@remit/backend 0.0.144 → 0.0.146

package/dist/src/handlers/organize.js

@@ -1,9 +1,6 @@
 import { BadRequestError, NotFoundError } from "@remit/data-ports/errors";
 import { logger } from "@remit/logger";
 import { ownedAccount, queueOrganizeJob, } from "@remit/mailbox-service";
-import { env } from "expect-env";
-import { getAccountConfigIdFromEvent, getSubFromEvent } from "../auth.js";
-import { getClient } from "../service/data-client.js";
 import { buildOrganizeMatchDeps, matchOrganize, ORGANIZE_MATCH_LIMIT, organizePredicateRejection, } from "../service/organize.js";
 import { unwrap } from "../service/refusal.js";
 /**
@@ -55,20 +52,16 @@ const requestedJob = async (client, owner, input) => {
     return { ...owner, predicate };
 };
 export const OrganizeOperations = {
-    OrganizeOperations_createOrganizeJob: async (context, ...args) => {
-        const event = args[0];
-        const accountConfigId = getAccountConfigIdFromEvent(event);
+    OrganizeOperations_createOrganizeJob: async (context, ctx) => {
+        const accountConfigId = ctx.identity.accountConfigId;
         const { accountId } = context.request.params;
         const input = context.request.requestBody;
-        const userId = getSubFromEvent(event);
-        if (!userId) {
-            throw new Error("Missing Cognito `sub`: cannot attribute an organize job to a user");
-        }
-        const client = await getClient();
+        const userId = ctx.identity.sub;
+        const client = ctx.client;
         await assertAccount(client, accountId, accountConfigId, "act");
         const job = await queueOrganizeJob({
             organizeJobRequest: client.organizeJobRequest,
-            sqsQueueUrl: env.SQS_QUEUE_URL_ACCOUNT_FANOUT,
+            queue: client.queues.accountFanout,
             logger,
         }, await requestedJob(client, { accountConfigId, userId }, input));
         return {
@@ -77,12 +70,11 @@ export const OrganizeOperations = {
             state: job.state,
         };
     },
-    OrganizeOperations_previewOrganize: async (context, ...args) => {
-        const event = args[0];
-        const accountConfigId = getAccountConfigIdFromEvent(event);
+    OrganizeOperations_previewOrganize: async (context, ctx) => {
+        const accountConfigId = ctx.identity.accountConfigId;
         const { accountId } = context.request.params;
         const input = context.request.requestBody;
-        const client = await getClient();
+        const client = ctx.client;
         await assertAccount(client, accountId, accountConfigId, "read");
         if (input.filterId) {
             throw new BadRequestError("Preview takes a rule, not a saved filter. Run the filter to apply it.");
@@ -97,11 +89,10 @@ export const OrganizeOperations = {
     },
 };
 export const OrganizeJobDetailOperations = {
-    OrganizeJobDetailOperations_getOrganizeJob: async (context, ...args) => {
-        const event = args[0];
-        const accountConfigId = getAccountConfigIdFromEvent(event);
+    OrganizeJobDetailOperations_getOrganizeJob: async (context, ctx) => {
+        const accountConfigId = ctx.identity.accountConfigId;
         const { accountId, organizeJobId } = context.request.params;
-        const client = await getClient();
+        const client = ctx.client;
         await assertAccount(client, accountId, accountConfigId, "read");
         const job = await client.organizeJobRequest.get(organizeJobId);
         if (job.accountConfigId !== accountConfigId) {

