@rapidmx/restapi 0.1.0

package/dist/types/routes/BaseFolderRoute.d.ts

@@ -0,0 +1,58 @@
+import { type JWTUser } from "@rapidrest/core";
+import { CRUDRoute, HttpRequest, HttpResponse } from "@rapidrest/service-core";
+import { Folder } from "../models/types.js";
+/**
+ * Extends the standard `CRUDRoute` CRUD scaffolding for `Folder` with a hybrid permission model — `Folder` is
+ * one of the two entities in this library with a real per-record `AccessControlList` (the other is `Mailbox`;
+ * see the architecture note on `Message.mailboxUid` in `models/types.ts`), so most of `CRUDRoute`'s default
+ * behavior already works correctly and is left untouched here:
+ *
+ * - `findById`/`update`/`delete`/`truncate` rely on `Folder`'s own record-level ACL, which by default inherits
+ * (via `AccessControlList.parentUid`) from its owning `Mailbox`'s ACL — so anyone the mailbox is shared with
+ * automatically gets the same access to its folders, while a single folder (e.g. one Calendar) can still be
+ * shared more narrowly by adding records directly to *that folder's own* ACL instead. `RepoUtils.findOne()`/
+ * `update()`/`delete()` check the record's own resolved ACL chain directly (no class-level fast-fail), so
+ * this works correctly once the class-level grant is denied; `truncate()` skips its class-level check
+ * entirely whenever `recordACL` is `true` (verified by reading its source) and relies on per-record
+ * filtering instead, which is equally safe here for the same reason.
+ * - `find`/`count`/`exists` are overridden here, for the same reason every other collection-or-fast-fail-gated
+ * operation in this library is: `RepoUtils.find()`/`count()`/`exists()` all check the class-level ACL as an
+ * unconditional first gate — before any per-record narrowing, and even that later narrowing falls back to
+ * the class grant for a record with no caller-specific entry — so a per-record ACL alone can't safely narrow
+ * them once class-level access is granted to anyone. `find`/`count` take an explicit `mailboxUid` query
+ * parameter and check permission against it directly; `exists` fetches the specific folder first (bypassing
+ * ACL) and then checks permission against *that folder's own* uid (i.e. its real resolved ACL chain), same
+ * as `findById` does implicitly.
+ * - `create` is also overridden, for a different reason: it seeds the new folder's ACL with `parentUid` set to
+ * the owning mailbox's ACL uid, which is what wires up the inheritance described above — this can't be done
+ * generically by `RepoUtils.create()`'s own default (it would parent to the `Folder` class ACL instead, which
+ * is deny-all and grants nothing) — and, since a folder doesn't exist yet at create time, permission is
+ * checked against the target `mailboxUid` from the request body instead. It also publishes a live-update
+ * notification (see `push/MailPushRoute.ts`) to the owning mailbox's channel, so a webmail client subscribed
+ * to a mailbox sees new folders appear without polling.
+ *
+ * `find`/`count`/`exists` also resolve an unauthenticated caller's `?shareToken=` query param via the local
+ * `resolveEffectiveUser()` helper below (see `BaseScopedChildRoute`'s doc comment for the full explanation of
+ * the mechanism this is one half of).
+ *
+ * KNOWN LIMITATIONS:
+ * - `update`/`delete` (folder rename/move/removal) do NOT publish a live-update notification, unlike every
+ * mutation on the folder-scoped entities in `BaseScopedChildRoute`. Overriding them here purely to add a
+ * notify call would mean re-implementing (and re-testing) the exact ACL-delegation behavior this class's own
+ * doc comment above is careful to leave untouched by relying on `CRUDRoute`'s defaults — a real gap, but a
+ * deliberate one given how comparatively rare and low-urgency folder structural changes are next to new-mail
+ * delivery, matching this library's existing "pragmatic subset, not full fidelity" scope elsewhere.
+ * - `findById` (also left on `CRUDRoute`'s default) does NOT resolve `?shareToken=` — a share link's token
+ * grants read access to the folder's *children* (e.g. its `CalendarEvent`s, via `BaseScopedChildRoute`), not
+ * to fetching the `Folder` record itself by id. A client wanting the calendar's display name alongside its
+ * events would need that carried elsewhere (e.g. denormalized onto `CalendarShareLink`), not fetched via this
+ * route with a token.
+ *
+ * @author Jean-Philippe Steinmetz
+ */
+export declare abstract class BaseFolderRoute<T extends Folder> extends CRUDRoute<T> {
+    count(params: any, query: any, res: HttpResponse, user?: JWTUser): Promise<any>;
+    create(obj: Partial<T> | Partial<T>[], req: HttpRequest, user?: JWTUser): Promise<T | T[]>;
+    find(params: any, query: any, user?: JWTUser): Promise<T[]>;
+    exists(id: string, query: any, res: HttpResponse, user?: JWTUser): Promise<any>;
+}

