list scrollable when the bottom reading pane is enabled with no conversation selected
-- **Mail**: Route keyword writes to the email's own account in unified view
-- **Mail**: Render emails that set `height:100%` on a wrapper element
-- **Mail**: Hide images that fail to load
-- **Mail**: Storage quota not shown with Stalwart (#577)
-- **Spam**: Hide the spam action in Sent, Drafts and Scheduled
-- **Spam**: Fix stale folder counters and open message after spam actions
-- **Composer**: Wait for in-flight attachment uploads before sending
-- **Composer**: Only commit a recipient on Space when the input is a valid email (#571)
-- **Composer**: Attachment reminder now ignores quoted text on reply/forward (#570)
-- **Calendar**: Store the event organizer as owner-only to prevent duplicate ORGANIZER/ATTENDEE
-- **Calendar**: Strike through cancelled events and mute their reminders (#572)
-- **Calendar**: Use `calendarAddress`/`organizerCalendarAddress` for scheduling, drop retired `sendTo`/`replyTo` (#500)
-- **Auth**: Keep the session when the auth server is briefly unreachable
-- **Shortcuts**: Make keyboard shortcuts layout-agnostic and map by physical position
-- **Shortcuts**: Don't toggle mailbox subfolders on Arrow keys while typing
-- **Contacts**: Clear the photo on the server by sending `media: null` when removed
-- **Plugins**: Preserve the settings slot and privileged tier
-- **Pro**: Prompt to save or discard a draft when closing a compose tab via the tab-bar X
-- **Pro**: Show the Edit button on draft emails opened in a new tab
-- **List**: Shift-click on the checkbox extends the selection (range)
-- **CSP**: Allow external/data fonts so email webfonts render
-- **Notifications**: Brand push notifications with the configured PWA icon
-- **Notifications**: Notification sound preview — base-path prefix and longer default beep
-- **Unsubscribe**: Send `mailto:` unsubscribe ourselves instead of via the OS handler
-- **Branding**: Apply per-domain favicon override in root metadata (#585)
-- **Settings**: Load the trusted-senders address book on the settings page so the count isn't 0
-- **Setup**: Clone source when `setup.sh` runs detached from a checkout (#518)
-- **Server**: Use a callable `.get` to detect `Headers` in `pickRequestHost`
-
-## 1.7.6 (2026-06-28)
-
-### Breaking Changes
-
-- **S/MIME**: The built-in S/MIME implementation has been removed from core and re-delivered through the new generic crypto plugin hooks (privileged same-origin plugin tier). S/MIME signing, encryption, decryption, certificate management, and the related settings UI now live in a plugin rather than the main app. Deployments that relied on built-in S/MIME must install the S/MIME crypto plugin to retain those features.
-
-### Features
-
-- **Plugins**: Privileged same-origin plugin tier with a crypto API surface
-- **Plugins**: Plugin hooks for email details, headers, and source
-- **Mail**: Option to hide the total message count on folders (#498)
-
-### Fixes
-
-- **Mail**: Hide the server scheduled folder when the virtual one is shown (#495)
-- **Mail**: Stop the unified mailbox from mutating client-returned email objects
-- **Composer**: HTML-escape sender and subject in the reply/forward quote header (#482)
-- **Calendar**: Send calendar invites by setting `organizerCalendarAddress`
-- **Identity**: Sync the default identity (`preferredPrimaryId`) to server settings (#507)
-- **Auth**: Support MFA login via the structured auth endpoint
-- **Admin**: Show all built-in themes in the admin theme controls (#496)
-- **i18n**: Add missing translation keys across 19 locales
-
-## 1.7.5 (2026-06-24)
-
-### Features
-
-- **Mail**: Cross-account "All accounts" views with full group/shared-account support
-- **Mail**: Per-account "All Mail" folder selection
-- **Mail**: "Download all" button to bundle attachments into a zip (#466)
-- **Mail**: Return to the list after deleting or marking the open message unread — configurable (default on)
-- **Mail**: Collapse-all-threads action in thread-list selection
-- **Calendar**: Option to disable the calendar
-- **Composer**: Send-now button on scheduled/delayed messages
-- **Composer**: Email a contact or group via the in-app composer
-- **Composer**: Split a pasted address list into recipient chips
-- **Contacts**: "New address book" creation UI (#415)
-- **OAuth**: `OAUTH_AUTHORIZE_URL` to override the authorize endpoint
-- **i18n**: Farsi (fa) locale — complete (2654 strings)
-- **i18n**: Romanian (ro) locale
-
-### Fixes
-
-- **Composer**: Keep HTML signature styling in the editor and on send
-- **Composer**: Guard Send against double-submit
-- **Composer**: Strip display names from the `EmailSubmission` envelope addresses
-- **Calendar**: Disable iMIP scheduling on calendar import (#411)
-- **Mail**: Localize special-folder names by JMAP role (#404)
-- **Mail**: Block remaining email tracking vectors (#457)
-- **Mail**: Route counter and unread updates to the email's own account in aggregate views
-- **Mail**: Fix blank space in plain-text emails
-- **Mail**: Fix toolbar re-render when opening emails
-- **Mail**: Truncate long subjects so they don't overlap the timestamp
-- **Mail**: Strip reply/forward prefixes followed by a full-width colon
-- **Mail**: Add breathing room between the unread dot and the avatar
-- **Mail**: Isolate per-account state snapshots from leakage and mutation
-- **Mail**: Cap filename tokens at the full 200-char limit
-- **Spam**: Fetch mailboxes with `accountId` in `markAsSpam`
-- **Filters**: Load mailboxes when opened directly (#485)
-- **Settings**: Surface server errors on password change and TOTP toggle
-- **Send now**: Gate the toolbar label and translate `send_now` across locales
-- **Directory**: Fix fetching display names
-- **Push**: Reap only relay-confirmed-dead leftover subscriptions
-- **i18n**: Add the missing fa locale to the client `IntlProvider` messages map
-- **i18n**: Add missing translation keys across 19 locales
-
-## 1.7.4 (2026-06-15)
-
-### Features
-
-- **Mail**: New "All Mail" view across folders and accounts
-- **Mail**: Edit contact directly from the email viewer contact sidebar
-- **Calendar**: Recurrence editor, set-default calendar, and timezone-aware calendar queries
-- **Calendar**: Agenda plugin sidecar
-- **Composer**: Email display name support
-- **Composer**: Drag-and-drop recipient chips between To/CC/BCC fields, with the address shown in the drag preview
-- **Composer**: Avatars in recipient autocomplete suggestions, including directory users
-- **Files**: JMAP file/folder sharing in the Files app (#408)
-- **Auth**: QR-code SSO login and device pairing between webmail and the mobile app
-- **Auth**: Require re-authentication for device pairing and SSO
-- **Accounts**: Manage shared/group account settings from the Accounts page
-- **Setup**: Opt-in telemetry in the web setup wizard
-- **Mail**: Persist the email detail sidebar state
-
-### Fixes
-
-- **Mail**: Preserve line breaks in the generated `text/plain` alternative (#421)
-- **Mail**: Fix inconsistent threading of email messages in the inbox and folders
-- **Mail**: Stop draft emails from being marked as unread
-- **Mail**: Prevent wide email tables from rendering with rotated headers (#409)
-- **Mail**: Preserve the folder list when a mailbox refetch hits the concurrent-request limit
-- **Mail**: Correct dark-mode background-image inversion and height clipping in the email viewer
-- **Calendar**: Dedupe scheduling emails and use Stalwart-compatible calendar filters
-- **Calendar**: Redesign the custom recurrence editor to match the modal UI
-- **Files**: Don't send the connected-account key as the JMAP `accountId` when sharing files (#408)
-- **Routing**: Strip the build-time `basePath` from `router.push` redirects after login (#390)
-- **Nav**: Open recent contact emails at `/` instead of 404ing on `/mail`
-- **Nav**: Hide the Add App button when `sidebarAppsEnabled` is false
-- **Settings**: Move the "Plain Text Only" setting from Reading to Composing (#422)
-- **Privacy**: Make telemetry opt-in
-- **UI**: Fix the context menu being invisible on first right-click after page load
-- **Admin**: Remove the JMAP status from the admin dashboard
-- **i18n**: Add missing translation keys across 17 locales
-
-## 1.7.3 (2026-06-04)
-
-### Features
-
-- **Mail**: Inline attachment preview — reliable MIME detection with inline PDF on desktop and mobile
-- **Mail**: Preview composer attachments inline (click to open)
-- **Mail**: Preview `.eml` (`message/rfc822`) attachments like an email
-- **Mail**: Read receipts (MDN, RFC 8098)
-- **Mail**: Editable, layout-preserving quote island when replying
-- **Mail**: Surface the most severe SPF result and hide the "via" badge on spoofed mail
-- **Calendar**: Per-viewer colors for shared calendars (#345)
-- **Filters**: Extended filter rules — attachment field and multi-value conditions
-- **Settings**: New built-in themes — Aurora Glass and Elastic
-- **Settings**: Theme cards render as a mini mailbox mockup from theme colors, with light/dark variant chips
-- **Plugins**: Localizable sandboxed plugins (manifest locales + `api.i18n.t`)
-- **Plugins**: `/api/translate` proxy and email body exposed to plugins
-- **Admin**: Toggle for search-engine indexing (robots)
-- **Admin**: `passwordHashFile` in `admin.json`
-- **Admin**: `sessionSecretFile` and `oauthClientSecretFile` for file-based secrets in JSON config
-- **PWA**: Configurable install screenshots (per-domain)
-- **i18n**: Hungarian locale support
-
-### Fixes
-
-- **Files**: Store Files as real `FileNode` hierarchy, migrate legacy flat-named files on load, and list folders via `FileNode/get` so they are visible (#379)
-- **Files**: Treat a blob-less `FileNode` as the only folder signal and migrate legacy dir-markers
-- **Mail**: Empty Trash for shared and group folders (#387)
-- **Mail**: Move mail from a shared group inbox to a personal inbox (#375)
-- **Mail**: Preserve the HTML signature when sending a quick reply
-- **Mail**: Stop body clipping under the fold when the email sets `html`/`body` `height: 100%`
-- **Mail**: Drop single-letter `R:`/`I:` subject prefix tokens and deduplicate localized reply/forward prefixes
-- **Mail**: No more 404 console spam for missing sender favicons
-- **Auth**: Discover OIDC metadata server-side to avoid CORS failures (#382)
-- **Send**: Route the Sent copy to the shared-mailbox account on per-identity send
-- **Routing**: Honour `basePath` in the plugin sandbox, `http.post` proxy, and branding
-- **i18n**: Localize the PWA install prompt, reply/forward quote header (incl. sender address), `<html lang>`, and per-locale `<head>` description; add missing `settings.folders.role_memos` key
-- **Themes**: Plugin slot iframes inherit host font and color tokens
-- **Theme**: Gate preview "open in new tab" on inline-safe MIME types
-- **Appearance**: Move Themes settings into the Appearance category with a distinct tab icon; clicking the active theme is a no-op
-- **UI**: Fix invisible dark-mode borders (border token collided with secondary)
-- **UI**: Remove the 16px empty strip beside the collapsed sidebar
-- **UI**: Align top bars to a uniform `h-14` height and the account selector header to the search/reply toolbars
-- **UI**: Close pane gaps by centering the resize handle on the seam
-- **Settings**: Fix section gears permanently hijacking the active tab
-
-## 1.7.2 (2026-05-28)
-
-### Features
-
-- **Mail**: Scheduled send and send delay (#322)
-- **Mail**: Drag emails out to the file explorer as `.eml`
-- **Mail**: Import emails from `.zip` archives
-- **Mail**: "Move to Trash and mark as read" delete action (#323)
-- **Mail**: Include group inboxes in the unified mailbox view (#328)
-- **Mail**: Locale-aware date format in the email list with a preset picker (#331)
-- **Mail**: Allow drag-and-drop into shared mailboxes
-- **Composer**: Ctrl/Cmd+Enter sends the open draft
-- **Settings**: New Downloads tab with template editor for `.eml` and attachment filenames
-- **Settings**: Filename transform settings and an ASCII-only "date (from-to) subject" template
-- **Settings**: Post-export action (keep / archive / trash)
-- **Settings**: Template for multi-email `.zip` filenames
-- **Admin**: Per-domain branding editor with overrides on `/api/config`, manifest, and PWA icon (#332)
-- **Admin**: Policy-controlled push relay URL with optional user lock
-- **i18n**: `NEXT_PUBLIC_DEFAULT_LOCALE` for fallback UI locale (#243)
-
-### Fixes
-
-- **Mail**: Editable HTML signature in new mail; clean state on every compose entry (#329)
-- **Mail**: Report real upload progress with XHR progress events (#333)
-- **Mail**: Restore `blob:` in `object-src` and `frame-src` CSP for PDF/HTML previews
-- **Mail**: Match user-avatar treatment on quick reply
-- **Email viewer**: Stop shattering table cells with `word-break: break-word`
-- **Composer**: Scope Ctrl/Cmd+Enter send to the focused composer
-- **Composer**: Stop closing the form when editing any field
-- **Pro**: Keep the empty viewer pane visible in the split layout
-- **Pro**: Prevent an empty main pane when reordering tabs across panes
-- **Mobile**: Collapse focus mail layout to multi-line
-- **Mobile**: Keep a gutter on bare-HTML and plain-text emails
-- **Calendar**: Align continued multi-week events with the week's left edge
-- **Calendar**: Show the end date in the event popover for multi-day events (#318)
-- **Calendar**: Convert `recurrenceRules` to singular in batch create
-- **Calendar**: Handle malformed event dates (#316)
-- **Files**: Stop URL-encoding drag-out filenames and preserve Unicode letters
-- **Routing**: Prefix remaining `<img>`, favicon, and WebDAV URLs with `basePath` (#319)
-- **Routing**: Prefix hand-written URLs with `basePath` for subpath deployments
-- **Auth**: `OAUTH_ALLOW_PRIVATE_ENDPOINTS` for split-DNS setups
-
-### i18n
-
-- Add missing translation keys across 16 locales
-
 ## 1.7.1 (2026-05-22)
 
 ### Features

Dockerfile

@@ -8,10 +8,6 @@ ENV NEXT_TELEMETRY_DISABLED=1
 # at build time, so it cannot be changed without rebuilding.
 ARG NEXT_PUBLIC_BASE_PATH=
 ENV NEXT_PUBLIC_BASE_PATH=$NEXT_PUBLIC_BASE_PATH
-# Optional: avoid next-intl rewrite loops when served under a subpath.
-# Baked in at build time.
-ARG NEXT_PUBLIC_LOCALE_PREFIX=
-ENV NEXT_PUBLIC_LOCALE_PREFIX=$NEXT_PUBLIC_LOCALE_PREFIX
 # Optional: fallback UI locale (e.g. tr, de, fr) used when the visitor's
 # Accept-Language header does not match any supported locale. Baked in at
 # build time because next-intl wires it into client-side routing too.

FEATURES.md

@@ -4,15 +4,10 @@
 
 - Read, compose, reply, reply-all, and forward with a Tiptap rich text editor (inline images, drag-and-drop embedding, tables)
 - Gmail-style threading with inline expansion and an optional conversation toggle
-- Unified Mailbox – combined Inbox, Sent, Drafts, Junk, Archive, and Trash, scoped by default to the active account and its shared/group folders, with an optional admin-gated cross-account mode that spans every connected account
-- Aggregated All mail / Unread / Starred entries in the Unified Mailbox – scoped by the same account boundary (or all accounts in cross-account mode) and narrowed by a per-account folder selection; each list labels the source folder of every message
-- Search inside the Unified Mailbox – text search across every unified view (the per-role mailboxes and the folder-selected All mail / Unread / Starred lists); advanced filters are additionally available in the per-role unified mailboxes
+- Unified mailbox view across all connected accounts
 - Three selectable mail layouts: split (three-pane), focused list, and reading pane at bottom
 - Draft auto-save with identity preservation, persisted HTML body, and proper `In-Reply-To` / `References` headers on replies
-- Attachment upload, download, drag-out to local file system, and inline preview – images, inline PDF on desktop and mobile, composer attachments (click to open), and `.eml` (`message/rfc822`) attachments rendered like an email; image thumbnails and forgotten-attachment warning
-- Scheduled send and configurable send delay
-- Read receipts (MDN, RFC 8098)
-- Editable, layout-preserving quote island when replying
+- Attachment upload, download, drag-out to local file system, and inline preview; image thumbnails and forgotten-attachment warning
 - Full-text search with JMAP filter panel, search chips, wildcards, OR conditions, and cross-mailbox queries
 - Batch operations – multi-select, archive, delete, move, tag
 - Archive modes – direct, by year, or by month
@@ -41,7 +36,7 @@
 - Auto-generated birthday calendar from contacts
 - Virtual locations (video conference URLs) as first-class event fields
 - Task management with due dates, priority, and completion status
-- Shared calendars with CalDAV discovery, multi-account home resolution, and per-viewer colors
+- Shared calendars with CalDAV discovery and multi-account home resolution
 - Week numbers, event hover preview, notifications with sound picker
 - Real-time sync via JMAP push
 
@@ -57,7 +52,7 @@
 ## Filters & Templates
 
 - Server-side filters via JMAP Sieve Scripts (RFC 9661)
-- Visual rule builder with expanded view; conditions (From, To, Subject, Size, Body, Attachment…) with multi-value matching and actions (Move, Forward, Star, Discard…)
+- Visual rule builder with expanded view; conditions (From, To, Subject, Size, Body…) and actions (Move, Forward, Star, Discard…)
 - Preserves rules authored in other clients
 - Raw Sieve editor with syntax validation
 - Vacation responder with date range scheduling
@@ -65,20 +60,19 @@
 
 ## Files
 
-- JMAP FileNode browser (Stalwart native cloud storage) with a real folder hierarchy; legacy flat-named files are migrated into nested `FileNode` folders automatically on load
+- JMAP FileNode browser (Stalwart native cloud storage)
 - Streamed WebDAV PUT upload and folder upload with progress tracking
 - Dynamic upload limits based on server configuration
 - Grid and list views with sorting by name, size, or date
 - Previews for images, text, audio, and video
 - Clipboard operations (cut, copy, paste, duplicate), favorites, and recent files
-- JMAP sharing (RFC 9670) for files and folders – share with users or groups at read, read/write, or manager levels via a principal picker, with share indicators and a "Shared with me" sidebar section for folders other principals have shared with you
 
 ## Security & Privacy
 
 - External content blocked by default, with a trusted senders list
 - HTML sanitization via DOMPurify
 - S/MIME – manage certificates, sign, encrypt, decrypt, and verify; legacy 3DES / PBE support; per-account key isolation
-- SPF / DKIM / DMARC status indicators – surfaces the most severe SPF result and hides the "via" badge on spoofed mail
+- SPF / DKIM / DMARC status indicators
 - OAuth2 / OIDC with PKCE (Keycloak, Authentik, or built-in), OAuth-only mode, OAuth app passwords, and non-interactive SSO for embedded deployments
 - TOTP two-factor authentication
 - Account security panel for password and 2FA management via the Stalwart admin API
@@ -91,7 +85,6 @@
 
 - Selectable mail layouts (split three-pane, focused list, reading pane at bottom) with resizable columns
 - Dark and light themes with intelligent email color transformation
-- Bundled color themes including Aurora Glass and Elastic; theme cards render as a mini mailbox mockup built from the theme's own colors, with light/dark variant chips
 - Responsive desktop, tablet, and mobile layouts
 - Full keyboard navigation
 - Drag-and-drop email organization and tag assignment
@@ -105,7 +98,7 @@
 
 ## Internationalization
 
-19 languages: Česky · Dansk · Deutsch · English · Español · Français · Italiano · Latviešu · Magyar · Nederlands · Polski · Português · Română · Türkçe · Русский · Українська · 한국어 · 日本語 · 简体中文
+17 languages: Česky · Dansk · Deutsch · English · Español · Français · Italiano · Latviešu · Nederlands · Polski · Português · Türkçe · Русский · Українська · 한국어 · 日本語 · 简体中文
 
 Automatic browser detection with persistent preference. Configurable locale URL prefix via `NEXT_PUBLIC_LOCALE_PREFIX`.
 
@@ -117,7 +110,6 @@ Automatic browser detection with persistent preference. Configurable locale URL
 - Configurable signature position (above or below quoted text)
 - Sub-addressing (`user+tag@domain.com`) with configurable delimiter and contextual tag suggestions
 - Shared folders across accounts
-- Shared / group (delegated) accounts: their folders appear alongside your own and can be merged into the Unified Mailbox ("Include group inboxes"); their messages are fully actionable there – open, mark read, spam / not-spam, move, delete, and archive – with folder unread counts kept in sync
 - Multiple JMAP servers per deployment with optional auto-pick by email domain
 - Optional custom JMAP endpoints on the login form (`ALLOW_CUSTOM_JMAP_ENDPOINT`)
 
@@ -125,11 +117,8 @@ Automatic browser detection with persistent preference. Configurable locale URL
 
 - Web setup wizard for first launch – guides through JMAP server(s), OAuth/OIDC, session secret, logging, branding (with file upload), and admin password; persists to the admin config dir, no `.env.local` editing required
 - Stalwart admin dashboard with dedicated policy sections, collapsed into a single tabbed page
-- Admin policy gates for the Unified Mailbox – enable or disable the All mail / Unread / Starred entries org-wide, plus a cross-account capability gate (off by default; auto-enabled on upgrade for instances that already used the cross-account views); each gated view still respects the user's own toggle
 - Split admin storage: `ADMIN_CONFIG_DIR` (operator-authored, mountable read-only after setup) and `ADMIN_STATE_DIR` (runtime audit log and login timestamps)
-- File-based secrets for JSON config: `passwordHashFile` (admin password), `sessionSecretFile`, and `oauthClientSecretFile` for Docker/Kubernetes secret mounts
-- Admin toggle for search-engine indexing (`robots.txt` / `noindex`)
-- Plugin system – schema-driven config UI, render and intercept hooks, `onAvatarResolve`, `onBeforeEmailSend`, composer-sidebar and email-banner slots, calendar event slots, i18n APIs (localizable sandboxed plugins via manifest locales and `api.i18n.t`), an `/api/translate` proxy, email-body access, and managed policy enforcement
+- Plugin system – schema-driven config UI, render and intercept hooks, `onAvatarResolve`, `onBeforeEmailSend`, composer-sidebar and email-banner slots, calendar event slots, i18n APIs, and managed policy enforcement
 - Plugin hot-reload and dev-folder loading, on-demand `src/` bundling via esbuild, and `http:fetch` permission with `httpOrigins`
 - Themes – upload, enforce, and manage admin-controlled themes as ZIP bundles
 - Extension marketplace – browse and install plugins and themes from a configurable directory (`EXTENSION_DIRECTORY_URL`); install/uninstall restricted to the admin dashboard
@@ -137,10 +126,10 @@ Automatic browser detection with persistent preference. Configurable locale URL
 
 ## Operations
 
-- Progressive Web App with service worker, install prompt, web push notifications for inbox mail, dynamic manifest, and configurable (per-domain) install screenshots
+- Progressive Web App with service worker, install prompt, web push notifications for inbox mail, and dynamic manifest
 - Automatic update check with server-side logging of new releases and a non-dismissible update notice
 - Structured logging (`text` or `json`) with category-based levels
-- Anonymous instance telemetry (opt-in via admin UI, the installer, or `BULWARK_TELEMETRY=on`; off by default) – version, platform, bucketed account counts, feature toggles only
+- Anonymous instance telemetry (opt-out via admin UI or `BULWARK_TELEMETRY=off`) – version, platform, bucketed account counts, feature toggles only
 - Release (`main`) and development (`dev`) Docker images on GHCR
 - Subpath deployment via `NEXT_PUBLIC_BASE_PATH` for mounting behind a reverse proxy
 - Demo mode with fixture data – no mail server required

README.md

@@ -12,8 +12,10 @@ A modern, self-hosted webmail client for [Stalwart Mail Server](https://stalw.ar
 
 [![License: AGPL v3](https://img.shields.io/badge/license-AGPL%20v3-blue.svg?logo=gnu&logoColor=white)](LICENSE)
 [![Discord](https://img.shields.io/discord/1482128142939455674?color=7289da&label=discord&logo=discord&logoColor=white)](https://discord.gg/tYCujymGrT)
-[![Version](https://img.shields.io/badge/version-1.7.8-green.svg?logo=git&logoColor=white)](CHANGELOG.md)
+[![Version](https://img.shields.io/badge/version-1.7.1-green.svg?logo=git&logoColor=white)](CHANGELOG.md)
 [![Docker](https://img.shields.io/badge/docker-ghcr.io%2Fbulwarkmail%2Fwebmail-blue?logo=docker&logoColor=white)](https://ghcr.io/bulwarkmail/webmail)
+[![Grafana](https://img.shields.io/badge/grafana-dashboard-orange?logo=grafana&logoColor=white)](https://grafana.external.bulwarkmail.org/)
+
 </div>
 
 ---
@@ -79,12 +81,12 @@ The wizard writes to `ADMIN_CONFIG_DIR` (`./data/admin` by default). Setting `JM
 
 Bulwark is a full webmail suite, not just an inbox. It bundles the four apps most self-hosters end up wanting on the same login:
 
-- **Mail** – threading, unified inbox, cross-account "All accounts" views, full-text search, Sieve filters, S/MIME, templates
+- **Mail** – threading, unified inbox, full-text search, Sieve filters, S/MIME, templates
 - **Calendar** – month/week/day/agenda, recurring events, iMIP invitations, CalDAV subscriptions
 - **Contacts** – multiple address books, groups, vCard import/export
 - **Files** – Stalwart's JMAP FileNode storage with previews and folder upload
 
-Plus the infrastructure around them: a web setup wizard, OAuth2 / OIDC SSO, TOTP 2FA, multi-account with HTTP/2 connection pooling, 18 languages, PWA install, dark/light themes, a plugin system with an extension marketplace, and an admin dashboard.
+Plus the infrastructure around them: a web setup wizard, OAuth2 / OIDC SSO, TOTP 2FA, multi-account with HTTP/2 connection pooling, 15 languages, PWA install, dark/light themes, a plugin system with an extension marketplace, and an admin dashboard.
 
 Full feature list: **[FEATURES.md](FEATURES.md)**.
 
