@rapidmx/autodiscover 1.0.0-beta.0

package/LICENSE

@@ -0,0 +1,382 @@
+# Mozilla Public License Version 2.0
+
+1. Definitions
+
+---
+
+1.1. "Contributor"
+means each individual or legal entity that creates, contributes to
+the creation of, or owns Covered Software.
+
+1.2. "Contributor Version"
+means the combination of the Contributions of others (if any) used
+by a Contributor and that particular Contributor's Contribution.
+
+1.3. "Contribution"
+means Covered Software of a particular Contributor.
+
+1.4. "Covered Software"
+means Source Code Form to which the initial Contributor has attached
+the notice in Exhibit A, the Executable Form of such Source Code
+Form, and Modifications of such Source Code Form, in each case
+including portions thereof.
+
+1.5. "Incompatible With Secondary Licenses"
+means
+
+    (a) that the initial Contributor has attached the notice described
+        in Exhibit B to the Covered Software; or
+
+    (b) that the Covered Software was made available under the terms of
+        version 1.1 or earlier of the License, but not also under the
+        terms of a Secondary License.
+
+1.6. "Executable Form"
+means any form of the work other than Source Code Form.
+
+1.7. "Larger Work"
+means a work that combines Covered Software with other material, in
+a separate file or files, that is not Covered Software.
+
+1.8. "License"
+means this document.
+
+1.9. "Licensable"
+means having the right to grant, to the maximum extent possible,
+whether at the time of the initial grant or subsequently, any and
+all of the rights conveyed by this License.
+
+1.10. "Modifications"
+means any of the following:
+
+    (a) any file in Source Code Form that results from an addition to,
+        deletion from, or modification of the contents of Covered
+        Software; or
+
+    (b) any new file in Source Code Form that contains any Covered
+        Software.
+
+1.11. "Patent Claims" of a Contributor
+means any patent claim(s), including without limitation, method,
+process, and apparatus claims, in any patent Licensable by such
+Contributor that would be infringed, but for the grant of the
+License, by the making, using, selling, offering for sale, having
+made, import, or transfer of either its Contributions or its
+Contributor Version.
+
+1.12. "Secondary License"
+means either the GNU General Public License, Version 2.0, the GNU
+Lesser General Public License, Version 2.1, the GNU Affero General
+Public License, Version 3.0, or any later versions of those
+licenses.
+
+1.13. "Source Code Form"
+means the form of the work preferred for making modifications.
+
+1.14. "You" (or "Your")
+means an individual or a legal entity exercising rights under this
+License. For legal entities, "You" includes any entity that
+controls, is controlled by, or is under common control with You. For
+purposes of this definition, "control" means (a) the power, direct
+or indirect, to cause the direction or management of such entity,
+whether by contract or otherwise, or (b) ownership of more than
+fifty percent (50%) of the outstanding shares or beneficial
+ownership of such entity.
+
+2. License Grants and Conditions
+
+---
+
+2.1. Grants
+
+Each Contributor hereby grants You a world-wide, royalty-free,
+non-exclusive license:
+
+(a) under intellectual property rights (other than patent or trademark)
+Licensable by such Contributor to use, reproduce, make available,
+modify, display, perform, distribute, and otherwise exploit its
+Contributions, either on an unmodified basis, with Modifications, or
+as part of a Larger Work; and
+
+(b) under Patent Claims of such Contributor to make, use, sell, offer
+for sale, have made, import, and otherwise transfer either its
+Contributions or its Contributor Version.
+
+2.2. Effective Date
+
+The licenses granted in Section 2.1 with respect to any Contribution
+become effective for each Contribution on the date the Contributor first
+distributes such Contribution.
+
+2.3. Limitations on Grant Scope
+
+The licenses granted in this Section 2 are the only rights granted under
+this License. No additional rights or licenses will be implied from the
+distribution or licensing of Covered Software under this License.
+Notwithstanding Section 2.1(b) above, no patent license is granted by a
+Contributor:
+
+(a) for any code that a Contributor has removed from Covered Software;
+or
+
+(b) for infringements caused by: (i) Your and any other third party's
+modifications of Covered Software, or (ii) the combination of its
+Contributions with other software (except as part of its Contributor
+Version); or
+
+(c) under Patent Claims infringed by Covered Software in the absence of
+its Contributions.
+
+This License does not grant any rights in the trademarks, service marks,
+or logos of any Contributor (except as may be necessary to comply with
+the notice requirements in Section 3.4).
+
+2.4. Subsequent Licenses
+
+No Contributor makes additional grants as a result of Your choice to
+distribute the Covered Software under a subsequent version of this
+License (see Section 10.2) or under the terms of a Secondary License (if
+permitted under the terms of Section 3.3).
+
+2.5. Representation
+
+Each Contributor represents that the Contributor believes its
+Contributions are its original creation(s) or it has sufficient rights
+to grant the rights to its Contributions conveyed by this License.
+
+2.6. Fair Use
+
+This License is not intended to limit any rights You have under
+applicable copyright doctrines of fair use, fair dealing, or other
+equivalents.
+
+2.7. Conditions
+
+Sections 3.1, 3.2, 3.3, and 3.4 are conditions of the licenses granted
+in Section 2.1.
+
+3. Responsibilities
+
+---
+
+3.1. Distribution of Source Form
+
+All distribution of Covered Software in Source Code Form, including any
+Modifications that You create or to which You contribute, must be under
+the terms of this License. You must inform recipients that the Source
+Code Form of the Covered Software is governed by the terms of this
+License, and how they can obtain a copy of this License. You may not
+attempt to alter or restrict the recipients' rights in the Source Code
+Form.
+
+3.2. Distribution of Executable Form
+
+If You distribute Covered Software in Executable Form then:
+
+(a) such Covered Software must also be made available in Source Code
+Form, as described in Section 3.1, and You must inform recipients of
+the Executable Form how they can obtain a copy of such Source Code
+Form by reasonable means in a timely manner, at a charge no more
+than the cost of distribution to the recipient; and
+
+(b) You may distribute such Executable Form under the terms of this
+License, or sublicense it under different terms, provided that the
+license for the Executable Form does not attempt to limit or alter
+the recipients' rights in the Source Code Form under this License.
+
+3.3. Distribution of a Larger Work
+
+You may create and distribute a Larger Work under terms of Your choice,
+provided that You also comply with the requirements of this License for
+the Covered Software. If the Larger Work is a combination of Covered
+Software with a work governed by one or more Secondary Licenses, and the
+Covered Software is not Incompatible With Secondary Licenses, this
+License permits You to additionally distribute such Covered Software
+under the terms of such Secondary License(s), so that the recipient of
+the Larger Work may, at their option, further distribute the Covered
+Software under the terms of either this License or such Secondary
+License(s).
+
+3.4. Notices
+
+You may not remove or alter the substance of any license notices
+(including copyright notices, patent notices, disclaimers of warranty,
+or limitations of liability) contained within the Source Code Form of
+the Covered Software, except that You may alter any license notices to
+the extent required to remedy known factual inaccuracies.
+
+3.5. Application of Additional Terms
+
+You may choose to offer, and to charge a fee for, warranty, support,
+indemnity or liability obligations to one or more recipients of Covered
+Software. However, You may do so only on Your own behalf, and not on
+behalf of any Contributor. You must make it absolutely clear that any
+such warranty, support, indemnity, or liability obligation is offered by
+You alone, and You hereby agree to indemnify every Contributor for any
+liability incurred by such Contributor as a result of warranty, support,
+indemnity or liability terms You offer. You may include additional
+disclaimers of warranty and limitations of liability specific to any
+jurisdiction.
+
+4. Inability to Comply Due to Statute or Regulation
+
+---
+
+If it is impossible for You to comply with any of the terms of this
+License with respect to some or all of the Covered Software due to
+statute, judicial order, or regulation then You must: (a) comply with
+the terms of this License to the maximum extent possible; and (b)
+describe the limitations and the code they affect. Such description must
+be placed in a text file included with all distributions of the Covered
+Software under this License. Except to the extent prohibited by statute
+or regulation, such description must be sufficiently detailed for a
+recipient of ordinary skill to be able to understand it.
+
+5. Termination
+
+---
+
+5.1. The rights granted under this License will terminate automatically
+if You fail to comply with any of its terms. However, if You become
+compliant, then the rights granted under this License from a particular
+Contributor are reinstated (a) provisionally, unless and until such
+Contributor explicitly and finally terminates Your grants, and (b) on an
+ongoing basis, if such Contributor fails to notify You of the
+non-compliance by some reasonable means prior to 60 days after You have
+come back into compliance. Moreover, Your grants from a particular
+Contributor are reinstated on an ongoing basis if such Contributor
+notifies You of the non-compliance by some reasonable means, this is the
+first time You have received notice of non-compliance with this License
+from such Contributor, and You become compliant prior to 30 days after
+Your receipt of the notice.
+
+5.2. If You initiate litigation against any entity by asserting a patent
+infringement claim (excluding declaratory judgment actions,
+counter-claims, and cross-claims) alleging that a Contributor Version
+directly or indirectly infringes any patent, then the rights granted to
+You by any and all Contributors for the Covered Software under Section
+2.1 of this License shall terminate.
+
+5.3. In the event of termination under Sections 5.1 or 5.2 above, all
+end user license agreements (excluding distributors and resellers) which
+have been validly granted by You or Your distributors under this License
+prior to termination shall survive termination.
+
+---
+
+-                                                                      *
+-   6. Disclaimer of Warranty \*
+- ------------------------- \*
+-                                                                      *
+- Covered Software is provided under this License on an "as is" \*
+- basis, without warranty of any kind, either expressed, implied, or \*
+- statutory, including, without limitation, warranties that the \*
+- Covered Software is free of defects, merchantable, fit for a \*
+- particular purpose or non-infringing. The entire risk as to the \*
+- quality and performance of the Covered Software is with You. \*
+- Should any Covered Software prove defective in any respect, You \*
+- (not any Contributor) assume the cost of any necessary servicing, \*
+- repair, or correction. This disclaimer of warranty constitutes an \*
+- essential part of this License. No use of any Covered Software is \*
+- authorized under this License except under this disclaimer. \*
+-                                                                      *
+
+---
+
+---
+
+-                                                                      *
+-   7. Limitation of Liability \*
+- -------------------------- \*
+-                                                                      *
+- Under no circumstances and under no legal theory, whether tort \*
+- (including negligence), contract, or otherwise, shall any \*
+- Contributor, or anyone who distributes Covered Software as \*
+- permitted above, be liable to You for any direct, indirect, \*
+- special, incidental, or consequential damages of any character \*
+- including, without limitation, damages for lost profits, loss of \*
+- goodwill, work stoppage, computer failure or malfunction, or any \*
+- and all other commercial damages or losses, even if such party \*
+- shall have been informed of the possibility of such damages. This \*
+- limitation of liability shall not apply to liability for death or \*
+- personal injury resulting from such party's negligence to the \*
+- extent applicable law prohibits such limitation. Some \*
+- jurisdictions do not allow the exclusion or limitation of \*
+- incidental or consequential damages, so this exclusion and \*
+- limitation may not apply to You. \*
+-                                                                      *
+
+---
+
+8. Litigation
+
+---
+
+Any litigation relating to this License may be brought only in the
+courts of a jurisdiction where the defendant maintains its principal
+place of business and such litigation shall be governed by laws of that
+jurisdiction, without reference to its conflict-of-law provisions.
+Nothing in this Section shall prevent a party's ability to bring
+cross-claims or counter-claims.
+
+9. Miscellaneous
+
+---
+
+This License represents the complete agreement concerning the subject
+matter hereof. If any provision of this License is held to be
+unenforceable, such provision shall be reformed only to the extent
+necessary to make it enforceable. Any law or regulation which provides
+that the language of a contract shall be construed against the drafter
+shall not be used to construe this License against a Contributor.
+
+10. Versions of the License
+
+---
+
+10.1. New Versions
+
+Mozilla Foundation is the license steward. Except as provided in Section
+10.3, no one other than the license steward has the right to modify or
+publish new versions of this License. Each version will be given a
+distinguishing version number.
+
+10.2. Effect of New Versions
+
+You may distribute the Covered Software under the terms of the version
+of the License under which You originally received the Covered Software,
+or under the terms of any subsequent version published by the license
+steward.
+
+10.3. Modified Versions
+
+If you create software not governed by this License, and you want to
+create a new license for such software, you may create and use a
+modified version of this License if you rename the license and remove
+any references to the name of the license steward (except to note that
+such modified license differs from this License).
+
+10.4. Distributing Source Code Form that is Incompatible With Secondary
+Licenses
+
+If You choose to distribute Source Code Form that is Incompatible With
+Secondary Licenses under the terms of this version of the License, the
+notice described in Exhibit B of this License must be attached.
+
+## Exhibit A - Source Code Form License Notice
+
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0. If a copy of the MPL was not distributed with this
+file, You can obtain one at https://mozilla.org/MPL/2.0/.
+
+If it is not possible or desirable to put the notice in a particular
+file, then You may include the notice in a location (such as a LICENSE
+file in a relevant directory) where a recipient would be likely to look
+for such a notice.
+
+You may add additional accurate notices of copyright ownership.
+
+## Exhibit B - "Incompatible With Secondary Licenses" Notice
+
+This Source Code Form is "Incompatible With Secondary Licenses", as
+defined by the Mozilla Public License, v. 2.0.