package/dist/types/routes/BaseMailIngestRoute.d.ts

@@ -0,0 +1,47 @@
+import { HttpRequest, HttpResponse } from "@rapidrest/service-core";
+import { IngestQueueEntry, Mailbox } from "../models/types.js";
+/**
+ * Implements the `MTAIngestAdapter` HTTP contract (see `transport/MTAIngestAdapter.ts`) that the deployment's
+ * MTA (Postfix, Haraka, ...) integrates against to hand accepted internet mail to this library. Both endpoints
+ * are internal-only — never exposed to the public internet — and gated by a shared bearer secret rather than
+ * ordinary user JWT auth, since the caller is the MTA process, not an end user.
+ *
+ * This class is DB-agnostic; `mailboxClass`/`ingestQueueClass` are supplied by the Mongo/SQL concrete
+ * subclasses (`MailIngestRouteMongo`/`MailIngestRouteSQL`), following the same pattern
+ * `DefaultAccounts`/`DefaultAccountsMongo` use for a background service spanning multiple entity types.
+ *
+ * !!Note!! that, like `BasePushRoute`/`BaseStatusRoute`, this class is not automatically registered with a
+ * server — the consuming application must apply `@Route("/internal/mta")` to its own subclass. The
+ * `MTAIngestAdapter` doc comment's `GET /internal/mta/resolve`/`POST /internal/mta/deliver` paths assume that
+ * exact base path is used; if a deployment mounts it elsewhere, its MTA content-filter/lookup configuration
+ * must be updated to match.
+ *
+ * @author Jean-Philippe Steinmetz
+ */
+export declare abstract class BaseMailIngestRoute<M extends Mailbox, Q extends IngestQueueEntry> {
+    protected abstract mailboxClass: any;
+    protected abstract ingestQueueClass: any;
+    private _objectFactory?;
+    private mailboxRepo?;
+    private ingestQueueRepo?;
+    private blobStore?;
+    private ingestSecret?;
+    private logger;
+    /**
+     * Builds the query value used to match `Mailbox.aliasAddresses` against the given address. MongoDB's
+     * implicit array-element equality lets a plain value match "array contains" directly, so the default here
+     * is a no-op passthrough. `MailIngestRouteSQL` overrides this: the SQL backend stores `aliasAddresses` as a
+     * serialized `simple-json` column, where a plain equality filter compares against the whole serialized
+     * string and never matches a single element.
+     */
+    protected aliasQueryValue(address: string): any;
+    private init;
+    /**
+     * Verifies the caller presented the configured internal bearer secret. Deliberately not `@Auth(["jwt"])` —
+     * the caller is the local MTA process, not an end user with a JWT. Throws `403` if no secret is configured
+     * at all (fail closed, never fail open into an unauthenticated internal endpoint).
+     */
+    private authorizeInternalCaller;
+    resolve(rcpt: string, req: HttpRequest, res: HttpResponse): Promise<HttpResponse>;
+    deliver(req: HttpRequest, res: HttpResponse): Promise<HttpResponse>;
+}

