@rapidmx/autodiscover-plugin 1.0.0-beta.1

package/dist/lib/BaseAutodiscoverRoute.js

@@ -0,0 +1,205 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+///////////////////////////////////////////////////////////////////////////////
+// Copyright (C) 2026 Jean-Philippe Steinmetz. All rights reserved.
+// SPDX-License-Identifier: MPL-2.0
+///////////////////////////////////////////////////////////////////////////////
+import { ObjectDecorators } from "@rapidrest/core";
+import { RepoUtils, RouteDecorators } from "@rapidrest/service-core";
+import { buildOutlookSuccessXml, buildPoxSuccessXml, extractAcceptableResponseSchema, extractEmailAddress, OUTLOOK_RESPONSE_SCHEMA, } from "./AutodiscoverXml.js";
+import { PluginRegistry } from "@rapidmx/restapi";
+const { Config, Init, Logger } = ObjectDecorators;
+/** The plugin packages whose endpoints Autodiscover advertises. */
+export const ACTIVESYNC_PLUGIN = "@rapidmx/activesync";
+export const MAPI_PLUGIN = "@rapidmx/mapi";
+const { Get, Param, Post, Query, Request, Response } = RouteDecorators;
+/**
+ * Abstract base for the two Autodiscover endpoints a real mail client uses to find this deployment's EAS
+ * server URL from just an email address - classic POX (`POST /autodiscover/autodiscover.xml`, per
+ * `[MS-ASCMD]`'s "MobileSync" response schema) and the modern JSON variant Microsoft calls "Autodiscover v2"
+ * (`GET /autodiscover/autodiscover.json/v1.0/<email>?Protocol=ActiveSync`). Like `BaseMailIngestRoute`/
+ * `BaseEasRoute`, this class is undecorated; its Mongo/SQL concrete classes are mounted at `/autodiscover`, which
+ * composes with this class's own relative method paths to land exactly on the real spec's conventional paths (`/autodiscover/autodiscover.xml`, `/autodiscover/autodiscover.json/v1.0/:email`).
+ *
+ * **Auth: deliberately none.** Real classic Autodiscover conventionally expects the client to send HTTP Basic
+ * credentials (email+password), with the server free to answer `401` and force re-entry - a model this
+ * library's JWT-only, no-credential-verification-of-our-own boundary (see `BaseEasRoute`'s own doc comment on
+ * why per-request Basic Auth was rejected there) can't and shouldn't absorb; no credential-verification
+ * function exists in this codebase or its dependencies. Instead, both endpoints here follow Microsoft's own
+ * Autodiscover v2 design intent exactly: answer anonymously, and reveal nothing but a deployment-wide,
+ * config-supplied EAS server URL - not a per-mailbox secret - once the request email is confirmed to belong to
+ * a real `Mailbox` in this deployment. The actual security boundary is unchanged from Phase 2: real mailbox
+ * access still requires a JWT at `BaseEasRoute`, exactly as today.
+ *
+ * **Known gap, deliberately out of scope**: `Action.Redirect` (for multi-tenant hosted providers whose mailbox
+ * moved to a different domain) is not implemented - this library serves exactly one EAS URL for its whole
+ * deployment, so there's never a different domain to redirect to. The client-side well-known-URL discovery
+ * sequence (`MS-OXDISCO`: root domain -> `autodiscover.` subdomain -> unauthenticated HTTP redirect probe ->
+ * DNS SRV record -> cache) and the DNS `CNAME`/`SRV` record setup it depends on are also out of scope here -
+ * both are client/deployment concerns, not application code; this class only needs to answer correctly once a
+ * request actually arrives at one of its two paths.
+ *
+ * `mailboxClass` is supplied by the Mongo/SQL concrete subclasses following the exact one-line-per-backend
+ * pattern used throughout this library. The advertised URLs are built from the `mail:autodiscover:public_url`
+ * setting, and each protocol is only advertised while its plugin (`@rapidmx/activesync`, `@rapidmx/mapi`) is
+ * loaded, so a client is never pointed at an endpoint this deployment doesn't serve.
+ *
+ * @author Jean-Philippe Steinmetz
+ */
+export class BaseAutodiscoverRoute {
+    constructor() {
+        /** The public base URL clients reach this deployment at, e.g. `https://mail.example.com`. */
+        this.publicUrl = "";
+    }
+    /** The EAS endpoint URL to report, or `undefined` when ActiveSync isn't available here. */
+    get easUrl() {
+        return this.endpointUrl(ACTIVESYNC_PLUGIN, "/Microsoft-Server-ActiveSync");
+    }
+    /** The MAPI/HTTP `emsmdb` endpoint URL to report to a real Outlook desktop client, or `undefined` when MAPI
+     * isn't available here. Only used by `pox()`'s Outlook/EXCH response branch. */
+    get mapiUrl() {
+        return this.endpointUrl(MAPI_PLUGIN, "/mapi/emsmdb");
+    }
+    /**
+     * Builds the query value used to match `Mailbox.aliasAddresses` against the given address. See
+     * `BaseMailIngestRoute.aliasQueryValue()`'s identical doc comment - same Mongo-array vs.
+     * SQL-`simple-json`-column backend split, same override point (`AutodiscoverRouteSQL` overrides this
+     * identically to `MailIngestRouteSQL`).
+     */
+    aliasQueryValue(address) {
+        return address;
+    }
+    endpointUrl(plugin, path) {
+        if (!this.publicUrl || !PluginRegistry.isActive(plugin)) {
+            return undefined;
+        }
