@remit/backend 0.0.143 → 0.0.144

package/dist/src/handlers/vip-suggestions.js

@@ -0,0 +1,16 @@
+/**
+ * Map an Address row to the wire-format `VipSuggestionEntry` returned by
+ * `GET /me/vip-suggestions` (issue #234). Absent counters are normalised to
+ * zero so the UI can render `12 received · 4 sent · 2 replies` without a
+ * `?? 0` fallback at every render site.
+ */
+export const toVipSuggestionEntry = (item) => ({
+    addressId: item.addressId,
+    displayName: item.displayName,
+    normalizedEmail: item.normalizedEmail,
+    inboundCount: item.inboundCount ?? 0,
+    outboundCount: item.outboundCount ?? 0,
+    replyCount: item.replyCount ?? 0,
+    lastInboundAt: item.lastInboundAt,
+    lastReplyAt: item.lastReplyAt,
+});

package/dist/src/index.d.ts

@@ -0,0 +1,2 @@
+export { api, handleApiEvent, OpenAPISpec } from "./api.js";
+export declare const handler: (event: import("aws-lambda").APIGatewayProxyEvent, context: import("aws-lambda").Context) => Promise<import("aws-lambda").APIGatewayProxyResult>;

package/dist/src/index.js

@@ -0,0 +1,37 @@
+import { inspect } from "node:util";
+import { logger } from "@remit/logger";
+import { installNodeLogger, withTelemetry } from "@remit/logger-lambda/node";
+import { handleApiEvent } from "./api.js";
+installNodeLogger();
+export { api, handleApiEvent, OpenAPISpec } from "./api.js";
+/**
+ * Last-resort net for a leaked background rejection.
+ *
+ * Every fire-and-forget side effect is meant to be contained at its source (see
+ * service/fire-and-forget.ts), so reaching here is a bug — an uncontained
+ * `void promise` somewhere. The API process (dev-server / warm Lambda container)
+ * shares one event loop across requests, so without this handler such a leak
+ * would surface as a spurious 500 on whatever request was in flight. We log it
+ * LOUDLY with a distinct alert so it is observable, and deliberately do NOT exit
+ * — a stray background rejection must never take the API down or fail a request.
+ * (The worker process intentionally has no such net: there each message is its
+ * own invocation and a rejection should crash it.)
+ */
+const unhandledRejectionRegistered = Symbol.for("remit.backend.unhandledRejectionNet");
+const globalProcess = process;
+if (!globalProcess[unhandledRejectionRegistered]) {
+    globalProcess[unhandledRejectionRegistered] = true;
+    process.on("unhandledRejection", (reason) => {
+        logger.error({
+            alert: "unhandled_rejection",
+            errorName: reason?.name,
+            errorCode: reason?.Code ??
+                reason?.code,
+            error: inspect(reason),
+        }, "Unhandled promise rejection leaked into the API event loop (contained, request not failed)");
+    });
+}
+// The Lambda and Node entry point. `withTelemetry` installs the Node logger and
+// its process metrics; a host without Node's process APIs imports
+// `@remit/backend/api` instead and plugs in its own logger with `setLogger`.
+export const handler = withTelemetry(handleApiEvent);

package/{src/json.ts → dist/src/json.d.ts}

@@ -5,7 +5,4 @@
  * absence (e.g. a third-party token, a dev-server response body) — never to
  * soften an internal contract, which must stay a fatal uncaught `JSON.parse`.
  */
-export const safeJsonParse = <T>(raw: string): Promise<T> =>
-	new Promise((resolve) => {
-		resolve(JSON.parse(raw));
-	});
+export declare const safeJsonParse: <T>(raw: string) => Promise<T>;

package/dist/src/json.js

@@ -0,0 +1,10 @@
+/**
+ * Parse JSON in a Promise so a malformed string surfaces as a rejection the
+ * caller can `.catch()`, instead of a synchronous throw that would need a block
+ * try/catch. Use only where an unparseable value is an expected, recoverable
+ * absence (e.g. a third-party token, a dev-server response body) — never to
+ * soften an internal contract, which must stay a fatal uncaught `JSON.parse`.
+ */
+export const safeJsonParse = (raw) => new Promise((resolve) => {
+    resolve(JSON.parse(raw));
+});