@@ -209,12 +211,6 @@ LOGIN_COMPANY_NAME=My Company
 LOGIN_WEBSITE_URL=https://example.com
 LOGIN_IMPRINT_URL=https://example.com/imprint
 LOGIN_PRIVACY_POLICY_URL=https://example.com/privacy
-
-# Per-domain overrides (optional). When the webmail is served on multiple
-# hostnames, each host can override any subset of the branding fields above.
-# Match is on the request Host (or X-Forwarded-Host). Use "*.example.com" to
-# match any subdomain. Unset fields fall back to the global values.
-DOMAIN_BRANDING=[{"host":"maildomain1.com","loginCompanyName":"Company One","loginLogoLightUrl":"/branding/one.svg"},{"host":"maildomain2.com","loginCompanyName":"Company Two"}]
 ```
 
 </details>

VERSION

@@ -1 +1 @@
-1.7.8
+1.7.1

app/(main)/[locale]/auth/callback/page.tsx

@@ -4,7 +4,7 @@ import { Suspense, useEffect, useState } from "react";
 import { useRouter, useSearchParams } from "next/navigation";
 import { useTranslations } from "next-intl";
 import { useAuthStore } from "@/stores/auth-store";
-import { apiFetch, getPathPrefix, toRouterPath } from "@/lib/browser-navigation";
+import { apiFetch, getPathPrefix } from "@/lib/browser-navigation";
 import { Loader2, AlertCircle } from "lucide-react";
 import { Button } from "@/components/ui/button";
 import { useParams } from "next/navigation";
@@ -32,42 +32,6 @@ function OAuthCallbackInner() {
       return;
     }
 
-    // Step-up re-auth for device pairing: the QR generator sent the user here
-    // via prompt=login. Don't create a login session — just confirm the fresh
-    // auth (sets the short-lived pairing proof cookie) and bounce back to the
-    // Security settings, where the QR generation auto-resumes.
-    let pairReauthResume = false;
-    try {
-      pairReauthResume = sessionStorage.getItem("pair_reauth_resume") === "1";
-    } catch { /* sessionStorage unavailable */ }
-    if (pairReauthResume && state) {
-      try { sessionStorage.removeItem("pair_reauth_resume"); } catch { /* ignore */ }
-      (async () => {
-        try {
-          const res = await apiFetch("/api/auth/reauth/sso/complete", {
-            method: "POST",
-            headers: { "Content-Type": "application/json" },
-            credentials: "include",
-            body: JSON.stringify({ code, state }),
-          });
-          if (!res.ok) {
-            setError("token_exchange_failed");
-            return;
-          }
-          try {
-            sessionStorage.setItem("pair_reauth_done", "1");
-            // Land back on the Security tab (readPersistedTab reads this key).
-            sessionStorage.setItem("settings-deep-link-tab", "security");
-          } catch { /* ignore */ }
-          const prefix = getPathPrefix(params.locale as string);
-          router.push(toRouterPath(`${prefix}/${params.locale}/settings`));
-        } catch {
-          setError("token_exchange_failed");
-        }
-      })();
-      return;
-    }
-
     const savedState = sessionStorage.getItem("oauth_state");
 
     if (savedState) {
@@ -105,7 +69,7 @@ function OAuthCallbackInner() {
                 redirectTo = saved;
               }
             } catch { /* sessionStorage may be unavailable */ }
-            router.push(toRouterPath(redirectTo));
+            router.push(redirectTo);
           } else {
             setError("token_exchange_failed");
           }
@@ -189,7 +153,7 @@ function OAuthCallbackInner() {
                 redirectTo = saved;
               }
             } catch { /* sessionStorage may be unavailable */ }
-            router.push(toRouterPath(redirectTo));
+            router.push(redirectTo);
           } else {
             setError("token_exchange_failed");
           }
@@ -217,7 +181,7 @@ function OAuthCallbackInner() {
           </p>
           <Button
             variant="outline"
-            onClick={() => router.push(toRouterPath(`${getPathPrefix(params.locale as string)}/${params.locale}/login`))}
+            onClick={() => router.push(`${getPathPrefix(params.locale as string)}/${params.locale}/login`)}
           >
             {t("oauth_error.back_to_login")}
           </Button>

app/(main)/[locale]/calendar/page.tsx

@@ -16,7 +16,6 @@ import { useEmailStore } from "@/stores/email-store";
 import { useSettingsStore } from "@/stores/settings-store";
 import { useIdentityStore } from "@/stores/identity-store";
 import { useAccountStore } from "@/stores/account-store";
-import { usePolicyStore } from "@/stores/policy-store";
 import { toast } from "@/stores/toast-store";
 import { useIsDesktop, useIsMobile } from "@/hooks/use-media-query";
 import { Button } from "@/components/ui/button";
@@ -61,7 +60,6 @@ import { useConfirmDialog } from "@/hooks/use-confirm-dialog";
 import { CreateCalendarModal } from "@/components/calendar/create-calendar-modal";
 import { getUserParticipantId } from "@/lib/calendar-participants";
 import { generateBirthdayEvents, createBirthdayCalendar, BIRTHDAY_CALENDAR_ID } from "@/lib/birthday-calendar";
-import { sharedCalendarColorKey, pickUnusedCalendarColor } from "@/lib/shared-calendar-colors";
 import { debug } from "@/lib/debug";
 import { consumePendingWebcal, hasPendingWebcal, subscribeToPendingWebcal } from "@/lib/protocol-handlers/session";
 import type { ParsedWebcal } from "@/lib/protocol-handlers/webcal";
@@ -98,11 +96,7 @@ export default function CalendarPage() {
     removeCalendar, clearCalendarEvents,
     refreshAllSubscriptions, icalSubscriptions,
   } = useCalendarStore();
-  const calendarEnabled = usePolicyStore((s) => s.isFeatureEnabled('calendarEnabled'));
   const { firstDayOfWeek, timeFormat, showWeekNumbers, enableCalendarTasks, showTasksOnCalendar, calendarHoverPreview, showBirthdayCalendar, birthdayCalendarColor, updateSetting } = useSettingsStore();
-  const sharedCalendarColors = useSettingsStore((s) => s.sharedCalendarColors);
-  const setSharedCalendarColor = useSettingsStore((s) => s.setSharedCalendarColor);
-  const removeSharedCalendarColor = useSettingsStore((s) => s.removeSharedCalendarColor);
   const taskStore = useTaskStore();
   const fetchTasksFn = useTaskStore(state => state.fetchTasks);
   const { identities } = useIdentityStore();
@@ -181,13 +175,10 @@ export default function CalendarPage() {
     if (initialCheckDone && !isAuthenticated && !authLoading) {
       try { sessionStorage.setItem('redirect_after_login', window.location.pathname); } catch { /* ignore */ }
       redirectToLogin();
-    } else if (client && !calendarEnabled) {
-      // Calendar disabled by admin policy - send the user back to mail.
-      router.push("/");
     } else if (client && !supportsCalendar && !pendingWebcalAccountChoice && !isProtocolAccountSwitching && !pendingSubscription && !showWebcalActionChoice && !hasPendingWebcal()) {
       router.push("/");
     }
-  }, [initialCheckDone, isAuthenticated, authLoading, client, calendarEnabled, supportsCalendar, pendingWebcalAccountChoice, isProtocolAccountSwitching, pendingSubscription, showWebcalActionChoice, router]);
+  }, [initialCheckDone, isAuthenticated, authLoading, client, supportsCalendar, pendingWebcalAccountChoice, isProtocolAccountSwitching, pendingSubscription, showWebcalActionChoice, router]);
 
   useEffect(() => {
     if (error) {
@@ -1039,47 +1030,10 @@ export default function CalendarPage() {
     try { return t('birthday_calendar'); } catch { return 'Birthdays'; }
   })();
 
-  // Apply each shared calendar's local color override (per-viewer recolor,
-  // #345). The override replaces the calendar's color and wins over per-event
-  // colors via the `colorIsLocalOverride` flag (see getEventColor). Personal
-  // calendars are passed through untouched.
-  const displayCalendars = useMemo(() => {
-    return calendars.map((cal) => {
-      if (!cal.isShared) return cal;
-      const override = sharedCalendarColors[sharedCalendarColorKey(cal)];
-      if (!override) return cal;
-      return { ...cal, color: override, colorIsLocalOverride: true };
-    });
-  }, [calendars, sharedCalendarColors]);
-
-  // Auto-assign a random, not-yet-used palette color to any freshly shared
-  // calendar so multiple shared calendars don't collide on one color. Runs
-  // once per calendar (guarded by the presence of an existing key), and the
-  // user can still overwrite it from the sidebar.
-  useEffect(() => {
-    const shared = calendars.filter((c) => c.isShared);
-    const missing = shared.filter((c) => !sharedCalendarColors[sharedCalendarColorKey(c)]);
-    if (missing.length === 0) return;
-    // Seed "used" with personal calendar colors plus already-assigned shared
-    // overrides so the picks stay distinct from what's already on screen.
-    const used = new Set<string>();
-    for (const c of calendars) {
-      if (!c.isShared && c.color) used.add(c.color.toLowerCase());
-    }
-    for (const color of Object.values(sharedCalendarColors)) {
-      if (color) used.add(color.toLowerCase());
-    }
-    for (const cal of missing) {
-      const color = pickUnusedCalendarColor(used);
-      used.add(color.toLowerCase());
-      setSharedCalendarColor(sharedCalendarColorKey(cal), color);
-    }
-  }, [calendars, sharedCalendarColors, setSharedCalendarColor]);
-
   const allCalendars = useMemo(() => {
-    if (!showBirthdayCalendar) return displayCalendars;
-    return [...displayCalendars, createBirthdayCalendar(birthdayCalendarName, birthdayCalendarColor)];
-  }, [displayCalendars, showBirthdayCalendar, birthdayCalendarName, birthdayCalendarColor]);
+    if (!showBirthdayCalendar) return calendars;
+    return [...calendars, createBirthdayCalendar(birthdayCalendarName, birthdayCalendarColor)];
+  }, [calendars, showBirthdayCalendar, birthdayCalendarName, birthdayCalendarColor]);
 
   const visibleEvents = useMemo(() => {
     const filtered = events.filter((e) => {
@@ -1149,13 +1103,13 @@ export default function CalendarPage() {
         </div>
         <div className="px-6 py-4 space-y-3">
           <Button variant="outline" className="w-full justify-start h-auto py-3" onClick={handleImportWebcal}>
-            <span className="text-start">
+            <span className="text-left">
               <span className="block font-medium">{tWebcalAction("import_title")}</span>
               <span className="block text-xs text-muted-foreground mt-0.5">{tWebcalAction("import_description")}</span>
             </span>
           </Button>
           <Button variant="outline" className="w-full justify-start h-auto py-3" onClick={handleSubscribeWebcal}>
-            <span className="text-start">
+            <span className="text-left">
               <span className="block font-medium">{tWebcalAction("subscribe_title")}</span>
               <span className="block text-xs text-muted-foreground mt-0.5">{tWebcalAction("subscribe_description")}</span>
             </span>
@@ -1169,7 +1123,6 @@ export default function CalendarPage() {
   ) : null;
 
   if (!isAuthenticated) return null;
-  if (!calendarEnabled) return null;
   if (!supportsCalendar) return renderWebcalAccountPicker();
 
   const renderView = () => {
@@ -1266,7 +1219,7 @@ export default function CalendarPage() {
               />
               <TaskListView
                 tasks={taskStore.tasks}
-                calendars={displayCalendars}
+                calendars={calendars}
                 selectedCalendarIds={selectedCalendarIds}
                 filter={taskStore.filter}
                 showCompleted={taskStore.showCompleted}
@@ -1336,7 +1289,7 @@ export default function CalendarPage() {
         <>
           <div
             className={cn(
-              "border-e border-border bg-secondary overflow-y-auto flex-shrink-0 p-3",
+              "border-r border-border bg-secondary overflow-y-auto flex-shrink-0 p-3",
               !isResizing && "transition-[width] duration-300",
               isNarrow && cn(
                 "absolute inset-y-0 left-0 z-50 w-72 pt-[env(safe-area-inset-top)]",
@@ -1364,21 +1317,8 @@ export default function CalendarPage() {
                   updateSetting('birthdayCalendarColor', color);
                   return;
                 }
-                // Shared calendars: recolor locally only (the viewer usually
-                // can't write the owner's calendar, and it'd recolor it for
-                // everyone). Personal calendars write through to the server.
-                const cal = allCalendars.find((c) => c.id === calendarId);
-                if (cal?.isShared) {
-                  setSharedCalendarColor(sharedCalendarColorKey(cal), color);
-                  return;
-                }
                 updateCalendar(client, calendarId, { color });
               } : undefined}
-              onResetColor={(cal) => {
-                // Drop the local override; the auto-assign effect picks a
-                // fresh unused color (so it never reverts to a collision).
-                removeSharedCalendarColor(sharedCalendarColorKey(cal));
-              }}
               onShareCalendar={client ? (cal) => setSharingCalendarId(cal.id) : undefined}
               onCreateEvent={(cal: Calendar) => {
                 setDefaultCalendarIdForCreate(cal.id);
@@ -1449,7 +1389,7 @@ export default function CalendarPage() {
           onSubscribe={() => setShowSubscriptionModal(true)}
           isMobile={isMobile}
           onNavigateBack={isMobile && mobileReturnToMonth && normalizedViewMode === "day" ? navigateBackToMonth : undefined}
-          calendars={displayCalendars}
+          calendars={calendars}
           selectedCalendarIds={selectedCalendarIds}
           onToggleVisibility={toggleCalendarVisibility}
           enableCalendarTasks={enableCalendarTasks}
@@ -1475,11 +1415,11 @@ export default function CalendarPage() {
 
           {/* Desktop event panel */}
           {!isMobile && showEventModal && (
-            <div className="w-[400px] border-s border-border flex-shrink-0 overflow-hidden">
+            <div className="w-[400px] border-l border-border flex-shrink-0 overflow-hidden">
               <EventModal
                 key={editEvent?.id ?? 'new'}
                 event={editEvent}
-                calendars={displayCalendars}
+                calendars={calendars}
                 defaultDate={defaultModalDate}
                 defaultEndDate={defaultModalEndDate}
                 defaultAllDay={defaultModalAllDay}
@@ -1498,11 +1438,11 @@ export default function CalendarPage() {
 
           {/* Desktop task panel */}
           {!isMobile && showTaskModal && (
-            <div className="w-[400px] border-s border-border flex-shrink-0 overflow-hidden">
+            <div className="w-[400px] border-l border-border flex-shrink-0 overflow-hidden">
               <TaskModal
                 key={editTask?.id ?? 'new-task'}
                 task={editTask}
-                calendars={displayCalendars}
+                calendars={calendars}
                 onSave={handleSaveTask}
                 onDelete={handleDeleteTask}
                 onClose={() => { setShowTaskModal(false); setEditTask(null); }}
@@ -1589,7 +1529,7 @@ export default function CalendarPage() {
       {detailEvent && detailAnchorRect && (
         <EventDetailPopover
           event={detailEvent}
-          calendar={displayCalendars.find(c => detailEvent.calendarIds[c.id])}
+          calendar={calendars.find(c => detailEvent.calendarIds[c.id])}
           anchorRect={detailAnchorRect}
           onEdit={handleEditFromDetail}
           onDelete={handleDeleteFromDetail}
@@ -1609,7 +1549,7 @@ export default function CalendarPage() {
         <EventModal
           key={editEvent?.id ?? 'new'}
           event={editEvent}
-          calendars={displayCalendars}
+          calendars={calendars}
           defaultDate={defaultModalDate}
           defaultEndDate={defaultModalEndDate}
           defaultAllDay={defaultModalAllDay}
@@ -1626,7 +1566,7 @@ export default function CalendarPage() {
 
       {showImportModal && client && (
         <ICalImportModal
-          calendars={displayCalendars}
+          calendars={calendars}
           client={client}
           initialUrl={pendingSubscription?.url}
           onClose={() => {

app/(main)/[locale]/contacts/page.tsx

@@ -18,9 +18,7 @@ import { ContactImportDialog } from "@/components/contacts/contact-import-dialog
 import { RenameDialog } from "@/components/files/rename-dialog";
 import { exportContacts } from "@/components/contacts/contact-export";
 import { AppTopBannerSlot } from "@/components/plugins/app-top-banner-slot";
-import { useContactStore, getContactDisplayName, getContactPrimaryEmail } from "@/stores/contact-store";
-import { savePendingMailto } from "@/lib/protocol-handlers/session";
-import { formatRecipient, formatRecipientEntry, type Recipient } from "@/lib/email-composer-utils";
+import { useContactStore, getContactDisplayName } from "@/stores/contact-store";
 import { useAuthStore, redirectToLogin } from "@/stores/auth-store";
 import { useEmailStore } from "@/stores/email-store";
 import { usePolicyStore } from "@/stores/policy-store";
@@ -84,7 +82,6 @@ export default function ContactsPage() {
     bulkDeleteContacts,
     bulkAddToGroup,
     moveContactToAddressBook,
-    createAddressBook,
     renameAddressBook,
     removeAddressBook,
     shareAddressBook,
@@ -96,7 +93,6 @@ export default function ContactsPage() {
   const [activeCategory, setActiveCategory] = useState<ContactCategory>("all");
   const [showImportDialog, setShowImportDialog] = useState(false);
   const [renamingAddressBook, setRenamingAddressBook] = useState<AddressBook | null>(null);
-  const [creatingAddressBook, setCreatingAddressBook] = useState(false);
   const [sharingAddressBookId, setSharingAddressBookId] = useState<string | null>(null);
   const [defaultBookIdForCreate, setDefaultBookIdForCreate] = useState<string | undefined>(undefined);
   const [createPrefill, setCreatePrefill] = useState<{ email?: string; name?: string } | undefined>(undefined);
@@ -177,13 +173,12 @@ export default function ContactsPage() {
     const addEmail = searchParams.get('addEmail');
     const addName = searchParams.get('addName');
     const from = searchParams.get('from');
-    const viewParam = searchParams.get('view');
     if (!contactId && !addEmail && !from) return;
     intentAppliedRef.current = true;
     if (from === 'email') setReturnToEmail(true);
     if (contactId) {
       setSelectedContact(contactId);
-      setView(viewParam === 'edit' ? 'edit' : 'detail');
+      setView('detail');
     } else if (addEmail) {
       setCreatePrefill({ email: addEmail, name: addName ?? undefined });
       setSelectedContact(null);
@@ -302,34 +297,6 @@ export default function ContactsPage() {
     }
   }, [client, supportsSync, contacts, updateContact, updateLocalContact, t]);
 
-  // Refresh address books (and contacts) after a structural change, staying
-  // multi-account aware so a freshly created book lands in the sidebar.
-  const refreshAddressBooks = useCallback(async () => {
-    if (!client) return;
-    if (multiAccountEnabled && accountClients.length > 0) {
-      const activeId = useAuthStore.getState().activeAccountId;
-      if (activeId) {
-        const { fetchAllAccountsAddressBooks } = useContactStore.getState();
-        await fetchAllAccountsAddressBooks(accountClients, activeId);
-        return;
-      }
-    }
-    await useContactStore.getState().fetchAddressBooks(client);
-  }, [client, multiAccountEnabled, accountClients]);
-
-  const handleCreateAddressBook = useCallback(async (name: string) => {
-    if (!client) return;
-    try {
-      await createAddressBook(client, name);
-      await refreshAddressBooks();
-      toast.success(t("address_books.created"));
-      setCreatingAddressBook(false);
-    } catch (error) {
-      console.error('Failed to create address book:', error);
-      toast.error(t("address_books.create_failed"));
-    }
-  }, [client, createAddressBook, refreshAddressBooks, t]);
-
   const handleImportContacts = useCallback(async (importedContacts: ContactCard[]) => {
     return importContacts(
       supportsSync && client ? client : null,
@@ -400,8 +367,8 @@ export default function ContactsPage() {
   }, [clearSelection, toggleContactSelection, groups.length]);
 
   const handleDuplicateContact = useCallback(async (source: ContactCard) => {
-    const { id: _id, uid: _uid, created: _created, updated: _updated, ...rest } = source;
-    void _id; void _uid; void _created; void _updated;
+    const { id: _id, created: _created, updated: _updated, ...rest } = source;
+    void _id; void _created; void _updated;
     const data: Partial<ContactCard> = JSON.parse(JSON.stringify(rest));
     if (supportsSync && client) {
       await createContact(client, data);
@@ -493,59 +460,6 @@ export default function ContactsPage() {
     setView("group-edit");
   }, []);
 
-  // Open the in-app composer in the current session rather than routing through
-  // a mailto: URL. `window.location='mailto:'` hands off to the OS handler
-  // (which may open a different mail app), and the mailto protocol round-trip
-  // reloads the app - dropping the in-memory per-account JMAP clients of a
-  // multi-account session, which reads as a logout. Stashing the recipients and
-  // doing a client-side router.push keeps the session and the active account
-  // intact; the main route consumes the pending compose and opens the composer
-  // (see consumePendingMailto in page.tsx).
-  const openComposeInApp = useCallback((recipients: string[], field: "to" | "cc" | "bcc") => {
-    savePendingMailto({
-      to: field === "to" ? recipients : [],
-      cc: field === "cc" ? recipients : [],
-      bcc: field === "bcc" ? recipients : [],
-      subject: "",
-      body: "",
-    });
-    router.push("/");
-  }, [router]);
-
-  const handleComposeGroupFromSidebar = useCallback((groupId: string, field: "to" | "cc" | "bcc") => {
-    // Hand the composer a single group chip (RFC 5322 group syntax survives
-    // the string hand-off) instead of one entry per member - the chip expands
-    // into the members when the message is sent. Dedupe by email,
-    // case-insensitively; members without an email are skipped.
-    const seen = new Set<string>();
-    const members: Array<{ name?: string; email: string }> = [];
-    for (const member of getGroupMembers(groupId)) {
-      const email = getContactPrimaryEmail(member).trim();
-      const key = email.toLowerCase();
-      if (!email || seen.has(key)) continue;
-      seen.add(key);
-      const name = getContactDisplayName(member);
-      members.push({ name: name && name !== email ? name : undefined, email });
-    }
-    if (members.length === 0) {
-      toast.error(t("groups.no_member_emails"));
-      return;
-    }
-    const group = useContactStore.getState().contacts.find((c) => c.id === groupId);
-    const chip: Recipient = {
-      name: (group && getContactDisplayName(group)) || "Group",
-      email: "",
-      group: { members },
-    };
-    openComposeInApp([formatRecipientEntry(chip)], field);
-  }, [getGroupMembers, t, openComposeInApp]);
-
-  const handleComposeContact = useCallback((contact: ContactCard) => {
-    const email = getContactPrimaryEmail(contact).trim();
-    if (!email) return;
-    openComposeInApp([formatRecipient(getContactDisplayName(contact), email)], "to");
-  }, [openComposeInApp]);
-
   const handleDeleteGroupFromSidebar = useCallback(async (groupId: string) => {
     const confirmed = await confirmDialog({
       title: t("groups.delete_confirm_title"),
@@ -710,7 +624,6 @@ export default function ContactsPage() {
             onEdit={handleEditGroup}
             onDelete={handleDeleteGroup}
             onRemoveMember={handleRemoveGroupMember}
-            onComposeGroup={(field) => handleComposeGroupFromSidebar(selectedGroup.id, field)}
             isMobile={isMobile}
             onSelectMember={(id) => {
               setSelectedContact(id);
@@ -759,7 +672,7 @@ export default function ContactsPage() {
                   <button
                     key={group.id}
                     onClick={() => handleBulkAddToGroupConfirm(group.id)}
-                    className="w-full flex items-center gap-3 px-6 py-3 text-start hover:bg-muted transition-colors"
+                    className="w-full flex items-center gap-3 px-6 py-3 text-left hover:bg-muted transition-colors"
                   >
                     <div className="w-9 h-9 rounded-full bg-primary/10 flex items-center justify-center flex-shrink-0">
                       <Users className="w-4 h-4 text-primary" />
@@ -788,11 +701,6 @@ export default function ContactsPage() {
             contact={selectedContact}
             onEdit={handleEdit}
             onDelete={handleDelete}
-            onCompose={
-              selectedContact
-                ? () => handleComposeContact(selectedContact)
-                : undefined
-            }
             onAddToGroup={
               selectedContact
                 ? () => handleAddContactToGroup(selectedContact.id)
@@ -877,7 +785,7 @@ export default function ContactsPage() {
                 <>
                   <div
                     className={cn(
-                      "border-e border-border flex flex-col flex-shrink-0 bg-background",
+                      "border-r border-border flex flex-col flex-shrink-0 bg-background",
                       !isSidebarResizing && "transition-[width] duration-300",
                       isNarrow && cn(
                         "absolute inset-y-0 left-0 z-50 w-72 pt-[env(safe-area-inset-top)]",
@@ -895,11 +803,9 @@ export default function ContactsPage() {
                       onSelectCategory={handleSelectCategory}
                       onCreateGroup={handleCreateGroup}
                       onCreateContact={handleCreateNew}
-                      onCreateAddressBook={client ? () => setCreatingAddressBook(true) : undefined}
                       onImport={() => setShowImportDialog(true)}
                       onEditGroup={handleEditGroupFromSidebar}
                       onDeleteGroup={handleDeleteGroupFromSidebar}
-                      onComposeGroup={handleComposeGroupFromSidebar}
                       onDropContacts={handleDropContacts}
                       onDropContactsToCategory={handleDropContactsToCategory}
                       onRenameAddressBook={client ? (book) => setRenamingAddressBook(book) : undefined}
@@ -945,7 +851,7 @@ export default function ContactsPage() {
               <div
                 data-tour="contacts-list"
                 className={cn(
-                  "border-e border-border bg-background flex flex-col flex-shrink-0",
+                  "border-r border-border bg-background flex flex-col flex-shrink-0",
                   isMobile ? "w-full" : "",
                   !isListResizing && !isMobile && "transition-[width] duration-300"
                 )}
@@ -999,7 +905,7 @@ export default function ContactsPage() {
                     onClick={mobileBackToList}
                     className="touch-manipulation"
                   >
-                    <ArrowLeft className="w-4 h-4 me-2" />
+                    <ArrowLeft className="w-4 h-4 mr-2" />
                     {returnToEmail ? t("back_to_email") : t("back_to_contacts")}
                   </Button>
                 </div>
@@ -1045,15 +951,6 @@ export default function ContactsPage() {
           }}
         />
       )}
-      {creatingAddressBook && (
-        <RenameDialog
-          currentName=""
-          title={t("address_books.create")}
-          label={t("address_books.name_label")}
-          onCancel={() => setCreatingAddressBook(false)}
-          onConfirm={handleCreateAddressBook}
-        />
-      )}
       {renamingAddressBook && (
         <RenameDialog
           currentName={renamingAddressBook.name}

app/(main)/[locale]/error.tsx

@@ -38,11 +38,11 @@ export default function LocaleError({
         </p>
         <div className="flex gap-3 justify-center">
           <Button variant="outline" onClick={() => router.push('/')}>
-            <Home className="w-4 h-4 me-2" />
+            <Home className="w-4 h-4 mr-2" />
             {t("go_home")}
           </Button>
           <Button onClick={reset}>
-            <RefreshCw className="w-4 h-4 me-2" />
+            <RefreshCw className="w-4 h-4 mr-2" />
             {t("try_again")}
           </Button>
         </div>

app/(main)/[locale]/files/page.tsx

@@ -22,13 +22,12 @@ import { useIsMobile } from "@/hooks/use-media-query";
 import { useRefreshGesture } from "@/hooks/use-refresh-gesture";
 import { usePolicyStore } from "@/stores/policy-store";
 import { FileBrowser } from "@/components/files/file-browser";
-import type { FileNodeRights } from "@/lib/jmap/types";
 import { ImagePreviewModal } from "@/components/files/image-preview-modal";
 import { FilePreviewModal } from "@/components/files/file-preview-modal";
 import { loadFilesSettings } from "@/components/files/files-settings-dialog";
 import type { FolderLayout } from "@/components/files/files-settings-dialog";
 import { AppTopBannerSlot } from "@/components/plugins/app-top-banner-slot";
-import { AlertTriangle, Loader2 } from "lucide-react";
+import { AlertTriangle } from "lucide-react";
 
 export default function FilesPage() {
   const router = useRouter();
@@ -49,11 +48,9 @@ export default function FilesPage() {
     supportsFiles,
     selectedResources,
     uploadProgress,
-    migrationProgress,
     clipboard,
     initClient,
     checkSupport,
-    migrateLegacyFlatNodes,
     navigate,
     navigateByPath,
     refresh,
@@ -89,7 +86,6 @@ export default function FilesPage() {
     cancelUpload,
     undoLastAction,
     lastAction,
-    shareResource,
   } = useFileStore();
 
   const isMobile = useIsMobile();
@@ -164,16 +160,13 @@ export default function FilesPage() {
   const storeClient = useFileStore(s => s.client);
   useEffect(() => {
     if (storeClient && supportsFiles === null) {
-      checkSupport().then(async (supported) => {
+      checkSupport().then((supported) => {
         if (supported) {
-          // Upgrade any files created by older builds (flat path-encoded names)
-          // into the real FileNode hierarchy before the first listing.
-          await migrateLegacyFlatNodes();
           navigate(null);
         }
       });
     }
-  }, [storeClient, supportsFiles, checkSupport, migrateLegacyFlatNodes, navigate]);
+  }, [storeClient, supportsFiles, checkSupport, navigate]);
 
   const handleNavigate = useCallback((path: string, resourceId?: string | null) => {
     // Pro shell only: the Account breadcrumb segment signals "go to this
@@ -403,14 +396,6 @@ export default function FilesPage() {
 
   const currentFilesAccountId = useFileStore((s) => s.currentAccountId);
 
-  // Sharing: the browsing client (store-attached) drives the principal picker
-  // and share mutations. supportsPrincipals() gates the whole Share affordance.
-  const sharingEnabled = !!storeClient?.supportsPrincipals();
-  const filesAccountId = storeClient?.getFilesAccountId() ?? null;
-  const handleShare = useCallback(async (id: string, principalId: string, rights: FileNodeRights | null) => {
-    await shareResource(id, principalId, rights);
-  }, [shareResource]);
-
   // Pro shell only: all connected accounts are equal top-level entries at
   // the root. The root path "/" itself is a cross-account picker - no
   // account's files are shown until the user enters one.
@@ -477,7 +462,7 @@ export default function FilesPage() {
                     onClick={() => router.push("/")}
                     className="justify-start"
                   >
-                    <ArrowLeft className="w-4 h-4 me-2" />
+                    <ArrowLeft className="w-4 h-4 mr-2" />
                     {t("title")}
                   </Button>
                 </div>
@@ -550,10 +535,6 @@ export default function FilesPage() {
                   onSelectAccount={handleSelectAccount}
                   accountPickerMode={isAccountPicker}
                   accountLabel={currentAccountLabel}
-                  client={storeClient}
-                  ownAccountId={filesAccountId}
-                  sharingEnabled={sharingEnabled}
-                  onShare={handleShare}
                 />
                 </div>
               )}
@@ -592,32 +573,6 @@ export default function FilesPage() {
         />
       )}
 
-      {/* Legacy file migration progress (issue #379) */}
-      {migrationProgress && (
-        <div className="fixed inset-0 z-50 flex items-center justify-center bg-black/40 backdrop-blur-sm">
-          <div className="w-[22rem] max-w-[90vw] rounded-lg border border-border bg-background p-6 shadow-xl">
-            <div className="flex items-center gap-3">
-              <Loader2 className="w-5 h-5 text-primary animate-spin shrink-0" />
-              <div>
-                <p className="text-sm font-medium">{t("migration_title")}</p>
-                <p className="text-xs text-muted-foreground">{t("migration_description")}</p>
-              </div>
-            </div>
-            <div className="mt-4 h-1.5 bg-primary/20 rounded-full overflow-hidden">
-              <div
-                className="h-full bg-primary rounded-full transition-all duration-300"
-                style={{ width: migrationProgress.total > 0
-                  ? `${(migrationProgress.current / migrationProgress.total) * 100}%`
-                  : '0%' }}
-              />
-            </div>
-            <p className="mt-2 text-xs text-muted-foreground tabular-nums text-end">
-              {migrationProgress.current} / {migrationProgress.total}
-            </p>
-          </div>
-        </div>
-      )}
-
       <SidebarAppsModal isOpen={showAppsModal} onClose={closeAppsModal} />
       <ConfirmDialog {...confirmDialogProps} />
       </div>

app/(main)/[locale]/layout.tsx

@@ -9,7 +9,6 @@ import { ProtocolLaunchHandlerProvider } from "@/components/protocol/protocol-la
 import { ProInterfaceRedirect } from "@/components/pro/pro-interface-redirect";
 import { PluginDialogHost } from "@/components/plugins/plugin-dialog-host";
 import { PluginConsentDialog } from "@/components/plugins/plugin-consent-dialog";
-import { PWAInstallPrompt } from "@/components/pwa-install-prompt";
 import { locales } from "@/i18n/routing";
 
 export default async function LocaleLayout({
@@ -42,7 +41,6 @@ export default async function LocaleLayout({
                   {children}
                   <PluginDialogHost />
                   <PluginConsentDialog />
-                  <PWAInstallPrompt />
                 </ProtocolLaunchHandlerProvider>
               </TourProvider>
             </EmbeddedBridgeProvider>

app/(main)/[locale]/login/page.tsx

@@ -11,10 +11,10 @@ import { useAccountStore } from "@/stores/account-store";
 import { useThemeStore } from "@/stores/theme-store";
 import { useShallow } from "zustand/react/shallow";
 import { useConfig } from "@/hooks/use-config";
-import { apiFetch, getPathPrefix, toRouterPath, withBasePath } from "@/lib/browser-navigation";
+import { apiFetch, getPathPrefix, withBasePath } from "@/lib/browser-navigation";
 import { cn } from "@/lib/utils";
 import { AlertCircle, Loader2, X, Info, Eye, EyeOff, LogIn, Sun, Moon, Monitor, Check, Shield, Play, Copy } from "lucide-react";
-import { type OAuthMetadata } from "@/lib/oauth/discovery";
+import { discoverOAuth, type OAuthMetadata } from "@/lib/oauth/discovery";
 import { generateCodeVerifier, generateCodeChallenge, generateState } from "@/lib/oauth/pkce";
 import { useUpdateStore, selectBanner } from "@/stores/update-store";
 import type { PublicJmapServerEntry } from "@/lib/admin/jmap-servers";
@@ -133,16 +133,9 @@ export default function LoginPage() {
   const isMobileHandoff = Boolean(mobileRedirectUri);
   const { login, loginDemo, isLoading, error, clearError, isAuthenticated } = useAuthStore();
   const { theme, setTheme, initializeTheme } = useThemeStore(useShallow((s) => ({ theme: s.theme, setTheme: s.setTheme, initializeTheme: s.initializeTheme })));
-  const { appName, jmapServerUrl: configuredServerUrl, oauthEnabled, oauthOnly, oauthClientId: globalOauthClientId, oauthIssuerUrl: globalOauthIssuerUrl, oauthScopes, rememberMeEnabled, devMode, demoMode, loginLogoLightUrl, loginLogoDarkUrl, loginCompanyName, loginImprintUrl, loginPrivacyPolicyUrl, loginWebsiteUrl, loginLogoMaxHeight, loginLogoMaxWidth, loginShowHeading, loginShowSubtitle, loginShowTotp, loginShowVersion, isLoading: configLoading, error: configError, autoSsoEnabled, embeddedMode: _embeddedMode, allowCustomJmapEndpoint, jmapServers, jmapServerAutoPickByDomain } = useConfig();
+  const { appName, jmapServerUrl: configuredServerUrl, oauthEnabled, oauthOnly, oauthClientId: globalOauthClientId, oauthIssuerUrl: globalOauthIssuerUrl, oauthScopes, rememberMeEnabled, devMode, demoMode, loginLogoLightUrl, loginLogoDarkUrl, loginCompanyName, loginImprintUrl, loginPrivacyPolicyUrl, loginWebsiteUrl, isLoading: configLoading, error: configError, autoSsoEnabled, embeddedMode: _embeddedMode, allowCustomJmapEndpoint, jmapServers, jmapServerAutoPickByDomain } = useConfig();
   const resolvedTheme = useThemeStore((s) => s.resolvedTheme);
 
-  // Login logo sizing: when a max height/width is configured, drop the fixed
-  // 64×64 box so the logo (e.g. a wide wordmark) can render at its true size.
-  const hasLogoSize = Boolean(loginLogoMaxHeight || loginLogoMaxWidth);
-  const loginLogoStyle = hasLogoSize
-    ? { maxHeight: loginLogoMaxHeight || undefined, maxWidth: loginLogoMaxWidth || undefined }
-    : undefined;
-
   const [formData, setFormData] = useState({
     username: "",
     password: "",
@@ -286,7 +279,7 @@ export default function LoginPage() {
           redirectTo = saved;
         }
       } catch { /* ignore */ }
-      router.push(toRouterPath(redirectTo));
+      router.push(redirectTo);
     }
   }, [isAuthenticated, router, isAddAccountMode, isMobileHandoff, mobileRedirectUri, mobileState]);
 
@@ -336,27 +329,16 @@ export default function LoginPage() {
     if (!oauthEnabled || !serverUrl) return;
     setOauthDiscoveryDone(false);
     setOauthMetadata(null);
-    const controller = new AbortController();
-    // Discover via our own origin rather than fetching the IdP's /.well-known/*
-    // documents directly from the browser. A direct cross-origin discovery
-    // fetch is subject to CORS, and providers like Authentik serve those
-    // documents without Access-Control-Allow-Origin, so the browser blocks the
-    // response and login breaks (issue #382). The proxy runs discovery server
-    // side where CORS does not apply.
-    const query = selectedServer?.id ? `?server_id=${encodeURIComponent(selectedServer.id)}` : "";
-    apiFetch(`/api/auth/oauth/metadata${query}`, { signal: controller.signal })
-      .then(async (res) => (res.ok ? ((await res.json()) as OAuthMetadata) : null))
+    discoverOAuth(effectiveOauthIssuerUrl || serverUrl)
       .then((metadata) => {
         setOauthMetadata(metadata);
         setOauthDiscoveryDone(true);
       })
-      .catch((err) => {
-        if (err?.name === "AbortError") return;
+      .catch(() => {
         setOauthMetadata(null);
         setOauthDiscoveryDone(true);
       });
-    return () => controller.abort();
-  }, [oauthEnabled, serverUrl, effectiveOauthIssuerUrl, selectedServer?.id]);
+  }, [oauthEnabled, serverUrl, effectiveOauthIssuerUrl]);
 
   // Auto-SSO: when enabled with OAUTH_ONLY, skip the login page entirely
   const ssoError = searchParams.get("sso_error");
@@ -662,7 +644,7 @@ export default function LoginPage() {
           redirectTo = saved;
         }
       } catch { /* ignore */ }
-      router.push(toRouterPath(redirectTo));
+      router.push(redirectTo);
     }
   };
 
@@ -725,7 +707,7 @@ export default function LoginPage() {
                     )}
                   >
                     <Icon className="w-4 h-4" />
-                    <span className="flex-1 text-start">{option.label}</span>
+                    <span className="flex-1 text-left">{option.label}</span>
                     {isActive && <Check className="w-3.5 h-3.5 text-primary" />}
                   </button>
                 );
@@ -822,7 +804,7 @@ export default function LoginPage() {
                 )}
               </div>
             )}
-            {loginShowVersion && <VersionBadge />}
+            <VersionBadge />
           </div>
         </div>
       </div>
@@ -874,7 +856,7 @@ export default function LoginPage() {
                   )}
                 >
                   <Icon className="w-4 h-4" />
-                  <span className="flex-1 text-start">{option.label}</span>
+                  <span className="flex-1 text-left">{option.label}</span>
                   {isActive && <Check className="w-3.5 h-3.5 text-primary" />}
                 </button>
               );
@@ -888,24 +870,19 @@ export default function LoginPage() {
         <div className="rounded-2xl border border-border/60 bg-background/80 backdrop-blur-sm shadow-xl shadow-black/5 dark:shadow-black/20 overflow-hidden">
           {/* Header section with logo */}
           <div className="px-8 pt-10 pb-6 text-center">
-            <div className={cn("inline-flex items-center justify-center mb-5", !hasLogoSize && "w-16 h-16")}>
+            <div className="inline-flex items-center justify-center w-16 h-16 mb-5">
               <img
                 src={withBasePath(resolvedTheme === 'dark' ? loginLogoDarkUrl : loginLogoLightUrl)}
                 alt={appName}
-                className={cn("object-contain", !hasLogoSize && "max-w-16 max-h-16")}
-                style={loginLogoStyle}
+                className="max-w-16 max-h-16 object-contain"
               />
             </div>
-            {loginShowHeading && (
-              <h1 className="text-2xl font-semibold text-foreground tracking-tight">
-                {isAddAccountMode ? t("add_account_title") : appName}
-              </h1>
-            )}
-            {loginShowSubtitle && (
-              <p className="text-sm text-muted-foreground mt-1.5">
-                {isAddAccountMode ? t("add_account_subtitle") : (t("title") !== appName ? t("title") : "Sign in to your account")}
-              </p>
-            )}
+            <h1 className="text-2xl font-semibold text-foreground tracking-tight">
+              {isAddAccountMode ? t("add_account_title") : appName}
+            </h1>
+            <p className="text-sm text-muted-foreground mt-1.5">
+              {isAddAccountMode ? t("add_account_subtitle") : (t("title") !== appName ? t("title") : "Sign in to your account")}
+            </p>
           </div>
 
           {/* Form section */}
@@ -1133,7 +1110,7 @@ export default function LoginPage() {
                         type={showPassword ? "text" : "password"}
                         value={formData.password}
                         onChange={(e) => setFormData({ ...formData, password: e.target.value })}
-                        className="h-11 px-3.5 pe-11 bg-muted/40 border-border/60 rounded-xl focus:bg-background focus:border-primary/50 transition-all duration-200"
+                        className="h-11 px-3.5 pr-11 bg-muted/40 border-border/60 rounded-xl focus:bg-background focus:border-primary/50 transition-all duration-200"
                         placeholder={t("password_placeholder")}
                         required
                         autoComplete="current-password"
@@ -1154,12 +1131,8 @@ export default function LoginPage() {
                     </div>
                   </div>
 
-                  {/* 2FA toggle / field. The manual toggle can be hidden via
-                      LOGIN_SHOW_TOTP (loginShowTotp) for deployments whose mail
-                      server has no per-account TOTP (auth delegated to an
-                      external directory); server-required TOTP still shows. */}
+                  {/* 2FA toggle / field */}
                   {!showTotpField ? (
-                    loginShowTotp ? (
                     <button
                       type="button"
                       onClick={() => {
@@ -1171,7 +1144,6 @@ export default function LoginPage() {
                       <Shield className="w-3.5 h-3.5" />
                       {t("totp_toggle")}
                     </button>
-                    ) : null
                   ) : (
                     <div className="space-y-1.5">
                       <label htmlFor="totp" className="block text-sm font-medium text-foreground">
@@ -1258,9 +1230,9 @@ export default function LoginPage() {
                       disabled={oauthLoading || isLoading}
                     >
                       {oauthLoading ? (
-                        <Loader2 className="w-4 h-4 animate-spin me-2" />
+                        <Loader2 className="w-4 h-4 animate-spin mr-2" />
                       ) : (
-                        <LogIn className="w-4 h-4 me-2" />
+                        <LogIn className="w-4 h-4 mr-2" />
                       )}
                       {t("sign_in_sso")}
                     </Button>
@@ -1366,7 +1338,7 @@ export default function LoginPage() {
               )}
             </div>
           )}
-          {loginShowVersion && <VersionBadge />}
+          <VersionBadge />
         </div>
       </div>
     </div>

app/(main)/[locale]/pro/page.tsx

@@ -139,7 +139,7 @@ export default function ProHome() {
   const focusedPaneId = useProTabStore((s) => s.focusedPaneId);
   const loadedTabIds = useProTabStore((s) => s.loadedTabIds);
   const openTab = useProTabStore((s) => s.openTab);
-  const requestCloseTab = useProTabStore((s) => s.requestCloseTab);
+  const closeTab = useProTabStore((s) => s.closeTab);
   const setActiveTab = useProTabStore((s) => s.setActiveTab);
   const setFocusedPane = useProTabStore((s) => s.setFocusedPane);
   const moveTabToPane = useProTabStore((s) => s.moveTabToPane);
@@ -354,7 +354,7 @@ export default function ProHome() {
                 activeMainTabId={activeMainTabId}
                 activeSplitTabId={activeSplitTabId}
                 onActivate={setActiveTab}
-                onClose={requestCloseTab}
+                onClose={closeTab}
                 onDragStateChange={setIsTabDragging}
               />
 

app/(main)/[locale]/settings/page.tsx

@@ -1,6 +1,6 @@
 "use client";
 
-import { useState, useEffect, useRef, useMemo, useSyncExternalStore } from 'react';
+import { useState, useEffect, useRef, useMemo } from 'react';
 import { useRouter } from '@/i18n/navigation';
 import { useTranslations, useMessages } from 'next-intl';
 import {
@@ -21,6 +21,7 @@ import {
   Tags,
   HardDrive,
   BookUser,
+  KeyRound,
   PanelLeftClose,
   Bell,
   Puzzle,
@@ -32,7 +33,6 @@ import {
   Languages,
   Info,
   Bug,
-  SwatchBook,
   Download,
   X,
   type LucideIcon,
@@ -62,19 +62,17 @@ import { AccountSecuritySettings } from '@/components/settings/account-security-
 import { FilesSettingsComponent } from '@/components/settings/files-settings';
 import { DownloadsSettings } from '@/components/settings/downloads-settings';
 import { ContactsSettings } from '@/components/settings/contacts-settings';
+import { SmimeSettings } from '@/components/settings/smime-settings';
 import { SidebarAppsSettings } from '@/components/settings/sidebar-apps-settings';
 import { NotificationSettings } from '@/components/settings/notification-settings';
 import { ThemesSettings } from '@/components/settings/themes-settings';
 import { PluginsSettings } from '@/components/settings/plugins-settings';
-import { PluginIframeSlot } from '@/components/plugins/plugin-iframe-slot';
-import { offersForSlot as pluginOffersForSlot, subscribe as pluginRegistrySubscribe, get as getActivePlugin } from '@/lib/plugin-sandbox/registry';
 import { ProtocolHandlerSettings } from '@/components/settings/protocol-handler-settings';
 import { useAuthStore, redirectToLogin } from '@/stores/auth-store';
 import { useEmailStore } from '@/stores/email-store';
 import { usePluginStore } from '@/stores/plugin-store';
 import { useThemeStore } from '@/stores/theme-store';
 import { useSettingsStore } from '@/stores/settings-store';
-import { useManagedAccountStore } from '@/stores/managed-account-store';
 import { useIsDesktop } from '@/hooks/use-media-query';
 import { NavigationRail } from '@/components/layout/navigation-rail';
 import { SidebarAppsModal } from '@/components/layout/sidebar-apps-modal';
@@ -102,6 +100,7 @@ type Tab =
   | 'folders'
   | 'keywords'
   | 'security'
+  | 'encryption'
   | 'content_senders'
   | 'calendar'
   | 'contacts'
@@ -115,14 +114,8 @@ type Tab =
 
 type TabGroup = 'general' | 'appearance' | 'mail' | 'privacy' | 'apps' | 'advanced';
 
-// A plugin that exposes a `settings-section` slot gets its own first-class
-// Settings entry, keyed `plugin:<id>`, so its UI (e.g. S/MIME key import) is
-// discoverable as a menu point rather than buried inside another panel.
-type PluginTabId = `plugin:${string}`;
-type SettingsTabId = Tab | PluginTabId;
-
 interface TabDef {
-  id: SettingsTabId;
+  id: Tab;
   label: string;
   icon: LucideIcon;
   group: TabGroup;
@@ -144,6 +137,7 @@ const tabIcons: Record<Tab, LucideIcon> = {
   folders: FolderOpen,
   keywords: Tags,
   security: Shield,
+  encryption: KeyRound,
   content_senders: EyeOff,
   calendar: Calendar,
   contacts: BookUser,
@@ -151,7 +145,7 @@ const tabIcons: Record<Tab, LucideIcon> = {
   protocol_handlers: LinkIcon,
   sidebar_apps: PanelLeftClose,
   about_data: Info,
-  themes: SwatchBook,
+  themes: Palette,
   plugins: Puzzle,
   debug: Bug,
 };
@@ -187,7 +181,6 @@ const tabSearchPaths: Record<Tab, string[]> = {
     'settings.appearance.hide_account_switcher',
     'settings.appearance.show_rail_account_list',
     'settings.appearance.unified_mailbox',
-    'settings.appearance.all_mail',
     'settings.appearance.colorful_sidebar_icons',
     'settings.email_behavior.mail_layout',
   ],
@@ -204,11 +197,11 @@ const tabSearchPaths: Record<Tab, string[]> = {
     'settings.email_behavior.hover_actions',
     'settings.email_behavior.permanently_delete_junk',
     'settings.email_behavior.show_preview',
+    'settings.email_behavior.plain_text_mode',
   ],
   composing: [
     'settings.email_behavior.attachment_reminder',
     'settings.email_behavior.auto_select_reply_identity',
-    'settings.email_behavior.plain_text_mode',
     'settings.email_behavior.default_mail_program',
     'settings.email_behavior.signature_position',
     'settings.email_behavior.sub_address_delimiter',
@@ -221,6 +214,7 @@ const tabSearchPaths: Record<Tab, string[]> = {
   folders: ['settings.folders'],
   keywords: ['settings.keywords'],
   security: ['settings.security'],
+  encryption: ['smime'],
   content_senders: [
     'settings.email_behavior.always_light_mode',
     'settings.email_behavior.external_content',
@@ -255,6 +249,7 @@ const tabKeywords: Record<Tab, string> = {
   folders: 'mailbox subscribe',
   keywords: 'tags labels colors',
   security: 'password 2fa two-factor passkey app password mfa',
+  encryption: 's/mime smime certificate pgp gpg',
   content_senders: 'block sender remote images privacy tracking',
   calendar: 'event schedule appointment meeting timezone',
   contacts: 'address book contact',
@@ -338,16 +333,8 @@ const LEGACY_TAB_MAP: Record<string, Tab> = {
   advanced: 'about_data',
 };
 
-function readPersistedTab(): SettingsTabId {
+function readPersistedTab(): Tab {
   try {
-    // One-shot deep link from the sidebar section gears (Folders / Tags).
-    // Used only as the initial tab and intentionally NOT written to
-    // 'settings-active-tab', so a gear click never becomes the persisted
-    // default that the regular Settings button lands on. Cleared on mount.
-    const deepLink = sessionStorage.getItem('settings-deep-link-tab');
-    if (deepLink) {
-      return (deepLink in LEGACY_TAB_MAP ? LEGACY_TAB_MAP[deepLink] : deepLink) as SettingsTabId;
-    }
     const saved = localStorage.getItem('settings-active-tab');
     if (!saved) return 'appearance';
     if (saved in LEGACY_TAB_MAP) {
@@ -355,7 +342,7 @@ function readPersistedTab(): SettingsTabId {
       try { localStorage.setItem('settings-active-tab', migrated); } catch { /* ignore */ }
       return migrated;
     }
-    return saved as SettingsTabId;
+    return saved as Tab;
   } catch {
     return 'appearance';
   }
@@ -372,23 +359,10 @@ export default function SettingsPage() {
   const { quota, isPushConnected } = useEmailStore();
   const { stalwartFeaturesEnabled } = useConfig();
   const { isFeatureEnabled } = usePolicyStore();
-  const [activeTab, setActiveTab] = useState<SettingsTabId>(readPersistedTab);
-  // Active plugins that expose a `settings-section` slot — each becomes its own
-  // Settings menu entry. Referentially stable per registry mutation, so it is
-  // safe to feed useSyncExternalStore directly.
-  const pluginSettingsOffers = useSyncExternalStore(
-    pluginRegistrySubscribe,
-    () => pluginOffersForSlot('settings-section'),
-    () => pluginOffersForSlot('settings-section'),
-  );
-  // Consume the one-shot deep-link key so a section gear only steers this one
-  // open, never the persisted default for future Settings-button clicks.
-  useEffect(() => {
-    try { sessionStorage.removeItem('settings-deep-link-tab'); } catch { /* ignore */ }
-  }, []);
+  const [activeTab, setActiveTab] = useState<Tab>(readPersistedTab);
   const [mobileShowContent, setMobileShowContent] = useState(false);
   const [searchQuery, setSearchQuery] = useState('');
-  const [pendingHighlight, setPendingHighlight] = useState<{ tab: SettingsTabId; label: string; pluginId?: string } | null>(null);
+  const [pendingHighlight, setPendingHighlight] = useState<{ tab: Tab; label: string; pluginId?: string } | null>(null);
   const isDesktop = useIsDesktop();
 
   const messages = useMessages() as Record<string, unknown>;
@@ -397,12 +371,6 @@ export default function SettingsPage() {
   const sidebarAppsList = useSettingsStore((s) => s.sidebarApps);
   const proInterface = useSettingsStore((s) => s.proInterface);
 
-  // When set, the settings panel is scoped to a shared/group account: a reduced
-  // tab list and a "Managing: <name>" header. null = the user's own account.
-  const managedAccountId = useManagedAccountStore((s) => s.managedAccountId);
-  const managedAccount = useManagedAccountStore((s) => s.managedAccount);
-  const clearManagedAccount = useManagedAccountStore((s) => s.clear);
-
   // Build a per-tab haystack for fulltext search and a list of sub-results
   // (individual settings) per tab. Sub-results come from translation entries
   // that have a `label`/`title` field, plus dynamic content (installed
@@ -506,10 +474,6 @@ export default function SettingsPage() {
     return () => window.removeEventListener('settings-tab-change', handler);
   }, []);
 
-  // Leaving the settings panel drops any shared-account scope so it never
-  // leaks into the next visit or another session.
-  useEffect(() => () => clearManagedAccount(), [clearManagedAccount]);
-
   useEffect(() => {
     if (initialCheckDone && !isAuthenticated && !authLoading) {
       try { sessionStorage.setItem('redirect_after_login', window.location.pathname); } catch { /* ignore */ }
@@ -618,7 +582,6 @@ export default function SettingsPage() {
     // Appearance
     { id: 'appearance', label: t('tabs.appearance'), icon: tabIcons.appearance, group: 'appearance' },
     { id: 'layout', label: t('tabs.layout'), icon: tabIcons.layout, group: 'appearance' },
-    ...(isFeatureEnabled('themesEnabled') ? [{ id: 'themes' as Tab, label: 'Themes', icon: tabIcons.themes, group: 'appearance' as TabGroup }] : []),
 
     // Mail
     { id: 'reading', label: t('tabs.reading'), icon: tabIcons.reading, group: 'mail' },
@@ -633,50 +596,28 @@ export default function SettingsPage() {
 
     // Privacy & Security
     ...(stalwartFeaturesEnabled ? [{ id: 'security' as Tab, label: t('tabs.security'), icon: tabIcons.security, group: 'privacy' as TabGroup }] : []),
+    ...(isFeatureEnabled('smimeEnabled') ? [{ id: 'encryption' as Tab, label: t('tabs.encryption'), icon: tabIcons.encryption, group: 'privacy' as TabGroup }] : []),
     { id: 'content_senders', label: t('tabs.content_senders'), icon: tabIcons.content_senders, group: 'privacy' },
 
     // Apps
-    ...(supportsCalendar && isFeatureEnabled('calendarEnabled') ? [{ id: 'calendar' as Tab, label: t('tabs.calendar'), icon: tabIcons.calendar, group: 'apps' as TabGroup }] : []),
+    ...(supportsCalendar ? [{ id: 'calendar' as Tab, label: t('tabs.calendar'), icon: tabIcons.calendar, group: 'apps' as TabGroup }] : []),
     ...(isFeatureEnabled('contactsEnabled') ? [{ id: 'contacts' as Tab, label: t('tabs.contacts'), icon: tabIcons.contacts, group: 'apps' as TabGroup }] : []),
     ...(supportsFiles && isFeatureEnabled('filesEnabled') ? [{ id: 'files' as Tab, label: t('tabs.files'), icon: tabIcons.files, group: 'apps' as TabGroup }] : []),
     ...(isFeatureEnabled('sidebarAppsEnabled') ? [{ id: 'sidebar_apps' as Tab, label: t('tabs.sidebar_apps'), icon: tabIcons.sidebar_apps, group: 'apps' as TabGroup }] : []),
-    // Plugin-contributed settings pages: one entry per active plugin that
-    // offers a `settings-section` slot (e.g. S/MIME key & certificate manager).
-    ...pluginSettingsOffers.map((offer): TabDef => ({
-      id: `plugin:${offer.pluginId}` as PluginTabId,
-      label: getActivePlugin(offer.pluginId)?.plugin.name ?? offer.pluginId,
-      icon: Puzzle,
-      group: 'apps',
-    })),
 
     // Advanced
     { id: 'about_data', label: t('tabs.about_data'), icon: tabIcons.about_data, group: 'advanced' },
+    ...(isFeatureEnabled('themesEnabled') ? [{ id: 'themes' as Tab, label: 'Themes', icon: tabIcons.themes, group: 'advanced' as TabGroup }] : []),
     ...(isFeatureEnabled('pluginsEnabled') ? [{ id: 'plugins' as Tab, label: 'Plugins', icon: tabIcons.plugins, group: 'advanced' as TabGroup }] : []),
     ...(isFeatureEnabled('debugModeEnabled') ? [{ id: 'debug' as Tab, label: t('tabs.debug'), icon: tabIcons.debug, group: 'advanced' as TabGroup }] : []),
   ];
 
-  // In scoped (shared-account) mode, restrict to the account-relevant tabs the
-  // account actually advertises. Folders is intentionally excluded (mailbox CRUD
-  // is hardwired to the active account). Gated on both the per-account
-  // capability and the session-level support/feature flags.
-  const scopedTabIds: Tab[] = managedAccount
-    ? ([
-        managedAccount.capabilities.sieve && supportsSieve ? 'filters' : null,
-        managedAccount.capabilities.mail && supportsVacation ? 'vacation' : null,
-        managedAccount.capabilities.calendars && supportsCalendar && isFeatureEnabled('calendarEnabled') ? 'calendar' : null,
-        managedAccount.capabilities.contacts && isFeatureEnabled('contactsEnabled') ? 'contacts' : null,
-      ].filter(Boolean) as Tab[])
-    : [];
-  const visibleTabs = managedAccountId
-    ? tabs.filter((tab) => scopedTabIds.includes(tab.id as Tab))
-    : tabs;
-
   // Group tabs by category
   const groupedTabs = tabGroupOrder
     .map((group) => ({
       group,
       label: t(`tab_groups.${group}`),
-      items: visibleTabs.filter((tab) => tab.group === group),
+      items: tabs.filter((tab) => tab.group === group),
     }))
     .filter((g) => g.items.length > 0);
 
@@ -684,12 +625,12 @@ export default function SettingsPage() {
   const matchesQuery = (tab: TabDef) => {
     if (!trimmedQuery) return true;
     if (tab.label.toLowerCase().includes(trimmedQuery)) return true;
-    return tabSearchHaystacks[tab.id as Tab]?.includes(trimmedQuery) ?? false;
+    return tabSearchHaystacks[tab.id]?.includes(trimmedQuery) ?? false;
   };
 
-  const subResultsForTab = (tabId: SettingsTabId): SubResult[] => {
+  const subResultsForTab = (tabId: Tab): SubResult[] => {
     if (!trimmedQuery) return [];
-    const list = tabSubResults[tabId as Tab] ?? [];
+    const list = tabSubResults[tabId] ?? [];
     return list
       .filter((r) =>
         r.label.toLowerCase().includes(trimmedQuery) ||
@@ -704,15 +645,11 @@ export default function SettingsPage() {
         .filter((g) => g.items.length > 0)
     : groupedTabs;
 
-  // If active tab is not in the visible list (e.g., feature disabled, or scoped
-  // mode hides it), fall back. In scoped mode fall back to the first scoped tab;
-  // otherwise the usual 'appearance' default.
-  const isActiveVisible = visibleTabs.some((tab) => tab.id === activeTab);
-  const effectiveActiveTab: SettingsTabId = isActiveVisible
-    ? activeTab
-    : (managedAccountId ? (visibleTabs[0]?.id ?? 'appearance') : 'appearance');
+  // If active tab is not in the visible list (e.g., feature disabled), fall back.
+  const isActiveVisible = tabs.some((tab) => tab.id === activeTab);
+  const effectiveActiveTab: Tab = isActiveVisible ? activeTab : 'appearance';
 
-  const handleTabSelect = (tabId: SettingsTabId) => {
+  const handleTabSelect = (tabId: Tab) => {
     setActiveTab(tabId);
     try { localStorage.setItem('settings-active-tab', tabId); } catch { /* ignore */ }
     if (!isDesktop) {
@@ -720,31 +657,15 @@ export default function SettingsPage() {
     }
   };
 
-  const handleSubResultSelect = (tabId: SettingsTabId, sub: SubResult) => {
+  const handleSubResultSelect = (tabId: Tab, sub: SubResult) => {
     handleTabSelect(tabId);
     setPendingHighlight({ tab: tabId, label: sub.label, pluginId: sub.pluginId });
   };
 
-  const activeTabLabel = visibleTabs.find((tab) => tab.id === effectiveActiveTab)?.label ?? '';
+  const activeTabLabel = tabs.find((tab) => tab.id === effectiveActiveTab)?.label ?? '';
 
   const renderTabContent = () => (
     <>
-      {managedAccountId && managedAccount && (
-        <button
-          type="button"
-          onClick={() => {
-            clearManagedAccount();
-            handleTabSelect('account');
-          }}