+        return `${this.publicUrl.replace(/\/+$/, "")}${path}`;
+    }
+    async init() {
+        if (!this.publicUrl) {
+            this.logger?.warn("Autodiscover has no mail:autodiscover:public_url set, so it can't point clients at any protocol.");
+        }
+        this.mailboxRepo = await this._objectFactory.newInstance(RepoUtils, {
+            name: this.mailboxClass.name,
+            args: [this.mailboxClass],
+        });
+    }
+    async resolveMailbox(email) {
+        const address = email.trim().toLowerCase();
+        const [byPrimary, byAlias] = await Promise.all([
+            this.mailboxRepo.find({ primarySmtpAddress: address }, { ignoreACL: true, limit: 1 }),
+            this.mailboxRepo.find({ aliasAddresses: this.aliasQueryValue(address) }, { ignoreACL: true, limit: 1 }),
+        ]);
+        return byPrimary[0] ?? byAlias[0];
+    }
+    /**
+     * Classic POX Autodiscover. Per Microsoft's own client-behavior documentation, a permanent failure is just
+     * as validly conveyed via a plain HTTP status as via an inner `Error` element, so this uses the HTTP-status
+     * form for both error cases rather than inventing values for `[MS-ASCMD]`'s provider-specific numeric
+     * error-code table.
+     *
+     * Branches on the request's `AcceptableResponseSchema` to decide which response shape to build: a real
+     * Outlook desktop client sends `[MS-OXDSCLI]`'s Outlook/EXCH schema (`OUTLOOK_RESPONSE_SCHEMA`) to locate
+     * this deployment's MAPI/HTTP endpoint (`buildOutlookSuccessXml`); any other value (or a mobile/EAS-only
+     * client that omits the field entirely) gets the original MobileSync/EAS response (`buildPoxSuccessXml`).
+     */
+    async pox(req, res) {
+        if (!this.mailboxRepo) {
+            res.status(500).send();
+            return;
+        }
+        const body = req.rawBody ? req.rawBody.toString("utf-8") : "";
+        const email = extractEmailAddress(body);
+        if (!email) {
+            res.status(400).send();
+            return;
+        }
+        const mailbox = await this.resolveMailbox(email);
+        if (!mailbox) {
+            res.status(404).send();
+            return;
+        }
+        const outlook = extractAcceptableResponseSchema(body) === OUTLOOK_RESPONSE_SCHEMA;
+        const url = outlook ? this.mapiUrl : this.easUrl;
+        if (!url) {
+            // The protocol this client asked about isn't served here - a 404 lets it move on to its next discovery step.
+            res.status(404).send();
+            return;
+        }
+        const xml = outlook
+            ? buildOutlookSuccessXml({ emailAddress: email, displayName: mailbox.displayName, mapiUrl: url })
+            : buildPoxSuccessXml({ emailAddress: email, displayName: mailbox.displayName, easUrl: url });
+        res.setHeader("Content-Type", "application/xml; charset=utf-8").status(200).send(xml);
+    }
+    /**
+     * Autodiscover v2 (JSON). Only the `ActiveSync` protocol is served - this library has no EWS/other
+     * protocol surface to advertise - so any other `Protocol` value is rejected outright rather than silently
+     * answered with an EAS URL under the wrong protocol name.
+     */
+    async v2(email, protocol, res) {
+        if (!this.mailboxRepo) {
+            res.status(500).send();
+            return;
+        }
+        // An unsupported protocol and ActiveSync not being available here get the same answer.
+        const easUrl = this.easUrl;
+        if (protocol !== "ActiveSync" || !easUrl) {
+            res.status(400).json({
+                ErrorCode: "ProtocolNotSupported",
+                ErrorMessage: `Unsupported protocol: ${protocol ?? ""}`,
+            });
+            return;
+        }
+        const mailbox = await this.resolveMailbox(decodeURIComponent(email));
+        if (!mailbox) {
+            res.status(404).json({
+                ErrorCode: "UserNotFound",
+                ErrorMessage: "No mailbox exists for the given address.",
+            });
+            return;
+        }
+        res.status(200).json({ Protocol: "ActiveSync", Url: easUrl });
+    }
+}
+__decorate([
+    Config("mail:autodiscover:public_url", ""),
+    __metadata("design:type", String)
+], BaseAutodiscoverRoute.prototype, "publicUrl", void 0);
+__decorate([
+    Logger,
+    __metadata("design:type", Object)
+], BaseAutodiscoverRoute.prototype, "logger", void 0);
+__decorate([
+    Init,
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", []),
+    __metadata("design:returntype", Promise)
+], BaseAutodiscoverRoute.prototype, "init", null);
+__decorate([
+    Post("/autodiscover.xml"),
+    __param(0, Request),
+    __param(1, Response),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Object]),
+    __metadata("design:returntype", Promise)
+], BaseAutodiscoverRoute.prototype, "pox", null);
+__decorate([
+    Get("/autodiscover.json/v1.0/:email"),
+    __param(0, Param("email")),
+    __param(1, Query("Protocol")),
+    __param(2, Response),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String, Object, Object]),
+    __metadata("design:returntype", Promise)
+], BaseAutodiscoverRoute.prototype, "v2", null);
+//# sourceMappingURL=BaseAutodiscoverRoute.js.map