package/dist/src/handlers/outbox-attachment.d.ts

@@ -1,8 +1,10 @@
 import type { MintOutboxAttachmentResponse, OutboxAttachmentRejection, OutboxAttachmentResponse } from "@remit/api-openapi-types";
 import type { OutboxAttachmentItem } from "@remit/data-ports";
 import type { Context } from "openapi-backend";
-export declare const toOutboxAttachmentResponse: (item: OutboxAttachmentItem) => OutboxAttachmentResponse;
-interface RejectionResponse {
+import type { ApiConfig } from "../config/api-config.js";
+import type { HandlerContext } from "../types.js";
+export declare const toOutboxAttachmentResponse: (config: ApiConfig) => (item: OutboxAttachmentItem) => OutboxAttachmentResponse;
+export interface RejectionResponse {
     statusCode: number;
     body: OutboxAttachmentRejection;
 }
@@ -12,12 +14,11 @@ interface RejectionResponse {
  * lets the upload live on its own fleet and keeps this operation under any
  * payload ceiling the REST tier has.
  */
-export declare const mintOutboxAttachment: (context: Context, ...args: unknown[]) => Promise<MintOutboxAttachmentResponse | RejectionResponse>;
+export declare const mintOutboxAttachment: (context: Context, ctx: HandlerContext) => Promise<MintOutboxAttachmentResponse | RejectionResponse>;
 /**
  * Confirm the upload landed. The size in the response is read back from
  * storage — on a deployment where the browser PUT straight to block storage
  * this call is the first the API hears of the bytes, and the client's word for
  * how many there are is not evidence.
  */
-export declare const completeOutboxAttachment: (context: Context, ...args: unknown[]) => Promise<OutboxAttachmentResponse | RejectionResponse>;
-export {};
+export declare const completeOutboxAttachment: (context: Context, ctx: HandlerContext) => Promise<OutboxAttachmentResponse | RejectionResponse>;

package/dist/src/handlers/outbox-attachment.js

@@ -1,9 +1,7 @@
 import { OutboxAttachmentRejectionReason } from "@remit/domain-enums";
 import { outboxAttachmentContentId } from "@remit/mailbox-service/outbox-attachment-content";
-import { getAccountConfigIdFromEvent } from "../auth.js";
 import { getContentSigner } from "../derive/contentSignature.js";
-import { buildStorageContentUrl, getContentDeliveryDomain, } from "../derive/contentUrl.js";
-import { getClient } from "../service/data-client.js";
+import { buildStorageContentUrl } from "../derive/contentUrl.js";
 // Every error body the API emits carries a `code` (issue #371). A refusal here
 // is one kind, so the code is one value and `reason` says which refusal it was.
 const ATTACHMENT_REJECTED_CODE = "attachment_rejected";
@@ -12,7 +10,7 @@ const TOO_LARGE = new Set([
     OutboxAttachmentRejectionReason.MessageTooLarge,
     OutboxAttachmentRejectionReason.TooManyAttachments,
 ]);
-export const toOutboxAttachmentResponse = (item) => ({
+export const toOutboxAttachmentResponse = (config) => (item) => ({
     outboxAttachmentId: item.outboxAttachmentId,
     outboxMessageId: item.outboxMessageId,
     filename: item.filename,
@@ -21,9 +19,9 @@ export const toOutboxAttachmentResponse = (item) => ({
     state: item.state,
     contentId: outboxAttachmentContentId(item.outboxAttachmentId),
     contentUrl: buildStorageContentUrl({
-        domain: getContentDeliveryDomain(),
+        domain: config.contentDeliveryDomain,
         storageKey: item.storageKey,
-        sign: getContentSigner(),
+        sign: getContentSigner(config),
     }),
 });
 const refuse = (detail) => ({
@@ -42,12 +40,11 @@ const refuse = (detail) => ({
  * lets the upload live on its own fleet and keeps this operation under any
  * payload ceiling the REST tier has.
  */
-export const mintOutboxAttachment = async (context, ...args) => {
-    const event = args[0];
-    const accountConfigId = getAccountConfigIdFromEvent(event);
+export const mintOutboxAttachment = async (context, ctx) => {
+    const accountConfigId = ctx.identity.accountConfigId;
     const { outboxMessageId } = context.request.params;
     const input = context.request.requestBody;
-    const client = await getClient();
+    const client = ctx.client;
     const result = await client.outboxAttachment.mint({
         accountConfigId,
         outboxMessageId,
@@ -65,11 +62,10 @@ export const mintOutboxAttachment = async (context, ...args) => {
  * this call is the first the API hears of the bytes, and the client's word for
  * how many there are is not evidence.
  */
-export const completeOutboxAttachment = async (context, ...args) => {
-    const event = args[0];
-    const accountConfigId = getAccountConfigIdFromEvent(event);
+export const completeOutboxAttachment = async (context, ctx) => {
+    const accountConfigId = ctx.identity.accountConfigId;
     const { outboxMessageId, outboxAttachmentId } = context.request.params;
-    const client = await getClient();
+    const client = ctx.client;
     const result = await client.outboxAttachment.complete({
         accountConfigId,
         outboxMessageId,
@@ -77,5 +73,5 @@ export const completeOutboxAttachment = async (context, ...args) => {
     });
     if (result.outcome === "Rejected")
         return refuse(result.rejection);
-    return toOutboxAttachmentResponse(result.attachment);
+    return toOutboxAttachmentResponse(ctx.config)(result.attachment);
 };