package/README.md

@@ -0,0 +1,90 @@
+# RapidMX: Autodiscover
+
+[![CI](https://github.com/RapidMX/autodiscover/actions/workflows/build.yml/badge.svg?branch=main)](https://github.com/RapidMX/autodiscover/actions/workflows/build.yml)
+[![Coverage Status](https://coveralls.io/repos/github/RapidMX/autodiscover/badge.svg?branch=main)](https://coveralls.io/github/RapidMX/autodiscover?branch=main)
+[![npm version](https://img.shields.io/npm/v/@rapidmx/autodiscover)](https://www.npmjs.com/package/@rapidmx/autodiscover)
+
+Autodiscover support for a [RapidMX](https://rapidmx.io) mail server. Lets a real mail client find this
+deployment's [`@rapidmx/activesync`](https://github.com/RapidMX/activesync) (EAS) and
+[`@rapidmx/mapi`](https://github.com/RapidMX/mapi) server URLs from just an email address: classic
+POX (`POST /autodiscover/autodiscover.xml`, serving either the EAS-only MobileSync response or, when a real
+Outlook desktop client requests it via `AcceptableResponseSchema`, an Outlook/EXCH response pointing at the
+MAPI/HTTP endpoint) and the modern JSON variant Microsoft calls "Autodiscover v2"
+(`GET /autodiscover/autodiscover.json/v1.0/<email>?Protocol=ActiveSync`, EAS only — this package has no
+separate JSON discovery variant for MAPI).
+
+Both endpoints are intentionally unauthenticated, matching Autodiscover v2's own spec design: they reveal
+nothing but deployment-wide server URLs (not secrets) once the requested address is confirmed to belong to a
+real mailbox — real mailbox access is still fully gated by the JWT-protected EAS/MAPI/REST layers. For a real
+device to find these endpoints at all, the deployment's DNS needs a `CNAME` record for
+`autodiscover.<your-domain>` (and, optionally, a `_autodiscover._tcp` `SRV` record) pointing at wherever this
+server is mounted — an ops/deployment task, not something this package configures.
+
+## Features
+
+* Classic POX Autodiscover (`POST /autodiscover/autodiscover.xml`) per `[MS-ASCMD]`'s MobileSync request/
+  response schema
+* A real Outlook desktop response shape per `[MS-OXDSCLI]`'s Outlook/EXCH `2006a` schema, served automatically
+  instead of the MobileSync response whenever a request's `AcceptableResponseSchema` asks for it — points a
+  real Outlook client at this deployment's MAPI/HTTP endpoint instead of EAS
+* Autodiscover v2 (JSON) (`GET /autodiscover/autodiscover.json/v1.0/:email?Protocol=ActiveSync`) for modern
+  clients that skip the POX request/response XML entirely
+* Mailbox resolution against both `Mailbox.primarySmtpAddress` and `Mailbox.aliasAddresses`
+* Deliberately unauthenticated by design — reveals only deployment-wide server URLs, never a per-mailbox
+  secret
+* MongoDB and SQL persistence backends (`@rapidmx/autodiscover/mongo`, `@rapidmx/autodiscover/sql`)
+
+## Installation
+
+### NPM
+
+```
+npm i @rapidmx/autodiscover
+```
+
+### Yarn
+
+```
+yarn add @rapidmx/autodiscover
+```
+
+## Requirements
+
+This package targets Node.js `>=24.0.0` and is published as an ESM-only package.
+
+The following peer dependencies are required:
+
+| Peer dependency            | Required for |
+| -------------------------- | ------------ |
+| `@rapidmx/restapi`         | Always       |
+| `@rapidrest/core`          | Always       |
+| `@rapidrest/service-core`  | Always       |
+
+## Usage
+
+Mount `AutodiscoverRouteMongo`/`AutodiscoverRouteSQL` (from `@rapidmx/autodiscover/mongo` or `/sql`) with a
+one-line subclass supplying your deployment's EAS and MAPI URLs:
+
+```ts
+import { AutodiscoverRouteMongo } from "@rapidmx/autodiscover/mongo";
+import { RouteDecorators } from "@rapidrest/service-core";
+const { Route } = RouteDecorators;
+
+@Route("/autodiscover")
+export class MyAutodiscoverRoute extends AutodiscoverRouteMongo {
+    protected readonly easUrl = "https://mail.example.com/Microsoft-Server-ActiveSync";
+    protected readonly mapiUrl = "https://mail.example.com/mapi/emsmdb";
+}
+```
+
+Requires a [`@rapidmx/restapi`](https://github.com/RapidMX/restapi)-backed `Mailbox` model to resolve
+addresses against.
+
+## Status
+
+Complete. This package was carved out of the former `@rapidrest/mail` monolith — see `.claude/NOTES.md` for
+the split's own rationale and history.
+
+## License
+
+MPL v2.0 — see [LICENSE](./LICENSE).

