@rapidmx/restapi 0.1.0

package/dist/lib/routes/BaseMessageRoute.js

@@ -0,0 +1,142 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+///////////////////////////////////////////////////////////////////////////////
+// Copyright (C) 2026 Jean-Philippe Steinmetz. All rights reserved.
+// SPDX-License-Identifier: MPL-2.0
+///////////////////////////////////////////////////////////////////////////////
+import { ApiError, ObjectDecorators } from "@rapidrest/core";
+import { ACLAction, ApiErrorMessages, ApiErrors, DocDecorators, RouteDecorators, } from "@rapidrest/service-core";
+import { ScanPipeline } from "../scan/ScanPipeline.js";
+import { findOrCreateWellKnownFolder } from "../util/FolderUtils.js";
+import { scanAndRelay } from "../util/MailSendUtils.js";
+import { RecoverableRepoUtils } from "../util/RecoverableRepoUtils.js";
+import { BaseScopedChildRoute } from "./BaseScopedChildRoute.js";
+import { FolderType } from "../models/types.js";
+const { Inject } = ObjectDecorators;
+const { Description, Returns, Summary } = DocDecorators;
+const { Get, Param, Post, Request, Response, User: AuthUser } = RouteDecorators;
+/**
+ * Extends `BaseScopedChildRoute` (scoped by `folderUid` — see the architecture note on `Message.mailboxUid`)
+ * with a `send` endpoint that composes, (re-)scans, and relays a drafted message via `MailTransport`, then
+ * moves it into the mailbox's Sent Items folder. Ordinary `create`/`update`/`delete`/`find`/`findById`
+ * (save-draft, edit-draft, discard-draft, list, fetch) are handled entirely by the base class — this is the
+ * only mail-specific behavior a `Message` needs beyond scoped CRUD.
+ *
+ * `folderClass` is supplied by the Mongo/SQL concrete subclasses so this class can look up (and, if needed,
+ * create) the mailbox's Sent Items folder without depending on either backend directly.
+ *
+ * @author Jean-Philippe Steinmetz
+ */
+export class BaseMessageRoute extends BaseScopedChildRoute {
+    constructor() {
+        super(...arguments);
+        this.scopeProperty = "folderUid";
+    }
+    async getFolderRepo() {
+        if (!this.folderRepo) {
+            this.folderRepo = await this._objectFactory.newInstance(RecoverableRepoUtils, {
+                name: this.folderClass.name,
+                args: [this.folderClass],
+            });
+        }
+        return this.folderRepo;
+    }
+    async send(id, req, user) {
+        if (!this.repoUtils || !this.blobStore || !this.mailTransport || !this.scanPipeline) {
+            throw new ApiError(ApiErrors.INTERNAL_ERROR, 500, ApiErrorMessages.INTERNAL_ERROR);
+        }
+        const message = await this.repoUtils.findOne(id, { ignoreACL: true });
+        if (!message) {
+            throw new ApiError(ApiErrors.NOT_FOUND, 404, ApiErrorMessages.NOT_FOUND);
+        }
+        if (!(await this.aclUtils.hasPermission(user, message.folderUid, ACLAction.UPDATE))) {
+            throw new ApiError(ApiErrors.AUTH_PERMISSION_FAILURE, 403, ApiErrorMessages.AUTH_PERMISSION_FAILURE);
+        }
+        // The message's `bodyBlobKey` already holds the fully composed RFC 5322 source (assembled by the
+        // webmail compose UI, or an EAS/MAPI "send" handler, before this endpoint is called) — this route's
+        // job is scanning and relay, not MIME composition.
+        const raw = await this.blobStore.get(message.bodyBlobKey);
+        const envelopeTo = message.recipients.map((r) => r.address);
+        const { sanitizedHtmlBlobKey: scannedHtmlBlobKey } = await scanAndRelay(raw, message.from.address, envelopeTo, this.scanPipeline, this.mailTransport, this.blobStore);
+        const folderRepo = await this.getFolderRepo();
+        const sentFolder = await findOrCreateWellKnownFolder(folderRepo, this.folderClass, message.mailboxUid, FolderType.SENT_ITEMS, user);
+        const flags = { ...message.flags, read: true };
+        // `scanAndRelay()` only stores a new blob when this send pass actually produced sanitized HTML - a
+        // message with no HTML body at all keeps whatever `sanitizedHtmlBlobKey` it already had (absent, for a
+        // freshly composed draft).
+        const sanitizedHtmlBlobKey = scannedHtmlBlobKey ?? message.sanitizedHtmlBlobKey;
+        return await this.repoUtils.update({
+            uid: message.uid,
+            version: message.version,
+            folderUid: sentFolder.uid,
+            flags,
+            sanitizedHtmlBlobKey,
+        }, message, { user, ignoreACL: true });
+    }
+    async content(id, res, user) {
+        if (!this.repoUtils || !this.blobStore) {
+            throw new ApiError(ApiErrors.INTERNAL_ERROR, 500, ApiErrorMessages.INTERNAL_ERROR);
+        }
+        const message = await this.repoUtils.findOne(id, { ignoreACL: true });
+        if (!message || !(await this.aclUtils.hasPermission(user, message.folderUid, ACLAction.READ))) {
+            throw new ApiError(ApiErrors.NOT_FOUND, 404, ApiErrorMessages.NOT_FOUND);
+        }
+        if (message.sanitizedHtmlBlobKey) {
+            const html = await this.blobStore.get(message.sanitizedHtmlBlobKey);
+            res.setHeader("content-type", "text/html; charset=utf-8");
+            res.send(html);
+            return;
+        }
+        res.setHeader("content-type", "text/plain; charset=utf-8");
+        res.send(Buffer.from(message.bodyPreview ?? "", "utf-8"));
+    }
+}
+__decorate([
+    Inject("BlobStore"),
+    __metadata("design:type", Object)
+], BaseMessageRoute.prototype, "blobStore", void 0);
+__decorate([
+    Inject("MailTransport"),
+    __metadata("design:type", Object)
+], BaseMessageRoute.prototype, "mailTransport", void 0);
+__decorate([
+    Inject(ScanPipeline),
+    __metadata("design:type", ScanPipeline)
+], BaseMessageRoute.prototype, "scanPipeline", void 0);
+__decorate([
+    Summary("Send message"),
+    Description("Scans and relays a drafted message via the configured MailTransport, then moves it into the " +