package/dist/src/handlers/outbox.d.ts

@@ -1,4 +1,25 @@
-import type { OperationHandler, OutboxAttachmentOperationIds, OutboxDetailOperationIds, OutboxOperationIds } from "../types.js";
-export declare const OutboxOperations: Record<OutboxOperationIds, OperationHandler<OutboxOperationIds>>;
-export declare const OutboxDetailOperations: Record<OutboxDetailOperationIds, OperationHandler<OutboxDetailOperationIds>>;
-export declare const OutboxAttachmentOperations: Record<OutboxAttachmentOperationIds, OperationHandler<OutboxAttachmentOperationIds>>;
+import type { OutboxMessageResponse } from "@remit/api-openapi-types";
+import type { Context } from "openapi-backend";
+import type { HandlerContext } from "../types.js";
+export declare const OutboxOperations: {
+    OutboxOperations_createOutboxMessage: (context: Context, ctx: HandlerContext<"smtp">) => Promise<OutboxMessageResponse>;
+    OutboxOperations_listOutboxMessages: (context: Context, ctx: HandlerContext) => Promise<{
+        items: never[];
+        continuationToken: null;
+    } | {
+        items: import("@remit/api-openapi-types").Components.Schemas.OutboxMessageResponse[];
+        continuationToken: string | undefined;
+    }>;
+};
+export declare const OutboxDetailOperations: {
+    OutboxDetailOperations_getOutboxMessage: (context: Context, ctx: HandlerContext) => Promise<OutboxMessageResponse>;
+    OutboxDetailOperations_updateOutboxMessage: (context: Context, ctx: HandlerContext<"smtp">) => Promise<OutboxMessageResponse>;
+    OutboxDetailOperations_deleteOutboxMessage: (context: Context, ctx: HandlerContext<"smtp">) => Promise<{
+        statusCode: number;
+    }>;
+    OutboxDetailOperations_sendOutboxMessage: (context: Context, ctx: HandlerContext<"smtp">) => Promise<OutboxMessageResponse>;
+    OutboxDetailOperations_mintOutboxAttachment: (context: Context, ctx: HandlerContext) => Promise<import("@remit/api-openapi-types").MintOutboxAttachmentResponse | import("./outbox-attachment.js").RejectionResponse>;
+};
+export declare const OutboxAttachmentOperations: {
+    OutboxAttachmentOperations_completeOutboxAttachment: (context: Context, ctx: HandlerContext) => Promise<import("@remit/api-openapi-types").OutboxAttachmentResponse | import("./outbox-attachment.js").RejectionResponse>;
+};