package/dist/lib/AutodiscoverXml.js

@@ -0,0 +1,137 @@
+///////////////////////////////////////////////////////////////////////////////
+// Copyright (C) 2026 Jean-Philippe Steinmetz. All rights reserved.
+// SPDX-License-Identifier: MPL-2.0
+///////////////////////////////////////////////////////////////////////////////
+/**
+ * Minimal, purpose-built XML handling for the classic POX Autodiscover request/response (`[MS-ASCMD]`'s
+ * "MobileSync" schema) - deliberately NOT a general-purpose XML/DOM parser. `BaseAutodiscoverRoute`'s POX
+ * endpoint is unauthenticated and internet-facing (see its own doc comment for why), and the real request
+ * schema has exactly one field this library ever reads (`EMailAddress`), so pulling in a general XML parser -
+ * especially one not hardened against XXE/entity-expansion - would be real attack surface for zero benefit.
+ * This follows the same "hand-build the wire format precisely, no library" approach Phase 2's WBXML codec
+ * already took, just for text XML instead of binary.
+ */
+const EMAIL_ELEMENT_PATTERN = /<[\w:]*EMailAddress[^>]*>\s*([^<]*?)\s*<\/[\w:]*EMailAddress>/i;
+/**
+ * Extracts the request's `<EMailAddress>` text content via a small, tightly-scoped regex rather than a DOM
+ * parse. Never resolves entities/DTDs - only the literal text between the open/close tags is ever inspected.
+ */
+export function extractEmailAddress(xml) {
+    const match = EMAIL_ELEMENT_PATTERN.exec(xml);
+    const value = match?.[1]?.trim();
+    return value ? decodeXmlEntities(value) : undefined;
+}
+/** Escapes the 5 XML-predefined-entity characters for safe inclusion as element text content. */
+export function escapeXml(value) {
+    return value
+        .replace(/&/g, "&amp;")
+        .replace(/</g, "&lt;")
+        .replace(/>/g, "&gt;")
+        .replace(/"/g, "&quot;")
+        .replace(/'/g, "&apos;");
+}
+function decodeXmlEntities(value) {
+    return value
+        .replace(/&lt;/g, "<")
+        .replace(/&gt;/g, ">")
+        .replace(/&quot;/g, '"')
+        .replace(/&apos;/g, "'")
+        .replace(/&amp;/g, "&");
+}
+const ACCEPTABLE_RESPONSE_SCHEMA_PATTERN = /<[\w:]*AcceptableResponseSchema[^>]*>\s*([^<]*?)\s*<\/[\w:]*AcceptableResponseSchema>/i;
+/** The `AcceptableResponseSchema` value a real Outlook desktop client sends to request the Outlook/EXCH
+ * response shape (`buildOutlookSuccessXml`) instead of the EAS-only MobileSync one - confirmed against
+ * `[MS-OXDSCLI]`'s own Autodiscover Response XSD, whose target namespace is exactly this value. */
+export const OUTLOOK_RESPONSE_SCHEMA = "http://schemas.microsoft.com/exchange/autodiscover/outlook/responseschema/2006a";
+/**
+ * Extracts the request's `<AcceptableResponseSchema>` text content via the same small, tightly-scoped regex
+ * approach as `extractEmailAddress` - never a DOM parse, same rationale (unauthenticated, internet-facing
+ * endpoint).
+ */
+export function extractAcceptableResponseSchema(xml) {
+    const match = ACCEPTABLE_RESPONSE_SCHEMA_PATTERN.exec(xml);
+    return match?.[1]?.trim() || undefined;
+}
+/**
+ * Builds a real `mobilesync:Response` success document per `[MS-ASCMD]`'s `AutodiscoverMobileSync.xsd` -
+ * `Culture`/`User`/`Action.Settings.Server{Type=MobileSync,Url,Name}`, matching the shape confirmed against
+ * Microsoft's own "Autodiscover for Exchange ActiveSync developers" example response. A real response can also
+ * carry a `CertEnroll` server block for client-certificate enrollment - deliberately omitted, same "pragmatic
+ * subset" scoping as Phase 2's own documented gaps, since this library has no certificate-enrollment support.
+ */
+export function buildPoxSuccessXml({ emailAddress, displayName, easUrl }) {
+    const email = escapeXml(emailAddress);
+    const url = escapeXml(easUrl);
+    const displayNameElement = displayName
+        ? `\n            <autodiscover:DisplayName>${escapeXml(displayName)}</autodiscover:DisplayName>`
+        : "";
+    return `<?xml version="1.0" encoding="utf-8"?>
+<Autodiscover xmlns:autodiscover="https://schemas.microsoft.com/exchange/autodiscover/mobilesync/responseschema/2006">
+    <autodiscover:Response>
+        <autodiscover:Culture>en:us</autodiscover:Culture>
+        <autodiscover:User>${displayNameElement}
+            <autodiscover:EMailAddress>${email}</autodiscover:EMailAddress>
+        </autodiscover:User>
+        <autodiscover:Action>
+            <autodiscover:Settings>
+                <autodiscover:Server>
+                    <autodiscover:Type>MobileSync</autodiscover:Type>
+                    <autodiscover:Url>${url}</autodiscover:Url>
+                    <autodiscover:Name>${url}</autodiscover:Name>
+                </autodiscover:Server>
+            </autodiscover:Settings>
+        </autodiscover:Action>
+    </autodiscover:Response>
+</Autodiscover>`;
+}
+/**
+ * Builds a real Outlook/EXCH `2006a` response per `[MS-OXDSCLI]`'s confirmed Autodiscover Response XSD -
+ * an `Autodiscover`(namespace `.../responseschema/2006`) element wrapping a `Response`
+ * (namespace `.../outlook/responseschema/2006a`) with `User`/`Account` children.
+ *
+ * Since this library only speaks MAPI/HTTP (no classic RPC/TCP MAPI transport), the response always
+ * advertises exactly one `Protocol`, using `Type`/`Version` as XML ATTRIBUTES rather than the classic
+ * `<Type>EXCH</Type>` child element - `[MS-OXDSCLI]`'s "Processing the X-MapiHttpCapability Header" section
+ * confirms a mapiHttp-capable client's response "MUST include a Protocol element that contains a Type
+ * attribute set to 'mapiHttp' and a Version attribute" and "MUST NOT include a Protocol element that contains
+ * a Type element set to 'EXCH' or 'EXPR'" - the two forms are mutually exclusive by design, not merely
+ * alternatives. This deployment has no classic RPC/TCP MAPI endpoint to fall back to, so every Outlook-schema
+ * request always gets the mapiHttp form - the real `X-MapiHttpCapability` request-header negotiation a full
+ * implementation would consult to choose between EXCH/mapiHttp is not implemented, a documented gap.
+ * `MailStore.InternalUrl`/`ExternalUrl` are both set to the same `mapiUrl`, since this library serves one URL
+ * per deployment with no separate internal/external network split.
+ *
+ * `LegacyDN`/`DeploymentId` are schema-required fields this library has no real backing value for (no X.500
+ * DN resolution, no multi-tenant deployment identity) - both are synthesized placeholders. Real Outlook does
+ * not validate their exact content for MAPI/HTTP connectivity; they matter for classic RPC/TCP MAPI
+ * free-busy/permissions lookups this library doesn't implement anyway.
+ */
+export function buildOutlookSuccessXml({ emailAddress, displayName, mapiUrl }) {
+    const email = escapeXml(emailAddress);
+    const url = escapeXml(mapiUrl);
+    const name = escapeXml(displayName ?? emailAddress);
+    const legacyDn = escapeXml(`/o=ExchangeLabs/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Recipients/cn=${emailAddress}`);
+    return `<?xml version="1.0" encoding="utf-8"?>
+<Autodiscover xmlns="http://schemas.microsoft.com/exchange/autodiscover/responseschema/2006">
+    <Response xmlns="${OUTLOOK_RESPONSE_SCHEMA}">
+        <User>
+            <DisplayName>${name}</DisplayName>
+            <LegacyDN>${legacyDn}</LegacyDN>
+            <AutoDiscoverSMTPAddress>${email}</AutoDiscoverSMTPAddress>
+            <DeploymentId>00000000-0000-0000-0000-000000000000</DeploymentId>
+        </User>
+        <Account>
+            <AccountType>email</AccountType>
+            <Action>settings</Action>
+            <MicrosoftOnline>False</MicrosoftOnline>
+            <Protocol Type="mapiHttp" Version="1">
+                <MailStore>
+                    <InternalUrl>${url}</InternalUrl>
+                    <ExternalUrl>${url}</ExternalUrl>
+                </MailStore>
+            </Protocol>
+        </Account>
+    </Response>
+</Autodiscover>`;
+}
+//# sourceMappingURL=AutodiscoverXml.js.map