package/dist/src/jwt-auth.d.ts

@@ -0,0 +1,18 @@
+import { type JwtVerifier } from "@remit/auth-service/verifier";
+import type { APIGatewayProxyEvent, APIGatewayProxyResult } from "aws-lambda";
+/** Test-only override for the memoized verifier. Pass null to reset. */
+export declare const _setVerifierForTest: (v: JwtVerifier | null) => void;
+/**
+ * Authenticate a self-host request from a better-auth RS256 JWT.
+ *
+ * On a valid token the verified `sub` is injected into the event's authorizer
+ * claims, exactly where the Cognito authorizer puts it, so every downstream
+ * handler reads identity through the unchanged `auth.ts` path. Returns a 401
+ * response (not null) when a token is present but fails verification, or when no
+ * token is supplied and no local test bypass is configured. Returns null to let
+ * the request proceed.
+ *
+ * When the edge tier (APISIX) has already verified and injected claims, this is
+ * a no-op — the backend trusts pre-populated claims and re-verifies otherwise.
+ */
+export declare const authenticateSelfHostRequest: (event: APIGatewayProxyEvent) => Promise<APIGatewayProxyResult | null>;

package/dist/src/jwt-auth.js

@@ -0,0 +1,97 @@
+import { createJwtVerifier, extractBearerToken, resolveVerifierConfig, } from "@remit/auth-service/verifier";
+import { readCalendarFeedToken } from "@remit/calendar-service";
+import { logger } from "@remit/logger";
+import { defaultErrorCode } from "./error.js";
+import { formatResponse } from "./response.js";
+let verifier = null;
+const getVerifier = () => {
+    if (!verifier)
+        verifier = createJwtVerifier(resolveVerifierConfig());
+    return verifier;
+};
+/** Test-only override for the memoized verifier. Pass null to reset. */
+export const _setVerifierForTest = (v) => {
+    verifier = v;
+};
+const readHeader = (headers, name) => {
+    for (const [key, value] of Object.entries(headers ?? {})) {
+        if (key.toLowerCase() === name && typeof value === "string")
+            return value;
+    }
+    return undefined;
+};
+const unauthorized = (message) => formatResponse({ code: defaultErrorCode(401), message }, 401);
+const injectClaims = (event, sub, email) => {
+    event.requestContext = {
+        ...event.requestContext,
+        authorizer: {
+            ...event.requestContext?.authorizer,
+            claims: {
+                sub,
+                email: email ?? "",
+            },
+        },
+    };
+};
+const hasLocalBypass = () => Boolean(process.env.LOCAL_ACCOUNT_CONFIG_ID);
+/**
+ * The routes that run without a token.
+ *
+ * Microsoft redirects the browser here after consent, so the request carries no
+ * Authorization header and no session to derive one from. The handler takes its
+ * identity from the HMAC-signed `state` parameter and validates it there; that
+ * signature is the gate, not a JWT.
+ *
+ * A calendar feed carries its credential in the path for the same reason: a
+ * subscribed client polls a URL and has no session to present, so the token is
+ * the gate and the handler compares it against a stored hash.
+ *
+ * Hardcoded, matching the edge exemption in packages/apisix/src/route-table.ts.
+ * `@useAuth(NoAuth)` in the spec does not open a path here — a future public
+ * route is added by hand.
+ */
+const PUBLIC_ROUTES = [
+    {
+        method: "GET",
+        matches: (path) => path === "/accounts/oauth/microsoft/callback",
+    },
+    {
+        method: "GET",
+        matches: (path) => readCalendarFeedToken(path) !== null,
+    },
+];
+const isPublicRoute = (event) => PUBLIC_ROUTES.some((route) => route.method === event.httpMethod && route.matches(event.path));
+/**
+ * Authenticate a self-host request from a better-auth RS256 JWT.
+ *
+ * On a valid token the verified `sub` is injected into the event's authorizer
+ * claims, exactly where the Cognito authorizer puts it, so every downstream
+ * handler reads identity through the unchanged `auth.ts` path. Returns a 401
+ * response (not null) when a token is present but fails verification, or when no
+ * token is supplied and no local test bypass is configured. Returns null to let
+ * the request proceed.
+ *
+ * When the edge tier (APISIX) has already verified and injected claims, this is
+ * a no-op — the backend trusts pre-populated claims and re-verifies otherwise.
+ */
+export const authenticateSelfHostRequest = async (event) => {
+    if (isPublicRoute(event))
+        return null;
+    const existingSub = event.requestContext?.authorizer?.claims?.sub;
+    if (typeof existingSub === "string" && existingSub.length > 0)
+        return null;
+    const token = extractBearerToken(readHeader(event.headers, "authorization"));
+    if (token) {
+        const claims = await getVerifier()(token).catch((err) => {
+            logger.warn({ err: err instanceof Error ? err.message : String(err) }, "better-auth JWT verification failed");
+            return null;
+        });
+        if (!claims)
+            return unauthorized("Invalid or expired token");
+        injectClaims(event, claims.sub, claims.email);
+        return null;
+    }
+    if (hasLocalBypass())
+        return null;
+    return unauthorized("Authentication required");
+};