+        "mailbox's Sent Items folder."),
+    Returns([Object]),
+    Post("/:id/send"),
+    __param(0, Param("id")),
+    __param(1, Request),
+    __param(2, AuthUser),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String, Object, Object]),
+    __metadata("design:returntype", Promise)
+], BaseMessageRoute.prototype, "send", null);
+__decorate([
+    Summary("Get message content"),
+    Description("Streams the message's sanitized HTML body (post-`ScanPipeline`, safe to render directly) if one " +
+        "exists, otherwise falls back to its plain-text preview. Never serves `bodyBlobKey`'s raw MIME " +
+        "source directly — that content is never sanitized."),
+    Get("/:id/content"),
+    __param(0, Param("id")),
+    __param(1, Response),
+    __param(2, AuthUser),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String, Object, Object]),
+    __metadata("design:returntype", Promise)
+], BaseMessageRoute.prototype, "content", null);
+//# sourceMappingURL=BaseMessageRoute.js.map

package/dist/lib/routes/BaseMessageRoute.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"BaseMessageRoute.js","sourceRoot":"","sources":["../../../src/routes/BaseMessageRoute.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,+EAA+E;AAC/E,mEAAmE;AACnE,mCAAmC;AACnC,+EAA+E;AAC/E,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAgB,MAAM,iBAAiB,CAAC;AAC3E,OAAO,EACH,SAAS,EACT,gBAAgB,EAChB,SAAS,EACT,aAAa,EAGb,eAAe,GAClB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,2BAA2B,EAAE,MAAM,wBAAwB,CAAC;AACrE,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AACvE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,UAAU,EAAyB,MAAM,oBAAoB,CAAC;AACvE,MAAM,EAAE,MAAM,EAAE,GAAG,gBAAgB,CAAC;AACpC,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,aAAa,CAAC;AACxD,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,eAAe,CAAC;AAEhF;;;;;;;;;;;GAWG;AACH,MAAM,OAAgB,gBAAoC,SAAQ,oBAAuB;IAAzF;;QACuB,kBAAa,GAAW,WAAW,CAAC;IAsH3D,CAAC;IAvGW,KAAK,CAAC,aAAa;QACvB,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACnB,IAAI,CAAC,UAAU,GAAG,MAAM,IAAI,CAAC,cAAe,CAAC,WAAW,CAAC,oBAAoB,EAAE;gBAC3E,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI;gBAC3B,IAAI,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC;aAC3B,CAAC,CAAC;QACP,CAAC;QACD,OAAO,IAAI,CAAC,UAAU,CAAC;IAC3B,CAAC;IASY,AAAN,KAAK,CAAC,IAAI,CAAc,EAAU,EAAW,GAAgB,EAAY,IAAc;QAC1F,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YAClF,MAAM,IAAI,QAAQ,CAAC,SAAS,CAAC,cAAc,EAAE,GAAG,EAAE,gBAAgB,CAAC,cAAc,CAAC,CAAC;QACvF,CAAC;QAED,MAAM,OAAO,GAAkB,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACrF,IAAI,CAAC,OAAO,EAAE,CAAC;YACX,MAAM,IAAI,QAAQ,CAAC,SAAS,CAAC,SAAS,EAAE,GAAG,EAAE,gBAAgB,CAAC,SAAS,CAAC,CAAC;QAC7E,CAAC;QACD,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,QAAS,CAAC,aAAa,CAAC,IAAI,EAAE,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;YACnF,MAAM,IAAI,QAAQ,CAAC,SAAS,CAAC,uBAAuB,EAAE,GAAG,EAAE,gBAAgB,CAAC,uBAAuB,CAAC,CAAC;QACzG,CAAC;QAED,iGAAiG;QACjG,oGAAoG;QACpG,mDAAmD;QACnD,MAAM,GAAG,GAAW,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QAClE,MAAM,UAAU,GAAa,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QAEtE,MAAM,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,GAAG,MAAM,YAAY,CACnE,GAAG,EACH,OAAO,CAAC,IAAI,CAAC,OAAO,EACpB,UAAU,EACV,IAAI,CAAC,YAAY,EACjB,IAAI,CAAC,aAAa,EAClB,IAAI,CAAC,SAAS,CACjB,CAAC;QAEF,MAAM,UAAU,GAA8B,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;QACzE,MAAM,UAAU,GAAQ,MAAM,2BAA2B,CACrD,UAAU,EACV,IAAI,CAAC,WAAW,EAChB,OAAO,CAAC,UAAU,EAClB,UAAU,CAAC,UAAU,EACrB,IAAI,CACP,CAAC;QACF,MAAM,KAAK,GAAiB,EAAE,GAAG,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QAC7D,mGAAmG;QACnG,uGAAuG;QACvG,2BAA2B;QAC3B,MAAM,oBAAoB,GAAuB,kBAAkB,IAAK,OAAe,CAAC,oBAAoB,CAAC;QAE7G,OAAO,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,CAC9B;YACI,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,OAAO,EAAG,OAAe,CAAC,OAAO;YACjC,SAAS,EAAE,UAAU,CAAC,GAAG;YACzB,KAAK;YACL,oBAAoB;SAChB,EACR,OAAO,EACP,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAC5B,CAAC;IACN,CAAC;IASY,AAAN,KAAK,CAAC,OAAO,CACH,EAAU,EACb,GAAiB,EACjB,IAAc;QAExB,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACrC,MAAM,IAAI,QAAQ,CAAC,SAAS,CAAC,cAAc,EAAE,GAAG,EAAE,gBAAgB,CAAC,cAAc,CAAC,CAAC;QACvF,CAAC;QAED,MAAM,OAAO,GAAkB,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACrF,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,QAAS,CAAC,aAAa,CAAC,IAAI,EAAE,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YAC7F,MAAM,IAAI,QAAQ,CAAC,SAAS,CAAC,SAAS,EAAE,GAAG,EAAE,gBAAgB,CAAC,SAAS,CAAC,CAAC;QAC7E,CAAC;QAED,IAAI,OAAO,CAAC,oBAAoB,EAAE,CAAC;YAC/B,MAAM,IAAI,GAAW,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;YAC5E,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,0BAA0B,CAAC,CAAC;YAC1D,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACf,OAAO;QACX,CAAC;QAED,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,2BAA2B,CAAC,CAAC;QAC3D,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,IAAI,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;IAC9D,CAAC;CACJ;AA/GW;IADP,MAAM,CAAC,WAAW,CAAC;;mDACU;AAGtB;IADP,MAAM,CAAC,eAAe,CAAC;;uDACI;AAGpB;IADP,MAAM,CAAC,YAAY,CAAC;8BACE,YAAY;sDAAC;AAmBvB;IAPZ,OAAO,CAAC,cAAc,CAAC;IACvB,WAAW,CACR,8FAA8F;QAC1F,8BAA8B,CACrC;IACA,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC;IACjB,IAAI,CAAC,WAAW,CAAC;IACC,WAAA,KAAK,CAAC,IAAI,CAAC,CAAA;IAAc,WAAA,OAAO,CAAA;IAAoB,WAAA,QAAQ,CAAA;;;;4CAqD9E;AASY;IAPZ,OAAO,CAAC,qBAAqB,CAAC;IAC9B,WAAW,CACR,kGAAkG;QAC9F,gGAAgG;QAChG,oDAAoD,CAC3D;IACA,GAAG,CAAC,cAAc,CAAC;IAEf,WAAA,KAAK,CAAC,IAAI,CAAC,CAAA;IACX,WAAA,QAAQ,CAAA;IACR,WAAA,QAAQ,CAAA;;;;+CAoBZ"}

package/dist/lib/routes/BaseScopedChildRoute.js

@@ -0,0 +1,348 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+///////////////////////////////////////////////////////////////////////////////
+// Copyright (C) 2026 Jean-Philippe Steinmetz. All rights reserved.