package/dist/lib/AutodiscoverXml.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AutodiscoverXml.js","sourceRoot":"","sources":["../../src/AutodiscoverXml.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,mEAAmE;AACnE,mCAAmC;AACnC,+EAA+E;AAE/E;;;;;;;;GAQG;AAEH,MAAM,qBAAqB,GAAG,gEAAgE,CAAC;AAE/F;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAW;IAC3C,MAAM,KAAK,GAAG,qBAAqB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC9C,MAAM,KAAK,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;IACjC,OAAO,KAAK,CAAC,CAAC,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACxD,CAAC;AAED,iGAAiG;AACjG,MAAM,UAAU,SAAS,CAAC,KAAa;IACnC,OAAO,KAAK;SACP,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAa;IACpC,OAAO,KAAK;SACP,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC;SACrB,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC;SACrB,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC;SACvB,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC;SACvB,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;AAChC,CAAC;AAQD,MAAM,kCAAkC,GACpC,wFAAwF,CAAC;AAE7F;;mGAEmG;AACnG,MAAM,CAAC,MAAM,uBAAuB,GAAG,iFAAiF,CAAC;AAEzH;;;;GAIG;AACH,MAAM,UAAU,+BAA+B,CAAC,GAAW;IACvD,MAAM,KAAK,GAAG,kCAAkC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3D,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;AAC3C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,EAA0B;IAC5F,MAAM,KAAK,GAAG,SAAS,CAAC,YAAY,CAAC,CAAC;IACtC,MAAM,GAAG,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;IAC9B,MAAM,kBAAkB,GAAG,WAAW;QAClC,CAAC,CAAC,2CAA2C,SAAS,CAAC,WAAW,CAAC,6BAA6B;QAChG,CAAC,CAAC,EAAE,CAAC;IACT,OAAO;;;;6BAIkB,kBAAkB;yCACN,KAAK;;;;;;wCAMN,GAAG;yCACF,GAAG;;;;;gBAK5B,CAAC;AACjB,CAAC;AAQD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,sBAAsB,CAAC,EAAE,YAAY,EAAE,WAAW,EAAE,OAAO,EAA8B;IACrG,MAAM,KAAK,GAAG,SAAS,CAAC,YAAY,CAAC,CAAC;IACtC,MAAM,GAAG,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IAC/B,MAAM,IAAI,GAAG,SAAS,CAAC,WAAW,IAAI,YAAY,CAAC,CAAC;IACpD,MAAM,QAAQ,GAAG,SAAS,CACtB,uFAAuF,YAAY,EAAE,CACxG,CAAC;IACF,OAAO;;uBAEY,uBAAuB;;2BAEnB,IAAI;wBACP,QAAQ;uCACO,KAAK;;;;;;;;;mCAST,GAAG;mCACH,GAAG;;;;;gBAKtB,CAAC;AACjB,CAAC"}

package/dist/lib/BaseAutodiscoverRoute.js

@@ -0,0 +1,185 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+///////////////////////////////////////////////////////////////////////////////
+// Copyright (C) 2026 Jean-Philippe Steinmetz. All rights reserved.
+// SPDX-License-Identifier: MPL-2.0
+///////////////////////////////////////////////////////////////////////////////
+import { ObjectDecorators } from "@rapidrest/core";
+import { RepoUtils, RouteDecorators } from "@rapidrest/service-core";
+import { buildOutlookSuccessXml, buildPoxSuccessXml, extractAcceptableResponseSchema, extractEmailAddress, OUTLOOK_RESPONSE_SCHEMA, } from "./AutodiscoverXml.js";
+const { Init, Logger } = ObjectDecorators;
+const { Get, Param, Post, Query, Request, Response } = RouteDecorators;
+/**
+ * Abstract base for the two Autodiscover endpoints a real mail client uses to find this deployment's EAS
+ * server URL from just an email address - classic POX (`POST /autodiscover/autodiscover.xml`, per
+ * `[MS-ASCMD]`'s "MobileSync" response schema) and the modern JSON variant Microsoft calls "Autodiscover v2"
+ * (`GET /autodiscover/autodiscover.json/v1.0/<email>?Protocol=ActiveSync`). Like `BaseMailIngestRoute`/
+ * `BaseEasRoute`, this class is undecorated - the consuming application mounts it:
+ * ```ts
+ * import { AutodiscoverRouteMongo } from "@rapidrest/mail/mongo";
+ * import { RouteDecorators } from "@rapidrest/service-core";
+ * const { Route } = RouteDecorators;
+ *
+ * @Route("/autodiscover")
+ * export class MyAutodiscoverRoute extends AutodiscoverRouteMongo {
+ *     protected readonly easUrl = "https://mail.example.com/Microsoft-Server-ActiveSync";
+ *     protected readonly mapiUrl = "https://mail.example.com/mapi/emsmdb";
+ * }
+ * ```
+ * which composes with this class's own relative method paths to land exactly on the real spec's conventional
+ * paths (`/autodiscover/autodiscover.xml`, `/autodiscover/autodiscover.json/v1.0/:email`).
+ *
+ * **Auth: deliberately none.** Real classic Autodiscover conventionally expects the client to send HTTP Basic
+ * credentials (email+password), with the server free to answer `401` and force re-entry - a model this
+ * library's JWT-only, no-credential-verification-of-our-own boundary (see `BaseEasRoute`'s own doc comment on
+ * why per-request Basic Auth was rejected there) can't and shouldn't absorb; no credential-verification
+ * function exists in this codebase or its dependencies. Instead, both endpoints here follow Microsoft's own
+ * Autodiscover v2 design intent exactly: answer anonymously, and reveal nothing but a deployment-wide,
+ * config-supplied EAS server URL - not a per-mailbox secret - once the request email is confirmed to belong to
+ * a real `Mailbox` in this deployment. The actual security boundary is unchanged from Phase 2: real mailbox
+ * access still requires a JWT at `BaseEasRoute`, exactly as today.
+ *
+ * **Known gap, deliberately out of scope**: `Action.Redirect` (for multi-tenant hosted providers whose mailbox
+ * moved to a different domain) is not implemented - this library serves exactly one EAS URL for its whole
+ * deployment, so there's never a different domain to redirect to. The client-side well-known-URL discovery
+ * sequence (`MS-OXDISCO`: root domain -> `autodiscover.` subdomain -> unauthenticated HTTP redirect probe ->
+ * DNS SRV record -> cache) and the DNS `CNAME`/`SRV` record setup it depends on are also out of scope here -
+ * both are client/deployment concerns, not application code; this class only needs to answer correctly once a
+ * request actually arrives at one of its two paths.
+ *
+ * `mailboxClass` is supplied by the Mongo/SQL concrete subclasses following the exact one-line-per-backend
+ * pattern used throughout this library. `easUrl`/`mapiUrl` remain abstract even after that - both are
+ * deployment-specific values only the consuming application's own subclass can supply.
+ *
+ * @author Jean-Philippe Steinmetz
+ */
+export class BaseAutodiscoverRoute {
+    /**
+     * Builds the query value used to match `Mailbox.aliasAddresses` against the given address. See
+     * `BaseMailIngestRoute.aliasQueryValue()`'s identical doc comment - same Mongo-array vs.
+     * SQL-`simple-json`-column backend split, same override point (`AutodiscoverRouteSQL` overrides this
+     * identically to `MailIngestRouteSQL`).
+     */
+    aliasQueryValue(address) {
+        return address;
+    }
+    async init() {
+        this.mailboxRepo = await this._objectFactory.newInstance(RepoUtils, {
+            name: this.mailboxClass.name,
+            args: [this.mailboxClass],
+        });
+    }
+    async resolveMailbox(email) {
+        const address = email.trim().toLowerCase();
+        const [byPrimary, byAlias] = await Promise.all([
+            this.mailboxRepo.find({ primarySmtpAddress: address }, { ignoreACL: true, limit: 1 }),
+            this.mailboxRepo.find({ aliasAddresses: this.aliasQueryValue(address) }, { ignoreACL: true, limit: 1 }),
+        ]);
+        return byPrimary[0] ?? byAlias[0];
+    }
+    /**
+     * Classic POX Autodiscover. Per Microsoft's own client-behavior documentation, a permanent failure is just
+     * as validly conveyed via a plain HTTP status as via an inner `Error` element, so this uses the HTTP-status
+     * form for both error cases rather than inventing values for `[MS-ASCMD]`'s provider-specific numeric
+     * error-code table.
+     *
+     * Branches on the request's `AcceptableResponseSchema` to decide which response shape to build: a real
+     * Outlook desktop client sends `[MS-OXDSCLI]`'s Outlook/EXCH schema (`OUTLOOK_RESPONSE_SCHEMA`) to locate
+     * this deployment's MAPI/HTTP endpoint (`buildOutlookSuccessXml`); any other value (or a mobile/EAS-only
+     * client that omits the field entirely) gets the original MobileSync/EAS response (`buildPoxSuccessXml`).
+     */
+    async pox(req, res) {
+        if (!this.mailboxRepo) {
+            res.status(500).send();
+            return;
+        }
+        const body = req.rawBody ? req.rawBody.toString("utf-8") : "";
+        const email = extractEmailAddress(body);
+        if (!email) {
+            res.status(400).send();
+            return;
+        }
+        const mailbox = await this.resolveMailbox(email);
+        if (!mailbox) {
+            res.status(404).send();
+            return;
+        }
+        const xml = extractAcceptableResponseSchema(body) === OUTLOOK_RESPONSE_SCHEMA
+            ? buildOutlookSuccessXml({
+                emailAddress: email,
+                displayName: mailbox.displayName,
+                mapiUrl: this.mapiUrl,
+            })
+            : buildPoxSuccessXml({
+                emailAddress: email,
+                displayName: mailbox.displayName,
+                easUrl: this.easUrl,
+            });
+        res.setHeader("Content-Type", "application/xml; charset=utf-8").status(200).send(xml);
+    }
+    /**
+     * Autodiscover v2 (JSON). Only the `ActiveSync` protocol is served - this library has no EWS/other
+     * protocol surface to advertise - so any other `Protocol` value is rejected outright rather than silently
+     * answered with an EAS URL under the wrong protocol name.
+     */
+    async v2(email, protocol, res) {
+        if (!this.mailboxRepo) {
+            res.status(500).send();
+            return;
+        }
+        if (protocol !== "ActiveSync") {
+            res.status(400).json({
+                ErrorCode: "ProtocolNotSupported",
+                ErrorMessage: `Unsupported protocol: ${protocol ?? ""}`,
+            });
+            return;
+        }
+        const mailbox = await this.resolveMailbox(decodeURIComponent(email));
+        if (!mailbox) {
+            res.status(404).json({
+                ErrorCode: "UserNotFound",
+                ErrorMessage: "No mailbox exists for the given address.",
+            });
+            return;
+        }
+        res.status(200).json({ Protocol: "ActiveSync", Url: this.easUrl });
+    }
+}
+__decorate([
+    Logger,
+    __metadata("design:type", Object)
+], BaseAutodiscoverRoute.prototype, "logger", void 0);
+__decorate([
+    Init,
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", []),
+    __metadata("design:returntype", Promise)
+], BaseAutodiscoverRoute.prototype, "init", null);
+__decorate([
+    Post("/autodiscover.xml"),
+    __param(0, Request),
+    __param(1, Response),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Object]),
+    __metadata("design:returntype", Promise)
+], BaseAutodiscoverRoute.prototype, "pox", null);
+__decorate([
+    Get("/autodiscover.json/v1.0/:email"),
+    __param(0, Param("email")),
+    __param(1, Query("Protocol")),
+    __param(2, Response),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String, Object, Object]),
+    __metadata("design:returntype", Promise)
+], BaseAutodiscoverRoute.prototype, "v2", null);
+//# sourceMappingURL=BaseAutodiscoverRoute.js.map