package/dist/lib/BaseAutodiscoverRoute.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"BaseAutodiscoverRoute.js","sourceRoot":"","sources":["../../src/BaseAutodiscoverRoute.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,+EAA+E;AAC/E,mEAAmE;AACnE,mCAAmC;AACnC,+EAA+E;AAC/E,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAA4C,SAAS,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC/G,OAAO,EACH,sBAAsB,EACtB,kBAAkB,EAClB,+BAA+B,EAC/B,mBAAmB,EACnB,uBAAuB,GAC1B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAW,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAC3D,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,gBAAgB,CAAC;AAElD,mEAAmE;AACnE,MAAM,CAAC,MAAM,iBAAiB,GAAG,qBAAqB,CAAC;AACvD,MAAM,CAAC,MAAM,WAAW,GAAG,eAAe,CAAC;AAC3C,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,eAAe,CAAC;AAEvE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,OAAgB,qBAAqB;IAA3C;QAGI,6FAA6F;QAEnF,cAAS,GAAW,EAAE,CAAC;IA0IrC,CAAC;IAxIG,2FAA2F;IAC3F,IAAc,MAAM;QAChB,OAAO,IAAI,CAAC,WAAW,CAAC,iBAAiB,EAAE,8BAA8B,CAAC,CAAC;IAC/E,CAAC;IAED;oFACgF;IAChF,IAAc,OAAO;QACjB,OAAO,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;IACzD,CAAC;IAUD;;;;;OAKG;IACO,eAAe,CAAC,OAAe;QACrC,OAAO,OAAO,CAAC;IACnB,CAAC;IAEO,WAAW,CAAC,MAAc,EAAE,IAAY;QAC5C,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACtD,OAAO,SAAS,CAAC;QACrB,CAAC;QACD,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC;IAC1D,CAAC;IAGY,AAAN,KAAK,CAAC,IAAI;QACb,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YAClB,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,kGAAkG,CAAC,CAAC;QAC1H,CAAC;QACD,IAAI,CAAC,WAAW,GAAG,MAAM,IAAI,CAAC,cAAe,CAAC,WAAW,CAAC,SAAS,EAAE;YACjE,IAAI,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI;YAC5B,IAAI,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC;SAC5B,CAAC,CAAC;IACP,CAAC;IAEO,KAAK,CAAC,cAAc,CAAC,KAAa;QACtC,MAAM,OAAO,GAAW,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACnD,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC3C,IAAI,CAAC,WAAY,CAAC,IAAI,CAAC,EAAE,kBAAkB,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;YACtF,IAAI,CAAC,WAAY,CAAC,IAAI,CAAC,EAAE,cAAc,EAAE,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;SAC3G,CAAC,CAAC;QACH,OAAO,SAAS,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC;IACtC,CAAC;IAED;;;;;;;;;;OAUG;IAEU,AAAN,KAAK,CAAC,GAAG,CAAU,GAAgB,EAAY,GAAiB;QACnE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACpB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;YACvB,OAAO;QACX,CAAC;QAED,MAAM,IAAI,GAAW,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,MAAM,KAAK,GAAuB,mBAAmB,CAAC,IAAI,CAAC,CAAC;QAC5D,IAAI,CAAC,KAAK,EAAE,CAAC;YACT,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;YACvB,OAAO;QACX,CAAC;QAED,MAAM,OAAO,GAAkB,MAAM,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QAChE,IAAI,CAAC,OAAO,EAAE,CAAC;YACX,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;YACvB,OAAO;QACX,CAAC;QAED,MAAM,OAAO,GAAY,+BAA+B,CAAC,IAAI,CAAC,KAAK,uBAAuB,CAAC;QAC3F,MAAM,GAAG,GAAuB,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC;QACrE,IAAI,CAAC,GAAG,EAAE,CAAC;YACP,6GAA6G;YAC7G,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;YACvB,OAAO;QACX,CAAC;QACD,MAAM,GAAG,GAAW,OAAO;YACvB,CAAC,CAAC,sBAAsB,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;YACjG,CAAC,CAAC,kBAAkB,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACjG,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,gCAAgC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC1F,CAAC;IAED;;;;OAIG;IAEU,AAAN,KAAK,CAAC,EAAE,CACK,KAAa,EACV,QAA4B,EACrC,GAAiB;QAE3B,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACpB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;YACvB,OAAO;QACX,CAAC;QACD,uFAAuF;QACvF,MAAM,MAAM,GAAuB,IAAI,CAAC,MAAM,CAAC;QAC/C,IAAI,QAAQ,KAAK,YAAY,IAAI,CAAC,MAAM,EAAE,CAAC;YACvC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACjB,SAAS,EAAE,sBAAsB;gBACjC,YAAY,EAAE,yBAAyB,QAAQ,IAAI,EAAE,EAAE;aAC1D,CAAC,CAAC;YACH,OAAO;QACX,CAAC;QAED,MAAM,OAAO,GAAkB,MAAM,IAAI,CAAC,cAAc,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC;QACpF,IAAI,CAAC,OAAO,EAAE,CAAC;YACX,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACjB,SAAS,EAAE,cAAc;gBACzB,YAAY,EAAE,0CAA0C;aAC3D,CAAC,CAAC;YACH,OAAO;QACX,CAAC;QAED,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;IAClE,CAAC;CACJ;AA1Ia;IADT,MAAM,CAAC,8BAA8B,EAAE,EAAE,CAAC;;wDACV;AAmBzB;IADP,MAAM;;qDACa;AAoBP;IADZ,IAAI;;;;iDASJ;AAuBY;IADZ,IAAI,CAAC,mBAAmB,CAAC;IACR,WAAA,OAAO,CAAA;IAAoB,WAAA,QAAQ,CAAA;;;;gDA8BpD;AAQY;IADZ,GAAG,CAAC,gCAAgC,CAAC;IAEjC,WAAA,KAAK,CAAC,OAAO,CAAC,CAAA;IACd,WAAA,KAAK,CAAC,UAAU,CAAC,CAAA;IACjB,WAAA,QAAQ,CAAA;;;;+CA0BZ"}