-          className="flex items-center gap-2 w-full mb-4 px-3 py-2 rounded-md border border-border bg-muted/40 hover:bg-muted text-start transition-colors"
-        >
-          <ArrowLeft className="w-4 h-4 text-muted-foreground flex-shrink-0" />
-          <span className="text-sm text-muted-foreground">{t('scoped.back')}</span>
-          <span className="ms-auto text-sm font-medium truncate">
-            {t('scoped.managing', { name: managedAccount.name })}
-          </span>
-        </button>
-      )}
       {effectiveActiveTab === 'account' && <AccountSettings />}
       {effectiveActiveTab === 'language' && <LanguageSettings />}
       {effectiveActiveTab === 'notifications' && <NotificationSettings />}
@@ -760,17 +681,10 @@ export default function SettingsPage() {
       {effectiveActiveTab === 'folders' && <FolderSettings />}
       {effectiveActiveTab === 'keywords' && <KeywordSettings />}
       {effectiveActiveTab === 'security' && <AccountSecuritySettings />}
+      {effectiveActiveTab === 'encryption' && <SmimeSettings />}
       {effectiveActiveTab === 'content_senders' && <ContentSendersSettings />}
-      {effectiveActiveTab === 'calendar' && (
-        managedAccountId
-          ? <CalendarManagementSettings />
-          : <><CalendarSettings /><div className="mt-8"><CalendarManagementSettings /></div></>
-      )}
-      {effectiveActiveTab === 'contacts' && (
-        managedAccountId
-          ? <AddressBookManagementSettings />
-          : <><ContactsSettings /><div className="mt-8"><AddressBookManagementSettings /></div></>
-      )}
+      {effectiveActiveTab === 'calendar' && <><CalendarSettings /><div className="mt-8"><CalendarManagementSettings /></div></>}
+      {effectiveActiveTab === 'contacts' && <><ContactsSettings /><div className="mt-8"><AddressBookManagementSettings /></div></>}
       {effectiveActiveTab === 'files' && <FilesSettingsComponent />}
       {effectiveActiveTab === 'protocol_handlers' && <ProtocolHandlerSettings supportsCalendar={supportsCalendar} />}
       {effectiveActiveTab === 'sidebar_apps' && <SidebarAppsSettings />}
@@ -778,13 +692,6 @@ export default function SettingsPage() {
       {effectiveActiveTab === 'themes' && <ThemesSettings />}
       {effectiveActiveTab === 'plugins' && <PluginsSettings />}
       {effectiveActiveTab === 'debug' && <DebugSettings />}
-      {effectiveActiveTab.startsWith('plugin:') && (
-        <PluginIframeSlot
-          key={effectiveActiveTab}
-          pluginId={effectiveActiveTab.slice('plugin:'.length)}
-          slot="settings-section"
-        />
-      )}
     </>
   );
 
@@ -851,7 +758,7 @@ export default function SettingsPage() {
                 value={searchQuery}
                 onChange={(e) => setSearchQuery(e.target.value)}
                 placeholder={t('search_placeholder')}
-                className="ps-9 pe-9 h-10"
+                className="pl-9 pr-9 h-10"
                 aria-label={t('search_placeholder')}
               />
               {searchQuery && (
@@ -899,7 +806,7 @@ export default function SettingsPage() {
                         <button
                           key={`${tab.id}:${sub.label}`}
                           onClick={() => handleSubResultSelect(tab.id, sub)}
-                          className="w-full flex items-center ps-12 pe-5 py-2 text-xs text-muted-foreground hover:bg-muted hover:text-foreground transition-colors duration-150 text-start"
+                          className="w-full flex items-center pl-12 pr-5 py-2 text-xs text-muted-foreground hover:bg-muted hover:text-foreground transition-colors duration-150 text-left"
                         >
                           <span className="truncate">{sub.label}</span>
                         </button>
@@ -963,7 +870,7 @@ export default function SettingsPage() {
       <>
       <div
         className={cn(
-          "border-e border-border bg-secondary flex flex-col",
+          "border-r border-border bg-secondary flex flex-col",
           !isResizing && "transition-[width] duration-300"
         )}
         style={{ width: `${settingsSidebarWidth}px` }}
@@ -976,7 +883,7 @@ export default function SettingsPage() {
               onClick={() => router.push('/')}
               className="w-full justify-start"
             >
-              <ArrowLeft className="w-4 h-4 me-2" />
+              <ArrowLeft className="w-4 h-4 mr-2" />
               {t('back_to_mail')}
             </Button>
           </div>
@@ -991,7 +898,7 @@ export default function SettingsPage() {
                 value={searchQuery}
                 onChange={(e) => setSearchQuery(e.target.value)}
                 placeholder={t('search_placeholder')}
-                className="ps-8 pe-8 h-9 text-sm"
+                className="pl-8 pr-8 h-9 text-sm"
                 aria-label={t('search_placeholder')}
               />
               {searchQuery && (
@@ -1026,9 +933,9 @@ export default function SettingsPage() {
                   return (
                     <div key={tab.id}>
                       <button
-                        onClick={() => handleTabSelect(tab.id)}
+                        onClick={() => setActiveTab(tab.id)}
                         className={cn(
-                          'w-full text-start px-3 py-2 rounded-md text-sm transition-colors duration-150 flex items-center gap-2.5',
+                          'w-full text-left px-3 py-2 rounded-md text-sm transition-colors duration-150 flex items-center gap-2.5',
                           effectiveActiveTab === tab.id
                             ? 'bg-accent text-accent-foreground font-medium'
                             : 'hover:bg-muted text-foreground'
@@ -1044,7 +951,7 @@ export default function SettingsPage() {
                         <button
                           key={`${tab.id}:${sub.label}`}
                           onClick={() => handleSubResultSelect(tab.id, sub)}
-                          className="w-full text-start ps-9 pe-3 py-1.5 rounded-md text-xs text-muted-foreground hover:bg-muted hover:text-foreground transition-colors duration-150"
+                          className="w-full text-left pl-9 pr-3 py-1.5 rounded-md text-xs text-muted-foreground hover:bg-muted hover:text-foreground transition-colors duration-150"
                         >
                           <span className="truncate block">{sub.label}</span>
                         </button>

app/(main)/admin/_tabs/_jmap-servers-section.tsx

@@ -220,7 +220,7 @@ export function JmapServersSection({ value, source, onChange, onRevert }: Props)
               Per-server OAuth (optional, overrides global)
             </button>
             {d.oauthExpanded && (
-              <div className="grid grid-cols-1 sm:grid-cols-3 gap-2 ps-4 border-s border-border">
+              <div className="grid grid-cols-1 sm:grid-cols-3 gap-2 pl-4 border-l border-border">
                 <div>
                   <label className="block text-[11px] font-medium text-muted-foreground mb-1">OAuth Client ID</label>
                   <input

app/(main)/admin/_tabs/branding.tsx

@@ -1,14 +1,8 @@
 'use client';
 
-import { useEffect, useMemo, useRef, useState } from 'react';
-import { Save, Loader2, RotateCcw, ImageIcon, Upload, Trash2, Globe, Plus, X } from 'lucide-react';
-import { apiFetch, withBasePath } from '@/lib/browser-navigation';
-import {
-  BRANDING_OVERRIDE_KEYS,
-  parseDomainBranding,
-  type BrandingOverrideKey,
-  type DomainBrandingEntry,
-} from '@/lib/admin/domain-branding';
+import { useEffect, useRef, useState } from 'react';
+import { Save, Loader2, RotateCcw, ImageIcon, Upload, Trash2 } from 'lucide-react';
+import { apiFetch } from '@/lib/browser-navigation';
 
 interface ConfigEntry {
   value?: unknown;
@@ -22,67 +16,42 @@ const IMAGE_FIELDS = [
   { key: 'appLogoDarkUrl', label: 'App Logo (Dark Mode)', accept: '.svg,.png,.jpg,.webp' },
   { key: 'loginLogoLightUrl', label: 'Login Logo (Light Mode)', accept: '.svg,.png,.jpg,.webp' },
   { key: 'loginLogoDarkUrl', label: 'Login Logo (Dark Mode)', accept: '.svg,.png,.jpg,.webp' },
-] as const;
+];
 
 const TEXT_FIELDS = [
   { key: 'loginCompanyName', label: 'Company Name' },
   { key: 'loginImprintUrl', label: 'Imprint URL' },
   { key: 'loginPrivacyPolicyUrl', label: 'Privacy Policy URL' },
   { key: 'loginWebsiteUrl', label: 'Company Website URL' },
-] as const;
+];
 
 const PWA_IMAGE_FIELDS = [
   { key: 'pwaIconUrl', label: 'PWA Icon', accept: '.svg,.png,.jpg,.webp' },
-  { key: 'pwaScreenshotMobileUrl', label: 'PWA Screenshot (Mobile)', accept: '.png,.jpg,.webp' },
-  { key: 'pwaScreenshotDesktopUrl', label: 'PWA Screenshot (Desktop)', accept: '.png,.jpg,.webp' },
-] as const;
+];
 
 const PWA_TEXT_FIELDS = [
   { key: 'appShortName', label: 'Short Name', placeholder: 'Shown on home screen (max ~12 chars)' },
   { key: 'appDescription', label: 'Description', placeholder: 'App description for install prompts' },
-] as const;
+];
 
 const PWA_COLOR_FIELDS = [
   { key: 'pwaThemeColor', label: 'Theme Color', defaultValue: '#ffffff' },
   { key: 'pwaBackgroundColor', label: 'Background Color', defaultValue: '#ffffff' },
-] as const;
-
-// Accepts exact hosts and one-level wildcards (e.g. *.example.com).
-const HOST_RE = /^(\*\.)?[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*$/;
-// Tighter rule for uploads: wildcards can only point to externally-hosted
-// URLs, since we'd have no concrete subdomain to serve a file from.
-const EXACT_HOST_RE = /^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*$/;
+];
 
 export function BrandingTab() {
   const [config, setConfig] = useState<Record<string, ConfigEntry>>({});
-  const [edits, setEdits] = useState<Record<string, string>>({});
+  const [edits, setEdits] = useState<Record<string, unknown>>({});
   const [loading, setLoading] = useState(true);
   const [saving, setSaving] = useState(false);
   const [uploading, setUploading] = useState<string | null>(null);
   const [message, setMessage] = useState<{ type: 'success' | 'error'; text: string } | null>(null);
-  const [selectedHost, setSelectedHost] = useState<string | null>(null);
-  const [addingHost, setAddingHost] = useState(false);
-  const [newHostInput, setNewHostInput] = useState('');
-  const [newHostError, setNewHostError] = useState<string | null>(null);
   const fileInputRefs = useRef<Record<string, HTMLInputElement | null>>({});
 
   useEffect(() => {
     fetchConfig();
   }, []);
 
-  const domainEntries = useMemo<DomainBrandingEntry[]>(
-    () => parseDomainBranding(config['domainBranding']?.value),
-    [config],
-  );
-
-  // Drop selection if the host disappeared from the config (e.g. concurrent edit).
-  useEffect(() => {
-    if (selectedHost && !domainEntries.some(e => e.host === selectedHost)) {
-      setSelectedHost(null);
-      setEdits({});
-    }
-  }, [domainEntries, selectedHost]);
-
   async function fetchConfig() {
     setLoading(true);
     const res = await apiFetch('/api/admin/config');
@@ -90,81 +59,29 @@ export function BrandingTab() {
     setLoading(false);
   }
 
-  function selectedEntry(): DomainBrandingEntry | null {
-    if (!selectedHost) return null;
-    return domainEntries.find(e => e.host === selectedHost) ?? null;
-  }
-
   function handleChange(key: string, value: string) {
     setEdits(prev => ({ ...prev, [key]: value }));
     setMessage(null);
   }
 
   function currentValue(key: string): string {
-    if (key in edits) return edits[key];
-    if (selectedHost) {
-      const entry = selectedEntry();
-      return (entry?.[key as BrandingOverrideKey] as string | undefined) ?? '';
-    }
+    if (key in edits) return edits[key] as string;
     return (config[key]?.value as string) ?? '';
   }
 
-  function isOverriddenInScope(key: string): boolean {
-    if (selectedHost) {
-      const entry = selectedEntry();
-      const v = entry?.[key as BrandingOverrideKey];
-      return typeof v === 'string' && v.length > 0;
-    }
-    return config[key]?.source === 'admin';
-  }
-
-  const isUploadedFile = (key: string): boolean => {
-    const val = currentValue(key);
-    return val.startsWith('/api/admin/branding/');
-  };
-
-  function buildUpdatedDomainBranding(merge: Record<string, string>): DomainBrandingEntry[] {
-    if (!selectedHost) return domainEntries;
-    const next = domainEntries.slice();
-    const idx = next.findIndex(e => e.host === selectedHost);
-    const base: DomainBrandingEntry =
-      idx === -1 ? { host: selectedHost } : { ...next[idx] };
-    const writable = base as unknown as Record<string, string | undefined>;
-    for (const [key, value] of Object.entries(merge)) {
-      if (!(BRANDING_OVERRIDE_KEYS as readonly string[]).includes(key)) continue;
-      if (typeof value === 'string' && value.length > 0) {
-        writable[key] = value;
-      } else {
-        delete writable[key];
-      }
-    }
-    if (idx === -1) next.push(base);
-    else next[idx] = base;
-    return next;
-  }
-
   async function handleSave() {
     if (Object.keys(edits).length === 0) return;
     setSaving(true);
     setMessage(null);
 
-    const payload = selectedHost
-      ? { domainBranding: buildUpdatedDomainBranding(edits) }
-      : edits;
-
     const res = await apiFetch('/api/admin/config', {
       method: 'PATCH',
       headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify(payload),
+      body: JSON.stringify(edits),
     });
 
     if (res.ok) {
-      setMessage({
-        type: 'success',
-        text: selectedHost
-          ? `Branding for ${selectedHost} updated. Changes visible on next page load.`
-          : 'Branding updated. Changes visible on next page load.',
-      });
+      setMessage({ type: 'success', text: 'Branding updated. Changes visible on next page load.' });
       setEdits({});
       await fetchConfig();
     } else {
@@ -175,20 +92,12 @@ export function BrandingTab() {
   }
 
   async function handleUpload(slot: string, file: File) {
-    if (selectedHost && !EXACT_HOST_RE.test(selectedHost)) {
-      setMessage({
-        type: 'error',
-        text: 'Wildcard hosts cannot upload files. Enter a URL instead.',
-      });
-      return;
-    }
     setUploading(slot);
     setMessage(null);
 
     const formData = new FormData();
     formData.append('file', file);
     formData.append('slot', slot);
-    if (selectedHost) formData.append('host', selectedHost);
 
     const res = await apiFetch('/api/admin/branding', {
       method: 'POST',
@@ -203,9 +112,10 @@ export function BrandingTab() {
         delete next[slot];
         return next;
       });
-      // Refresh from server so domainBranding entries reflect the upload.
-      await fetchConfig();
-      void data;
+      setConfig(prev => ({
+        ...prev,
+        [slot]: { value: data.url, source: 'admin' },
+      }));
     } else {
       const data = await res.json();
       setMessage({ type: 'error', text: data.error || 'Upload failed' });
@@ -216,13 +126,10 @@ export function BrandingTab() {
   async function handleDeleteUpload(slot: string) {
     setMessage(null);
 
-    const body: { slot: string; host?: string } = { slot };
-    if (selectedHost) body.host = selectedHost;
-
     const res = await apiFetch('/api/admin/branding', {
       method: 'DELETE',
       headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify(body),
+      body: JSON.stringify({ slot }),
     });
 
     if (res.ok) {
@@ -240,25 +147,6 @@ export function BrandingTab() {
   }
 
   async function handleRevert(key: string) {
-    if (selectedHost) {
-      // Domain scope: drop the field from the entry and PATCH the array.
-      const updated = buildUpdatedDomainBranding({ [key]: '' });
-      const res = await apiFetch('/api/admin/config', {
-        method: 'PATCH',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({ domainBranding: updated }),
-      });
-      if (res.ok) {
-        setEdits(prev => {
-          const next = { ...prev };
-          delete next[key];
-          return next;
-        });
-        await fetchConfig();
-      }
-      return;
-    }
-    // Default scope: revert via DELETE /api/admin/config
     const res = await apiFetch('/api/admin/config', {
       method: 'DELETE',
       headers: { 'Content-Type': 'application/json' },
@@ -274,71 +162,12 @@ export function BrandingTab() {
     }
   }
 
-  async function handleAddDomain() {
-    const host = newHostInput.trim().toLowerCase().replace(/\.+$/, '');
-    if (!host) {
-      setNewHostError('Enter a hostname');
-      return;
-    }
-    if (!HOST_RE.test(host)) {
-      setNewHostError('Invalid hostname. Use foo.example.com or *.example.com');
-      return;
-    }
-    if (domainEntries.some(e => e.host === host)) {
-      setNewHostError('A branding entry for this host already exists');
-      return;
-    }
-    setNewHostError(null);
-
-    const next: DomainBrandingEntry[] = [...domainEntries, { host }];
-    const res = await apiFetch('/api/admin/config', {
-      method: 'PATCH',
-      headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({ domainBranding: next }),
-    });
-    if (res.ok) {
-      setNewHostInput('');
-      setAddingHost(false);
-      setSelectedHost(host);
-      setEdits({});
-      await fetchConfig();
-    } else {
-      const data = await res.json();
-      setNewHostError(data.error || 'Failed to add domain');
-    }
-  }
-
-  async function handleDeleteDomain() {
-    if (!selectedHost) return;
-    if (!confirm(`Remove branding entry for ${selectedHost}? Uploaded files for this domain will be left behind on disk.`)) {
-      return;
-    }
-    const next = domainEntries.filter(e => e.host !== selectedHost);
-    const res = await apiFetch('/api/admin/config', {
-      method: 'PATCH',
-      headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({ domainBranding: next }),
-    });
-    if (res.ok) {
-      setSelectedHost(null);
-      setEdits({});
-      await fetchConfig();
-      setMessage({ type: 'success', text: `Removed branding entry for ${selectedHost}.` });
-    } else {
-      const data = await res.json();
-      setMessage({ type: 'error', text: data.error || 'Failed to remove domain' });
-    }
-  }
-
-  function handleScopeChange(host: string | null) {
-    if (Object.keys(edits).length > 0 && !confirm('Discard unsaved changes?')) return;
-    setSelectedHost(host);
-    setEdits({});
-    setMessage(null);
-  }
+  const isUploadedFile = (key: string): boolean => {
+    const val = currentValue(key);
+    return val.startsWith('/api/admin/branding/');
+  };
 
   const hasEdits = Object.keys(edits).length > 0;
-  const wildcardScope = !!selectedHost && !EXACT_HOST_RE.test(selectedHost);
 
   if (loading) {
     return <div className="flex items-center justify-center py-12 text-muted-foreground text-sm">Loading...</div>;
@@ -363,102 +192,6 @@ export function BrandingTab() {
         )}
       </div>
 
-      {/* Scope picker */}
-      <div className="border border-border rounded-lg">
-        <div className="px-4 py-3 border-b border-border bg-muted/30 flex items-center gap-2">
-          <Globe className="w-4 h-4 text-muted-foreground" />
-          <h2 className="text-sm font-medium text-foreground">Scope</h2>
-        </div>
-        <div className="px-4 py-3 space-y-3">
-          <div className="flex flex-wrap gap-2">
-            <button
-              type="button"
-              onClick={() => handleScopeChange(null)}
-              className={`h-8 px-3 rounded-md text-sm font-medium transition-colors ${
-                selectedHost === null
-                  ? 'bg-primary text-primary-foreground'
-                  : 'bg-muted text-foreground hover:bg-muted/70'
-              }`}
-            >
-              Default
-            </button>
-            {domainEntries.map(entry => (
-              <button
-                key={entry.host}
-                type="button"
-                onClick={() => handleScopeChange(entry.host)}
-                className={`h-8 px-3 rounded-md text-sm font-medium transition-colors ${
-                  selectedHost === entry.host
-                    ? 'bg-primary text-primary-foreground'
-                    : 'bg-muted text-foreground hover:bg-muted/70'
-                }`}
-              >
-                {entry.host}
-              </button>
-            ))}
-            {!addingHost && (
-              <button
-                type="button"
-                onClick={() => { setAddingHost(true); setNewHostError(null); }}
-                className="inline-flex items-center gap-1 h-8 px-3 rounded-md border border-dashed border-input text-sm text-muted-foreground hover:bg-muted hover:text-foreground transition-colors"
-              >
-                <Plus className="w-3.5 h-3.5" />
-                Add domain
-              </button>
-            )}
-          </div>
-          {addingHost && (
-            <div className="flex flex-wrap items-center gap-2">
-              <input
-                type="text"
-                autoFocus
-                value={newHostInput}
-                onChange={(e) => { setNewHostInput(e.target.value); setNewHostError(null); }}
-                onKeyDown={(e) => { if (e.key === 'Enter') void handleAddDomain(); }}
-                placeholder="mail.example.com or *.example.com"
-                className="h-8 w-64 rounded-md border border-input bg-background px-2.5 text-sm text-foreground placeholder:text-muted-foreground focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring"
-              />
-              <button
-                type="button"
-                onClick={handleAddDomain}
-                className="h-8 px-3 rounded-md bg-primary text-primary-foreground text-sm font-medium hover:bg-primary/90 transition-colors"
-              >
-                Add
-              </button>
-              <button
-                type="button"
-                onClick={() => { setAddingHost(false); setNewHostInput(''); setNewHostError(null); }}
-                className="h-8 px-2.5 rounded-md text-sm text-muted-foreground hover:text-foreground transition-colors"
-              >
-                Cancel
-              </button>
-              {newHostError && <span className="text-xs text-destructive">{newHostError}</span>}
-            </div>
-          )}
-          {selectedHost ? (
-            <div className="flex items-center justify-between gap-3 text-xs">
-              <p className="text-muted-foreground">
-                Editing overrides for <span className="font-mono text-foreground">{selectedHost}</span>.
-                Unset fields fall back to the Default values.
-                {wildcardScope && ' Uploads are disabled for wildcard hosts; enter a URL instead.'}
-              </p>
-              <button
-                type="button"
-                onClick={handleDeleteDomain}
-                className="inline-flex items-center gap-1 text-destructive hover:underline whitespace-nowrap"
-              >
-                <X className="w-3.5 h-3.5" />
-                Remove domain
-              </button>
-            </div>
-          ) : (
-            <p className="text-xs text-muted-foreground">
-              Editing the Default branding. Add a domain to override branding when the webmail is served on a specific hostname.
-            </p>
-          )}
-        </div>
-      </div>
-
       {message && (
         <div className={`text-sm rounded-md px-3 py-2 ${message.type === 'success' ? 'bg-emerald-50 text-emerald-700 dark:bg-emerald-950/30 dark:text-emerald-300' : 'bg-destructive/10 text-destructive'}`}>
           {message.text}
@@ -476,9 +209,9 @@ export function BrandingTab() {
               <div className="flex flex-col gap-2 sm:flex-row sm:items-center sm:justify-between sm:gap-4">
                 <div className="flex items-center gap-2 min-w-0">
                   <label className="text-sm text-foreground">{field.label}</label>
-                  {isOverriddenInScope(field.key) && (
+                  {config[field.key]?.source === 'admin' && (
                     <span className="text-[10px] font-medium uppercase tracking-wider px-1.5 py-0.5 rounded bg-primary/10 text-primary">
-                      {isUploadedFile(field.key) ? 'uploaded' : selectedHost ? 'domain' : 'admin'}
+                      {isUploadedFile(field.key) ? 'uploaded' : 'admin'}
                     </span>
                   )}
                 </div>
@@ -487,7 +220,7 @@ export function BrandingTab() {
                     type="text"
                     value={currentValue(field.key)}
                     onChange={(e) => handleChange(field.key, e.target.value)}
-                    placeholder={selectedHost ? 'Enter URL (uploads only for default scope)' : 'Enter URL or upload a file'}
+                    placeholder="Enter URL or upload a file"
                     className="h-8 w-full sm:w-64 min-w-0 rounded-md border border-input bg-background px-2.5 text-sm text-foreground placeholder:text-muted-foreground focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring"
                   />
                   <input
@@ -503,9 +236,9 @@ export function BrandingTab() {
                   />
                   <button
                     onClick={() => fileInputRefs.current[field.key]?.click()}
-                    disabled={uploading === field.key || wildcardScope}
+                    disabled={uploading === field.key}
                     className="inline-flex items-center gap-1.5 h-8 px-2.5 rounded-md border border-input bg-background text-sm text-foreground hover:bg-muted disabled:opacity-50 transition-colors"
-                    title={wildcardScope ? 'Uploads disabled for wildcard hosts' : 'Upload file'}
+                    title="Upload file"
                   >
                     {uploading === field.key ? <Loader2 className="w-3.5 h-3.5 animate-spin" /> : <Upload className="w-3.5 h-3.5" />}
                   </button>
@@ -518,7 +251,7 @@ export function BrandingTab() {
                       <Trash2 className="w-3.5 h-3.5" />
                     </button>
                   )}
-                  {isOverriddenInScope(field.key) && !isUploadedFile(field.key) && (
+                  {config[field.key]?.source === 'admin' && !isUploadedFile(field.key) && (
                     <button onClick={() => handleRevert(field.key)} className="text-muted-foreground hover:text-foreground" title="Revert to default">
                       <RotateCcw className="w-3.5 h-3.5" />
                     </button>
@@ -530,7 +263,7 @@ export function BrandingTab() {
                   <ImageIcon className="w-3.5 h-3.5 text-muted-foreground" />
                   <div className="h-8 w-auto bg-muted rounded flex items-center justify-center px-2">
                     <img
-                      src={withBasePath(currentValue(field.key))}
+                      src={currentValue(field.key)}
                       alt={field.label}
                       className="max-h-6 max-w-[200px] object-contain"
                       onError={(e) => { (e.target as HTMLImageElement).style.display = 'none'; }}
@@ -554,9 +287,9 @@ export function BrandingTab() {
               <div className="flex flex-col gap-2 sm:flex-row sm:items-center sm:justify-between sm:gap-4">
                 <div className="flex items-center gap-2 min-w-0">
                   <label className="text-sm text-foreground">{field.label}</label>
-                  {isOverriddenInScope(field.key) && (
+                  {config[field.key]?.source === 'admin' && (
                     <span className="text-[10px] font-medium uppercase tracking-wider px-1.5 py-0.5 rounded bg-primary/10 text-primary">
-                      {isUploadedFile(field.key) ? 'uploaded' : selectedHost ? 'domain' : 'admin'}
+                      {isUploadedFile(field.key) ? 'uploaded' : 'admin'}
                     </span>
                   )}
                 </div>
@@ -565,7 +298,7 @@ export function BrandingTab() {
                     type="text"
                     value={currentValue(field.key)}
                     onChange={(e) => handleChange(field.key, e.target.value)}
-                    placeholder={selectedHost ? 'Enter URL (uploads only for default scope)' : 'Enter URL or upload a file'}
+                    placeholder="Enter URL or upload a file"
                     className="h-8 w-full sm:w-64 min-w-0 rounded-md border border-input bg-background px-2.5 text-sm text-foreground placeholder:text-muted-foreground focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring"
                   />
                   <input
@@ -581,9 +314,9 @@ export function BrandingTab() {
                   />
                   <button
                     onClick={() => fileInputRefs.current[field.key]?.click()}
-                    disabled={uploading === field.key || wildcardScope}
+                    disabled={uploading === field.key}
                     className="inline-flex items-center gap-1.5 h-8 px-2.5 rounded-md border border-input bg-background text-sm text-foreground hover:bg-muted disabled:opacity-50 transition-colors"
-                    title={wildcardScope ? 'Uploads disabled for wildcard hosts' : 'Upload file'}
+                    title="Upload file"
                   >
                     {uploading === field.key ? <Loader2 className="w-3.5 h-3.5 animate-spin" /> : <Upload className="w-3.5 h-3.5" />}
                   </button>
@@ -596,7 +329,7 @@ export function BrandingTab() {
                       <Trash2 className="w-3.5 h-3.5" />
                     </button>
                   )}
-                  {isOverriddenInScope(field.key) && !isUploadedFile(field.key) && (
+                  {config[field.key]?.source === 'admin' && !isUploadedFile(field.key) && (
                     <button onClick={() => handleRevert(field.key)} className="text-muted-foreground hover:text-foreground" title="Revert to default">
                       <RotateCcw className="w-3.5 h-3.5" />
                     </button>
@@ -608,7 +341,7 @@ export function BrandingTab() {
                   <ImageIcon className="w-3.5 h-3.5 text-muted-foreground" />
                   <div className="h-8 w-auto bg-muted rounded flex items-center justify-center px-2">
                     <img
-                      src={withBasePath(currentValue(field.key))}
+                      src={currentValue(field.key)}
                       alt={field.label}
                       className="max-h-6 max-w-[200px] object-contain"
                       onError={(e) => { (e.target as HTMLImageElement).style.display = 'none'; }}
@@ -622,10 +355,8 @@ export function BrandingTab() {
             <div key={field.key} className="px-4 py-3 flex flex-col gap-2 sm:flex-row sm:items-center sm:justify-between sm:gap-4">
               <div className="flex items-center gap-2 min-w-0">
                 <label className="text-sm text-foreground">{field.label}</label>
-                {isOverriddenInScope(field.key) && (
-                  <span className="text-[10px] font-medium uppercase tracking-wider px-1.5 py-0.5 rounded bg-primary/10 text-primary">
-                    {selectedHost ? 'domain' : 'admin'}
-                  </span>
+                {config[field.key]?.source === 'admin' && (
+                  <span className="text-[10px] font-medium uppercase tracking-wider px-1.5 py-0.5 rounded bg-primary/10 text-primary">admin</span>
                 )}
               </div>
               <div className="flex items-center gap-2 w-full sm:w-auto">
@@ -636,7 +367,7 @@ export function BrandingTab() {
                   placeholder={field.placeholder}
                   className="h-8 w-full sm:w-72 min-w-0 rounded-md border border-input bg-background px-2.5 text-sm text-foreground placeholder:text-muted-foreground focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring"
                 />
-                {isOverriddenInScope(field.key) && (
+                {config[field.key]?.source === 'admin' && (
                   <button onClick={() => handleRevert(field.key)} className="text-muted-foreground hover:text-foreground" title="Revert to default">
                     <RotateCcw className="w-3.5 h-3.5" />
                   </button>
@@ -650,10 +381,8 @@ export function BrandingTab() {
               <div key={field.key} className="px-4 py-3 flex flex-col gap-2 sm:flex-row sm:items-center sm:justify-between sm:gap-4">
                 <div className="flex items-center gap-2 min-w-0">
                   <label className="text-sm text-foreground">{field.label}</label>
-                  {isOverriddenInScope(field.key) && (
-                    <span className="text-[10px] font-medium uppercase tracking-wider px-1.5 py-0.5 rounded bg-primary/10 text-primary">
-                      {selectedHost ? 'domain' : 'admin'}
-                    </span>
+                  {config[field.key]?.source === 'admin' && (
+                    <span className="text-[10px] font-medium uppercase tracking-wider px-1.5 py-0.5 rounded bg-primary/10 text-primary">admin</span>
                   )}
                 </div>
                 <div className="flex items-center gap-2 w-full sm:w-auto">
@@ -671,7 +400,7 @@ export function BrandingTab() {
                     placeholder={field.defaultValue}
                     className="h-8 w-full sm:w-32 min-w-0 rounded-md border border-input bg-background px-2.5 text-sm font-mono text-foreground placeholder:text-muted-foreground focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring"
                   />
-                  {isOverriddenInScope(field.key) && (
+                  {config[field.key]?.source === 'admin' && (
                     <button onClick={() => handleRevert(field.key)} className="text-muted-foreground hover:text-foreground" title="Revert to default">
                       <RotateCcw className="w-3.5 h-3.5" />
                     </button>
@@ -692,10 +421,8 @@ export function BrandingTab() {
             <div key={field.key} className="px-4 py-3 flex flex-col gap-2 sm:flex-row sm:items-center sm:justify-between sm:gap-4">
               <div className="flex items-center gap-2 min-w-0">
                 <label className="text-sm text-foreground">{field.label}</label>
-                {isOverriddenInScope(field.key) && (
-                  <span className="text-[10px] font-medium uppercase tracking-wider px-1.5 py-0.5 rounded bg-primary/10 text-primary">
-                    {selectedHost ? 'domain' : 'admin'}
-                  </span>
+                {config[field.key]?.source === 'admin' && (
+                  <span className="text-[10px] font-medium uppercase tracking-wider px-1.5 py-0.5 rounded bg-primary/10 text-primary">admin</span>
                 )}
               </div>
               <div className="flex items-center gap-2 w-full sm:w-auto">
@@ -706,7 +433,7 @@ export function BrandingTab() {
                   placeholder={field.key.includes('Url') ? 'https://...' : 'Enter value'}
                   className="h-8 w-full sm:w-72 min-w-0 rounded-md border border-input bg-background px-2.5 text-sm text-foreground placeholder:text-muted-foreground focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring"
                 />
-                {isOverriddenInScope(field.key) && (
+                {config[field.key]?.source === 'admin' && (
                   <button onClick={() => handleRevert(field.key)} className="text-muted-foreground hover:text-foreground" title="Revert to default">
                     <RotateCcw className="w-3.5 h-3.5" />
                   </button>

app/(main)/admin/_tabs/dashboard.tsx

@@ -32,6 +32,7 @@ export function DashboardTab() {
   const [themeCount, setThemeCount] = useState(0);
   const [policyRuleCount, setPolicyRuleCount] = useState(0);
   const [accountCounts, setAccountCounts] = useState<{ total: number; active7d: number } | null>(null);
+  const [jmapHealth, setJmapHealth] = useState<'unknown' | 'ok' | 'error'>('unknown');
 
   useEffect(() => {
     fetchDashboardData();
@@ -81,6 +82,15 @@ export function DashboardTab() {
       }
     }
 
+    if (configData?.jmapServerUrl) {
+      try {
+        const jmapRes = await apiFetch('/api/config');
+        setJmapHealth(jmapRes.ok ? 'ok' : 'error');
+      } catch {
+        setJmapHealth('error');
+      }
+    }
+
     const w: string[] = [];
     if (adminConfigRes.ok) {
       const sources = await adminConfigRes.json();
@@ -118,6 +128,16 @@ export function DashboardTab() {
         <SettingItem label="JMAP Server" description={jmapUrl !== '-' ? jmapUrl : undefined}>
           <span className="text-sm text-foreground">{jmapHostname}</span>
         </SettingItem>
+        <SettingItem label="JMAP Connection">
+          <span className={`inline-flex items-center gap-1.5 text-sm font-medium ${
+            jmapHealth === 'ok' ? 'text-green-600 dark:text-green-400' : jmapHealth === 'error' ? 'text-red-600 dark:text-red-400' : 'text-muted-foreground'
+          }`}>
+            <span className={`w-2 h-2 rounded-full ${
+              jmapHealth === 'ok' ? 'bg-green-500' : jmapHealth === 'error' ? 'bg-red-500' : 'bg-muted-foreground/40'
+            }`} />
+            {jmapHealth === 'ok' ? 'Connected' : jmapHealth === 'error' ? 'Error' : 'Unknown'}
+          </span>
+        </SettingItem>
         <SettingItem label="Last Login">
           <span className="text-sm text-foreground">
             {status?.lastLogin ? new Date(status.lastLogin).toLocaleString() : 'Never'}

app/(main)/admin/_tabs/logs.tsx

@@ -96,10 +96,10 @@ export function LogsTab() {
         <table className="w-full text-sm">
           <thead>
             <tr className="border-b border-border bg-muted/30">
-              <th className="text-start px-4 py-2 font-medium text-muted-foreground whitespace-nowrap">Time</th>
-              <th className="text-start px-4 py-2 font-medium text-muted-foreground whitespace-nowrap">Action</th>
-              <th className="text-start px-4 py-2 font-medium text-muted-foreground">Details</th>
-              <th className="text-start px-4 py-2 font-medium text-muted-foreground whitespace-nowrap">IP</th>
+              <th className="text-left px-4 py-2 font-medium text-muted-foreground whitespace-nowrap">Time</th>
+              <th className="text-left px-4 py-2 font-medium text-muted-foreground whitespace-nowrap">Action</th>
+              <th className="text-left px-4 py-2 font-medium text-muted-foreground">Details</th>
+              <th className="text-left px-4 py-2 font-medium text-muted-foreground whitespace-nowrap">IP</th>
             </tr>
           </thead>
           <tbody className="divide-y divide-border">

app/(main)/admin/_tabs/marketplace.tsx

@@ -171,7 +171,7 @@ export function MarketplaceTab() {
             placeholder="Search extensions..."
             value={searchInput}
             onChange={(e) => setSearchInput(e.target.value)}
-            className="w-full h-9 ps-9 pe-3 rounded-md border border-input bg-background text-sm text-foreground placeholder:text-muted-foreground focus:outline-none focus:ring-2 focus:ring-ring/20 focus:border-ring"
+            className="w-full h-9 pl-9 pr-3 rounded-md border border-input bg-background text-sm text-foreground placeholder:text-muted-foreground focus:outline-none focus:ring-2 focus:ring-ring/20 focus:border-ring"
           />
         </div>
         <div className="flex items-center gap-1 rounded-md border border-input bg-background p-0.5 self-start sm:self-auto">
@@ -210,7 +210,7 @@ export function MarketplaceTab() {
       {loading && !error && (
         <div className="flex items-center justify-center py-12">
           <Loader2 className="w-5 h-5 animate-spin text-muted-foreground" />
-          <span className="ms-2 text-sm text-muted-foreground">Searching extensions...</span>
+          <span className="ml-2 text-sm text-muted-foreground">Searching extensions...</span>
         </div>
       )}
 

app/(main)/admin/_tabs/plugin-config-panel.tsx

@@ -155,7 +155,7 @@ export function PluginConfigPanel({ pluginId, onBack }: Props) {
   if (loading) {
     return (
       <div className="flex items-center justify-center py-12 text-muted-foreground text-sm">
-        <Loader2 className="w-4 h-4 animate-spin me-2" />
+        <Loader2 className="w-4 h-4 animate-spin mr-2" />
         Loading...
       </div>
     );
@@ -217,7 +217,7 @@ export function PluginConfigPanel({ pluginId, onBack }: Props) {
               <div key={key}>
                 <label className="text-sm font-medium text-foreground block mb-1">
                   {field.label}
-                  {field.required && <span className="text-destructive ms-0.5">*</span>}
+                  {field.required && <span className="text-destructive ml-0.5">*</span>}
                 </label>
                 {field.description && (
                   <p className="text-xs text-muted-foreground mb-1.5">{field.description}</p>
@@ -250,7 +250,7 @@ export function PluginConfigPanel({ pluginId, onBack }: Props) {
                       value={formValues[key] ?? ''}
                       onChange={(e) => setFormValues(prev => ({ ...prev, [key]: e.target.value }))}
                       placeholder={config[key] ? '••••••••  (unchanged)' : (field.placeholder || '')}
-                      className="w-full h-9 px-3 pe-10 rounded-md border border-input bg-background text-sm focus:outline-none focus:ring-2 focus:ring-ring font-mono"
+                      className="w-full h-9 px-3 pr-10 rounded-md border border-input bg-background text-sm focus:outline-none focus:ring-2 focus:ring-ring font-mono"
                     />
                     <button
                       type="button"

app/(main)/admin/_tabs/policy.tsx

@@ -6,16 +6,13 @@ import type { SettingsPolicy, FeatureGates } from '@/lib/admin/types';
 import { DEFAULT_FEATURE_GATES, DEFAULT_POLICY } from '@/lib/admin/types';
 import { apiFetch } from '@/lib/browser-navigation';
 
-// `allMailViewEnabled` is deprecated (folded into `crossAllViewEnabled`, normalized
-// forward on policy load), so it is hidden from the admin UI.
-const EXCLUDED_FEATURE_GATES: (keyof FeatureGates)[] = ['pluginsEnabled', 'pluginsUploadEnabled', 'themesEnabled', 'userThemesEnabled', 'allMailViewEnabled'];
+const EXCLUDED_FEATURE_GATES: (keyof FeatureGates)[] = ['pluginsEnabled', 'pluginsUploadEnabled', 'themesEnabled', 'userThemesEnabled'];
 
 const FEATURE_GATE_LABELS: Partial<Record<keyof FeatureGates, { label: string; description: string }>> = {
   sidebarAppsEnabled: { label: 'Sidebar Apps', description: 'Allow custom web apps in navigation rail' },
   settingsExportEnabled: { label: 'Settings Export/Import', description: 'Allow users to export and import settings JSON' },
   customKeywordsEnabled: { label: 'Custom Keywords', description: 'Allow user-created labels and tags' },
   templatesEnabled: { label: 'Email Templates', description: 'Allow email template creation and library' },
-  calendarEnabled: { label: 'Calendar', description: 'Enable calendar features and views' },
   calendarTasksEnabled: { label: 'Calendar Tasks', description: 'Show task panel in calendar view' },
   contactsEnabled: { label: 'Contacts', description: 'Enable contacts/address book features' },
   smimeEnabled: { label: 'S/MIME', description: 'Enable certificate management and email signing' },
@@ -24,10 +21,6 @@ const FEATURE_GATE_LABELS: Partial<Record<keyof FeatureGates, { label: string; d
   folderIconsEnabled: { label: 'Folder Icons', description: 'Allow custom folder icon picker' },
   hoverActionsConfigEnabled: { label: 'Hover Actions Config', description: 'Allow users to customize email hover actions' },
   filesEnabled: { label: 'Files (WebDAV)', description: 'Enable file storage via WebDAV. WARNING: Large uploads can cause Stalwart/RocksDB instability. Not recommended for production.' },
-  crossUnreadViewEnabled: { label: 'Unified Mailbox: Unread', description: 'Allow an "Unread" entry in the Unified Mailbox section that lists unread mail across the account and its shared folders (or every account when the cross-account sub-option is on). Honors the user\'s folder selection. Requires the matching per-user toggle in Settings → Appearance.' },
-  crossStarredViewEnabled: { label: 'Unified Mailbox: Starred', description: 'Allow a "Starred" entry in the Unified Mailbox section that lists flagged/starred mail across the account and its shared folders (or every account when the cross-account sub-option is on). Honors the user\'s folder selection. Requires the matching per-user toggle in Settings → Appearance.' },
-  crossAllViewEnabled: { label: 'Unified Mailbox: All Mail', description: 'Allow an "All mail" entry in the Unified Mailbox section that lists all mail across the account and its shared folders (or every account when the cross-account sub-option is on). Honors the user\'s folder selection. Requires the matching per-user toggle in Settings → Appearance.' },
-  unifiedCrossAccountEnabled: { label: 'Unified Mailbox: Cross-account', description: 'Allow users to expand the Unified Mailbox beyond the active account boundary so its lists merge across every logged-in account. When off, the Unified Mailbox stays within the active account and its shared folders.' },
 };
 
 const RESTRICTABLE_SETTINGS = [
@@ -81,18 +74,6 @@ export function PolicyTab() {
     setMessage(null);
   }
 
-  function setPushRelayUrl(value: string) {
-    setPolicy(prev => ({ ...prev, pushRelayUrl: value }));
-    setDirty(true);
-    setMessage(null);
-  }
-
-  function togglePushRelayLocked() {
-    setPolicy(prev => ({ ...prev, pushRelayUrlLocked: !prev.pushRelayUrlLocked }));
-    setDirty(true);
-    setMessage(null);
-  }
-
   function toggleLocked(settingKey: string) {
     setPolicy(prev => {
       const existing = prev.restrictions[settingKey] || {};
@@ -202,34 +183,6 @@ export function PolicyTab() {
         </div>
       </div>
 
-      <div className="border border-border rounded-lg">
-        <div className="px-4 py-3 border-b border-border bg-muted/30">
-          <h2 className="text-sm font-medium text-foreground">Push Relay</h2>
-          <p className="text-xs text-muted-foreground mt-0.5">Override the Web Push relay URL shown in user notification settings. Leave empty to use the built-in default.</p>
-        </div>
-        <div className="px-4 py-3 space-y-3">
-          <input
-            type="url"
-            inputMode="url"
-            autoComplete="off"
-            spellCheck={false}
-            value={policy.pushRelayUrl ?? ''}
-            onChange={(e) => setPushRelayUrl(e.target.value)}
-            placeholder="https://notifications.relay.example.com"
-            className="w-full rounded border border-input bg-background px-3 py-2 text-sm"
-          />
-          <label className="flex items-center gap-1.5 text-xs text-muted-foreground cursor-pointer">
-            <input
-              type="checkbox"
-              checked={!!policy.pushRelayUrlLocked}
-              onChange={togglePushRelayLocked}
-              className="rounded border-input"
-            />
-            <Lock className="w-3 h-3" /> Lock - users cannot change this URL
-          </label>
-        </div>
-      </div>
-
       {categories.map(category => (
         <div key={category} className="border border-border rounded-lg">
           <div className="px-4 py-3 border-b border-border bg-muted/30">

app/(main)/admin/_tabs/settings.tsx

@@ -117,7 +117,7 @@ export function SettingsTab() {
         <TextSetting label="JMAP Server URL" configKey="jmapServerUrl" value={currentValue('jmapServerUrl') as string} source={config.jmapServerUrl?.source} onChange={handleChange} onRevert={handleRevert} placeholder="https://mail.example.com" />
         <ToggleSetting label="Allow Custom JMAP Endpoint" description="Show a JMAP server URL field on the login form, allowing users to connect to any JMAP server" configKey="allowCustomJmapEndpoint" value={currentValue('allowCustomJmapEndpoint') as boolean} source={config.allowCustomJmapEndpoint?.source} onChange={handleChange} onRevert={handleRevert} />
         {!!currentValue('allowCustomJmapEndpoint') && (
-          <div className="px-4 py-2.5 bg-amber-50 dark:bg-amber-950/30 border-s-2 border-amber-400 dark:border-amber-600">
+          <div className="px-4 py-2.5 bg-amber-50 dark:bg-amber-950/30 border-l-2 border-amber-400 dark:border-amber-600">
             <p className="text-xs text-amber-800 dark:text-amber-300 leading-relaxed">
               <strong>CORS warning:</strong> External JMAP servers must include this domain in their CORS <code className="text-[11px] bg-amber-100 dark:bg-amber-900/50 px-1 py-0.5 rounded">Access-Control-Allow-Origin</code> header, or requests from the browser will be blocked.
             </p>
@@ -125,7 +125,6 @@ export function SettingsTab() {
         )}
         <ToggleSetting label="Stalwart Features" description="Enable Stalwart Mail Server-specific features" configKey="stalwartFeaturesEnabled" value={currentValue('stalwartFeaturesEnabled') as boolean} source={config.stalwartFeaturesEnabled?.source} onChange={handleChange} onRevert={handleRevert} />
         <ToggleSetting label="Demo Mode" description="Enable demo mode with sample data" configKey="demoMode" value={currentValue('demoMode') as boolean} source={config.demoMode?.source} onChange={handleChange} onRevert={handleRevert} />
-        <ToggleSetting label="Search Engine Indexing" description="Allow search engines to index this webmail. Off (the default) sends noindex/nofollow in the page head, recommended for private deployments." configKey="searchEngineIndexing" value={currentValue('searchEngineIndexing') as boolean} source={config.searchEngineIndexing?.source} onChange={handleChange} onRevert={handleRevert} />
       </SettingsSection>
 
       <SettingsSection title="JMAP Servers (multi-server)">
@@ -145,7 +144,7 @@ export function SettingsTab() {
           onRevert={() => handleRevert('jmapServers')}
         />
         {Array.isArray(currentValue('jmapServers')) && (currentValue('jmapServers') as JmapServerEntry[]).length > 0 && (
-          <div className="px-4 py-2.5 bg-amber-50 dark:bg-amber-950/30 border-s-2 border-amber-400 dark:border-amber-600">
+          <div className="px-4 py-2.5 bg-amber-50 dark:bg-amber-950/30 border-l-2 border-amber-400 dark:border-amber-600">
             <p className="text-xs text-amber-800 dark:text-amber-300 leading-relaxed">
               <strong>CORS warning:</strong> Each JMAP server must allow this webmail's origin in its <code className="text-[11px] bg-amber-100 dark:bg-amber-900/50 px-1 py-0.5 rounded">Access-Control-Allow-Origin</code> header, or browser requests will be blocked.
             </p>

app/(main)/admin/_tabs/telemetry.tsx

@@ -118,10 +118,9 @@ export function TelemetryTab() {
       <header className="space-y-2">
         <h1 className="text-2xl font-semibold">Anonymous Usage Stats</h1>
         <p className="text-sm text-muted-foreground">
-          Bulwark can send one anonymous heartbeat per day so we can see how many instances are
-          running, on what platforms, and which features they use. It&apos;s <strong>off by
-          default</strong>; one click below enables it and helps us make the product better. No
-          email addresses, no hostnames, no IPs are sent.{' '}
+          Bulwark sends one anonymous heartbeat per day so we can see how many instances are
+          running, on what platforms, and which features they use. <strong>Enabled by default</strong>;
+          one click below disables it. No email addresses, no hostnames, no IPs are sent.{' '}
           <a
             href="https://bulwarkmail.org/docs/legal/privacy/telemetry"
             target="_blank"
@@ -139,8 +138,8 @@ export function TelemetryTab() {
             <div className="font-medium">Status</div>
             <div className="text-sm text-muted-foreground">
               {status.consent === 'pending' && 'Initialising - no heartbeats sent yet.'}
-              {status.consent === 'on' && 'Heartbeats are enabled. Thanks for helping us improve!'}
-              {status.consent === 'off' && 'Heartbeats are off (default).'}
+              {status.consent === 'on' && 'Heartbeats are enabled (default).'}
+              {status.consent === 'off' && 'Heartbeats are off.'}
               {envOverridden && (
                 <> Locked by <code>BULWARK_TELEMETRY</code> env var.</>
               )}

app/(main)/admin/_tabs/themes.tsx

@@ -5,11 +5,12 @@ import { Upload, Trash2, Power, PowerOff, Loader2, Palette, Save, Shield, Lock,
 import type { SettingsPolicy } from '@/lib/admin/types';
 import { DEFAULT_POLICY, DEFAULT_THEME_POLICY } from '@/lib/admin/types';
 import { apiFetch } from '@/lib/browser-navigation';
-import { BUILTIN_THEMES } from '@/lib/builtin-themes';
 
-// Derive from the single source of truth so newly added built-in themes show
-// up here automatically (was previously a hardcoded subset — see #496).
-const BUILTIN_THEME_OPTIONS = BUILTIN_THEMES.map(t => ({ id: t.id, name: t.name }));
+const BUILTIN_THEME_OPTIONS = [
+  { id: 'builtin-nord', name: 'Nord' },
+  { id: 'builtin-catppuccin', name: 'Catppuccin' },
+  { id: 'builtin-solarized', name: 'Solarized' },
+];
 
 interface ThemeEntry {
   id: string;

app/(main)/admin/change-password/page.tsx

@@ -65,7 +65,7 @@ export default function ChangePasswordPage() {
               value={currentPassword}
               onChange={e => setCurrentPassword(e.target.value)}
               required
-              className="w-full h-9 ps-9 pe-3 rounded-md border border-input bg-background text-sm text-foreground focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring"
+              className="w-full h-9 pl-9 pr-3 rounded-md border border-input bg-background text-sm text-foreground focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring"
               autoComplete="current-password"
             />
           </div>

app/(main)/admin/layout.tsx

@@ -212,7 +212,7 @@ export default function AdminLayout({ children }: { children: React.ReactNode })
                     type="button"
                     onClick={handleClick}
                     className={cn(
-                      'w-full text-start px-3 py-2 rounded-md text-sm transition-colors duration-150 flex items-center gap-2.5',
+                      'w-full text-left px-3 py-2 rounded-md text-sm transition-colors duration-150 flex items-center gap-2.5',
                       active
                         ? 'bg-accent text-accent-foreground font-medium'
                         : 'hover:bg-muted text-foreground'
@@ -248,7 +248,7 @@ export default function AdminLayout({ children }: { children: React.ReactNode })
           <Link
             href="/admin/change-password"
             className={cn(
-              'w-full text-start px-3 py-2 rounded-md text-sm transition-colors duration-150 flex items-center gap-2.5',
+              'w-full text-left px-3 py-2 rounded-md text-sm transition-colors duration-150 flex items-center gap-2.5',
               pathname === '/admin/change-password'
                 ? 'bg-accent text-accent-foreground font-medium'
                 : 'hover:bg-muted text-foreground'
@@ -263,7 +263,7 @@ export default function AdminLayout({ children }: { children: React.ReactNode })
         )}
         <button
           onClick={handleLogout}
-          className="w-full text-start px-3 py-2 rounded-md text-sm transition-colors duration-150 flex items-center gap-2.5 hover:bg-muted text-foreground"
+          className="w-full text-left px-3 py-2 rounded-md text-sm transition-colors duration-150 flex items-center gap-2.5 hover:bg-muted text-foreground"
         >
           <LogOut className="w-4 h-4 shrink-0 text-muted-foreground" />
           Sign out
@@ -275,7 +275,7 @@ export default function AdminLayout({ children }: { children: React.ReactNode })
   return (
     <div className="min-h-screen flex bg-background">
       {/* Slim webmail nav rail (desktop only) */}
-      <nav className="hidden md:flex w-14 bg-secondary flex-col items-center py-3 gap-2 border-e border-border sticky top-0 h-screen shrink-0">
+      <nav className="hidden md:flex w-14 bg-secondary flex-col items-center py-3 gap-2 border-r border-border sticky top-0 h-screen shrink-0">
         {logoUrl ? (
           <img src={logoUrl} alt="" className="w-7 h-7 object-contain mb-2" />
         ) : (
@@ -326,12 +326,12 @@ export default function AdminLayout({ children }: { children: React.ReactNode })
       </nav>
 
       {/* Admin Sidebar (desktop only) */}
-      <aside className="hidden md:flex w-60 border-e border-border bg-secondary flex-col sticky top-0 h-screen">
+      <aside className="hidden md:flex w-60 border-r border-border bg-secondary flex-col sticky top-0 h-screen">
         <div className="h-14 flex items-center px-4 border-b border-border shrink-0">
           {logoUrl ? (
-            <img src={logoUrl} alt="" className="w-5 h-5 object-contain me-2" />
+            <img src={logoUrl} alt="" className="w-5 h-5 object-contain mr-2" />
           ) : (
-            <Shield className="w-5 h-5 text-primary me-2" />
+            <Shield className="w-5 h-5 text-primary mr-2" />
           )}
           <span className="font-semibold text-sm text-foreground">Admin Panel</span>
         </div>
@@ -350,7 +350,7 @@ export default function AdminLayout({ children }: { children: React.ReactNode })
       {/* Mobile drawer */}
       <aside
         className={cn(
-          'md:hidden fixed inset-y-0 left-0 z-50 w-72 max-w-[85vw] border-e border-border bg-secondary flex flex-col transition-transform duration-200 ease-out',
+          'md:hidden fixed inset-y-0 left-0 z-50 w-72 max-w-[85vw] border-r border-border bg-secondary flex flex-col transition-transform duration-200 ease-out',
           mobileNavOpen ? 'translate-x-0' : '-translate-x-full'
         )}
         aria-label="Admin navigation"
@@ -359,9 +359,9 @@ export default function AdminLayout({ children }: { children: React.ReactNode })
         <div className="h-14 flex items-center justify-between px-3 border-b border-border shrink-0">
           <div className="flex items-center min-w-0">
             {logoUrl ? (
-              <img src={logoUrl} alt="" className="w-5 h-5 object-contain me-2" />
+              <img src={logoUrl} alt="" className="w-5 h-5 object-contain mr-2" />
             ) : (
-              <Shield className="w-5 h-5 text-primary me-2" />
+              <Shield className="w-5 h-5 text-primary mr-2" />
             )}
             <span className="font-semibold text-sm text-foreground truncate">Admin Panel</span>
           </div>
@@ -391,9 +391,9 @@ export default function AdminLayout({ children }: { children: React.ReactNode })
           </button>
           <div className="flex items-center min-w-0">
             {logoUrl ? (
-              <img src={logoUrl} alt="" className="w-5 h-5 object-contain me-2" />
+              <img src={logoUrl} alt="" className="w-5 h-5 object-contain mr-2" />
             ) : (
-              <Shield className="w-5 h-5 text-primary me-2" />
+              <Shield className="w-5 h-5 text-primary mr-2" />
             )}
             <span className="font-semibold text-sm text-foreground truncate">Admin Panel</span>
           </div>

app/(main)/admin/marketplace/[slug]/page.tsx

@@ -186,7 +186,7 @@ export default function MarketplacePreviewPage() {
   if (loading) {
     return (
       <div className="flex items-center justify-center py-12 text-muted-foreground text-sm">
-        <Loader2 className="w-4 h-4 animate-spin me-2" />
+        <Loader2 className="w-4 h-4 animate-spin mr-2" />
         Loading...
       </div>
     );
@@ -512,7 +512,7 @@ export default function MarketplacePreviewPage() {
         <section className="border border-border rounded-lg">
           <button
             onClick={() => setShowManifest(v => !v)}
-            className="w-full flex items-center justify-between gap-2 px-4 py-3 text-start hover:bg-muted/30 transition-colors"
+            className="w-full flex items-center justify-between gap-2 px-4 py-3 text-left hover:bg-muted/30 transition-colors"
           >
             <div className="flex items-center gap-2">
               <FileCode className="w-4 h-4 text-muted-foreground" />
@@ -532,7 +532,7 @@ export default function MarketplacePreviewPage() {
         <section className="border border-border rounded-lg">
           <button
             onClick={() => setShowSource(v => !v)}
-            className="w-full flex items-center justify-between gap-2 px-4 py-3 text-start hover:bg-muted/30 transition-colors"
+            className="w-full flex items-center justify-between gap-2 px-4 py-3 text-left hover:bg-muted/30 transition-colors"
           >
             <div className="flex items-center gap-2">
               <FileCode className="w-4 h-4 text-muted-foreground" />

app/(main)/global-error.tsx

@@ -44,7 +44,7 @@ export default function GlobalError({
               onClick={reset}
               className="inline-flex items-center px-4 py-2 bg-blue-600 text-white rounded-lg hover:bg-blue-700 transition-colors"
             >
-              <RefreshCw className="w-4 h-4 me-2" />
+              <RefreshCw className="w-4 h-4 mr-2" />
               Try again
             </button>
           </div>

app/(main)/layout.tsx

@@ -1,32 +1,13 @@
 import type { Metadata, Viewport } from "next";
-import { getLocaleDirection } from "@/i18n/direction";
 import { Geist, Geist_Mono } from "next/font/google";
 import { headers } from "next/headers";
-import { getLocale, getTranslations } from "next-intl/server";
+import { getLocale } from "next-intl/server";
+import { PWAInstallPrompt } from "@/components/pwa-install-prompt";
 import { ServiceWorkerRegistration } from "@/components/service-worker-registration";
-import { FaviconBadge } from "@/components/favicon-badge";
 import { configManager } from "@/lib/admin/config-manager";
-import {