package/dist/lib/BaseAutodiscoverRoute.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"BaseAutodiscoverRoute.js","sourceRoot":"","sources":["../../src/BaseAutodiscoverRoute.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,+EAA+E;AAC/E,mEAAmE;AACnE,mCAAmC;AACnC,+EAA+E;AAC/E,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAA4C,SAAS,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC/G,OAAO,EACH,sBAAsB,EACtB,kBAAkB,EAClB,+BAA+B,EAC/B,mBAAmB,EACnB,uBAAuB,GAC1B,MAAM,sBAAsB,CAAC;AAE9B,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,gBAAgB,CAAC;AAC1C,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,eAAe,CAAC;AAEvE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,MAAM,OAAgB,qBAAqB;IAoBvC;;;;;OAKG;IACO,eAAe,CAAC,OAAe;QACrC,OAAO,OAAO,CAAC;IACnB,CAAC;IAGY,AAAN,KAAK,CAAC,IAAI;QACb,IAAI,CAAC,WAAW,GAAG,MAAM,IAAI,CAAC,cAAe,CAAC,WAAW,CAAC,SAAS,EAAE;YACjE,IAAI,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI;YAC5B,IAAI,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC;SAC5B,CAAC,CAAC;IACP,CAAC;IAEO,KAAK,CAAC,cAAc,CAAC,KAAa;QACtC,MAAM,OAAO,GAAW,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACnD,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC3C,IAAI,CAAC,WAAY,CAAC,IAAI,CAAC,EAAE,kBAAkB,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;YACtF,IAAI,CAAC,WAAY,CAAC,IAAI,CAAC,EAAE,cAAc,EAAE,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;SAC3G,CAAC,CAAC;QACH,OAAO,SAAS,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC;IACtC,CAAC;IAED;;;;;;;;;;OAUG;IAEU,AAAN,KAAK,CAAC,GAAG,CAAU,GAAgB,EAAY,GAAiB;QACnE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACpB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;YACvB,OAAO;QACX,CAAC;QAED,MAAM,IAAI,GAAW,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,MAAM,KAAK,GAAuB,mBAAmB,CAAC,IAAI,CAAC,CAAC;QAC5D,IAAI,CAAC,KAAK,EAAE,CAAC;YACT,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;YACvB,OAAO;QACX,CAAC;QAED,MAAM,OAAO,GAAkB,MAAM,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QAChE,IAAI,CAAC,OAAO,EAAE,CAAC;YACX,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;YACvB,OAAO;QACX,CAAC;QAED,MAAM,GAAG,GACL,+BAA+B,CAAC,IAAI,CAAC,KAAK,uBAAuB;YAC7D,CAAC,CAAC,sBAAsB,CAAC;gBACnB,YAAY,EAAE,KAAK;gBACnB,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,OAAO,EAAE,IAAI,CAAC,OAAO;aACxB,CAAC;YACJ,CAAC,CAAC,kBAAkB,CAAC;gBACf,YAAY,EAAE,KAAK;gBACnB,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,MAAM,EAAE,IAAI,CAAC,MAAM;aACtB,CAAC,CAAC;QACb,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,gCAAgC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC1F,CAAC;IAED;;;;OAIG;IAEU,AAAN,KAAK,CAAC,EAAE,CACK,KAAa,EACV,QAA4B,EACrC,GAAiB;QAE3B,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACpB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;YACvB,OAAO;QACX,CAAC;QACD,IAAI,QAAQ,KAAK,YAAY,EAAE,CAAC;YAC5B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACjB,SAAS,EAAE,sBAAsB;gBACjC,YAAY,EAAE,yBAAyB,QAAQ,IAAI,EAAE,EAAE;aAC1D,CAAC,CAAC;YACH,OAAO;QACX,CAAC;QAED,MAAM,OAAO,GAAkB,MAAM,IAAI,CAAC,cAAc,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC;QACpF,IAAI,CAAC,OAAO,EAAE,CAAC;YACX,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACjB,SAAS,EAAE,cAAc;gBACzB,YAAY,EAAE,0CAA0C;aAC3D,CAAC,CAAC;YACH,OAAO;QACX,CAAC;QAED,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IACvE,CAAC;CACJ;AA7GW;IADP,MAAM;;qDACa;AAaP;IADZ,IAAI;;;;iDAMJ;AAuBY;IADZ,IAAI,CAAC,mBAAmB,CAAC;IACR,WAAA,OAAO,CAAA;IAAoB,WAAA,QAAQ,CAAA;;;;gDAgCpD;AAQY;IADZ,GAAG,CAAC,gCAAgC,CAAC;IAEjC,WAAA,KAAK,CAAC,OAAO,CAAC,CAAA;IACd,WAAA,KAAK,CAAC,UAAU,CAAC,CAAA;IACjB,WAAA,QAAQ,CAAA;;;;+CAwBZ"}