package/dist/src/handlers/outbox.js

@@ -1,9 +1,7 @@
 import { ForbiddenError } from "@remit/data-ports/errors";
-import { getAccountConfigIdFromEvent } from "../auth.js";
-import { getClient } from "../service/data-client.js";
 import { completeOutboxAttachment, mintOutboxAttachment, toOutboxAttachmentResponse, } from "./outbox-attachment.js";
-const toOutboxMessageResponse = (item, attachments = []) => ({
-    attachments: attachments.map(toOutboxAttachmentResponse),
+const toOutboxMessageResponse = (config, item, attachments = []) => ({
+    attachments: attachments.map(toOutboxAttachmentResponse(config)),
     outboxMessageId: item.outboxMessageId,
     accountId: item.accountId,
     fromAddress: item.fromAddress,
@@ -23,11 +21,10 @@ const toOutboxMessageResponse = (item, attachments = []) => ({
     updatedAt: item.updatedAt,
 });
 export const OutboxOperations = {
-    OutboxOperations_createOutboxMessage: async (_context, ...args) => {
-        const event = args[0];
-        const accountConfigId = getAccountConfigIdFromEvent(event);
-        const input = JSON.parse(event.body ?? "{}");
-        const client = await getClient();
+    OutboxOperations_createOutboxMessage: async (context, ctx) => {
+        const accountConfigId = ctx.identity.accountConfigId;
+        const input = context.request.requestBody;
+        const client = ctx.client;
         const account = await client.account.get(input.accountId);
         if (account.accountConfigId !== accountConfigId) {
             throw new ForbiddenError(`Account ${input.accountId} not in account config`);
@@ -47,7 +44,7 @@ export const OutboxOperations = {
                 inReplyTo: input.inReplyTo,
                 references: input.references,
             });
-            return toOutboxMessageResponse(outbox);
+            return toOutboxMessageResponse(ctx.config, outbox);
         }
         const outbox = await client.outboxQueue.createDraft({
             accountId: input.accountId,
@@ -62,41 +59,38 @@ export const OutboxOperations = {
             inReplyTo: input.inReplyTo,
             references: input.references,
         });
-        return toOutboxMessageResponse(outbox);
+        return toOutboxMessageResponse(ctx.config, outbox);
     },
-    OutboxOperations_listOutboxMessages: async (context, ...args) => {
-        const event = args[0];
-        const accountConfigId = getAccountConfigIdFromEvent(event);
+    OutboxOperations_listOutboxMessages: async (context, ctx) => {
+        const accountConfigId = ctx.identity.accountConfigId;
         const { continuationToken } = context.request.query;
-        const client = await getClient();
+        const client = ctx.client;
         const accounts = await client.account.listAllByAccountConfig(accountConfigId);
         if (accounts.length === 0) {
             return { items: [], continuationToken: null };
         }
         const result = await client.outboxMessage.listByAccounts(accounts.map((account) => account.accountId), { continuationToken });
         return {
-            items: result.items.map((item) => toOutboxMessageResponse(item)),
+            items: result.items.map((item) => toOutboxMessageResponse(ctx.config, item)),
             continuationToken: result.continuationToken,
         };
     },
 };
 export const OutboxDetailOperations = {
-    OutboxDetailOperations_getOutboxMessage: async (context, ...args) => {
-        const event = args[0];
-        const accountConfigId = getAccountConfigIdFromEvent(event);
+    OutboxDetailOperations_getOutboxMessage: async (context, ctx) => {
+        const accountConfigId = ctx.identity.accountConfigId;
         const { outboxMessageId } = context.request.params;
-        const client = await getClient();
+        const client = ctx.client;
         // Default mode "read": the scoped get refuses a foreign message with
         // NotFound (404, no existence leak) — no separate check needed.
         const outbox = await client.outboxMessage.get(accountConfigId, outboxMessageId);
-        return toOutboxMessageResponse(outbox, await client.outboxAttachment.listFor(accountConfigId, outboxMessageId));
+        return toOutboxMessageResponse(ctx.config, outbox, await client.outboxAttachment.listFor(accountConfigId, outboxMessageId));
     },
-    OutboxDetailOperations_updateOutboxMessage: async (context, ...args) => {
-        const event = args[0];
-        const accountConfigId = getAccountConfigIdFromEvent(event);
+    OutboxDetailOperations_updateOutboxMessage: async (context, ctx) => {
+        const accountConfigId = ctx.identity.accountConfigId;
         const { outboxMessageId } = context.request.params;
         const input = context.request.requestBody;
-        const client = await getClient();
+        const client = ctx.client;
         // updateDraft's own scoped get uses mode "act": a foreign message is
         // denied with Forbidden (403), not feigned as NotFound.
         const updated = await client.outboxQueue.updateDraft(accountConfigId, outboxMessageId, {
@@ -115,27 +109,25 @@ export const OutboxDetailOperations = {
         if (input.attachmentIds !== undefined) {
             await client.outboxAttachment.retainOnly(accountConfigId, updated.accountId, outboxMessageId, input.attachmentIds);
         }
-        return toOutboxMessageResponse(updated, await client.outboxAttachment.listFor(accountConfigId, outboxMessageId));
+        return toOutboxMessageResponse(ctx.config, updated, await client.outboxAttachment.listFor(accountConfigId, outboxMessageId));
     },
-    OutboxDetailOperations_deleteOutboxMessage: async (context, ...args) => {
-        const event = args[0];
-        const accountConfigId = getAccountConfigIdFromEvent(event);
+    OutboxDetailOperations_deleteOutboxMessage: async (context, ctx) => {
+        const accountConfigId = ctx.identity.accountConfigId;
         const { outboxMessageId } = context.request.params;
-        const client = await getClient();
+        const client = ctx.client;
         // deleteDraft's own scoped get uses mode "act": a foreign message is
         // denied with Forbidden (403), not feigned as NotFound.
         await client.outboxQueue.deleteDraft(accountConfigId, outboxMessageId);
         return { statusCode: 204 };
     },
-    OutboxDetailOperations_sendOutboxMessage: async (context, ...args) => {
-        const event = args[0];
-        const accountConfigId = getAccountConfigIdFromEvent(event);
+    OutboxDetailOperations_sendOutboxMessage: async (context, ctx) => {
+        const accountConfigId = ctx.identity.accountConfigId;
         const { outboxMessageId } = context.request.params;
-        const client = await getClient();
+        const client = ctx.client;
         // send's own scoped get uses mode "act": a foreign message is denied
         // with Forbidden (403), not feigned as NotFound.
         const sent = await client.outboxQueue.send(accountConfigId, outboxMessageId);
-        return toOutboxMessageResponse(sent);
+        return toOutboxMessageResponse(ctx.config, sent);
     },
     OutboxDetailOperations_mintOutboxAttachment: mintOutboxAttachment,
 };