-  matchDomainBranding,
-  parseDomainBranding,
-  pickRequestHost,
-} from "@/lib/admin/domain-branding";
 import { withBasePath } from "@/lib/browser-navigation";
-import { locales } from "@/i18n/routing";
 import "../globals.css";
 
-// This layout renders <html> and sits ABOVE the [locale] segment, so
-// next-intl's getLocale() returns the default locale here - emitting
-// <html lang="en"> on e.g. /de pages, which makes browsers offer to
-// "translate this page". Recover the active locale from the request pathname
-// (exposed by proxy.ts as x-pathname), falling back to getLocale() (cookie /
-// Accept-Language) when the path carries no locale segment.
-async function resolveRequestLocale(): Promise<string> {
-  const pathname = (await headers()).get("x-pathname") || "";
-  const seg = pathname.split("/").find((s) => (locales as readonly string[]).includes(s));
-  return seg ?? (await getLocale());
-}
-
 const geistSans = Geist({
   variable: "--font-geist-sans",
   subsets: ["latin"],
@@ -45,34 +26,11 @@ export const viewport: Viewport = {
 
 export async function generateMetadata(): Promise<Metadata> {
   await configManager.ensureLoaded();
-  // The <head> favicon must honor per-domain branding, exactly like
-  // /api/config, app/manifest.ts, and /api/pwa-icon already do. Resolve the
-  // request host and prefer its override; fall back to the global
-  // admin/env/default value when the host has no favicon override (#585).
-  const host = pickRequestHost(await headers());
-  const domainOverride = matchDomainBranding(
-    host,
-    parseDomainBranding(configManager.get<unknown>("domainBranding", [])),
-  ).faviconUrl;
-  const faviconUrl =
-    domainOverride && domainOverride.length > 0
-      ? domainOverride
-      : configManager.get<string>("faviconUrl", "/branding/Bulwark_Favicon.svg");
-  // Localize the <head> description to match the UI language; a hardcoded
-  // English description is another signal that makes Chrome offer to
-  // "translate this page". Resolve the locale from the request path, since this
-  // layout is above the [locale] segment (see resolveRequestLocale).
-  const locale = await resolveRequestLocale();
-  const t = await getTranslations({ locale });
+  const faviconUrl = configManager.get<string>("faviconUrl", "/branding/Bulwark_Favicon.svg");
 
   return {
     title: process.env.APP_NAME || process.env.NEXT_PUBLIC_APP_NAME || "Webmail",
-    description: t("meta_description"),
-    // A private webmail should not be indexed by search engines. This is opt-in
-    // via Settings -> General; the default (false) emits noindex/nofollow.
-    robots: configManager.get<boolean>("searchEngineIndexing", false)
-      ? { index: true, follow: true }
-      : { index: false, follow: false },
+    description: "Minimalist webmail client using JMAP protocol",
     appleWebApp: {
       capable: true,
       statusBarStyle: "black-translucent",
@@ -90,12 +48,12 @@ export default async function RootLayout({
 }: {
   children: React.ReactNode;
 }) {
-  const locale = await resolveRequestLocale();
+  const locale = await getLocale();
   const nonce = (await headers()).get("x-nonce") ?? "";
   const parentOrigin = process.env.NEXT_PUBLIC_PARENT_ORIGIN || "";
 
   return (
-    <html lang={locale} dir={getLocaleDirection(locale)} suppressHydrationWarning>
+    <html lang={locale} suppressHydrationWarning>
       <head>
         <meta name="theme-color" content="#ffffff" />
         <meta name="mobile-web-app-capable" content="yes" />
@@ -133,8 +91,8 @@ export default async function RootLayout({
         className={`${geistSans.variable} ${geistMono.variable} antialiased`}
       >
         <ServiceWorkerRegistration />
-        <FaviconBadge />
         {children}
+        <PWAInstallPrompt />
       </body>
     </html>
   );

app/(main)/setup/page.tsx

@@ -38,7 +38,6 @@ interface WizardConfig {
   // Security
   sessionSecret: string;
   settingsSyncEnabled: boolean;
-  telemetryEnabled: boolean;
   // Logging
   logFormat: 'text' | 'json';
   logLevel: 'error' | 'warn' | 'info' | 'debug';
@@ -67,7 +66,6 @@ const EMPTY_CONFIG: WizardConfig = {
   oauthIssuerUrl: '',
   sessionSecret: '',
   settingsSyncEnabled: true,
-  telemetryEnabled: false,
   logFormat: 'text',
   logLevel: 'info',
   faviconUrl: '',
@@ -780,7 +778,7 @@ function ServerStep({ config, setConfig, onNext }: Pick<StepProps, 'config' | 's
                   </p>
                 </div>
               </div>
-              <label className="mt-3 ms-[3.25rem] flex items-center gap-2 cursor-pointer">
+              <label className="mt-3 ml-[3.25rem] flex items-center gap-2 cursor-pointer">
                 <input
                   type="checkbox"
                   checked={confirmedNonJmap}
@@ -870,7 +868,7 @@ function ServerStep({ config, setConfig, onNext }: Pick<StepProps, 'config' | 's
             )}
 
             {hasRowErrors && (
-              <ul className="text-xs text-destructive list-disc ps-5 space-y-0.5">
+              <ul className="text-xs text-destructive list-disc pl-5 space-y-0.5">
                 {rowErrors.map((err, i) => (
                   <li key={i}>{err}</li>
                 ))}
@@ -1004,11 +1002,8 @@ function SecurityStep({ config, setConfig, onNext, onBack }: Pick<StepProps, 'co
     e.preventDefault();
     setSubmitting(true);
     try {
-      // telemetryConsent is persisted to the telemetry state file by the API,
-      // not to admin config - see app/api/setup/step/route.ts.
-      const values: Record<string, unknown> = {
+      const values: Partial<WizardConfig> = {
         settingsSyncEnabled: config.settingsSyncEnabled,
-        telemetryConsent: config.telemetryEnabled ? 'on' : 'off',
       };
       if (config.sessionSecret) values.sessionSecret = config.sessionSecret;
       await onNext('security', values);
@@ -1073,15 +1068,6 @@ function SecurityStep({ config, setConfig, onNext, onBack }: Pick<StepProps, 'co
         hint="Stores user preferences server-side, encrypted with the session secret."
         disabled={!config.sessionSecret}
       />
-
-      <div className="rounded-md border border-border bg-muted/20 p-3">
-        <Toggle
-          checked={config.telemetryEnabled}
-          onChange={(v) => setConfig({ ...config, telemetryEnabled: v })}
-          label="Send anonymous usage stats to help improve Bulwark"
-          hint="Off by default. One anonymous heartbeat per day with version, platform, and which features are enabled - never email addresses, hostnames, or IPs. You can change this anytime in admin settings."
-        />
-      </div>
       <Footer>
         <SecondaryButton onClick={onBack}>Back</SecondaryButton>
         <PrimaryButton type="submit" disabled={submitting}>
@@ -1384,7 +1370,7 @@ function BrandingAsset({
       </div>
 
       {showUrlField && (
-        <div className="mt-3 ps-[4.75rem]">
+        <div className="mt-3 pl-[4.75rem]">
           <Input
             value={value}
             onChange={onChange}
@@ -1394,7 +1380,7 @@ function BrandingAsset({
       )}
 
       {uploadError && (
-        <p className="mt-2 ps-[4.75rem] text-xs text-destructive">{uploadError}</p>
+        <p className="mt-2 pl-[4.75rem] text-xs text-destructive">{uploadError}</p>
       )}
     </div>
   );
@@ -1494,7 +1480,6 @@ function ReviewStep({ config, onBack, onFinish }: { config: WizardConfig; onBack
                   : 'Off'
             }
           />
-          <SummaryRow label="Anonymous telemetry" value={config.telemetryEnabled ? 'On' : 'Off'} />
         </SummaryGroup>
 
         <SummaryGroup icon={<FileText className="w-4 h-4" />} title="Logging">
@@ -1601,7 +1586,7 @@ function SummaryRow({ label, value, mono }: { label: string; value: string; mono
   return (
     <div className="flex justify-between items-baseline gap-3 text-sm">
       <span className="text-muted-foreground shrink-0">{label}</span>
-      <span className={'text-foreground text-end truncate min-w-0 ' + (mono ? 'font-mono text-xs' : '')}>
+      <span className={'text-foreground text-right truncate min-w-0 ' + (mono ? 'font-mono text-xs' : '')}>
         {value || <span className="text-muted-foreground italic">-</span>}
       </span>
     </div>

app/(sandbox)/layout.tsx

@@ -1,14 +1,17 @@
 import type { Metadata } from 'next';
 import type { ReactNode } from 'react';
+import { Geist, Geist_Mono } from 'next/font/google';
+import '../globals.css';
 
-// The plugin sandbox iframe runs with an opaque origin (the `sandbox`
-// attribute in production excludes `allow-same-origin` for isolation). Any
-// asset request from this layout - bundled fonts, globals.css, etc. - is then
-// cross-origin from the "null" origin to the host origin and gets blocked
-// (fonts in particular require CORS). So this layout is intentionally minimal:
-// no font imports, no CSS imports. Plugins ship their own styles, and both the
-// plugin bundle and all host API calls travel over the postMessage RPC bridge,
-// so the sandbox never fetches same-origin assets itself.
+const geistSans = Geist({
+  variable: '--font-geist-sans',
+  subsets: ['latin'],
+});
+
+const geistMono = Geist_Mono({
+  variable: '--font-geist-mono',
+  subsets: ['latin'],
+});
 
 export const metadata: Metadata = {
   title: 'Plugin sandbox',
@@ -18,7 +21,10 @@ export const metadata: Metadata = {
 export default function PluginSandboxLayout({ children }: { children: ReactNode }) {
   return (
     <html lang="en">
-      <body style={{ margin: 0, padding: 0, background: 'transparent' }}>
+      <body
+        className={`${geistSans.variable} ${geistMono.variable} antialiased`}
+        style={{ margin: 0, padding: 0, background: 'transparent' }}
+      >
         {children}
       </body>
     </html>

app/(sandbox)/plugin-sandbox-privileged/page.tsx

@@ -1,15 +0,0 @@
-import { SandboxRuntime } from '@/lib/plugin-sandbox/runtime';
-
-// Privileged-tier sandbox route. Identical runtime to /plugin-sandbox, but the
-// host loads it into a same-origin (`allow-same-origin`) iframe so the bundle
-// gets real `crypto.subtle` + IndexedDB. The trust gate (signature + admin
-// approval) is enforced host-side before this route is ever framed; the page
-// itself carries no extra privilege.
-//
-// Must be dynamic so the per-request CSP nonce from proxy.ts is embedded in
-// Next's injected hydration/chunk scripts.
-export const dynamic = 'force-dynamic';
-
-export default function PrivilegedPluginSandboxPage() {
-  return <SandboxRuntime />;
-}

app/api/account/stalwart/jmap/route.ts

@@ -1,7 +1,6 @@
 import { NextRequest, NextResponse } from 'next/server';
 import { logger } from '@/lib/logger';
 import { getStalwartCredentials } from '@/lib/stalwart/credentials';
-import { JmapRedirectError, fetchJmapSession, postJmap, rebaseApiUrl } from '@/lib/stalwart/jmap-api';
 
 /**
  * POST /api/account/stalwart/jmap
@@ -24,26 +23,14 @@ export async function POST(request: NextRequest) {
 
     const body = await request.text();
 
-    const directUrl = `${creds.serverUrl}/jmap/`;
-    let response = await postJmap(directUrl, creds.authHeader, body);
-
-    if (response.status === 404) {
-      // `${serverUrl}/jmap/` is not the API endpoint on this deployment
-      // (path prefix, non-Stalwart URL layout). Resolve the session's
-      // advertised apiUrl on the same host and retry once.
-      const session = await fetchJmapSession(creds.serverUrl, creds.authHeader);
-      const apiUrl = rebaseApiUrl(session, creds.serverUrl);
-      if (apiUrl && apiUrl !== directUrl) {
-        response = await postJmap(apiUrl, creds.authHeader, body);
-      }
-    }
-
-    if (!response.ok) {
-      logger.warn('Stalwart JMAP passthrough upstream error', {
-        status: response.status,
-        serverUrl: creds.serverUrl,
-      });
-    }
+    const response = await fetch(`${creds.serverUrl}/jmap/`, {
+      method: 'POST',
+      headers: {
+        'Authorization': creds.authHeader,
+        'Content-Type': 'application/json',
+      },
+      body,
+    });
 
     const responseText = await response.text();
     return new NextResponse(responseText, {
@@ -51,10 +38,6 @@ export async function POST(request: NextRequest) {
       headers: { 'Content-Type': response.headers.get('Content-Type') || 'application/json' },
     });
   } catch (error) {
-    if (error instanceof JmapRedirectError) {
-      logger.error('Stalwart JMAP passthrough redirect error', { error: error.message });
-      return NextResponse.json({ error: error.message }, { status: 502 });
-    }
     logger.error('Stalwart JMAP passthrough error', {
       error: error instanceof Error ? error.message : 'Unknown',
     });

app/api/admin/branding/route.ts

@@ -3,13 +3,8 @@ import { requireAdminAuth, getClientIP } from '@/lib/admin/session';
 import { auditLog } from '@/lib/admin/audit';
 import { configManager } from '@/lib/admin/config-manager';
 import { getConfigDir } from '@/lib/admin/paths';
-import {
-  parseDomainBranding,
-  type DomainBrandingEntry,
-  type BrandingOverrideKey,
-} from '@/lib/admin/domain-branding';
 import { logger } from '@/lib/logger';
-import { writeFile, unlink, mkdir, readdir } from 'node:fs/promises';
+import { writeFile, unlink, mkdir } from 'node:fs/promises';
 import { existsSync } from 'node:fs';
 import path from 'node:path';
 
@@ -26,99 +21,27 @@ const ALLOWED_MIME_TYPES = new Set([
   'image/vnd.microsoft.icon',
 ]);
 
-type UploadSlot = BrandingOverrideKey;
-
 /** Slots that correspond to branding config keys */
-const VALID_SLOTS = new Set<UploadSlot>([
+const VALID_SLOTS = new Set([
   'faviconUrl',
   'pwaIconUrl',
   'appLogoLightUrl',
   'appLogoDarkUrl',
   'loginLogoLightUrl',
   'loginLogoDarkUrl',
-  'pwaScreenshotMobileUrl',
-  'pwaScreenshotDesktopUrl',
 ]);
 
-const EXT_BY_MIME: Record<string, string> = {
-  'image/svg+xml': '.svg',
-  'image/png': '.png',
-  'image/jpeg': '.jpg',
-  'image/webp': '.webp',
-  'image/x-icon': '.ico',
-  'image/vnd.microsoft.icon': '.ico',
-};
-
-const POSSIBLE_EXTS = ['.svg', '.png', '.jpg', '.jpeg', '.webp', '.ico'];
-
-// Exact hostnames only (no wildcards): wildcards can't be uploaded against
-// because we'd need a real subdomain to serve the file from.
-const EXACT_HOST_RE = /^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*$/;
-
 function sanitizeFilename(name: string): string {
   // Strip directory traversal, keep only safe chars
   return path.basename(name).replace(/[^a-zA-Z0-9._-]/g, '_');
 }
 
-function normalizeHost(raw: string): string {
-  return raw.trim().toLowerCase().replace(/\.+$/, '');
-}
-
-/** Filename used to store a per-host uploaded asset. */
-function domainAssetName(host: string, slot: BrandingOverrideKey, ext: string): string {
-  return sanitizeFilename(`domain__${host}__${slot}${ext}`);
-}
-
-/** True if the file belongs to the given host+slot (any extension). */
-function isDomainAssetFor(filename: string, host: string, slot: BrandingOverrideKey): boolean {
-  const prefix = sanitizeFilename(`domain__${host}__${slot}.`);
-  return filename.startsWith(prefix);
-}
-
-/** Merge a per-host update into the existing domainBranding array. */
-function mergeDomainEntry(
-  current: DomainBrandingEntry[],
-  host: string,
-  patch: Partial<DomainBrandingEntry>,
-): DomainBrandingEntry[] {
-  const next = current.slice();
-  const idx = next.findIndex(e => e.host === host);
-  if (idx === -1) {
-    next.push({ host, ...patch });
-  } else {
-    next[idx] = { ...next[idx], ...patch };
-  }
-  return next;
-}
-
-/** Remove keys from a host's entry. If the entry has nothing left besides
- *  `host`, drop it entirely. */
-function clearDomainKeys(
-  current: DomainBrandingEntry[],
-  host: string,
-  keys: BrandingOverrideKey[],
-): DomainBrandingEntry[] {
-  const idx = current.findIndex(e => e.host === host);
-  if (idx === -1) return current;
-  const entry = { ...current[idx] };
-  for (const key of keys) delete (entry as Record<string, unknown>)[key];
-  const next = current.slice();
-  if (Object.keys(entry).filter(k => k !== 'host').length === 0) {
-    next.splice(idx, 1);
-  } else {
-    next[idx] = entry;
-  }
-  return next;
-}
-
 /**
  * POST /api/admin/branding - Upload a branding image file
  *
  * Expects multipart/form-data with:
  *   - file: the image file
  *   - slot: which branding field this is for (e.g. "faviconUrl")
- *   - host (optional): when set, the upload is stored against the
- *     per-domain entry for that hostname instead of the global default.
  */
 export async function POST(request: NextRequest) {
   try {
@@ -129,24 +52,15 @@ export async function POST(request: NextRequest) {
     const formData = await request.formData();
     const file = formData.get('file') as File | null;
     const slot = formData.get('slot') as string | null;
-    const rawHost = (formData.get('host') as string | null) ?? '';
 
     if (!file || !slot) {
       return NextResponse.json({ error: 'Missing file or slot' }, { status: 400 });
     }
 
-    if (!VALID_SLOTS.has(slot as UploadSlot)) {
+    if (!VALID_SLOTS.has(slot)) {
       return NextResponse.json({ error: `Invalid slot: ${slot}` }, { status: 400 });
     }
 
-    const host = rawHost ? normalizeHost(rawHost) : '';
-    if (host && !EXACT_HOST_RE.test(host)) {
-      return NextResponse.json(
-        { error: `Invalid host: ${rawHost} (wildcards must be configured by URL, not upload)` },
-        { status: 400 },
-      );
-    }
-
     if (file.size > MAX_FILE_SIZE) {
       return NextResponse.json({ error: 'File too large (max 2 MB)' }, { status: 400 });
     }
@@ -158,51 +72,34 @@ export async function POST(request: NextRequest) {
       );
     }
 
-    const ext = EXT_BY_MIME[file.type] ?? '.png';
-    const safeName = host
-      ? domainAssetName(host, slot as BrandingOverrideKey, ext)
-      : sanitizeFilename(`${slot}${ext}`);
+    // Determine extension from mime type
+    const extMap: Record<string, string> = {
+      'image/svg+xml': '.svg',
+      'image/png': '.png',
+      'image/jpeg': '.jpg',
+      'image/webp': '.webp',
+      'image/x-icon': '.ico',
+      'image/vnd.microsoft.icon': '.ico',
+    };
+    const ext = extMap[file.type] || '.png';
+    const safeName = sanitizeFilename(`${slot}${ext}`);
     const filePath = path.join(getBrandingDir(), safeName);
 
+    // Ensure branding directory exists
     if (!existsSync(getBrandingDir())) {
       await mkdir(getBrandingDir(), { recursive: true });
     }
 
-    // Strip any prior asset for the same slot but a different extension so
-    // the directory doesn't accumulate orphan files on re-upload.
-    const dir = getBrandingDir();
-    const allFiles = await readdir(dir).catch(() => [] as string[]);
-    for (const f of allFiles) {
-      if (f === safeName) continue;
-      const isSame = host
-        ? isDomainAssetFor(f, host, slot as BrandingOverrideKey)
-        : POSSIBLE_EXTS.some(e => f === `${slot}${e}`);
-      if (isSame) {
-        try { await unlink(path.join(dir, f)); } catch { /* ignore */ }
-      }
-    }
-
+    // Write file to disk
     const buffer = Buffer.from(await file.arrayBuffer());
     await writeFile(filePath, buffer);
 
+    // Update config to point to the served URL
     const servedUrl = `/api/admin/branding/${safeName}`;
     await configManager.ensureLoaded();
+    await configManager.setAdminConfig({ [slot]: servedUrl });
 
-    if (host) {
-      const current = parseDomainBranding(configManager.get<unknown>('domainBranding', []));
-      const next = mergeDomainEntry(current, host, { [slot]: servedUrl });
-      await configManager.setAdminConfig({ domainBranding: next });
-    } else {
-      await configManager.setAdminConfig({ [slot]: servedUrl });
-    }
-
-    await auditLog('branding_upload', {
-      slot,
-      host: host || undefined,
-      filename: safeName,
-      size: file.size,
-      mimeType: file.type,
-    }, ip);
+    await auditLog('branding_upload', { slot, filename: safeName, size: file.size, mimeType: file.type }, ip);
 
     return NextResponse.json({ url: servedUrl, filename: safeName });
   } catch (error) {
@@ -214,11 +111,7 @@ export async function POST(request: NextRequest) {
 /**
  * DELETE /api/admin/branding - Remove an uploaded branding file
  *
- * Expects JSON body: { slot: string, host?: string }
- *
- * When `host` is provided, only the per-domain asset for that host+slot is
- * removed (and the override in `domainBranding[host][slot]` is cleared).
- * Otherwise the global asset and config override are removed.
+ * Expects JSON body: { slot: string }
  */
 export async function DELETE(request: NextRequest) {
   try {
@@ -226,48 +119,28 @@ export async function DELETE(request: NextRequest) {
     if ('error' in result) return result.error;
 
     const ip = getClientIP(request);
-    const body = await request.json().catch(() => ({})) as { slot?: string; host?: string };
-    const slot = body.slot;
-    const rawHost = body.host ?? '';
+    const { slot } = await request.json();
 
-    if (!slot || !VALID_SLOTS.has(slot as UploadSlot)) {
+    if (!slot || !VALID_SLOTS.has(slot)) {
       return NextResponse.json({ error: 'Invalid or missing slot' }, { status: 400 });
     }
 
-    const host = rawHost ? normalizeHost(rawHost) : '';
-    if (host && !EXACT_HOST_RE.test(host)) {
-      return NextResponse.json({ error: `Invalid host: ${rawHost}` }, { status: 400 });
-    }
-
-    const dir = getBrandingDir();
+    // Find and remove matching files for this slot
+    const possibleExts = ['.svg', '.png', '.jpg', '.webp', '.ico'];
     let removed = false;
-    if (host) {
-      const allFiles = await readdir(dir).catch(() => [] as string[]);
-      for (const f of allFiles) {
-        if (isDomainAssetFor(f, host, slot as BrandingOverrideKey)) {
-          try { await unlink(path.join(dir, f)); removed = true; } catch { /* ignore */ }
-        }
-      }
-    } else {
-      for (const ext of POSSIBLE_EXTS) {
-        const filePath = path.join(dir, `${slot}${ext}`);
-        if (existsSync(filePath)) {
-          await unlink(filePath);
-          removed = true;
-        }
+    for (const ext of possibleExts) {
+      const filePath = path.join(getBrandingDir(), `${slot}${ext}`);
+      if (existsSync(filePath)) {
+        await unlink(filePath);
+        removed = true;
       }
     }
 
+    // Clear the config override so it falls back to default/env
     await configManager.ensureLoaded();
-    if (host) {
-      const current = parseDomainBranding(configManager.get<unknown>('domainBranding', []));
-      const next = clearDomainKeys(current, host, [slot as BrandingOverrideKey]);
-      await configManager.setAdminConfig({ domainBranding: next });
-    } else {
-      await configManager.removeAdminOverride(slot);
-    }
+    await configManager.removeAdminOverride(slot);
 
-    await auditLog('branding_delete', { slot, host: host || undefined, fileRemoved: removed }, ip);
+    await auditLog('branding_delete', { slot, fileRemoved: removed }, ip);
 
     return NextResponse.json({ success: true });
   } catch (error) {

app/api/admin/config/route.ts

@@ -4,7 +4,6 @@ import { requireAdminAuth, getClientIP } from '@/lib/admin/session';
 import { auditLog } from '@/lib/admin/audit';
 import { CONFIG_ENV_MAP, SENSITIVE_CONFIG_KEYS } from '@/lib/admin/types';
 import { parseJmapServers } from '@/lib/admin/jmap-servers';
-import { parseDomainBranding } from '@/lib/admin/domain-branding';
 import { logger } from '@/lib/logger';
 
 // Strings that count as "no real secret configured" - used so the dashboard
@@ -89,25 +88,6 @@ export async function PATCH(request: NextRequest) {
       updates.jmapServers = sanitized;
     }
 
-    // Normalize domainBranding: drop entries with an invalid/missing host or
-    // duplicate hosts before persisting. Each entry's branding field strings
-    // are passed through unchanged (URL/string content is the operator's
-    // responsibility, same as the flat branding fields).
-    if ('domainBranding' in updates) {
-      const incoming = updates.domainBranding;
-      if (incoming != null && !Array.isArray(incoming)) {
-        return NextResponse.json({ error: 'domainBranding must be an array' }, { status: 400 });
-      }
-      const sanitized = parseDomainBranding(incoming);
-      const incomingCount = Array.isArray(incoming) ? incoming.length : 0;
-      if (sanitized.length !== incomingCount) {
-        return NextResponse.json({
-          error: 'One or more domainBranding entries are invalid (each needs a unique, valid host).',
-        }, { status: 400 });
-      }
-      updates.domainBranding = sanitized;
-    }
-
     // Get old values for audit
     const oldValues: Record<string, unknown> = {};
     for (const key of Object.keys(updates)) {

app/api/admin/marketplace/route.ts

@@ -19,7 +19,7 @@ import {
   invalidateFrameOriginsCache,
 } from '@/lib/admin/csp-frame-origins';
 import JSZip from 'jszip';
-import { MAX_PLUGIN_SIZE, MAX_THEME_SIZE, ALL_PERMISSIONS } from '@/lib/plugin-types';
+import { MAX_PLUGIN_SIZE, MAX_THEME_SIZE, ALL_PERMISSIONS, ALLOWED_PLUGIN_FILES } from '@/lib/plugin-types';
 import { sanitizeThemeCSS, validateThemeCSSSafety } from '@/lib/theme-loader';
 import { configManager } from '@/lib/admin/config-manager';
 
@@ -341,7 +341,6 @@ export async function POST(request: NextRequest) {
         author: (manifest.author as string) || 'Unknown',
         description: (manifest.description as string) || '',
         type: (manifest.type as string) || 'hook',
-        ...(manifest.tier === 'privileged' ? { tier: 'privileged' } : {}),
         permissions,
         entrypoint,
         enabled: existingPlugin?.enabled ?? true,

app/api/admin/plugins/route.ts

@@ -183,7 +183,6 @@ export async function POST(request: NextRequest) {
       author: manifest.author as string,
       description: (manifest.description as string) || '',
       type: manifest.type as string,
-      ...(manifest.tier === 'privileged' ? { tier: 'privileged' } : {}),
       permissions: (manifest.permissions as string[]) || [],
       entrypoint: manifest.entrypoint as string,
       enabled: true,
@@ -193,9 +192,6 @@ export async function POST(request: NextRequest) {
       ...(manifest.settingsSchema && typeof manifest.settingsSchema === 'object'
         ? { settingsSchema: manifest.settingsSchema as ServerPlugin['settingsSchema'] }
         : {}),
-      ...(manifest.locales && typeof manifest.locales === 'object'
-        ? { locales: manifest.locales as ServerPlugin['locales'] }
-        : {}),
       ...(declaredFrameOrigins.length > 0
         ? { frameOrigins: declaredFrameOrigins }
         : {}),

app/api/auth/oauth/metadata/route.ts

@@ -1,53 +0,0 @@
-import { NextRequest, NextResponse } from 'next/server';
-import { logger } from '@/lib/logger';
-import { configManager } from '@/lib/admin/config-manager';
-import { getMetadata, getRequiredConfig } from '@/lib/oauth/token-exchange';
-
-/**
- * Same-origin OAuth metadata (discovery) proxy.
- *
- * The login page needs the authorization_endpoint to build the PKCE authorize
- * URL in the browser. Discovering it directly from the browser means a
- * cross-origin fetch to the IdP's /.well-known/* documents, which is subject
- * to CORS: providers like Authentik serve those documents without an
- * Access-Control-Allow-Origin header, so the browser blocks the response and
- * discovery fails (issue #382). Performing discovery here - server to server,
- * where CORS does not apply - and handing the result back as a same-origin
- * response sidesteps the problem entirely.
- *
- * The discovery URL is resolved from admin config (via server_id), never from
- * client input, so this cannot be abused as an open SSRF proxy. Endpoint URLs
- * in the discovered document are still gated by the SSRF validator inside
- * discoverOAuth. The returned fields are public well-known metadata.
- */
-export async function GET(request: NextRequest) {
-  await configManager.ensureLoaded();
-  const serverId = request.nextUrl.searchParams.get('server_id');
-
-  let discoveryUrl: string;
-  try {
-    ({ discoveryUrl } = getRequiredConfig(serverId));
-  } catch {
-    // OAuth not configured for this server - surface as "no metadata" rather
-    // than a 500 so the login page just hides the SSO button.
-    return NextResponse.json({ error: 'OAuth not configured' }, { status: 404 });
-  }
-
-  try {
-    const metadata = await getMetadata(serverId);
-    if (!metadata?.authorization_endpoint || !metadata.token_endpoint) {
-      logger.warn('OAuth metadata discovery returned no usable endpoints', { discoveryUrl });
-      return NextResponse.json({ error: 'OAuth discovery failed' }, { status: 502 });
-    }
-    return NextResponse.json(metadata, {
-      // Mirror the in-process discovery cache TTL so repeated login-page loads
-      // hit the CDN/browser cache instead of re-running discovery.
-      headers: { 'Cache-Control': 'private, max-age=600' },
-    });
-  } catch (error) {
-    logger.error('OAuth metadata discovery error', {
-      error: error instanceof Error ? error.message : 'Unknown error',
-    });
-    return NextResponse.json({ error: 'OAuth discovery failed' }, { status: 502 });
-  }
-}

app/api/auth/pair/create/route.ts

@@ -1,96 +0,0 @@
-import { NextRequest, NextResponse } from 'next/server';
-import { cookies } from 'next/headers';
-import { logger } from '@/lib/logger';
-import { refreshTokenCookieName, refreshTokenServerCookieName } from '@/lib/oauth/tokens';
-import { buildOAuthParams, getRequiredConfig, getTokenEndpoint } from '@/lib/oauth/token-exchange';
-import { getCookieOptions } from '@/lib/oauth/cookie-config';
-import { createPairing } from '@/lib/auth/pairing-store';
-import { hasValidPairReauth } from '@/lib/auth/pair-reauth';
-import { MAX_ACCOUNT_SLOTS } from '@/lib/account-utils';
-
-// Desktop side of the cross-device QR login. The caller must be a signed-in
-// webmail session (its refresh token lives in the httpOnly jmap_rt cookie). We
-// refresh that token to (a) prove the session is live and (b) obtain a fresh
-// access token to hand the phone, then stash the bundle under a one-time
-// pairing code. The desktop renders the returned code as a QR; the phone
-// redeems it at /api/auth/pair/redeem.
-//
-// Token sharing note: the phone receives the SAME refresh token as the desktop.
-// That is correct for OAuth servers (such as Stalwart in its default config)
-// that do not rotate refresh tokens on use. If the server rotates refresh
-// tokens, the two devices would fight over the latest token — such deployments
-// should disable rotation for this client or use a token-exchange grant.
-export async function POST(request: NextRequest) {
-  const cookieStore = await cookies();
-  try {
-    // Step-up gate: minting a pairing code grants new-device access, so it
-    // requires a recent fresh IdP re-authentication (see the reauth SSO flow).
-    // The client turns this 401 into a re-auth redirect, then retries.
-    if (!(await hasValidPairReauth())) {
-      return NextResponse.json({ error: 'reauth_required' }, { status: 401 });
-    }
-
-    const body = await request.json().catch(() => ({}));
-    const slot =
-      typeof body.slot === 'number' && body.slot >= 0 && body.slot < MAX_ACCOUNT_SLOTS
-        ? body.slot
-        : 0;
-
-    const cookieName = refreshTokenCookieName(slot);
-    const refreshToken = cookieStore.get(cookieName)?.value;
-    if (!refreshToken) {
-      return NextResponse.json({ error: 'Not signed in' }, { status: 401 });
-    }
-    const serverId = cookieStore.get(refreshTokenServerCookieName(slot))?.value || null;
-
-    const tokenEndpoint = await getTokenEndpoint(serverId);
-    const params = buildOAuthParams({ grant_type: 'refresh_token', refresh_token: refreshToken }, serverId);
-
-    const tokenResponse = await fetch(tokenEndpoint, {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
-      body: params.toString(),
-    });
-
-    if (!tokenResponse.ok) {
-      const errorText = await tokenResponse.text();
-      logger.warn('Pair create: refresh failed', { status: tokenResponse.status, error: errorText });
-      // Stale session — clear the dead cookie so the user is prompted to log
-      // back in, mirroring the token route's behaviour.
-      cookieStore.delete(cookieName);
-      cookieStore.delete(refreshTokenServerCookieName(slot));
-      return NextResponse.json({ error: 'Session expired' }, { status: 401 });
-    }
-
-    const tokens = await tokenResponse.json();
-    if (!tokens.access_token) {
-      logger.error('Pair create: refresh response missing access_token');
-      return NextResponse.json({ error: 'Invalid token response' }, { status: 502 });
-    }
-
-    // If the server rotated the refresh token, persist the new one back to the
-    // desktop's cookie so this very session keeps working. The phone will get
-    // the same (new) token below.
-    const effectiveRefreshToken = tokens.refresh_token || refreshToken;
-    if (tokens.refresh_token) {
-      cookieStore.set(cookieName, tokens.refresh_token, getCookieOptions());
-    }
-
-    const { clientId, serverUrl } = getRequiredConfig(serverId);
-
-    const { code, expiresIn } = createPairing({
-      accessToken: tokens.access_token,
-      refreshToken: effectiveRefreshToken,
-      expiresIn: tokens.expires_in,
-      tokenEndpoint,
-      clientId,
-      serverUrl,
-      serverId,
-    });
-
-    return NextResponse.json({ pairing_code: code, server_url: serverUrl, expires_in: expiresIn });
-  } catch (error) {
-    logger.error('Pair create error', { error: error instanceof Error ? error.message : 'Unknown error' });
-    return NextResponse.json({ error: 'Internal server error' }, { status: 500 });
-  }
-}

app/api/auth/pair/redeem/route.ts

@@ -1,36 +0,0 @@
-import { NextRequest, NextResponse } from 'next/server';
-import { logger } from '@/lib/logger';
-import { consumePairing } from '@/lib/auth/pairing-store';
-
-// Phone side of the cross-device QR login. The app POSTs the pairing code it
-// scanned; we hand back the OAuth token bundle the desktop stashed at
-// /api/auth/pair/create. The code is the only credential required — it is
-// high-entropy, single-use, and expires within ~2 minutes — so this route is
-// intentionally unauthenticated (the scanning device has no webmail cookies).
-export async function POST(request: NextRequest) {
-  try {
-    const { pairing_code: pairingCode } = await request.json().catch(() => ({}));
-    if (!pairingCode || typeof pairingCode !== 'string') {
-      return NextResponse.json({ error: 'Missing pairing code' }, { status: 400 });
-    }
-
-    const tokens = consumePairing(pairingCode);
-    if (!tokens) {
-      // Unknown, expired, or already redeemed — do not distinguish.
-      return NextResponse.json({ error: 'Invalid or expired pairing code' }, { status: 400 });
-    }
-
-    return NextResponse.json({
-      flow: 'oauth',
-      server_url: tokens.serverUrl,
-      access_token: tokens.accessToken,
-      ...(tokens.refreshToken ? { refresh_token: tokens.refreshToken } : {}),
-      ...(typeof tokens.expiresIn === 'number' ? { expires_in: tokens.expiresIn } : {}),
-      token_endpoint: tokens.tokenEndpoint,
-      client_id: tokens.clientId,
-    });
-  } catch (error) {
-    logger.error('Pair redeem error', { error: error instanceof Error ? error.message : 'Unknown error' });
-    return NextResponse.json({ error: 'Internal server error' }, { status: 500 });
-  }
-}

app/api/auth/reauth/sso/complete/route.ts

@@ -1,70 +0,0 @@
-import { NextRequest, NextResponse } from 'next/server';
-import { cookies } from 'next/headers';
-import { logger } from '@/lib/logger';
-import { decryptPayload } from '@/lib/auth/crypto';
-import { exchangeCodeForTokens } from '@/lib/oauth/token-exchange';
-import { setPairReauth } from '@/lib/auth/pair-reauth';
-
-// Completes the step-up re-authentication for device pairing. The user was sent
-// to the IdP with prompt=login (see /api/auth/sso/start with purpose=reauth);
-// here we verify the returned code against the pending state and exchange it to
-// confirm a fresh login actually happened, then set the short-lived pairing
-// re-auth proof cookie. We deliberately do NOT issue a login session or write
-// any refresh-token cookies — the user is already signed in; this only proves
-// recency for the pairing action.
-
-const SSO_PENDING_COOKIE = 'sso_pending';
-const SSO_PENDING_MAX_AGE_MS = 5 * 60 * 1000;
-
-export async function POST(request: NextRequest) {
-  const cookieStore = await cookies();
-  try {
-    const { code, state } = await request.json();
-    if (!code || !state) {
-      return NextResponse.json({ error: 'Missing code or state' }, { status: 400 });
-    }
-
-    const pendingCookie = cookieStore.get(SSO_PENDING_COOKIE)?.value;
-    if (!pendingCookie) {
-      return NextResponse.json({ error: 'No pending re-auth session' }, { status: 400 });
-    }
-
-    const pending = decryptPayload(pendingCookie);
-    cookieStore.delete(SSO_PENDING_COOKIE);
-    if (!pending) {
-      return NextResponse.json({ error: 'Invalid re-auth session' }, { status: 400 });
-    }
-
-    // Only honor pending sessions that were started for the reauth purpose, so
-    // a normal login code can't be redirected into setting a pairing proof.
-    if (pending.purpose !== 'reauth') {
-      return NextResponse.json({ error: 'Not a re-auth session' }, { status: 400 });
-    }
-    if (pending.state !== state) {
-      return NextResponse.json({ error: 'State mismatch' }, { status: 400 });
-    }
-    const createdAt = pending.created_at as number;
-    if (!createdAt || Date.now() - createdAt > SSO_PENDING_MAX_AGE_MS) {
-      return NextResponse.json({ error: 'Re-auth session expired' }, { status: 400 });
-    }
-
-    const codeVerifier = pending.code_verifier as string;
-    const redirectUri = pending.redirect_uri as string;
-    const pendingServerId = typeof pending.server_id === 'string' ? pending.server_id : null;
-    if (!codeVerifier || !redirectUri) {
-      return NextResponse.json({ error: 'Invalid re-auth session data' }, { status: 400 });
-    }
-
-    // A successful exchange proves the user just authenticated at the IdP (the
-    // freshness is enforced by prompt=login on the authorize request). We don't
-    // keep the resulting tokens.
-    await exchangeCodeForTokens(code, codeVerifier, redirectUri, pendingServerId);
-
-    await setPairReauth();
-    return NextResponse.json({ ok: true });
-  } catch (error) {
-    cookieStore.delete(SSO_PENDING_COOKIE);
-    logger.error('Reauth complete error', { error: error instanceof Error ? error.message : 'Unknown error' });
-    return NextResponse.json({ error: 'Re-authentication failed' }, { status: 401 });
-  }
-}

app/api/auth/sso/start/route.ts

@@ -8,7 +8,6 @@ import { discoverOAuth } from '@/lib/oauth/discovery';
 import { getOauthScopes } from '@/lib/oauth/tokens';
 import { getCookieOptions } from '@/lib/oauth/cookie-config';
 import { hasSessionSecret } from '@/lib/auth/session-secret';
-import { configManager } from '@/lib/admin/config-manager';
 
 const SSO_PENDING_COOKIE = 'sso_pending';
 const SSO_PENDING_MAX_AGE = 300; // 5 minutes
@@ -31,14 +30,8 @@ export async function POST(request: NextRequest) {
       server_id: bodyServerId,
       mobile_redirect_uri: rawMobileRedirectUri,
       mobile_state: rawMobileState,
-      purpose: rawPurpose,
     } = await request.json();
 
-    // `reauth` drives the step-up flow for device pairing: it forces a fresh
-    // IdP login (prompt=login) and the /reauth/sso/complete handler sets the
-    // short-lived pairing re-auth proof instead of logging the user in again.
-    const isReauth = rawPurpose === 'reauth';
-
     if (!redirect_uri || typeof redirect_uri !== 'string') {
       return NextResponse.json({ error: 'Missing redirect_uri' }, { status: 400 });
     }
@@ -92,7 +85,6 @@ export async function POST(request: NextRequest) {
       ...(serverId ? { server_id: serverId } : {}),
       ...(mobileRedirectUri ? { mobile_redirect_uri: mobileRedirectUri } : {}),
       ...(mobileState ? { mobile_state: mobileState } : {}),
-      ...(isReauth ? { purpose: 'reauth' } : {}),
     };
 
     const encrypted = encryptPayload(pendingData);
@@ -103,12 +95,8 @@ export async function POST(request: NextRequest) {
       maxAge: SSO_PENDING_MAX_AGE,
     });
 
-    // Build authorize URL. OAUTH_AUTHORIZE_URL, when set, overrides only the
-    // user-facing authorize endpoint (e.g. a per-brand login host). Discovery,
-    // token exchange and refresh keep using the canonical discovered endpoints.
-    const authorizeOverride =
-      configManager.get<string>('oauthAuthorizeUrl', '') || process.env.OAUTH_AUTHORIZE_URL;
-    const authUrl = new URL(authorizeOverride?.trim() || metadata.authorization_endpoint);
+    // Build authorize URL
+    const authUrl = new URL(metadata.authorization_endpoint);
     authUrl.searchParams.set('response_type', 'code');
     authUrl.searchParams.set('client_id', clientId);
     authUrl.searchParams.set('redirect_uri', redirect_uri);
@@ -121,14 +109,6 @@ export async function POST(request: NextRequest) {
       authUrl.searchParams.set('ui_locales', locale);
     }
 
-    // Force a fresh credential entry for step-up re-auth. prompt=login and
-    // max_age=0 both ask the IdP to re-authenticate even if it has an active
-    // session; honoring them depends on the IdP supporting these OIDC params.
-    if (isReauth) {
-      authUrl.searchParams.set('prompt', 'login');
-      authUrl.searchParams.set('max_age', '0');
-    }
-
     return NextResponse.json({
       authorize_url: authUrl.toString(),
       state,

app/api/auth/token/route.ts

@@ -82,16 +82,9 @@ export async function PUT(request: NextRequest) {
     if (!tokenResponse.ok) {
       const errorText = await tokenResponse.text();
       logger.error('Token refresh failed', { status: tokenResponse.status, error: errorText });
-      // Drop the refresh token only when the server definitively rejected it
-      // (invalid/expired/revoked grant). A 5xx or 429 is an outage - keeping
-      // the cookie lets the session resume once the server is back.
-      const status = tokenResponse.status;
-      if (status === 400 || status === 401 || status === 403) {
-        cookieStore.delete(cookieName);
-        cookieStore.delete(refreshTokenServerCookieName(slot));
-        return NextResponse.json({ error: 'Refresh failed' }, { status: 401 });
-      }
-      return NextResponse.json({ error: 'Token endpoint unavailable' }, { status: 503 });
+      cookieStore.delete(cookieName);
+      cookieStore.delete(refreshTokenServerCookieName(slot));
+      return NextResponse.json({ error: 'Refresh failed' }, { status: 401 });
     }
 
     const tokens = await tokenResponse.json();

app/api/auth/totp-token-exchange/route.ts

@@ -1,6 +1,8 @@
 import { NextRequest, NextResponse } from 'next/server';
 import { cookies } from 'next/headers';
 import { logger } from '@/lib/logger';
+import { discoverOAuth } from '@/lib/oauth/discovery';
+import { getDiscoveryValidator } from '@/lib/oauth/token-exchange';
 import { refreshTokenCookieName, refreshTokenServerCookieName } from '@/lib/oauth/tokens';
 import { getCookieOptions } from '@/lib/oauth/cookie-config';
 import { readFileEnv } from '@/lib/read-file-env';
@@ -9,173 +11,81 @@ import { isPublicHttpUrl } from '@/lib/security/url-guard';
 import { recordLogin } from '@/lib/telemetry/login-tracker';
 import { parseJmapServers, findServerByUrl, findServerById } from '@/lib/admin/jmap-servers';
 import { MAX_ACCOUNT_SLOTS } from '@/lib/account-utils';
-import { generateCodeVerifier, generateCodeChallenge } from '@/lib/oauth/pkce';
 
 /**
- * Exchange a password + (optional) TOTP code for OAuth tokens.
+ * Exchange basic auth credentials (with TOTP appended) for OAuth tokens.
  *
- * Stalwart 0.16+ no longer accepts the legacy `password$totp` convention over
- * HTTP Basic auth: its Basic decoder hardcodes `mfa_token: None` and never
- * splits the secret on `$`, so any TOTP appended to the password is verified
- * verbatim against the password hash and fails. The MFA token must instead be
- * supplied as a distinct field through the structured login endpoint.
+ * This allows 2FA users who log in with basic auth + TOTP to upgrade
+ * to token-based auth, avoiding session expiry when the TOTP rotates.
  *
- * This route drives that flow server-side (avoiding browser CORS against the
- * mail server, same as OAuth discovery):
- *   1. POST {serverUrl}/api/auth  -> authenticate with a separate `mfaToken`,
- *      receiving a short-lived authorization `clientCode`.
- *   2. POST {serverUrl}/auth/token (grant_type=authorization_code) -> exchange
- *      the code (with PKCE) for access/refresh tokens.
- *
- * Token-based auth also survives TOTP rotation, unlike basic auth which embeds
- * the (≈30s) code in every request.
+ * Tries three strategies:
+ * 1. ROPC grant with client_id (if OAUTH_CLIENT_ID is set)
+ * 2. ROPC grant without client_id
+ * 3. ROPC grant authenticated via Basic Auth header (Stalwart-style)
  */
 
-// Fallback OAuth client id used when no client is configured. Stalwart accepts
-// any client id unless `require_client_registration` is enabled (default off);
-// when it is enabled the admin must configure `oauthClientId` with this
-// redirect URI registered.
-const DEFAULT_CLIENT_ID = 'bulwark-webmail';
-
-interface LoginResult {
-  type?: string;
-  // The response keeps snake_case: only the LoginResponse variant *tags* are
-  // camelCased server-side, not the struct fields (the request fields are).
-  client_code?: string;
-}
-
-function trimUrl(url: string): string {
-  return url.replace(/\/+$/, '');
-}
-
-async function attemptLogin(
-  upstreamUrl: string,
-  username: string,
-  password: string,
-  totp: string | undefined,
-  redirectUri: string,
-  slot: number,
-  serverId: string | null,
-): Promise<NextResponse> {
-  const base = trimUrl(upstreamUrl);
-
-  // Per-server OAuth credentials override the global ones when the requested
-  // server entry has its own oauth block configured.
-  const serverList = parseJmapServers(configManager.get<unknown>('jmapServers', []));
-  const entry = findServerById(serverList, serverId);
-  const clientId = entry?.oauth?.clientId
-    || configManager.get<string>('oauthClientId', '')
-    || process.env.OAUTH_CLIENT_ID
-    || DEFAULT_CLIENT_ID;
-  const clientSecret = entry?.oauth?.clientSecret
-    || configManager.get<string>('oauthClientSecret', '')
-    || process.env.OAUTH_CLIENT_SECRET
-    || readFileEnv(process.env.OAUTH_CLIENT_SECRET_FILE)
-    || '';
-
-  // PKCE proves the token exchange originates from the same client that
-  // initiated the login, so no client secret is required for public clients.
-  const verifier = generateCodeVerifier();
-  const challenge = await generateCodeChallenge(verifier);
-
-  // Step 1: structured login with a separate MFA token.
-  let login: LoginResult;
+async function tryTokenRequest(
+  tokenEndpoint: string,
+  params: URLSearchParams,
+  extraHeaders?: Record<string, string>,
+): Promise<{ ok: true; tokens: { access_token: string; expires_in?: number; refresh_token?: string } } | { ok: false; status: number; error: string }> {
   try {
-    const loginResponse = await fetch(`${base}/api/auth`, {
+    const headers: Record<string, string> = { 'Content-Type': 'application/x-www-form-urlencoded', ...extraHeaders };
+    const response = await fetch(tokenEndpoint, {
       method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({
-        type: 'authCode',
-        accountName: username,
-        accountSecret: password,
-        ...(totp ? { mfaToken: totp } : {}),
-        clientId,
-        redirectUri,
-        codeChallenge: challenge,
-        codeChallengeMethod: 'S256',
-      }),
+      headers,
+      body: params.toString(),
     });
 
-    if (!loginResponse.ok) {
-      const detail = (await loginResponse.text()).substring(0, 500);
-      logger.warn('TOTP login: /api/auth rejected request', { status: loginResponse.status });
-      // A 404 means the server predates the structured login endpoint; let the
-      // caller fall back to the legacy basic-auth path.
-      return NextResponse.json(
-        { error: loginResponse.status === 404 ? 'login_endpoint_missing' : 'login_failed', detail },
-        { status: loginResponse.status === 404 ? 404 : 502 },
-      );
+    if (!response.ok) {
+      const errorText = await response.text();
+      return { ok: false, status: response.status, error: errorText.substring(0, 500) };
     }
 
-    login = await loginResponse.json();
-  } catch (err) {
-    logger.warn('TOTP login: /api/auth request failed', { error: err instanceof Error ? err.message : String(err) });
-    return NextResponse.json({ error: 'login_unreachable' }, { status: 502 });
-  }
-
-  switch (login.type) {
-    case 'authenticated':
-      break;
-    case 'mfaRequired':
-      return NextResponse.json({ error: 'totp_required' }, { status: 401 });
-    case 'failure':
-    default:
-      return NextResponse.json({ error: 'invalid_credentials' }, { status: 401 });
-  }
-
-  if (!login.client_code) {
-    logger.warn('TOTP login: authenticated response missing client_code');
-    return NextResponse.json({ error: 'login_failed' }, { status: 502 });
-  }
-
-  // Step 2: exchange the authorization code for tokens.
-  const tokenParams = new URLSearchParams({
-    grant_type: 'authorization_code',
-    code: login.client_code,
-    client_id: clientId,
-    redirect_uri: redirectUri,
-    code_verifier: verifier,
-  });
-  // Confidential clients still send their secret; harmless for public clients.
-  if (clientSecret) tokenParams.set('client_secret', clientSecret);
-
-  let tokens: { access_token?: string; expires_in?: number; refresh_token?: string };
-  try {
-    const tokenResponse = await fetch(`${base}/auth/token`, {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
-      body: tokenParams.toString(),
-    });
-
-    if (!tokenResponse.ok) {
-      const detail = (await tokenResponse.text()).substring(0, 500);
-      logger.warn('TOTP login: token exchange failed', { status: tokenResponse.status, detail });
-      return NextResponse.json({ error: 'token_exchange_failed', detail }, { status: 502 });
+    const tokens = await response.json();
+    if (!tokens.access_token) {
+      return { ok: false, status: 502, error: 'Response missing access_token' };
     }
 
-    tokens = await tokenResponse.json();
+    return { ok: true, tokens };
   } catch (err) {
-    logger.warn('TOTP login: token endpoint failed', { error: err instanceof Error ? err.message : String(err) });
-    return NextResponse.json({ error: 'token_exchange_failed' }, { status: 502 });
+    return { ok: false, status: 0, error: err instanceof Error ? err.message : String(err) };
+  }
+}
+
+async function findTokenEndpoint(serverUrl: string, adminTrusted: boolean): Promise<string | null> {
+  // Admin-trusted callers (matched server entry or configured JMAP server URL)
+  // honor the `oauthAllowPrivateEndpoints` opt-in. User-supplied URLs always
+  // go through the SSRF validator regardless of the setting.
+  const validateEndpoint = adminTrusted ? getDiscoveryValidator() : isPublicHttpUrl;
+  // 1. Try OAuth discovery
+  const metadata = await discoverOAuth(serverUrl, { validateEndpoint });
+  if (metadata?.token_endpoint) return metadata.token_endpoint;
+
+  // 2. Try common Stalwart token endpoint paths directly
+  const candidates = [
+    `${serverUrl}/auth/token`,
+    `${serverUrl}/api/oauth/token`,
+  ];
+
+  for (const url of candidates) {
+    try {
+      // A POST with no body should return 400 (bad request) rather than 404 if the endpoint exists
+      const probe = await fetch(url, { method: 'POST', headers: { 'Content-Type': 'application/x-www-form-urlencoded' }, body: 'grant_type=probe' });
+      if (probe.status !== 404 && probe.status !== 405) {
+        return url;
+      }
+    } catch {
+      // Network error - endpoint not reachable
+    }
   }
 
-  if (!tokens.access_token) {
-    return NextResponse.json({ error: 'token_exchange_failed', detail: 'Response missing access_token' }, { status: 502 });
-  }
-
-  logger.info('TOTP login succeeded');
-  void recordLogin(username, base);
-  return await storeAndRespond(
-    { access_token: tokens.access_token, expires_in: tokens.expires_in, refresh_token: tokens.refresh_token },
-    slot,
-    serverId,
-  );
+  return null;
 }
 
 export async function POST(request: NextRequest) {
   try {
-    const { serverUrl, username, password, totp, slot: bodySlot, server_id: bodyServerId, redirectUri: bodyRedirectUri } =
-      await request.json();
+    const { serverUrl, username, password, slot: bodySlot, server_id: bodyServerId } = await request.json();
 
     if (!serverUrl || !username || !password) {
       return NextResponse.json({ error: 'Missing required parameters' }, { status: 400 });
@@ -183,7 +93,6 @@ export async function POST(request: NextRequest) {
 
     const slot = typeof bodySlot === 'number' && bodySlot >= 0 && bodySlot < MAX_ACCOUNT_SLOTS ? bodySlot : 0;
     const requestedServerId = typeof bodyServerId === 'string' && bodyServerId ? bodyServerId : null;
-    const totpCode = typeof totp === 'string' && totp ? totp : undefined;
 
     // Pin the upstream URL to a configured JMAP server. The list of allowed
     // servers is `jmapServerUrl` plus any entry from `jmapServers`. Only when
@@ -201,17 +110,20 @@ export async function POST(request: NextRequest) {
 
     let upstreamUrl: string;
     let resolvedServerId: string | null = null;
+    let adminTrusted = false;
     const requestedEntry = findServerById(serverList, requestedServerId);
     const matchedEntry = requestedEntry || findServerByUrl(serverList, serverUrl);
 
     if (matchedEntry) {
       upstreamUrl = matchedEntry.url;
       resolvedServerId = matchedEntry.id;
+      adminTrusted = true;
     } else if (configuredServerUrl) {
       upstreamUrl = configuredServerUrl;
+      adminTrusted = true;
     } else if (allowCustomEndpoint) {
       if (!(await isPublicHttpUrl(serverUrl))) {
-        logger.warn('TOTP login: rejected non-public server URL');
+        logger.warn('TOTP token exchange: rejected non-public server URL');
         return NextResponse.json({ error: 'invalid_server_url' }, { status: 400 });
       }
       upstreamUrl = serverUrl;
@@ -219,22 +131,100 @@ export async function POST(request: NextRequest) {
       return NextResponse.json({ error: 'jmap_server_not_configured' }, { status: 500 });
     }
 
-    // The redirect URI must be identical in the login and token-exchange steps,
-    // and (when require_client_registration is on) registered for the client.
-    // Prefer the browser-supplied callback URL the OAuth client already uses;
-    // fall back to the upstream URL so the two steps still agree.
-    const redirectUri =
-      typeof bodyRedirectUri === 'string' && /^https?:\/\//.test(bodyRedirectUri)
-        ? bodyRedirectUri
-        : trimUrl(upstreamUrl);
+    const tokenEndpoint = await findTokenEndpoint(upstreamUrl, adminTrusted);
+    if (!tokenEndpoint) {
+      logger.warn('TOTP token exchange: no token endpoint found');
+      return NextResponse.json({ error: 'no_token_endpoint', detail: 'Could not discover OAuth token endpoint on the mail server' }, { status: 404 });
+    }
 
-    return await attemptLogin(upstreamUrl, username, password, totpCode, redirectUri, slot, resolvedServerId);
+    return await attemptAllStrategies(tokenEndpoint, upstreamUrl, username, password, slot, resolvedServerId);
   } catch (error) {
-    logger.error('TOTP login error', { error: error instanceof Error ? error.message : 'Unknown error' });
+    logger.error('TOTP token exchange error', { error: error instanceof Error ? error.message : 'Unknown error' });
     return NextResponse.json({ error: 'Internal server error' }, { status: 500 });
   }
 }
 
+async function attemptAllStrategies(
+  tokenEndpoint: string,
+  serverUrl: string,
+  username: string,
+  password: string,
+  slot: number,
+  serverId: string | null,
+): Promise<NextResponse> {
+  logger.info('TOTP token exchange: found token endpoint', { tokenEndpoint });
+
+  // Per-server OAuth credentials override the global ones when the requested
+  // server entry has its own oauth block configured.
+  const serverList = parseJmapServers(configManager.get<unknown>('jmapServers', []));
+  const entry = findServerById(serverList, serverId);
+  const clientId = entry?.oauth?.clientId
+    || configManager.get<string>('oauthClientId', '')
+    || process.env.OAUTH_CLIENT_ID;
+  const clientSecret = entry?.oauth?.clientSecret
+    || configManager.get<string>('oauthClientSecret', '')
+    || process.env.OAUTH_CLIENT_SECRET
+    || readFileEnv(process.env.OAUTH_CLIENT_SECRET_FILE);
+  const basicAuth = `Basic ${Buffer.from(`${username}:${password}`).toString('base64')}`;
+  const attempts: Array<{ strategy: string; error: string }> = [];
+
+  // Strategy 1: ROPC with client_id (if configured)
+  if (clientId) {
+    const params = new URLSearchParams({ grant_type: 'password', username, password, client_id: clientId });
+    if (clientSecret) params.set('client_secret', clientSecret);
+    const result = await tryTokenRequest(tokenEndpoint, params);
+    if (result.ok) {
+      logger.info('TOTP token exchange succeeded (ROPC with client_id)');
+      void recordLogin(username, serverUrl);
+      return await storeAndRespond(result.tokens, slot, serverId);
+    }
+    attempts.push({ strategy: 'ROPC with client_id', error: result.error });
+  }
+
+  // Strategy 2: ROPC without client_id
+  {
+    const params = new URLSearchParams({ grant_type: 'password', username, password });
+    const result = await tryTokenRequest(tokenEndpoint, params);
+    if (result.ok) {
+      logger.info('TOTP token exchange succeeded (ROPC without client_id)');
+      void recordLogin(username, serverUrl);
+      return await storeAndRespond(result.tokens, slot, serverId);
+    }
+    attempts.push({ strategy: 'ROPC without client_id', error: result.error });
+  }
+
+  // Strategy 3: Basic Auth header on token endpoint (some servers accept this)
+  {
+    const params = new URLSearchParams({ grant_type: 'password' });
+    const result = await tryTokenRequest(tokenEndpoint, params, { 'Authorization': basicAuth });
+    if (result.ok) {
+      logger.info('TOTP token exchange succeeded (Basic Auth header)');
+      void recordLogin(username, serverUrl);
+      return await storeAndRespond(result.tokens, slot, serverId);
+    }
+    attempts.push({ strategy: 'Basic Auth header', error: result.error });
+  }
+
+  // Strategy 4: client_credentials with Basic Auth (last resort)
+  {
+    const params = new URLSearchParams({ grant_type: 'client_credentials' });
+    const result = await tryTokenRequest(tokenEndpoint, params, { 'Authorization': basicAuth });
+    if (result.ok) {
+      logger.info('TOTP token exchange succeeded (client_credentials + Basic Auth)');
+      void recordLogin(username, serverUrl);
+      return await storeAndRespond(result.tokens, slot, serverId);
+    }
+    attempts.push({ strategy: 'client_credentials + Basic Auth', error: result.error });
+  }
+
+  logger.warn('TOTP token exchange: all strategies failed', { attempts });
+  return NextResponse.json({
+    error: 'token_exchange_failed',
+    detail: 'All token exchange strategies failed',
+    attempts,
+  }, { status: 502 });
+}
+
 async function storeAndRespond(
   tokens: { access_token: string; expires_in?: number; refresh_token?: string },
   slot: number,

app/api/calendar-agenda/route.ts

@@ -1,296 +0,0 @@
-import { NextRequest, NextResponse } from 'next/server';
-import { logger } from '@/lib/logger';
-import { getStalwartCredentials } from '@/lib/stalwart/credentials';
-import { fetchJmapSession, postJmap, rebaseApiUrl } from '@/lib/stalwart/jmap-api';
-import { normalizeCalendarEventLike } from '@/lib/calendar-event-normalization';
-import { expandRecurringEvents } from '@/lib/recurrence-expansion';
-import { parseISO } from 'date-fns';
-import type { CalendarEvent } from '@/lib/jmap/types';
-
-/**
- * POST /api/calendar-agenda
- *
- * Sidecar for the "Calendar Agenda" plugin. Resolves the caller's calendar
- * account from the stored Stalwart auth context, queries upcoming
- * CalendarEvents over JMAP, expands recurring series server-side, and returns
- * a slim, structured-cloneable agenda the plugin can render directly.
- *
- * Credentials never leave the server — the sandboxed plugin only ever sees
- * the resulting agenda DTOs.
- *
- * Body: { days?: number (1-90, default 7), limit?: number (1-200, default 50) }
- */
-
-const CALENDAR_CAP = 'urn:ietf:params:jmap:calendars';
-const PRINCIPALS_CAP = 'urn:ietf:params:jmap:principals';
-
-// Mirror of lib/jmap/client.ts CALENDAR_EVENT_PROPERTIES, trimmed to what the
-// agenda actually needs (start/recurrence/display fields).
-const EVENT_PROPERTIES = [
-  'id', '@type', 'uid', 'calendarIds', 'title', 'start', 'duration', 'timeZone',
-  'showWithoutTime', 'utcStart', 'utcEnd', 'status', 'freeBusyStatus', 'color',
-  'locations', 'recurrenceId', 'recurrenceIdTimeZone', 'recurrenceRule',
-  'recurrenceOverrides', 'excludedRecurrenceRule',
-] as const;
-
-interface AgendaEvent {
-  id: string;
-  uid: string | null;
-  title: string;
-  start: string;
-  end: string;
-  allDay: boolean;
-  status: string | null;
-  color: string | null;
-  location: string | null;
-  calendarId: string | null;
-}
-
-// Pure, server-safe equivalents of lib/calendar-utils' getEventStartDate /
-// getEventEndDate. We can't import that module here because it transitively
-// pulls in a "use client" calendar component (which throws at load on the
-// server). Logic mirrors the originals.
-function parseDurationMinutes(duration: string | undefined): number {