package/dist/lib/index.js

@@ -0,0 +1,28 @@
+///////////////////////////////////////////////////////////////////////////////
+// Copyright (C) 2026 Jean-Philippe Steinmetz. All rights reserved.
+// SPDX-License-Identifier: MPL-2.0
+///////////////////////////////////////////////////////////////////////////////
+/**
+ * Autodiscover protocol compatibility: the mechanism a real mail client uses to find this deployment's EAS
+ * server URL from just an email address, before it has any credentials or JWT of its own. Exports the
+ * backend-agnostic surface - the request/response XML helpers and the abstract route base class. The concrete
+ * Mongo/SQL classes a deployment actually instantiates (`AutodiscoverRouteMongo`/`AutodiscoverRouteSQL`) are
+ * exported from this package's `./mongo`/`./sql` subpaths instead, alongside every other entity/route/job this
+ * library defines - see `src/eas/index.ts`'s identical doc comment for the same convention.
+ *
+ * A deployment mounts Autodiscover with a trivial subclass supplying its own EAS URL:
+ * ```ts
+ * import { AutodiscoverRouteMongo } from "@rapidrest/mail/mongo";
+ * import { RouteDecorators } from "@rapidrest/service-core";
+ * const { Route } = RouteDecorators;
+ *
+ * @Route("/autodiscover")
+ * export class MyAutodiscoverRoute extends AutodiscoverRouteMongo {
+ *     protected readonly easUrl = "https://mail.example.com/Microsoft-Server-ActiveSync";
+ *     protected readonly mapiUrl = "https://mail.example.com/mapi/emsmdb";
+ * }
+ * ```
+ */
+export * from "./AutodiscoverXml.js";
+export * from "./BaseAutodiscoverRoute.js";
+//# sourceMappingURL=index.js.map

package/dist/lib/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,mEAAmE;AACnE,mCAAmC;AACnC,+EAA+E;AAE/E;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,cAAc,sBAAsB,CAAC;AACrC,cAAc,4BAA4B,CAAC"}

package/dist/lib/mongo/AutodiscoverRouteMongo.js

@@ -0,0 +1,20 @@
+///////////////////////////////////////////////////////////////////////////////
+// Copyright (C) 2026 Jean-Philippe Steinmetz. All rights reserved.
+// SPDX-License-Identifier: MPL-2.0
+///////////////////////////////////////////////////////////////////////////////
+import { MailboxMongo } from "@rapidmx/restapi/mongo";
+import { BaseAutodiscoverRoute } from "../BaseAutodiscoverRoute.js";
+/**
+ * Mongo-backed concrete `BaseAutodiscoverRoute`. `easUrl` remains abstract - the deployment's own
+ * `@Route("/autodiscover")` subclass supplies it. See `EasRouteMongo.ts`'s doc comment for the identical
+ * mounting pattern.
+ *
+ * @author Jean-Philippe Steinmetz
+ */
+export class AutodiscoverRouteMongo extends BaseAutodiscoverRoute {
+    constructor() {
+        super(...arguments);
+        this.mailboxClass = MailboxMongo;
+    }
+}
+//# sourceMappingURL=AutodiscoverRouteMongo.js.map

package/dist/lib/mongo/AutodiscoverRouteMongo.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AutodiscoverRouteMongo.js","sourceRoot":"","sources":["../../../src/mongo/AutodiscoverRouteMongo.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,mEAAmE;AACnE,mCAAmC;AACnC,+EAA+E;AAC/E,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACtD,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AAEpE;;;;;;GAMG;AACH,MAAM,OAAgB,sBAAuB,SAAQ,qBAAmC;IAAxF;;QACc,iBAAY,GAAQ,YAAY,CAAC;IAC/C,CAAC;CAAA"}

package/dist/lib/mongo/index.js

@@ -0,0 +1,6 @@
+///////////////////////////////////////////////////////////////////////////////
+// Copyright (C) 2026 Jean-Philippe Steinmetz. All rights reserved.
+// SPDX-License-Identifier: MPL-2.0
+///////////////////////////////////////////////////////////////////////////////
+export * from "./AutodiscoverRouteMongo.js";
+//# sourceMappingURL=index.js.map

package/dist/lib/mongo/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/mongo/index.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,mEAAmE;AACnE,mCAAmC;AACnC,+EAA+E;AAC/E,cAAc,6BAA6B,CAAC"}

package/dist/lib/mongo.js

@@ -0,0 +1,6 @@
+///////////////////////////////////////////////////////////////////////////////
+// Copyright (C) 2026 Jean-Philippe Steinmetz. All rights reserved.
+// SPDX-License-Identifier: MPL-2.0
+///////////////////////////////////////////////////////////////////////////////
+export * from "./mongo/index.js";
+//# sourceMappingURL=mongo.js.map

package/dist/lib/mongo.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mongo.js","sourceRoot":"","sources":["../../src/mongo.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,mEAAmE;AACnE,mCAAmC;AACnC,+EAA+E;AAC/E,cAAc,kBAAkB,CAAC"}

package/dist/lib/sql/AutodiscoverRouteSQL.js

@@ -0,0 +1,27 @@
+///////////////////////////////////////////////////////////////////////////////
+// Copyright (C) 2026 Jean-Philippe Steinmetz. All rights reserved.
+// SPDX-License-Identifier: MPL-2.0
+///////////////////////////////////////////////////////////////////////////////
+import { Raw } from "typeorm";
+import { MailboxSQL } from "@rapidmx/restapi/sql";
+import { BaseAutodiscoverRoute } from "../BaseAutodiscoverRoute.js";
+/**
+ * SQL-backed concrete `BaseAutodiscoverRoute`. See `AutodiscoverRouteMongo.ts`'s doc comment - the same
+ * mounting pattern applies here. `aliasQueryValue()` is overridden identically to `MailIngestRouteSQL` - see
+ * that class's doc comment for the full vulnerability rationale (unescaped `%`/`_` enabling alias-enumeration
+ * and cross-mailbox matches) this same escaping closes here too, since `resolveMailbox()` is reached by
+ * unauthenticated callers exactly like `MailIngestRoute.resolve()` is.
+ *
+ * @author Jean-Philippe Steinmetz
+ */
+export class AutodiscoverRouteSQL extends BaseAutodiscoverRoute {
+    constructor() {
+        super(...arguments);
+        this.mailboxClass = MailboxSQL;
+    }
+    aliasQueryValue(address) {
+        const escaped = address.replace(/[\\%_]/g, (ch) => `\\${ch}`);
+        return Raw((alias) => `${alias} LIKE :pattern ESCAPE '\\'`, { pattern: `%"${escaped}"%` });
+    }
+}
+//# sourceMappingURL=AutodiscoverRouteSQL.js.map

package/dist/lib/sql/AutodiscoverRouteSQL.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AutodiscoverRouteSQL.js","sourceRoot":"","sources":["../../../src/sql/AutodiscoverRouteSQL.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,mEAAmE;AACnE,mCAAmC;AACnC,+EAA+E;AAC/E,OAAO,EAAE,GAAG,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AAEpE;;;;;;;;GAQG;AACH,MAAM,OAAgB,oBAAqB,SAAQ,qBAAiC;IAApF;;QACc,iBAAY,GAAQ,UAAU,CAAC;IAM7C,CAAC;IAJa,eAAe,CAAC,OAAe;QACrC,MAAM,OAAO,GAAW,OAAO,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACtE,OAAO,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,4BAA4B,EAAE,EAAE,OAAO,EAAE,KAAK,OAAO,IAAI,EAAE,CAAC,CAAC;IAC/F,CAAC;CACJ"}

package/dist/lib/sql/index.js

@@ -0,0 +1,6 @@
+///////////////////////////////////////////////////////////////////////////////
+// Copyright (C) 2026 Jean-Philippe Steinmetz. All rights reserved.
+// SPDX-License-Identifier: MPL-2.0
+///////////////////////////////////////////////////////////////////////////////
+export * from "./AutodiscoverRouteSQL.js";
+//# sourceMappingURL=index.js.map

package/dist/lib/sql/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/sql/index.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,mEAAmE;AACnE,mCAAmC;AACnC,+EAA+E;AAC/E,cAAc,2BAA2B,CAAC"}

package/dist/lib/sql.js

@@ -0,0 +1,6 @@
+///////////////////////////////////////////////////////////////////////////////
+// Copyright (C) 2026 Jean-Philippe Steinmetz. All rights reserved.
+// SPDX-License-Identifier: MPL-2.0
+///////////////////////////////////////////////////////////////////////////////
+export * from "./sql/index.js";
+//# sourceMappingURL=sql.js.map

package/dist/lib/sql.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sql.js","sourceRoot":"","sources":["../../src/sql.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,mEAAmE;AACnE,mCAAmC;AACnC,+EAA+E;AAC/E,cAAc,gBAAgB,CAAC"}