package/dist/types/routes/BaseMailboxRoute.d.ts

@@ -0,0 +1,60 @@
+import { type JWTUser } from "@rapidrest/core";
+import { CRUDRoute, HttpRequest, HttpResponse } from "@rapidrest/service-core";
+import { Mailbox } from "../models/types.js";
+/**
+ * Extends the standard `CRUDRoute` CRUD scaffolding for `Mailbox` with ACL-driven `find`/`count` overrides,
+ * plus a `create` override that bypasses the ACL system entirely. `Mailbox` has a real per-record
+ * `AccessControlList` (`@Protect(..., true)`; see the architecture note on `Message.mailboxUid`), whose
+ * class-level ACL denies EVERY action to non-trusted callers, including `CREATE`.
+ *
+ * `create` is deliberately NOT gated by the class-level ACL at all (unlike every other action): provisioning a
+ * brand-new mailbox is a pure self-service action (any authenticated user may create their own) with no parent
+ * resource to check permission against — `RepoUtils.create()`'s own automatic owner-grant logic is what
+ * actually scopes the new mailbox to its creator, not a class-level check. A class-level `CREATE` grant to
+ * `.*` was tried first and found to leak: every mailbox's own ACL falls back to that SAME class ACL as its
+ * parent whenever a caller has no mailbox-specific record, so *any* authenticated user calling
+ * `ACLUtils.hasPermission(user, someOtherMailboxUid, CREATE)` (e.g. `BaseFolderRoute.create()` checking
+ * permission to create a folder *in* that mailbox) would incorrectly pass too. Denying `CREATE` at the class
+ * level entirely, and having this route check only `user` truthiness before bypassing ACL, closes that leak.
+ *
+ * A non-trusted caller's `ownerUserUid` is always forced to their own uid, discarding whatever the client
+ * sent — self-service creation can only ever create a mailbox *for yourself*. Only a trusted caller may create
+ * a mailbox with a different (or no) `ownerUserUid` — the latter is a true ownerless "shared mailbox" (the
+ * Exchange concept, e.g. `support@example.com`) with no single owner, only delegates added afterward via
+ * `BaseACLRoute` (`@rapidrest/service-core`). `RepoUtils.create()`'s automatic owner-grant is already
+ * conditioned on the creator lacking a trusted role, so a trusted caller creating an ownerless mailbox does
+ * not, on its own, leave behind a stray self-grant for the admin who happened to create it.
+ *
+ * `find`/`count` still need overriding despite the real per-record ACL: `RepoUtils.find()`/`count()` both
+ * check the class-level ACL as an unconditional first gate *before* any per-record narrowing, and even that
+ * later per-record narrowing falls back to the class grant for a record with no caller-specific entry —
+ * verified by reading their source. Rather than the old ownership-only (`ownerUserUid: user.uid`) scoping,
+ * these now query for every mailbox uid the caller has *any* ACL grant on — owned, shared-with-them as a
+ * delegate, or (for a trusted caller) every mailbox unfiltered — via `findAccessibleMailboxUids()`, backed by
+ * the exact same `AccessControlList` model `BaseACLRoute` exposes as CRUD (no new API surface). `exists`
+ * doesn't need this treatment: it fetches the specific record first (bypassing ACL) and then checks
+ * permission against *that record's own* uid via `ACLUtils.hasPermission`, which already resolves ownership,
+ * delegate shares, and trusted-role access correctly on its own — see `exists()` below, unchanged.
+ * `findById`/`update`/`delete` are unaffected for the same reason: `RepoUtils.findOne()`/`update()`/
+ * `delete()` check the *record's own* resolved ACL chain directly (no class-level fast-fail), so once the
+ * class-level grant is denied, that chain correctly resolves to "deny" for a caller with no grant and "allow"
+ * for the owner or any delegate — `CRUDRoute`'s default behavior for those already works correctly and is
+ * left untouched.
+ *
+ * @author Jean-Philippe Steinmetz
+ */
+export declare abstract class BaseMailboxRoute<T extends Mailbox> extends CRUDRoute<T> {
+    protected trustedRoles: string[];
+    /**
+     * Returns the uids of every mailbox this user has any ACL grant on — as owner, as a shared delegate, or
+     * (implicitly, via a wildcard/role record) as a trusted caller. Backend-specific because
+     * `AccessControlList`'s storage shape differs (a natively queryable embedded array in Mongo vs. a
+     * `simple-json` column in SQL) — implemented by the concrete `MailboxRouteMongo`/`MailboxRouteSQL`
+     * subclass, each against the exact same `AccessControlList` collection/table `BaseACLRoute` exposes.
+     */
+    protected abstract findAccessibleMailboxUids(user: JWTUser): Promise<string[]>;
+    create(obj: T | T[], req: HttpRequest, user?: JWTUser): Promise<T | T[]>;
+    find(params: any, query: any, user?: JWTUser): Promise<T[]>;
+    count(params: any, query: any, res: HttpResponse, user?: JWTUser): Promise<any>;
+    exists(id: string, query: any, res: HttpResponse, user?: JWTUser): Promise<any>;
+}

package/dist/types/routes/BaseMessageRoute.d.ts

@@ -0,0 +1,27 @@
+import { type JWTUser } from "@rapidrest/core";
+import { HttpRequest, HttpResponse } from "@rapidrest/service-core";
+import { BaseScopedChildRoute } from "./BaseScopedChildRoute.js";
+import { Message } from "../models/types.js";
+/**
+ * Extends `BaseScopedChildRoute` (scoped by `folderUid` — see the architecture note on `Message.mailboxUid`)
+ * with a `send` endpoint that composes, (re-)scans, and relays a drafted message via `MailTransport`, then
+ * moves it into the mailbox's Sent Items folder. Ordinary `create`/`update`/`delete`/`find`/`findById`
+ * (save-draft, edit-draft, discard-draft, list, fetch) are handled entirely by the base class — this is the
+ * only mail-specific behavior a `Message` needs beyond scoped CRUD.
+ *
+ * `folderClass` is supplied by the Mongo/SQL concrete subclasses so this class can look up (and, if needed,
+ * create) the mailbox's Sent Items folder without depending on either backend directly.
+ *
+ * @author Jean-Philippe Steinmetz
+ */
+export declare abstract class BaseMessageRoute<T extends Message> extends BaseScopedChildRoute<T> {
+    protected readonly scopeProperty: string;
+    protected abstract folderClass: any;
+    private folderRepo?;
+    private blobStore?;
+    private mailTransport?;
+    private scanPipeline?;
+    private getFolderRepo;
+    send(id: string, req: HttpRequest, user?: JWTUser): Promise<T>;
+    content(id: string, res: HttpResponse, user?: JWTUser): Promise<void>;
+}