package/dist/lib/index.js

@@ -0,0 +1,28 @@
+///////////////////////////////////////////////////////////////////////////////
+// Copyright (C) 2026 Jean-Philippe Steinmetz. All rights reserved.
+// SPDX-License-Identifier: MPL-2.0
+///////////////////////////////////////////////////////////////////////////////
+/**
+ * Autodiscover protocol compatibility: the mechanism a real mail client uses to find this deployment's EAS
+ * server URL from just an email address, before it has any credentials or JWT of its own. Exports the
+ * backend-agnostic surface - the request/response XML helpers and the abstract route base class. The concrete
+ * Mongo/SQL classes a deployment actually instantiates (`AutodiscoverRouteMongo`/`AutodiscoverRouteSQL`) are
+ * exported from this package's `./mongo`/`./sql` subpaths instead, alongside every other entity/route/job this
+ * library defines - see `src/eas/index.ts`'s identical doc comment for the same convention.
+ *
+ * A deployment mounts Autodiscover with a trivial subclass supplying its own EAS URL:
+ * ```ts
+ * import { AutodiscoverRouteMongo } from "@rapidrest/mail/mongo";
+ * import { RouteDecorators } from "@rapidrest/service-core";
+ * const { Route } = RouteDecorators;
+ *
+ * @Route("/autodiscover")
+ * export class MyAutodiscoverRoute extends AutodiscoverRouteMongo {
+ *     protected readonly easUrl = "https://mail.example.com/Microsoft-Server-ActiveSync";
+ *     protected readonly mapiUrl = "https://mail.example.com/mapi/emsmdb";
+ * }
+ * ```
+ */
+export * from "./AutodiscoverXml.js";
+export * from "./BaseAutodiscoverRoute.js";
+//# sourceMappingURL=index.js.map

package/dist/lib/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,mEAAmE;AACnE,mCAAmC;AACnC,+EAA+E;AAE/E;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,cAAc,sBAAsB,CAAC;AACrC,cAAc,4BAA4B,CAAC"}

package/dist/lib/mongo/AutodiscoverRouteMongo.js

@@ -0,0 +1,31 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+///////////////////////////////////////////////////////////////////////////////
+// Copyright (C) 2026 Jean-Philippe Steinmetz. All rights reserved.
+// SPDX-License-Identifier: MPL-2.0
+///////////////////////////////////////////////////////////////////////////////
+import { MailboxMongo } from "@rapidmx/restapi/mongo";
+import { RouteDecorators } from "@rapidrest/service-core";
+import { BaseAutodiscoverRoute } from "../BaseAutodiscoverRoute.js";
+const { Route } = RouteDecorators;
+/**
+ * Mongo-backed concrete `BaseAutodiscoverRoute`, mounted at `/autodiscover`. Exported from this plugin's `./mongo`
+ * entry point, so the server host mounts it without a wrapper class of its own.
+ *
+ * @author Jean-Philippe Steinmetz
+ */
+let AutodiscoverRouteMongo = class AutodiscoverRouteMongo extends BaseAutodiscoverRoute {
+    constructor() {
+        super(...arguments);
+        this.mailboxClass = MailboxMongo;
+    }
+};
+AutodiscoverRouteMongo = __decorate([
+    Route("/autodiscover")
+], AutodiscoverRouteMongo);
+export { AutodiscoverRouteMongo };
+//# sourceMappingURL=AutodiscoverRouteMongo.js.map