package/dist/src/handlers/sync.d.ts

@@ -1,9 +1,9 @@
-import type { SQSClient } from "@aws-sdk/client-sqs";
+import type { FifoQueueProducer } from "@remit/data-ports";
 import { type FireAndForgetLogger } from "../service/fire-and-forget.js";
-import type { OperationHandler, SyncOperationIds } from "../types.js";
+import { type SyncMailboxesEvent } from "../service/trigger-sync.js";
+import type { HandlerContext } from "../types.js";
 interface SyncTriggerDeps {
-    sqsClient: SQSClient;
-    queueUrl: string;
+    queue: FifoQueueProducer<SyncMailboxesEvent>;
     logger: FireAndForgetLogger & {
         info: (fields: Record<string, unknown>, message: string) => void;
     };
@@ -23,6 +23,19 @@ interface SyncTriggerDeps {
  * loudly with the alertable structured fields, and resolves to void. A genuine
  * account-lookup / ownership failure still propagates and 500s as normal.
  */
-export declare const triggerSyncSafe: (accountId: string, accountConfigId: string, deps?: SyncTriggerDeps) => Promise<void>;
-export declare const SyncOperations: Record<SyncOperationIds, OperationHandler<SyncOperationIds>>;
+export declare const triggerSyncSafe: (accountId: string, accountConfigId: string, deps: SyncTriggerDeps) => Promise<void>;
+export declare const SyncOperations: {
+    SyncOperations_triggerSync: (context: import("openapi-backend").Context<any, any, any, any, any, import("openapi-backend").Document>, ctx: HandlerContext<"sync">) => Promise<{
+        triggered: boolean;
+        message: string;
+    }>;
+    SyncOperations_getSyncStatus: (context: import("openapi-backend").Context<any, any, any, any, any, import("openapi-backend").Document>, ctx: HandlerContext) => Promise<{
+        accountId: string;
+        syncPhase: "error" | "idle" | "discovering_mailboxes" | "syncing_inbox" | "syncing_others" | "complete" | undefined;
+        mailboxCountTotal: number | undefined;
+        mailboxCountSynced: number | undefined;
+        lastSyncAt: number | undefined;
+        mailboxes: import("./sync-progress.js").MailboxSyncProgress[];
+    }>;
+};
 export {};