package/dist/types/routes/BaseScopedChildRoute.d.ts

@@ -0,0 +1,61 @@
+import { type JWTUser } from "@rapidrest/core";
+import { BaseEntity, CRUDRoute, HttpRequest, HttpResponse, type UpdateObject } from "@rapidrest/service-core";
+/**
+ * Base CRUD route for any entity that has no `AccessControlList` of its own and is instead permission-checked
+ * against a named "scope" field it carries — `folderUid` for most entities (`Message`, `CalendarEvent`,
+ * `Task`, `Note`, `Contact`, `Attachment`, `CalendarShareLink`), or `mailboxUid` for the one entity with no
+ * folder to belong to (`ContactList`). See the architecture note on `Message.mailboxUid` in `models/types.ts`
+ * for the full rationale, and `BaseFolderRoute` for `Folder`'s own (different) pattern.
+ *
+ * Concrete subclasses set `scopeProperty` to the field name to scope by; everything else is generic. A
+ * `mailboxUid`-scoped concrete class still works identically here since `ACLUtils.hasPermission` resolves any
+ * uid to its `AccessControlList` regardless of which kind of entity that uid actually names.
+ *
+ * IMPORTANT implementation note: this class deliberately does NOT delegate to `ModelRoute`'s `doFind`/
+ * `doCount`/`doFindById`/`doDelete`/`doTruncate`/`doUpdate` helpers, even though `CRUDRoute` (which this
+ * extends) normally does. Those helpers' own internal `RepoUtils.find`/`findOne`/`count`/`truncate` calls do
+ * NOT forward an `ignoreACL: true` passed into the helper's `options` down to that internal call — verified by
+ * reading their source — so calling them after establishing permission below would still hit this library's
+ * deny-by-default class-level ACL and fail. `doCreateObject`/`doBulkCreate` are the exception (verified safe:
+ * they forward `options`, `ignoreACL` included, straight through to `RepoUtils.create()`), so `create()` still
+ * uses them. Every other operation calls `this.repoUtils` directly instead.
+ *
+ * Read-shaped denials (`find`/`count`/`exists`/`findById`) fail quietly (an empty result / zero count / `404`)
+ * rather than `403`, so a caller with no access can't distinguish "records exist but you can't see them" from
+ * "nothing matches". Write-shaped denials (`create`/`update`/`delete`/`truncate`/`updateProperty`) return
+ * `403`, since the caller already knows the target scope/record they were trying to act on.
+ *
+ * Read-shaped methods also resolve an unauthenticated caller's `?shareToken=` query param via the local
+ * `resolveEffectiveUser()` helper below before checking permission — this, together with
+ * `BaseCalendarShareLinkRoute` keeping a real `ACLRecord` for each link's token in sync on the shared folder's
+ * `AccessControlList`, is the entire mechanism behind anonymous `CalendarShareLink` consumption. There is no
+ * separate route or lookup for it: a share link's token is checked by `ACLUtils.hasPermission()` exactly the
+ * same way any other uid is, through these same `find`/`count`/`exists`/`findById` methods every other caller
+ * already uses.
+ *
+ * @author Jean-Philippe Steinmetz
+ */
+export declare abstract class BaseScopedChildRoute<T extends BaseEntity> extends CRUDRoute<T> {
+    /** The property name on `T` (and on incoming create bodies / list query params) to check permission by. */
+    protected abstract readonly scopeProperty: string;
+    private scopeUidOf;
+    private requirePermission;
+    /**
+     * Publishes live-update notifications (see `push/MailPushRoute.ts`) for create/update/delete on this entity
+     * type. Channels are bare `folderUid`/`mailboxUid` values, matching every other permission check in this
+     * class — a webmail client subscribed to a folder it can read sees every mutation of a record scoped to it.
+     * `this.notificationUtils` is inherited from `ModelRoute` (`@Inject(NotificationUtils)` there already) —
+     * publishing is fire-and-forget (see `NotificationUtils.sendMessage()`) and never blocks or fails a request.
+     */
+    private notify;
+    count(params: any, query: any, res: HttpResponse, user?: JWTUser): Promise<any>;
+    create(obj: T | T[], req: HttpRequest, user?: JWTUser): Promise<T | T[]>;
+    delete(id: string, version: string | undefined, purge: string | undefined, req: HttpRequest, user?: JWTUser): Promise<void>;
+    exists(id: string, query: any, res: HttpResponse, user?: JWTUser): Promise<any>;
+    find(params: any, query: any, user?: JWTUser): Promise<T[]>;
+    findById(id: string, query: any, user?: JWTUser): Promise<T | null>;
+    truncate(params: any, query: any, user?: JWTUser): Promise<void>;
+    update(id: string, obj: UpdateObject<T>, req?: HttpRequest, user?: JWTUser): Promise<T>;
+    updateBulk(obj: UpdateObject<T>[], req: HttpRequest, user?: JWTUser): Promise<T[]>;
+    updateProperty(id: string, propertyName: string, obj: any, user?: JWTUser): Promise<T>;
+}