package/dist/lib/mongo/AutodiscoverRouteMongo.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AutodiscoverRouteMongo.js","sourceRoot":"","sources":["../../../src/mongo/AutodiscoverRouteMongo.ts"],"names":[],"mappings":";;;;;;AAAA,+EAA+E;AAC/E,mEAAmE;AACnE,mCAAmC;AACnC,+EAA+E;AAC/E,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACpE,MAAM,EAAE,KAAK,EAAE,GAAG,eAAe,CAAC;AAElC;;;;;GAKG;AAEI,IAAM,sBAAsB,GAA5B,MAAM,sBAAuB,SAAQ,qBAAmC;IAAxE;;QACO,iBAAY,GAAQ,YAAY,CAAC;IAC/C,CAAC;CAAA,CAAA;AAFY,sBAAsB;IADlC,KAAK,CAAC,eAAe,CAAC;GACV,sBAAsB,CAElC"}

package/dist/lib/mongo/index.js

@@ -0,0 +1,6 @@
+///////////////////////////////////////////////////////////////////////////////
+// Copyright (C) 2026 Jean-Philippe Steinmetz. All rights reserved.
+// SPDX-License-Identifier: MPL-2.0
+///////////////////////////////////////////////////////////////////////////////
+export * from "./AutodiscoverRouteMongo.js";
+//# sourceMappingURL=index.js.map

package/dist/lib/mongo/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/mongo/index.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,mEAAmE;AACnE,mCAAmC;AACnC,+EAA+E;AAC/E,cAAc,6BAA6B,CAAC"}

package/dist/lib/mongo.js

@@ -0,0 +1,6 @@
+///////////////////////////////////////////////////////////////////////////////
+// Copyright (C) 2026 Jean-Philippe Steinmetz. All rights reserved.
+// SPDX-License-Identifier: MPL-2.0
+///////////////////////////////////////////////////////////////////////////////
+export * from "./mongo/index.js";
+//# sourceMappingURL=mongo.js.map

package/dist/lib/mongo.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mongo.js","sourceRoot":"","sources":["../../src/mongo.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,mEAAmE;AACnE,mCAAmC;AACnC,+EAA+E;AAC/E,cAAc,kBAAkB,CAAC"}

package/dist/lib/sql/AutodiscoverRouteSQL.js

@@ -0,0 +1,39 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+///////////////////////////////////////////////////////////////////////////////
+// Copyright (C) 2026 Jean-Philippe Steinmetz. All rights reserved.
+// SPDX-License-Identifier: MPL-2.0
+///////////////////////////////////////////////////////////////////////////////
+import { Raw } from "typeorm";
+import { MailboxSQL } from "@rapidmx/restapi/sql";
+import { RouteDecorators } from "@rapidrest/service-core";
+import { BaseAutodiscoverRoute } from "../BaseAutodiscoverRoute.js";
+const { Route } = RouteDecorators;
+/**
+ * SQL-backed concrete `BaseAutodiscoverRoute`, mounted at `/autodiscover` and exported from this plugin's `./sql`
+ * entry point. `aliasQueryValue()` is overridden identically to `MailIngestRouteSQL` - see
+ * that class's doc comment for the full vulnerability rationale (unescaped `%`/`_` enabling alias-enumeration
+ * and cross-mailbox matches) this same escaping closes here too, since `resolveMailbox()` is reached by
+ * unauthenticated callers exactly like `MailIngestRoute.resolve()` is.
+ *
+ * @author Jean-Philippe Steinmetz
+ */
+let AutodiscoverRouteSQL = class AutodiscoverRouteSQL extends BaseAutodiscoverRoute {
+    constructor() {
+        super(...arguments);
+        this.mailboxClass = MailboxSQL;
+    }
+    aliasQueryValue(address) {
+        const escaped = address.replace(/[\\%_]/g, (ch) => `\\${ch}`);
+        return Raw((alias) => `${alias} LIKE :pattern ESCAPE '\\'`, { pattern: `%"${escaped}"%` });
+    }
+};
+AutodiscoverRouteSQL = __decorate([
+    Route("/autodiscover")
+], AutodiscoverRouteSQL);
+export { AutodiscoverRouteSQL };
+//# sourceMappingURL=AutodiscoverRouteSQL.js.map

package/dist/lib/sql/AutodiscoverRouteSQL.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AutodiscoverRouteSQL.js","sourceRoot":"","sources":["../../../src/sql/AutodiscoverRouteSQL.ts"],"names":[],"mappings":";;;;;;AAAA,+EAA+E;AAC/E,mEAAmE;AACnE,mCAAmC;AACnC,+EAA+E;AAC/E,OAAO,EAAE,GAAG,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACpE,MAAM,EAAE,KAAK,EAAE,GAAG,eAAe,CAAC;AAElC;;;;;;;;GAQG;AAEI,IAAM,oBAAoB,GAA1B,MAAM,oBAAqB,SAAQ,qBAAiC;IAApE;;QACO,iBAAY,GAAQ,UAAU,CAAC;IAM7C,CAAC;IAJa,eAAe,CAAC,OAAe;QACrC,MAAM,OAAO,GAAW,OAAO,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACtE,OAAO,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,4BAA4B,EAAE,EAAE,OAAO,EAAE,KAAK,OAAO,IAAI,EAAE,CAAC,CAAC;IAC/F,CAAC;CACJ,CAAA;AAPY,oBAAoB;IADhC,KAAK,CAAC,eAAe,CAAC;GACV,oBAAoB,CAOhC"}