+// SPDX-License-Identifier: MPL-2.0
+///////////////////////////////////////////////////////////////////////////////
+import { ApiError } from "@rapidrest/core";
+import { ACLAction, ApiErrorMessages, ApiErrors, CRUDRoute, RouteDecorators, } from "@rapidrest/service-core";
+const { Delete, Get, Head, Param, Post, Put, Query, Request, Response, User: AuthUser } = RouteDecorators;
+/**
+ * Resolves an unauthenticated caller's `?shareToken=` query parameter into a synthetic, ACL-checkable identity
+ * (`uid` = the token itself) when no real authenticated `user` is present — see `BaseScopedChildRoute`'s own
+ * doc comment for the full explanation of the mechanism this is one half of. Kept as a small private function
+ * duplicated in `BaseScopedChildRoute.ts`/`BaseFolderRoute.ts` (identical in both), rather than a shared
+ * `util/` module, deliberately: `ClassLoader` (see `@rapidrest/core`) scans and dynamically `import()`s an
+ * entire test-fixture directory's files concurrently via `Promise.all`, and a brand-new leaf module reached
+ * for the very first time by *several* of those concurrent imports at once triggered a real, repeatable
+ * `"Class extends value undefined"` failure under Vitest's module transform — the same class of "concurrent
+ * first dynamic import of the same module can resolve inconsistently" issue already documented on
+ * `ConnectionManager.connect()`'s sequential-redis-connection comment. Duplicating these few lines avoids ever
+ * introducing that new shared module into the concurrently-scanned graph.
+ */
+function resolveEffectiveUser(user, query) {
+    if (user) {
+        return user;
+    }
+    const shareToken = query?.shareToken;
+    return typeof shareToken === "string" && shareToken.length > 0
+        ? ({ uid: shareToken, roles: [], scopes: [] })
+        : undefined;
+}
+/**
+ * Base CRUD route for any entity that has no `AccessControlList` of its own and is instead permission-checked
+ * against a named "scope" field it carries — `folderUid` for most entities (`Message`, `CalendarEvent`,
+ * `Task`, `Note`, `Contact`, `Attachment`, `CalendarShareLink`), or `mailboxUid` for the one entity with no
+ * folder to belong to (`ContactList`). See the architecture note on `Message.mailboxUid` in `models/types.ts`
+ * for the full rationale, and `BaseFolderRoute` for `Folder`'s own (different) pattern.
+ *
+ * Concrete subclasses set `scopeProperty` to the field name to scope by; everything else is generic. A
+ * `mailboxUid`-scoped concrete class still works identically here since `ACLUtils.hasPermission` resolves any
+ * uid to its `AccessControlList` regardless of which kind of entity that uid actually names.
+ *
+ * IMPORTANT implementation note: this class deliberately does NOT delegate to `ModelRoute`'s `doFind`/
+ * `doCount`/`doFindById`/`doDelete`/`doTruncate`/`doUpdate` helpers, even though `CRUDRoute` (which this
+ * extends) normally does. Those helpers' own internal `RepoUtils.find`/`findOne`/`count`/`truncate` calls do
+ * NOT forward an `ignoreACL: true` passed into the helper's `options` down to that internal call — verified by
+ * reading their source — so calling them after establishing permission below would still hit this library's
+ * deny-by-default class-level ACL and fail. `doCreateObject`/`doBulkCreate` are the exception (verified safe:
+ * they forward `options`, `ignoreACL` included, straight through to `RepoUtils.create()`), so `create()` still
+ * uses them. Every other operation calls `this.repoUtils` directly instead.
+ *
+ * Read-shaped denials (`find`/`count`/`exists`/`findById`) fail quietly (an empty result / zero count / `404`)
+ * rather than `403`, so a caller with no access can't distinguish "records exist but you can't see them" from
+ * "nothing matches". Write-shaped denials (`create`/`update`/`delete`/`truncate`/`updateProperty`) return
+ * `403`, since the caller already knows the target scope/record they were trying to act on.
+ *
+ * Read-shaped methods also resolve an unauthenticated caller's `?shareToken=` query param via the local
+ * `resolveEffectiveUser()` helper below before checking permission — this, together with
+ * `BaseCalendarShareLinkRoute` keeping a real `ACLRecord` for each link's token in sync on the shared folder's
+ * `AccessControlList`, is the entire mechanism behind anonymous `CalendarShareLink` consumption. There is no
+ * separate route or lookup for it: a share link's token is checked by `ACLUtils.hasPermission()` exactly the
+ * same way any other uid is, through these same `find`/`count`/`exists`/`findById` methods every other caller
+ * already uses.
+ *
+ * @author Jean-Philippe Steinmetz
+ */
+export class BaseScopedChildRoute extends CRUDRoute {
+    scopeUidOf(obj) {
+        return obj?.[this.scopeProperty];
+    }
+    async requirePermission(scopeUid, user, action) {
+        if (!scopeUid || !(await this.aclUtils.hasPermission(user, scopeUid, action))) {
+            throw new ApiError(ApiErrors.AUTH_PERMISSION_FAILURE, 403, ApiErrorMessages.AUTH_PERMISSION_FAILURE);
+        }
+    }
+    /**
+     * Publishes live-update notifications (see `push/MailPushRoute.ts`) for create/update/delete on this entity
+     * type. Channels are bare `folderUid`/`mailboxUid` values, matching every other permission check in this
+     * class — a webmail client subscribed to a folder it can read sees every mutation of a record scoped to it.
+     * `this.notificationUtils` is inherited from `ModelRoute` (`@Inject(NotificationUtils)` there already) —
+     * publishing is fire-and-forget (see `NotificationUtils.sendMessage()`) and never blocks or fails a request.
+     */
+    notify(scopeUid, action, data) {
+        /* v8 ignore else -- unreachable via real usage: every call site derives `scopeUid` from a record that
+           already passed `requirePermission()` (which throws on a falsy scope) earlier in the same method, so
+           it is always truthy by the time `notify()` runs. The `string | undefined` parameter type (matching
+           `scopeUidOf()`'s own return type) is what requires this guard to typecheck, not a real code path. */
+        if (scopeUid) {
+            this.notificationUtils?.sendMessage(scopeUid, this.modelClass.name, action, data);
+        }
+    }
+    async count(params, query, res, user) {
+        if (!this.repoUtils) {
+            throw new ApiError(ApiErrors.INTERNAL_ERROR, 500, ApiErrorMessages.INTERNAL_ERROR);
+        }
+        const scopeUid = this.scopeUidOf(query);
+        if (!scopeUid) {
+            throw new ApiError(ApiErrors.INVALID_REQUEST, 400, ApiErrorMessages.INVALID_REQUEST);
+        }
+        if (!(await this.aclUtils.hasPermission(resolveEffectiveUser(user, query), scopeUid, ACLAction.COUNT))) {
+            return res.status(200).setHeader("content-length", 0);
+        }
+        // `shareToken` is consumed above by `resolveEffectiveUser()` for permission resolution only - it names
+        // no field on `T`, so it must not be forwarded into the data filter below (SQL: an unknown-column
+        // error; Mongo: a `$match` no real document ever satisfies, silently returning zero results either way).