package/dist/src/request-context.d.ts

@@ -0,0 +1,9 @@
+interface RequestContext {
+    origin?: string;
+    correlationId?: string;
+}
+export declare const runWithRequestContext: <T>(ctx: RequestContext, fn: () => T) => T;
+export declare const getRequestOrigin: () => string | undefined;
+export declare const getRequestCorrelationId: () => string | undefined;
+export declare const resolveAllowedOrigin: (origin: string | undefined) => string;
+export {};

package/dist/src/request-context.js

@@ -0,0 +1,22 @@
+import { AsyncLocalStorage } from "node:async_hooks";
+const storage = new AsyncLocalStorage();
+export const runWithRequestContext = (ctx, fn) => storage.run(ctx, fn);
+export const getRequestOrigin = () => storage.getStore()?.origin;
+export const getRequestCorrelationId = () => storage.getStore()?.correlationId;
+const parseAllowedOrigins = () => {
+    const raw = process.env.CORS_ALLOWED_ORIGINS;
+    if (!raw)
+        return [];
+    return raw
+        .split(",")
+        .map((s) => s.trim())
+        .filter((s) => s.length > 0);
+};
+export const resolveAllowedOrigin = (origin) => {
+    const allowed = parseAllowedOrigins();
+    if (allowed.length === 0)
+        return "*";
+    if (origin && allowed.includes(origin))
+        return origin;
+    return allowed[0];
+};

package/dist/src/request.d.ts

@@ -0,0 +1,3 @@
+import type { APIGatewayProxyEvent } from "aws-lambda";
+import type { Request } from "openapi-backend";
+export declare const normalizeRequest: (event: APIGatewayProxyEvent) => Request;

package/dist/src/request.js

@@ -0,0 +1,7 @@
+export const normalizeRequest = (event) => ({
+    method: event.httpMethod,
+    path: event.path,
+    query: (event.queryStringParameters ?? {}),
+    body: event.body,
+    headers: (event.headers ?? {}),
+});

package/dist/src/response.d.ts

@@ -0,0 +1,27 @@
+import type { APIGatewayProxyResult } from "aws-lambda";
+import type { Context as OpenAPIContext } from "openapi-backend";
+declare const RAW_API_RESPONSE: unique symbol;
+/**
+ * A response the caller reads by something other than its JSON body — an
+ * iCalendar feed, an OAuth redirect's Location, and whatever later joins them.
+ *
+ * Every other handler returns a plain object and lets this module decide the
+ * status, the content type and the serialization. That is the right default and
+ * stays the default; a handler that has to own its own media type or headers
+ * says so with `rawApiResponse` rather than by returning a shape this one has
+ * to guess at.
+ * The CORS and correlation headers are still added here, so a raw response is
+ * not a way around them.
+ */
+export interface RawApiResponse {
+    statusCode: number;
+    headers: Record<string, string>;
+    body: string;
+}
+type MarkedRawApiResponse = RawApiResponse & {
+    readonly [RAW_API_RESPONSE]: true;
+};
+export declare const rawApiResponse: (response: RawApiResponse) => MarkedRawApiResponse;
+export declare const formatResponse: (body: Record<string, unknown>, statusCode?: number) => APIGatewayProxyResult;
+export declare const postResponseHandler: (context: OpenAPIContext) => APIGatewayProxyResult;
+export {};