package/dist/types/routes/BaseSearchRoute.d.ts

@@ -0,0 +1,23 @@
+import { type JWTUser } from "@rapidrest/core";
+import { SearchResultPage } from "../search/SearchProvider.js";
+import { Mailbox } from "../models/types.js";
+/**
+ * Exposes full-text search across a mailbox's messages/contacts/calendar events/notes/tasks. Unlike every
+ * other route in this library, this is NOT a `ModelRoute`/`CRUDRoute` subclass — `RepoUtils.find()` has no
+ * full-text query capability, so this route calls the injected `SearchProvider` directly instead.
+ *
+ * `mailboxClass` is supplied by the Mongo/SQL concrete subclasses. Search is always scoped to a mailbox the
+ * requesting user owns (`ownerUserUid === user.uid`) — a client-supplied `mailboxUid` is deliberately not
+ * accepted, so this endpoint can never be used to search another user's mailbox.
+ *
+ * @author Jean-Philippe Steinmetz
+ */
+export declare abstract class BaseSearchRoute<M extends Mailbox> {
+    protected abstract mailboxClass: any;
+    private _objectFactory?;
+    private mailboxRepo?;
+    private searchProvider?;
+    private logger;
+    private getMailboxRepo;
+    search(text: string, typesParam: string | undefined, cursor: string | undefined, limitParam: string | undefined, user?: JWTUser): Promise<SearchResultPage>;
+}

package/dist/types/routes/index.d.ts

@@ -0,0 +1,8 @@
+export * from "./BaseAttachmentRoute.js";
+export * from "./BaseCalendarShareLinkRoute.js";
+export * from "./BaseFolderRoute.js";
+export * from "./BaseMailboxRoute.js";
+export * from "./BaseMailIngestRoute.js";
+export * from "./BaseMessageRoute.js";
+export * from "./BaseScopedChildRoute.js";
+export * from "./BaseSearchRoute.js";

package/dist/types/routes/mongo/AttachmentRouteMongo.d.ts

@@ -0,0 +1,6 @@
+import { AttachmentMongo, MessageMongo } from "../../mongo.js";
+import { BaseAttachmentRoute } from "../BaseAttachmentRoute.js";
+export declare class AttachmentRouteMongo extends BaseAttachmentRoute<AttachmentMongo, MessageMongo> {
+    protected readonly repoUtilsClass: any;
+    protected messageClass: any;
+}

package/dist/types/routes/mongo/CalendarEventRouteMongo.d.ts

@@ -0,0 +1,6 @@
+import { CalendarEventMongo } from "../../mongo.js";
+import { BaseScopedChildRoute } from "../BaseScopedChildRoute.js";
+export declare class CalendarEventRouteMongo extends BaseScopedChildRoute<CalendarEventMongo> {
+    protected readonly repoUtilsClass: any;
+    protected readonly scopeProperty: string;
+}

package/dist/types/routes/mongo/CalendarShareLinkRouteMongo.d.ts

@@ -0,0 +1,6 @@
+import { CalendarShareLinkMongo } from "../../mongo.js";
+import { BaseCalendarShareLinkRoute } from "../BaseCalendarShareLinkRoute.js";
+export declare class CalendarShareLinkRouteMongo extends BaseCalendarShareLinkRoute<CalendarShareLinkMongo> {
+    protected readonly repoUtilsClass: any;
+    protected readonly scopeProperty: string;
+}

package/dist/types/routes/mongo/ContactListRouteMongo.d.ts

@@ -0,0 +1,6 @@
+import { ContactListMongo } from "../../mongo.js";
+import { BaseScopedChildRoute } from "../BaseScopedChildRoute.js";
+export declare class ContactListRouteMongo extends BaseScopedChildRoute<ContactListMongo> {
+    protected readonly repoUtilsClass: any;
+    protected readonly scopeProperty: string;
+}

package/dist/types/routes/mongo/ContactRouteMongo.d.ts

@@ -0,0 +1,6 @@
+import { ContactMongo } from "../../mongo.js";
+import { BaseScopedChildRoute } from "../BaseScopedChildRoute.js";
+export declare class ContactRouteMongo extends BaseScopedChildRoute<ContactMongo> {
+    protected readonly repoUtilsClass: any;
+    protected readonly scopeProperty: string;
+}

package/dist/types/routes/mongo/FolderRouteMongo.d.ts

@@ -0,0 +1,5 @@
+import { FolderMongo } from "../../mongo.js";
+import { BaseFolderRoute } from "../BaseFolderRoute.js";
+export declare class FolderRouteMongo extends BaseFolderRoute<FolderMongo> {
+    protected readonly repoUtilsClass: any;
+}

package/dist/types/routes/mongo/IngestQueueRouteMongo.d.ts

@@ -0,0 +1,13 @@
+import { IngestQueueEntryMongo } from "../../mongo.js";
+import { BaseScopedChildRoute } from "../BaseScopedChildRoute.js";
+/**
+ * `IngestQueueEntry` has no `AccessControlList` of its own — like every other `mailboxUid`-scoped entity (see
+ * `ContactListRouteMongo`), `BaseScopedChildRoute` already provides exactly the CRUD/permission behavior
+ * needed: a mailbox owner or delegate sees their own mailbox's pending/failed ingest entries, a trusted caller
+ * (ops diagnosing stuck delivery) sees everything via the same ACL bypass every other route in this library
+ * already gets for free.
+ */
+export declare class IngestQueueRouteMongo extends BaseScopedChildRoute<IngestQueueEntryMongo> {
+    protected readonly repoUtilsClass: any;
+    protected readonly scopeProperty: string;
+}