package/dist/lib/sql/index.js

@@ -0,0 +1,6 @@
+///////////////////////////////////////////////////////////////////////////////
+// Copyright (C) 2026 Jean-Philippe Steinmetz. All rights reserved.
+// SPDX-License-Identifier: MPL-2.0
+///////////////////////////////////////////////////////////////////////////////
+export * from "./AutodiscoverRouteSQL.js";
+//# sourceMappingURL=index.js.map

package/dist/lib/sql/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/sql/index.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,mEAAmE;AACnE,mCAAmC;AACnC,+EAA+E;AAC/E,cAAc,2BAA2B,CAAC"}

package/dist/lib/sql.js

@@ -0,0 +1,6 @@
+///////////////////////////////////////////////////////////////////////////////
+// Copyright (C) 2026 Jean-Philippe Steinmetz. All rights reserved.
+// SPDX-License-Identifier: MPL-2.0
+///////////////////////////////////////////////////////////////////////////////
+export * from "./sql/index.js";
+//# sourceMappingURL=sql.js.map

package/dist/lib/sql.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sql.js","sourceRoot":"","sources":["../../src/sql.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,mEAAmE;AACnE,mCAAmC;AACnC,+EAA+E;AAC/E,cAAc,gBAAgB,CAAC"}

package/dist/types/AutodiscoverXml.d.ts

@@ -0,0 +1,58 @@
+/**
+ * Extracts the request's `<EMailAddress>` text content via a small, tightly-scoped regex rather than a DOM
+ * parse. Never resolves entities/DTDs - only the literal text between the open/close tags is ever inspected.
+ */
+export declare function extractEmailAddress(xml: string): string | undefined;
+/** Escapes the 5 XML-predefined-entity characters for safe inclusion as element text content. */
+export declare function escapeXml(value: string): string;
+export interface AutodiscoverPoxSuccess {
+    emailAddress: string;
+    displayName?: string;
+    easUrl: string;
+}
+/** The `AcceptableResponseSchema` value a real Outlook desktop client sends to request the Outlook/EXCH
+ * response shape (`buildOutlookSuccessXml`) instead of the EAS-only MobileSync one - confirmed against
+ * `[MS-OXDSCLI]`'s own Autodiscover Response XSD, whose target namespace is exactly this value. */
+export declare const OUTLOOK_RESPONSE_SCHEMA = "http://schemas.microsoft.com/exchange/autodiscover/outlook/responseschema/2006a";
+/**
+ * Extracts the request's `<AcceptableResponseSchema>` text content via the same small, tightly-scoped regex
+ * approach as `extractEmailAddress` - never a DOM parse, same rationale (unauthenticated, internet-facing
+ * endpoint).
+ */
+export declare function extractAcceptableResponseSchema(xml: string): string | undefined;
+/**
+ * Builds a real `mobilesync:Response` success document per `[MS-ASCMD]`'s `AutodiscoverMobileSync.xsd` -
+ * `Culture`/`User`/`Action.Settings.Server{Type=MobileSync,Url,Name}`, matching the shape confirmed against
+ * Microsoft's own "Autodiscover for Exchange ActiveSync developers" example response. A real response can also
+ * carry a `CertEnroll` server block for client-certificate enrollment - deliberately omitted, same "pragmatic
+ * subset" scoping as Phase 2's own documented gaps, since this library has no certificate-enrollment support.
+ */
+export declare function buildPoxSuccessXml({ emailAddress, displayName, easUrl }: AutodiscoverPoxSuccess): string;
+export interface AutodiscoverOutlookSuccess {
+    emailAddress: string;
+    displayName?: string;
+    mapiUrl: string;
+}
+/**
+ * Builds a real Outlook/EXCH `2006a` response per `[MS-OXDSCLI]`'s confirmed Autodiscover Response XSD -
+ * an `Autodiscover`(namespace `.../responseschema/2006`) element wrapping a `Response`
+ * (namespace `.../outlook/responseschema/2006a`) with `User`/`Account` children.
+ *
+ * Since this library only speaks MAPI/HTTP (no classic RPC/TCP MAPI transport), the response always
+ * advertises exactly one `Protocol`, using `Type`/`Version` as XML ATTRIBUTES rather than the classic
+ * `<Type>EXCH</Type>` child element - `[MS-OXDSCLI]`'s "Processing the X-MapiHttpCapability Header" section
+ * confirms a mapiHttp-capable client's response "MUST include a Protocol element that contains a Type
+ * attribute set to 'mapiHttp' and a Version attribute" and "MUST NOT include a Protocol element that contains
+ * a Type element set to 'EXCH' or 'EXPR'" - the two forms are mutually exclusive by design, not merely
+ * alternatives. This deployment has no classic RPC/TCP MAPI endpoint to fall back to, so every Outlook-schema
+ * request always gets the mapiHttp form - the real `X-MapiHttpCapability` request-header negotiation a full
+ * implementation would consult to choose between EXCH/mapiHttp is not implemented, a documented gap.
+ * `MailStore.InternalUrl`/`ExternalUrl` are both set to the same `mapiUrl`, since this library serves one URL
+ * per deployment with no separate internal/external network split.
+ *
+ * `LegacyDN`/`DeploymentId` are schema-required fields this library has no real backing value for (no X.500
+ * DN resolution, no multi-tenant deployment identity) - both are synthesized placeholders. Real Outlook does
+ * not validate their exact content for MAPI/HTTP connectivity; they matter for classic RPC/TCP MAPI
+ * free-busy/permissions lookups this library doesn't implement anyway.
+ */
+export declare function buildOutlookSuccessXml({ emailAddress, displayName, mapiUrl }: AutodiscoverOutlookSuccess): string;