package/dist/src/response.js

@@ -0,0 +1,87 @@
+import { logger } from "@remit/logger";
+import { getRequestCorrelationId, getRequestOrigin, resolveAllowedOrigin, } from "./request-context.js";
+const RAW_API_RESPONSE = Symbol("remit.rawApiResponse");
+export const rawApiResponse = (response) => Object.assign(response, { [RAW_API_RESPONSE]: true });
+const isRawApiResponse = (body) => RAW_API_RESPONSE in body;
+/**
+ * The headers every response carries whatever its body is: the CORS grant the
+ * browser needs, and the id the request's log lines are already tagged with.
+ * Returning that id is what makes a bug report's "correlation id" resolve to a
+ * server-side line; the browser can only read a non-safelisted header when it
+ * is exposed.
+ */
+const envelopeHeaders = () => {
+    const allowOrigin = resolveAllowedOrigin(getRequestOrigin());
+    const headers = {
+        "Access-Control-Allow-Origin": allowOrigin,
+        "Access-Control-Allow-Headers": "Authorization,Content-Type",
+        "Access-Control-Allow-Methods": "GET,POST,PUT,PATCH,DELETE,OPTIONS",
+        Vary: "Origin",
+    };
+    if (allowOrigin !== "*") {
+        headers["Access-Control-Allow-Credentials"] = "true";
+    }
+    const correlationId = getRequestCorrelationId();
+    if (correlationId) {
+        headers["x-correlation-id"] = correlationId;
+        headers["Access-Control-Expose-Headers"] = "x-correlation-id";
+    }
+    return headers;
+};
+export const formatResponse = (body, statusCode = 200) => {
+    if (body.statusCode && typeof body.statusCode === "number") {
+        statusCode = body.statusCode;
+    }
+    if (isRawApiResponse(body)) {
+        logger.debug({ statusCode: body.statusCode }, "response");
+        return {
+            statusCode: body.statusCode,
+            headers: { ...envelopeHeaders(), ...body.headers },
+            body: body.body,
+        };
+    }
+    if ("body" in body && body.body && typeof body.body === "object") {
+        body = body.body;
+    }
+    logger.debug({ statusCode }, "response");
+    return {
+        statusCode: statusCode,
+        headers: {
+            "Content-Type": "application/json",
+            ...envelopeHeaders(),
+        },
+        body: JSON.stringify(body),
+    };
+};
+export const postResponseHandler = (context) => {
+    const { api, response, operation } = context;
+    if (response.statusCode)
+        return formatResponse(response, response.statusCode);
+    if (process.env.STAGE_NAME !== "dev")
+        return formatResponse(response, 200);
+    const { valid, errors } = api.validateResponse(response, operation);
+    if (valid)
+        return formatResponse(response, 200);
+    const { operationId } = operation;
+    const errorDetails = {
+        errors,
+        operationId,
+        responseKeys: Object.keys(response),
+    };
+    errors?.forEach((error) => {
+        if (error.instancePath) {
+            const pathParts = error.instancePath.split("/").filter(Boolean);
+            let value = response;
+            for (const part of pathParts) {
+                value = value?.[part];
+            }
+            errorDetails[`problematicValue_${error.instancePath}`] = {
+                path: error.instancePath,
+                value: JSON.stringify(value).substring(0, 500),
+                error: error.message,
+            };
+        }
+    });
+    logger.error(errorDetails, "Response validation failed");
+    return formatResponse(response, 200);
+};

package/dist/src/service/account-deletion.d.ts

@@ -0,0 +1,22 @@
+import { type SQSClient } from "@aws-sdk/client-sqs";
+import type { AccountItem, IAccountRepository, IConfigImportRepository } from "@remit/data-ports";
+import type { Logger } from "@remit/logger";
+export interface AccountDeletionDeps {
+    account: Pick<IAccountRepository, "update">;
+    sqsClient: SQSClient;
+    accountFanoutQueueUrl: string;
+    log: Logger;
+}
+export declare const deleteAccount: (deps: AccountDeletionDeps, account: Pick<AccountItem, "accountId" | "accountConfigId">, deletedAt: number) => Promise<void>;
+export interface HalfDeletedAccountDeps extends AccountDeletionDeps {
+    account: Pick<IAccountRepository, "update" | "listAll">;
+    configImport: Pick<IConfigImportRepository, "listByAccountConfig">;
+}
+/**
+ * Before #1384 a delete stored `isActive=false` and dropped `deletedAt`. Of the
+ * writers in this repo only that delete and a config import leave an account
+ * inactive, and an import names each account it creates in its stored
+ * document. The public update endpoint accepts `isActive` as sent, so a caller
+ * outside the repo can also leave one inactive.
+ */
+export declare const finishHalfDeletedAccounts: (deps: HalfDeletedAccountDeps) => Promise<void>;