package/dist/types/routes/mongo/MailIngestRouteMongo.d.ts

@@ -0,0 +1,6 @@
+import { IngestQueueEntryMongo, MailboxMongo } from "../../mongo.js";
+import { BaseMailIngestRoute } from "../BaseMailIngestRoute.js";
+export declare class MailIngestRouteMongo extends BaseMailIngestRoute<MailboxMongo, IngestQueueEntryMongo> {
+    protected mailboxClass: any;
+    protected ingestQueueClass: any;
+}

package/dist/types/routes/mongo/MailboxRouteMongo.d.ts

@@ -0,0 +1,8 @@
+import type { JWTUser } from "@rapidrest/core";
+import { MailboxMongo } from "../../mongo.js";
+import { BaseMailboxRoute } from "../BaseMailboxRoute.js";
+export declare class MailboxRouteMongo extends BaseMailboxRoute<MailboxMongo> {
+    protected readonly repoUtilsClass: any;
+    private aclRepo?;
+    protected findAccessibleMailboxUids(user: JWTUser): Promise<string[]>;
+}

package/dist/types/routes/mongo/MessageRouteMongo.d.ts

@@ -0,0 +1,6 @@
+import { MessageMongo } from "../../mongo.js";
+import { BaseMessageRoute } from "../BaseMessageRoute.js";
+export declare class MessageRouteMongo extends BaseMessageRoute<MessageMongo> {
+    protected readonly repoUtilsClass: any;
+    protected folderClass: any;
+}

package/dist/types/routes/mongo/NoteRouteMongo.d.ts

@@ -0,0 +1,6 @@
+import { NoteMongo } from "../../mongo.js";
+import { BaseScopedChildRoute } from "../BaseScopedChildRoute.js";
+export declare class NoteRouteMongo extends BaseScopedChildRoute<NoteMongo> {
+    protected readonly repoUtilsClass: any;
+    protected readonly scopeProperty: string;
+}

package/dist/types/routes/mongo/QuarantineRouteMongo.d.ts

@@ -0,0 +1,15 @@
+import { QuarantineEntryMongo } from "../../mongo.js";
+import { BaseScopedChildRoute } from "../BaseScopedChildRoute.js";
+/**
+ * `QuarantineEntry` has no `AccessControlList` of its own — like every other `mailboxUid`-scoped entity (see
+ * `ContactListRouteMongo`), `BaseScopedChildRoute` already provides exactly the CRUD/permission behavior
+ * needed: a mailbox owner or delegate sees their own mailbox's quarantined mail (a legitimate webmail
+ * "Spam/Quarantine" folder), a trusted caller sees everything via the same ACL bypass every other route in
+ * this library already gets for free. "Releasing" a quarantined entry is just a normal `PUT /:id` updating
+ * `releasedAt`/`releasedByUserUid` — no bespoke endpoint needed. Re-injecting the released message back into
+ * normal delivery (if desired) is a separate follow-up, not implemented here.
+ */
+export declare class QuarantineRouteMongo extends BaseScopedChildRoute<QuarantineEntryMongo> {
+    protected readonly repoUtilsClass: any;
+    protected readonly scopeProperty: string;
+}

package/dist/types/routes/mongo/SearchRouteMongo.d.ts

@@ -0,0 +1,5 @@
+import { MailboxMongo } from "../../mongo.js";
+import { BaseSearchRoute } from "../BaseSearchRoute.js";
+export declare class SearchRouteMongo extends BaseSearchRoute<MailboxMongo> {
+    protected mailboxClass: any;
+}

package/dist/types/routes/mongo/TaskRouteMongo.d.ts

@@ -0,0 +1,6 @@
+import { TaskMongo } from "../../mongo.js";
+import { BaseScopedChildRoute } from "../BaseScopedChildRoute.js";
+export declare class TaskRouteMongo extends BaseScopedChildRoute<TaskMongo> {
+    protected readonly repoUtilsClass: any;
+    protected readonly scopeProperty: string;
+}

package/dist/types/routes/mongo/index.d.ts

@@ -0,0 +1,14 @@
+export * from "./AttachmentRouteMongo.js";
+export * from "./CalendarEventRouteMongo.js";
+export * from "./CalendarShareLinkRouteMongo.js";
+export * from "./ContactListRouteMongo.js";
+export * from "./ContactRouteMongo.js";
+export * from "./FolderRouteMongo.js";
+export * from "./IngestQueueRouteMongo.js";
+export * from "./MailboxRouteMongo.js";
+export * from "./MailIngestRouteMongo.js";
+export * from "./MessageRouteMongo.js";
+export * from "./NoteRouteMongo.js";
+export * from "./QuarantineRouteMongo.js";
+export * from "./SearchRouteMongo.js";
+export * from "./TaskRouteMongo.js";