-  if (!duration) return 0;
-  let total = 0;
-  const week = duration.match(/(\d+)W/);
-  const day = duration.match(/(\d+)D/);
-  const hour = duration.match(/(\d+)H/);
-  const min = duration.match(/(\d+)M/);
-  if (week) total += parseInt(week[1], 10) * 7 * 24 * 60;
-  if (day) total += parseInt(day[1], 10) * 24 * 60;
-  if (hour) total += parseInt(hour[1], 10) * 60;
-  if (min) total += parseInt(min[1], 10);
-  return total;
-}
-
-function eventStart(event: Partial<CalendarEvent>): Date {
-  if (!event.showWithoutTime && event.utcStart) {
-    const utc = parseISO(event.utcStart);
-    if (!isNaN(utc.getTime())) return utc;
-  }
-  return parseISO(event.start as string);
-}
-
-function eventEnd(event: Partial<CalendarEvent>): Date {
-  if (!event.showWithoutTime && event.utcEnd) {
-    const utc = parseISO(event.utcEnd);
-    if (!isNaN(utc.getTime())) return utc;
-  }
-  const start = eventStart(event);
-  if (!event.duration) return start;
-  return new Date(start.getTime() + parseDurationMinutes(event.duration) * 60000);
-}
-
-function firstLocationName(event: Partial<CalendarEvent>): string | null {
-  const locations = event.locations;
-  if (!locations || typeof locations !== 'object') return null;
-  for (const loc of Object.values(locations)) {
-    const name = (loc as { name?: unknown })?.name;
-    if (typeof name === 'string' && name.trim()) return name.trim();
-  }
-  return null;
-}
-
-function firstCalendarId(event: Partial<CalendarEvent>): string | null {
-  const ids = event.calendarIds;
-  if (!ids || typeof ids !== 'object') return null;
-  const keys = Object.keys(ids);
-  return keys.length > 0 ? keys[0] : null;
-}
-
-export async function POST(request: NextRequest) {
-  try {
-    const creds = await getStalwartCredentials(request);
-    if (!creds) {
-      return NextResponse.json({ error: 'Not authenticated' }, { status: 401 });
-    }
-
-    let body: { days?: unknown; limit?: unknown } = {};
-    try {
-      body = await request.json();
-    } catch {
-      /* empty body is fine */
-    }
-    const days = clampInt(body.days, 1, 90, 7);
-    const limit = clampInt(body.limit, 1, 200, 50);
-
-    // ── Resolve the calendar account from the JMAP session ──
-    // Hit Stalwart's canonical session endpoint on the SAME host as serverUrl.
-    // We deliberately avoid /.well-known/jmap: it 301s to the server's
-    // configured public hostname, which the host process may not be able to
-    // resolve (the browser client rewrites those URLs back to the origin for
-    // the same reason). Fall back to /.well-known/jmap for non-Stalwart servers.
-    const session = await fetchJmapSession(creds.serverUrl, creds.authHeader);
-    if (!session) {
-      return NextResponse.json({ error: 'JMAP session fetch failed' }, { status: 502 });
-    }
-    const accountId = session.primaryAccounts?.[CALENDAR_CAP];
-    if (!accountId) {
-      // No calendar account for this user — return an empty agenda, not an error.
-      return NextResponse.json({ events: [], generatedAt: new Date().toISOString() });
-    }
-
-    const using = ['urn:ietf:params:jmap:core', CALENDAR_CAP];
-    if (session.capabilities && PRINCIPALS_CAP in session.capabilities) {
-      using.push('urn:ietf:params:jmap:principals:owner');
-    }
-
-    // Send method calls to the session's apiUrl rebased onto serverUrl's host
-    // — never to session.apiUrl's (possibly unreachable) public host.
-    const apiUrl = rebaseApiUrl(session, creds.serverUrl) ?? `${creds.serverUrl}/jmap/`;
-
-    const now = new Date();
-    const horizon = new Date(now.getTime() + days * 24 * 60 * 60 * 1000);
-    // Expand from the start of today so all-day / already-running events still
-    // show in the agenda.
-    const windowStart = new Date(now);
-    windowStart.setHours(0, 0, 0, 0);
-
-    // ── 1) Query event IDs in range + load calendars (colours) ──
-    const queryReq = {
-      using,
-      methodCalls: [
-        [
-          'CalendarEvent/query',
-          {
-            accountId,
-            // Mirror the app's calendar store: an { after, before } window lets
-            // Stalwart evaluate recurrence so masters with occurrences in range
-            // are returned (a `before`-only filter can drop unbounded series).
-            filter: { after: windowStart.toISOString(), before: horizon.toISOString() },
-            limit: 1000,
-          },
-          '0',
-        ],
-        [
-          'Calendar/get',
-          { accountId, ids: null, properties: ['id', 'name', 'color'] },
-          'c',
-        ],
-      ],
-    };
-
-    const queryRes = await jmapPost(apiUrl, creds.authHeader, queryReq);
-    const queryResp = findResponse(queryRes, 'CalendarEvent/query', '0');
-    if (!queryResp) {
-      const err = findResponse(queryRes, 'error', '0');
-      return NextResponse.json(
-        { error: (err?.description as string) || 'CalendarEvent/query failed' },
-        { status: 502 },
-      );
-    }
-    const ids = (queryResp.ids as string[]) || [];
-
-    const calColors = new Map<string, { name: string; color: string | null }>();
-    const calResp = findResponse(queryRes, 'Calendar/get', 'c');
-    for (const cal of ((calResp?.list as Array<Record<string, unknown>>) || [])) {
-      if (typeof cal.id === 'string') {
-        calColors.set(cal.id, {
-          name: typeof cal.name === 'string' ? cal.name : '',
-          color: typeof cal.color === 'string' ? cal.color : null,
-        });
-      }
-    }
-
-    if (ids.length === 0) {
-      return NextResponse.json({ events: [], generatedAt: now.toISOString() });
-    }
-
-    // ── 2) Fetch full event objects (batched) ──
-    const raw: Array<Record<string, unknown>> = [];
-    const BATCH = 100;
-    for (let i = 0; i < ids.length; i += BATCH) {
-      const batch = ids.slice(i, i + BATCH);
-      const getRes = await jmapPost(apiUrl, creds.authHeader, {
-        using,
-        methodCalls: [
-          ['CalendarEvent/get', { accountId, ids: batch, properties: EVENT_PROPERTIES }, '0'],
-        ],
-      });
-      const getResp = findResponse(getRes, 'CalendarEvent/get', '0');
-      if (getResp?.list) raw.push(...(getResp.list as Array<Record<string, unknown>>));
-    }
-
-    // ── 3) Normalize + expand recurrences server-side ──
-    const normalized = raw
-      .map((e) => normalizeCalendarEventLike(e as Partial<CalendarEvent>))
-      .filter((e) => (e['@type'] ?? 'Event') === 'Event')
-      // Drop malformed events without a parseable start (would crash format()/
-      // parseISO downstream) — mirrors the calendar store guard (#316).
-      .filter((e) => typeof e.start === 'string' && e.start && !isNaN(parseISO(e.start).getTime())) as CalendarEvent[];
-
-    const expanded = expandRecurringEvents(
-      normalized,
-      windowStart.toISOString(),
-      horizon.toISOString(),
-    );
-
-    // ── 4) Keep ongoing/upcoming, sort, slice, map to DTOs ──
-    const agenda: AgendaEvent[] = expanded
-      .filter((e) => eventEnd(e).getTime() >= now.getTime())
-      .sort((a, b) => eventStart(a).getTime() - eventStart(b).getTime())
-      .slice(0, limit)
-      .map((e) => {
-        const calId = firstCalendarId(e);
-        const cal = calId ? calColors.get(calId) : undefined;
-        return {
-          id: String(e.id ?? ''),
-          uid: e.uid ?? null,
-          title: (e.title ?? '').trim() || '(no title)',
-          start: eventStart(e).toISOString(),
-          end: eventEnd(e).toISOString(),
-          allDay: !!e.showWithoutTime,
-          status: e.status ?? null,
-          color: e.color || cal?.color || null,
-          location: firstLocationName(e),
-          calendarId: calId,
-        };
-      });
-
-    return NextResponse.json({ events: agenda, generatedAt: now.toISOString() });
-  } catch (error) {
-    // `fetch failed` from undici is too generic to debug — the real reason
-    // (ENOTFOUND, ECONNREFUSED, self-signed TLS, …) lives on `error.cause`.
-    const err = error as Error & { cause?: { code?: string; message?: string } };
-    logger.error('Calendar agenda error', {
-      error: err?.message ?? 'Unknown',
-      causeCode: err?.cause?.code,
-      causeMessage: err?.cause?.message,
-    });
-    return NextResponse.json({ error: 'Internal server error' }, { status: 500 });
-  }
-}
-
-function clampInt(value: unknown, min: number, max: number, fallback: number): number {
-  const n = typeof value === 'number' ? value : Number(value);
-  if (!Number.isFinite(n)) return fallback;
-  return Math.min(max, Math.max(min, Math.round(n)));
-}
-
-async function jmapPost(
-  apiUrl: string,
-  authHeader: string,
-  payload: unknown,
-): Promise<unknown> {
-  const res = await postJmap(apiUrl, authHeader, JSON.stringify(payload));
-  if (!res.ok) {
-    throw new Error(`JMAP request failed (${res.status})`);
-  }
-  return res.json();
-}
-
-function findResponse(
-  res: unknown,
-  name: string,
-  callId: string,
-): Record<string, unknown> | null {
-  const responses = (res as { methodResponses?: unknown[] })?.methodResponses;
-  if (!Array.isArray(responses)) return null;
-  for (const entry of responses) {
-    if (Array.isArray(entry) && entry[0] === name && entry[2] === callId) {
-      return entry[1] as Record<string, unknown>;
-    }
-  }
-  return null;
-}

app/api/config/route.ts

@@ -1,15 +1,9 @@
-import { NextRequest, NextResponse } from 'next/server';
+import { NextResponse } from 'next/server';
 import { logger } from '@/lib/logger';
 import { configManager } from '@/lib/admin/config-manager';
 import { parseJmapServers, redactJmapServers } from '@/lib/admin/jmap-servers';
 import { hasSessionSecret } from '@/lib/auth/session-secret';
 import { getOauthScopes } from '@/lib/oauth/tokens';
-import {
-  matchDomainBranding,
-  parseDomainBranding,
-  pickRequestHost,
-  type BrandingOverrideKey,
-} from '@/lib/admin/domain-branding';
 
 /**
  * Runtime configuration endpoint
@@ -19,79 +13,49 @@ import {
  * post-build configuration for Docker deployments.
  *
  * Priority order:
- * 1. Per-domain branding override (admin-configured, matched on request host)
- * 2. Admin dashboard overrides (data/admin/config.json)
- * 3. Runtime env vars (APP_NAME, JMAP_SERVER_URL)
- * 4. Build-time env vars (NEXT_PUBLIC_APP_NAME, NEXT_PUBLIC_JMAP_SERVER_URL)
- * 5. Default values
+ * 1. Admin dashboard overrides (data/admin/config.json)
+ * 2. Runtime env vars (APP_NAME, JMAP_SERVER_URL)
+ * 3. Build-time env vars (NEXT_PUBLIC_APP_NAME, NEXT_PUBLIC_JMAP_SERVER_URL)
+ * 4. Default values
  */
-export async function GET(request: NextRequest) {
+export async function GET() {
   logger.debug('Config requested');
   await configManager.ensureLoaded();
 
-  const host = pickRequestHost(request);
-  const domainOverrides = matchDomainBranding(
-    host,
-    parseDomainBranding(configManager.get<unknown>('domainBranding', [])),
-  );
-
-  // Per-domain override wins over the global value, but only when the
-  // entry explicitly sets that key. Otherwise we fall through to the
-  // global admin/env/default chain.
-  const branded = <T,>(key: BrandingOverrideKey, fallback: T): T => {
-    const override = domainOverrides[key];
-    if (typeof override === 'string' && override.length > 0) return override as T;
-    return configManager.get<T>(key, fallback);
-  };
-
-  const appName =
-    branded<string>('appName', '') || process.env.NEXT_PUBLIC_APP_NAME || 'Webmail';
+  const appName = configManager.get<string>('appName') || process.env.NEXT_PUBLIC_APP_NAME || 'Webmail';
   const jmapServerUrl = configManager.get<string>('jmapServerUrl') || process.env.NEXT_PUBLIC_JMAP_SERVER_URL || '';
   const oauthEnabled = configManager.get<boolean>('oauthEnabled', false);
   const oauthOnly = oauthEnabled && configManager.get<boolean>('oauthOnly', false);
   const stalwartFeaturesEnabled = configManager.get<boolean>('stalwartFeaturesEnabled', true);
   const allowedFrameAncestors = configManager.get<string>('allowedFrameAncestors', '');
 
-  return NextResponse.json(
-    {
-      appName,
-      jmapServerUrl,
-      oauthEnabled,
-      oauthOnly,
-      oauthClientId: configManager.get<string>('oauthClientId', ''),
-      oauthIssuerUrl: configManager.get<string>('oauthIssuerUrl', ''),
-      oauthScopes: getOauthScopes(),
-      rememberMeEnabled: hasSessionSecret(),
-      settingsSyncEnabled: configManager.get<boolean>('settingsSyncEnabled', false) && hasSessionSecret(),
-      stalwartFeaturesEnabled,
-      devMode: configManager.get<boolean>('devMode', false),
-      faviconUrl: branded<string>('faviconUrl', '/branding/Bulwark_Favicon.svg'),
-      appLogoLightUrl: branded<string>('appLogoLightUrl', ''),
-      appLogoDarkUrl: branded<string>('appLogoDarkUrl', ''),
-      loginLogoLightUrl: branded<string>('loginLogoLightUrl', '/branding/Bulwark_Logo_Color.svg'),
-      loginLogoDarkUrl: branded<string>('loginLogoDarkUrl', '/branding/Bulwark_Logo_White.svg'),
-      loginCompanyName: branded<string>('loginCompanyName', ''),
-      loginImprintUrl: branded<string>('loginImprintUrl', ''),
-      loginPrivacyPolicyUrl: branded<string>('loginPrivacyPolicyUrl', ''),
-      loginWebsiteUrl: branded<string>('loginWebsiteUrl', ''),
-      loginLogoMaxHeight: configManager.get<string>('loginLogoMaxHeight', ''),
-      loginLogoMaxWidth: configManager.get<string>('loginLogoMaxWidth', ''),
-      loginShowHeading: configManager.get<boolean>('loginShowHeading', true),
-      loginShowSubtitle: configManager.get<boolean>('loginShowSubtitle', true),
-      loginShowTotp: configManager.get<boolean>('loginShowTotp', true),
-      loginShowVersion: configManager.get<boolean>('loginShowVersion', true),
-      demoMode: configManager.get<boolean>('demoMode', false),
-      allowCustomJmapEndpoint: configManager.get<boolean>('allowCustomJmapEndpoint', false),
-      jmapServers: redactJmapServers(parseJmapServers(configManager.get<unknown>('jmapServers', []))),
-      jmapServerAutoPickByDomain: configManager.get<boolean>('jmapServerAutoPickByDomain', false),
-      autoSsoEnabled: configManager.get<boolean>('autoSsoEnabled', false),
-      embeddedMode: !!allowedFrameAncestors && allowedFrameAncestors !== "'none'",
-      parentOrigin: configManager.get<string>('parentOrigin', ''),
-    },
-    {
-      // Branding varies by host, so any cache between us and the browser
-      // must key its entry by the host headers we consulted.
-      headers: { Vary: 'Host, X-Forwarded-Host' },
-    },
-  );
+  return NextResponse.json({
+    appName,
+    jmapServerUrl,
+    oauthEnabled,
+    oauthOnly,
+    oauthClientId: configManager.get<string>('oauthClientId', ''),
+    oauthIssuerUrl: configManager.get<string>('oauthIssuerUrl', ''),
+    oauthScopes: getOauthScopes(),
+    rememberMeEnabled: hasSessionSecret(),
+    settingsSyncEnabled: configManager.get<boolean>('settingsSyncEnabled', false) && hasSessionSecret(),
+    stalwartFeaturesEnabled,
+    devMode: configManager.get<boolean>('devMode', false),
+    faviconUrl: configManager.get<string>('faviconUrl', '/branding/Bulwark_Favicon.svg'),
+    appLogoLightUrl: configManager.get<string>('appLogoLightUrl', ''),
+    appLogoDarkUrl: configManager.get<string>('appLogoDarkUrl', ''),
+    loginLogoLightUrl: configManager.get<string>('loginLogoLightUrl', '/branding/Bulwark_Logo_Color.svg'),
+    loginLogoDarkUrl: configManager.get<string>('loginLogoDarkUrl', '/branding/Bulwark_Logo_White.svg'),
+    loginCompanyName: configManager.get<string>('loginCompanyName', ''),
+    loginImprintUrl: configManager.get<string>('loginImprintUrl', ''),
+    loginPrivacyPolicyUrl: configManager.get<string>('loginPrivacyPolicyUrl', ''),
+    loginWebsiteUrl: configManager.get<string>('loginWebsiteUrl', ''),
+    demoMode: configManager.get<boolean>('demoMode', false),
+    allowCustomJmapEndpoint: configManager.get<boolean>('allowCustomJmapEndpoint', false),
+    jmapServers: redactJmapServers(parseJmapServers(configManager.get<unknown>('jmapServers', []))),
+    jmapServerAutoPickByDomain: configManager.get<boolean>('jmapServerAutoPickByDomain', false),
+    autoSsoEnabled: configManager.get<boolean>('autoSsoEnabled', false),
+    embeddedMode: !!allowedFrameAncestors && allowedFrameAncestors !== "'none'",
+    parentOrigin: configManager.get<string>('parentOrigin', ''),
+  });
 }

app/api/dev-jmap/[...path]/route.ts

@@ -121,9 +121,9 @@ const emails: MockEmail[] = [
   },
   {
     id: 'email-002', threadId: 'thread-002', mailboxIds: { 'mb-inbox': true }, keywords: { $seen: true, $flagged: true, '$label:blue': true }, size: 5100, receivedAt: daysAgo(1),
-    from: [{ name: 'Dubois, Pierre', email: 'pierre@dubois.example' }],
+    from: [{ name: 'Pierre Dubois', email: 'pierre@dubois.example' }],
     to: [{ name: 'Dev User', email: 'dev@localhost' }],
-    cc: [{ name: 'de Vries, Karel', email: 'karel@devries.example' }],
+    cc: [{ name: 'Karel de Vries', email: 'karel@devries.example' }],
     subject: 'Project Update - Q1 Review',
     preview: 'Salut team, I wanted to share the latest project numbers. We are on track to meet our targets for Q1.',
     hasAttachment: true,
@@ -723,18 +723,7 @@ const emails: MockEmail[] = [
 // Identities
 // ---------------------------------------------------------------------------
 
-type MockIdentity = {
-  id: string;
-  name: string;
-  email: string;
-  replyTo: Array<{ name?: string; email: string }> | null;
-  bcc: Array<{ name?: string; email: string }> | null;
-  textSignature: string | null;
-  htmlSignature: string | null;
-  mayDelete: boolean;
-};
-
-const IDENTITIES: MockIdentity[] = [
+const IDENTITIES = [
   {
     id: 'identity-001',
     name: 'Dev User',
@@ -1573,55 +1562,13 @@ function handleIdentityGet(_args: MethodArgs, callId: string): MethodResult {
 
 function handleIdentitySet(args: MethodArgs, callId: string): MethodResult {
   const created: Record<string, { id: string }> = {};
-  const updated: Record<string, null> = {};
-  const destroyed: string[] = [];
-
-  const create = args.create as Record<string, Record<string, unknown>> | undefined;
+  const create = args.create as Record<string, unknown> | undefined;
   if (create) {
-    for (const [key, data] of Object.entries(create)) {
-      const newId = `identity-${Date.now()}-${key}`;
-      IDENTITIES.push({
-        id: newId,
-        name: (data.name as string) || '',
-        email: (data.email as string) || '',
-        replyTo: (data.replyTo as MockIdentity['replyTo']) ?? null,
-        bcc: (data.bcc as MockIdentity['bcc']) ?? null,
-        textSignature: (data.textSignature as string | null) ?? null,
-        htmlSignature: (data.htmlSignature as string | null) ?? null,
-        mayDelete: true,
-      });
-      created[key] = { id: newId };
+    for (const key of Object.keys(create)) {
+      created[key] = { id: `identity-new-${Date.now()}-${key}` };
     }
   }
-
-  const update = args.update as Record<string, Record<string, unknown>> | undefined;
-  if (update) {
-    for (const [id, changes] of Object.entries(update)) {
-      const identity = IDENTITIES.find((i) => i.id === id);
-      if (identity) {
-        // Email is immutable per the identity form, so it's never in `changes`.
-        if (changes.name !== undefined) identity.name = changes.name as string;
-        if (changes.replyTo !== undefined) identity.replyTo = changes.replyTo as MockIdentity['replyTo'];
-        if (changes.bcc !== undefined) identity.bcc = changes.bcc as MockIdentity['bcc'];
-        if (changes.textSignature !== undefined) identity.textSignature = changes.textSignature as string | null;
-        if (changes.htmlSignature !== undefined) identity.htmlSignature = changes.htmlSignature as string | null;
-        updated[id] = null;
-      }
-    }
-  }
-
-  const destroy = args.destroy as string[] | undefined;
-  if (destroy) {
-    for (const id of destroy) {
-      const idx = IDENTITIES.findIndex((i) => i.id === id);
-      if (idx !== -1) {
-        IDENTITIES.splice(idx, 1);
-        destroyed.push(id);
-      }
-    }
-  }
-
-  return ['Identity/set', { accountId: ACCOUNT_ID, oldState: nextState(), newState: nextState(), created, updated, destroyed, notCreated: null, notUpdated: null, notDestroyed: null }, callId];
+  return ['Identity/set', { accountId: ACCOUNT_ID, oldState: nextState(), newState: nextState(), created, updated: null, destroyed: null }, callId];
 }
 
 function handleThreadGet(args: MethodArgs, callId: string): MethodResult {
@@ -1679,8 +1626,7 @@ function handleEmailSubmissionGet(args: MethodArgs, callId: string): MethodResul
 }
 
 function handleQuotaGet(_args: MethodArgs, callId: string): MethodResult {
-  // mirroring Stalwart: resourceType "octets", scope "account"
-  return ['Quota/get', { accountId: ACCOUNT_ID, state: nextState(), list: [{ id: 'quota-1', resourceType: 'octets', scope: 'account', types: ['Email', 'SieveScript'], used: 52428800, hardLimit: 1073741824 }], notFound: [] }, callId];
+  return ['Quota/get', { accountId: ACCOUNT_ID, state: nextState(), list: [{ resourceType: 'mail', scope: 'mail', used: 52428800, hardLimit: 1073741824 }], notFound: [] }, callId];
 }
 
 function handleVacationResponseGet(_args: MethodArgs, callId: string): MethodResult {

app/api/favicon/route.ts

@@ -19,20 +19,6 @@ const negativeCache = new Map<string, NegativeCacheEntry>();
 const NEGATIVE_CACHE_TTL_MS = 24 * 60 * 60 * 1000; // 1 day
 const NEGATIVE_CACHE_MAX_SIZE = 2000;
 
-// 1x1 transparent PNG. Returned with HTTP 200 (instead of 404) when no
-// favicon exists for a domain, so the browser's <img> tag loads it cleanly
-// without spamming the DevTools console with red 404 errors. Avatar.tsx
-// checks `naturalWidth <= 1` in onLoad and falls back to initials.
-const TRANSPARENT_PNG = Buffer.from(
-  'iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mNgAAIAAAUAAen63NgAAAAASUVORK5CYII=',
-  'base64',
-);
-const MISSING_FAVICON_HEADERS = {
-  'Content-Type': 'image/png',
-  'Cache-Control': 'public, max-age=86400', // 1 day
-  'X-Bulwark-Favicon': 'missing',
-};
-
 // Strict domain validation to prevent SSRF
 const DOMAIN_RE = /^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+$/i;
 
@@ -448,7 +434,10 @@ export async function GET(request: NextRequest) {
   // Check negative cache (domains known to have no favicon)
   const neg = negativeCache.get(normalizedDomain);
   if (neg && Date.now() - neg.fetchedAt < NEGATIVE_CACHE_TTL_MS) {
-    return new NextResponse(TRANSPARENT_PNG, { headers: MISSING_FAVICON_HEADERS });
+    return new NextResponse(null, {
+      status: 404,
+      headers: { 'Cache-Control': 'public, max-age=86400' }, // 1 day
+    });
   }
 
   // Check cache
@@ -471,7 +460,10 @@ export async function GET(request: NextRequest) {
     if (!upstream.ok) {
       evictNegativeOldest();
       negativeCache.set(normalizedDomain, { fetchedAt: Date.now() });
-      return new NextResponse(TRANSPARENT_PNG, { headers: MISSING_FAVICON_HEADERS });
+      return new NextResponse(null, {
+        status: 404,
+        headers: { 'Cache-Control': 'public, max-age=86400' },
+      });
     }
 
     const contentType = upstream.headers.get('content-type') || 'image/x-icon';
@@ -481,7 +473,10 @@ export async function GET(request: NextRequest) {
     if (data.byteLength < 10) {
       evictNegativeOldest();
       negativeCache.set(normalizedDomain, { fetchedAt: Date.now() });
-      return new NextResponse(TRANSPARENT_PNG, { headers: MISSING_FAVICON_HEADERS });
+      return new NextResponse(null, {
+        status: 404,
+        headers: { 'Cache-Control': 'public, max-age=86400' },
+      });
     }
 
     // Cache the result

app/api/plugins/route.ts

@@ -37,9 +37,6 @@ export async function GET() {
       author: p.author,
       description: p.description,
       type: p.type,
-      // Requested execution tier; clients gate the same-origin privileged
-      // sandbox on this (plus signature + approval + consent).
-      tier: p.tier,
       permissions: p.permissions,
       entrypoint: p.entrypoint,
       // Policy is the canonical source for force-enable. The per-plugin field
@@ -60,9 +57,6 @@ export async function GET() {
       // Per-user settings schema, captured from the manifest at upload/load
       // time so the client can render the settings UI without re-parsing.
       settingsSchema: p.settingsSchema,
-      // Plugin-declared i18n tables, so the sandbox can localize plugin
-      // strings via api.i18n.t().
-      locales: p.locales,
     }));
 
     // Only serve enabled themes

app/api/pwa-icon/[size]/route.ts

@@ -4,11 +4,6 @@ import path from 'node:path';
 import { readFile } from 'node:fs/promises';
 import { configManager } from '@/lib/admin/config-manager';
 import { getConfigDir } from '@/lib/admin/paths';
-import {
-  matchDomainBranding,
-  parseDomainBranding,
-  pickRequestHost,
-} from '@/lib/admin/domain-branding';
 
 const VALID_SIZES = new Set([192, 512]);
 
@@ -38,7 +33,7 @@ async function fetchSourceImage(iconUrl: string): Promise<Buffer> {
 }
 
 export async function GET(
-  req: NextRequest,
+  _req: NextRequest,
   { params }: { params: Promise<{ size: string }> }
 ) {
   const { size: sizeParam } = await params;
@@ -49,27 +44,17 @@ export async function GET(
   }
 
   await configManager.ensureLoaded();
-  const host = pickRequestHost(req);
-  const domainOverrides = matchDomainBranding(
-    host,
-    parseDomainBranding(configManager.get<unknown>('domainBranding', [])),
-  );
   const sources = configManager.getAllWithSources();
   const iconUrl =
-    domainOverrides.pwaIconUrl ||
-    domainOverrides.faviconUrl ||
     (sources.pwaIconUrl?.source !== 'default' ? (sources.pwaIconUrl?.value as string) : '') ||
-    (sources.faviconUrl?.source !== 'default' ? (sources.faviconUrl?.value as string) : '') ||
-    // Fall back to the built-in default so this endpoint ALWAYS returns an app
-    // icon (custom if configured, else the bundled default). This lets callers
-    // that can't run the custom-vs-default check themselves - notably the
-    // service worker's notifications - use a single stable URL.
-    `/icon-${size}x${size}.png`;
+    (sources.faviconUrl?.source !== 'default' ? (sources.faviconUrl?.value as string) : '');
+  if (!iconUrl) {
+    return new NextResponse('No PWA icon configured', { status: 404 });
+  }
 
   const pngHeaders = {
     'Content-Type': 'image/png',
     'Cache-Control': 'public, max-age=86400',
-    Vary: 'Host, X-Forwarded-Host',
   };
 
   const cacheKey = `${size}|${iconUrl}`;

app/api/pwa-screenshot/[variant]/route.ts

@@ -1,104 +0,0 @@
-import { NextRequest, NextResponse } from 'next/server';
-import sharp from 'sharp';
-import path from 'node:path';
-import { readFile } from 'node:fs/promises';
-import { configManager } from '@/lib/admin/config-manager';
-import { getConfigDir } from '@/lib/admin/paths';
-import {
-  matchDomainBranding,
-  parseDomainBranding,
-  pickRequestHost,
-} from '@/lib/admin/domain-branding';
-
-/**
- * Variant → target output size + admin config key.
- * Matches the sizes declared in app/manifest.ts so the rendered PNG fits
- * the slot the manifest tells the browser about.
- */
-const VARIANTS = {
-  mobile: { width: 540, height: 720, configKey: 'pwaScreenshotMobileUrl' as const },
-  desktop: { width: 1280, height: 720, configKey: 'pwaScreenshotDesktopUrl' as const },
-} as const;
-
-type Variant = keyof typeof VARIANTS;
-
-// Cache resized images keyed by (variant, source URL).
-const cache = new Map<string, Blob>();
-
-async function fetchSourceImage(iconUrl: string): Promise<Buffer> {
-  if (iconUrl.startsWith('http://') || iconUrl.startsWith('https://')) {
-    const res = await fetch(iconUrl);
-    if (!res.ok) throw new Error(`Failed to fetch PWA screenshot: ${res.status}`);
-    return Buffer.from(await res.arrayBuffer());
-  }
-
-  // Admin-uploaded branding asset: served from /api/admin/branding/<file>
-  // but stored on disk under getConfigDir()/branding/.
-  const ADMIN_BRANDING_PREFIX = '/api/admin/branding/';
-  if (iconUrl.startsWith(ADMIN_BRANDING_PREFIX)) {
-    const filename = path.basename(iconUrl.slice(ADMIN_BRANDING_PREFIX.length));
-    return readFile(path.join(getConfigDir(), 'branding', filename));
-  }
-
-  // Path relative to public/ directory
-  const publicPath = path.join(process.cwd(), 'public', iconUrl.replace(/^\//, ''));
-  return readFile(publicPath);
-}
-
-export async function GET(
-  req: NextRequest,
-  { params }: { params: Promise<{ variant: string }> },
-) {
-  const { variant: variantParam } = await params;
-  if (!(variantParam in VARIANTS)) {
-    return new NextResponse('Invalid variant. Allowed: mobile, desktop', { status: 400 });
-  }
-  const { width, height, configKey } = VARIANTS[variantParam as Variant];
-
-  await configManager.ensureLoaded();
-  const host = pickRequestHost(req);
-  const domainOverrides = matchDomainBranding(
-    host,
-    parseDomainBranding(configManager.get<unknown>('domainBranding', [])),
-  );
-  const sources = configManager.getAllWithSources();
-  const sourceEntry = sources[configKey];
-  const screenshotUrl =
-    domainOverrides[configKey] ||
-    (sourceEntry?.source !== 'default' ? (sourceEntry?.value as string | undefined) : undefined);
-  if (!screenshotUrl) {
-    return new NextResponse('No PWA screenshot configured', { status: 404 });
-  }
-
-  const pngHeaders = {
-    'Content-Type': 'image/png',
-    'Cache-Control': 'public, max-age=86400',
-    Vary: 'Host, X-Forwarded-Host',
-  };
-  const cacheKey = `${variantParam}|${screenshotUrl}`;
-
-  try {
-    if (cache.has(cacheKey)) {
-      return new NextResponse(cache.get(cacheKey)!, { headers: pngHeaders });
-    }
-
-    const sourceBuffer = await fetchSourceImage(screenshotUrl);
-    // 'cover' fills the target box without letterboxing - screenshots benefit
-    // more from cropping than from a transparent frame around them. Users get
-    // a hint about the recommended aspect ratio in the admin UI.
-    const resized = await sharp(sourceBuffer)
-      .resize(width, height, { fit: 'cover', position: 'center' })
-      .png()
-      .toBuffer();
-
-    const ab = new ArrayBuffer(resized.byteLength);
-    new Uint8Array(ab).set(resized);
-    const blob = new Blob([ab], { type: 'image/png' });
-    cache.set(cacheKey, blob);
-
-    return new NextResponse(blob, { headers: pngHeaders });
-  } catch (err) {
-    console.error('Failed to generate PWA screenshot:', err);
-    return new NextResponse('Failed to generate screenshot', { status: 500 });
-  }
-}

app/api/setup/branding/route.ts

@@ -23,13 +23,10 @@ const ALLOWED_MIME_TYPES = new Set([
 
 const VALID_SLOTS = new Set([
   'faviconUrl',
-  'pwaIconUrl',
   'appLogoLightUrl',
   'appLogoDarkUrl',
   'loginLogoLightUrl',
   'loginLogoDarkUrl',
-  'pwaScreenshotMobileUrl',
-  'pwaScreenshotDesktopUrl',
 ]);
 
 const EXT_BY_MIME: Record<string, string> = {

app/api/setup/step/route.ts

@@ -4,7 +4,6 @@ import { authenticateWizardRequest } from '@/lib/setup/session';
 import { configManager } from '@/lib/admin/config-manager';
 import { CONFIG_ENV_MAP } from '@/lib/admin/types';
 import { parseJmapServers } from '@/lib/admin/jmap-servers';
-import { effectiveConsent, loadState, saveState, reschedule } from '@/lib/telemetry';
 import { logger } from '@/lib/logger';
 
 export const dynamic = 'force-dynamic';
@@ -77,32 +76,8 @@ export async function POST(request: NextRequest) {
     return NextResponse.json({ error: 'values must be an object' }, { status: 400 });
   }
 
-  const valuesObj = { ...(values as Record<string, unknown>) };
-
-  // Telemetry consent lives in the telemetry state file, not admin config, so
-  // it has no CONFIG_ENV_MAP entry. Pull it out of the security step and
-  // persist it directly, mirroring POST /api/admin/telemetry (set-consent).
-  if (step === 'security' && 'telemetryConsent' in valuesObj) {
-    const consent = valuesObj.telemetryConsent;
-    delete valuesObj.telemetryConsent;
-    if (consent !== 'on' && consent !== 'off') {
-      return NextResponse.json({ error: 'telemetryConsent must be "on" or "off"' }, { status: 400 });
-    }
-    // A BULWARK_TELEMETRY env var hard-locks the choice; don't fight it.
-    const { source } = await effectiveConsent();
-    if (source !== 'env') {
-      const tstate = await loadState();
-      tstate.consent = consent;
-      if (consent === 'on' && !tstate.consentedAt) {
-        tstate.consentedAt = new Date().toISOString();
-      }
-      await saveState(tstate);
-      await reschedule();
-    }
-  }
-
   const updates: Record<string, unknown> = {};
-  for (const [key, value] of Object.entries(valuesObj)) {
+  for (const [key, value] of Object.entries(values as Record<string, unknown>)) {
     if (!allowedKeys.includes(key)) {
       return NextResponse.json({ error: `Key not allowed in step ${step}: ${key}` }, { status: 400 });
     }

app/api/translate/route.ts

@@ -1,298 +0,0 @@
-import { NextRequest, NextResponse } from 'next/server';
-
-// Host-side proxy backing the "Translate" plugin (manifest apiPostPaths:
-// ["/api/translate"]). The plugin slot iframe POSTs { text, target, source,
-// provider } here via api.http.post; we forward to a free translation backend
-// and return { translatedText, detectedSource } in a stable shape.
-//
-// Two providers:
-//   - "mymemory"     — public MyMemory API, no configuration required. Its
-//                       langpair needs an explicit source language, so when the
-//                       plugin asks for "auto" we detect it locally first.
-//   - "libretranslate" — only available when the host sets LIBRETRANSLATE_URL
-//                       (and optionally LIBRETRANSLATE_API_KEY). Supports native
-//                       source auto-detection.
-
-export const runtime = 'nodejs';
-
-const MAX_CHARS = 5000;
-// Long bodies are split into ~480-char chunks for MyMemory and translated
-// sequentially, so allow enough headroom for ~10 round-trips.
-const TIMEOUT_MS = 25000;
-
-type Provider = 'mymemory' | 'libretranslate';
-
-interface TranslateBody {
-  text?: unknown;
-  target?: unknown;
-  source?: unknown;
-  provider?: unknown;
-}
-
-interface TranslateResult {
-  translatedText: string;
-  detectedSource?: string;
-}
-
-// ─── Lightweight language detection ───────────────────────────
-//
-// MyMemory has no auto-detect, so we infer a source language from the text.
-// Non-Latin scripts are decided by Unicode range; Latin-script European
-// languages are scored by stop-word frequency. Detection only needs to be good
-// enough to (a) pick a sensible langpair and (b) let the plugin skip messages
-// already in the target language.
-
-const SCRIPT_RANGES: ReadonlyArray<[RegExp, string]> = [
-  [/[぀-ヿ]/, 'ja'], // Hiragana / Katakana
-  [/[가-힯]/, 'ko'], // Hangul
-  [/[一-鿿]/, 'zh'], // CJK ideographs (after JP/KR checks)
-  [/[Ѐ-ӿ]/, 'ru'], // Cyrillic (ru vs uk refined below)
-  [/[Ͱ-Ͽ]/, 'el'], // Greek
-  [/[؀-ۿ]/, 'ar'], // Arabic
-  [/[֐-׿]/, 'he'], // Hebrew
-  [/[ऀ-ॿ]/, 'hi'], // Devanagari
-];
-
-// Distinctive stop words per Latin-script language from the manifest's option
-// list. Kept small and high-signal to avoid cross-language collisions.
-const LATIN_STOPWORDS: Record<string, readonly string[]> = {
-  en: ['the', 'and', 'you', 'that', 'with', 'for', 'this', 'have', 'are'],
-  de: ['der', 'die', 'und', 'das', 'ist', 'nicht', 'mit', 'sie', 'ein', 'auch'],
-  fr: ['les', 'des', 'une', 'est', 'pour', 'que', 'vous', 'dans', 'avec', 'pas'],
-  es: ['que', 'los', 'una', 'por', 'con', 'para', 'como', 'pero', 'más', 'esta'],
-  it: ['che', 'non', 'per', 'una', 'sono', 'con', 'come', 'questo', 'anche', 'della'],
-  pt: ['que', 'não', 'uma', 'com', 'para', 'como', 'mais', 'você', 'está', 'isso'],
-  nl: ['het', 'een', 'van', 'dat', 'niet', 'met', 'voor', 'aan', 'zijn', 'maar'],
-  pl: ['nie', 'jest', 'się', 'ale', 'oraz', 'tego', 'jak', 'tym', 'przez', 'dla'],
-  sv: ['och', 'att', 'det', 'som', 'för', 'med', 'inte', 'den', 'till', 'har'],
-  no: ['og', 'det', 'som', 'for', 'med', 'ikke', 'har', 'til', 'denne', 'jeg'],
-  da: ['og', 'det', 'som', 'for', 'med', 'ikke', 'har', 'til', 'denne', 'jeg'],
-  fi: ['että', 'olen', 'tämä', 'kanssa', 'mutta', 'sekä', 'ei', 'on', 'ja', 'jotta'],
-  cs: ['není', 'jsem', 'pro', 'ale', 'jako', 'tento', 'také', 'přes', 'jsou', 'své'],
-  ro: ['este', 'pentru', 'care', 'dar', 'sunt', 'această', 'mai', 'din', 'sau', 'nu'],
-  hu: ['hogy', 'nem', 'egy', 'van', 'ezt', 'vagy', 'mint', 'csak', 'ezzel', 'így'],
-  tr: ['bir', 'için', 'değil', 'bu', 'çok', 'daha', 'ama', 'gibi', 've', 'ile'],
-};
-
-function detectLanguage(text: string): string {
-  const sample = text.slice(0, 1000);
-  for (const [range, lang] of SCRIPT_RANGES) {
-    if (range.test(sample)) {
-      // Ukrainian shares Cyrillic with Russian; its unique glyphs decide it.
-      if (lang === 'ru' && /[єіїґ]/.test(sample)) return 'uk';
-      return lang;
-    }
-  }
-
-  const words = sample.toLowerCase().match(/[a-zà-ÿčśžłńęąółżźć]+/gi) || [];
-  if (words.length === 0) return 'en';
-  const counts: Record<string, number> = {};
-  const wordSet = new Set(words);
-  for (const [lang, stops] of Object.entries(LATIN_STOPWORDS)) {
-    let score = 0;
-    for (const stop of stops) if (wordSet.has(stop)) score += 1;
-    counts[lang] = score;
-  }
-  let best = 'en';
-  let bestScore = -1;
-  for (const [lang, score] of Object.entries(counts)) {
-    if (score > bestScore) {
-      best = lang;
-      bestScore = score;
-    }
-  }
-  return bestScore > 0 ? best : 'en';
-}
-
-function baseLang(code: string): string {
-  return String(code || '').toLowerCase().split('-')[0];
-}
-
-// ─── Chunking ─────────────────────────────────────────────────
-//
-// MyMemory's free endpoint caps each request's `q` at 500 characters and
-// silently returns only the translated prefix beyond that — which is why long
-// emails came back truncated ("…about Sel…"). We split the text into
-// line-aware chunks under the limit, translate each, then rejoin so the whole
-// body is covered.
-
-const MYMEMORY_CHUNK = 480;
-
-function chunkText(text: string, max: number): string[] {
-  const chunks: string[] = [];
-  let cur = '';
-  const flush = () => {
-    if (cur) {
-      chunks.push(cur);
-      cur = '';
-    }
-  };
-  for (const line of text.split('\n')) {
-    if (line.length > max) {
-      flush();
-      // A single over-long line (e.g. a long URL list): split on words, and
-      // hard-cut any word that is itself longer than the limit.
-      let seg = '';
-      for (const word of line.split(' ')) {
-        const piece = seg ? seg + ' ' + word : word;
-        if (piece.length > max) {
-          if (seg) {
-            chunks.push(seg);
-            seg = '';
-          }
-          if (word.length > max) {
-            for (let i = 0; i < word.length; i += max) chunks.push(word.slice(i, i + max));
-          } else {
-            seg = word;
-          }
-        } else {
-          seg = piece;
-        }
-      }
-      if (seg) chunks.push(seg);
-      continue;
-    }
-    if (cur && cur.length + 1 + line.length > max) flush();
-    cur = cur ? cur + '\n' + line : line;
-  }
-  flush();
-  return chunks;
-}
-
-// ─── Providers ────────────────────────────────────────────────
-
-async function mymemoryRequest(
-  q: string,
-  langpair: string,
-  signal: AbortSignal,
-): Promise<string> {
-  const url = new URL('https://api.mymemory.translated.net/get');
-  url.searchParams.set('q', q);
-  url.searchParams.set('langpair', langpair);
-
-  const res = await fetch(url.toString(), {
-    signal,
-    headers: { 'User-Agent': 'JMAP-Webmail/1.0 Translate-Plugin' },
-  });
-  const data = (await res.json().catch(() => null)) as
-    | { responseStatus?: number | string; responseData?: { translatedText?: string }; responseDetails?: string }
-    | null;
-  if (!res.ok || !data) {
-    throw new Error(`MyMemory returned ${res.status}`);
-  }
-  const status = Number(data.responseStatus);
-  if (status && status !== 200) {
-    throw new Error(data.responseDetails || `MyMemory error ${status}`);
-  }
-  const translatedText = data.responseData?.translatedText || '';
-  if (!translatedText) {
-    throw new Error('MyMemory returned no translation');
-  }
-  return translatedText;
-}
-
-async function translateMyMemory(
-  text: string,
-  source: string,
-  target: string,
-  signal: AbortSignal,
-): Promise<TranslateResult> {
-  const detected = source === 'auto' || !source ? detectLanguage(text) : baseLang(source);
-  const tgt = baseLang(target);
-  // Nothing to do if already in the target language; the plugin skips display.
-  if (detected === tgt) {
-    return { translatedText: text, detectedSource: detected };
-  }
-  const langpair = `${detected}|${tgt}`;
-  const chunks = chunkText(text, MYMEMORY_CHUNK);
-  // Sequential to stay friendly to MyMemory's free-tier rate limits; emails are
-  // usually one or two chunks.
-  const translated: string[] = [];
-  for (const chunk of chunks) {
-    translated.push(await mymemoryRequest(chunk, langpair, signal));
-  }
-  return { translatedText: translated.join('\n'), detectedSource: detected };
-}
-
-async function translateLibre(
-  text: string,
-  source: string,
-  target: string,
-  signal: AbortSignal,
-): Promise<TranslateResult> {
-  const endpoint = process.env.LIBRETRANSLATE_URL;
-  if (!endpoint) {
-    throw new Error('LibreTranslate is not configured on this server');
-  }
-  const apiKey = process.env.LIBRETRANSLATE_API_KEY;
-  const url = endpoint.replace(/\/+$/, '') + '/translate';
-  const res = await fetch(url, {
-    method: 'POST',
-    signal,
-    headers: { 'Content-Type': 'application/json' },
-    body: JSON.stringify({
-      q: text,
-      source: source || 'auto',
-      target: baseLang(target),
-      format: 'text',
-      ...(apiKey ? { api_key: apiKey } : {}),
-    }),
-  });
-  const data = (await res.json().catch(() => null)) as
-    | { translatedText?: string; detectedLanguage?: { language?: string }; error?: string }
-    | null;
-  if (!res.ok || !data) {
-    throw new Error(data?.error || `LibreTranslate returned ${res.status}`);
-  }
-  if (!data.translatedText) {
-    throw new Error(data.error || 'LibreTranslate returned no translation');
-  }
-  return {
-    translatedText: data.translatedText,
-    detectedSource: data.detectedLanguage?.language || (source !== 'auto' ? baseLang(source) : undefined),
-  };
-}
-
-// ─── Route ────────────────────────────────────────────────────
-
-export async function POST(request: NextRequest) {
-  let body: TranslateBody;
-  try {
-    body = (await request.json()) as TranslateBody;
-  } catch {
-    return NextResponse.json({ error: 'Invalid request body' }, { status: 400 });
-  }
-
-  const text = typeof body.text === 'string' ? body.text.trim() : '';
-  const target = typeof body.target === 'string' && body.target.trim() ? body.target.trim() : 'en';
-  const source = typeof body.source === 'string' && body.source.trim() ? body.source.trim() : 'auto';
-  const provider: Provider = body.provider === 'libretranslate' ? 'libretranslate' : 'mymemory';
-
-  if (!text) {
-    return NextResponse.json({ error: 'No text to translate' }, { status: 400 });
-  }
-  if (text.length > MAX_CHARS) {
-    return NextResponse.json(
-      { error: `Text exceeds the ${MAX_CHARS}-character limit` },
-      { status: 413 },
-    );
-  }
-
-  const controller = new AbortController();
-  const timeout = setTimeout(() => controller.abort(), TIMEOUT_MS);
-  try {
-    const result =
-      provider === 'libretranslate'
-        ? await translateLibre(text, source, target, controller.signal)
-        : await translateMyMemory(text, source, target, controller.signal);
-    return NextResponse.json(result, { status: 200 });
-  } catch (error: unknown) {
-    if (error instanceof Error && error.name === 'AbortError') {
-      return NextResponse.json({ error: 'Translation timed out' }, { status: 504 });
-    }
-    const message = error instanceof Error ? error.message : 'Translation failed';
-    return NextResponse.json({ error: message }, { status: 502 });
-  } finally {
-    clearTimeout(timeout);
-  }
-}

app/globals.css

@@ -70,7 +70,7 @@
 }
 
 .dark {
-  --color-border: rgba(128, 128, 128, 0.3);
+  --color-border: #262626;
   --color-input: #262626;
   --color-ring: #d4d4d4;
   --color-background: #0a0a0a;
@@ -660,13 +660,13 @@ body {
 
 .tiptap ul {
   list-style-type: disc;
-  padding-inline-start: 1.5rem;
+  padding-left: 1.5rem;
   margin: 0.25rem 0;
 }
 
 .tiptap ol {
   list-style-type: decimal;
-  padding-inline-start: 1.5rem;
+  padding-left: 1.5rem;
   margin: 0.25rem 0;
 }
 
@@ -675,8 +675,8 @@ body {
 }
 
 .tiptap blockquote {
-  border-inline-start: 3px solid var(--color-border);
-  padding-inline-start: 1rem;
+  border-left: 3px solid var(--color-border);
+  padding-left: 1rem;
   margin: 0.5rem 0;
   color: var(--color-muted-foreground);
 }
@@ -719,7 +719,7 @@ body {
 
 .tiptap p.is-editor-empty:first-child::before {
   content: attr(data-placeholder);
-  float: inline-start;
+  float: left;
   color: var(--color-muted-foreground);
   pointer-events: none;
   height: 0;
@@ -808,20 +808,3 @@ body {
   border-radius: 8px;
   animation: settings-search-pulse 1.6s ease-in-out forwards;
 }
-
-/* RTL: mirror directional icons (chevrons/arrows) so prev/next, back/forward,
-   and panel-collapse affordances point the correct way in right-to-left layouts.
-   lucide-react emits a `lucide-<name>` class per icon, so we target the
-   directional ones only — vertical chevrons (up/down) are intentionally left. */
-[dir="rtl"] .lucide-chevron-left,
-[dir="rtl"] .lucide-chevron-right,
-[dir="rtl"] .lucide-chevrons-left,
-[dir="rtl"] .lucide-chevrons-right,
-[dir="rtl"] .lucide-arrow-left,
-[dir="rtl"] .lucide-arrow-right,
-[dir="rtl"] .lucide-arrow-big-left,
-[dir="rtl"] .lucide-arrow-big-right,
-[dir="rtl"] .lucide-panel-left,
-[dir="rtl"] .lucide-panel-right {
-  transform: scaleX(-1);
-}

app/manifest.ts

@@ -1,12 +1,5 @@
 import type { MetadataRoute } from "next";
-import { headers } from "next/headers";
 import { configManager } from "@/lib/admin/config-manager";
-import {
-  matchDomainBranding,
-  parseDomainBranding,
-  pickRequestHost,
-  type BrandingOverrideKey,
-} from "@/lib/admin/domain-branding";
 
 export const dynamic = "force-dynamic";
 
@@ -32,40 +25,25 @@ const withBase = (p: string) => `${BASE_PATH}${p}`;
 export default async function manifest(): Promise<ExtendedManifest> {
   await configManager.ensureLoaded();
 
-  const host = pickRequestHost(await headers());
-  const domainOverrides = matchDomainBranding(
-    host,
-    parseDomainBranding(configManager.get<unknown>("domainBranding", [])),
-  );
-  const branded = <T,>(key: BrandingOverrideKey, fallback: T): T => {
-    const override = domainOverrides[key];
-    if (typeof override === "string" && override.length > 0) return override as T;
-    return configManager.get<T>(key, fallback);
-  };
-
   const appName =
-    branded<string>("appName", "") ||
+    configManager.get<string>("appName") ||
     process.env.NEXT_PUBLIC_APP_NAME ||
     "Bulwark Webmail";
 
-  const shortName = branded<string>("appShortName", "") || appName;
+  const shortName = configManager.get<string>("appShortName") || appName;
   const description =
-    branded<string>("appDescription", "") ||
+    configManager.get<string>("appDescription") ||
     "A modern webmail client built for Stalwart Mail Server";
-  const themeColor = branded<string>("pwaThemeColor", "") || "#ffffff";
-  const backgroundColor = branded<string>("pwaBackgroundColor", "") || "#ffffff";
+  const themeColor = configManager.get<string>("pwaThemeColor") || "#ffffff";
+  const backgroundColor = configManager.get<string>("pwaBackgroundColor") || "#ffffff";
 
-  // If pwaIconUrl or faviconUrl was explicitly configured (admin override,
-  // env var, or per-domain override), serve dynamically resized PNGs via
-  // /api/pwa-icon/[size]. Otherwise fall back to the static Bulwark PNGs -
-  // sources marked "default" are the built-in placeholder paths and not
-  // real custom icons.
+  // If pwaIconUrl or faviconUrl was explicitly configured (admin override or
+  // env var), serve dynamically resized PNGs via /api/pwa-icon/[size].
+  // Otherwise fall back to the static Bulwark PNGs - sources marked "default"
+  // are the built-in placeholder paths and not real custom icons.
   const sources = configManager.getAllWithSources();
   const hasCustomIcon =
-    !!domainOverrides.pwaIconUrl ||
-    !!domainOverrides.faviconUrl ||
-    sources.pwaIconUrl?.source !== "default" ||
-    sources.faviconUrl?.source !== "default";
+    sources.pwaIconUrl?.source !== "default" || sources.faviconUrl?.source !== "default";
 
   const icons: MetadataRoute.Manifest["icons"] = hasCustomIcon
     ? [
@@ -95,25 +73,10 @@ export default async function manifest(): Promise<ExtendedManifest> {
     background_color: backgroundColor,
     icons,
     categories: ["productivity"],
-    // Use admin-uploaded screenshots when configured (per-domain override,
-    // admin/env global; resized on the fly via /api/pwa-screenshot/[variant]);
-    // otherwise fall back to the built-in Bulwark screenshots from public/.
-    screenshots: (() => {
-      const hasMobile =
-        !!domainOverrides.pwaScreenshotMobileUrl ||
-        sources.pwaScreenshotMobileUrl?.source !== "default";
-      const hasDesktop =
-        !!domainOverrides.pwaScreenshotDesktopUrl ||
-        sources.pwaScreenshotDesktopUrl?.source !== "default";
-      return [
-        hasMobile
-          ? { src: withBase("/api/pwa-screenshot/mobile"), sizes: "540x720", type: "image/png" }
-          : { src: withBase("/screenshot-540x720.png"), sizes: "540x720", type: "image/png" },
-        hasDesktop
-          ? { src: withBase("/api/pwa-screenshot/desktop"), sizes: "1280x720", type: "image/png" }
-          : { src: withBase("/screenshot-1280x720.png"), sizes: "1280x720", type: "image/png" },
-      ];
-    })(),
+    screenshots: [
+      { src: withBase("/screenshot-540x720.png"), sizes: "540x720", type: "image/png" },
+      { src: withBase("/screenshot-1280x720.png"), sizes: "1280x720", type: "image/png" },
+    ],
     protocol_handlers: [
       { protocol: "mailto", url: withBase("/protocol/mailto?url=%s") },
       { protocol: "webcal", url: withBase("/protocol/webcal?url=%s") },

components/__tests__/favicon-badge.test.tsx

@@ -1,98 +0,0 @@
-import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
-import { render } from '@testing-library/react';
-import { FaviconBadge } from '@/components/favicon-badge';
-import { useFaviconBadge } from '@/hooks/use-favicon-badge';
-import { useEmailStore } from '@/stores/email-store';
-import { useSettingsStore } from '@/stores/settings-store';
-import type { Mailbox } from '@/lib/jmap/types';
-
-vi.mock('@/hooks/use-favicon-badge', () => ({
-  useFaviconBadge: vi.fn(),
-}));
-
-const useFaviconBadgeMock = vi.mocked(useFaviconBadge);
-
-function mailbox(patch: Partial<Mailbox> & { id: string }): Mailbox {
-  return {
-    name: patch.id,
-    sortOrder: 0,
-    totalEmails: 0,
-    unreadEmails: 0,
-    totalThreads: 0,
-    unreadThreads: 0,
-    isSubscribed: true,
-    myRights: {
-      mayReadItems: true,
-      mayAddItems: true,
-      mayRemoveItems: true,
-      maySetSeen: true,
-      maySetKeywords: true,
-      mayCreateChild: true,
-      mayRename: true,
-      mayDelete: true,
-      maySubmit: true,
-    },
-    ...patch,
-  } as Mailbox;
-}
-
-const initialMailboxes = useEmailStore.getState().mailboxes;
-
-beforeEach(() => {
-  useEmailStore.setState({ mailboxes: initialMailboxes });
-  useSettingsStore.setState({ faviconUnreadBadge: true });
-});
-
-afterEach(() => {
-  useEmailStore.setState({ mailboxes: initialMailboxes });
-  useSettingsStore.setState({ faviconUnreadBadge: true });
-  vi.clearAllMocks();
-});
-
-describe('FaviconBadge', () => {
-  it('badges the unread count of the primary inbox', () => {
-    useEmailStore.setState({
-      mailboxes: [mailbox({ id: 'inbox', role: 'inbox', unreadEmails: 7 })],
-    });
-
-    const { container } = render(<FaviconBadge />);
-
-    expect(useFaviconBadgeMock).toHaveBeenCalledWith(7, true);
-    expect(container.firstChild).toBeNull(); // renders no markup
-  });
-
-  it('disables the badge when the setting is off', () => {
-    useSettingsStore.setState({ faviconUnreadBadge: false });
-    useEmailStore.setState({
-      mailboxes: [mailbox({ id: 'inbox', role: 'inbox', unreadEmails: 7 })],
-    });
-
-    render(<FaviconBadge />);
-
-    expect(useFaviconBadgeMock).toHaveBeenCalledWith(7, false);
-  });
-
-  it('ignores a shared inbox, even when it sorts first', () => {
-    // Shared and group inboxes ship in the same `mailboxes` array. A plain
-    // `role === 'inbox'` lookup would badge somebody else's inbox on a
-    // delegated setup, so the store's canonical `!isShared` filter is required.
-    useEmailStore.setState({
-      mailboxes: [
-        mailbox({ id: 'shared', role: 'inbox', isShared: true, unreadEmails: 99 }),
-        mailbox({ id: 'mine', role: 'inbox', unreadEmails: 4 }),
-      ],
-    });
-
-    render(<FaviconBadge />);
-
-    expect(useFaviconBadgeMock).toHaveBeenCalledWith(4, true);
-  });
-
-  it('badges zero when there is no inbox yet', () => {
-    useEmailStore.setState({ mailboxes: [] });
-
-    render(<FaviconBadge />);
-
-    expect(useFaviconBadgeMock).toHaveBeenCalledWith(0, true);
-  });
-});

components/calendar/calendar-agenda-view.tsx

@@ -5,7 +5,7 @@ import { useTranslations, useFormatter } from "next-intl";
 import { format, isToday, isTomorrow, startOfDay } from "date-fns";
 import { MapPin, Users } from "lucide-react";
 import { cn } from "@/lib/utils";
-import { getEventColor } from "./event-card";
+import { parseDuration, getEventColor } from "./event-card";
 import { getEventDayBounds, getEventEndDate, getEventStartDate, getPrimaryCalendarId } from "@/lib/calendar-utils";
 import { getParticipantCount } from "@/lib/calendar-participants";
 import type { CalendarEvent, Calendar } from "@/lib/jmap/types";
@@ -131,7 +131,7 @@ export function CalendarAgendaView({
             )}>
               {formatDateHeader(group.date)}
             </span>
-            <span className="text-xs text-muted-foreground ms-2">
+            <span className="text-xs text-muted-foreground ml-2">
               {intlFormatter.dateTime(group.date, { month: "short", day: "numeric", year: "numeric" })}
             </span>
           </div>
@@ -147,10 +147,8 @@ export function CalendarAgendaView({
               const calendar = calId ? calendarMap.get(calId) : undefined;
               const color = getEventColor(ev, calendar);
               const start = getEventStartDate(ev);
+              const durMin = parseDuration(ev.duration);
               const end = getEventEndDate(ev);
-              // iTIP CANCEL marks the attendee's copy with status "cancelled"
-              // instead of deleting it (#572).
-              const isCancelled = ev.status === "cancelled";
               const locationName = ev.locations
                 ? Object.values(ev.locations)[0]?.name
                 : null;
@@ -162,10 +160,7 @@ export function CalendarAgendaView({
                   onMouseEnter={(e) => onHoverEvent?.(ev, e.currentTarget.getBoundingClientRect())}
                   onMouseLeave={() => onHoverLeave?.()}
                   onContextMenu={onContextMenuEvent ? (e) => onContextMenuEvent(e, ev) : undefined}
-                  className={cn(
-                    "w-full flex items-start px-4 hover:bg-muted/50 transition-colors text-start",
-                    isCancelled && "opacity-60"
-                  )}
+                  className="w-full flex items-start px-4 hover:bg-muted/50 transition-colors text-left"
                   style={{ gap: 'var(--density-item-gap)', paddingBlock: 'var(--density-item-py)' }}
                 >
                   <div className="flex flex-col items-center pt-0.5 min-w-[60px]">
@@ -187,7 +182,7 @@ export function CalendarAgendaView({
                   />
 
                   <div className="flex-1 min-w-0">
-                    <div className={cn("text-sm font-medium truncate", isCancelled && "line-through")}>
+                    <div className="text-sm font-medium truncate">
                       {ev.title || t("events.no_title")}
                     </div>
                     {locationName && (

components/calendar/calendar-day-view.tsx

@@ -218,7 +218,7 @@ export function CalendarDayView({
             {HOURS.map((h) => (
               <div
                 key={h}
-                className="relative text-muted-foreground text-end pe-2"
+                className="relative text-muted-foreground text-right pr-2"
                 style={{ height: HOUR_HEIGHT }}
               >
                 {h > 0 && (
@@ -231,7 +231,7 @@ export function CalendarDayView({
           </div>
 
           <div
-            className="flex-1 relative border-s border-border"
+            className="flex-1 relative border-l border-border"
             role="row"
             aria-label={t("views.day")}
             onPointerDown={(e) => handleGridPointerDown(e, dayKey, selectedDate)}
@@ -312,7 +312,7 @@ export function CalendarDayView({
                 style={{ top: (nowMinutes / 60) * HOUR_HEIGHT }}
               >
                 <div className="flex items-center">
-                  <div className="w-2.5 h-2.5 rounded-full bg-destructive -ms-1" />
+                  <div className="w-2.5 h-2.5 rounded-full bg-destructive -ml-1" />
                   <div className="flex-1 h-px bg-destructive" />
                 </div>
               </div>
@@ -346,7 +346,7 @@ export function CalendarDayView({
                 style={{ top: (dropTarget.minutes / 60) * HOUR_HEIGHT }}
               >
                 <div className="flex items-center">
-                  <div className="w-2.5 h-2.5 rounded-full bg-primary -ms-1" />
+                  <div className="w-2.5 h-2.5 rounded-full bg-primary -ml-1" />
                   <div className="flex-1 h-0.5 bg-primary rounded-full" />
                 </div>
                 <div className="absolute -top-4 left-2 text-[10px] font-medium text-primary bg-background/90 px-1 rounded shadow-sm">

components/calendar/calendar-month-view.tsx

@@ -1,18 +1,19 @@
 "use client";
 
 import { useMemo, useState, useCallback, type DragEvent } from "react";
-import { useTranslations } from "next-intl";
-import { format, parseISO } from "date-fns";
+import { useTranslations, useFormatter } from "next-intl";
+import {
+  startOfMonth, endOfMonth, startOfWeek, endOfWeek,
+  eachDayOfInterval, isSameDay, isSameMonth, isToday, format, parseISO,
+} from "date-fns";
 import { cn } from "@/lib/utils";
 import { EventCard } from "./event-card";
 import { buildWeekSegments, getEventDayBounds, getPrimaryCalendarId } from "@/lib/calendar-utils";
 import type { CalendarEvent, Calendar } from "@/lib/jmap/types";
 import { useAuthStore } from "@/stores/auth-store";
 import { useCalendarStore } from "@/stores/calendar-store";
-import { useSettingsStore } from "@/stores/settings-store";
 import type { PendingEventPreview } from "./event-modal";
 import { toast } from "@/stores/toast-store";
-import { useCalendarLocale } from "@/hooks/use-calendar-locale";
 
 interface CalendarMonthViewProps {
   selectedDate: Date;
@@ -46,28 +47,16 @@ export function CalendarMonthView({
   pendingPreview,
 }: CalendarMonthViewProps) {
   const t = useTranslations("calendar");
-  const showTimeInMonthView = useSettingsStore((state) => state.showTimeInMonthView);
-  // On mobile the month view collapses events to dots unless the user opted
-  // into full entries via "Show time in month view" (#666).
-  const showChips = !isMobile || showTimeInMonthView;
-  const overlayTop = isMobile ? 34 : 30;
-  const rowHeight = isMobile ? 18 : 22;
-  const chipHeight = rowHeight - 2;
-  const {
-    weekStartsOn,
-    dayHeaderKeys,
-    getMonthGridDays,
-    checkIsToday,
-    checkIsSameMonth,
-    checkIsSameDay,
-    formatDayNumber,
-    formatFullDate,
-  } = useCalendarLocale();
+  const intlFormatter = useFormatter();
+  const weekStart = (firstDayOfWeek === 0 ? 0 : 1) as 0 | 1;
 
-  const days = useMemo(
-    () => getMonthGridDays(selectedDate),
-    [selectedDate, getMonthGridDays],
-  );
+  const days = useMemo(() => {
+    const monthStart = startOfMonth(selectedDate);
+    const monthEnd = endOfMonth(selectedDate);
+    const gridStart = startOfWeek(monthStart, { weekStartsOn: weekStart });
+    const gridEnd = endOfWeek(monthEnd, { weekStartsOn: weekStart });
+    return eachDayOfInterval({ start: gridStart, end: gridEnd });
+  }, [selectedDate, weekStart]);
 
   const calendarMap = useMemo(() => {
     const map = new Map<string, Calendar>();
@@ -94,6 +83,10 @@ export function CalendarMonthView({
     return map;
   }, [events]);
 
+  const dayHeaders = firstDayOfWeek === 0
+    ? ["sun", "mon", "tue", "wed", "thu", "fri", "sat"] as const
+    : ["mon", "tue", "wed", "thu", "fri", "sat", "sun"] as const;
+
   const weeks = useMemo(() => {
     const result: Date[][] = [];
     for (let i = 0; i < days.length; i += 7) {
@@ -148,11 +141,11 @@ export function CalendarMonthView({
   }, [t]);
 
   return (
-    <div className="flex flex-col flex-1 overflow-hidden" role="grid" aria-label={formatFullDate(selectedDate)}>
+    <div className="flex flex-col flex-1 overflow-hidden" role="grid" aria-label={intlFormatter.dateTime(selectedDate, { month: "long", year: "numeric" })}>
       <div className="grid grid-cols-7 border-b border-border" role="row">
-        {dayHeaderKeys.map((d) => (
+        {dayHeaders.map((d) => (
           <div key={d} role="columnheader" className={cn(
-            "text-center text-xs font-medium text-muted-foreground py-2 border-e border-border last:border-e-0",
+            "text-center text-xs font-medium text-muted-foreground py-2 border-r border-border last:border-r-0",