package/dist/src/service/account-deletion.js

@@ -0,0 +1,39 @@
+import { SendMessageCommand } from "@aws-sdk/client-sqs";
+import { readConfigDocument } from "@remit/config-format";
+export const deleteAccount = async (deps, account, deletedAt) => {
+    const { accountId, accountConfigId } = account;
+    // Purge first: an account whose request never left still reads as not deleted, so it is found and asked for again.
+    await deps.sqsClient.send(new SendMessageCommand({
+        QueueUrl: deps.accountFanoutQueueUrl,
+        MessageBody: JSON.stringify({
+            type: "AccountDataPurge",
+            accountId,
+            accountConfigId,
+        }),
+    }));
+    await deps.account.update(accountId, { deletedAt, isActive: false });
+    deps.log.info({ accountId, accountConfigId }, "Account data purge initiated");
+};
+/**
+ * Before #1384 a delete stored `isActive=false` and dropped `deletedAt`. Of the
+ * writers in this repo only that delete and a config import leave an account
+ * inactive, and an import names each account it creates in its stored
+ * document. The public update endpoint accepts `isActive` as sent, so a caller
+ * outside the repo can also leave one inactive.
+ */
+export const finishHalfDeletedAccounts = async (deps) => {
+    const imported = new Map();
+    for (const account of await deps.account.listAll()) {
+        if (account.isActive || account.deletedAt !== undefined)
+            continue;
+        let names = imported.get(account.accountConfigId);
+        if (!names) {
+            const imports = await deps.configImport.listByAccountConfig(account.accountConfigId);
+            names = new Set(imports.flatMap((row) => readConfigDocument(row.document).accounts.map((a) => a.accountId)));
+            imported.set(account.accountConfigId, names);
+        }
+        if (names.has(account.accountId))
+            continue;
+        await deleteAccount(deps, account, Date.now());
+    }
+};

package/dist/src/service/compose-sqlite.d.ts

@@ -0,0 +1,2 @@
+import { type RemitClient } from "./create-remit-client.js";
+export declare const buildSqliteClient: () => Promise<RemitClient>;

package/dist/src/service/compose-sqlite.js

@@ -0,0 +1,11 @@
+import { createSqliteRepositories, openSqliteDatabases, sqliteDatabasePathsFromEnv, } from "@remit/drizzle-service";
+import { buildSharedDeps, createRemitClient, } from "./create-remit-client.js";
+// The SQLite adapter composition (RFC 036). Every repo runs on the database
+// that holds its tables: app, tenant mail or tenant search (#1420).
+export const buildSqliteClient = async () => {
+    const databases = await openSqliteDatabases(sqliteDatabasePathsFromEnv());
+    return createRemitClient({
+        repositories: createSqliteRepositories(databases),
+        ...buildSharedDeps(),
+    });
+};