+        const { shareToken: _shareToken, ...filterQuery } = query ?? {};
+        const result = await this.repoUtils.count({ ...filterQuery, ...params }, { limit: query?.limit, page: query?.page, version: query?.version, user, ignoreACL: true });
+        return res.status(200).setHeader("content-length", result);
+    }
+    async create(obj, req, user) {
+        const objs = Array.isArray(obj) ? obj : [obj];
+        for (const single of objs) {
+            await this.requirePermission(this.scopeUidOf(single), user, ACLAction.CREATE);
+        }
+        if (Array.isArray(obj)) {
+            const created = await this.doBulkCreate(obj, { req, user, ignoreACL: true });
+            for (const single of created) {
+                this.notify(this.scopeUidOf(single), "create", single);
+            }
+            return created;
+        }
+        const created = await this.doCreateObject(obj, { req, user, ignoreACL: true });
+        this.notify(this.scopeUidOf(created), "create", created);
+        return created;
+    }
+    async delete(id, version, purge, req, user) {
+        if (!this.repoUtils) {
+            throw new ApiError(ApiErrors.INTERNAL_ERROR, 500, ApiErrorMessages.INTERNAL_ERROR);
+        }
+        const existing = await this.repoUtils.findOne(id, { version, ignoreACL: true });
+        if (!existing) {
+            throw new ApiError(ApiErrors.NOT_FOUND, 404, ApiErrorMessages.NOT_FOUND);
+        }
+        await this.requirePermission(this.scopeUidOf(existing), user, ACLAction.DELETE);
+        await this.repoUtils.delete(existing.uid, { user, version, purge: purge === "true", ignoreACL: true });
+        this.notify(this.scopeUidOf(existing), "delete", { uid: existing.uid });
+    }
+    async exists(id, query, res, user) {
+        if (!this.repoUtils) {
+            throw new ApiError(ApiErrors.INTERNAL_ERROR, 500, ApiErrorMessages.INTERNAL_ERROR);
+        }
+        const existing = await this.repoUtils.findOne(id, {
+            version: query?.version,
+            includeDeleted: query?.deleted === true || query?.deleted === "true",
+            ignoreACL: true,
+        });
+        const scopeUid = existing ? this.scopeUidOf(existing) : undefined;
+        const permitted = scopeUid
+            ? await this.aclUtils.hasPermission(resolveEffectiveUser(user, query), scopeUid, ACLAction.EXISTS)
+            : false;
+        return permitted
+            ? res.status(200).setHeader("content-length", 1)
+            : res.status(404).setHeader("content-length", 0);
+    }
+    async find(params, query, user) {
+        if (!this.repoUtils) {
+            throw new ApiError(ApiErrors.INTERNAL_ERROR, 500, ApiErrorMessages.INTERNAL_ERROR);
+        }
+        const scopeUid = this.scopeUidOf(query);
+        if (!scopeUid) {
+            throw new ApiError(ApiErrors.INVALID_REQUEST, 400, ApiErrorMessages.INVALID_REQUEST);
+        }
+        if (!(await this.aclUtils.hasPermission(resolveEffectiveUser(user, query), scopeUid, ACLAction.LIST))) {
+            return [];
+        }
+        // See the identical `shareToken` exclusion (and its rationale) in `count()` above.
+        const { shareToken: _shareToken, ...filterQuery } = query ?? {};
+        return await this.repoUtils.find({ ...filterQuery, ...params }, { limit: query?.limit, page: query?.page, version: query?.version, user, ignoreACL: true });
+    }
+    async findById(id, query, user) {
+        if (!this.repoUtils) {
+            throw new ApiError(ApiErrors.INTERNAL_ERROR, 500, ApiErrorMessages.INTERNAL_ERROR);
+        }
+        const existing = await this.repoUtils.findOne(id, {
+            version: query?.version,
+            includeDeleted: query?.deleted === true || query?.deleted === "true",
+            ignoreACL: true,
+        });
+        const scopeUid = existing ? this.scopeUidOf(existing) : undefined;
+        if (!scopeUid || !(await this.aclUtils.hasPermission(resolveEffectiveUser(user, query), scopeUid, ACLAction.READ))) {
+            throw new ApiError(ApiErrors.NOT_FOUND, 404, ApiErrorMessages.NOT_FOUND);
+        }
+        return existing;
+    }
+    async truncate(params, query, user) {
+        if (!this.repoUtils) {
+            throw new ApiError(ApiErrors.INTERNAL_ERROR, 500, ApiErrorMessages.INTERNAL_ERROR);
+        }
+        await this.requirePermission(this.scopeUidOf(query), user, ACLAction.TRUNCATE);
+        await this.repoUtils.truncate({ ...query, ...params }, { limit: query?.limit, page: query?.page, version: query?.version, user, ignoreACL: true });
+    }
+    async update(id, obj, req, user) {
+        if (!this.repoUtils) {
+            throw new ApiError(ApiErrors.INTERNAL_ERROR, 500, ApiErrorMessages.INTERNAL_ERROR);
+        }
+        const existing = await this.repoUtils.findOne(id, { skipCache: true, ignoreACL: true });
+        if (!existing) {
+            throw new ApiError(ApiErrors.NOT_FOUND, 404, ApiErrorMessages.NOT_FOUND);
+        }
+        await this.requirePermission(this.scopeUidOf(existing), user, ACLAction.UPDATE);
+        // `obj` is client-supplied and `scopeProperty` (`folderUid`/`mailboxUid`) is an ordinary, writable field
+        // on every entity this class serves - none of them mark it `@ReadOnly`, since a folder/mailbox transfer
+        // (e.g. moving a Message between folders) is legitimate functionality, not something to block outright.
+        // But the check above only establishes permission on the record's CURRENT scope; without also checking
+        // the NEW one, a caller with UPDATE access to their own folder could silently re-parent any record they
+        // can already reach into a folder/mailbox they have no access to at all (or vice versa: pull a record
+        // OUT of a folder they don't own but happen to know the uid of, into their own), completely bypassing
+        // the scope-based permission model this route family exists to enforce - equivalent to planting
+        // attacker-controlled content directly into a victim's mailbox, bypassing ingestion/scanning entirely
+        // for entities like `Message`/`Attachment`.
+        const newScopeUid = this.scopeUidOf(obj);
+        if (newScopeUid !== undefined && newScopeUid !== this.scopeUidOf(existing)) {
+            await this.requirePermission(newScopeUid, user, ACLAction.CREATE);
+        }
+        await this.validate(obj, { user });
+        const updated = await this.repoUtils.update(obj, existing, { user, ignoreACL: true });
+        // Notify the record's new scope always, and its OLD scope too if this update re-parented it - a
+        // client subscribed to the folder the record just left needs to know it's gone from their view, not
+        // just that it appeared somewhere else.