package/dist/src/handlers/sync.js

@@ -1,18 +1,9 @@
 import { logger } from "@remit/logger";
 import { ownedAccount } from "@remit/mailbox-service";
-import { env } from "expect-env";
-import { getAccountConfigIdFromEvent } from "../auth.js";
-import { getClient } from "../service/data-client.js";
 import { fireAndForget, } from "../service/fire-and-forget.js";
 import { unwrap } from "../service/refusal.js";
-import { sqsClient } from "../service/sqs.js";
-import { triggerAccountSync } from "../service/trigger-sync.js";
+import { triggerAccountSync, } from "../service/trigger-sync.js";
 import { toMailboxSyncProgress } from "./sync-progress.js";
-const defaultSyncTriggerDeps = () => ({
-    sqsClient,
-    queueUrl: env.SQS_QUEUE_URL,
-    logger,
-});
 /**
  * Fire-and-forget enqueue for the POST /sync kick.
  *
@@ -28,11 +19,10 @@ const defaultSyncTriggerDeps = () => ({
  * loudly with the alertable structured fields, and resolves to void. A genuine
  * account-lookup / ownership failure still propagates and 500s as normal.
  */
-export const triggerSyncSafe = async (accountId, accountConfigId, deps = defaultSyncTriggerDeps()) => {
+export const triggerSyncSafe = async (accountId, accountConfigId, deps) => {
     await fireAndForget(async () => {
         const { eventId } = await triggerAccountSync({
-            sqsClient: deps.sqsClient,
-            queueUrl: deps.queueUrl,
+            queue: deps.queue,
             accountId,
             // POST /sync asks for a sync of this account by name — the refresh
             // control, pull-to-refresh, and the client's automatic poll all land
@@ -49,23 +39,24 @@ export const triggerSyncSafe = async (accountId, accountConfigId, deps = default
     });
 };
 export const SyncOperations = {
-    SyncOperations_triggerSync: async (context, ...args) => {
-        const event = args[0];
-        const accountConfigId = getAccountConfigIdFromEvent(event);
+    SyncOperations_triggerSync: async (context, ctx) => {
+        const accountConfigId = ctx.identity.accountConfigId;
         const { accountId } = context.request.params;
-        const account = await (await getClient()).account.get(accountId);
+        const account = await ctx.client.account.get(accountId);
         unwrap(ownedAccount(account, accountConfigId, "act"));
-        void triggerSyncSafe(account.accountId, accountConfigId);
+        void triggerSyncSafe(account.accountId, accountConfigId, {
+            queue: ctx.client.queues.sync,
+            logger,
+        });
         return {
             triggered: true,
             message: `Sync triggered for account ${accountId}`,
         };
     },
-    SyncOperations_getSyncStatus: async (context, ...args) => {
-        const event = args[0];
-        const accountConfigId = getAccountConfigIdFromEvent(event);
+    SyncOperations_getSyncStatus: async (context, ctx) => {
+        const accountConfigId = ctx.identity.accountConfigId;
         const { accountId } = context.request.params;
-        const client = await getClient();
+        const client = ctx.client;
         const account = await client.account.get(accountId);
         unwrap(ownedAccount(account, accountConfigId, "read"));
         // Collect all mailboxes (read-only — does not write or contend with sync lock)