package/dist/types/routes/mongo.d.ts

@@ -0,0 +1 @@
+export * from "./mongo/index.js";

package/dist/types/routes/sql/AttachmentRouteSQL.d.ts

@@ -0,0 +1,6 @@
+import { AttachmentSQL, MessageSQL } from "../../sql.js";
+import { BaseAttachmentRoute } from "../BaseAttachmentRoute.js";
+export declare class AttachmentRouteSQL extends BaseAttachmentRoute<AttachmentSQL, MessageSQL> {
+    protected readonly repoUtilsClass: any;
+    protected messageClass: any;
+}

package/dist/types/routes/sql/CalendarEventRouteSQL.d.ts

@@ -0,0 +1,6 @@
+import { CalendarEventSQL } from "../../sql.js";
+import { BaseScopedChildRoute } from "../BaseScopedChildRoute.js";
+export declare class CalendarEventRouteSQL extends BaseScopedChildRoute<CalendarEventSQL> {
+    protected readonly repoUtilsClass: any;
+    protected readonly scopeProperty: string;
+}

package/dist/types/routes/sql/CalendarShareLinkRouteSQL.d.ts

@@ -0,0 +1,6 @@
+import { CalendarShareLinkSQL } from "../../sql.js";
+import { BaseCalendarShareLinkRoute } from "../BaseCalendarShareLinkRoute.js";
+export declare class CalendarShareLinkRouteSQL extends BaseCalendarShareLinkRoute<CalendarShareLinkSQL> {
+    protected readonly repoUtilsClass: any;
+    protected readonly scopeProperty: string;
+}

package/dist/types/routes/sql/ContactListRouteSQL.d.ts

@@ -0,0 +1,6 @@
+import { ContactListSQL } from "../../sql.js";
+import { BaseScopedChildRoute } from "../BaseScopedChildRoute.js";
+export declare class ContactListRouteSQL extends BaseScopedChildRoute<ContactListSQL> {
+    protected readonly repoUtilsClass: any;
+    protected readonly scopeProperty: string;
+}

package/dist/types/routes/sql/ContactRouteSQL.d.ts

@@ -0,0 +1,6 @@
+import { ContactSQL } from "../../sql.js";
+import { BaseScopedChildRoute } from "../BaseScopedChildRoute.js";
+export declare class ContactRouteSQL extends BaseScopedChildRoute<ContactSQL> {
+    protected readonly repoUtilsClass: any;
+    protected readonly scopeProperty: string;
+}

package/dist/types/routes/sql/FolderRouteSQL.d.ts

@@ -0,0 +1,5 @@
+import { FolderSQL } from "../../sql.js";
+import { BaseFolderRoute } from "../BaseFolderRoute.js";
+export declare class FolderRouteSQL extends BaseFolderRoute<FolderSQL> {
+    protected readonly repoUtilsClass: any;
+}

package/dist/types/routes/sql/IngestQueueRouteSQL.d.ts

@@ -0,0 +1,9 @@
+import { IngestQueueEntrySQL } from "../../sql.js";
+import { BaseScopedChildRoute } from "../BaseScopedChildRoute.js";
+/**
+ * See `IngestQueueRouteMongo` for the rationale — identical behavior against the SQL backend.
+ */
+export declare class IngestQueueRouteSQL extends BaseScopedChildRoute<IngestQueueEntrySQL> {
+    protected readonly repoUtilsClass: any;
+    protected readonly scopeProperty: string;
+}

package/dist/types/routes/sql/MailIngestRouteSQL.d.ts

@@ -0,0 +1,23 @@
+import { IngestQueueEntrySQL, MailboxSQL } from "../../sql.js";
+import { BaseMailIngestRoute } from "../BaseMailIngestRoute.js";
+export declare class MailIngestRouteSQL extends BaseMailIngestRoute<MailboxSQL, IngestQueueEntrySQL> {
+    protected mailboxClass: any;
+    protected ingestQueueClass: any;
+    /**
+     * `MailboxSQL.aliasAddresses` is a `simple-json` column, stored as a serialized JSON array string (e.g.
+     * `["a@example.com","b@example.com"]`). A plain equality filter compares against that whole string, so it
+     * never matches a single address. Match the serialized substring instead, anchored on the surrounding
+     * quotes the JSON encoding produces, so a partial-address match (e.g. "ob@example.co" against a stored
+     * "bob@example.com") can't produce a false positive.
+     *
+     * Returns a TypeORM `Raw()` `FindOperator` (a live object, not an `op(value)`-encoded string) so this can
+     * bind `%`/`_` as literal characters via an explicit `ESCAPE` clause — `RepoUtils`'s shared query-string DSL
+     * has no such escaping for its own `like(...)` operator, and `address` here ultimately originates from
+     * whatever RCPT TO value an anonymous internet SMTP client sends. Without escaping, an address containing
+     * `%`/`_` would turn this intended *exact*-alias-match into a wildcard/substring match, enabling blind
+     * alias enumeration via `GET /internal/mta/resolve`'s 200/404 response and mis-delivery to an unintended
+     * mailbox whose alias happens to satisfy the resulting pattern - a real, confirmed vulnerability, not a
+     * theoretical one.
+     */
+    protected aliasQueryValue(address: string): any;
+}