package/dist/types/AutodiscoverXml.d.ts

@@ -0,0 +1,58 @@
+/**
+ * Extracts the request's `<EMailAddress>` text content via a small, tightly-scoped regex rather than a DOM
+ * parse. Never resolves entities/DTDs - only the literal text between the open/close tags is ever inspected.
+ */
+export declare function extractEmailAddress(xml: string): string | undefined;
+/** Escapes the 5 XML-predefined-entity characters for safe inclusion as element text content. */
+export declare function escapeXml(value: string): string;
+export interface AutodiscoverPoxSuccess {
+    emailAddress: string;
+    displayName?: string;
+    easUrl: string;
+}
+/** The `AcceptableResponseSchema` value a real Outlook desktop client sends to request the Outlook/EXCH
+ * response shape (`buildOutlookSuccessXml`) instead of the EAS-only MobileSync one - confirmed against
+ * `[MS-OXDSCLI]`'s own Autodiscover Response XSD, whose target namespace is exactly this value. */
+export declare const OUTLOOK_RESPONSE_SCHEMA = "http://schemas.microsoft.com/exchange/autodiscover/outlook/responseschema/2006a";
+/**
+ * Extracts the request's `<AcceptableResponseSchema>` text content via the same small, tightly-scoped regex
+ * approach as `extractEmailAddress` - never a DOM parse, same rationale (unauthenticated, internet-facing
+ * endpoint).
+ */
+export declare function extractAcceptableResponseSchema(xml: string): string | undefined;
+/**
+ * Builds a real `mobilesync:Response` success document per `[MS-ASCMD]`'s `AutodiscoverMobileSync.xsd` -
+ * `Culture`/`User`/`Action.Settings.Server{Type=MobileSync,Url,Name}`, matching the shape confirmed against
+ * Microsoft's own "Autodiscover for Exchange ActiveSync developers" example response. A real response can also
+ * carry a `CertEnroll` server block for client-certificate enrollment - deliberately omitted, same "pragmatic
+ * subset" scoping as Phase 2's own documented gaps, since this library has no certificate-enrollment support.
+ */
+export declare function buildPoxSuccessXml({ emailAddress, displayName, easUrl }: AutodiscoverPoxSuccess): string;
+export interface AutodiscoverOutlookSuccess {
+    emailAddress: string;
+    displayName?: string;
+    mapiUrl: string;
+}
+/**
+ * Builds a real Outlook/EXCH `2006a` response per `[MS-OXDSCLI]`'s confirmed Autodiscover Response XSD -
+ * an `Autodiscover`(namespace `.../responseschema/2006`) element wrapping a `Response`
+ * (namespace `.../outlook/responseschema/2006a`) with `User`/`Account` children.
+ *
+ * Since this library only speaks MAPI/HTTP (no classic RPC/TCP MAPI transport), the response always
+ * advertises exactly one `Protocol`, using `Type`/`Version` as XML ATTRIBUTES rather than the classic
+ * `<Type>EXCH</Type>` child element - `[MS-OXDSCLI]`'s "Processing the X-MapiHttpCapability Header" section
+ * confirms a mapiHttp-capable client's response "MUST include a Protocol element that contains a Type
+ * attribute set to 'mapiHttp' and a Version attribute" and "MUST NOT include a Protocol element that contains
+ * a Type element set to 'EXCH' or 'EXPR'" - the two forms are mutually exclusive by design, not merely
+ * alternatives. This deployment has no classic RPC/TCP MAPI endpoint to fall back to, so every Outlook-schema
+ * request always gets the mapiHttp form - the real `X-MapiHttpCapability` request-header negotiation a full
+ * implementation would consult to choose between EXCH/mapiHttp is not implemented, a documented gap.
+ * `MailStore.InternalUrl`/`ExternalUrl` are both set to the same `mapiUrl`, since this library serves one URL
+ * per deployment with no separate internal/external network split.
+ *
+ * `LegacyDN`/`DeploymentId` are schema-required fields this library has no real backing value for (no X.500
+ * DN resolution, no multi-tenant deployment identity) - both are synthesized placeholders. Real Outlook does
+ * not validate their exact content for MAPI/HTTP connectivity; they matter for classic RPC/TCP MAPI
+ * free-busy/permissions lookups this library doesn't implement anyway.
+ */
+export declare function buildOutlookSuccessXml({ emailAddress, displayName, mapiUrl }: AutodiscoverOutlookSuccess): string;

package/dist/types/BaseAutodiscoverRoute.d.ts

@@ -0,0 +1,86 @@
+import { HttpRequest, HttpResponse } from "@rapidrest/service-core";
+import { Mailbox } from "@rapidmx/restapi";
+/**
+ * Abstract base for the two Autodiscover endpoints a real mail client uses to find this deployment's EAS
+ * server URL from just an email address - classic POX (`POST /autodiscover/autodiscover.xml`, per
+ * `[MS-ASCMD]`'s "MobileSync" response schema) and the modern JSON variant Microsoft calls "Autodiscover v2"
+ * (`GET /autodiscover/autodiscover.json/v1.0/<email>?Protocol=ActiveSync`). Like `BaseMailIngestRoute`/
+ * `BaseEasRoute`, this class is undecorated - the consuming application mounts it:
+ * ```ts
+ * import { AutodiscoverRouteMongo } from "@rapidrest/mail/mongo";
+ * import { RouteDecorators } from "@rapidrest/service-core";
+ * const { Route } = RouteDecorators;
+ *
+ * @Route("/autodiscover")
+ * export class MyAutodiscoverRoute extends AutodiscoverRouteMongo {
+ *     protected readonly easUrl = "https://mail.example.com/Microsoft-Server-ActiveSync";
+ *     protected readonly mapiUrl = "https://mail.example.com/mapi/emsmdb";
+ * }
+ * ```
+ * which composes with this class's own relative method paths to land exactly on the real spec's conventional
+ * paths (`/autodiscover/autodiscover.xml`, `/autodiscover/autodiscover.json/v1.0/:email`).
+ *
+ * **Auth: deliberately none.** Real classic Autodiscover conventionally expects the client to send HTTP Basic
+ * credentials (email+password), with the server free to answer `401` and force re-entry - a model this
+ * library's JWT-only, no-credential-verification-of-our-own boundary (see `BaseEasRoute`'s own doc comment on
+ * why per-request Basic Auth was rejected there) can't and shouldn't absorb; no credential-verification
+ * function exists in this codebase or its dependencies. Instead, both endpoints here follow Microsoft's own
+ * Autodiscover v2 design intent exactly: answer anonymously, and reveal nothing but a deployment-wide,
+ * config-supplied EAS server URL - not a per-mailbox secret - once the request email is confirmed to belong to
+ * a real `Mailbox` in this deployment. The actual security boundary is unchanged from Phase 2: real mailbox
+ * access still requires a JWT at `BaseEasRoute`, exactly as today.
+ *
+ * **Known gap, deliberately out of scope**: `Action.Redirect` (for multi-tenant hosted providers whose mailbox
+ * moved to a different domain) is not implemented - this library serves exactly one EAS URL for its whole
+ * deployment, so there's never a different domain to redirect to. The client-side well-known-URL discovery
+ * sequence (`MS-OXDISCO`: root domain -> `autodiscover.` subdomain -> unauthenticated HTTP redirect probe ->
+ * DNS SRV record -> cache) and the DNS `CNAME`/`SRV` record setup it depends on are also out of scope here -
+ * both are client/deployment concerns, not application code; this class only needs to answer correctly once a
+ * request actually arrives at one of its two paths.
+ *
+ * `mailboxClass` is supplied by the Mongo/SQL concrete subclasses following the exact one-line-per-backend
+ * pattern used throughout this library. `easUrl`/`mapiUrl` remain abstract even after that - both are
+ * deployment-specific values only the consuming application's own subclass can supply.
+ *
+ * @author Jean-Philippe Steinmetz
+ */
+export declare abstract class BaseAutodiscoverRoute<M extends Mailbox> {
+    protected abstract mailboxClass: any;
+    /** The EAS endpoint URL to report - e.g. `https://mail.example.com/Microsoft-Server-ActiveSync`, matching
+     * whatever `@Route(...)` path the deployment mounted its `BaseEasRoute` subclass at. */
+    protected abstract readonly easUrl: string;
+    /** The MAPI/HTTP `emsmdb` endpoint URL to report to a real Outlook desktop client - e.g.
+     * `https://mail.example.com/mapi/emsmdb`, matching whatever `@Route(...)` path the deployment mounted its
+     * `BaseMapiEmsmdbRoute` subclass at. Only used by `pox()`'s Outlook/EXCH response branch. */
+    protected abstract readonly mapiUrl: string;
+    private _objectFactory?;
+    private mailboxRepo?;
+    private logger;
+    /**
+     * Builds the query value used to match `Mailbox.aliasAddresses` against the given address. See
+     * `BaseMailIngestRoute.aliasQueryValue()`'s identical doc comment - same Mongo-array vs.
+     * SQL-`simple-json`-column backend split, same override point (`AutodiscoverRouteSQL` overrides this
+     * identically to `MailIngestRouteSQL`).
+     */
+    protected aliasQueryValue(address: string): any;
+    init(): Promise<void>;
+    private resolveMailbox;
+    /**
+     * Classic POX Autodiscover. Per Microsoft's own client-behavior documentation, a permanent failure is just
+     * as validly conveyed via a plain HTTP status as via an inner `Error` element, so this uses the HTTP-status
+     * form for both error cases rather than inventing values for `[MS-ASCMD]`'s provider-specific numeric
+     * error-code table.
+     *
+     * Branches on the request's `AcceptableResponseSchema` to decide which response shape to build: a real
+     * Outlook desktop client sends `[MS-OXDSCLI]`'s Outlook/EXCH schema (`OUTLOOK_RESPONSE_SCHEMA`) to locate
+     * this deployment's MAPI/HTTP endpoint (`buildOutlookSuccessXml`); any other value (or a mobile/EAS-only
+     * client that omits the field entirely) gets the original MobileSync/EAS response (`buildPoxSuccessXml`).
+     */
+    pox(req: HttpRequest, res: HttpResponse): Promise<void>;
+    /**
+     * Autodiscover v2 (JSON). Only the `ActiveSync` protocol is served - this library has no EWS/other
+     * protocol surface to advertise - so any other `Protocol` value is rejected outright rather than silently
+     * answered with an EAS URL under the wrong protocol name.
+     */
+    v2(email: string, protocol: string | undefined, res: HttpResponse): Promise<void>;
+}