             isMobile && "py-1.5 text-[11px]"
           )}>
             {isMobile ? t(`days.${d}`).slice(0, 2) : t(`days.${d}`)}
@@ -165,15 +158,15 @@ export function CalendarMonthView({
           <div key={wi} className={cn(
             "relative flex-1 border-b border-border last:border-b-0",
             isMobile ? "min-h-[52px]" : "min-h-[100px]"
-          )} role="row" style={showChips ? { minHeight: Math.max(isMobile ? 52 : 100, overlayTop + 4 + rowCount * rowHeight + 8) } : undefined}>
+          )} role="row" style={isMobile ? undefined : { minHeight: Math.max(100, 34 + rowCount * 22 + 8) }}>
             <div className="grid grid-cols-7 h-full">
             {week.map((day) => {
-              const inMonth = checkIsSameMonth(day, selectedDate);
-              const selected = checkIsSameDay(day, selectedDate);
-              const today = checkIsToday(day);
+              const inMonth = isSameMonth(day, selectedDate);
+              const selected = isSameDay(day, selectedDate);
+              const today = isToday(day);
               const key = format(day, "yyyy-MM-dd");
               const dayEvents = eventsByDate.get(key) || [];
-              const fullDateLabel = formatFullDate(day);
+              const fullDateLabel = intlFormatter.dateTime(day, { weekday: "long", month: "long", day: "numeric", year: "numeric" });
 
               return (
                 <div
@@ -188,7 +181,7 @@ export function CalendarMonthView({
                   onDragLeave={handleCellDragLeave}
                   onDrop={(e) => handleCellDrop(e, day)}
                   className={cn(
-                    "border-e border-border last:border-e-0 p-1 cursor-pointer transition-colors touch-manipulation",
+                    "border-r border-border last:border-r-0 p-1 cursor-pointer transition-colors touch-manipulation",
                     !inMonth && "bg-muted/30",
                     "hover:bg-muted/50",
                     selected && isMobile && "bg-primary/10",
@@ -206,10 +199,10 @@ export function CalendarMonthView({
                         inMonth && !selected && !today && "font-medium"
                       )}
                     >
-                      {formatDayNumber(day)}
+                      {format(day, "d")}
                     </span>
                   </div>
-                  {isMobile && !showChips ? (
+                  {isMobile ? (
                     <div className="flex items-center justify-center gap-0.5 flex-wrap">
                       {dayEvents.slice(0, 3).map((ev) => {
                         const calId = getPrimaryCalendarId(ev);
@@ -226,7 +219,7 @@ export function CalendarMonthView({
                       {dayEvents.length > 3 && (
                         <span className="w-1.5 h-1.5 rounded-full bg-muted-foreground/40" />
                       )}
-                      {pendingPreview && checkIsSameDay(pendingPreview.start, day) && (
+                      {pendingPreview && isSameDay(pendingPreview.start, day) && (
                         <span
                           className="w-1.5 h-1.5 rounded-full border border-dashed"
                           style={{ borderColor: calendarMap.get(pendingPreview.calendarId)?.color || "#3b82f6" }}
@@ -239,28 +232,25 @@ export function CalendarMonthView({
             })}
             </div>
 
-            {showChips && pendingPreview && (() => {
-              const previewDayIdx = week.findIndex(d => checkIsSameDay(d, pendingPreview.start));
+            {!isMobile && pendingPreview && (() => {
+              const previewDayIdx = week.findIndex(d => isSameDay(d, pendingPreview.start));
               if (previewDayIdx === -1) return null;
               const previewRow = rowCount;
               const cal = calendarMap.get(pendingPreview.calendarId);
               const color = cal?.color || "#3b82f6";
               return (
-                <div className="absolute inset-x-0 pointer-events-none" style={{ top: overlayTop }}>
+                <div className="absolute inset-x-0 pointer-events-none" style={{ top: 30 }}>
                   <div
                     className="absolute px-0.5"
                     style={{
                       left: `calc(${(previewDayIdx / 7) * 100}% + 1px)`,
                       width: `calc(${(1 / 7) * 100}% - 2px)`,
-                      top: previewRow * rowHeight,
-                      height: chipHeight,
+                      top: previewRow * 22,
+                      height: 20,
                     }}
                   >
                     <div
-                      className={cn(
-                        "h-full rounded text-[10px] font-medium truncate border-2 border-dashed",
-                        isMobile ? "leading-[16px] px-1" : "leading-[20px] px-1.5"
-                      )}
+                      className="h-full rounded text-[10px] leading-[20px] font-medium px-1.5 truncate border-2 border-dashed"
                       style={{ borderColor: color, color, backgroundColor: `${color}10` }}
                     >
                       {pendingPreview.title}
@@ -270,8 +260,8 @@ export function CalendarMonthView({
               );
             })()}
 
-            {showChips && segments.length > 0 && (
-              <div className="absolute inset-x-0 pointer-events-none" style={{ top: overlayTop }}>
+            {!isMobile && segments.length > 0 && (
+              <div className="absolute inset-x-0 pointer-events-none" style={{ top: 30 }}>
                 {segments.map((segment) => {
                   const calId = getPrimaryCalendarId(segment.event);
                   return (
@@ -281,8 +271,8 @@ export function CalendarMonthView({
                       style={{
                         left: `calc(${(segment.startIndex / 7) * 100}% + 1px)`,
                         width: `calc(${(segment.span / 7) * 100}% - 2px)`,
-                        top: segment.row * rowHeight,
-                        height: chipHeight,
+                        top: segment.row * 22,
+                        height: 20,
                       }}
                     >
                       <EventCard
@@ -296,7 +286,6 @@ export function CalendarMonthView({
                         onMouseLeave={onHoverLeave}
                         onContextMenu={onContextMenuEvent}
                         draggable
-                        className={isMobile ? "text-[10px] px-1" : undefined}
                       />
                     </div>
                   );

components/calendar/calendar-sidebar-panel.tsx

@@ -2,7 +2,7 @@
 
 import { useMemo, useState } from "react";
 import { useTranslations } from "next-intl";
-import { ChevronDown, ChevronRight, Globe, ListTodo, Pencil, RefreshCw, Share2, Star, Trash2, Cake, User, Users, Plus, Eraser, Palette, Shuffle } from "lucide-react";
+import { ChevronDown, ChevronRight, Globe, ListTodo, Pencil, RefreshCw, Share2, Trash2, Cake, User, Users, Plus, Eraser, Palette } from "lucide-react";
 import { cn, formatDateTime } from "@/lib/utils";
 import type { Calendar } from "@/lib/jmap/types";
 import { CalendarColorPicker } from "@/components/settings/calendar-management-settings";
@@ -11,7 +11,6 @@ import { useSettingsStore } from "@/stores/settings-store";
 import { useTaskStore } from "@/stores/task-store";
 import { useAccountStore } from "@/stores/account-store";
 import { BIRTHDAY_CALENDAR_ID } from "@/lib/birthday-calendar";
-import { sharedCalendarColorKey } from "@/lib/shared-calendar-colors";
 import { toast } from "@/stores/toast-store";
 import { ContextMenu, ContextMenuItem, ContextMenuSeparator, ContextMenuSubMenu } from "@/components/ui/context-menu";
 import { useContextMenu } from "@/hooks/use-context-menu";
@@ -51,7 +50,6 @@ interface CalendarSidebarPanelProps {
   selectedCalendarIds: string[];
   onToggleVisibility: (id: string) => void;
   onColorChange?: (calendarId: string, color: string) => void;
-  onResetColor?: (calendar: Calendar) => void;
   onShareCalendar?: (calendar: Calendar) => void;
   onCreateEvent?: (calendar: Calendar) => void;
   onClearCalendar?: (calendar: Calendar) => void;
@@ -73,7 +71,6 @@ export function CalendarSidebarPanel({
   selectedCalendarIds,
   onToggleVisibility,
   onColorChange,
-  onResetColor,
   onShareCalendar,
   onCreateEvent,
   onClearCalendar,
@@ -96,9 +93,7 @@ export function CalendarSidebarPanel({
   );
   const refreshICalSubscription = useCalendarStore((s) => s.refreshICalSubscription);
   const removeICalSubscription = useCalendarStore((s) => s.removeICalSubscription);
-  const setDefaultCalendar = useCalendarStore((s) => s.setDefaultCalendar);
   const timeFormat = useSettingsStore((s) => s.timeFormat);
-  const sharedCalendarColors = useSettingsStore((s) => s.sharedCalendarColors);
   const enableCalendarTasks = useSettingsStore((s) => s.enableCalendarTasks);
   const tasks = useTaskStore((s) => s.tasks);
   const setViewMode = useCalendarStore((s) => s.setViewMode);
@@ -220,16 +215,6 @@ export function CalendarSidebarPanel({
     }
   };
 
-  const handleSetDefault = async (calendarId: string) => {
-    if (!client) return;
-    try {
-      await setDefaultCalendar(client, calendarId);
-      toast.success(tMgmt('default_updated'));
-    } catch {
-      toast.error(tMgmt('error_default'));
-    }
-  };
-
   if (calendars.length === 0 && !onSubscribe) return null;
 
   const renderCalendarItem = (cal: Calendar) => {
@@ -317,13 +302,10 @@ export function CalendarSidebarPanel({
     const isBirthday = cal.id === BIRTHDAY_CALENDAR_ID;
     const canCreate = onCreateEvent && !isBirthday && cal.myRights?.mayWriteOwn !== false;
     const canShare = onShareCalendar && cal.myRights?.mayShare && !cal.isShared;
-    const canSetDefault = !!client && !isBirthday && !cal.isShared && !cal.isDefault;
     const canChangeColor = !!onColorChange;
-    const hasColorOverride = !!cal.isShared && !!sharedCalendarColors[sharedCalendarColorKey(cal)];
-    const canResetColor = !!onResetColor && hasColorOverride;
     const canClear = onClearCalendar && !isBirthday && cal.myRights?.mayDelete !== false;
     const canDelete = onDeleteCalendar && !isBirthday && !cal.isDefault && !cal.isShared;
-    const showSeparator = (canCreate || canShare || canSetDefault || canChangeColor || canResetColor) && (canClear || canDelete);
+    const showSeparator = (canCreate || canShare || canChangeColor) && (canClear || canDelete);
     const color = cal.color || "#3b82f6";
 
     return (
@@ -342,13 +324,6 @@ export function CalendarSidebarPanel({
             onClick={() => { closeContextMenu(); onShareCalendar(cal); }}
           />
         )}
-        {canSetDefault && (
-          <ContextMenuItem
-            icon={Star}
-            label={tMgmt('set_default')}
-            onClick={() => { closeContextMenu(); handleSetDefault(cal.id); }}
-          />
-        )}
         {canChangeColor && (
           <ContextMenuSubMenu icon={Palette} label={tMgmt('change_color')}>
             <div className="px-2 py-1.5 w-[200px]">
@@ -360,13 +335,6 @@ export function CalendarSidebarPanel({
             </div>
           </ContextMenuSubMenu>
         )}
-        {canResetColor && (
-          <ContextMenuItem
-            icon={Shuffle}
-            label={tMgmt('random_color')}
-            onClick={() => { closeContextMenu(); onResetColor!(cal); }}
-          />
-        )}
         {showSeparator && <ContextMenuSeparator />}
         {canClear && (
           <ContextMenuItem
@@ -397,7 +365,7 @@ export function CalendarSidebarPanel({
           <ListTodo className="w-4 h-4 text-muted-foreground" />
           <span>{t('tasks.label')}</span>
           {pendingTaskCount > 0 && (
-            <span className="ms-auto text-xs text-muted-foreground">{pendingTaskCount}</span>
+            <span className="ml-auto text-xs text-muted-foreground">{pendingTaskCount}</span>
           )}
           {overdueTaskCount > 0 && (
             <span className="text-xs text-destructive font-medium">{overdueTaskCount} {t('tasks.filter_overdue').toLowerCase()}</span>
@@ -437,7 +405,7 @@ export function CalendarSidebarPanel({
                           onCreateCalendar();
                         }
                       }}
-                      className="ms-auto p-0.5 rounded text-muted-foreground/70 opacity-0 group-hover:opacity-100 hover:text-foreground hover:bg-muted transition-colors cursor-pointer"
+                      className="ml-auto p-0.5 rounded text-muted-foreground/70 opacity-0 group-hover:opacity-100 hover:text-foreground hover:bg-muted transition-colors cursor-pointer"
                       title={tMgmt('add_calendar')}
                     >
                       <Plus className="w-3 h-3" />
@@ -445,7 +413,7 @@ export function CalendarSidebarPanel({
                   )}
                 </button>
                 {expanded && (
-                  <div className="mt-1 ps-3">
+                  <div className="mt-1 pl-3">
                     {owned.length > 0 && (
                       <div>
                         <div className="px-1 mb-1 text-[10px] font-medium text-muted-foreground/80 uppercase tracking-wider">

components/calendar/calendar-toolbar.tsx

@@ -1,14 +1,13 @@
 "use client";
 
 import { useState, useRef, useEffect } from "react";
-import { useTranslations } from "next-intl";
+import { useTranslations, useFormatter } from "next-intl";
 import { Button } from "@/components/ui/button";
 import { ChevronLeft, ChevronRight, Plus, Upload, CalendarDays, Globe, ChevronDown, ArrowLeft, Menu } from "lucide-react";
-import { startOfWeek } from "date-fns";
+import { addDays, startOfWeek } from "date-fns";
 import { cn } from "@/lib/utils";
 import type { CalendarViewMode } from "@/stores/calendar-store";
 import type { Calendar } from "@/lib/jmap/types";
-import { useCalendarLocale } from "@/hooks/use-calendar-locale";
 
 interface CalendarToolbarProps {
   selectedDate: Date;
@@ -51,14 +50,7 @@ export function CalendarToolbar({
   onMenuClick,
 }: CalendarToolbarProps) {
   const t = useTranslations("calendar");
-  const {
-    weekStartsOn,
-    formatMonthYear,
-    formatMonthYearShort,
-    formatWeekRange,
-    formatWeekRangeShort,
-    formatFullDate,
-  } = useCalendarLocale();
+  const formatter = useFormatter();
   const views: CalendarViewMode[] = enableCalendarTasks
     ? ["month", "week", "day", "agenda", "tasks"]
     : ["month", "week", "day", "agenda"];
@@ -80,22 +72,28 @@ export function CalendarToolbar({
     switch (viewMode) {
       case "month":
         return isMobile
-          ? formatMonthYearShort(selectedDate)
-          : formatMonthYear(selectedDate);
+          ? formatter.dateTime(selectedDate, { month: "short", year: "numeric" })
+          : formatter.dateTime(selectedDate, { month: "long", year: "numeric" });
       case "week": {
-        const ws = startOfWeek(selectedDate, { weekStartsOn });
-        return isMobile
-          ? formatWeekRangeShort(ws)
-          : formatWeekRange(ws);
+        const ws = startOfWeek(selectedDate, { weekStartsOn: firstDayOfWeek as 0 | 1 });
+        const we = addDays(ws, 6);
+        if (isMobile) {
+          return `${formatter.dateTime(ws, { month: "short", day: "numeric" })} – ${formatter.dateTime(we, { day: "numeric" })}`;
+        }
+        const sameMonth = ws.getMonth() === we.getMonth();
+        if (sameMonth) {
+          return `${formatter.dateTime(ws, { month: "short", day: "numeric" })} – ${formatter.dateTime(we, { day: "numeric" })}, ${we.getFullYear()}`;
+        }
+        return `${formatter.dateTime(ws, { month: "short", day: "numeric" })} – ${formatter.dateTime(we, { month: "short", day: "numeric" })}, ${we.getFullYear()}`;
       }
       case "day":
         return isMobile
-          ? formatFullDate(selectedDate)
-          : formatFullDate(selectedDate);
+          ? formatter.dateTime(selectedDate, { weekday: "short", month: "short", day: "numeric" })
+          : formatter.dateTime(selectedDate, { weekday: "long", month: "long", day: "numeric", year: "numeric" });
       case "agenda":
         return isMobile
-          ? formatMonthYearShort(selectedDate)
-          : formatMonthYear(selectedDate);
+          ? formatter.dateTime(selectedDate, { month: "short", year: "numeric" })
+          : formatter.dateTime(selectedDate, { month: "long", year: "numeric" });
       case "tasks":
         return t("views.tasks");
     }
@@ -126,7 +124,7 @@ export function CalendarToolbar({
           variant="ghost"
           size="icon"
           onClick={onMenuClick}
-          className="h-8 w-8 -ms-1 me-1"
+          className="h-8 w-8 -ml-1 mr-1"
           aria-label={t("nav_open_menu")}
         >
           <Menu className="w-4 h-4" />
@@ -140,7 +138,7 @@ export function CalendarToolbar({
             {onMenuClick && (
               <button
                 onClick={onMenuClick}
-                className="p-1.5 -ms-1 rounded-md hover:bg-muted transition-colors touch-manipulation"
+                className="p-1.5 -ml-1 rounded-md hover:bg-muted transition-colors touch-manipulation"
                 aria-label={t("nav_open_menu")}
               >
                 <Menu className="w-4 h-4" />
@@ -149,7 +147,7 @@ export function CalendarToolbar({
             {onNavigateBack && (
               <button
                 onClick={onNavigateBack}
-                className="p-1.5 -ms-1 rounded-md hover:bg-muted transition-colors touch-manipulation"
+                className="p-1.5 -ml-1 rounded-md hover:bg-muted transition-colors touch-manipulation"
                 aria-label={t("back_to_month")}
               >
                 <ArrowLeft className="w-4 h-4" />
@@ -164,7 +162,7 @@ export function CalendarToolbar({
             <button onClick={onNext} className="p-1.5 rounded-md hover:bg-muted transition-colors touch-manipulation" aria-label={t("nav_next")}>
               <ChevronRight className="w-4 h-4" />
             </button>
-            <Button variant="ghost" size="sm" onClick={onToday} className="touch-manipulation text-xs h-7 px-2 ms-0.5">
+            <Button variant="ghost" size="sm" onClick={onToday} className="touch-manipulation text-xs h-7 px-2 ml-0.5">
               {t("views.today")}
             </Button>
           </div>
@@ -201,7 +199,7 @@ export function CalendarToolbar({
                   <CalendarDays className="w-4 h-4" />
                 </button>
                 {showCalendarDropdown && (
-                  <div className="absolute top-full end-0 mt-1 z-50 bg-popover border border-border rounded-lg shadow-lg p-2 min-w-[180px]">
+                  <div className="absolute top-full right-0 mt-1 z-50 bg-popover border border-border rounded-lg shadow-lg p-2 min-w-[180px]">
                     <h3 className="text-xs font-medium text-muted-foreground uppercase tracking-wider mb-2 px-1">
                       {t("my_calendars")}
                     </h3>
@@ -286,7 +284,7 @@ export function CalendarToolbar({
       {/* ── DESKTOP TOOLBAR ── */}
       {!isMobile && (
         <div className="flex items-center gap-1">
-          <Button variant="outline" size="sm" onClick={onToday} className="h-8 me-1">
+          <Button variant="outline" size="sm" onClick={onToday} className="h-8 mr-1">
             {t("views.today")}
           </Button>
           <Button variant="ghost" size="icon" className="h-8 w-8" onClick={onPrev} aria-label={t("nav_prev")}>
@@ -295,7 +293,7 @@ export function CalendarToolbar({
           <Button variant="ghost" size="icon" className="h-8 w-8" onClick={onNext} aria-label={t("nav_next")}>
             <ChevronRight className="w-4 h-4" />
           </Button>
-          <span className="text-base font-semibold ms-2 select-none">
+          <span className="text-base font-semibold ml-2 select-none">
             {getDateLabel()}
           </span>
         </div>
@@ -330,12 +328,12 @@ export function CalendarToolbar({
       {(onImport || onSubscribe) && !isMobile && (
         <div className="relative" ref={importDropdownRef}>
           <Button variant="outline" size="sm" className="h-8" onClick={() => setShowImportDropdown((v) => !v)}>
-            <Upload className="w-4 h-4 me-1" />
+            <Upload className="w-4 h-4 mr-1" />
             {t("import.title")}
-            <ChevronDown className="w-3 h-3 ms-1" />
+            <ChevronDown className="w-3 h-3 ml-1" />
           </Button>
           {showImportDropdown && (
-            <div className="absolute top-full end-0 mt-1 z-50 bg-background border border-border rounded-lg shadow-lg p-1 min-w-[180px]">
+            <div className="absolute top-full right-0 mt-1 z-50 bg-background border border-border rounded-lg shadow-lg p-1 min-w-[180px]">
               {onImport && (
                 <button
                   onClick={() => { onImport(); setShowImportDropdown(false); }}
@@ -361,7 +359,7 @@ export function CalendarToolbar({
 
       {!isMobile && (
         <Button size="sm" className="h-8" onClick={onCreateEvent} data-tour="create-event-button">
-          <Plus className="w-4 h-4 me-1" />
+          <Plus className="w-4 h-4 mr-1" />
           {t("events.create")}
         </Button>
       )}

components/calendar/calendar-week-view.tsx

@@ -58,7 +58,7 @@ export function CalendarWeekView({
   const intlFormatter = useFormatter();
   const scrollRef = useRef<HTMLDivElement>(null);
   const rootRef = useRef<HTMLDivElement>(null);
-  const weekStart = (firstDayOfWeek === 0 ? 0 : firstDayOfWeek === 6 ? 6 : 1) as 0 | 1 | 6;
+  const weekStart = (firstDayOfWeek === 0 ? 0 : 1) as 0 | 1;
 
   const weekDays = useMemo(() => {
     const start = startOfWeek(selectedDate, { weekStartsOn: weekStart });
@@ -211,7 +211,7 @@ export function CalendarWeekView({
       <div className={cn("flex min-h-0 flex-col flex-1", isMobile && "min-w-[880px]")}>      {hasAllDay && (
         <div className="flex border-b border-border">
           <div
-            className={cn("flex-shrink-0 text-[10px] text-muted-foreground p-1 text-end", isMobile ? "w-10 sticky left-0 z-10 bg-background" : "w-14")}
+            className={cn("flex-shrink-0 text-[10px] text-muted-foreground p-1 text-right", isMobile ? "w-10 sticky left-0 z-10 bg-background" : "w-14")}
             style={{ minHeight: Math.max(28, (allDayRowCount + taskRowCount) * 24 + 4) }}
           >
             {t("events.all_day")}
@@ -306,7 +306,7 @@ export function CalendarWeekView({
 
       <div className="flex border-b border-border" role="row">
         <div className={cn("flex-shrink-0", isMobile ? "w-10 sticky left-0 z-10 bg-background" : "w-14")} />
-        <div className="flex-1 border-s border-border grid grid-cols-7">
+        <div className="flex-1 border-l border-border grid grid-cols-7">
           {weekDays.map((day) => {
             const todayCol = isToday(day);
             const selected = isSameDay(day, selectedDate);
@@ -318,7 +318,7 @@ export function CalendarWeekView({
                 role="columnheader"
                 aria-label={fullLabel}
                 className={cn(
-                  "text-center py-2 text-sm border-e border-border last:border-e-0 transition-colors touch-manipulation",
+                  "text-center py-2 text-sm border-r border-border last:border-r-0 transition-colors touch-manipulation",
                   "hover:bg-muted/50",
                   todayCol && "font-bold",
                 )}
@@ -345,7 +345,7 @@ export function CalendarWeekView({
             {HOURS.map((h) => (
               <div
                 key={h}
-                className="relative text-muted-foreground text-end pe-2"
+                className="relative text-muted-foreground text-right pr-2"
                 style={{ height: HOUR_HEIGHT }}
               >
                 {h > 0 && (
@@ -357,7 +357,7 @@ export function CalendarWeekView({
             ))}
           </div>
 
-          <div className="flex-1 border-s border-border relative grid grid-cols-7">
+          <div className="flex-1 border-l border-border relative grid grid-cols-7">
             {weekDays.map((day) => {
               const key = format(day, "yyyy-MM-dd");
               const dayEvents = timedEvents.get(key) || [];
@@ -367,7 +367,7 @@ export function CalendarWeekView({
               return (
                 <div
                   key={key}
-                  className="relative border-e border-border last:border-e-0"
+                  className="relative border-r border-border last:border-r-0"
                   role="row"
                   aria-label={intlFormatter.dateTime(day, { weekday: "long", month: "long", day: "numeric" })}
                   onPointerDown={(e) => handleGridPointerDown(e, key, day)}
@@ -448,7 +448,7 @@ export function CalendarWeekView({
                       style={{ top: (nowMinutes / 60) * HOUR_HEIGHT }}
                     >
                       <div className="flex items-center">
-                        <div className="w-2 h-2 rounded-full bg-destructive -ms-1" />
+                        <div className="w-2 h-2 rounded-full bg-destructive -ml-1" />
                         <div className="flex-1 h-px bg-destructive" />
                       </div>
                     </div>
@@ -482,7 +482,7 @@ export function CalendarWeekView({
                       style={{ top: (dropTarget.minutes / 60) * HOUR_HEIGHT }}
                     >
                       <div className="flex items-center">
-                        <div className="w-2 h-2 rounded-full bg-primary -ms-1" />
+                        <div className="w-2 h-2 rounded-full bg-primary -ml-1" />
                         <div className="flex-1 h-0.5 bg-primary rounded-full" />
                       </div>
                       <div className="absolute -top-4 left-2 text-[10px] font-medium text-primary bg-background/90 px-1 rounded shadow-sm">

components/calendar/create-calendar-modal.tsx

@@ -137,7 +137,7 @@ export function CreateCalendarModal({ client, onClose }: CreateCalendarModalProp
           <Button onClick={handleSubmit} disabled={!isValid || isSubmitting}>
             {isSubmitting ? (
               <>
-                <Loader2 className="w-4 h-4 animate-spin me-2" />
+                <Loader2 className="w-4 h-4 animate-spin mr-2" />
                 {tCommon("loading")}
               </>
             ) : (

components/calendar/event-card.tsx

@@ -34,11 +34,6 @@ function sanitizeColor(color: string | null | undefined, fallback = "#3b82f6"):
 }
 
 function getEventColor(event: CalendarEvent, calendar?: Calendar): string {
-  // A local color override on a shared calendar wins over per-event colors,
-  // so the whole shared calendar paints uniformly in the viewer's chosen hue.
-  if (calendar?.colorIsLocalOverride && calendar.color) {
-    return sanitizeColor(calendar.color);
-  }
   return sanitizeColor(event.color, sanitizeColor(calendar?.color));
 }
 
@@ -71,7 +66,7 @@ function createEventDragPreview(title: string, timeRange: string, color: string)
   return el;
 }
 
-export function EventCard({ event, calendar, variant, onClick, onMouseEnter, onMouseLeave, onContextMenu, isSelected, draggable: isDraggable, continuesAfter = false, className, style }: EventCardProps) {
+export function EventCard({ event, calendar, variant, onClick, onMouseEnter, onMouseLeave, onContextMenu, isSelected, draggable: isDraggable, continuesBefore = false, continuesAfter = false, className, style }: EventCardProps) {
   const t = useTranslations("calendar");
   const [isBeingDragged, setIsBeingDragged] = useState(false);
   const color = getEventColor(event, calendar);
@@ -88,10 +83,7 @@ export function EventCard({ event, calendar, variant, onClick, onMouseEnter, onM
     try { return format(d, fmt); } catch { return "--:--"; }
   };
   const timeString = `${safeFormat(startDate, timeFmt)} – ${safeFormat(endTime, timeFmt)}`;
-  // iTIP CANCEL marks the attendee's copy with status "cancelled" instead of
-  // deleting it (#572) - render it struck through and dimmed.
-  const isCancelled = event.status === "cancelled";
-  const ariaLabel = `${event.title || t("events.no_title")}, ${timeString}${calendarName ? `, ${calendarName}` : ""}${isCancelled ? `, ${t("detail.cancelled")}` : ""}`;
+  const ariaLabel = `${event.title || t("events.no_title")}, ${timeString}${calendarName ? `, ${calendarName}` : ""}`;
 
   const handleDragStart = useCallback((e: DragEvent) => {
     e.stopPropagation();
@@ -134,12 +126,11 @@ export function EventCard({ event, calendar, variant, onClick, onMouseEnter, onM
         aria-label={ariaLabel}
         {...dragProps}
         className={cn(
-          "flex items-center gap-1 w-full text-start text-xs px-1 py-0.5 rounded truncate",
+          "flex items-center gap-1 w-full text-left text-xs px-1 py-0.5 rounded truncate",
           "min-h-[44px] sm:min-h-0",
           "hover:opacity-80 transition-opacity",
           isSelected && "ring-2 ring-primary",
           isBeingDragged && "opacity-50",
-          isCancelled && !isBeingDragged && "opacity-60",
           className
         )}
         style={{ backgroundColor: `${color}20`, color, ...style }}
@@ -148,7 +139,7 @@ export function EventCard({ event, calendar, variant, onClick, onMouseEnter, onM
           className="w-1.5 h-1.5 rounded-full flex-shrink-0"
           style={{ backgroundColor: color }}
         />
-        <span className={cn("truncate", isCancelled && "line-through")}>{event.title || t("events.no_title")}</span>
+        <span className="truncate">{event.title || t("events.no_title")}</span>
       </button>
     );
   }
@@ -163,13 +154,12 @@ export function EventCard({ event, calendar, variant, onClick, onMouseEnter, onM
         aria-label={ariaLabel}
         {...dragProps}
         className={cn(
-          "w-full h-full text-start rounded-r px-1.5 py-0.5 text-xs overflow-hidden",
+          "w-full h-full text-left rounded-r px-1.5 py-0.5 text-xs overflow-hidden",
           "hover:opacity-90 transition-opacity cursor-pointer",
           continuesAfter && "rounded-r-sm",
-          continuesAfter && "pe-2",
+          continuesAfter && "pr-2",
           isSelected && "ring-2 ring-primary",
           isBeingDragged && "opacity-50",
-          isCancelled && !isBeingDragged && "opacity-60",
           className
         )}
         style={{ backgroundColor: `${color}24`, borderLeft: `3px solid ${color}`, color, ...style }}
@@ -178,7 +168,7 @@ export function EventCard({ event, calendar, variant, onClick, onMouseEnter, onM
           {showTimeInMonthView && !event.showWithoutTime && (
             <span className="flex-shrink-0 opacity-80">{format(startDate, timeFmt)}</span>
           )}
-          <span className={cn("truncate font-medium", isCancelled && "line-through")}>{event.title || t("events.no_title")}</span>
+          <span className="truncate font-medium">{event.title || t("events.no_title")}</span>
         </div>
       </button>
     );
@@ -194,16 +184,15 @@ export function EventCard({ event, calendar, variant, onClick, onMouseEnter, onM
       {...dragProps}
       data-calendar-event
       className={cn(
-        "w-full h-full text-start rounded-r px-1.5 py-0.5 text-xs overflow-hidden",
+        "w-full h-full text-left rounded-r px-1.5 py-0.5 text-xs overflow-hidden",
         "hover:opacity-90 transition-opacity cursor-pointer",
         isSelected && "ring-2 ring-primary",
         isBeingDragged && "opacity-50",
-        isCancelled && !isBeingDragged && "opacity-60",
         className
       )}
       style={{ backgroundColor: `${color}30`, borderLeft: `3px solid ${color}`, color, ...style }}
     >
-      <div className={cn("font-medium truncate", isCancelled && "line-through")}>{event.title || t("events.no_title")}</div>
+      <div className="font-medium truncate">{event.title || t("events.no_title")}</div>
       {!event.showWithoutTime && (
         <div className="opacity-80 text-[10px]">
           {timeString}

components/calendar/event-detail-popover.tsx

@@ -1,19 +1,18 @@
 "use client";
 
 import { useState, useEffect, useRef, useMemo, useCallback, useLayoutEffect } from "react";
-import { useTranslations, useLocale } from "next-intl";
+import { useTranslations } from "next-intl";
 import { createPortal } from "react-dom";
 import { Button } from "@/components/ui/button";
 import {
   X, Clock, MapPin, Video, Users, Repeat, Bell, AlignLeft,
   Pencil, Trash2, Copy, Send, Check,
 } from "lucide-react";
-import { format, isSameDay } from "date-fns";
+import { format, isSameDay, parseISO } from "date-fns";
 import { cn } from "@/lib/utils";
 import type { CalendarEvent, Calendar, CalendarParticipant } from "@/lib/jmap/types";
 import { parseDuration, getEventColor } from "./event-card";
 import { getEventDisplayEndDate, getEventEndDate, getEventStartDate } from "@/lib/calendar-utils";
-import { buildRecurrenceSummary } from "./recurrence-editor";
 import {
   isOrganizer,
   getUserParticipantId,
@@ -102,9 +101,16 @@ function getAlertLabel(event: CalendarEvent, t: ReturnType<typeof useTranslation
   return null;
 }
 
-function getRecurrenceLabel(event: CalendarEvent, t: ReturnType<typeof useTranslations>, locale: string): string | null {
+function getRecurrenceLabel(event: CalendarEvent, t: ReturnType<typeof useTranslations>): string | null {
   if (!event.recurrenceRules?.length) return null;
-  return buildRecurrenceSummary(event.recurrenceRules[0], t, locale);
+  const freq = event.recurrenceRules[0].frequency;
+  const labels: Record<string, string> = {
+    daily: t("recurrence.daily"),
+    weekly: t("recurrence.weekly"),
+    monthly: t("recurrence.monthly"),
+    yearly: t("recurrence.yearly"),
+  };
+  return labels[freq] || null;
 }
 
 export function EventDetailPopover({
@@ -124,7 +130,6 @@ export function EventDetailPopover({
   isMobile,
 }: EventDetailPopoverProps) {
   const t = useTranslations("calendar");
-  const locale = useLocale();
   const popoverRef = useRef<HTMLDivElement>(null);
   const noteInputRef = useRef<HTMLTextAreaElement>(null);
   const [position, setPosition] = useState<{ top: number; left: number } | null>(null);
@@ -153,7 +158,7 @@ export function EventDetailPopover({
   }, [event.virtualLocations]);
 
   const participants = useMemo(() => getParticipantList(event), [event]);
-  const recurrenceLabel = useMemo(() => getRecurrenceLabel(event, t, locale), [event, t, locale]);
+  const recurrenceLabel = useMemo(() => getRecurrenceLabel(event, t), [event, t]);
   const alertLabel = useMemo(() => getAlertLabel(event, t), [event, t]);
 
   const userIsOrganizer = useMemo(() => {
@@ -290,23 +295,20 @@ export function EventDetailPopover({
               className="w-2.5 h-2.5 rounded-full flex-shrink-0"
               style={{ backgroundColor: color }}
             />
-            <h3 className={cn(
-              "text-base font-semibold truncate text-foreground",
-              event.status === "cancelled" && "line-through text-muted-foreground"
-            )}>
+            <h3 className="text-base font-semibold truncate text-foreground">
               {event.title || t("events.no_title")}
             </h3>
           </div>
           {calendar && (
-            <p className="text-xs text-muted-foreground mt-0.5 ps-[18px]">
+            <p className="text-xs text-muted-foreground mt-0.5 pl-[18px]">
               {calendar.name}
               {event.status === "tentative" && (
-                <span className="ms-2 inline-flex items-center px-1.5 py-0.5 rounded text-[10px] font-medium bg-warning/15 text-warning">
+                <span className="ml-2 inline-flex items-center px-1.5 py-0.5 rounded text-[10px] font-medium bg-warning/15 text-warning">
                   {t("detail.tentative")}
                 </span>
               )}
               {event.status === "cancelled" && (
-                <span className="ms-2 inline-flex items-center px-1.5 py-0.5 rounded text-[10px] font-medium bg-red-100 text-red-800 dark:bg-red-900/30 dark:text-red-400 line-through">
+                <span className="ml-2 inline-flex items-center px-1.5 py-0.5 rounded text-[10px] font-medium bg-red-100 text-red-800 dark:bg-red-900/30 dark:text-red-400 line-through">
                   {t("detail.cancelled")}
                 </span>
               )}
@@ -346,13 +348,13 @@ export function EventDetailPopover({
                 <>
                   <div className="font-medium text-foreground">
                     {formatEventDate(startDate)}
-                    <span className="ms-1.5 font-normal text-muted-foreground">
+                    <span className="ml-1.5 font-normal text-muted-foreground">
                       {formatTime(startDate)}
                     </span>
                   </div>
                   <div className="font-medium text-foreground">
                     {formatEventDate(endDate)}
-                    <span className="ms-1.5 font-normal text-muted-foreground">
+                    <span className="ml-1.5 font-normal text-muted-foreground">
                       {formatTime(endDate)}
                     </span>
                   </div>
@@ -367,11 +369,11 @@ export function EventDetailPopover({
                   {formatEventDate(startDate)}
                 </span>
                 {event.showWithoutTime ? (
-                  <span className="text-muted-foreground ms-1.5">{t("events.all_day")}</span>
+                  <span className="text-muted-foreground ml-1.5">{t("events.all_day")}</span>
                 ) : (
                   <div className="text-muted-foreground">
                     {formatTime(startDate)} – {formatTime(endDate)}
-                    <span className="ms-1.5 text-xs">({formatDurationDisplay(durationMinutes)})</span>
+                    <span className="ml-1.5 text-xs">({formatDurationDisplay(durationMinutes)})</span>
                   </div>
                 )}
               </>
@@ -437,7 +439,7 @@ export function EventDetailPopover({
                     <span className="truncate text-foreground">
                       {p.name || p.email}
                       {p.isOrganizer && (
-                        <span className="text-muted-foreground ms-1">
+                        <span className="text-muted-foreground ml-1">
                           ({t("participants.organizer").toLowerCase()})
                         </span>
                       )}
@@ -515,7 +517,7 @@ export function EventDetailPopover({
                   disabled={!noteText.trim() || isSavingNote}
                   className="h-7 text-xs"
                 >
-                  <Send className="w-3 h-3 me-1" />
+                  <Send className="w-3 h-3 mr-1" />
                   {t("detail.save_note")}
                 </Button>
               </div>
@@ -549,7 +551,7 @@ export function EventDetailPopover({
                   : "text-success border-success/30 hover:bg-success/10"
               }
             >
-              {userCurrentStatus === "accepted" && <Check className="w-3.5 h-3.5 me-1" />}
+              {userCurrentStatus === "accepted" && <Check className="w-3.5 h-3.5 mr-1" />}
               {t("participants.accepted")}
             </Button>
             <Button
@@ -562,7 +564,7 @@ export function EventDetailPopover({
                   : "border border-warning/30 text-warning hover:bg-warning/10"
               }
             >
-              {userCurrentStatus === "tentative" && <Check className="w-3.5 h-3.5 me-1" />}
+              {userCurrentStatus === "tentative" && <Check className="w-3.5 h-3.5 mr-1" />}
               {t("participants.tentative")}
             </Button>
             <Button
@@ -575,7 +577,7 @@ export function EventDetailPopover({
                   : "text-destructive hover:bg-destructive/10"
               }
             >
-              {userCurrentStatus === "declined" && <Check className="w-3.5 h-3.5 me-1" />}
+              {userCurrentStatus === "declined" && <Check className="w-3.5 h-3.5 mr-1" />}
               {t("participants.declined")}
             </Button>
           </div>
@@ -609,7 +611,7 @@ export function EventDetailPopover({
         ) : (
           <>
             <Button variant="default" size="sm" onClick={onEdit} className="h-7 text-xs">
-              <Pencil className="w-3.5 h-3.5 me-1" />
+              <Pencil className="w-3.5 h-3.5 mr-1" />
               {t("events.edit")}
             </Button>
             <Button
@@ -619,7 +621,7 @@ export function EventDetailPopover({
               className="h-7 text-xs"
               title={t("events.duplicate")}
             >
-              <Copy className="w-3.5 h-3.5 me-1" />
+              <Copy className="w-3.5 h-3.5 mr-1" />
               {t("events.duplicate")}
             </Button>
             <div className="flex-1" />

components/calendar/event-modal.tsx

@@ -1,13 +1,12 @@
 "use client";
 
 import { useState, useEffect, useCallback, useRef, useMemo } from "react";
-import { useTranslations, useLocale } from "next-intl";
+import { useTranslations } from "next-intl";
 import { Button } from "@/components/ui/button";
 import { Input } from "@/components/ui/input";
 import { X, Trash2, Check, Users, CalendarDays, Copy, Pencil, Clock, MapPin, Video, Repeat, Bell, AlignLeft, Plus } from "lucide-react";
 import { format, parseISO, addHours, addDays, isSameDay } from "date-fns";
-import type { CalendarEvent, Calendar, CalendarParticipant, CalendarEventAlert, CalendarRecurrenceRule } from "@/lib/jmap/types";
-import { RecurrenceEditor, buildRecurrenceSummary, isSimpleRecurrenceRule } from "./recurrence-editor";
+import type { CalendarEvent, Calendar, CalendarParticipant, CalendarEventAlert } from "@/lib/jmap/types";
 import { parseDuration, getEventColor } from "./event-card";
 import { buildAllDayDuration, getEventDisplayEndDate, getEventEndDate, getEventStartDate, getPrimaryCalendarId } from "@/lib/calendar-utils";
 import { ParticipantInput, type ParticipantInputHandle } from "./participant-input";
@@ -76,7 +75,7 @@ function buildDuration(startDate: Date, endDate: Date): string {
   return dur;
 }
 
-type RecurrenceOption = "none" | "daily" | "weekly" | "monthly" | "yearly" | "custom";
+type RecurrenceOption = "none" | "daily" | "weekly" | "monthly" | "yearly";
 
 type AlertUnit = "at_time" | "minutes" | "hours" | "days" | "weeks";
 
@@ -158,9 +157,16 @@ function getAlertLabel(event: CalendarEvent, t: ReturnType<typeof useTranslation
   return labels.join(", ");
 }
 
-function getRecurrenceLabel(event: CalendarEvent, t: ReturnType<typeof useTranslations>, locale: string): string | null {
+function getRecurrenceLabel(event: CalendarEvent, t: ReturnType<typeof useTranslations>): string | null {
   if (!event.recurrenceRules?.length) return null;
-  return buildRecurrenceSummary(event.recurrenceRules[0], t, locale);
+  const freq = event.recurrenceRules[0].frequency;
+  const labels: Record<string, string> = {
+    daily: t("recurrence.daily"),
+    weekly: t("recurrence.weekly"),
+    monthly: t("recurrence.monthly"),
+    yearly: t("recurrence.yearly"),
+  };
+  return labels[freq] || null;
 }
 
 export function EventModal({
@@ -180,7 +186,6 @@ export function EventModal({
   isMobile = false,
 }: EventModalProps) {
   const t = useTranslations("calendar");
-  const locale = useLocale();
   const timeFormat = useSettingsStore((s) => s.timeFormat);
   const timeDisplayFmt = timeFormat === "12h" ? "h:mm a" : "HH:mm";
   const isEdit = !!event;
@@ -265,35 +270,8 @@ export function EventModal({
   });
   const [recurrence, setRecurrence] = useState<RecurrenceOption>(() => {
     if (!event?.recurrenceRules?.length) return "none";
-    const rule = event.recurrenceRules[0];
-    return isSimpleRecurrenceRule(rule) ? (rule.frequency as RecurrenceOption) : "custom";
+    return event.recurrenceRules[0].frequency as RecurrenceOption;
   });
-  const [customRule, setCustomRule] = useState<CalendarRecurrenceRule | null>(() => {
-    if (!event?.recurrenceRules?.length) return null;
-    const rule = event.recurrenceRules[0];
-    return isSimpleRecurrenceRule(rule) ? null : rule;
-  });
-  const [showRecurrenceEditor, setShowRecurrenceEditor] = useState(false);
-  // Dropdown value to restore when the custom editor is cancelled without a saved rule.
-  const recurrenceBeforeCustomRef = useRef<RecurrenceOption>("none");
-
-  const handleRecurrenceEditorSave = useCallback((rule: CalendarRecurrenceRule) => {
-    setCustomRule(rule);
-    setRecurrence("custom");
-    setShowRecurrenceEditor(false);
-  }, []);
-
-  const handleRecurrenceEditorCancel = useCallback(() => {
-    setShowRecurrenceEditor(false);
-    if (!customRule) {
-      setRecurrence(recurrenceBeforeCustomRef.current);
-    }
-  }, [customRule]);
-
-  const customRuleSummary = useMemo(
-    () => (customRule ? buildRecurrenceSummary(customRule, t, locale) : null),
-    [customRule, t, locale]
-  );
   const preservedAlertsRef = useRef<Record<string, CalendarEventAlert>>({});
   const [alertRows, setAlertRows] = useState<AlertRow[]>(() => {
     if (!event?.alerts) return [];
@@ -466,9 +444,7 @@ export function EventModal({
       data.virtualLocations = null;
     }
 
-    if (recurrence === "custom" && customRule) {
-      data.recurrenceRules = [customRule];
-    } else if (recurrence !== "none" && recurrence !== "custom") {
+    if (recurrence !== "none") {
       data.recurrenceRules = [{
         "@type": "RecurrenceRule",
         frequency: recurrence,
@@ -522,16 +498,10 @@ export function EventModal({
         { name: organizerName, email: organizerEmail },
         effectiveAttendees
       ) as Record<string, CalendarParticipant>;
-      // Stalwart (calcard) derives the iCalendar ORGANIZER property solely from
-      // organizerCalendarAddress; without it no ORGANIZER is emitted and iTIP
-      // scheduling is silently skipped (NoSchedulingInfo), so no invites are sent.
-      // The RFC 8984 replyTo property is retired in jscalendarbis and ignored.
-      data.organizerCalendarAddress = `mailto:${organizerEmail}`;
+      data.replyTo = { imip: `mailto:${organizerEmail}` };
     } else if (effectiveAttendees.length === 0 && event?.participants) {
       data.participants = null;
-      // Also clear the retired replyTo that older releases (<= 1.7.6) wrote.
       data.replyTo = null;
-      data.organizerCalendarAddress = null;
     }
 
     const shouldSendScheduling = effectiveAttendees.length > 0 && sendInvitations;
@@ -541,7 +511,7 @@ export function EventModal({
     } finally {
       setIsSaving(false);
     }
-  }, [title, description, location, virtualLocation, startDate, startTime, endDate, endTime, allDay, calendarId, recurrence, customRule, alertRows, attendees, sendInvitations, currentUserEmails, existingParticipants, event, onSave, isSaving]);
+  }, [title, description, location, virtualLocation, startDate, startTime, endDate, endTime, allDay, calendarId, recurrence, alertRows, attendees, sendInvitations, currentUserEmails, existingParticipants, event, onSave, isSaving]);
 
   const handleRsvp = useCallback((status: CalendarParticipant['participationStatus']) => {
     if (!event || !userParticipantId || !onRsvp) return;
@@ -623,6 +593,7 @@ export function EventModal({
 
   if (isAttendeeMode && event) {
     const startD = getEventStartDate(event);
+    const durMin = parseDuration(event.duration);
     const endD = getEventEndDate(event);
     const locationName = event.locations ? Object.values(event.locations)[0]?.name : null;
     const participants = getParticipantList(event);
@@ -666,11 +637,11 @@ export function EventModal({
                   <div className="text-sm">
                     <div>
                       <span className="font-medium">{formatEventDate(startD)}</span>
-                      <span className="text-muted-foreground ms-2">{format(startD, timeDisplayFmt)}</span>
+                      <span className="text-muted-foreground ml-2">{format(startD, timeDisplayFmt)}</span>
                     </div>
                     <div>
                       <span className="font-medium">{formatEventDate(endD)}</span>
-                      <span className="text-muted-foreground ms-2">{format(endD, timeDisplayFmt)}</span>
+                      <span className="text-muted-foreground ml-2">{format(endD, timeDisplayFmt)}</span>
                     </div>
                   </div>
                 );
@@ -679,7 +650,7 @@ export function EventModal({
                 <div className="text-sm">
                   <span className="font-medium">{formatEventDate(startD)}</span>
                   {!event.showWithoutTime && (
-                    <span className="text-muted-foreground ms-2">
+                    <span className="text-muted-foreground ml-2">
                       {format(startD, timeDisplayFmt)} – {format(endD, timeDisplayFmt)}
                     </span>
                   )}
@@ -701,7 +672,7 @@ export function EventModal({
                   <Users className="w-4 h-4" />
                   {t("participants.title")}
                 </div>
-                <div className="space-y-1 ps-5">
+                <div className="space-y-1 pl-5">
                   {participants.map(p => (
                     <div key={p.id} className="flex items-center justify-between text-sm">
                       <span className="truncate">{p.name || p.email}</span>
@@ -726,7 +697,7 @@ export function EventModal({
                   ? "bg-success hover:bg-success/80 text-success-foreground"
                   : "text-success border-success/30 hover:bg-success/10"}
               >
-                {userCurrentStatus === "accepted" && <Check className="w-4 h-4 me-1" />}
+                {userCurrentStatus === "accepted" && <Check className="w-4 h-4 mr-1" />}
                 {t("participants.accepted")}
               </Button>
               <Button
@@ -737,7 +708,7 @@ export function EventModal({
                   ? "bg-warning hover:bg-warning/80 text-warning-foreground"
                   : "border border-warning/30 text-warning hover:bg-warning/10"}
               >
-                {userCurrentStatus === "tentative" && <Check className="w-4 h-4 me-1" />}
+                {userCurrentStatus === "tentative" && <Check className="w-4 h-4 mr-1" />}
                 {t("participants.tentative")}
               </Button>
               <Button
@@ -748,7 +719,7 @@ export function EventModal({
                   ? "bg-destructive hover:bg-destructive/80 text-destructive-foreground"
                   : "text-destructive hover:bg-destructive/10"}
               >
-                {userCurrentStatus === "declined" && <Check className="w-4 h-4 me-1" />}
+                {userCurrentStatus === "declined" && <Check className="w-4 h-4 mr-1" />}
                 {t("participants.declined")}
               </Button>
             </div>
@@ -766,7 +737,7 @@ export function EventModal({
     const locationName = event.locations ? Object.values(event.locations)[0]?.name || null : null;
     const virtualLoc = event.virtualLocations ? Object.values(event.virtualLocations)[0]?.uri || null : null;
     const viewParticipants = getParticipantList(event);
-    const recurrenceLabel = getRecurrenceLabel(event, t, locale);
+    const recurrenceLabel = getRecurrenceLabel(event, t);
     const alertLabel = getAlertLabel(event, t);
     const eventCalendar = calendars.find(c => event.calendarIds[c.id]);
     const color = getEventColor(event, eventCalendar);
@@ -784,7 +755,7 @@ export function EventModal({
               <h2 className="text-lg font-semibold truncate">{event.title || t("events.no_title")}</h2>
             </div>
             {eventCalendar && (
-              <p className="text-xs text-muted-foreground mt-0.5 ps-[18px]">{eventCalendar.name}</p>
+              <p className="text-xs text-muted-foreground mt-0.5 pl-[18px]">{eventCalendar.name}</p>
             )}
           </div>
           <button onClick={onClose} className="p-1.5 rounded-md hover:bg-muted transition-colors duration-150 flex-shrink-0 mt-0.5 text-muted-foreground hover:text-foreground" aria-label={t("form.cancel")}>
@@ -816,13 +787,13 @@ export function EventModal({
                       <>
                         <div className="font-medium text-foreground">
                           {formatEventDate(startD)}
-                          <span className="ms-1.5 font-normal text-muted-foreground">
+                          <span className="ml-1.5 font-normal text-muted-foreground">
                             {format(startD, timeDisplayFmt)}
                           </span>
                         </div>
                         <div className="font-medium text-foreground">
                           {formatEventDate(endD)}
-                          <span className="ms-1.5 font-normal text-muted-foreground">
+                          <span className="ml-1.5 font-normal text-muted-foreground">
                             {format(endD, timeDisplayFmt)}
                           </span>
                         </div>
@@ -838,11 +809,11 @@ export function EventModal({
                         {formatEventDate(startD)}
                       </span>
                       {event.showWithoutTime ? (
-                        <span className="text-muted-foreground ms-1.5">{t("events.all_day")}</span>
+                        <span className="text-muted-foreground ml-1.5">{t("events.all_day")}</span>
                       ) : (
                         <div className="text-muted-foreground">
                           {format(startD, timeDisplayFmt)} – {format(endD, timeDisplayFmt)}
-                          <span className="ms-1.5 text-xs">({formatDurationDisplay(durMin)})</span>
+                          <span className="ml-1.5 text-xs">({formatDurationDisplay(durMin)})</span>
                         </div>
                       )}
                     </>
@@ -889,7 +860,7 @@ export function EventModal({
                         <span className="truncate text-foreground">
                           {p.name || p.email}
                           {p.isOrganizer && (
-                            <span className="text-muted-foreground ms-1">({t("participants.organizer").toLowerCase()})</span>
+                            <span className="text-muted-foreground ml-1">({t("participants.organizer").toLowerCase()})</span>
                           )}
                         </span>
                         <StatusBadge status={p.status} isOrganizer={p.isOrganizer} t={t} />
@@ -942,21 +913,21 @@ export function EventModal({
                 </div>
               ) : (
                 <Button variant="ghost" size="sm" onClick={() => setShowDeleteConfirm(true)} className="text-destructive">
-                  <Trash2 className="w-4 h-4 me-1" />
+                  <Trash2 className="w-4 h-4 mr-1" />
                   {t("events.delete")}
                 </Button>
               )
             )}
             {onDuplicate && !showDeleteConfirm && (
               <Button variant="ghost" size="sm" onClick={handleDuplicate} aria-label={t("events.duplicate")}>
-                <Copy className="w-4 h-4 me-1" />
+                <Copy className="w-4 h-4 mr-1" />
                 {t("events.duplicate")}
               </Button>
             )}
           </div>
           {!showDeleteConfirm && (
             <Button onClick={() => setMode("edit")}>
-              <Pencil className="w-4 h-4 me-1" />
+              <Pencil className="w-4 h-4 mr-1" />
               {t("events.edit")}
             </Button>
           )}
@@ -1160,51 +1131,17 @@ export function EventModal({
 
           <div>
             <label className="text-sm font-medium mb-1 block">{t("recurrence.title")}</label>
-            <div className="flex items-center gap-2">
-              <select
-                value={recurrence}
-                onChange={(e) => {
-                  const value = e.target.value as RecurrenceOption;
-                  if (value === "custom") {
-                    recurrenceBeforeCustomRef.current = recurrence;
-                    setRecurrence("custom");
-                    setShowRecurrenceEditor(true);
-                  } else {
-                    setRecurrence(value);
-                    setShowRecurrenceEditor(false);
-                  }
-                }}
-                className="flex-1 min-w-0 rounded-md border border-input bg-background px-3 py-2 text-sm focus:outline-none focus:ring-2 focus:ring-ring"
-              >
-                <option value="none">{t("recurrence.none")}</option>
-                <option value="daily">{t("recurrence.daily")}</option>
-                <option value="weekly">{t("recurrence.weekly")}</option>
-                <option value="monthly">{t("recurrence.monthly")}</option>
-                <option value="yearly">{t("recurrence.yearly")}</option>
-                <option value="custom">{customRuleSummary || t("recurrence.custom")}</option>
-              </select>
-              {recurrence === "custom" && !showRecurrenceEditor && (
-                <button
-                  type="button"
-                  onClick={() => setShowRecurrenceEditor(true)}
-                  className="p-2 rounded-md text-muted-foreground hover:text-foreground hover:bg-muted transition-colors"
-                  aria-label={t("recurrence.edit_custom")}
-                >
-                  <Pencil className="w-4 h-4" />
-                </button>
-              )}
-            </div>
-            {showRecurrenceEditor && (
-              <RecurrenceEditor
-                rule={customRule}
-                eventStart={(() => {
-                  const d = new Date(`${startDate}T${allDay ? "00:00" : (startTime || "00:00")}:00`);
-                  return isNaN(d.getTime()) ? new Date() : d;
-                })()}
-                onSave={handleRecurrenceEditorSave}
-                onCancel={handleRecurrenceEditorCancel}
-              />
-            )}
+            <select
+              value={recurrence}
+              onChange={(e) => setRecurrence(e.target.value as RecurrenceOption)}
+              className="w-full rounded-md border border-input bg-background px-3 py-2 text-sm focus:outline-none focus:ring-2 focus:ring-ring"
+            >
+              <option value="none">{t("recurrence.none")}</option>
+              <option value="daily">{t("recurrence.daily")}</option>
+              <option value="weekly">{t("recurrence.weekly")}</option>
+              <option value="monthly">{t("recurrence.monthly")}</option>
+              <option value="yearly">{t("recurrence.yearly")}</option>
+            </select>
           </div>
 
           <div>
@@ -1320,7 +1257,7 @@ export function EventModal({
                 onClick={() => setShowDeleteConfirm(true)}
                 className="text-red-600 dark:text-red-400"
               >
-                <Trash2 className="w-4 h-4 me-1" />
+                <Trash2 className="w-4 h-4 mr-1" />
                 {t("events.delete")}
               </Button>
             )
@@ -1332,7 +1269,7 @@ export function EventModal({
               onClick={handleDuplicate}
               aria-label={t("events.duplicate")}
             >
-              <Copy className="w-4 h-4 me-1" />
+              <Copy className="w-4 h-4 mr-1" />
               {t("events.duplicate")}
             </Button>
           )}

components/calendar/ical-import-modal.tsx

@@ -4,7 +4,7 @@ import { useState, useCallback, useRef, useEffect } from "react";
 import { useTranslations } from "next-intl";
 import { Button } from "@/components/ui/button";
 import { X, Upload, Check, Loader2, RefreshCw, Globe } from "lucide-react";
-import { format } from "date-fns";
+import { format, parseISO } from "date-fns";
 import type { CalendarEvent, Calendar } from "@/lib/jmap/types";
 import type { IJMAPClient } from '@/lib/jmap/client-interface';
 import { getEventStartDate } from "@/lib/calendar-utils";
@@ -444,7 +444,7 @@ export function ICalImportModal({ calendars, client, onClose, initialUrl }: ICal
                 onClick={handleImport}
                 disabled={selectedIndices.size === 0}
               >
-                <Check className="w-4 h-4 me-1" />
+                <Check className="w-4 h-4 mr-1" />
                 {t("import_button")} ({selectedIndices.size})
               </Button>
             )}

components/calendar/ical-subscription-modal.tsx

@@ -208,7 +208,7 @@ export function ICalSubscriptionModal({ client, onClose, editSubscription, initi
           <Button onClick={handleSubmit} disabled={!isValid || isSubmitting}>
             {isSubmitting ? (
               <>
-                <Loader2 className="w-4 h-4 animate-spin me-2" />
+                <Loader2 className="w-4 h-4 animate-spin mr-2" />
                 {isEdit ? t("saving") : t("subscribing")}
               </>
             ) : (

components/calendar/mini-calendar.tsx

@@ -1,19 +1,25 @@
 "use client";
 
 import { useState, useMemo, Fragment } from "react";
-import { useTranslations } from "next-intl";
+import { useTranslations, useFormatter } from "next-intl";
 import { ChevronLeft, ChevronRight, ChevronDown } from "lucide-react";
 import {
+  startOfMonth, endOfMonth, startOfWeek, endOfWeek,
   addMonths, subMonths, addYears, subYears, setMonth, setYear,
-  getISOWeek, getWeek, format,
+  eachDayOfInterval, getMonth, getYear, getISOWeek, getWeek,
+  isSameDay, isSameMonth, isToday, format,
 } from "date-fns";
 import { cn } from "@/lib/utils";
 import { getEventDayBounds } from "@/lib/calendar-utils";
 import type { CalendarEvent } from "@/lib/jmap/types";
-import { useCalendarLocale } from "@/hooks/use-calendar-locale";
 
 type PickerView = "days" | "months" | "years";
 
+const MONTH_LABELS = [
+  "Jan", "Feb", "Mar", "Apr", "May", "Jun",
+  "Jul", "Aug", "Sep", "Oct", "Nov", "Dec",
+];
+
 interface MiniCalendarProps {
   selectedDate: Date;
   displayMonth: Date;
@@ -34,25 +40,17 @@ export function MiniCalendar({
   showWeekNumbers = false,
 }: MiniCalendarProps) {
   const t = useTranslations("calendar");