+        const oldScopeUid = this.scopeUidOf(existing);
+        const updatedScopeUid = this.scopeUidOf(updated);
+        this.notify(updatedScopeUid, "update", updated);
+        if (newScopeUid !== undefined && oldScopeUid !== updatedScopeUid) {
+            this.notify(oldScopeUid, "delete", { uid: updated.uid });
+        }
+        return updated;
+    }
+    async updateBulk(obj, req, user) {
+        const results = [];
+        for (const single of obj) {
+            results.push(await this.update(single.uid, single, req, user));
+        }
+        return results;
+    }
+    async updateProperty(id, propertyName, obj, user) {
+        if (!this.repoUtils) {
+            throw new ApiError(ApiErrors.INTERNAL_ERROR, 500, ApiErrorMessages.INTERNAL_ERROR);
+        }
+        const existing = await this.repoUtils.findOne(id, { ignoreACL: true });
+        if (!existing) {
+            throw new ApiError(ApiErrors.NOT_FOUND, 404, ApiErrorMessages.NOT_FOUND);
+        }
+        return await this.update(id, { uid: existing.uid, version: existing.version, [propertyName]: obj }, undefined, user);
+    }
+}
+__decorate([
+    Head(),
+    __param(0, Param()),
+    __param(1, Query()),
+    __param(2, Response),
+    __param(3, AuthUser),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Object, Object, Object]),
+    __metadata("design:returntype", Promise)
+], BaseScopedChildRoute.prototype, "count", null);
+__decorate([
+    Post(),
+    __param(1, Request),
+    __param(2, AuthUser),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Object, Object]),
+    __metadata("design:returntype", Promise)
+], BaseScopedChildRoute.prototype, "create", null);
+__decorate([
+    Delete("/:id"),
+    __param(0, Param("id")),
+    __param(1, Query("version")),
+    __param(2, Query("purge")),
+    __param(3, Request),
+    __param(4, AuthUser),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String, Object, Object, Object, Object]),
+    __metadata("design:returntype", Promise)
+], BaseScopedChildRoute.prototype, "delete", null);
+__decorate([
+    Head("/:id"),
+    __param(0, Param("id")),
+    __param(1, Query()),
+    __param(2, Response),
+    __param(3, AuthUser),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String, Object, Object, Object]),
+    __metadata("design:returntype", Promise)
+], BaseScopedChildRoute.prototype, "exists", null);
+__decorate([
+    Get(),
+    __param(0, Param()),
+    __param(1, Query()),
+    __param(2, AuthUser),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Object, Object]),
+    __metadata("design:returntype", Promise)
+], BaseScopedChildRoute.prototype, "find", null);
+__decorate([
+    Get("/:id"),
+    __param(0, Param("id")),
+    __param(1, Query()),
+    __param(2, AuthUser),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String, Object, Object]),
+    __metadata("design:returntype", Promise)
+], BaseScopedChildRoute.prototype, "findById", null);
+__decorate([
+    Delete(),
+    __param(0, Param()),
+    __param(1, Query()),
+    __param(2, AuthUser),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Object, Object]),
+    __metadata("design:returntype", Promise)
+], BaseScopedChildRoute.prototype, "truncate", null);
+__decorate([
+    Put("/:id"),
+    __param(0, Param("id")),
+    __param(2, Request),
+    __param(3, AuthUser),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String, Object, Object, Object]),
+    __metadata("design:returntype", Promise)
+], BaseScopedChildRoute.prototype, "update", null);
+__decorate([
+    Put(),
+    __param(1, Request),
+    __param(2, AuthUser),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Array, Object, Object]),
+    __metadata("design:returntype", Promise)
+], BaseScopedChildRoute.prototype, "updateBulk", null);
+__decorate([
+    Put("/:id/:property"),
+    __param(0, Param("id")),
+    __param(1, Param("property")),
+    __param(3, AuthUser),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String, String, Object, Object]),
+    __metadata("design:returntype", Promise)
+], BaseScopedChildRoute.prototype, "updateProperty", null);
+//# sourceMappingURL=BaseScopedChildRoute.js.map

package/dist/lib/routes/BaseScopedChildRoute.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"BaseScopedChildRoute.js","sourceRoot":"","sources":["../../../src/routes/BaseScopedChildRoute.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,+EAA+E;AAC/E,mEAAmE;AACnE,mCAAmC;AACnC,+EAA+E;AAC/E,OAAO,EAAE,QAAQ,EAAgB,MAAM,iBAAiB,CAAC;AACzD,OAAO,EACH,SAAS,EACT,gBAAgB,EAChB,SAAS,EAET,SAAS,EAGT,eAAe,GAElB,MAAM,yBAAyB,CAAC;AACjC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,eAAe,CAAC;AAE1G;;;;;;;;;;;;GAYG;AACH,SAAS,oBAAoB,CAAC,IAAyB,EAAE,KAAU;IAC/D,IAAI,IAAI,EAAE,CAAC;QACP,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,MAAM,UAAU,GAAY,KAAK,EAAE,UAAU,CAAC;IAC9C,OAAO,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC;QAC1D,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;QAC9C,CAAC,CAAC,SAAS,CAAC;AACpB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,MAAM,OAAgB,oBAA2C,SAAQ,SAAY;IAIzE,UAAU,CAAC,GAAQ;QACvB,OAAO,GAAG,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IACrC,CAAC;IAEO,KAAK,CAAC,iBAAiB,CAAC,QAA4B,EAAE,IAAyB,EAAE,MAAc;QACnG,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,QAAS,CAAC,aAAa,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;YAC7E,MAAM,IAAI,QAAQ,CAAC,SAAS,CAAC,uBAAuB,EAAE,GAAG,EAAE,gBAAgB,CAAC,uBAAuB,CAAC,CAAC;QACzG,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACK,MAAM,CAAC,QAA4B,EAAE,MAAsC,EAAE,IAAS;QAC1F;;;+GAGuG;QACvG,IAAI,QAAQ,EAAE,CAAC;YACX,IAAI,CAAC,iBAAiB,EAAE,WAAW,CAAC,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;QACtF,CAAC;IACL,CAAC;IAGY,AAAN,KAAK,CAAC,KAAK,CACL,MAAW,EACX,KAAU,EACT,GAAiB,EACjB,IAAc;QAExB,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YAClB,MAAM,IAAI,QAAQ,CAAC,SAAS,CAAC,cAAc,EAAE,GAAG,EAAE,gBAAgB,CAAC,cAAc,CAAC,CAAC;QACvF,CAAC;QACD,MAAM,QAAQ,GAAuB,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAC5D,IAAI,CAAC,QAAQ,EAAE,CAAC;YACZ,MAAM,IAAI,QAAQ,CAAC,SAAS,CAAC,eAAe,EAAE,GAAG,EAAE,gBAAgB,CAAC,eAAe,CAAC,CAAC;QACzF,CAAC;QACD,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,QAAS,CAAC,aAAa,CAAC,oBAAoB,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,QAAQ,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACtG,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC;QAC1D,CAAC;QACD,uGAAuG;QACvG,kGAAkG;QAClG,yGAAyG;QACzG,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,GAAG,WAAW,EAAE,GAAG,KAAK,IAAI,EAAE,CAAC;QAChE,MAAM,MAAM,GAAW,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CAC7C,EAAE,GAAG,WAAW,EAAE,GAAG,MAAM,EAAE,EAC7B,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAC7F,CAAC;QACF,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC;IAC/D,CAAC;IAGY,AAAN,KAAK,CAAC,MAAM,CAAC,GAAY,EAAW,GAAgB,EAAY,IAAc;QACjF,MAAM,IAAI,GAAQ,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACnD,KAAK,MAAM,MAAM,IAAI,IAAI,EAAE,CAAC;YACxB,MAAM,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;QAClF,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACrB,MAAM,OAAO,GAAQ,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAClF,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC3B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;YAC3D,CAAC;YACD,OAAO,OAAO,CAAC;QACnB,CAAC;QACD,MAAM,OAAO,GAAM,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAClF,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;QACzD,OAAO,OAAO,CAAC;IACnB,CAAC;IAGY,AAAN,KAAK,CAAC,MAAM,CACF,EAAU,EACL,OAA2B,EAC7B,KAAyB,EAChC,GAAgB,EACf,IAAc;QAExB,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YAClB,MAAM,IAAI,QAAQ,CAAC,SAAS,CAAC,cAAc,EAAE,GAAG,EAAE,gBAAgB,CAAC,cAAc,CAAC,CAAC;QACvF,CAAC;QACD,MAAM,QAAQ,GAAkB,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/F,IAAI,CAAC,QAAQ,EAAE,CAAC;YACZ,MAAM,IAAI,QAAQ,CAAC,SAAS,CAAC,SAAS,EAAE,GAAG,EAAE,gBAAgB,CAAC,SAAS,CAAC,CAAC;QAC7E,CAAC;QACD,MAAM,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;QAChF,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,KAAK,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACvG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC;IAC5E,CAAC;IAGY,AAAN,KAAK,CAAC,MAAM,CACF,EAAU,EACd,KAAU,EACT,GAAiB,EACjB,IAAc;QAExB,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YAClB,MAAM,IAAI,QAAQ,CAAC,SAAS,CAAC,cAAc,EAAE,GAAG,EAAE,gBAAgB,CAAC,cAAc,CAAC,CAAC;QACvF,CAAC;QACD,MAAM,QAAQ,GAAkB,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,EAAE;YAC7D,OAAO,EAAE,KAAK,EAAE,OAAO;YACvB,cAAc,EAAE,KAAK,EAAE,OAAO,KAAK,IAAI,IAAI,KAAK,EAAE,OAAO,KAAK,MAAM;YACpE,SAAS,EAAE,IAAI;SAClB,CAAC,CAAC;QACH,MAAM,QAAQ,GAAuB,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACtF,MAAM,SAAS,GAAY,QAAQ;YAC/B,CAAC,CAAC,MAAM,IAAI,CAAC,QAAS,CAAC,aAAa,CAAC,oBAAoB,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,QAAQ,EAAE,SAAS,CAAC,MAAM,CAAC;YACnG,CAAC,CAAC,KAAK,CAAC;QACZ,OAAO,SAAS;YACZ,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,gBAAgB,EAAE,CAAC,CAAC;YAChD,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC;IACzD,CAAC;IAGY,AAAN,KAAK,CAAC,IAAI,CAAU,MAAW,EAAW,KAAU,EAAY,IAAc;QACjF,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YAClB,MAAM,IAAI,QAAQ,CAAC,SAAS,CAAC,cAAc,EAAE,GAAG,EAAE,gBAAgB,CAAC,cAAc,CAAC,CAAC;QACvF,CAAC;QACD,MAAM,QAAQ,GAAuB,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAC5D,IAAI,CAAC,QAAQ,EAAE,CAAC;YACZ,MAAM,IAAI,QAAQ,CAAC,SAAS,CAAC,eAAe,EAAE,GAAG,EAAE,gBAAgB,CAAC,eAAe,CAAC,CAAC;QACzF,CAAC;QACD,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,QAAS,CAAC,aAAa,CAAC,oBAAoB,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,QAAQ,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YACrG,OAAO,EAAE,CAAC;QACd,CAAC;QACD,mFAAmF;QACnF,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,GAAG,WAAW,EAAE,GAAG,KAAK,IAAI,EAAE,CAAC;QAChE,OAAO,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAC5B,EAAE,GAAG,WAAW,EAAE,GAAG,MAAM,EAAE,EAC7B,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAC7F,CAAC;IACN,CAAC;IAGY,AAAN,KAAK,CAAC,QAAQ,CAAc,EAAU,EAAW,KAAU,EAAY,IAAc;QACxF,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YAClB,MAAM,IAAI,QAAQ,CAAC,SAAS,CAAC,cAAc,EAAE,GAAG,EAAE,gBAAgB,CAAC,cAAc,CAAC,CAAC;QACvF,CAAC;QACD,MAAM,QAAQ,GAAkB,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,EAAE;YAC7D,OAAO,EAAE,KAAK,EAAE,OAAO;YACvB,cAAc,EAAE,KAAK,EAAE,OAAO,KAAK,IAAI,IAAI,KAAK,EAAE,OAAO,KAAK,MAAM;YACpE,SAAS,EAAE,IAAI;SAClB,CAAC,CAAC;QACH,MAAM,QAAQ,GAAuB,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACtF,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,QAAS,CAAC,aAAa,CAAC,oBAAoB,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,QAAQ,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YAClH,MAAM,IAAI,QAAQ,CAAC,SAAS,CAAC,SAAS,EAAE,GAAG,EAAE,gBAAgB,CAAC,SAAS,CAAC,CAAC;QAC7E,CAAC;QACD,