package/dist/types/BaseAutodiscoverRoute.d.ts

@@ -0,0 +1,79 @@
+import { HttpRequest, HttpResponse } from "@rapidrest/service-core";
+import { Mailbox } from "@rapidmx/restapi";
+/** The plugin packages whose endpoints Autodiscover advertises. */
+export declare const ACTIVESYNC_PLUGIN = "@rapidmx/activesync";
+export declare const MAPI_PLUGIN = "@rapidmx/mapi";
+/**
+ * Abstract base for the two Autodiscover endpoints a real mail client uses to find this deployment's EAS
+ * server URL from just an email address - classic POX (`POST /autodiscover/autodiscover.xml`, per
+ * `[MS-ASCMD]`'s "MobileSync" response schema) and the modern JSON variant Microsoft calls "Autodiscover v2"
+ * (`GET /autodiscover/autodiscover.json/v1.0/<email>?Protocol=ActiveSync`). Like `BaseMailIngestRoute`/
+ * `BaseEasRoute`, this class is undecorated; its Mongo/SQL concrete classes are mounted at `/autodiscover`, which
+ * composes with this class's own relative method paths to land exactly on the real spec's conventional paths (`/autodiscover/autodiscover.xml`, `/autodiscover/autodiscover.json/v1.0/:email`).
+ *
+ * **Auth: deliberately none.** Real classic Autodiscover conventionally expects the client to send HTTP Basic
+ * credentials (email+password), with the server free to answer `401` and force re-entry - a model this
+ * library's JWT-only, no-credential-verification-of-our-own boundary (see `BaseEasRoute`'s own doc comment on
+ * why per-request Basic Auth was rejected there) can't and shouldn't absorb; no credential-verification
+ * function exists in this codebase or its dependencies. Instead, both endpoints here follow Microsoft's own
+ * Autodiscover v2 design intent exactly: answer anonymously, and reveal nothing but a deployment-wide,
+ * config-supplied EAS server URL - not a per-mailbox secret - once the request email is confirmed to belong to
+ * a real `Mailbox` in this deployment. The actual security boundary is unchanged from Phase 2: real mailbox
+ * access still requires a JWT at `BaseEasRoute`, exactly as today.
+ *
+ * **Known gap, deliberately out of scope**: `Action.Redirect` (for multi-tenant hosted providers whose mailbox
+ * moved to a different domain) is not implemented - this library serves exactly one EAS URL for its whole
+ * deployment, so there's never a different domain to redirect to. The client-side well-known-URL discovery
+ * sequence (`MS-OXDISCO`: root domain -> `autodiscover.` subdomain -> unauthenticated HTTP redirect probe ->
+ * DNS SRV record -> cache) and the DNS `CNAME`/`SRV` record setup it depends on are also out of scope here -
+ * both are client/deployment concerns, not application code; this class only needs to answer correctly once a
+ * request actually arrives at one of its two paths.
+ *
+ * `mailboxClass` is supplied by the Mongo/SQL concrete subclasses following the exact one-line-per-backend
+ * pattern used throughout this library. The advertised URLs are built from the `mail:autodiscover:public_url`
+ * setting, and each protocol is only advertised while its plugin (`@rapidmx/activesync`, `@rapidmx/mapi`) is
+ * loaded, so a client is never pointed at an endpoint this deployment doesn't serve.
+ *
+ * @author Jean-Philippe Steinmetz
+ */
+export declare abstract class BaseAutodiscoverRoute<M extends Mailbox> {
+    protected abstract mailboxClass: any;
+    /** The public base URL clients reach this deployment at, e.g. `https://mail.example.com`. */
+    protected publicUrl: string;
+    /** The EAS endpoint URL to report, or `undefined` when ActiveSync isn't available here. */
+    protected get easUrl(): string | undefined;
+    /** The MAPI/HTTP `emsmdb` endpoint URL to report to a real Outlook desktop client, or `undefined` when MAPI
+     * isn't available here. Only used by `pox()`'s Outlook/EXCH response branch. */
+    protected get mapiUrl(): string | undefined;
+    private _objectFactory?;
+    private mailboxRepo?;
+    private logger;
+    /**
+     * Builds the query value used to match `Mailbox.aliasAddresses` against the given address. See
+     * `BaseMailIngestRoute.aliasQueryValue()`'s identical doc comment - same Mongo-array vs.
+     * SQL-`simple-json`-column backend split, same override point (`AutodiscoverRouteSQL` overrides this
+     * identically to `MailIngestRouteSQL`).
+     */
+    protected aliasQueryValue(address: string): any;
+    private endpointUrl;
+    init(): Promise<void>;
+    private resolveMailbox;
+    /**
+     * Classic POX Autodiscover. Per Microsoft's own client-behavior documentation, a permanent failure is just
+     * as validly conveyed via a plain HTTP status as via an inner `Error` element, so this uses the HTTP-status
+     * form for both error cases rather than inventing values for `[MS-ASCMD]`'s provider-specific numeric
+     * error-code table.
+     *
+     * Branches on the request's `AcceptableResponseSchema` to decide which response shape to build: a real
+     * Outlook desktop client sends `[MS-OXDSCLI]`'s Outlook/EXCH schema (`OUTLOOK_RESPONSE_SCHEMA`) to locate
+     * this deployment's MAPI/HTTP endpoint (`buildOutlookSuccessXml`); any other value (or a mobile/EAS-only
+     * client that omits the field entirely) gets the original MobileSync/EAS response (`buildPoxSuccessXml`).
+     */
+    pox(req: HttpRequest, res: HttpResponse): Promise<void>;
+    /**
+     * Autodiscover v2 (JSON). Only the `ActiveSync` protocol is served - this library has no EWS/other
+     * protocol surface to advertise - so any other `Protocol` value is rejected outright rather than silently
+     * answered with an EAS URL under the wrong protocol name.
+     */
+    v2(email: string, protocol: string | undefined, res: HttpResponse): Promise<void>;
+}