-  const {
-    weekStartsOn,
-    dayHeaderKeys,
-    getMonthGridDays,
-    checkIsToday,
-    checkIsSameMonth,
-    checkIsSameDay,
-    formatDayNumber,
-    formatMonthYear,
-    getMonth,
-    getYear,
-    monthLabelKeys,
-  } = useCalendarLocale();
+  const intlFormatter = useFormatter();
+  const weekStart = (firstDayOfWeek === 0 ? 0 : 1) as 0 | 1;
   const [pickerView, setPickerView] = useState<PickerView>("days");
 
-  const days = useMemo(
-    () => getMonthGridDays(displayMonth),
-    [displayMonth, getMonthGridDays],
-  );
+  const days = useMemo(() => {
+    const monthStart = startOfMonth(displayMonth);
+    const monthEnd = endOfMonth(displayMonth);
+    const gridStart = startOfWeek(monthStart, { weekStartsOn: weekStart });
+    const gridEnd = endOfWeek(monthEnd, { weekStartsOn: weekStart });
+    return eachDayOfInterval({ start: gridStart, end: gridEnd });
+  }, [displayMonth, weekStart]);
 
   const eventDates = useMemo(() => {
     const set = new Set<string>();
@@ -69,16 +67,20 @@ export function MiniCalendar({
     return set;
   }, [events]);
 
+  const dayHeaders = firstDayOfWeek === 0
+    ? ["sun", "mon", "tue", "wed", "thu", "fri", "sat"] as const
+    : ["mon", "tue", "wed", "thu", "fri", "sat", "sun"] as const;
+
   // Compute week numbers for each row (one per 7-day chunk)
   const weekNumbers = useMemo(() => {
     if (!showWeekNumbers) return [];
     const nums: number[] = [];
     for (let i = 0; i < days.length; i += 7) {
       // Use the first day of each row to determine the week number
-      nums.push(weekStartsOn === 1 ? getISOWeek(days[i]) : getWeek(days[i], { weekStartsOn: 0 }));
+      nums.push(weekStart === 1 ? getISOWeek(days[i]) : getWeek(days[i], { weekStartsOn: 0 }));
     }
     return nums;
-  }, [days, showWeekNumbers, weekStartsOn]);
+  }, [days, showWeekNumbers, weekStart]);
 
   const currentYear = getYear(displayMonth);
   const currentMonth = getMonth(displayMonth);
@@ -114,7 +116,7 @@ export function MiniCalendar({
 
   const headerLabel =
     pickerView === "days"
-      ? formatMonthYear(displayMonth)
+      ? intlFormatter.dateTime(displayMonth, { month: "long", year: "numeric" })
       : pickerView === "months"
         ? String(currentYear)
         : `${decadeStart}\u2013${decadeStart + 9}`;
@@ -158,15 +160,15 @@ export function MiniCalendar({
           {showWeekNumbers && (
             <div className="text-center text-[10px] font-medium text-muted-foreground py-1 w-5" />
           )}
-          {dayHeaderKeys.map((d) => (
+          {dayHeaders.map((d) => (
             <div key={d} className="text-center text-[10px] font-medium text-muted-foreground py-1">
               {t(`days.${d}`)}
             </div>
           ))}
           {days.map((day, index) => {
-            const inMonth = checkIsSameMonth(day, displayMonth);
-            const selected = checkIsSameDay(day, selectedDate);
-            const today = checkIsToday(day);
+            const inMonth = isSameMonth(day, displayMonth);
+            const selected = isSameDay(day, selectedDate);
+            const today = isToday(day);
             const hasEvent = eventDates.has(format(day, "yyyy-MM-dd"));
             const isFirstDayOfRow = index % 7 === 0;
 
@@ -191,7 +193,7 @@ export function MiniCalendar({
                     selected && "bg-primary text-primary-foreground"
                   )}
                 >
-                  {formatDayNumber(day)}
+                  {format(day, "d")}
                   {hasEvent && !selected && (
                     <span className="absolute bottom-0.5 left-1/2 -translate-x-1/2 w-1 h-1 rounded-full bg-primary" />
                   )}
@@ -204,7 +206,7 @@ export function MiniCalendar({
 
       {pickerView === "months" && (
         <div className="grid grid-cols-3 gap-1 py-1">
-          {monthLabelKeys.map((labelKey, i) => {
+          {MONTH_LABELS.map((label, i) => {
             const isCurrentMonth = i === currentMonth && currentYear === getYear(new Date());
             const isSelected = i === getMonth(selectedDate) && currentYear === getYear(selectedDate);
             return (
@@ -218,7 +220,7 @@ export function MiniCalendar({
                   !isSelected && !isCurrentMonth && "hover:bg-muted"
                 )}
               >
-                {t(`months.${labelKey}`)}
+                {label}
               </button>
             );
           })}

components/calendar/participant-input.tsx

@@ -4,7 +4,6 @@ import { useState, useRef, useCallback, useEffect, forwardRef, useImperativeHand
 import { useTranslations } from "next-intl";
 import { X } from "lucide-react";
 import { Input } from "@/components/ui/input";
-import { Avatar } from "@/components/ui/avatar";
 import { useContactStore } from "@/stores/contact-store";
 
 interface Participant {
@@ -145,17 +144,14 @@ export const ParticipantInput = forwardRef<ParticipantInputHandle, ParticipantIn
                 role="option"
                 aria-selected={i === activeIndex}
                 onMouseDown={(e) => { e.preventDefault(); addParticipant(s); }}
-                className={`px-3 py-2 text-sm cursor-pointer transition-colors flex items-center gap-2 ${
+                className={`px-3 py-2 text-sm cursor-pointer transition-colors ${
                   i === activeIndex ? "bg-accent text-accent-foreground" : "hover:bg-muted"
                 }`}
               >
-                <Avatar name={s.name} email={s.email} size="sm" className="shrink-0 w-7 h-7 text-[10px]" />
-                <div className="min-w-0">
-                  <div className="font-medium truncate">{s.name || s.email}</div>
-                  {s.name && (
-                    <div className="text-xs text-muted-foreground truncate">{s.email}</div>
-                  )}
-                </div>
+                <div className="font-medium truncate">{s.name || s.email}</div>
+                {s.name && (
+                  <div className="text-xs text-muted-foreground truncate">{s.email}</div>
+                )}
               </li>
             ))}
           </ul>

components/calendar/recurrence-editor.tsx

@@ -1,427 +0,0 @@
-"use client";
-
-import { useState } from "react";
-import { useLocale, useTranslations } from "next-intl";
-import { addYears, format } from "date-fns";
-import { Button } from "@/components/ui/button";
-import { Input } from "@/components/ui/input";
-import type { CalendarRecurrenceRule } from "@/lib/jmap/types";
-
-type EditorFrequency = "daily" | "weekly" | "monthly" | "yearly";
-type MonthlyMode = "day" | "nth";
-type EndsMode = "never" | "on" | "after";
-
-const EDITOR_FREQUENCIES: EditorFrequency[] = ["daily", "weekly", "monthly", "yearly"];
-
-// 2024-01-01 is a Monday - used to render localized weekday names via Intl.
-const WEEKDAYS: string[] = ["mo", "tu", "we", "th", "fr", "sa", "su"];
-const DAY_TO_REF_DATE: Record<string, number> = { mo: 1, tu: 2, we: 3, th: 4, fr: 5, sa: 6, su: 7 };
-const INDEX_TO_DAY = ["su", "mo", "tu", "we", "th", "fr", "sa"];
-
-const UNIT_LABEL_KEYS: Record<EditorFrequency, string> = {
-  daily: "recurrence.editor_unit_days",
-  weekly: "recurrence.editor_unit_weeks",
-  monthly: "recurrence.editor_unit_months",
-  yearly: "recurrence.editor_unit_years",
-};
-
-type CalendarT = ReturnType<typeof useTranslations>;
-
-function weekdayName(day: string, locale: string, style: "long" | "short" = "long"): string {
-  const ref = new Date(2024, 0, DAY_TO_REF_DATE[day] ?? 1);
-  return new Intl.DateTimeFormat(locale, { weekday: style }).format(ref);
-}
-
-function monthName(month: number, locale: string): string {
-  return new Intl.DateTimeFormat(locale, { month: "long" }).format(new Date(2024, month - 1, 1));
-}
-
-function nthLabel(nth: number, t: CalendarT): string {
-  if (nth === -1) return t("recurrence.nth_last");
-  if (nth >= 1 && nth <= 4) return t(`recurrence.nth_${nth}`);
-  return String(nth);
-}
-
-function capitalize(s: string): string {
-  return s.charAt(0).toUpperCase() + s.slice(1);
-}
-
-/**
- * Extract an "nth weekday" pattern from a rule, accepting both the
- * byDay+nthOfPeriod encoding and the byDay+bySetPosition encoding.
- */
-function getNthDay(rule: CalendarRecurrenceRule): { day: string; nth: number } | null {
-  if (rule.byDay?.length === 1) {
-    const nd = rule.byDay[0];
-    if (nd.nthOfPeriod) return { day: nd.day, nth: nd.nthOfPeriod };
-    if (rule.bySetPosition?.length === 1) return { day: nd.day, nth: rule.bySetPosition[0] };
-  }
-  return null;
-}
-
-/**
- * True when the rule is exactly what the plain Daily/Weekly/Monthly/Yearly
- * dropdown presets produce, i.e. it needs no custom editor to represent.
- */
-export function isSimpleRecurrenceRule(rule: CalendarRecurrenceRule): boolean {
-  return (
-    (EDITOR_FREQUENCIES as string[]).includes(rule.frequency) &&
-    (!rule.interval || rule.interval === 1) &&
-    !rule.byDay?.length &&
-    !rule.byMonthDay?.length &&
-    !rule.byMonth?.length &&
-    !rule.byYearDay?.length &&
-    !rule.byWeekNo?.length &&
-    !rule.bySetPosition?.length &&
-    !rule.count &&
-    !rule.until
-  );
-}
-
-/**
- * Human-readable summary of a recurrence rule, e.g.
- * "Every 2 months on the third Thursday · 12 occurrences".
- * Returns null for frequencies the UI cannot describe (hourly etc.).
- */
-export function buildRecurrenceSummary(
-  rule: CalendarRecurrenceRule,
-  t: CalendarT,
-  locale: string,
-): string | null {
-  const interval = rule.interval || 1;
-  let base: string;
-  switch (rule.frequency) {
-    case "daily":
-      base = interval > 1 ? t("recurrence.every_n_days", { count: interval }) : t("recurrence.daily");
-      break;
-    case "weekly":
-      base = interval > 1 ? t("recurrence.every_n_weeks", { count: interval }) : t("recurrence.weekly");
-      break;
-    case "monthly":
-      base = interval > 1 ? t("recurrence.every_n_months", { count: interval }) : t("recurrence.monthly");
-      break;
-    case "yearly":
-      base = interval > 1 ? t("recurrence.every_n_years", { count: interval }) : t("recurrence.yearly");
-      break;
-    default:
-      return null;
-  }
-
-  const parts = [base];
-
-  if (rule.frequency === "weekly" && rule.byDay?.length) {
-    const days = rule.byDay
-      .filter((d) => WEEKDAYS.includes(d.day))
-      .sort((a, b) => WEEKDAYS.indexOf(a.day) - WEEKDAYS.indexOf(b.day))
-      .map((d) => weekdayName(d.day, locale, "short"))
-      .join(", ");
-    if (days) parts.push(t("recurrence.on_days", { days }));
-  }
-
-  if (rule.frequency === "monthly" || rule.frequency === "yearly") {
-    if (rule.frequency === "yearly" && rule.byMonth?.length) {
-      const m = parseInt(rule.byMonth[0], 10);
-      if (m >= 1 && m <= 12) parts.push(t("recurrence.in_month", { month: monthName(m, locale) }));
-    }
-    const nthDay = getNthDay(rule);
-    if (nthDay) {
-      parts.push(t("recurrence.on_the_nth", {
-        nth: nthLabel(nthDay.nth, t),
-        day: weekdayName(nthDay.day, locale),
-      }));
-    } else if (rule.byMonthDay?.length) {
-      parts.push(t("recurrence.on_day_n", { day: rule.byMonthDay[0] }));
-    }
-  }
-
-  let summary = parts.join(" ");
-  if (rule.count) {
-    summary += ` · ${t("recurrence.occurrences", { count: rule.count })}`;
-  } else if (rule.until) {
-    const d = new Date(rule.until);
-    if (!isNaN(d.getTime())) {
-      summary += ` · ${t("recurrence.until")} ${new Intl.DateTimeFormat(locale, { dateStyle: "medium" }).format(d)}`;
-    }
-  }
-  return summary;
-}
-
-interface RecurrenceEditorProps {
-  rule: CalendarRecurrenceRule | null;
-  eventStart: Date;
-  onSave: (rule: CalendarRecurrenceRule) => void;
-  onCancel: () => void;
-}
-
-export function RecurrenceEditor({ rule, eventStart, onSave, onCancel }: RecurrenceEditorProps) {
-  const t = useTranslations("calendar");
-  const locale = useLocale();
-
-  const startDay = INDEX_TO_DAY[eventStart.getDay()];
-  const initialNthDay = rule ? getNthDay(rule) : null;
-
-  const [frequency, setFrequency] = useState<EditorFrequency>(() =>
-    rule && (EDITOR_FREQUENCIES as string[]).includes(rule.frequency)
-      ? (rule.frequency as EditorFrequency)
-      : "weekly"
-  );
-  const [interval, setIntervalValue] = useState<number>(rule?.interval || 1);
-  const [weekDays, setWeekDays] = useState<string[]>(() => {
-    if (rule?.frequency === "weekly" && rule.byDay?.length) {
-      const days = rule.byDay.map((d) => d.day).filter((d) => WEEKDAYS.includes(d));
-      if (days.length) return days;
-    }
-    return [startDay];
-  });
-  const [monthlyMode, setMonthlyMode] = useState<MonthlyMode>(initialNthDay ? "nth" : "day");
-  const [monthDay, setMonthDay] = useState<number>(() => {
-    const md = rule?.byMonthDay?.[0];
-    return md && md >= 1 && md <= 31 ? md : eventStart.getDate();
-  });
-  const [nth, setNth] = useState<number>(() => {
-    if (initialNthDay && (initialNthDay.nth === -1 || (initialNthDay.nth >= 1 && initialNthDay.nth <= 4))) {
-      return initialNthDay.nth;
-    }
-    return Math.min(4, Math.floor((eventStart.getDate() - 1) / 7) + 1);
-  });
-  const [nthDay, setNthDay] = useState<string>(() =>
-    initialNthDay && WEEKDAYS.includes(initialNthDay.day) ? initialNthDay.day : startDay
-  );
-  const [month, setMonth] = useState<number>(() => {
-    const m = rule?.byMonth?.length ? parseInt(rule.byMonth[0], 10) : NaN;
-    return m >= 1 && m <= 12 ? m : eventStart.getMonth() + 1;
-  });
-  const [endsMode, setEndsMode] = useState<EndsMode>(rule?.count ? "after" : rule?.until ? "on" : "never");
-  const [untilDate, setUntilDate] = useState<string>(() => {
-    if (rule?.until) {
-      const d = new Date(rule.until);
-      if (!isNaN(d.getTime())) return format(d, "yyyy-MM-dd");
-    }
-    return format(addYears(eventStart, 1), "yyyy-MM-dd");
-  });
-  const [count, setCount] = useState<number>(rule?.count ?? 12);
-
-  const toggleWeekDay = (day: string) => {
-    setWeekDays((prev) =>
-      prev.includes(day)
-        ? prev.length > 1 ? prev.filter((d) => d !== day) : prev
-        : [...prev, day]
-    );
-  };
-
-  const buildRule = (): CalendarRecurrenceRule => {
-    const built: CalendarRecurrenceRule = {
-      "@type": "RecurrenceRule",
-      frequency,
-      interval: Math.max(1, interval),
-      rscale: "gregorian",
-      skip: "omit",
-      firstDayOfWeek: "mo",
-      byDay: null,
-      byMonthDay: null,
-      byMonth: null,
-      byYearDay: null,
-      byWeekNo: null,
-      byHour: null,
-      byMinute: null,
-      bySecond: null,
-      bySetPosition: null,
-      count: endsMode === "after" ? Math.max(1, count) : null,
-      until: endsMode === "on" && untilDate ? `${untilDate}T23:59:59` : null,
-    };
-
-    if (frequency === "weekly") {
-      const days = weekDays.length ? weekDays : [startDay];
-      built.byDay = WEEKDAYS.filter((d) => days.includes(d)).map((day) => ({ day }));
-    } else if (frequency === "monthly" || frequency === "yearly") {
-      if (monthlyMode === "nth") {
-        built.byDay = [{ day: nthDay, nthOfPeriod: nth }];
-      } else {
-        built.byMonthDay = [Math.min(31, Math.max(1, monthDay))];
-      }
-      if (frequency === "yearly") {
-        built.byMonth = [String(month)];
-      }
-    }
-
-    return built;
-  };
-
-  const handleSave = () => onSave(buildRule());
-
-  const summary = buildRecurrenceSummary(buildRule(), t, locale);
-
-  const selectCls = "rounded-md border border-input bg-background px-3 py-2 text-sm focus:outline-none focus:ring-2 focus:ring-ring";
-
-  return (
-    <div className="mt-2 rounded-md border border-border bg-muted/20 p-3 space-y-3">
-      <div className="flex items-center gap-2 text-sm">
-        <span className="shrink-0">{t("recurrence.editor_every")}</span>
-        <Input
-          type="number"
-          min={1}
-          max={999}
-          value={interval}
-          onChange={(e) => {
-            const n = parseInt(e.target.value, 10);
-            setIntervalValue(Number.isFinite(n) ? Math.max(1, n) : 1);
-          }}
-          className="w-16 shrink-0"
-          aria-label={t("recurrence.editor_every")}
-        />
-        <select
-          value={frequency}
-          onChange={(e) => setFrequency(e.target.value as EditorFrequency)}
-          className={`${selectCls} flex-1 min-w-0`}
-          aria-label={t("recurrence.title")}
-        >
-          {EDITOR_FREQUENCIES.map((f) => (
-            <option key={f} value={f}>{t(UNIT_LABEL_KEYS[f])}</option>
-          ))}
-        </select>
-      </div>
-
-      {frequency === "weekly" && (
-        <div className="flex gap-1">
-          {WEEKDAYS.map((day) => (
-            <button
-              key={day}
-              type="button"
-              onClick={() => toggleWeekDay(day)}
-              title={weekdayName(day, locale)}
-              aria-pressed={weekDays.includes(day)}
-              className={
-                weekDays.includes(day)
-                  ? "flex-1 min-w-0 px-1 py-1.5 text-xs font-medium rounded-md border border-primary text-primary bg-primary/10 transition-colors"
-                  : "flex-1 min-w-0 px-1 py-1.5 text-xs font-medium rounded-md border border-input text-muted-foreground hover:text-foreground hover:bg-muted transition-colors"
-              }
-            >
-              {weekdayName(day, locale, "short")}
-            </button>
-          ))}
-        </div>
-      )}
-
-      {frequency === "yearly" && (
-        <div className="flex items-center gap-2 text-sm">
-          <span className="shrink-0">{capitalize(t("recurrence.editor_in"))}</span>
-          <select
-            value={month}
-            onChange={(e) => setMonth(parseInt(e.target.value, 10))}
-            className={`${selectCls} flex-1 min-w-0`}
-            aria-label={t("recurrence.editor_in")}
-          >
-            {Array.from({ length: 12 }, (_, i) => i + 1).map((m) => (
-              <option key={m} value={m}>{capitalize(monthName(m, locale))}</option>
-            ))}
-          </select>
-        </div>
-      )}
-
-      {(frequency === "monthly" || frequency === "yearly") && (
-        <div className="flex items-center gap-2 text-sm">
-          <select
-            value={monthlyMode}
-            onChange={(e) => setMonthlyMode(e.target.value as MonthlyMode)}
-            className={`${selectCls} shrink-0`}
-            aria-label={t("recurrence.editor_repeats_on")}
-          >
-            <option value="day">{capitalize(t("recurrence.editor_on_day"))}</option>
-            <option value="nth">{capitalize(t("recurrence.editor_on_the"))}</option>
-          </select>
-          {monthlyMode === "day" ? (
-            <Input
-              type="number"
-              min={1}
-              max={31}
-              value={monthDay}
-              onChange={(e) => {
-                const n = parseInt(e.target.value, 10);
-                setMonthDay(Number.isFinite(n) ? Math.min(31, Math.max(1, n)) : 1);
-              }}
-              className="w-16 shrink-0"
-              aria-label={t("recurrence.editor_on_day")}
-            />
-          ) : (
-            <>
-              <select
-                value={nth}
-                onChange={(e) => setNth(parseInt(e.target.value, 10))}
-                className={`${selectCls} flex-1 min-w-0`}
-                aria-label={t("recurrence.editor_on_the")}
-              >
-                {[1, 2, 3, 4, -1].map((n) => (
-                  <option key={n} value={n}>{capitalize(nthLabel(n, t))}</option>
-                ))}
-              </select>
-              <select
-                value={nthDay}
-                onChange={(e) => setNthDay(e.target.value)}
-                className={`${selectCls} flex-1 min-w-0`}
-                aria-label={t("recurrence.editor_on_the")}
-              >
-                {WEEKDAYS.map((d) => (
-                  <option key={d} value={d}>{capitalize(weekdayName(d, locale))}</option>
-                ))}
-              </select>
-            </>
-          )}
-        </div>
-      )}
-
-      <div className="flex items-center gap-2 text-sm">
-        <span className="shrink-0">{t("recurrence.editor_ends")}</span>
-        <select
-          value={endsMode}
-          onChange={(e) => setEndsMode(e.target.value as EndsMode)}
-          className={`${selectCls} ${endsMode === "never" ? "flex-1" : "shrink-0"} min-w-0`}
-          aria-label={t("recurrence.editor_ends")}
-        >
-          <option value="never">{t("recurrence.editor_never")}</option>
-          <option value="on">{t("recurrence.until")}</option>
-          <option value="after">{t("recurrence.editor_ends_after")}</option>
-        </select>
-        {endsMode === "on" && (
-          <input
-            type="date"
-            value={untilDate}
-            onChange={(e) => setUntilDate(e.target.value)}
-            className={`${selectCls} flex-1 min-w-0`}
-            aria-label={t("recurrence.editor_ends_on")}
-          />
-        )}
-        {endsMode === "after" && (
-          <>
-            <Input
-              type="number"
-              min={1}
-              max={999}
-              value={count}
-              onChange={(e) => {
-                const n = parseInt(e.target.value, 10);
-                setCount(Number.isFinite(n) ? Math.max(1, n) : 1);
-              }}
-              className="w-16 shrink-0"
-              aria-label={t("recurrence.editor_ends_after")}
-            />
-            <span className="text-muted-foreground truncate">{t("recurrence.editor_occurrences")}</span>
-          </>
-        )}
-      </div>
-
-      <div className="flex items-center justify-between gap-3 border-t border-border pt-3">
-        <p className="text-xs text-muted-foreground truncate min-w-0" title={summary ?? undefined}>
-          {summary}
-        </p>
-        <div className="flex gap-2 shrink-0">
-          <Button variant="outline" size="sm" onClick={onCancel}>
-            {t("form.cancel")}
-          </Button>
-          <Button size="sm" onClick={handleSave}>
-            {t("form.save")}
-          </Button>
-        </div>
-      </div>
-    </div>
-  );
-}

components/calendar/task-modal.tsx

@@ -302,7 +302,7 @@ export function TaskModal({
               className="text-destructive hover:text-destructive"
               onClick={() => onDelete(task.id)}
             >
-              <Trash2 className="h-4 w-4 me-1" />
+              <Trash2 className="h-4 w-4 mr-1" />
               {t("tasks.delete")}
             </Button>
           )}

components/calendar/task-toolbar.tsx

@@ -44,7 +44,7 @@ export function TaskToolbar({
         ))}
       </div>
 
-      <label className="flex items-center gap-1.5 text-xs text-muted-foreground cursor-pointer select-none ms-2">
+      <label className="flex items-center gap-1.5 text-xs text-muted-foreground cursor-pointer select-none ml-2">
         <input
           type="checkbox"
           checked={showCompleted}
@@ -57,7 +57,7 @@ export function TaskToolbar({
       <div className="flex-1" />
 
       <Button size="sm" onClick={onCreateTask}>
-        <Plus className="w-4 h-4 me-1" />
+        <Plus className="w-4 h-4 mr-1" />
         {t("tasks.create")}
       </Button>
     </div>

components/contacts/__tests__/contact-form.test.tsx

@@ -62,27 +62,6 @@ describe('ContactForm', () => {
     expect(phoneAfter.length).toBe(phoneBefore.length + 1);
   });
 
-  it('sends media: null when an existing photo is removed', async () => {
-    const onSave = vi.fn().mockResolvedValue(undefined);
-    const contactWithPhoto: ContactCard = {
-      ...existingContact,
-      media: {
-        photo: { kind: 'photo', uri: 'data:image/png;base64,AAAA', mediaType: 'image/png' },
-      },
-    };
-    render(<ContactForm contact={contactWithPhoto} onSave={onSave} onCancel={vi.fn()} />);
-
-    fireEvent.click(screen.getByText('remove_photo'));
-    fireEvent.submit(screen.getByText('save').closest('form')!);
-
-    await waitFor(() => {
-      expect(onSave).toHaveBeenCalledOnce();
-    });
-
-    const savedData = onSave.mock.calls[0][0];
-    expect(savedData.media).toBeNull();
-  });
-
   it('submits form data correctly', async () => {
     const onSave = vi.fn().mockResolvedValue(undefined);
     render(<ContactForm onSave={onSave} onCancel={vi.fn()} />);

components/contacts/__tests__/contacts-sidebar.test.tsx

@@ -1,65 +0,0 @@
-import { render, screen } from '@testing-library/react';
-import { fireEvent } from '@testing-library/dom';
-import { describe, it, expect, vi, beforeEach } from 'vitest';
-import { ContactsSidebar } from '../contacts-sidebar';
-import type { ContactCard } from '@/lib/jmap/types';
-
-// next-intl + next/navigation are mocked globally in vitest.setup (t returns the key).
-vi.mock('@/stores/account-store', () => {
-  const state = { accounts: [], activeAccountId: null };
-  const hook = (sel?: (s: typeof state) => unknown) =>
-    typeof sel === 'function' ? sel(state) : state;
-  hook.getState = () => state;
-  return { useAccountStore: hook };
-});
-
-const group = {
-  id: 'g1',
-  kind: 'group',
-  name: { full: 'Team' },
-  members: { '1': true },
-} as unknown as ContactCard;
-
-function renderSidebar(onComposeGroup = vi.fn()) {
-  render(
-    <ContactsSidebar
-      groups={[group]}
-      individuals={[]}
-      addressBooks={[]}
-      activeCategory="all"
-      onSelectCategory={vi.fn()}
-      onCreateGroup={vi.fn()}
-      onCreateContact={vi.fn()}
-      onEditGroup={vi.fn()}
-      onDeleteGroup={vi.fn()}
-      onComposeGroup={onComposeGroup}
-    />,
-  );
-  return onComposeGroup;
-}
-
-describe('ContactsSidebar — compose to group', () => {
-  beforeEach(() => vi.clearAllMocks());
-
-  it('shows a "Send email to group" submenu in the group context menu', () => {
-    renderSidebar();
-    fireEvent.contextMenu(screen.getByText('Team'));
-    expect(screen.getByText('groups.send_email')).toBeInTheDocument();
-    // and the existing Edit/Delete entries still render
-    expect(screen.getByText('groups.edit')).toBeInTheDocument();
-    expect(screen.getByText('form.delete')).toBeInTheDocument();
-  });
-
-  it('calls onComposeGroup(groupId, field) when a To/Cc/Bcc item is clicked', () => {
-    const onComposeGroup = renderSidebar();
-    fireEvent.contextMenu(screen.getByText('Team'));
-
-    // Open the submenu (hover) then click "Cc".
-    const trigger = screen.getByText('groups.send_email').closest('.relative')!;
-    fireEvent.mouseOver(trigger);
-    fireEvent.mouseEnter(trigger);
-
-    fireEvent.click(screen.getByText('groups.send_email_cc'));
-    expect(onComposeGroup).toHaveBeenCalledWith('g1', 'cc');
-  });
-});

components/contacts/contact-activity.tsx

@@ -172,7 +172,7 @@ export function ContactActivity({ contact }: ContactActivityProps) {
 
   const handleOpenEmail = (email: Email) => {
     selectEmail(email);
-    router.push("/");
+    router.push("/mail");
   };
 
   const handleOpenEvent = (event: CalendarEvent) => {
@@ -229,7 +229,7 @@ export function ContactActivity({ contact }: ContactActivityProps) {
                   key={email.id}
                   type="button"
                   onClick={() => handleOpenEmail(email)}
-                  className="w-full text-start flex items-start gap-3 px-2 py-2 rounded-md hover:bg-muted/60 transition-colors touch-manipulation"
+                  className="w-full text-left flex items-start gap-3 px-2 py-2 rounded-md hover:bg-muted/60 transition-colors touch-manipulation"
                 >
                   <Avatar name={sender.name} email={sender.address} size="sm" />
                   <div className="flex-1 min-w-0">
@@ -277,7 +277,7 @@ export function ContactActivity({ contact }: ContactActivityProps) {
                       key={event.id}
                       type="button"
                       onClick={() => handleOpenEvent(event)}
-                      className="w-full text-start flex items-baseline gap-3 px-2 py-2 rounded-md hover:bg-muted/60 transition-colors touch-manipulation"
+                      className="w-full text-left flex items-baseline gap-3 px-2 py-2 rounded-md hover:bg-muted/60 transition-colors touch-manipulation"
                     >
                       <span className="text-xs text-muted-foreground tabular-nums w-20 flex-shrink-0">
                         {formatEventTime(event)}

components/contacts/contact-detail.tsx

@@ -2,13 +2,16 @@
 
 import { useState, useEffect, useRef } from "react";
 import { useTranslations } from "next-intl";
-import { Mail, Phone, Building, MapPin, StickyNote, Pencil, Trash2, BookUser, Copy, Send, Globe, Cake, KeyRound, Users, Briefcase, Heart, Languages, Calendar, UserCircle, Download, MoreHorizontal, Printer } from "lucide-react";
+import { Mail, Phone, Building, MapPin, StickyNote, Pencil, Trash2, BookUser, Copy, Send, Globe, Cake, KeyRound, Users, Briefcase, Heart, Languages, Calendar, UserCircle, ShieldCheck, ShieldAlert, Download, MoreHorizontal, Printer } from "lucide-react";
 import { Avatar } from "@/components/ui/avatar";
 import { Button } from "@/components/ui/button";
 import { cn } from "@/lib/utils";
 import type { ContactCard, AnniversaryDate, PartialDate } from "@/lib/jmap/types";
 import { getContactDisplayName, getContactPrimaryEmail, getContactPhotoUri } from "@/stores/contact-store";
 import { ContactActivity } from "./contact-activity";
+import { useSmimeStore } from "@/stores/smime-store";
+import { parseCertificatePemOrDer, extractCertificateInfo } from "@/lib/smime/certificate-utils";
+import type { CertificateInfo } from "@/lib/smime/types";
 import { toast } from "@/stores/toast-store";
 import { exportContact } from "./contact-export";
 import { printContact } from "./contact-print";
@@ -29,8 +32,6 @@ interface ContactDetailProps {
   onDelete: () => void;
   onAddToGroup?: () => void;
   onDuplicate?: () => void;
-  /** Compose an email to this contact in the app (no OS mailto handoff). */
-  onCompose?: () => void;
   isMobile?: boolean;
   className?: string;
 }
@@ -114,11 +115,51 @@ function formatDate(dateInput: AnniversaryDate): string {
   return dateStr;
 }
 
-export function ContactDetail({ contact, onEdit, onDelete, onAddToGroup, onDuplicate, onCompose, isMobile, className }: ContactDetailProps) {
+export function ContactDetail({ contact, onEdit, onDelete, onAddToGroup, onDuplicate, isMobile, className }: ContactDetailProps) {
   const t = useTranslations("contacts");
+  const smimeStore = useSmimeStore();
+  const [parsedCerts, setParsedCerts] = useState<Map<number, CertificateInfo>>(new Map());
 
   const cryptoKeys = contact?.cryptoKeys ? Object.values(contact.cryptoKeys) : [];
 
+  useEffect(() => {
+    if (!contact) return;
+    let cancelled = false;
+    const parseCerts = async () => {
+      const results = new Map<number, CertificateInfo>();
+      for (let i = 0; i < cryptoKeys.length; i++) {
+        const key = cryptoKeys[i];
+        if (typeof key.uri !== 'string') continue;
+        try {
+          let derBytes: ArrayBuffer | string | null = null;
+          if (key.uri.startsWith('data:')) {
+            const commaIdx = key.uri.indexOf(',');
+            if (commaIdx === -1) continue;
+            const b64 = key.uri.substring(commaIdx + 1);
+            const binary = atob(b64);
+            const bytes = new Uint8Array(binary.length);
+            for (let j = 0; j < binary.length; j++) bytes[j] = binary.charCodeAt(j);
+            derBytes = bytes.buffer;
+          } else if (key.uri.startsWith('-----BEGIN')) {
+            derBytes = key.uri;
+          }
+          if (!derBytes) continue;
+          const cert = parseCertificatePemOrDer(derBytes);
+          const der = typeof derBytes === 'string' ? cert.toSchema(true).toBER(false) : derBytes;
+          const info = await extractCertificateInfo(cert, der);
+          if (!cancelled) results.set(i, info);
+        } catch { /* skip unparseable keys */ }
+      }
+      if (!cancelled) setParsedCerts(results);
+    };
+    if (cryptoKeys.length > 0) {
+      parseCerts();
+    } else {
+      setParsedCerts(new Map());
+    }
+    return () => { cancelled = true; };
+  }, [contact?.id]); // eslint-disable-line react-hooks/exhaustive-deps
+
   if (!contact) {
     return (
       <div className={cn("flex flex-col items-center justify-center h-full text-muted-foreground", className)}>
@@ -160,10 +201,35 @@ export function ContactDetail({ contact, onEdit, onDelete, onAddToGroup, onDupli
   const notes = contact.notes ? Object.values(contact.notes) : [];
   const titles = contact.titles ? Object.values(contact.titles) : [];
   const jobTitles = titles.filter(t => t.kind !== "role");
+  const roles = titles.filter(t => t.kind === "role");
   const onlineServices = contact.onlineServices ? Object.values(contact.onlineServices) : [];
   const anniversaries = contact.anniversaries ? Object.values(contact.anniversaries) : [];
   const keywords = contact.keywords ? Object.keys(contact.keywords).filter(k => contact.keywords![k]) : [];
 
+  const handleImportContactCert = async (keyIndex: number) => {
+    const key = cryptoKeys[keyIndex];
+    if (!key?.uri || typeof key.uri !== 'string') return;
+    try {
+      let derBytes: ArrayBuffer | string;
+      if (key.uri.startsWith('data:')) {
+        const commaIdx = key.uri.indexOf(',');
+        if (commaIdx === -1) return;
+        const b64 = key.uri.substring(commaIdx + 1);
+        const binary = atob(b64);
+        const bytes = new Uint8Array(binary.length);
+        for (let j = 0; j < binary.length; j++) bytes[j] = binary.charCodeAt(j);
+        derBytes = bytes.buffer;
+      } else if (key.uri.startsWith('-----BEGIN')) {
+        derBytes = key.uri;
+      } else {
+        return;
+      }
+      await smimeStore.importPublicCert(derBytes, 'contact', contact.id);
+      toast.success(t("detail.cert_imported"));
+    } catch (err) {
+      toast.error(err instanceof Error ? err.message : t("detail.cert_import_failed"));
+    }
+  };
   const relatedTo = contact.relatedTo ? Object.entries(contact.relatedTo) : [];
   const preferredLanguages = contact.preferredLanguages ? Object.values(contact.preferredLanguages) : [];
   const personalInfo = contact.personalInfo ? Object.values(contact.personalInfo) : [];
@@ -194,28 +260,26 @@ export function ContactDetail({ contact, onEdit, onDelete, onAddToGroup, onDupli
             </div>
           </div>
           <div className="flex gap-2 flex-shrink-0 flex-wrap">
-            {email && onCompose && (
-              <Button
-                variant="outline"
-                size="sm"
-                onClick={onCompose}
-                className="touch-manipulation"
+            {email && (
+              <a
+                href={`mailto:${email}`}
+                className="inline-flex items-center justify-center rounded-md font-medium h-9 px-3 text-sm border border-input bg-background hover:bg-accent hover:text-accent-foreground transition-colors touch-manipulation"
               >
-                <Send className="w-4 h-4 me-1" />
+                <Send className="w-4 h-4 mr-1" />
                 {t("detail.compose_email")}
-              </Button>
+              </a>
             )}
             {phone && (
               <a
                 href={`tel:${phone}`}
                 className="inline-flex items-center justify-center rounded-md font-medium h-9 px-3 text-sm border border-input bg-background hover:bg-accent hover:text-accent-foreground transition-colors touch-manipulation"
               >
-                <Phone className="w-4 h-4 me-1" />
+                <Phone className="w-4 h-4 mr-1" />
                 {t("context_menu.call")}
               </a>
             )}
             <Button variant="outline" size="sm" onClick={onEdit} className="touch-manipulation">
-              <Pencil className="w-4 h-4 me-1" />
+              <Pencil className="w-4 h-4 mr-1" />
               {t("form.edit_title")}
             </Button>
             <MoreActionsMenu items={moreItems} label={t("detail.more_actions")} />
@@ -426,20 +490,59 @@ export function ContactDetail({ contact, onEdit, onDelete, onAddToGroup, onDupli
         {cryptoKeys.length > 0 && (
           <Section title={t("detail.crypto_keys")}>
             <div className="space-y-3">
-              {cryptoKeys.map((key, i) => (
-                <div key={i} className="rounded-md border border-border/60 bg-muted/30 p-3 space-y-1">
-                  <div className="flex items-start gap-2 text-sm break-all">
-                    <KeyRound className="w-4 h-4 text-muted-foreground mt-0.5 flex-shrink-0" />
-                    {typeof key.uri === 'string' && key.uri.startsWith("http") ? (
-                      <a href={key.uri} target="_blank" rel="noopener noreferrer" className="text-primary hover:underline">
-                        {key.uri}
-                      </a>
+              {cryptoKeys.map((key, i) => {
+                const certInfo = parsedCerts.get(i);
+                const isExpired = certInfo ? new Date(certInfo.notAfter) < new Date() : false;
+                const alreadyImported = certInfo?.emailAddresses?.[0]
+                  ? !!smimeStore.getPublicCertForEmail(certInfo.emailAddresses[0])
+                  : false;
+
+                return (
+                  <div key={i} className="rounded-md border border-border/60 bg-muted/30 p-3 space-y-1">
+                    {certInfo ? (
+                      <>
+                        <div className="flex items-center gap-2">
+                          {isExpired ? (
+                            <ShieldAlert className="w-4 h-4 text-destructive flex-shrink-0" />
+                          ) : (
+                            <ShieldCheck className="w-4 h-4 text-primary flex-shrink-0" />
+                          )}
+                          <span className="text-sm font-medium truncate">{certInfo.subject}</span>
+                        </div>
+                        <div className="text-xs text-muted-foreground space-y-0.5 pl-6">
+                          <p>{t("detail.cert_issuer")}: {certInfo.issuer}</p>
+                          <p>
+                            {t("detail.cert_expires")}: {new Date(certInfo.notAfter).toLocaleDateString()}
+                            {isExpired && <span className="text-destructive ml-1">({t("detail.cert_expired")})</span>}
+                          </p>
+                          <p>{t("detail.cert_fingerprint")}: {certInfo.fingerprint.substring(0, 20)}...</p>
+                          {certInfo.algorithm && <p>{t("detail.cert_algorithm")}: {certInfo.algorithm}</p>}
+                        </div>
+                        {!alreadyImported && (
+                          <Button variant="ghost" size="sm" className="ml-4 mt-1" onClick={() => handleImportContactCert(i)}>
+                            <Download className="w-3 h-3 mr-1" />
+                            {t("detail.import_to_smime")}
+                          </Button>
+                        )}
+                        {alreadyImported && (
+                          <p className="text-xs text-green-600 pl-6 mt-1">{t("detail.cert_already_imported")}</p>
+                        )}
+                      </>
                     ) : (
-                      <span className="text-muted-foreground">{typeof key.uri === 'string' ? `${key.uri.substring(0, 80)}${key.uri.length > 80 ? "…" : ""}` : String(key.uri ?? '')}</span>
+                      <div className="flex items-start gap-2 text-sm break-all">
+                        <KeyRound className="w-4 h-4 text-muted-foreground mt-0.5 flex-shrink-0" />
+                        {typeof key.uri === 'string' && key.uri.startsWith("http") ? (
+                          <a href={key.uri} target="_blank" rel="noopener noreferrer" className="text-primary hover:underline">
+                            {key.uri}
+                          </a>
+                        ) : (
+                          <span className="text-muted-foreground">{typeof key.uri === 'string' ? `${key.uri.substring(0, 80)}${key.uri.length > 80 ? "…" : ""}` : String(key.uri ?? '')}</span>
+                        )}
+                      </div>
                     )}
                   </div>
-                </div>
-              ))}
+                );
+              })}
             </div>
           </Section>
         )}
@@ -571,7 +674,7 @@ function MoreActionsMenu({ items, label }: { items: MoreItem[]; label: string })
       {open && (
         <div
           role="menu"
-          className="absolute end-0 top-full mt-1 z-30 min-w-[200px] rounded-md border border-border bg-popover text-popover-foreground shadow-lg py-1 animate-in fade-in-0 zoom-in-95 duration-100"
+          className="absolute right-0 top-full mt-1 z-30 min-w-[200px] rounded-md border border-border bg-popover text-popover-foreground shadow-lg py-1 animate-in fade-in-0 zoom-in-95 duration-100"
         >
           {items.map((item, i) => {
             if (item.separator) {
@@ -587,7 +690,7 @@ function MoreActionsMenu({ items, label }: { items: MoreItem[]; label: string })
                   setOpen(false);
                 }}
                 className={cn(
-                  "w-full flex items-center gap-2 px-3 py-1.5 text-sm text-start hover:bg-muted focus:bg-muted focus:outline-none transition-colors",
+                  "w-full flex items-center gap-2 px-3 py-1.5 text-sm text-left hover:bg-muted focus:bg-muted focus:outline-none transition-colors",
                   item.destructive && "text-red-600 dark:text-red-400 hover:bg-red-50 dark:hover:bg-red-950 focus:bg-red-50 dark:focus:bg-red-950",
                 )}
               >

components/contacts/contact-form.tsx

@@ -1,6 +1,6 @@
 "use client";
 
-import { useState, useMemo, useCallback, useRef } from "react";
+import { useState, useMemo, useCallback, useEffect, useRef } from "react";
 import { useTranslations } from "next-intl";
 import { X, Plus, ChevronDown, ChevronRight, User, Building, MapPin, Globe, Cake, Heart, Tag, StickyNote, Mail, Phone, Calendar, UserCircle, Book, Camera, Trash2 } from "lucide-react";
 import { Button } from "@/components/ui/button";
@@ -72,7 +72,7 @@ function FormSection({ icon: Icon, title, children, collapsible, defaultOpen = t
       <button
         type="button"
         className={cn(
-          "flex items-center gap-2 w-full text-start",
+          "flex items-center gap-2 w-full text-left",
           collapsible ? "cursor-pointer" : "cursor-default"
         )}
         onClick={() => collapsible && setOpen(!open)}
@@ -525,11 +525,6 @@ export function ContactForm({ contact, addressBooks, allKeywords, defaultAddress
       mediaMap[photoKey] = { kind: "photo", uri: photoUri, mediaType: photoMediaType };
     }
 
-    // Set mediaVluae to null if we are removing media, so the server removes it
-    const hadMedia = !!contact?.media && Object.keys(contact.media).length > 0;
-    const mediaValue: Record<string, ContactMedia> | null | undefined =
-      Object.keys(mediaMap).length > 0 ? mediaMap : (hadMedia ? null : undefined);
-
     const data: Partial<ContactCard> = {
       name: { components: nameComponents, isOrdered: true },
       nicknames: nickname.trim() ? { n0: { name: nickname.trim() } } : undefined,
@@ -556,7 +551,7 @@ export function ContactForm({ contact, addressBooks, allKeywords, defaultAddress
       calendarUri: calendarUri.trim() || undefined,
       schedulingUri: schedulingUri.trim() || undefined,
       freeBusyUri: freeBusyUri.trim() || undefined,
-      media: mediaValue as Record<string, ContactMedia> | undefined,
+      media: Object.keys(mediaMap).length > 0 ? mediaMap : undefined,
       ...(selectedBookId ? { addressBookIds: { [selectedBookId]: true } } : {}),
     };
 
@@ -736,12 +731,12 @@ export function ContactForm({ contact, addressBooks, allKeywords, defaultAddress
                     )}
                   </div>
                   {emailErrors[i] && (
-                    <p className="text-xs text-red-600 dark:text-red-400 mt-1 ms-1">{emailErrors[i]}</p>
+                    <p className="text-xs text-red-600 dark:text-red-400 mt-1 ml-1">{emailErrors[i]}</p>
                   )}
                 </div>
               ))}
               <Button type="button" variant="ghost" size="sm" onClick={() => setEmails([...emails, { address: "", context: "" }])} className="text-xs">
-                <Plus className="w-3 h-3 me-1" />
+                <Plus className="w-3 h-3 mr-1" />
                 {t("add_email")}
               </Button>
             </div>
@@ -799,7 +794,7 @@ export function ContactForm({ contact, addressBooks, allKeywords, defaultAddress
                 </div>
               ))}
               <Button type="button" variant="ghost" size="sm" onClick={() => setPhones([...phones, { number: "", context: "", feature: "" }])} className="text-xs">
-                <Plus className="w-3 h-3 me-1" />
+                <Plus className="w-3 h-3 mr-1" />
                 {t("add_phone")}
               </Button>
             </div>
@@ -855,7 +850,7 @@ export function ContactForm({ contact, addressBooks, allKeywords, defaultAddress
                 </div>
               ))}
               <Button type="button" variant="ghost" size="sm" onClick={() => setAddresses([...addresses, { street: "", locality: "", region: "", postcode: "", country: "", context: "" }])} className="text-xs">
-                <Plus className="w-3 h-3 me-1" />
+                <Plus className="w-3 h-3 mr-1" />
                 {t("add_address")}
               </Button>
             </div>
@@ -884,7 +879,7 @@ export function ContactForm({ contact, addressBooks, allKeywords, defaultAddress
                 </div>
               ))}
               <Button type="button" variant="ghost" size="sm" onClick={() => setOnlineServices([...onlineServices, { uri: "", service: "", label: "" }])} className="text-xs">
-                <Plus className="w-3 h-3 me-1" />
+                <Plus className="w-3 h-3 mr-1" />
                 {t("add_online_service")}
               </Button>
             </div>
@@ -916,7 +911,7 @@ export function ContactForm({ contact, addressBooks, allKeywords, defaultAddress
                 </div>
               ))}
               <Button type="button" variant="ghost" size="sm" onClick={() => setAnniversaries([...anniversaries, { date: "", kind: "birth" }])} className="text-xs">
-                <Plus className="w-3 h-3 me-1" />
+                <Plus className="w-3 h-3 mr-1" />
                 {t("add_anniversary")}
               </Button>
             </div>
@@ -957,7 +952,7 @@ export function ContactForm({ contact, addressBooks, allKeywords, defaultAddress
                 </div>
               ))}
               <Button type="button" variant="ghost" size="sm" onClick={() => setPersonalInfoEntries([...personalInfoEntries, { value: "", kind: "hobby", level: "" }])} className="text-xs">
-                <Plus className="w-3 h-3 me-1" />
+                <Plus className="w-3 h-3 mr-1" />
                 {t("add_personal_info")}
               </Button>
             </div>
@@ -1145,7 +1140,7 @@ function CategoryComboBox({
             <button
               key={kw}
               type="button"
-              className="w-full flex items-center gap-2 px-3 py-1.5 text-sm hover:bg-accent transition-colors text-start"
+              className="w-full flex items-center gap-2 px-3 py-1.5 text-sm hover:bg-accent transition-colors text-left"
               onClick={() => { addKeyword(kw); inputRef.current?.focus(); }}
             >
               <Tag className="w-3.5 h-3.5 text-muted-foreground flex-shrink-0" />
@@ -1155,7 +1150,7 @@ function CategoryComboBox({
           {canAddNew && (
             <button
               type="button"
-              className="w-full flex items-center gap-2 px-3 py-1.5 text-sm hover:bg-accent transition-colors text-start text-primary"
+              className="w-full flex items-center gap-2 px-3 py-1.5 text-sm hover:bg-accent transition-colors text-left text-primary"
               onClick={() => { addKeyword(inputValue); inputRef.current?.focus(); }}
             >
               <Plus className="w-3.5 h-3.5 flex-shrink-0" />

components/contacts/contact-group-detail.tsx

@@ -1,7 +1,7 @@
 "use client";
 
 import { useTranslations } from "next-intl";
-import { Users, Pencil, Trash2, UserMinus, Mail } from "lucide-react";
+import { Users, Pencil, Trash2, UserMinus } from "lucide-react";
 import { Avatar } from "@/components/ui/avatar";
 import { Button } from "@/components/ui/button";
 import { cn } from "@/lib/utils";
@@ -15,8 +15,6 @@ interface ContactGroupDetailProps {
   onDelete: () => void;
   onRemoveMember: (memberId: string) => void;
   onSelectMember: (id: string) => void;
-  /** Compose an email to every member with the recipients placed in `field`. */
-  onComposeGroup?: (field: "to" | "cc" | "bcc") => void;
   isMobile?: boolean;
   className?: string;
 }
@@ -28,13 +26,11 @@ export function ContactGroupDetail({
   onDelete,
   onRemoveMember,
   onSelectMember,
-  onComposeGroup,
   isMobile,
   className,
 }: ContactGroupDetailProps) {
   const t = useTranslations("contacts");
   const groupName = getContactDisplayName(group);
-  const hasEmailMembers = members.some((m) => getContactPrimaryEmail(m).trim());
 
   return (
     <div className={cn("flex flex-col h-full overflow-y-auto", className)}>
@@ -53,7 +49,7 @@ export function ContactGroupDetail({
           </div>
           <div className="flex gap-2">
             <Button variant="outline" size="sm" onClick={onEdit} className="touch-manipulation">
-              <Pencil className="w-4 h-4 me-1" />
+              <Pencil className="w-4 h-4 mr-1" />
               {t("form.edit_title")}
             </Button>
             <Button
@@ -66,25 +62,6 @@ export function ContactGroupDetail({
             </Button>
           </div>
         </div>
-        {onComposeGroup && hasEmailMembers && (
-          <div className="flex flex-wrap items-center gap-2 mt-4">
-            <Mail className="w-4 h-4 text-muted-foreground" aria-hidden />
-            <span className="text-sm text-muted-foreground">{t("groups.send_email")}</span>
-            <div className="inline-flex gap-1">
-              {(["to", "cc", "bcc"] as const).map((field) => (
-                <Button
-                  key={field}
-                  variant="outline"
-                  size="sm"
-                  onClick={() => onComposeGroup(field)}
-                  className="touch-manipulation"
-                >
-                  {t(`groups.send_email_${field}`)}
-                </Button>
-              ))}
-            </div>
-          </div>
-        )}
       </div>
 
       <div className="px-6 py-4">
@@ -106,7 +83,7 @@ export function ContactGroupDetail({
                   className="flex items-center gap-3 px-3 py-2.5 rounded-md hover:bg-muted group transition-colors"
                 >
                   <button
-                    className="flex items-center gap-3 flex-1 min-w-0 text-start"
+                    className="flex items-center gap-3 flex-1 min-w-0 text-left"
                     onClick={() => onSelectMember(member.id)}
                   >
                     <Avatar name={mName} email={mEmail} size="sm" />

components/contacts/contact-group-form.tsx

@@ -114,7 +114,7 @@ export function ContactGroupForm({
               placeholder={t("groups.search_members")}
               value={memberSearch}
               onChange={(e) => setMemberSearch(e.target.value)}
-              className="ps-9"
+              className="pl-9"
             />
           </div>
 
@@ -134,7 +134,7 @@ export function ContactGroupForm({
                     type="button"
                     onClick={() => toggleMember(contact.id)}
                     className={cn(
-                      "w-full flex items-center gap-3 px-3 py-2.5 text-start transition-colors",
+                      "w-full flex items-center gap-3 px-3 py-2.5 text-left transition-colors",
                       "hover:bg-muted",
                       isSelected && "bg-primary/5"
                     )}

components/contacts/contact-group-list.tsx

@@ -45,7 +45,7 @@ export function ContactGroupList({
     <div className={cn("flex flex-col", className)}>
       <div className="px-4 py-2 border-b border-border">
         <Button size="sm" variant="outline" onClick={onCreateGroup} className="w-full">
-          <Plus className="w-4 h-4 me-1" />
+          <Plus className="w-4 h-4 mr-1" />
           {t("groups.create")}
         </Button>
       </div>
@@ -69,7 +69,7 @@ export function ContactGroupList({
                   key={group.id}
                   onClick={() => onSelectGroup(group.id)}
                   className={cn(
-                    "w-full flex items-center px-4 text-start transition-colors",
+                    "w-full flex items-center px-4 text-left transition-colors",
                     "hover:bg-muted",
                     group.id === selectedGroupId && "bg-accent text-accent-foreground"
                   )}

components/contacts/contact-import-dialog.tsx

@@ -187,7 +187,7 @@ export function ContactImportDialog({
                     type="button"
                     onClick={() => toggleSelect(idx)}
                     className={cn(
-                      "w-full flex items-center gap-3 px-3 py-2.5 text-start transition-colors hover:bg-muted",
+                      "w-full flex items-center gap-3 px-3 py-2.5 text-left transition-colors hover:bg-muted",
                       isSelected && "bg-primary/5"
                     )}
                   >

components/contacts/contact-list.tsx

@@ -310,7 +310,7 @@ export function ContactList({
                 placeholder={t("search_placeholder")}
                 value={searchQuery}
                 onChange={(e) => onSearchChange(e.target.value)}
-                className={cn("ps-9 h-9", searchQuery && "pe-8")}
+                className={cn("pl-9 h-9", searchQuery && "pr-8")}
               />
               {searchQuery && (
                 <button
@@ -359,7 +359,7 @@ export function ContactList({
                   onClick={() => setFilters(EMPTY_FILTERS)}
                   className="h-7 px-2 text-xs"
                 >
-                  <RotateCcw className="w-3 h-3 me-1" />
+                  <RotateCcw className="w-3 h-3 mr-1" />
                   {t("filters.clear")}
                 </Button>
                 <Button
@@ -479,11 +479,11 @@ export function ContactList({
           </span>
           <div className="flex-1" />
           <Button variant="ghost" size="sm" onClick={onBulkAddToGroup} className="h-7 text-xs">
-            <Users className="w-3.5 h-3.5 me-1" />
+            <Users className="w-3.5 h-3.5 mr-1" />
             {t("bulk.add_to_group")}
           </Button>
           <Button variant="ghost" size="sm" onClick={onBulkExport} className="h-7 text-xs">
-            <Download className="w-3.5 h-3.5 me-1" />
+            <Download className="w-3.5 h-3.5 mr-1" />
             {t("bulk.export")}
           </Button>
           <Button
@@ -492,7 +492,7 @@ export function ContactList({
             onClick={onBulkDelete}
             className="h-7 text-xs text-red-600 dark:text-red-400 hover:text-red-700 dark:hover:text-red-300"
           >
-            <Trash2 className="w-3.5 h-3.5 me-1" />
+            <Trash2 className="w-3.5 h-3.5 mr-1" />
             {t("bulk.delete")}
           </Button>
           <Button variant="ghost" size="icon" onClick={onClearSelection} className="h-7 w-7">
@@ -526,7 +526,7 @@ export function ContactList({
                   )}
                   {activeFilters > 0 && (
                     <Button variant="outline" size="sm" onClick={() => setFilters(EMPTY_FILTERS)}>
-                      <RotateCcw className="w-3.5 h-3.5 me-1" />
+                      <RotateCcw className="w-3.5 h-3.5 mr-1" />
                       {t("filters.clear")}
                     </Button>
                   )}
@@ -538,7 +538,7 @@ export function ContactList({
                 <p className="text-sm font-medium text-foreground">{t("empty_state_title")}</p>
                 <p className="text-xs text-muted-foreground mt-1">{t("empty_state_subtitle")}</p>
                 <Button size="sm" className="mt-3" onClick={onCreateNew}>
-                  <UserPlus className="w-4 h-4 me-1.5" />
+                  <UserPlus className="w-4 h-4 mr-1.5" />
                   {t("create_new")}
                 </Button>
               </>

components/contacts/contacts-sidebar.tsx

@@ -2,10 +2,10 @@
 
 import { useMemo, useState, useCallback, useEffect, useRef, type DragEvent } from "react";
 import { useTranslations } from "next-intl";
-import { BookUser, User, Users, Plus, Share2, Book, BookPlus, ChevronRight, ChevronDown, UserPlus, UsersRound, Upload, Tag, Pencil, Trash2, Settings, Mail } from "lucide-react";
+import { BookUser, User, Users, Plus, Share2, Book, ChevronRight, ChevronDown, UserPlus, UsersRound, Upload, Tag, Pencil, Trash2, Settings } from "lucide-react";
 import { useRouter } from "next/navigation";
 import { Button } from "@/components/ui/button";
-import { ContextMenu, ContextMenuItem, ContextMenuSeparator, ContextMenuSubMenu } from "@/components/ui/context-menu";
+import { ContextMenu, ContextMenuItem, ContextMenuSeparator } from "@/components/ui/context-menu";
 import { useContextMenu } from "@/hooks/use-context-menu";
 import { cn } from "@/lib/utils";
 import type { ContactCard, AddressBook } from "@/lib/jmap/types";
@@ -22,11 +22,9 @@ interface ContactsSidebarProps {
   onSelectCategory: (category: ContactCategory) => void;
   onCreateGroup: () => void;
   onCreateContact: () => void;
-  onCreateAddressBook?: () => void;
   onImport?: () => void;
   onEditGroup?: (groupId: string) => void;
   onDeleteGroup?: (groupId: string) => void;
-  onComposeGroup?: (groupId: string, field: "to" | "cc" | "bcc") => void;
   onDropContacts?: (contactIds: string[], addressBook: AddressBook) => void;
   onDropContactsToCategory?: (contactIds: string[], keyword: string) => void;
   onRenameAddressBook?: (addressBook: AddressBook) => void;
@@ -92,11 +90,9 @@ export function ContactsSidebar({
   onSelectCategory,
   onCreateGroup,
   onCreateContact,
-  onCreateAddressBook,
   onImport,
   onEditGroup,
   onDeleteGroup,
-  onComposeGroup,
   onDropContacts,
   onDropContactsToCategory,
   onRenameAddressBook,
@@ -284,34 +280,25 @@ export function ContactsSidebar({
           {showMenu && (
             <div
               ref={menuRef}
-              className="absolute end-0 top-full mt-1 w-44 rounded-md border border-border bg-background text-foreground shadow-md z-50 py-1"
+              className="absolute right-0 top-full mt-1 w-44 rounded-md border border-border bg-background text-foreground shadow-md z-50 py-1"
             >
               <button
-                className="w-full flex items-center gap-2 px-3 py-1.5 text-sm hover:bg-accent transition-colors text-start"
+                className="w-full flex items-center gap-2 px-3 py-1.5 text-sm hover:bg-accent transition-colors text-left"
                 onClick={() => { setShowMenu(false); onCreateContact(); }}
               >
                 <UserPlus className="w-4 h-4" />
                 {t("create_new")}
               </button>
               <button
-                className="w-full flex items-center gap-2 px-3 py-1.5 text-sm hover:bg-accent transition-colors text-start"
+                className="w-full flex items-center gap-2 px-3 py-1.5 text-sm hover:bg-accent transition-colors text-left"
                 onClick={() => { setShowMenu(false); onCreateGroup(); }}
               >
                 <UsersRound className="w-4 h-4" />
                 {t("groups.create")}
               </button>
-              {onCreateAddressBook && (
-                <button
-                  className="w-full flex items-center gap-2 px-3 py-1.5 text-sm hover:bg-accent transition-colors text-start"
-                  onClick={() => { setShowMenu(false); onCreateAddressBook(); }}
-                >
-                  <BookPlus className="w-4 h-4" />
-                  {t("address_books.create")}
-                </button>
-              )}
               {onImport && (
                 <button
-                  className="w-full flex items-center gap-2 px-3 py-1.5 text-sm hover:bg-accent transition-colors text-start"
+                  className="w-full flex items-center gap-2 px-3 py-1.5 text-sm hover:bg-accent transition-colors text-left"
                   onClick={() => { setShowMenu(false); onImport(); }}
                 >
                   <Upload className="w-4 h-4" />
@@ -338,7 +325,7 @@ export function ContactsSidebar({
         >
           <BookUser className="w-4 h-4 flex-shrink-0" />
           <span className="truncate">{t("tabs.all")}</span>
-          <span className="ms-auto text-xs text-muted-foreground tabular-nums">
+          <span className="ml-auto text-xs text-muted-foreground tabular-nums">
             {individuals.length}
           </span>
         </button>
@@ -355,7 +342,7 @@ export function ContactsSidebar({
                 <div className="flex items-center px-3 py-1 group">
                   <button
                     onClick={() => toggleSection(sectionKey)}
-                    className="flex items-center gap-1 flex-1 min-w-0 text-start"
+                    className="flex items-center gap-1 flex-1 min-w-0 text-left"
                   >
                     {expanded ? (
                       <ChevronDown className="w-3 h-3 text-muted-foreground" />
@@ -369,7 +356,7 @@ export function ContactsSidebar({
                   </button>
                 </div>
                 {expanded && (
-                  <div className="ps-2">
+                  <div className="pl-2">
                     {owned.length > 0 && (
                       <div className="mt-1">
                         <div className="px-3 py-0.5 text-[10px] font-medium text-muted-foreground/80 uppercase tracking-wider">