package/dist/src/service/create-remit-client.d.ts

@@ -0,0 +1,95 @@
+import type { IAccountConfigRepository, IAccountExportRequestRepository, IAccountRepository, IAccountSettingRepository, IAddressRepository, ICalendarCollectionRepository, ICalendarEventIndexRepository, ICalendarFeedTokenRepository, ICalendarObjectRepository, ICalendarStore, ICalendarSuggestionRepository, IConfigImportRepository, IEnvelopeRepository, IFilterRepository, ILabelRepository, IMailboxLockRepository, IMailboxRepository, IMailboxSpecialUseRepository, IMessageFlagPushRepository, IMessageFlagRepository, IMessageLabelRepository, IMessagePlacementMoveRepository, IMessageRepository, IOrganizeJobRequestRepository, IOutboxAttachmentRepository, IOutboxMessageRepository, IQuarantineRepository, ISenderSignerStandingRepository, ISyncWarningRepository, IThreadMessageRepository } from "@remit/data-ports";
+import { BodySyncQueueService, BodySyncService, type FilterConfig, FlagQueueService, type IImapConnection, MailboxQueueService, MessageMoveService, OutboxAttachmentService, OutboxQueueService, SpamReportService } from "@remit/mailbox-service";
+import { type SecretsService } from "@remit/secrets-service";
+import type { StorageService } from "@remit/storage-service";
+export interface ConnectionScope {
+    getConnection: () => Promise<IImapConnection>;
+    disconnect: () => Promise<void>;
+}
+export interface RemitClient {
+    accountConfig: IAccountConfigRepository;
+    account: IAccountRepository;
+    accountSetting: IAccountSettingRepository;
+    address: IAddressRepository;
+    mailbox: IMailboxRepository;
+    mailboxSpecialUse: IMailboxSpecialUseRepository;
+    mailboxLock: IMailboxLockRepository;
+    message: IMessageRepository;
+    messageFlag: IMessageFlagRepository;
+    outboxMessage: IOutboxMessageRepository;
+    threadMessage: IThreadMessageRepository;
+    envelope: IEnvelopeRepository;
+    accountExportRequest: IAccountExportRequestRepository;
+    configImport: IConfigImportRepository;
+    quarantine: IQuarantineRepository;
+    syncWarning: ISyncWarningRepository;
+    organizeJobRequest: IOrganizeJobRequestRepository;
+    filter: IFilterRepository;
+    label: ILabelRepository;
+    messageLabel: IMessageLabelRepository;
+    senderSignerStanding: ISenderSignerStandingRepository;
+    calendarCollection: ICalendarCollectionRepository;
+    calendarObject: ICalendarObjectRepository;
+    calendarEventIndex: ICalendarEventIndexRepository;
+    calendarFeedToken: ICalendarFeedTokenRepository;
+    calendarSuggestion: ICalendarSuggestionRepository;
+    calendarStore: ICalendarStore;
+    storage: StorageService;
+    secrets: SecretsService;
+    bodySync: BodySyncService;
+    bodySyncQueue?: BodySyncQueueService;
+    placementMove: IMessagePlacementMoveRepository;
+    flagPush: IMessageFlagPushRepository;
+    flagQueue: FlagQueueService;
+    mailboxQueue: MailboxQueueService;
+    messageMove: MessageMoveService;
+    outboxAttachment: OutboxAttachmentService;
+    outboxQueue: OutboxQueueService;
+    spamReport: SpamReportService;
+    createConnectionScope: (accountId: string) => Promise<ConnectionScope>;
+}
+export interface RemitClientRepositories {
+    accountConfig: IAccountConfigRepository;
+    account: IAccountRepository;
+    accountSetting: IAccountSettingRepository;
+    address: IAddressRepository;
+    mailbox: IMailboxRepository;
+    mailboxSpecialUse: IMailboxSpecialUseRepository;
+    mailboxLock: IMailboxLockRepository;
+    message: IMessageRepository;
+    messageFlag: IMessageFlagRepository;
+    outboxMessage: IOutboxMessageRepository;
+    outboxAttachment: IOutboxAttachmentRepository;
+    threadMessage: IThreadMessageRepository;
+    envelope: IEnvelopeRepository;
+    accountExportRequest: IAccountExportRequestRepository;
+    configImport: IConfigImportRepository;
+    quarantine: IQuarantineRepository;
+    syncWarning: ISyncWarningRepository;
+    organizeJobRequest: IOrganizeJobRequestRepository;
+    placementMove: IMessagePlacementMoveRepository;
+    flagPush: IMessageFlagPushRepository;
+    filter: IFilterRepository;
+    label: ILabelRepository;
+    messageLabel: IMessageLabelRepository;
+    senderSignerStanding: ISenderSignerStandingRepository;
+    calendarCollection: ICalendarCollectionRepository;
+    calendarObject: ICalendarObjectRepository;
+    calendarEventIndex: ICalendarEventIndexRepository;
+    calendarFeedToken: ICalendarFeedTokenRepository;
+    calendarSuggestion: ICalendarSuggestionRepository;
+    calendarStore: ICalendarStore;
+}
+export interface RemitClientSharedDeps {
+    storage: StorageService;
+    secrets: SecretsService;
+    sqsQueueUrl: string;
+    sqsSmtpQueueUrl: string;
+    bodySyncQueue?: BodySyncQueueService;
+}
+export interface RemitClientDeps extends RemitClientSharedDeps {
+    repositories: RemitClientRepositories;
+}
+export declare const buildSharedDeps: () => RemitClientSharedDeps;
+export declare const buildReadPathFilterConfig: (repositories: RemitClientRepositories) => FilterConfig | undefined;
+export declare const createRemitClient: (deps: RemitClientDeps) => RemitClient;