Mail — /api/mail*
The framework's internal mail surface. Postgres-backed, with subjects, bodies and attachment JSON encrypted at rest (AES-256-GCM); long bodies are zlib-deflated before encryption. Routing happens by alias lookup — your public handle stays plaintext (it's a chosen address, not PII), everything else is sealed.
Concept: Zeq Mail.
Source: shared/api-core/src/routes/mail.ts.
Endpoints
| Method | Path | Auth | Notes |
|---|---|---|---|
GET | /api/mail/stats | Bearer (session) | Unread count + folder totals. |
GET | /api/mail/inbox | Bearer (session) | Inbox listing (decrypted on read). |
GET | /api/mail/sent | Bearer (session) | Sent listing. |
GET | /api/mail/contacts | Bearer (session) | Address-book contacts. |
GET | /api/mail/aliases | Bearer (session) | Your routing aliases. |
POST | /api/mail/aliases | Bearer (session) | Register a new alias. |
DELETE | /api/mail/aliases/:id | Bearer (session) | Remove an alias. |
GET | /api/mail/message/:id | Bearer (session) | One message, decrypted. |
PATCH | /api/mail/message/:id | Bearer (session) | Update flags (read, starred, folder). |
POST | /api/mail/send | Bearer (session) | Compose + deliver to an alias. |
Every route requires a live session — no anonymous access.