package/dist/types/index.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Autodiscover protocol compatibility: the mechanism a real mail client uses to find this deployment's EAS
+ * server URL from just an email address, before it has any credentials or JWT of its own. Exports the
+ * backend-agnostic surface - the request/response XML helpers and the abstract route base class. The concrete
+ * Mongo/SQL classes a deployment actually instantiates (`AutodiscoverRouteMongo`/`AutodiscoverRouteSQL`) are
+ * exported from this package's `./mongo`/`./sql` subpaths instead, alongside every other entity/route/job this
+ * library defines - see `src/eas/index.ts`'s identical doc comment for the same convention.
+ *
+ * A deployment mounts Autodiscover with a trivial subclass supplying its own EAS URL:
+ * ```ts
+ * import { AutodiscoverRouteMongo } from "@rapidrest/mail/mongo";
+ * import { RouteDecorators } from "@rapidrest/service-core";
+ * const { Route } = RouteDecorators;
+ *
+ * @Route("/autodiscover")
+ * export class MyAutodiscoverRoute extends AutodiscoverRouteMongo {
+ *     protected readonly easUrl = "https://mail.example.com/Microsoft-Server-ActiveSync";
+ *     protected readonly mapiUrl = "https://mail.example.com/mapi/emsmdb";
+ * }
+ * ```
+ */
+export * from "./AutodiscoverXml.js";
+export * from "./BaseAutodiscoverRoute.js";

package/dist/types/mongo/AutodiscoverRouteMongo.d.ts

@@ -0,0 +1,11 @@
+import { MailboxMongo } from "@rapidmx/restapi/mongo";
+import { BaseAutodiscoverRoute } from "../BaseAutodiscoverRoute.js";
+/**
+ * Mongo-backed concrete `BaseAutodiscoverRoute`, mounted at `/autodiscover`. Exported from this plugin's `./mongo`
+ * entry point, so the server host mounts it without a wrapper class of its own.
+ *
+ * @author Jean-Philippe Steinmetz
+ */
+export declare class AutodiscoverRouteMongo extends BaseAutodiscoverRoute<MailboxMongo> {
+    protected mailboxClass: any;
+}

package/dist/types/mongo/index.d.ts

@@ -0,0 +1 @@
+export * from "./AutodiscoverRouteMongo.js";

package/dist/types/mongo.d.ts

@@ -0,0 +1 @@
+export * from "./mongo/index.js";

package/dist/types/sql/AutodiscoverRouteSQL.d.ts

@@ -0,0 +1,15 @@
+import { MailboxSQL } from "@rapidmx/restapi/sql";
+import { BaseAutodiscoverRoute } from "../BaseAutodiscoverRoute.js";
+/**
+ * SQL-backed concrete `BaseAutodiscoverRoute`, mounted at `/autodiscover` and exported from this plugin's `./sql`
+ * entry point. `aliasQueryValue()` is overridden identically to `MailIngestRouteSQL` - see
+ * that class's doc comment for the full vulnerability rationale (unescaped `%`/`_` enabling alias-enumeration
+ * and cross-mailbox matches) this same escaping closes here too, since `resolveMailbox()` is reached by
+ * unauthenticated callers exactly like `MailIngestRoute.resolve()` is.
+ *
+ * @author Jean-Philippe Steinmetz
+ */
+export declare class AutodiscoverRouteSQL extends BaseAutodiscoverRoute<MailboxSQL> {
+    protected mailboxClass: any;
+    protected aliasQueryValue(address: string): any;
+}

package/dist/types/sql/index.d.ts

@@ -0,0 +1 @@
+export * from "./AutodiscoverRouteSQL.js";

package/dist/types/sql.d.ts

@@ -0,0 +1 @@
+export * from "./sql/index.js";