OAAO,QAAS,CAAC;IACrB,CAAC;IAGY,AAAN,KAAK,CAAC,QAAQ,CAAU,MAAW,EAAW,KAAU,EAAY,IAAc;QACrF,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YAClB,MAAM,IAAI,QAAQ,CAAC,SAAS,CAAC,cAAc,EAAE,GAAG,EAAE,gBAAgB,CAAC,cAAc,CAAC,CAAC;QACvF,CAAC;QACD,MAAM,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAC;QAC/E,MAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,CACzB,EAAE,GAAG,KAAK,EAAE,GAAG,MAAM,EAAE,EACvB,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAC7F,CAAC;IACN,CAAC;IAGY,AAAN,KAAK,CAAC,MAAM,CACF,EAAU,EACvB,GAAoB,EACX,GAAiB,EAChB,IAAc;QAExB,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YAClB,MAAM,IAAI,QAAQ,CAAC,SAAS,CAAC,cAAc,EAAE,GAAG,EAAE,gBAAgB,CAAC,cAAc,CAAC,CAAC;QACvF,CAAC;QACD,MAAM,QAAQ,GAAkB,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACvG,IAAI,CAAC,QAAQ,EAAE,CAAC;YACZ,MAAM,IAAI,QAAQ,CAAC,SAAS,CAAC,SAAS,EAAE,GAAG,EAAE,gBAAgB,CAAC,SAAS,CAAC,CAAC;QAC7E,CAAC;QACD,MAAM,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;QAEhF,yGAAyG;QACzG,wGAAwG;QACxG,wGAAwG;QACxG,uGAAuG;QACvG,wGAAwG;QACxG,sGAAsG;QACtG,sGAAsG;QACtG,gGAAgG;QAChG,sGAAsG;QACtG,4CAA4C;QAC5C,MAAM,WAAW,GAAuB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QAC7D,IAAI,WAAW,KAAK,SAAS,IAAI,WAAW,KAAK,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzE,MAAM,IAAI,CAAC,iBAAiB,CAAC,WAAW,EAAE,IAAI,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;QACtE,CAAC;QAED,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACnC,MAAM,OAAO,GAAM,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAEzF,gGAAgG;QAChG,oGAAoG;QACpG,wCAAwC;QACxC,MAAM,WAAW,GAAuB,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAClE,MAAM,eAAe,GAAuB,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QACrE,IAAI,CAAC,MAAM,CAAC,eAAe,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;QAChD,IAAI,WAAW,KAAK,SAAS,IAAI,WAAW,KAAK,eAAe,EAAE,CAAC;YAC/D,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QAC7D,CAAC;QAED,OAAO,OAAO,CAAC;IACnB,CAAC;IAGY,AAAN,KAAK,CAAC,UAAU,CAAC,GAAsB,EAAW,GAAgB,EAAY,IAAc;QAC/F,MAAM,OAAO,GAAQ,EAAE,CAAC;QACxB,KAAK,MAAM,MAAM,IAAI,GAAG,EAAE,CAAC;YACvB,OAAO,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;QACnE,CAAC;QACD,OAAO,OAAO,CAAC;IACnB,CAAC;IAGY,AAAN,KAAK,CAAC,cAAc,CACV,EAAU,EACJ,YAAoB,EACvC,GAAQ,EACE,IAAc;QAExB,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YAClB,MAAM,IAAI,QAAQ,CAAC,SAAS,CAAC,cAAc,EAAE,GAAG,EAAE,gBAAgB,CAAC,cAAc,CAAC,CAAC;QACvF,CAAC;QACD,MAAM,QAAQ,GAAkB,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACtF,IAAI,CAAC,QAAQ,EAAE,CAAC;YACZ,MAAM,IAAI,QAAQ,CAAC,SAAS,CAAC,SAAS,EAAE,GAAG,EAAE,gBAAgB,CAAC,SAAS,CAAC,CAAC;QAC7E,CAAC;QACD,OAAO,MAAM,IAAI,CAAC,MAAM,CACpB,EAAE,EACF,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,OAAO,EAAG,QAAgB,CAAC,OAAO,EAAE,CAAC,YAAY,CAAC,EAAE,GAAG,EAAS,EACrF,SAAS,EACT,IAAI,CACP,CAAC;IACN,CAAC;CACJ;AAvNgB;IADZ,IAAI,EAAE;IAEF,WAAA,KAAK,EAAE,CAAA;IACP,WAAA,KAAK,EAAE,CAAA;IACP,WAAA,QAAQ,CAAA;IACR,WAAA,QAAQ,CAAA;;;;iDAqBZ;AAGY;IADZ,IAAI,EAAE;IAC4B,WAAA,OAAO,CAAA;IAAoB,WAAA,QAAQ,CAAA;;;;kDAerE;AAGY;IADZ,MAAM,CAAC,MAAM,CAAC;IAEV,WAAA,KAAK,CAAC,IAAI,CAAC,CAAA;IACX,WAAA,KAAK,CAAC,SAAS,CAAC,CAAA;IAChB,WAAA,KAAK,CAAC,OAAO,CAAC,CAAA;IACd,WAAA,OAAO,CAAA;IACP,WAAA,QAAQ,CAAA;;;;kDAYZ;AAGY;IADZ,IAAI,CAAC,MAAM,CAAC;IAER,WAAA,KAAK,CAAC,IAAI,CAAC,CAAA;IACX,WAAA,KAAK,EAAE,CAAA;IACP,WAAA,QAAQ,CAAA;IACR,WAAA,QAAQ,CAAA;;;;kDAiBZ;AAGY;IADZ,GAAG,EAAE;IACa,WAAA,KAAK,EAAE,CAAA;IAAe,WAAA,KAAK,EAAE,CAAA;IAAc,WAAA,QAAQ,CAAA;;;;gDAiBrE;AAGY;IADZ,GAAG,CAAC,MAAM,CAAC;IACW,WAAA,KAAK,CAAC,IAAI,CAAC,CAAA;IAAc,WAAA,KAAK,EAAE,CAAA;IAAc,WAAA,QAAQ,CAAA;;;;oDAc5E;AAGY;IADZ,MAAM,EAAE;IACc,WAAA,KAAK,EAAE,CAAA;IAAe,WAAA,KAAK,EAAE,CAAA;IAAc,WAAA,QAAQ,CAAA;;;;oDASzE;AAGY;IADZ,GAAG,CAAC,MAAM,CAAC;IAEP,WAAA,KAAK,CAAC,IAAI,CAAC,CAAA;IAEX,WAAA,OAAO,CAAA;IACP,WAAA,QAAQ,CAAA;;;;kDAwCZ;AAGY;IADZ,GAAG,EAAE;IAC2C,WAAA,OAAO,CAAA;IAAoB,WAAA,QAAQ,CAAA;;;;sDAMnF;AAGY;IADZ,GAAG,CAAC,gBAAgB,CAAC;IAEjB,WAAA,KAAK,CAAC,IAAI,CAAC,CAAA;IACX,WAAA,KAAK,CAAC,UAAU,CAAC,CAAA;IAEjB,WAAA,QAAQ,CAAA;;;;0DAeZ"}

package/dist/lib/routes/BaseSearchRoute.js

@@ -0,0 +1,91 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+///////////////////////////////////////////////////////////////////////////////
+// Copyright (C) 2026 Jean-Philippe Steinmetz. All rights reserved.
+// SPDX-License-Identifier: MPL-2.0
+///////////////////////////////////////////////////////////////////////////////
+import { ApiError, ObjectDecorators } from "@rapidrest/core";
+import { ApiErrorMessages, ApiErrors, DocDecorators, RepoUtils, RouteDecorators } from "@rapidrest/service-core";
+import { resolveCallerMailboxUid } from "../util/MailboxScopeUtils.js";
+const { Inject, Logger } = ObjectDecorators;
+const { Description, Returns, Summary } = DocDecorators;
+const { Auth, Get, Query, User: AuthUser } = RouteDecorators;
+/**
+ * Exposes full-text search across a mailbox's messages/contacts/calendar events/notes/tasks. Unlike every
+ * other route in this library, this is NOT a `ModelRoute`/`CRUDRoute` subclass — `RepoUtils.find()` has no
+ * full-text query capability, so this route calls the injected `SearchProvider` directly instead.
+ *
+ * `mailboxClass` is supplied by the Mongo/SQL concrete subclasses. Search is always scoped to a mailbox the
+ * requesting user owns (`ownerUserUid === user.uid`) — a client-supplied `mailboxUid` is deliberately not
+ * accepted, so this endpoint can never be used to search another user's mailbox.