@@ -418,7 +405,7 @@ export function ContactsSidebar({
               <div className="flex items-center px-3 py-1 group">
                 <button
                   onClick={() => toggleSection("addressBooks")}
-                  className="flex items-center gap-1 flex-1 text-start"
+                  className="flex items-center gap-1 flex-1 text-left"
                 >
                   {collapsed.addressBooks ? (
                     <ChevronRight className="w-3 h-3 text-muted-foreground" />
@@ -461,7 +448,7 @@ export function ContactsSidebar({
           <div className="mt-2">
             <button
               onClick={() => toggleSection("groups")}
-              className="flex items-center gap-1 px-3 py-1 w-full text-start group"
+              className="flex items-center gap-1 px-3 py-1 w-full text-left group"
             >
               {collapsed.groups ? (
                 <ChevronRight className="w-3 h-3 text-muted-foreground" />
@@ -483,7 +470,7 @@ export function ContactsSidebar({
                   onClick={() => onSelectCategory({ groupId: group.id })}
                   onContextMenu={(e) => openGroupContextMenu(e, group)}
                   className={cn(
-                    "w-full flex items-center gap-2 ps-5 pe-3 text-sm transition-colors",
+                    "w-full flex items-center gap-2 pl-5 pr-3 text-sm transition-colors",
                     isActive
                       ? "bg-accent text-accent-foreground font-medium"
                       : "text-foreground/80 hover:bg-muted"
@@ -492,7 +479,7 @@ export function ContactsSidebar({
                 >
                   <Users className="w-4 h-4 flex-shrink-0" />
                   <span className="truncate">{getContactDisplayName(group)}</span>
-                  <span className="ms-auto text-xs text-muted-foreground tabular-nums">
+                  <span className="ml-auto text-xs text-muted-foreground tabular-nums">
                     {memberCount}
                   </span>
                 </button>
@@ -505,7 +492,7 @@ export function ContactsSidebar({
         <div className="mt-2">
           <button
             onClick={() => toggleSection("categories")}
-            className="flex items-center gap-1 px-3 py-1 w-full text-start group"
+            className="flex items-center gap-1 px-3 py-1 w-full text-left group"
           >
             {collapsed.categories ? (
               <ChevronRight className="w-3 h-3 text-muted-foreground" />
@@ -523,7 +510,7 @@ export function ContactsSidebar({
               <button
                 onClick={() => onSelectCategory("uncategorized")}
                 className={cn(
-                  "w-full flex items-center gap-2 ps-5 pe-3 text-sm transition-colors",
+                  "w-full flex items-center gap-2 pl-5 pr-3 text-sm transition-colors",
                   activeCategory === "uncategorized"
                     ? "bg-accent text-accent-foreground font-medium"
                     : "text-foreground/80 hover:bg-muted"
@@ -532,7 +519,7 @@ export function ContactsSidebar({
               >
                 <Tag className="w-3.5 h-3.5 flex-shrink-0 opacity-50" />
                 <span className="truncate italic">{t("no_category")}</span>
-                <span className="ms-auto text-xs text-muted-foreground tabular-nums">
+                <span className="ml-auto text-xs text-muted-foreground tabular-nums">
                   {uncategorizedCount}
                 </span>
               </button>
@@ -561,7 +548,7 @@ export function ContactsSidebar({
             <div className="flex items-center px-3 py-1 group">
               <button
                 onClick={() => toggleSection(`shared-${group.accountId}`)}
-                className="flex items-center gap-1 flex-1 min-w-0 text-start"
+                className="flex items-center gap-1 flex-1 min-w-0 text-left"
               >
                 {collapsed[`shared-${group.accountId}`] ? (
                   <ChevronRight className="w-3 h-3 text-muted-foreground" />
@@ -697,21 +684,6 @@ export function ContactsSidebar({
               onEditGroup?.(groupContextMenu.data!.id);
             }}
           />
-          {onComposeGroup && (
-            <ContextMenuSubMenu icon={Mail} label={t("groups.send_email")}>
-              {(["to", "cc", "bcc"] as const).map((field) => (
-                <ContextMenuItem
-                  key={field}
-                  label={t(`groups.send_email_${field}`)}
-                  onClick={() => {
-                    const groupId = groupContextMenu.data!.id;
-                    closeGroupContextMenu();
-                    onComposeGroup(groupId, field);
-                  }}
-                />
-              ))}
-            </ContextMenuSubMenu>
-          )}
           <ContextMenuSeparator />
           <ContextMenuItem
             icon={Trash2}
@@ -779,7 +751,7 @@ function CategoryItem({
       onDragLeave={handleDragLeave}
       onDrop={handleDrop}
       className={cn(
-        "w-full flex items-center gap-2 ps-5 pe-3 text-sm transition-colors",
+        "w-full flex items-center gap-2 pl-5 pr-3 text-sm transition-colors",
         isActive
           ? "bg-accent text-accent-foreground font-medium"
           : "text-foreground/80 hover:bg-muted",
@@ -789,7 +761,7 @@ function CategoryItem({
     >
       <Tag className="w-3.5 h-3.5 flex-shrink-0" />
       <span className="truncate">{keyword}</span>
-      <span className="ms-auto text-xs text-muted-foreground tabular-nums">
+      <span className="ml-auto text-xs text-muted-foreground tabular-nums">
         {count}
       </span>
     </button>
@@ -847,7 +819,7 @@ function AddressBookItem({
       onDragLeave={handleDragLeave}
       onDrop={handleDrop}
       className={cn(
-        "w-full flex items-center gap-2 ps-5 pe-3 text-sm transition-colors",
+        "w-full flex items-center gap-2 pl-5 pr-3 text-sm transition-colors",
         isActive
           ? "bg-accent text-accent-foreground font-medium"
           : "text-foreground/80 hover:bg-muted",
@@ -858,11 +830,11 @@ function AddressBookItem({
       <Book className="w-4 h-4 flex-shrink-0" />
       <span className="truncate">{book.name}</span>
       {!book.isShared && Object.keys(book.shareWith || {}).length > 0 && (
-        <Users className="w-3 h-3 text-muted-foreground flex-shrink-0 ms-auto" />
+        <Users className="w-3 h-3 text-muted-foreground flex-shrink-0 ml-auto" />
       )}
       <span className={cn(
         "text-xs text-muted-foreground tabular-nums",
-        !(!book.isShared && Object.keys(book.shareWith || {}).length > 0) && "ms-auto"
+        !(!book.isShared && Object.keys(book.shareWith || {}).length > 0) && "ml-auto"
       )}>
         {contactCount}
       </span>

components/email/__tests__/calendar-invitation-banner.test.tsx

@@ -540,9 +540,7 @@ describe('CalendarInvitationBanner', () => {
         mocks.clientMock,
         'event-8',
         expect.objectContaining({
-          // The stored event lacks an ORGANIZER, so the RSVP repair writes
-          // organizerCalendarAddress (replyTo is retired in jscalendarbis).
-          organizerCalendarAddress: 'mailto:organizer@example.com',
+          replyTo: { imip: 'mailto:organizer@example.com' },
           participants: expect.objectContaining({
             attendee: expect.objectContaining({
               participationStatus: 'accepted',

components/email/__tests__/contact-sidebar-edit.test.tsx

@@ -1,106 +0,0 @@
-import { render, screen, fireEvent } from '@testing-library/react';
-import { describe, it, expect, vi, beforeEach } from 'vitest';
-import { ContactSidebarPanel } from '../email-viewer';
-import type { ContactCard } from '@/lib/jmap/types';
-
-const contact: ContactCard = {
-  id: 'c1',
-  addressBookIds: {},
-  name: {
-    components: [
-      { kind: 'given', value: 'Alice' },
-      { kind: 'surname', value: 'Smith' },
-    ],
-    isOrdered: true,
-  },
-  emails: { e0: { address: 'alice@example.com' } },
-};
-
-const unknownEmail = 'unknown@example.com';
-
-describe('ContactSidebarPanel', () => {
-  beforeEach(() => {
-    Object.assign(navigator, {
-      clipboard: { writeText: vi.fn().mockResolvedValue(undefined) },
-    });
-  });
-
-  it('shows Edit button when contact is known and onEditContact is provided', () => {
-    render(
-      <ContactSidebarPanel
-        email="alice@example.com"
-        contact={contact}
-        onClose={vi.fn()}
-        onEditContact={vi.fn()}
-      />,
-    );
-    // useTranslations mock returns the key, so we look for the common.edit key
-    expect(screen.getByTitle('contact_sidebar.action_edit_title')).toBeInTheDocument();
-    expect(screen.getByText('edit')).toBeInTheDocument();
-  });
-
-  it('calls onEditContact when Edit button is clicked', () => {
-    const onEditContact = vi.fn();
-    render(
-      <ContactSidebarPanel
-        email="alice@example.com"
-        contact={contact}
-        onClose={vi.fn()}
-        onEditContact={onEditContact}
-      />,
-    );
-    fireEvent.click(screen.getByTitle('contact_sidebar.action_edit_title'));
-    expect(onEditContact).toHaveBeenCalledOnce();
-  });
-
-  it('does not show Edit button when contact is null', () => {
-    render(
-      <ContactSidebarPanel
-        email={unknownEmail}
-        contact={null}
-        onClose={vi.fn()}
-        onEditContact={vi.fn()}
-      />,
-    );
-    expect(screen.queryByTitle('contact_sidebar.action_edit_title')).not.toBeInTheDocument();
-  });
-
-  it('does not show Edit button when onEditContact is not provided', () => {
-    render(
-      <ContactSidebarPanel
-        email="alice@example.com"
-        contact={contact}
-        onClose={vi.fn()}
-      />,
-    );
-    expect(screen.queryByTitle('contact_sidebar.action_edit_title')).not.toBeInTheDocument();
-  });
-
-  it('shows "not in contacts" message and Add button for unknown email', () => {
-    const onAddToContacts = vi.fn();
-    render(
-      <ContactSidebarPanel
-        email={unknownEmail}
-        contact={null}
-        onClose={vi.fn()}
-        onAddToContacts={onAddToContacts}
-      />,
-    );
-    expect(screen.getByText('contact_sidebar.not_in_contacts')).toBeInTheDocument();
-    fireEvent.click(screen.getByText('contact_sidebar.add_to_contacts'));
-    expect(onAddToContacts).toHaveBeenCalledWith(unknownEmail, undefined);
-  });
-
-  it('calls onClose when the close button is clicked', () => {
-    const onClose = vi.fn();
-    render(
-      <ContactSidebarPanel
-        email="alice@example.com"
-        contact={contact}
-        onClose={onClose}
-      />,
-    );
-    fireEvent.click(screen.getByLabelText('contact_sidebar.close'));
-    expect(onClose).toHaveBeenCalledOnce();
-  });
-});

components/email/__tests__/email-list-item.test.tsx

@@ -68,12 +68,10 @@ describe('EmailListItem tag badge', () => {
     expect(screen.getByText('Blue')).toBeInTheDocument();
   });
 
-  it('shows a gray fallback badge when keyword id is not in settings', () => {
+  it('does not show badge when keyword id not in settings', () => {
     const email = makeEmail({ keywords: { $seen: true, '$label:unknown-tag': true } });
     render(<EmailListItem email={email} />);
-    // Unknown tags fall back to the raw id as label with a gray dot
-    // (see email-list-item.tsx: keywordDefs fallback).
-    expect(screen.getByText('unknown-tag')).toBeInTheDocument();
+    expect(screen.queryByText('unknown-tag')).not.toBeInTheDocument();
   });
 
   it('shows custom keyword label', () => {
@@ -121,34 +119,3 @@ describe('EmailListItem tag badge', () => {
     expect(container.querySelector('p')).toBeNull();
   });
 });
-
-describe('EmailListItem shift-range checkbox', () => {
-  beforeEach(() => {
-    useSettingsStore.setState({ emailKeywords: [...DEFAULT_KEYWORDS], showPreview: false, mailLayout: 'split' });
-  });
-
-  it('shift-clicking the checkbox extends the selection from the anchor', () => {
-    const e1 = makeEmail({ id: 'e1', threadId: 't1' });
-    const e2 = makeEmail({ id: 'e2', threadId: 't2' });
-    const e3 = makeEmail({ id: 'e3', threadId: 't3' });
-    // selection mode active (so the checkbox renders), anchor on e1
-    useEmailStore.setState({
-      emails: [e1, e2, e3],
-      selectedEmailIds: new Set(['e1']),
-      lastSelectedEmailId: 'e1',
-      selectedMailbox: 'inbox',
-    });
-
-    render(<EmailListItem email={e3} />);
-    // the checkbox is the first button in the row (shown in selection mode)
-    const checkbox = screen.getAllByRole('button')[0];
-    act(() => {
-      checkbox.dispatchEvent(new MouseEvent('click', { bubbles: true, shiftKey: true }));
-    });
-
-    const sel = useEmailStore.getState().selectedEmailIds;
-    expect(sel.has('e1')).toBe(true);
-    expect(sel.has('e2')).toBe(true); // the in-between row got filled in
-    expect(sel.has('e3')).toBe(true);
-  });
-});

components/email/__tests__/recipient-chip-drag.test.tsx

@@ -1,466 +0,0 @@
-import { render, screen, act } from '@testing-library/react';
-import { fireEvent } from '@testing-library/dom';
-import { describe, it, expect, vi, beforeEach } from 'vitest';
-import React from 'react';
-import { EmailComposer } from '../email-composer';
-
-// ─── Heavy component mocks ────────────────────────────────────────────────────
-
-vi.mock('@/components/email/rich-text-editor', () => ({
-  RichTextEditor: ({ onChange }: { onChange?: (html: string) => void }) => (
-    React.createElement('div', { 'data-testid': 'rich-text-editor', onClick: () => onChange?.('') })
-  ),
-}));
-
-vi.mock('@/components/plugins/plugin-slot', () => ({ PluginSlot: () => null }));
-vi.mock('@/components/identity/sub-address-helper', () => ({ SubAddressHelper: () => null }));
-vi.mock('@/components/templates/template-picker', () => ({ TemplatePicker: () => null }));
-vi.mock('@/components/templates/template-form', () => ({ TemplateForm: () => null }));
-vi.mock('@/components/files/file-preview-modal', () => ({ FilePreviewModal: () => null }));
-vi.mock('@/hooks/use-focus-trap', () => ({
-  useFocusTrap: () => ({ ref: { current: null } }),
-}));
-vi.mock('@/hooks/use-pro-multi-account-identities', () => ({
-  useProMultiAccountIdentities: () => ({ enabled: false, groups: [], allIdentities: [] }),
-  stripCrossAccountIdentityPrefix: (id: string) => ({ localAccountId: null, rawId: id }),
-}));
-
-// ─── Store mocks ──────────────────────────────────────────────────────────────
-// vi.mock factories are hoisted, so all values must be defined inline.
-
-vi.mock('@/stores/auth-store', () => {
-  const state = {
-    client: null,
-    identities: [],
-    primaryIdentity: null,
-    isAuthenticated: false,
-    isDemoMode: false,
-    activeAccountId: null,
-    connectionLost: false,
-    getClientForAccount: () => undefined,
-    getAllConnectedClients: () => new Map(),
-    syncIdentities: () => {},
-    refreshIdentities: async () => {},
-  };
-  const hook = (sel?: (s: typeof state) => unknown) =>
-    typeof sel === 'function' ? sel(state) : state;
-  hook.getState = () => state;
-  hook.setState = (p: Partial<typeof state>) => Object.assign(state, p);
-  return { useAuthStore: hook };
-});
-
-vi.mock('@/stores/identity-store', () => {
-  const state = { identities: [], defaultIdentityId: null };
-  const hook = (sel?: (s: typeof state) => unknown) =>
-    typeof sel === 'function' ? sel(state) : state;
-  hook.getState = () => state;
-  hook.setState = (p: Partial<typeof state>) => Object.assign(state, p);
-  return { useIdentityStore: hook };
-});
-
-vi.mock('@/stores/account-store', () => {
-  const state = { accounts: [], getAccountById: () => undefined };
-  const hook = (sel?: (s: typeof state) => unknown) =>
-    typeof sel === 'function' ? sel(state) : state;
-  hook.getState = () => state;
-  hook.setState = (p: Partial<typeof state>) => Object.assign(state, p);
-  return { useAccountStore: hook };
-});
-
-vi.mock('@/stores/email-store', () => {
-  const state = {
-    draftSaveEnabled: false,
-    sendRawEmail: async () => ({ sent: true }),
-  };
-  const hook = (sel?: (s: typeof state) => unknown) =>
-    typeof sel === 'function' ? sel(state) : state;
-  hook.getState = () => state;
-  hook.setState = (p: Partial<typeof state>) => Object.assign(state, p);
-  return { useEmailStore: hook };
-});
-
-vi.mock('@/stores/settings-store', () => {
-  const state = {
-    timeFormat: '24h',
-    plainTextMode: false,
-    subAddressDelimiter: '+',
-    autoSelectReplyIdentity: true,
-    attachmentReminderEnabled: false,
-    attachmentReminderKeywords: [],
-    sendDelaySeconds: 0,
-    signaturePosition: 'above_quote',
-    signatureSeparatorEnabled: false,
-    requestReadReceiptDefault: false,
-    addTrustedSender: () => {},
-    trustedSendersAddressBook: null,
-  };
-  const hook = (sel?: (s: typeof state) => unknown) =>
-    typeof sel === 'function' ? sel(state) : state;
-  hook.getState = () => state;
-  hook.setState = (p: Partial<typeof state>) => Object.assign(state, p);
-  return { useSettingsStore: hook };
-});
-
-vi.mock('@/stores/contact-store', () => {
-  const state = {
-    contacts: [],
-    getAutocomplete: async () => [],
-    addToTrustedSendersBook: async () => {},
-  };
-  const hook = (sel?: (s: typeof state) => unknown) =>
-    typeof sel === 'function' ? sel(state) : state;
-  hook.getState = () => state;
-  hook.setState = (p: Partial<typeof state>) => Object.assign(state, p);
-  return { useContactStore: hook };
-});
-
-vi.mock('@/stores/template-store', () => {
-  const state = { templates: [], addTemplate: async () => {} };
-  const hook = (sel?: (s: typeof state) => unknown) =>
-    typeof sel === 'function' ? sel(state) : state;
-  hook.getState = () => state;
-  hook.setState = (p: Partial<typeof state>) => Object.assign(state, p);
-  return { useTemplateStore: hook };
-});
-
-// ─── Misc dependency mocks ────────────────────────────────────────────────────
-
-vi.mock('@/stores/toast-store', () => ({
-  toast: { info: () => {}, error: () => {}, success: () => {} },
-}));
-
-vi.mock('@/lib/plugin-hooks', () => ({
-  emailHooks: {
-    onComposerOpen: { call: async () => [] },
-    onRecipientChange: { call: async () => [] },
-    getRecipientSuggestions: { call: async () => [] },
-    onSend: { call: async () => [] },
-    beforeSend: { call: async () => [] },
-    onRecipientChipsChange: { transform: async (chips: unknown) => chips },
-  },
-  contactHooks: {
-    search: { call: async () => [] },
-  },
-}));
-
-vi.mock('@/lib/email-sanitization', () => ({
-  sanitizeSignatureHtml: (v: string) => v,
-  sanitizeEmailHtml: (v: string) => v,
-  parseHtmlSafely: (html: string) => new DOMParser().parseFromString(html, 'text/html'),
-}));
-
-vi.mock('@/lib/reply-identity', () => ({
-  resolveReplyFrom: () => null,
-  findComposeIdentityId: () => null,
-}));
-vi.mock('@/lib/email-threading', () => ({
-  computeReplyThreadingHeaders: () => ({ inReplyTo: [], references: [] }),
-}));
-vi.mock('@/lib/signature-utils', () => ({
-  appendPlainTextSignature: (body: string) => body,
-  getPlainTextSignature: () => '',
-}));
-vi.mock('@/lib/sub-addressing', () => ({ generateSubAddress: () => '' }));
-vi.mock('@/lib/debug', () => ({ debug: () => {} }));
-vi.mock('@/components/email/quoted-html', () => ({
-  buildQuotedHtmlBlock: () => '',
-  serializeEditorContent: () => '',
-}));
-vi.mock('@/lib/template-utils', () => ({ substitutePlaceholders: (s: string) => s }));
-
-// ─── DataTransfer polyfill ────────────────────────────────────────────────────
-
-/** jsdom's built-in DataTransfer doesn't fully support setData/getData in synthetic drag events. */
-class MockDataTransfer {
-  private _data: Record<string, string> = {};
-  types: string[] = [];
-  effectAllowed = '';
-  dropEffect = '';
-
-  setData(type: string, data: string) {
-    this._data[type] = data;
-    if (!this.types.includes(type)) this.types.push(type);
-  }
-
-  getData(type: string): string {
-    return this._data[type] ?? '';
-  }
-
-  setDragImage(_image: Element, _x: number, _y: number) {
-    // no-op: jsdom has no rendering, but the chip drag handler calls this.
-  }
-}
-
-// ─── Shared test data ─────────────────────────────────────────────────────────
-
-const BASE_DATA = {
-  to: 'alice@example.com, ',
-  cc: '',
-  bcc: '',
-  subject: '',
-  body: '',
-  showCc: true,
-  showBcc: true,
-  selectedIdentityId: null,
-  subAddressTag: '',
-  mode: 'compose' as const,
-  draftId: null,
-};
-
-// ─── Tests ────────────────────────────────────────────────────────────────────
-
-describe('RecipientChipInput drag and drop', () => {
-  beforeEach(() => { vi.clearAllMocks(); });
-
-  it('renders recipient chips with draggable="true"', async () => {
-    render(<EmailComposer initialData={BASE_DATA} />);
-
-    const chipText = await screen.findByText('alice@example.com');
-    const chipSpan = chipText.closest('[draggable]');
-    expect(chipSpan).not.toBeNull();
-    expect(chipSpan).toHaveAttribute('draggable', 'true');
-  });
-
-  it('onDragStart encodes the recipient and source field into dataTransfer', async () => {
-    render(<EmailComposer initialData={BASE_DATA} />);
-
-    const chipText = await screen.findByText('alice@example.com');
-    const chipSpan = chipText.closest('[draggable]') as HTMLElement;
-
-    const dt = new MockDataTransfer();
-    fireEvent.dragStart(chipSpan, { dataTransfer: dt });
-
-    // The enrichment pass may have stamped extra display metadata on the
-    // chip by drag time, so match the essential fields rather than deep-equal.
-    const payload = JSON.parse(dt.getData('application/x-recipient-chip'));
-    expect(payload).toMatchObject({ recipient: { email: 'alice@example.com' }, fromField: 'to', fromIndex: 0 });
-  });
-
-  it('keeps a display name with a comma in a single chip (array model)', async () => {
-    render(<EmailComposer initialData={{ ...BASE_DATA, to: '"Doo, John" <john@doo.org>, ' }} />);
-
-    // One chip, displayed as "Doo, John (john@doo.org)" — not split on the comma.
-    const chip = await screen.findByText('Doo, John (john@doo.org)');
-    const chipSpan = chip.closest('[draggable]') as HTMLElement;
-    expect(chipSpan).not.toBeNull();
-
-    const dt = new MockDataTransfer();
-    fireEvent.dragStart(chipSpan, { dataTransfer: dt });
-    const payload = JSON.parse(dt.getData('application/x-recipient-chip'));
-    expect(payload).toMatchObject({ recipient: { name: 'Doo, John', email: 'john@doo.org' }, fromField: 'to', fromIndex: 0 });
-  });
-
-  it('onDragEnd clears the opacity class on the chip', async () => {
-    render(<EmailComposer initialData={BASE_DATA} />);
-
-    const chipText = await screen.findByText('alice@example.com');
-    const chipSpan = chipText.closest('[draggable]') as HTMLElement;
-
-    fireEvent.dragStart(chipSpan, { dataTransfer: new MockDataTransfer() });
-    expect(chipSpan.className).toContain('opacity-50');
-
-    fireEvent.dragEnd(chipSpan);
-    expect(chipSpan.className).not.toContain('opacity-50');
-  });
-
-  it('dragOver on a different field container adds ring indicator; dragLeave removes it', async () => {
-    render(<EmailComposer initialData={BASE_DATA} />);
-
-    await screen.findByText('alice@example.com');
-
-    // The flex-wrap containers are the actual drop zones
-    const allContainers = Array.from(document.querySelectorAll('[class*="flex-wrap"]'));
-    // To-container has the draggable chip; cc-container doesn't
-    const toContainer = allContainers.find(el => el.querySelector('[draggable]')) as HTMLElement;
-    const ccContainer = allContainers.find(el => el !== toContainer) as HTMLElement;
-
-    if (!ccContainer) return;
-
-    const dt = new MockDataTransfer();
-    dt.setData('application/x-recipient-chip', JSON.stringify({ recipient: { email: 'alice@example.com' }, fromField: 'to' }));
-
-    fireEvent.dragOver(ccContainer, { dataTransfer: dt });
-    expect(ccContainer.className).toContain('ring-primary');
-
-    fireEvent.dragLeave(ccContainer, { relatedTarget: null });
-    expect(ccContainer.className).not.toContain('ring-primary');
-  });
-
-  it('drop on a different field container moves the chip', async () => {
-    render(<EmailComposer initialData={BASE_DATA} />);
-    await screen.findByText('alice@example.com');
-
-    const allContainers = Array.from(document.querySelectorAll('[class*="flex-wrap"]'));
-    const toContainer = allContainers.find(el => el.querySelector('[draggable]')) as HTMLElement;
-    const ccContainer = allContainers.find(el => el !== toContainer) as HTMLElement;
-
-    if (!toContainer || !ccContainer) return;
-
-    const dt = new MockDataTransfer();
-    dt.setData('application/x-recipient-chip', JSON.stringify({ recipient: { email: 'alice@example.com' }, fromField: 'to' }));
-    fireEvent.dragOver(ccContainer, { dataTransfer: dt });
-    act(() => {
-      fireEvent.drop(ccContainer, { dataTransfer: dt });
-    });
-
-    // Chip should still appear exactly once (moved, not duplicated or lost)
-    await screen.findByText('alice@example.com');
-    expect(screen.getAllByText('alice@example.com')).toHaveLength(1);
-
-    // The To container must now be empty
-    expect(toContainer.querySelectorAll('[draggable]')).toHaveLength(0);
-  });
-
-  it('drop on the same field container is a no-op', async () => {
-    render(<EmailComposer initialData={BASE_DATA} />);
-    await screen.findByText('alice@example.com');
-
-    const allContainers = Array.from(document.querySelectorAll('[class*="flex-wrap"]'));
-    const toContainer = allContainers.find(el => el.querySelector('[draggable]')) as HTMLElement;
-
-    const dt = new MockDataTransfer();
-    dt.setData('application/x-recipient-chip', JSON.stringify({ recipient: { email: 'alice@example.com' }, fromField: 'to' }));
-    fireEvent.dragOver(toContainer, { dataTransfer: dt });
-    act(() => {
-      fireEvent.drop(toContainer, { dataTransfer: dt });
-    });
-
-    // Chip stays present exactly once
-    expect(screen.getAllByText('alice@example.com')).toHaveLength(1);
-  });
-
-  it('dropping a chip onto the hidden Cc button shows the CC field', async () => {
-    render(<EmailComposer initialData={{ ...BASE_DATA, showCc: false, showBcc: false }} />);
-    await screen.findByText('alice@example.com');
-
-    const ccButton = screen.getByRole('button', { name: 'Cc' });
-
-    const dt = new MockDataTransfer();
-    dt.setData('application/x-recipient-chip', JSON.stringify({ recipient: { email: 'alice@example.com' }, fromField: 'to' }));
-    fireEvent.dragOver(ccButton, { dataTransfer: dt });
-    act(() => {
-      fireEvent.drop(ccButton, { dataTransfer: dt });
-    });
-
-    // cc_label is rendered by the mock translation as its key string
-    const ccLabel = await screen.findByText('cc_label');
-    expect(ccLabel).toBeInTheDocument();
-  });
-
-  // ─── Reordering within / across fields (#593) ─────────────────────────────────
-  // jsdom ignores `clientX` in fireEvent's init for drag events (it's a
-  // read-only MouseEvent getter) and gives every element a zero-size rect at
-  // (0,0). So we dispatch events with `clientX` forced via defineProperty; with
-  // the rect midpoint at 0, clientX>0 lands AFTER the hovered chip, <0 BEFORE.
-
-  const THREE = { ...BASE_DATA, to: 'alice@example.com, bob@example.com, carol@example.com, ' };
-
-  const chipByText = async (text: string) =>
-    (await screen.findByText(text)).closest('[draggable]') as HTMLElement;
-
-  /** Dispatch a drag event with a real clientX (fireEvent init drops it). */
-  const fireDnd = (type: 'dragover' | 'drop', el: HTMLElement, dt: MockDataTransfer, clientX: number) => {
-    const e = new Event(type, { bubbles: true, cancelable: true });
-    Object.defineProperty(e, 'clientX', { value: clientX });
-    Object.defineProperty(e, 'dataTransfer', { value: dt });
-    act(() => { fireEvent(el, e); });
-  };
-  const BEFORE = -100;
-  const AFTER = 100;
-
-  /** Ordered chip labels of the field-container that holds `anchorText`. */
-  const orderIn = (anchorText: string) => {
-    const containers = Array.from(document.querySelectorAll('[class*="flex-wrap"]'));
-    const c = containers.find(el =>
-      Array.from(el.querySelectorAll('[draggable]')).some(d => d.textContent?.includes(anchorText))
-    ) as HTMLElement;
-    return Array.from(c.querySelectorAll('[draggable]')).map(el => el.textContent?.trim() ?? '');
-  };
-
-  /** All draggable chips (across fields) whose label contains `text`. */
-  const draggableChipsWith = (text: string) =>
-    Array.from(document.querySelectorAll('[draggable]')).filter(el => el.textContent?.includes(text));
-
-  it('reorders a chip to the end of the same field (drop after the last chip)', async () => {
-    render(<EmailComposer initialData={THREE} />);
-    await screen.findByText('alice@example.com');
-    const alice = await chipByText('alice@example.com');
-    const carol = await chipByText('carol@example.com');
-
-    const dt = new MockDataTransfer();
-    fireEvent.dragStart(alice, { dataTransfer: dt });   // fromIndex 0
-    fireDnd('dragover', carol, dt, AFTER);              // after carol -> index 3
-    fireDnd('drop', carol, dt, AFTER);
-
-    expect(orderIn('bob@example.com')).toEqual([
-      'bob@example.com', 'carol@example.com', 'alice@example.com',
-    ]);
-  });
-
-  it('reorders a chip to the front of the same field (drop before the first chip)', async () => {
-    render(<EmailComposer initialData={THREE} />);
-    await screen.findByText('carol@example.com');
-    const carol = await chipByText('carol@example.com');
-    const alice = await chipByText('alice@example.com');
-
-    const dt = new MockDataTransfer();
-    fireEvent.dragStart(carol, { dataTransfer: dt });   // fromIndex 2
-    fireDnd('dragover', alice, dt, BEFORE);             // before alice -> index 0
-    fireDnd('drop', alice, dt, BEFORE);
-
-    expect(orderIn('alice@example.com')).toEqual([
-      'carol@example.com', 'alice@example.com', 'bob@example.com',
-    ]);
-  });
-
-  it('dropping a chip onto its own position leaves the order unchanged', async () => {
-    render(<EmailComposer initialData={THREE} />);
-    await screen.findByText('bob@example.com');
-    const bob = await chipByText('bob@example.com');
-
-    const dt = new MockDataTransfer();
-    fireEvent.dragStart(bob, { dataTransfer: dt });     // fromIndex 1
-    fireDnd('dragover', bob, dt, BEFORE);               // before itself -> index 1 (no-op)
-    fireDnd('drop', bob, dt, BEFORE);
-
-    expect(orderIn('bob@example.com')).toEqual([
-      'alice@example.com', 'bob@example.com', 'carol@example.com',
-    ]);
-  });
-
-  it('moves a chip into another field at the drop position (cross-field reorder)', async () => {
-    render(<EmailComposer initialData={{ ...BASE_DATA, to: 'alice@example.com, ', cc: 'x@example.com, y@example.com, ' }} />);
-    await screen.findByText('alice@example.com');
-    const alice = await chipByText('alice@example.com');       // To
-    const y = await chipByText('y@example.com');               // Cc
-
-    const dt = new MockDataTransfer();
-    fireEvent.dragStart(alice, { dataTransfer: dt });
-    fireDnd('dragover', y, dt, BEFORE);               // before y -> index 1 in Cc
-    fireDnd('drop', y, dt, BEFORE);
-
-    // alice lands between x and y; To no longer holds it (count only real chips,
-    // not the leftover jsdom drag-preview element)
-    expect(orderIn('x@example.com')).toEqual([
-      'x@example.com', 'alice@example.com', 'y@example.com',
-    ]);
-    expect(draggableChipsWith('alice@example.com')).toHaveLength(1);
-  });
-
-  it('shows a drop caret only while a chip is dragged over the field', async () => {
-    render(<EmailComposer initialData={THREE} />);
-    await screen.findByText('alice@example.com');
-    const alice = await chipByText('alice@example.com');
-    const bob = await chipByText('bob@example.com');
-
-    const dt = new MockDataTransfer();
-    fireEvent.dragStart(alice, { dataTransfer: dt });
-    expect(document.querySelector('[data-testid="recipient-drop-caret"]')).toBeNull();
-
-    fireDnd('dragover', bob, dt, BEFORE);
-    expect(document.querySelector('[data-testid="recipient-drop-caret"]')).not.toBeNull();
-
-    fireEvent.dragEnd(alice);
-    expect(document.querySelector('[data-testid="recipient-drop-caret"]')).toBeNull();
-  });
-});

components/email/__tests__/recipient-paste.test.tsx

@@ -1,300 +0,0 @@
-import { render, screen } from '@testing-library/react';
-import { fireEvent } from '@testing-library/dom';
-import { describe, it, expect, vi, beforeEach } from 'vitest';
-import React from 'react';
-import { EmailComposer } from '../email-composer';
-
-// ─── Heavy component mocks (mirrors recipient-chip-drag.test.tsx) ──────────────
-
-vi.mock('@/components/email/rich-text-editor', () => ({
-  RichTextEditor: ({ onChange }: { onChange?: (html: string) => void }) => (
-    React.createElement('div', { 'data-testid': 'rich-text-editor', onClick: () => onChange?.('') })
-  ),
-}));
-
-vi.mock('@/components/plugins/plugin-slot', () => ({ PluginSlot: () => null }));
-vi.mock('@/components/identity/sub-address-helper', () => ({ SubAddressHelper: () => null }));
-vi.mock('@/components/templates/template-picker', () => ({ TemplatePicker: () => null }));
-vi.mock('@/components/templates/template-form', () => ({ TemplateForm: () => null }));
-vi.mock('@/components/files/file-preview-modal', () => ({ FilePreviewModal: () => null }));
-vi.mock('@/hooks/use-focus-trap', () => ({
-  useFocusTrap: () => ({ ref: { current: null } }),
-}));
-vi.mock('@/hooks/use-pro-multi-account-identities', () => ({
-  useProMultiAccountIdentities: () => ({ enabled: false, groups: [], allIdentities: [] }),
-  stripCrossAccountIdentityPrefix: (id: string) => ({ localAccountId: null, rawId: id }),
-}));
-
-// ─── Store mocks ──────────────────────────────────────────────────────────────
-
-vi.mock('@/stores/auth-store', () => {
-  const state = {
-    client: null,
-    identities: [],
-    primaryIdentity: null,
-    isAuthenticated: false,
-    isDemoMode: false,
-    activeAccountId: null,
-    connectionLost: false,
-    getClientForAccount: () => undefined,
-    getAllConnectedClients: () => new Map(),
-    syncIdentities: () => {},
-    refreshIdentities: async () => {},
-  };
-  const hook = (sel?: (s: typeof state) => unknown) =>
-    typeof sel === 'function' ? sel(state) : state;
-  hook.getState = () => state;
-  hook.setState = (p: Partial<typeof state>) => Object.assign(state, p);
-  return { useAuthStore: hook };
-});
-
-vi.mock('@/stores/identity-store', () => {
-  const state = { identities: [], defaultIdentityId: null };
-  const hook = (sel?: (s: typeof state) => unknown) =>
-    typeof sel === 'function' ? sel(state) : state;
-  hook.getState = () => state;
-  hook.setState = (p: Partial<typeof state>) => Object.assign(state, p);
-  return { useIdentityStore: hook };
-});
-
-vi.mock('@/stores/account-store', () => {
-  const state = { accounts: [], getAccountById: () => undefined };
-  const hook = (sel?: (s: typeof state) => unknown) =>
-    typeof sel === 'function' ? sel(state) : state;
-  hook.getState = () => state;
-  hook.setState = (p: Partial<typeof state>) => Object.assign(state, p);
-  return { useAccountStore: hook };
-});
-
-vi.mock('@/stores/email-store', () => {
-  const state = {
-    draftSaveEnabled: false,
-    sendRawEmail: async () => ({ sent: true }),
-  };
-  const hook = (sel?: (s: typeof state) => unknown) =>
-    typeof sel === 'function' ? sel(state) : state;
-  hook.getState = () => state;
-  hook.setState = (p: Partial<typeof state>) => Object.assign(state, p);
-  return { useEmailStore: hook };
-});
-
-vi.mock('@/stores/settings-store', () => {
-  const state = {
-    timeFormat: '24h',
-    plainTextMode: false,
-    subAddressDelimiter: '+',
-    autoSelectReplyIdentity: true,
-    attachmentReminderEnabled: false,
-    attachmentReminderKeywords: [],
-    sendDelaySeconds: 0,
-    signaturePosition: 'above_quote',
-    signatureSeparatorEnabled: false,
-    requestReadReceiptDefault: false,
-    addTrustedSender: () => {},
-    trustedSendersAddressBook: null,
-  };
-  const hook = (sel?: (s: typeof state) => unknown) =>
-    typeof sel === 'function' ? sel(state) : state;
-  hook.getState = () => state;
-  hook.setState = (p: Partial<typeof state>) => Object.assign(state, p);
-  return { useSettingsStore: hook };
-});
-
-vi.mock('@/stores/contact-store', () => {
-  const state = {
-    contacts: [],
-    getAutocomplete: async () => [],
-    addToTrustedSendersBook: async () => {},
-  };
-  const hook = (sel?: (s: typeof state) => unknown) =>
-    typeof sel === 'function' ? sel(state) : state;
-  hook.getState = () => state;
-  hook.setState = (p: Partial<typeof state>) => Object.assign(state, p);
-  return { useContactStore: hook };
-});
-
-vi.mock('@/stores/template-store', () => {
-  const state = { templates: [], addTemplate: async () => {} };
-  const hook = (sel?: (s: typeof state) => unknown) =>
-    typeof sel === 'function' ? sel(state) : state;
-  hook.getState = () => state;
-  hook.setState = (p: Partial<typeof state>) => Object.assign(state, p);
-  return { useTemplateStore: hook };
-});
-
-// ─── Misc dependency mocks ────────────────────────────────────────────────────
-
-vi.mock('@/stores/toast-store', () => ({
-  toast: { info: () => {}, error: () => {}, success: () => {} },
-}));
-
-vi.mock('@/lib/plugin-hooks', () => ({
-  emailHooks: {
-    onComposerOpen: { call: async () => [] },
-    onRecipientChange: { call: async () => [] },
-    getRecipientSuggestions: { call: async () => [] },
-    onSend: { call: async () => [] },
-    beforeSend: { call: async () => [] },
-    onRecipientChipsChange: { transform: async (chips: unknown) => chips },
-  },
-  contactHooks: {
-    search: { call: async () => [] },
-  },
-}));
-
-vi.mock('@/lib/email-sanitization', () => ({
-  sanitizeSignatureHtml: (v: string) => v,
-  sanitizeEmailHtml: (v: string) => v,
-  parseHtmlSafely: (html: string) => new DOMParser().parseFromString(html, 'text/html'),
-}));
-
-vi.mock('@/lib/reply-identity', () => ({
-  resolveReplyFrom: () => null,
-  findComposeIdentityId: () => null,
-}));
-vi.mock('@/lib/email-threading', () => ({
-  computeReplyThreadingHeaders: () => ({ inReplyTo: [], references: [] }),
-}));
-vi.mock('@/lib/signature-utils', () => ({
-  appendPlainTextSignature: (body: string) => body,
-  getPlainTextSignature: () => '',
-}));
-vi.mock('@/lib/sub-addressing', () => ({ generateSubAddress: () => '' }));
-vi.mock('@/lib/debug', () => ({ debug: () => {} }));
-vi.mock('@/components/email/quoted-html', () => ({
-  buildQuotedHtmlBlock: () => '',
-  serializeEditorContent: () => '',
-}));
-vi.mock('@/lib/template-utils', () => ({ substitutePlaceholders: (s: string) => s }));
-
-// ─── Shared test data ─────────────────────────────────────────────────────────
-
-const EMPTY_DATA = {
-  to: '',
-  cc: '',
-  bcc: '',
-  subject: '',
-  body: '',
-  showCc: true,
-  showBcc: true,
-  selectedIdentityId: null,
-  subAddressTag: '',
-  mode: 'compose' as const,
-  draftId: null,
-};
-
-/** next-intl is mocked to return the key, so the To placeholder is "to_placeholder". */
-const toInput = () => screen.getByPlaceholderText('to_placeholder') as HTMLInputElement;
-const ccInput = () => screen.getByPlaceholderText('cc_placeholder') as HTMLInputElement;
-
-const paste = (input: HTMLElement, text: string) =>
-  fireEvent.paste(input, { clipboardData: { getData: () => text } });
-
-// ─── Tests ────────────────────────────────────────────────────────────────────
-
-describe('RecipientChipInput paste', () => {
-  beforeEach(() => { vi.clearAllMocks(); });
-
-  it('splits a pasted list (comma / semicolon / whitespace) into one chip per address', () => {
-    render(<EmailComposer initialData={EMPTY_DATA} />);
-    const input = toInput(); // capture once — placeholder disappears once chips exist
-    paste(input, 'a@x.com b@y.com; c@z.com');
-
-    expect(screen.getByText('a@x.com')).toBeInTheDocument();
-    expect(screen.getByText('b@y.com')).toBeInTheDocument();
-    expect(screen.getByText('c@z.com')).toBeInTheDocument();
-    // all consumed → input cleared
-    expect(input.value).toBe('');
-  });
-
-  it('chips the valid addresses and leaves invalid text in the input', () => {
-    render(<EmailComposer initialData={EMPTY_DATA} />);
-    const input = toInput();
-    paste(input, 'foo bar a@x.com');
-
-    expect(screen.getByText('a@x.com')).toBeInTheDocument();
-    expect(input.value).toBe('foo bar');
-  });
-
-  it('does not pre-empt a single-address paste (no delimiter → normal editing)', () => {
-    render(<EmailComposer initialData={EMPTY_DATA} />);
-    paste(toInput(), 'single@x.com');
-
-    // The handler bailed out, so no chip was created from the single token.
-    expect(screen.queryByText('single@x.com')).not.toBeInTheDocument();
-  });
-
-  it('keeps display names from a fully-quoted "Name <email>" list', () => {
-    render(<EmailComposer initialData={EMPTY_DATA} />);
-    const input = toInput();
-    paste(input, '"Alice Smith <alice@x.com>", "Alex Smith <alex@x.com>"');
-
-    // Chips render as "Name (email)" when a display name is present.
-    expect(screen.getByText('Alice Smith (alice@x.com)')).toBeInTheDocument();
-    expect(screen.getByText('Alex Smith (alex@x.com)')).toBeInTheDocument();
-    expect(input.value).toBe('');
-  });
-
-  it('keeps a `Name <email>` pair as a single named chip', () => {
-    render(<EmailComposer initialData={EMPTY_DATA} />);
-    const input = toInput();
-    paste(input, 'John Doe <j@x.com>, jane@y.com');
-
-    expect(screen.getByText('John Doe (j@x.com)')).toBeInTheDocument();
-    expect(screen.getByText('jane@y.com')).toBeInTheDocument();
-    expect(input.value).toBe('');
-  });
-
-  it('keeps a comma inside a quoted display name intact', () => {
-    render(<EmailComposer initialData={EMPTY_DATA} />);
-    const input = toInput();
-    paste(input, '"Doe, John" <j@x.com>; bob@z.com');
-
-    expect(screen.getByText('Doe, John (j@x.com)')).toBeInTheDocument();
-    expect(screen.getByText('bob@z.com')).toBeInTheDocument();
-    expect(input.value).toBe('');
-  });
-
-  it('splits a newline-separated block (e.g. a spreadsheet column)', () => {
-    render(<EmailComposer initialData={EMPTY_DATA} />);
-    const input = toInput();
-    paste(input, 'a@x.com\nb@y.com\nc@z.com');
-
-    expect(screen.getByText('a@x.com')).toBeInTheDocument();
-    expect(screen.getByText('b@y.com')).toBeInTheDocument();
-    expect(screen.getByText('c@z.com')).toBeInTheDocument();
-    expect(input.value).toBe('');
-  });
-
-  it('dedupes case-insensitively within the paste and against existing chips', () => {
-    render(<EmailComposer initialData={EMPTY_DATA} />);
-    const input = toInput(); // DOM node persists across pastes (placeholder just clears)
-    paste(input, 'a@x.com, A@X.com, b@y.com'); // within-paste dup collapses
-    paste(input, 'A@X.COM, c@z.com'); // dup of an existing chip is dropped
-
-    expect(screen.getByText('b@y.com')).toBeInTheDocument();
-    expect(screen.getByText('c@z.com')).toBeInTheDocument();
-    // a@x.com appears exactly once despite three case variants across two pastes.
-    expect(screen.getAllByText('a@x.com')).toHaveLength(1);
-    expect(screen.queryByText('A@X.COM')).not.toBeInTheDocument();
-    expect(input.value).toBe('');
-  });
-
-  it('chips the valid (named) entries and leaves a non-address token behind', () => {
-    render(<EmailComposer initialData={EMPTY_DATA} />);
-    const input = toInput();
-    paste(input, '"VIP" <vip@x.com>, not-an-email, b@y.com');
-
-    expect(screen.getByText('VIP (vip@x.com)')).toBeInTheDocument();
-    expect(screen.getByText('b@y.com')).toBeInTheDocument();
-    expect(input.value).toBe('not-an-email');
-  });
-
-  it('works on the Cc field (shared handler)', () => {
-    render(<EmailComposer initialData={EMPTY_DATA} />);
-    paste(ccInput(), 'x@a.com; y@b.com');
-
-    expect(screen.getByText('x@a.com')).toBeInTheDocument();
-    expect(screen.getByText('y@b.com')).toBeInTheDocument();
-  });
-});

components/email/__tests__/selectable-avatar.test.tsx

@@ -1,39 +0,0 @@
-import { describe, it, expect, vi } from 'vitest';
-import { render, screen, fireEvent } from '@testing-library/react';
-import { SelectableAvatar } from '../selectable-avatar';
-
-// Isolate from the real Avatar (image fetching, libravatar hashing) — we only
-// care about the selection wrapper behaviour here.
-vi.mock('@/components/ui/avatar', () => ({
-  Avatar: (props: { name?: string }) => <span data-testid="avatar">{props.name}</span>,
-}));
-
-describe('SelectableAvatar', () => {
-  it('renders the wrapped avatar', () => {
-    render(<SelectableAvatar name="Marta" checked={false} onToggle={() => {}} selectLabel="Select" />);
-    expect(screen.getByTestId('avatar')).toHaveTextContent('Marta');
-  });
-
-  it('fires onToggle and stops propagation when the avatar is clicked', () => {
-    const onToggle = vi.fn();
-    const onRowClick = vi.fn();
-    render(
-      <div onClick={onRowClick}>
-        <SelectableAvatar name="Marta" checked={false} onToggle={onToggle} selectLabel="Select" />
-      </div>,
-    );
-    fireEvent.click(screen.getByRole('checkbox'));
-    expect(onToggle).toHaveBeenCalledTimes(1);
-    // Clicking the avatar must not bubble up to open/select the row.
-    expect(onRowClick).not.toHaveBeenCalled();
-  });
-
-  it('reflects the checked state via aria-checked', () => {
-    const { rerender } = render(
-      <SelectableAvatar name="Marta" checked={false} onToggle={() => {}} selectLabel="Select" />,
-    );
-    expect(screen.getByRole('checkbox')).toHaveAttribute('aria-checked', 'false');
-    rerender(<SelectableAvatar name="Marta" checked onToggle={() => {}} selectLabel="Select" />);
-    expect(screen.getByRole('checkbox')).toHaveAttribute('aria-checked', 'true');
-  });
-});

components/email/__tests__/signature-block.test.ts

@@ -1,38 +0,0 @@
-import { describe, expect, it } from 'vitest';
-import { Editor } from '@tiptap/core';
-import StarterKit from '@tiptap/starter-kit';
-
-import { SignatureBlock, buildSignatureBlock, SIGNATURE_BLOCK_MARKER } from '../signature-block';
-import { serializeEditorContent } from '../quoted-html';
-
-describe('signature-block', () => {
-  it('buildSignatureBlock wraps html in the marker div', () => {
-    expect(buildSignatureBlock('<b>x</b>')).toBe(`<div ${SIGNATURE_BLOCK_MARKER}><b>x</b></div>`);
-  });
-
-  it('preserves an inline-styled signature through parse + serialize (no schema flattening)', () => {
-    const styled =
-      '<table style="background:#0a0e16;border-radius:8px"><tbody><tr>' +
-      '<td style="color:#c6f24e;font-family:\'Courier New\'">MV</td>' +
-      '</tr></tbody></table>';
-    const editor = new Editor({
-      element: document.createElement('div'),
-      extensions: [StarterKit, SignatureBlock],
-      content: `<p>Hello</p>${buildSignatureBlock(styled)}`,
-    });
-    try {
-      const out = serializeEditorContent(editor);
-      // Original inline styling survives - it is NOT re-parsed into the schema.
-      expect(out).toContain('background:#0a0e16');
-      expect(out).toContain('border-radius:8px');
-      expect(out).toContain('color:#c6f24e');
-      expect(out).toContain(SIGNATURE_BLOCK_MARKER);
-      // Surrounding body is preserved.
-      expect(out).toContain('Hello');
-      // The signature did not get the editor's generic table styling.
-      expect(out).not.toContain('rgb(204, 204, 204)');
-    } finally {
-      editor.destroy();
-    }
-  });
-});

components/email/calendar-invitation-banner.tsx

@@ -20,7 +20,6 @@ import {
 } from 'lucide-react';
 import { useTranslations, useFormatter } from 'next-intl';
 import { useRouter } from '@/i18n/navigation';
-import { isDocumentRTL } from '@/i18n/direction';
 import { useAuthStore } from '@/stores/auth-store';
 import { useCalendarStore } from '@/stores/calendar-store';
 import { useSettingsStore } from '@/stores/settings-store';
@@ -375,7 +374,7 @@ export function CalendarInvitationBanner({ email }: CalendarInvitationBannerProp
   const [actionError, setActionError] = useState<string | null>(null);
   const [isProcessing, setIsProcessing] = useState(false);
   const [showCalendarPicker, setShowCalendarPicker] = useState(false);
-  const [pickerPosition, setPickerPosition] = useState<{ top: number; left?: number; right?: number } | null>(null);
+  const [pickerPosition, setPickerPosition] = useState<{ top: number; left: number } | null>(null);
   const pickerTriggerRef = useRef<HTMLButtonElement>(null);
   const [selectedCalendarId, setSelectedCalendarId] = useState<string>('');
   const [rawIcsMethod, setRawIcsMethod] = useState<InvitationMethod>('unknown');
@@ -554,10 +553,40 @@ export function CalendarInvitationBanner({ email }: CalendarInvitationBannerProp
     const replyToForRsvp = parsedEvent.replyTo
       || (parsedEvent.organizerCalendarAddress ? { imip: parsedEvent.organizerCalendarAddress } : null);
 
-    // The iMIP REPLY to the organizer is sent by the server: rsvpEvent /
-    // updateEvent below pass sendSchedulingMessages=true to CalendarEvent/set
-    // and Stalwart queues the iTIP REPLY itself. A manual client-side reply
-    // here produced duplicate emails.
+    const imipStatus = status.toUpperCase() as 'ACCEPTED' | 'TENTATIVE' | 'DECLINED';
+    const organizerEmail = parsedEvent?.replyTo?.imip?.replace('mailto:', '')
+      || parsedEvent?.organizerCalendarAddress?.replace('mailto:', '')
+      || summary?.organizerEmail
+      || null;
+
+    // Send the iMIP REPLY email to the organizer (client-side scheduling).
+    // Called after updating the local calendar event. Best-effort - if it
+    // fails we still report the RSVP as sent since the calendar was updated.
+    const sendImipReply = async () => {
+      if (!organizerEmail || !parsedEvent?.uid || !currentUserEmail) {
+        return;
+      }
+
+      try {
+        await client.sendImipReply({
+          organizerEmail,
+          organizerName: summary?.organizer || undefined,
+          attendeeEmail: currentUserEmail,
+          attendeeName: myParticipant?.participant.name || undefined,
+          uid: parsedEvent.uid,
+          summary: parsedEvent.title,
+          dtStart: parsedEvent.start || undefined,
+          dtEnd: summary?.end || undefined,
+          timeZone: parsedEvent.timeZone || undefined,
+          isAllDay: parsedEvent.showWithoutTime || false,
+          sequence: parsedEvent.sequence,
+          status: imipStatus,
+        });
+      } catch {
+        // Best-effort: don't block the RSVP success notification
+      }
+    };
+
     try {
       const eventForRsvp = existingEvent
         ? await resolveExistingEventForRsvp()
@@ -572,6 +601,7 @@ export function CalendarInvitationBanner({ email }: CalendarInvitationBannerProp
       );
       if (eventForRsvp && existingEventParticipant) {
         await rsvpEvent(client, eventForRsvp.id, existingEventParticipant.id, status, replyToForRsvp);
+        await sendImipReply();
         setRsvpStatus(status);
         setActionNotice(t('rsvp_sent'));
         setState('parsed');
@@ -583,13 +613,9 @@ export function CalendarInvitationBanner({ email }: CalendarInvitationBannerProp
         } else {
           await updateEvent(client, eventForRsvp.id, {
             participants: repairedParticipants,
-            // Stalwart routes the iTIP REPLY via the stored ORGANIZER
-            // (organizerCalendarAddress; the RFC 8984 replyTo is retired).
-            // Only repair a missing organizer - attendees may not modify it.
-            ...(replyToForRsvp?.imip && !eventForRsvp.organizerCalendarAddress
-              ? { organizerCalendarAddress: replyToForRsvp.imip }
-              : {}),
+            replyTo: replyToForRsvp ?? undefined,
           }, true);
+          await sendImipReply();
           setRsvpStatus(status);
           setActionNotice(t('rsvp_sent'));
           setState('parsed');
@@ -606,6 +632,7 @@ export function CalendarInvitationBanner({ email }: CalendarInvitationBannerProp
             || (newEvent && currentUserEmail ? findParticipantByEmail(newEvent, currentUserEmail) : null);
           if (newEvent && participant) {
             await rsvpEvent(client, newEvent.id, participant.id, status, replyToForRsvp);
+            await sendImipReply();
             setRsvpStatus(status);
             setActionNotice(t('rsvp_sent'));
           } else {
@@ -1027,11 +1054,7 @@ export function CalendarInvitationBanner({ email }: CalendarInvitationBannerProp
                   }
                   if (pickerTriggerRef.current) {
                     const rect = pickerTriggerRef.current.getBoundingClientRect();
-                    setPickerPosition(
-                      isDocumentRTL()
-                        ? { top: rect.bottom + 4, right: window.innerWidth - rect.right }
-                        : { top: rect.bottom + 4, left: rect.left }
-                    );
+                    setPickerPosition({ top: rect.bottom + 4, left: rect.left });
                   }
                   setShowCalendarPicker(true);
                 }}
@@ -1046,7 +1069,7 @@ export function CalendarInvitationBanner({ email }: CalendarInvitationBannerProp
               {showCalendarPicker && calendars.length > 1 && pickerPosition && typeof document !== 'undefined' && createPortal(
                 <div
                   className="fixed w-52 bg-background rounded-lg shadow-lg border border-border z-50 py-1"
-                  style={{ top: pickerPosition.top, left: pickerPosition.left, right: pickerPosition.right }}
+                  style={{ top: pickerPosition.top, left: pickerPosition.left }}
                 >
                   <div className="px-3 py-1.5 text-xs font-medium text-muted-foreground">
                     {t('select_calendar')}
@@ -1058,7 +1081,7 @@ export function CalendarInvitationBanner({ email }: CalendarInvitationBannerProp
                         setShowCalendarPicker(false);
                         handleImport(cal.id);
                       }}
-                      className="w-full px-3 py-1.5 text-sm text-start hover:bg-muted flex items-center gap-2"
+                      className="w-full px-3 py-1.5 text-sm text-left hover:bg-muted flex items-center gap-2"
                     >
                       <span
                         className="w-3 h-3 rounded-full flex-shrink-0"
@@ -1100,7 +1123,7 @@ export function CalendarInvitationBanner({ email }: CalendarInvitationBannerProp
           )}
 
           {isProcessing && (
-            <Loader2 className="w-4 h-4 animate-spin text-muted-foreground ms-auto" />
+            <Loader2 className="w-4 h-4 animate-spin text-muted-foreground ml-auto" />
           )}
         </div>
         )}

components/email/email-context-menu.tsx

@@ -17,8 +17,6 @@ import {
   Mail,
   MailOpen,
   Star,
-  Pin,
-  PinOff,
   Trash2,
   Archive,
   FolderInput,
@@ -36,7 +34,6 @@ import {
   XCircle,
 } from "lucide-react";
 import { cn, buildMailboxTree, MailboxNode } from "@/lib/utils";
-import { localizeMailboxName } from "@/lib/mailbox-label";
 import { useSettingsStore, KEYWORD_PALETTE } from "@/stores/settings-store";
 
 interface Position {
@@ -61,7 +58,6 @@ interface EmailContextMenuProps {
   onForward?: () => void;
   onMarkAsRead?: (read: boolean) => void;
   onToggleStar?: () => void;
-  onTogglePinned?: () => void;
   onDelete?: () => void;
   onArchive?: () => void;
   onSetColorTag?: (color: string | null) => void;
@@ -129,7 +125,6 @@ export function EmailContextMenu({
   onForward,
   onMarkAsRead,
   onToggleStar,
-  onTogglePinned,
   onDelete,
   onArchive,
   onSetColorTag,
@@ -148,19 +143,14 @@ export function EmailContextMenu({
   onRescheduleScheduled,
 }: EmailContextMenuProps) {
   const t = useTranslations("context_menu");
-  const tSidebar = useTranslations("sidebar");
   const _tColor = useTranslations("email_viewer.color_tag");
   const emailKeywords = useSettingsStore((state) => state.emailKeywords);
   const isUnread = !email.keywords?.$seen;
   const isStarred = email.keywords?.$flagged;
-  const isPinned = email.keywords?.['$pinned'] === true;
   const isDraft = email.keywords?.['$draft'] === true;
   const currentColors = getCurrentColors(email.keywords);
   const showBatchActions = isMultiSelect && selectedCount > 1;
   const isInJunkFolder = currentMailboxRole === 'junk';
-  // Marking your own outgoing mail as spam makes no sense - hide the action
-  // in Sent, Drafts and Scheduled.
-  const spamApplicable = !['sent', 'drafts', 'scheduled'].includes(currentMailboxRole || '');
   const isScheduled = email.isScheduled === true;
   const canCancelScheduled = isScheduled && email.scheduledUndoStatus === 'pending';
 
@@ -295,7 +285,6 @@ export function EmailContextMenu({
       <ContextMenuItem
         icon={Trash2}
         label={t("delete")}
-        testId="ctx-delete"
         onClick={() =>
           handleAction(showBatchActions ? onBatchDelete! : onDelete!)
         }
@@ -307,20 +296,18 @@ export function EmailContextMenu({
 
       {/* Move to submenu */}
       {moveTree.length > 0 && (
-        <ContextMenuSubMenu icon={FolderInput} label={t("move_to")} testId="ctx-move-to">
+        <ContextMenuSubMenu icon={FolderInput} label={t("move_to")}>
           {(() => {
             const renderNodes = (nodes: MailboxNode[]) => {
               return nodes.map((node) => {
                 const Icon = getMailboxIcon(node.role);
                 const isTarget = moveTargetIds.has(node.id);
-                const nodeLabel = localizeMailboxName(node.role, node.name, (k) => tSidebar(`mailboxes.${k}`));
                 return (
                   <div key={node.id}>
                     {isTarget ? (
                       <ContextMenuItem
                         icon={Icon}
-                        label={nodeLabel}
-                        testId={`move-to:${node.id}`}
+                        label={node.name}
                         onClick={() =>
                           handleAction(() =>
                             showBatchActions
@@ -332,11 +319,11 @@ export function EmailContextMenu({
                     ) : (
                       <div className="px-3 py-1.5 text-sm flex items-center gap-2 text-muted-foreground">
                         <Icon className="w-4 h-4 flex-shrink-0" />
-                        <span>{nodeLabel}</span>
+                        <span>{node.name}</span>
                       </div>
                     )}
                     {node.children.length > 0 && (
-                      <div className="ps-4">
+                      <div className="pl-4">
                         {renderNodes(node.children)}
                       </div>
                     )}
@@ -359,15 +346,6 @@ export function EmailContextMenu({
         />
       )}
 
-      {/* Pin/Unpin - only for single email; pinned mails float to the top of the list */}
-      {!showBatchActions && onTogglePinned && (
-        <ContextMenuItem
-          icon={isPinned ? PinOff : Pin}
-          label={isPinned ? t("unpin") : t("pin")}
-          onClick={() => handleAction(onTogglePinned)}
-        />
-      )}
-
       {/* Set tag submenu - only for single email */}
       {!showBatchActions && (
         <ContextMenuSubMenu icon={Tag} label={t("color_tag")}>
@@ -379,7 +357,7 @@ export function EmailContextMenu({
                 role="menuitem"
                 onClick={() => handleAction(() => onSetColorTag?.(option.value))}
                 className={cn(
-                  "w-full px-3 py-1.5 text-sm text-start flex items-center gap-2 hover:bg-muted cursor-pointer",
+                  "w-full px-3 py-1.5 text-sm text-left flex items-center gap-2 hover:bg-muted cursor-pointer",
                   isActive && "bg-accent font-medium"
                 )}
               >
@@ -404,27 +382,22 @@ export function EmailContextMenu({
         </ContextMenuSubMenu>
       )}
 
-      {/* Spam - contextual based on folder; pointless on own outgoing mail */}
-      {spamApplicable && (
-        <>
-          <ContextMenuSeparator />
+      <ContextMenuSeparator />
 
-          <ContextMenuItem
-            icon={isInJunkFolder ? ShieldCheck : ShieldAlert}
-            label={isInJunkFolder ? t("not_spam") : t("mark_as_spam")}
-            testId={isInJunkFolder ? "ctx-not-spam" : "ctx-spam"}
-            onClick={() =>
-              handleAction(
-                showBatchActions
-                  ? (isInJunkFolder ? onBatchUndoSpam! : onBatchMarkAsSpam!)
-                  : (isInJunkFolder ? onUndoSpam! : onMarkAsSpam!)
-              )
-            }
-            disabled={showBatchActions ? (isInJunkFolder ? !onBatchUndoSpam : !onBatchMarkAsSpam) : (isInJunkFolder ? !onUndoSpam : !onMarkAsSpam)}
-            destructive={!isInJunkFolder}
-          />
-        </>
-      )}
+      {/* Spam - contextual based on folder */}
+      <ContextMenuItem
+        icon={isInJunkFolder ? ShieldCheck : ShieldAlert}
+        label={isInJunkFolder ? t("not_spam") : t("mark_as_spam")}
+        onClick={() =>
+          handleAction(
+            showBatchActions
+              ? (isInJunkFolder ? onBatchUndoSpam! : onBatchMarkAsSpam!)
+              : (isInJunkFolder ? onUndoSpam! : onMarkAsSpam!)
+          )
+        }
+        disabled={showBatchActions ? (isInJunkFolder ? !onBatchUndoSpam : !onBatchMarkAsSpam) : (isInJunkFolder ? !onUndoSpam : !onMarkAsSpam)}
+        destructive={!isInJunkFolder}
+      />
 
       <ContextMenuSeparator />
 
@@ -432,7 +405,6 @@ export function EmailContextMenu({
       <ContextMenuItem
         icon={isUnread ? MailOpen : Mail}
         label={isUnread ? t("mark_read") : t("mark_unread")}
-        testId={isUnread ? "ctx-mark-read" : "ctx-mark-unread"}
         onClick={() =>
           handleAction(() =>
             showBatchActions