package/dist/src/handlers/system-update.js

@@ -2,15 +2,11 @@ import { randomUUID } from "node:crypto";
 import { readFileSync, renameSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { ConflictError, HTTPError } from "@remit/data-ports/errors";
-import { getSubFromEvent } from "../auth.js";
 import { defaultErrorCode } from "../error.js";
 class TargetVersionMismatchError extends HTTPError {
     name = "TargetVersionMismatchError";
     statusCode = 422;
 }
-const DEFAULT_CONTROL_DIR = "/data/control";
-const controlDir = () => process.env.REMIT_UPDATE_CONTROL_DIR ?? DEFAULT_CONTROL_DIR;
-const manifestUrl = () => process.env.REMIT_UPDATE_MANIFEST_URL;
 /**
  * The running version is a fact the updater owns: it reads the tag from `.env`
  * and writes it into `state.json`, which is the only honest source across an
@@ -33,24 +29,23 @@ const refuse = (statusCode, message) => ({
     body: { code: defaultErrorCode(statusCode), message },
 });
 const notFound = () => refuse(404, "Not found");
-const unauthorized = () => refuse(401, "Unauthorized");
 /**
  * The self-update seam is off unless a manifest URL is configured (RFC 037 D8),
  * which the hosted deployment leaves unset. Both endpoints answer 404 in that
  * case. Where it is on, any authenticated caller may use it — the account list
  * is the trust boundary of a self-hosted instance.
  */
-const guardManifestConfigured = () => manifestUrl() ? null : notFound();
+const guardManifestConfigured = (config) => config.selfUpdate === "Enabled" ? null : notFound();
 /**
  * Read `state.json` off the control volume. A missing file is an instance that
  * has never checked or updated (RFC 037 D8), not an error, so it reads as
  * `null`; the caller renders the disabled/empty resource. Any other read or
  * parse failure propagates.
  */
-const readState = () => {
+const readState = (controlDir) => {
     let raw;
     try {
-        raw = readFileSync(join(controlDir(), "state.json"), "utf8");
+        raw = readFileSync(join(controlDir, "state.json"), "utf8");
     }
     catch (error) {
         if (error.code === "ENOENT")
@@ -78,8 +73,7 @@ const checkedVersion = (state) => state?.check.status === "ok" ? state.check.lat
  * so the backend never writes one. The temp file sits in the same directory as
  * the target for the rename to be atomic on one filesystem.
  */
-const writeRequest = (request) => {
-    const dir = controlDir();
+const writeRequest = (dir, request) => {
     const tmp = join(dir, `.request.json.${request.runId}.tmp`);
     writeFileSync(tmp, JSON.stringify(request), { mode: 0o644 });
     renameSync(tmp, join(dir, "request.json"));
@@ -91,8 +85,7 @@ const writeRequest = (request) => {
  * request.json it is written atomically and carries no authority: its presence
  * is the whole message, so it is empty.
  */
-const writeCheckRequest = () => {
-    const dir = controlDir();
+const writeCheckRequest = (dir) => {
     const tmp = join(dir, `.check-request.json.tmp`);
     writeFileSync(tmp, JSON.stringify({}), { mode: 0o644 });
     renameSync(tmp, join(dir, "check-request.json"));
@@ -123,13 +116,10 @@ const requestedResource = (state, runId, targetVersion, requestedAt) => {
     };
 };
 export const SystemOperations = {
-    SystemOperations_getSystemUpdate: async (context, ...args) => {
-        const offSurface = guardManifestConfigured();
+    SystemOperations_getSystemUpdate: async (context, ctx) => {
+        const offSurface = guardManifestConfigured(ctx.config);
         if (offSurface)
             return offSurface;
-        const event = args[0];
-        if (!getSubFromEvent(event))
-            return unauthorized();
         // A refresh asks for a fresh answer, and only the updater can fetch one, so
         // the request goes on the control seam for its watch loop to pick up (#599).
         // The answer is the stored state as it stands, `lastCheckedAt` included: the
@@ -137,19 +127,16 @@ export const SystemOperations = {
         // response never has to claim a verdict the updater has not reached.
         const { refresh } = context.request.query;
         if (refresh === true)
-            writeCheckRequest();
-        return readState() ?? emptyResource();
+            writeCheckRequest(ctx.config.updateControlDir);
+        return readState(ctx.config.updateControlDir) ?? emptyResource();
     },
-    SystemOperations_applySystemUpdate: async (context, ...args) => {
-        const offSurface = guardManifestConfigured();
+    SystemOperations_applySystemUpdate: async (context, ctx) => {
+        const offSurface = guardManifestConfigured(ctx.config);
         if (offSurface)
             return offSurface;
-        const event = args[0];
-        const sub = getSubFromEvent(event);
-        if (!sub)
-            return unauthorized();
+        const sub = ctx.identity.sub;
         const { targetVersion } = context.request.requestBody;
-        const state = readState();
+        const state = readState(ctx.config.updateControlDir);
         if (isRunInFlight(state?.run)) {
             throw new ConflictError("An update is already in progress.");
         }
@@ -158,7 +145,7 @@ export const SystemOperations = {
         }
         const runId = randomUUID();
         const requestedAt = new Date().toISOString();
-        writeRequest({
+        writeRequest(ctx.config.updateControlDir, {
             runId,
             targetVersion,
             requestedAt,