package/dist/types/routes/sql/MailboxRouteSQL.d.ts

@@ -0,0 +1,22 @@
+import type { JWTUser } from "@rapidrest/core";
+import { MailboxSQL } from "../../sql.js";
+import { BaseMailboxRoute } from "../BaseMailboxRoute.js";
+export declare class MailboxRouteSQL extends BaseMailboxRoute<MailboxSQL> {
+    protected readonly repoUtilsClass: any;
+    private aclRepo?;
+    /**
+     * `AccessControlListSQL.records` is a `simple-json` column (serialized as a single JSON string), the same
+     * shape as `MailboxSQL.aliasAddresses` — see `MailIngestRouteSQL.aliasQueryValue()` for the identical
+     * problem/solution this mirrors: match the serialized substring via `LIKE`, anchored on the `userOrRoleId`
+     * key specifically (not just any quoted occurrence, which could otherwise false-positive-match a
+     * coincidentally identical string inside a record's `actions` array) and escaped so a candidate id
+     * containing `%`/`_` can't turn this intended exact match into an unintended wildcard/substring match.
+     *
+     * KNOWN LIMITATION: a `LIKE '%...%'` scan of the whole `records` column can't use a standard index the way
+     * a normalized join table could, so this degrades on a very large ACL table (every mailbox/folder/message/
+     * etc.'s ACL lives in this one table). Acceptable for now given the library's existing precedent of
+     * similar tradeoffs elsewhere (e.g. search index eventual consistency); revisit with a dedicated
+     * reverse-lookup table if this becomes a real bottleneck.
+     */
+    protected findAccessibleMailboxUids(user: JWTUser): Promise<string[]>;
+}

package/dist/types/routes/sql/MessageRouteSQL.d.ts

@@ -0,0 +1,6 @@
+import { MessageSQL } from "../../sql.js";
+import { BaseMessageRoute } from "../BaseMessageRoute.js";
+export declare class MessageRouteSQL extends BaseMessageRoute<MessageSQL> {
+    protected readonly repoUtilsClass: any;
+    protected folderClass: any;
+}

package/dist/types/routes/sql/NoteRouteSQL.d.ts

@@ -0,0 +1,6 @@
+import { NoteSQL } from "../../sql.js";
+import { BaseScopedChildRoute } from "../BaseScopedChildRoute.js";
+export declare class NoteRouteSQL extends BaseScopedChildRoute<NoteSQL> {
+    protected readonly repoUtilsClass: any;
+    protected readonly scopeProperty: string;
+}

package/dist/types/routes/sql/QuarantineRouteSQL.d.ts

@@ -0,0 +1,9 @@
+import { QuarantineEntrySQL } from "../../sql.js";
+import { BaseScopedChildRoute } from "../BaseScopedChildRoute.js";
+/**
+ * See `QuarantineRouteMongo` for the rationale — identical behavior against the SQL backend.
+ */
+export declare class QuarantineRouteSQL extends BaseScopedChildRoute<QuarantineEntrySQL> {
+    protected readonly repoUtilsClass: any;
+    protected readonly scopeProperty: string;
+}

package/dist/types/routes/sql/SearchRouteSQL.d.ts

@@ -0,0 +1,5 @@
+import { MailboxSQL } from "../../sql.js";
+import { BaseSearchRoute } from "../BaseSearchRoute.js";
+export declare class SearchRouteSQL extends BaseSearchRoute<MailboxSQL> {
+    protected mailboxClass: any;
+}

package/dist/types/routes/sql/TaskRouteSQL.d.ts

@@ -0,0 +1,6 @@
+import { TaskSQL } from "../../sql.js";
+import { BaseScopedChildRoute } from "../BaseScopedChildRoute.js";
+export declare class TaskRouteSQL extends BaseScopedChildRoute<TaskSQL> {
+    protected readonly repoUtilsClass: any;
+    protected readonly scopeProperty: string;
+}

package/dist/types/routes/sql/index.d.ts

@@ -0,0 +1,14 @@
+export * from "./AttachmentRouteSQL.js";
+export * from "./CalendarEventRouteSQL.js";
+export * from "./CalendarShareLinkRouteSQL.js";
+export * from "./ContactListRouteSQL.js";
+export * from "./ContactRouteSQL.js";
+export * from "./FolderRouteSQL.js";
+export * from "./IngestQueueRouteSQL.js";
+export * from "./MailboxRouteSQL.js";
+export * from "./MailIngestRouteSQL.js";
+export * from "./MessageRouteSQL.js";
+export * from "./NoteRouteSQL.js";
+export * from "./QuarantineRouteSQL.js";
+export * from "./SearchRouteSQL.js";
+export * from "./TaskRouteSQL.js";

package/dist/types/routes/sql.d.ts

@@ -0,0 +1 @@
+export * from "./sql/index.js";