package/dist/types/index.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Autodiscover protocol compatibility: the mechanism a real mail client uses to find this deployment's EAS
+ * server URL from just an email address, before it has any credentials or JWT of its own. Exports the
+ * backend-agnostic surface - the request/response XML helpers and the abstract route base class. The concrete
+ * Mongo/SQL classes a deployment actually instantiates (`AutodiscoverRouteMongo`/`AutodiscoverRouteSQL`) are
+ * exported from this package's `./mongo`/`./sql` subpaths instead, alongside every other entity/route/job this
+ * library defines - see `src/eas/index.ts`'s identical doc comment for the same convention.
+ *
+ * A deployment mounts Autodiscover with a trivial subclass supplying its own EAS URL:
+ * ```ts
+ * import { AutodiscoverRouteMongo } from "@rapidrest/mail/mongo";
+ * import { RouteDecorators } from "@rapidrest/service-core";
+ * const { Route } = RouteDecorators;
+ *
+ * @Route("/autodiscover")
+ * export class MyAutodiscoverRoute extends AutodiscoverRouteMongo {
+ *     protected readonly easUrl = "https://mail.example.com/Microsoft-Server-ActiveSync";
+ *     protected readonly mapiUrl = "https://mail.example.com/mapi/emsmdb";
+ * }
+ * ```
+ */
+export * from "./AutodiscoverXml.js";
+export * from "./BaseAutodiscoverRoute.js";

package/dist/types/mongo/AutodiscoverRouteMongo.d.ts

@@ -0,0 +1,12 @@
+import { MailboxMongo } from "@rapidmx/restapi/mongo";
+import { BaseAutodiscoverRoute } from "../BaseAutodiscoverRoute.js";
+/**
+ * Mongo-backed concrete `BaseAutodiscoverRoute`. `easUrl` remains abstract - the deployment's own
+ * `@Route("/autodiscover")` subclass supplies it. See `EasRouteMongo.ts`'s doc comment for the identical
+ * mounting pattern.
+ *
+ * @author Jean-Philippe Steinmetz
+ */
+export declare abstract class AutodiscoverRouteMongo extends BaseAutodiscoverRoute<MailboxMongo> {
+    protected mailboxClass: any;
+}

package/dist/types/mongo/index.d.ts

@@ -0,0 +1 @@
+export * from "./AutodiscoverRouteMongo.js";

package/dist/types/mongo.d.ts

@@ -0,0 +1 @@
+export * from "./mongo/index.js";

package/dist/types/sql/AutodiscoverRouteSQL.d.ts

@@ -0,0 +1,15 @@
+import { MailboxSQL } from "@rapidmx/restapi/sql";
+import { BaseAutodiscoverRoute } from "../BaseAutodiscoverRoute.js";
+/**
+ * SQL-backed concrete `BaseAutodiscoverRoute`. See `AutodiscoverRouteMongo.ts`'s doc comment - the same
+ * mounting pattern applies here. `aliasQueryValue()` is overridden identically to `MailIngestRouteSQL` - see
+ * that class's doc comment for the full vulnerability rationale (unescaped `%`/`_` enabling alias-enumeration
+ * and cross-mailbox matches) this same escaping closes here too, since `resolveMailbox()` is reached by
+ * unauthenticated callers exactly like `MailIngestRoute.resolve()` is.
+ *
+ * @author Jean-Philippe Steinmetz
+ */
+export declare abstract class AutodiscoverRouteSQL extends BaseAutodiscoverRoute<MailboxSQL> {
+    protected mailboxClass: any;
+    protected aliasQueryValue(address: string): any;
+}

package/dist/types/sql/index.d.ts

@@ -0,0 +1 @@
+export * from "./AutodiscoverRouteSQL.js";

package/dist/types/sql.d.ts

@@ -0,0 +1 @@
+export * from "./sql/index.js";

package/package.json

@@ -0,0 +1,90 @@
+{
+    "name": "@rapidmx/autodiscover",
+    "version": "1.0.0-beta.0",
+    "description": "Autodiscover protocol support for RapidREST mail servers.",
+    "repository": "https://github.com/RapidMX/autodiscover.git",
+    "author": "RapidREST <rapidrests@gmail.com>",
+    "license": "MPL-2.0",
+    "contributors": [
+        "Jean-Philippe Steinmetz"
+    ],
+    "scripts": {
+        "build": "yarn lint && rimraf dist && tsc",
+        "lint": "eslint ./src ./test",
+        "local-audit": "yarn install && yarn npm audit -A -R \"$@\"",
+        "checkup": "yarn dlx @yarnpkg/doctor \"$@\"",
+        "dependency-check": "yarn dlx depcheck \"$@\"",
+        "report-coverage": "cat ./coverage/lcov.info | coveralls",
+        "test": "vitest run",
+        "test:prod": "npm run lint && vitest run --coverage",
+        "test:watch": "vitest",
+        "release": "rapidrest release"
+    },
+    "peerDependencies": {
+        "@rapidmx/restapi": "0.1.x",
+        "@rapidrest/core": "5.x",
+        "@rapidrest/service-core": "1.x"
+    },
+    "devDependencies": {
+        "@rapidmx/restapi": "^0.2.0",
+        "@rapidrest/cli": "^1.0.1",
+        "@rapidrest/core": "^5.2.2",
+        "@rapidrest/service-core": "^1.7.2",
+        "@swc/core": "^1.16.2",
+        "@types/nconf": "^0.10.7",
+        "@types/node": "^26.5.0",
+        "@typescript-eslint/eslint-plugin": "^8.70.0",
+        "@typescript-eslint/parser": "^8.70.0",
+        "@vitest/coverage-v8": "^5.0.0",
+        "better-sqlite3": "^13.0.3",
+        "eslint": "^10.10.0",
+        "eslint-config-prettier": "^10.1.8",
+        "eslint-plugin-import": "^2.32.0",
+        "eslint-plugin-jsdoc": "^64.3.6",
+        "globals": "^17.12.0",
+        "lodash-es": "^4.18.1",
+        "mongodb": "^7.6.0",
+        "mongodb-memory-server": "^11.2.0",
+        "nconf": "^0.13.0",
+        "openapi3-ts": "^4.6.1",
+        "prom-client": "^15.1.3",
+        "redis": "^6.2.1",
+        "reflect-metadata": "^0.2.2",
+        "rimraf": "^6.1.3",
+        "ts-node": "^10.9.2",
+        "tsx": "^4.23.13",
+        "typeorm": "^1.1.1",
+        "typescript": "^6.0.3",
+        "unplugin-swc": "^1.6.0",
+        "vite": "^8.2.2",
+        "vitest": "^5.0.0",
+        "winston": "^3.19.0"
+    },
+    "packageManager": "yarn@4.5.3",
+    "engines": {
+        "node": ">=24.0.0"
+    },
+    "publishConfig": {
+        "registry": "https://registry.npmjs.org/"
+    },
+    "type": "module",
+    "main": "dist/lib/index.js",
+    "exports": {
+        ".": {
+            "import": "./dist/lib/index.js",
+            "types": "./dist/types/index.d.ts"
+        },
+        "./mongo": {
+            "import": "./dist/lib/mongo.js",
+            "types": "./dist/types/mongo.d.ts"
+        },
+        "./sql": {
+            "import": "./dist/lib/sql.js",
+            "types": "./dist/types/sql.d.ts"
+        }
+    },
+    "typings": "dist/types/index.d.ts",
+    "files": [
+        "dist"
+    ]
+}