package/dist/src/handlers/thread.js

@@ -1,9 +1,7 @@
 import { NotFoundError } from "@remit/data-ports/errors";
 import { isValidMessageId } from "@remit/data-ports/id";
-import { getAccountConfigIdFromEvent } from "../auth.js";
 import { enrichThreadRows, } from "../derive/enrichThreadRows.js";
 import { filterByOffRowCriteria, hasOffRowCriteria, } from "../derive/filterThreadCriteria.js";
-import { getClient } from "../service/data-client.js";
 const DEFAULT_THREADS_PAGE_SIZE = 50;
 // Project to fields used by ListThreadsResponse — keep in sync with handler mapping.
 // Includes ThreadMessage table key fields (accountConfigId, threadMessageId) and
@@ -183,12 +181,11 @@ export const dedupeThreadMessages = (rows) => {
     });
 };
 export const ThreadOperations = {
-    ThreadOperations_listThreads: async (context, ...args) => {
-        const event = args[0];
-        const accountConfigId = getAccountConfigIdFromEvent(event);
+    ThreadOperations_listThreads: async (context, ctx) => {
+        const accountConfigId = ctx.identity.accountConfigId;
         const { mailboxId } = context.request.params;
         const { continuationToken, order } = context.request.query;
-        const client = await getClient();
+        const client = ctx.client;
         const result = await client.threadMessage.listByMailbox(accountConfigId, mailboxId, buildListThreadsOptions({ continuationToken, order }));
         const items = await enrichThreadRows(result.items, client, accountConfigId);
         return {
@@ -196,12 +193,11 @@ export const ThreadOperations = {
             continuationToken: result.continuationToken,
         };
     },
-    ThreadOperations_searchThreads: async (context, ...args) => {
-        const event = args[0];
-        const accountConfigId = getAccountConfigIdFromEvent(event);
+    ThreadOperations_searchThreads: async (context, ctx) => {
+        const accountConfigId = ctx.identity.accountConfigId;
         const { mailboxId } = context.request.params;
         const raw = context.request.query;
-        return executeThreadSearch(await getClient(), accountConfigId, mailboxId, {
+        return executeThreadSearch(ctx.client, accountConfigId, mailboxId, {
             ...raw,
             senderTrust: toArray(raw.senderTrust),
             category: toArray(raw.category),
@@ -209,12 +205,11 @@ export const ThreadOperations = {
     },
 };
 export const ThreadDetailOperations = {
-    ThreadDetailOperations_listThreadMessages: async (context, ...args) => {
-        const event = args[0];
-        const accountConfigId = getAccountConfigIdFromEvent(event);
+    ThreadDetailOperations_listThreadMessages: async (context, ctx) => {
+        const accountConfigId = ctx.identity.accountConfigId;
         const { threadId } = context.request.params;
         const { order } = context.request.query;
-        const client = await getClient();
+        const client = ctx.client;
         const result = await client.threadMessage.listByThread(threadId, accountConfigId, buildListThreadMessagesOptions({ order }));
         // Defense-in-depth: the query is already scoped to accountConfigId; assert
         // no foreign row slips into the response. `read`-class → 404, no existence

package/dist/src/handlers/unified-threads.js

@@ -1,9 +1,7 @@
 import { isVirtualCopyMailbox } from "@remit/data-ports/virtual-copy";
 import { MailboxSpecialUse } from "@remit/domain-enums";
 import pMap from "p-map";
-import { getAccountConfigIdFromEvent } from "../auth.js";
 import { enrichThreadRows, } from "../derive/enrichThreadRows.js";
-import { getClient } from "../service/data-client.js";
 import { groupAccountOverrides, groupMailboxOverrides, } from "./account-overrides.js";
 const DEFAULT_UNIFIED_THREADS_PAGE_SIZE = 50;
 const MAILBOX_LIST_CONCURRENCY = 5;
@@ -374,9 +372,8 @@ const toBoolean = (value) => {
     return undefined;
 };
 export const UnifiedThreadOperations = {
-    UnifiedThreadOperations_listAllThreads: async (context, ...args) => {
-        const event = args[0];
-        const accountConfigId = getAccountConfigIdFromEvent(event);
+    UnifiedThreadOperations_listAllThreads: async (context, ctx) => {
+        const accountConfigId = ctx.identity.accountConfigId;
         const { continuationToken, order, limit, starred, query, from, subject, accountId, mailboxId, category, unread, attachments, muted, count, results, } = context.request.query;
         // Whitespace-only text is not a search: it would widen the scope to every
         // folder while matching nothing in particular. The two field parameters
@@ -384,7 +381,7 @@ export const UnifiedThreadOperations = {
         const searchText = query?.trim();
         const fromText = from?.trim();
         const subjectText = subject?.trim();
-        return executeUnifiedThreadListing(await getClient(), accountConfigId, {
+        return executeUnifiedThreadListing(ctx.client, accountConfigId, {
             continuationToken,
             order,
             limit,

package/dist/src/index.d.ts

@@ -1,2 +1,5 @@
-export { api, handleApiEvent, OpenAPISpec } from "./api.js";
+export { OpenAPISpec } from "./api.js";
+export { configFromEnv } from "./config/from-env.js";
+export { createApiEventHandler } from "./lambda.js";
+export declare const handleApiEvent: import("./lambda.js").ApiEventHandler;
 export declare const handler: (event: import("aws-lambda").APIGatewayProxyEvent, context: import("aws-lambda").Context) => Promise<import("aws-lambda").APIGatewayProxyResult>;