+ *
+ * @author Jean-Philippe Steinmetz
+ */
+export class BaseSearchRoute {
+    async getMailboxRepo() {
+        if (!this.mailboxRepo) {
+            this.mailboxRepo = await this._objectFactory.newInstance(RepoUtils, {
+                name: this.mailboxClass.name,
+                args: [this.mailboxClass],
+            });
+        }
+        return this.mailboxRepo;
+    }
+    async search(text, typesParam, cursor, limitParam, user) {
+        if (!this.searchProvider) {
+            throw new ApiError(ApiErrors.INTERNAL_ERROR, 500, ApiErrorMessages.INTERNAL_ERROR);
+        }
+        if (!text || !user) {
+            throw new ApiError(ApiErrors.INVALID_REQUEST, 400, ApiErrorMessages.INVALID_REQUEST);
+        }
+        const mailboxRepo = await this.getMailboxRepo();
+        const mailboxUid = await resolveCallerMailboxUid(mailboxRepo, user);
+        if (!mailboxUid) {
+            throw new ApiError(ApiErrors.NOT_FOUND, 404, ApiErrorMessages.NOT_FOUND);
+        }
+        const entityTypes = typesParam
+            ? typesParam.split(",")
+            : undefined;
+        return await this.searchProvider.search({
+            mailboxUid,
+            text,
+            entityTypes,
+            cursor,
+            limit: limitParam ? parseInt(limitParam, 10) : undefined,
+        });
+    }
+}
+__decorate([
+    Inject("SearchProvider"),
+    __metadata("design:type", Object)
+], BaseSearchRoute.prototype, "searchProvider", void 0);
+__decorate([
+    Logger,
+    __metadata("design:type", Object)
+], BaseSearchRoute.prototype, "logger", void 0);
+__decorate([
+    Summary("Search mailbox"),
+    Description("Performs a full-text search across the requesting user's mail, contacts, calendar, notes, and tasks."),
+    Returns([Object]),
+    Auth(["jwt"]),
+    Get(),
+    __param(0, Query("q")),
+    __param(1, Query("types")),
+    __param(2, Query("cursor")),
+    __param(3, Query("limit")),
+    __param(4, AuthUser),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String, Object, Object, Object, Object]),
+    __metadata("design:returntype", Promise)
+], BaseSearchRoute.prototype, "search", null);
+//# sourceMappingURL=BaseSearchRoute.js.map

package/dist/lib/routes/BaseSearchRoute.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"BaseSearchRoute.js","sourceRoot":"","sources":["../../../src/routes/BaseSearchRoute.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,+EAA+E;AAC/E,mEAAmE;AACnE,mCAAmC;AACnC,+EAA+E;AAC/E,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAgB,MAAM,iBAAiB,CAAC;AAC3E,OAAO,EAAE,gBAAgB,EAAE,SAAS,EAAE,aAAa,EAAiB,SAAS,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAEhI,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAEvE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,gBAAgB,CAAC;AAC5C,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,aAAa,CAAC;AACxD,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,eAAe,CAAC;AAE7D;;;;;;;;;;GAUG;AACH,MAAM,OAAgB,eAAe;IAczB,KAAK,CAAC,cAAc;QACxB,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACpB,IAAI,CAAC,WAAW,GAAG,MAAM,IAAI,CAAC,cAAe,CAAC,WAAW,CAAC,SAAS,EAAE;gBACjE,IAAI,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI;gBAC5B,IAAI,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC;aAC5B,CAAC,CAAC;QACP,CAAC;QACD,OAAO,IAAI,CAAC,WAAW,CAAC;IAC5B,CAAC;IAOY,AAAN,KAAK,CAAC,MAAM,CACH,IAAY,EACR,UAA8B,EAC7B,MAA0B,EAC3B,UAA8B,EACpC,IAAc;QAExB,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YACvB,MAAM,IAAI,QAAQ,CAAC,SAAS,CAAC,cAAc,EAAE,GAAG,EAAE,gBAAgB,CAAC,cAAc,CAAC,CAAC;QACvF,CAAC;QACD,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACjB,MAAM,IAAI,QAAQ,CAAC,SAAS,CAAC,eAAe,EAAE,GAAG,EAAE,gBAAgB,CAAC,eAAe,CAAC,CAAC;QACzF,CAAC;QAED,MAAM,WAAW,GAAiB,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAC9D,MAAM,UAAU,GAAuB,MAAM,uBAAuB,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;QACxF,IAAI,CAAC,UAAU,EAAE,CAAC;YACd,MAAM,IAAI,QAAQ,CAAC,SAAS,CAAC,SAAS,EAAE,GAAG,EAAE,gBAAgB,CAAC,SAAS,CAAC,CAAC;QAC7E,CAAC;QAED,MAAM,WAAW,GAAmC,UAAU;YAC1D,CAAC,CAAE,UAAU,CAAC,KAAK,CAAC,GAAG,CAAwB;YAC/C,CAAC,CAAC,SAAS,CAAC;QAEhB,OAAO,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC;YACpC,UAAU;YACV,IAAI;YACJ,WAAW;YACX,MAAM;YACN,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS;SAC3D,CAAC,CAAC;IACP,CAAC;CACJ;AApDW;IADP,MAAM,CAAC,gBAAgB,CAAC;;uDACe;AAGhC;IADP,MAAM;;+CACa;AAiBP;IALZ,OAAO,CAAC,gBAAgB,CAAC;IACzB,WAAW,CAAC,sGAAsG,CAAC;IACnH,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC;IACjB,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC;IACb,GAAG,EAAE;IAED,WAAA,KAAK,CAAC,GAAG,CAAC,CAAA;IACV,WAAA,KAAK,CAAC,OAAO,CAAC,CAAA;IACd,WAAA,KAAK,CAAC,QAAQ,CAAC,CAAA;IACf,WAAA,KAAK,CAAC,OAAO,CAAC,CAAA;IACd,WAAA,QAAQ,CAAA;;;;6CA0BZ"}

package/dist/lib/routes/index.js

@@ -0,0 +1,13 @@
+///////////////////////////////////////////////////////////////////////////////
+// Copyright (C) 2026 Jean-Philippe Steinmetz. All rights reserved.
+// SPDX-License-Identifier: MPL-2.0
+///////////////////////////////////////////////////////////////////////////////
+export * from "./BaseAttachmentRoute.js";
+export * from "./BaseCalendarShareLinkRoute.js";
+export * from "./BaseFolderRoute.js";
+export * from "./BaseMailboxRoute.js";
+export * from "./BaseMailIngestRoute.js";
+export * from "./BaseMessageRoute.js";
+export * from "./BaseScopedChildRoute.js";
+export * from "./BaseSearchRoute.js";
+//# sourceMappingURL=index.js.map

package/dist/lib/routes/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/routes/index.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,mEAAmE;AACnE,mCAAmC;AACnC,+EAA+E;AAC/E,cAAc,0BAA0B,CAAC;AACzC,cAAc,iCAAiC,CAAC;AAChD,cAAc,sBAAsB,CAAC;AACrC,cAAc,uBAAuB,CAAC;AACtC,cAAc,0BAA0B,CAAC;AACzC,cAAc,uBAAuB,CAAC;AACtC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,sBAAsB,CAAC"}