@remit/mailbox-service 0.0.111 → 0.0.113

package/package.json

@@ -1,75 +1,88 @@
 {
-  "name": "@remit/mailbox-service",
-  "version": "0.0.111",
-  "type": "module",
-  "main": "src/index.ts",
-  "types": "src/index.ts",
-  "exports": {
-    ".": {
-      "types": "./src/index.ts",
-      "default": "./src/index.ts"
-    },
-    "./filter-config": {
-      "types": "./src/filters/filter-config.ts",
-      "default": "./src/filters/filter-config.ts"
-    },
-    "./body-sync-queue": {
-      "types": "./src/body-sync-queue.ts",
-      "default": "./src/body-sync-queue.ts"
-    },
-    "./imapflow-connection": {
-      "types": "./src/imapflow-connection.ts",
-      "default": "./src/imapflow-connection.ts"
-    },
-    "./account-credentials": {
-      "types": "./src/account-credentials.ts",
-      "default": "./src/account-credentials.ts"
-    },
-    "./outbox-attachment-content": {
-      "types": "./src/outbox-attachment-content.ts",
-      "default": "./src/outbox-attachment-content.ts"
-    },
-    "./types": {
-      "types": "./src/types.ts",
-      "default": "./src/types.ts"
-    }
-  },
-  "scripts": {
-    "test:typecheck": "tsgo --noEmit",
-    "test:run": "node $NODE_TEST_FLAGS --env-file=../../localhost-test-unit.env --import tsx --experimental-test-coverage --test-coverage-include='src/**' --test-coverage-exclude='src/**/*.test.ts' --test-coverage-exclude='src/**/*.test.tsx' --test-coverage-lines=86 --test 'src/**/*.test.ts'",
-    "test:integ": "RUN_INTEG_TESTS=1 node --env-file=../../localhost-test-unit.env --import tsx --test 'src/**/*.integ.test.ts'",
-    "test:e2e": "RUN_E2E_TESTS=1 node --env-file=../../localhost-test-e2e.env --import tsx --test --test-concurrency=1 'src/**/*.e2e.test.ts'",
-    "test": "npm run test:typecheck && npm run test:run"
-  },
-  "dependencies": {
-    "imapflow": "^1.3.3",
-    "mailparser": "^3.9.14",
-    "nodemailer": "^9.0.3",
-    "p-map": "^7.0.4",
-    "tldts": "^7.4.9",
-    "@remit/data-ports": "*",
-    "@remit/domain-enums": "*",
-    "@remit/mail-oauth-service": "*",
-    "@remit/search-service": "*",
-    "@remit/secrets-service": "*",
-    "@remit/sqs-client": "*",
-    "@remit/storage-service": "*",
-    "@aws-sdk/client-sqs": "*",
-    "franc": "*",
-    "natural": "^8.1.1",
-    "stopword": "*",
-    "@types/mailparser": "*",
-    "@types/nodemailer": "*",
-    "@types/stopword": "^2.0.3",
-    "@remit/calendar-service": "*"
-  },
-  "license": "MIT",
-  "publishConfig": {
-    "access": "public"
-  },
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/remit-mail/reader.git",
-    "directory": "packages/mailbox-service"
-  }
+	"name": "@remit/mailbox-service",
+	"version": "0.0.113",
+	"type": "module",
+	"main": "dist/index.js",
+	"types": "dist/index.d.ts",
+	"exports": {
+		".": {
+			"types": "./dist/index.d.ts",
+			"default": "./dist/index.js"
+		},
+		"./filter-config": {
+			"types": "./dist/filters/filter-config.d.ts",
+			"default": "./dist/filters/filter-config.js"
+		},
+		"./body-sync-queue": {
+			"types": "./dist/body-sync-queue.d.ts",
+			"default": "./dist/body-sync-queue.js"
+		},
+		"./imapflow-connection": {
+			"types": "./dist/imapflow-connection.d.ts",
+			"default": "./dist/imapflow-connection.js"
+		},
+		"./account-credentials": {
+			"types": "./dist/account-credentials.d.ts",
+			"default": "./dist/account-credentials.js"
+		},
+		"./outbox-attachment-content": {
+			"types": "./dist/outbox-attachment-content.d.ts",
+			"default": "./dist/outbox-attachment-content.js"
+		},
+		"./types": {
+			"types": "./dist/types.d.ts",
+			"default": "./dist/types.js"
+		},
+		"./test-helpers/fake-imap": {
+			"types": "./dist/test-helpers/fake-imap.d.ts",
+			"default": "./dist/test-helpers/fake-imap.js"
+		},
+		"./test-helpers/test-store": {
+			"types": "./dist/test-helpers/test-store.d.ts",
+			"default": "./dist/test-helpers/test-store.js"
+		}
+	},
+	"scripts": {
+		"prepack": "node ../../npm-scripts/pack-dist.mjs prepack",
+		"postpack": "node ../../npm-scripts/pack-dist.mjs postpack",
+		"test:typecheck": "tsgo --noEmit",
+		"test:run": "node $NODE_TEST_FLAGS --env-file=../../localhost-test-unit.env --import tsx --experimental-test-coverage --test-coverage-include='src/**' --test-coverage-exclude='src/**/*.test.ts' --test-coverage-exclude='src/**/*.test.tsx' --test-coverage-lines=86 --test 'src/**/*.test.ts'",
+		"test": "npm run test:typecheck && npm run test:run"
+	},
+	"devDependencies": {
+		"@remit/drizzle-service": "*",
+		"@types/better-sqlite3": "^7.6.13",
+		"better-sqlite3": "^12.11.1"
+	},
+	"dependencies": {
+		"imapflow": "^1.3.3",
+		"mailparser": "3.12.2",
+		"nodemailer": "^10.0.6",
+		"p-map": "^7.0.4",
+		"tldts": "^7.4.9",
+		"@remit/data-ports": "*",
+		"@remit/domain-enums": "*",
+		"@remit/mail-oauth-service": "*",
+		"@remit/secrets-service": "*",
+		"@remit/storage-service": "*",
+		"franc": "^6.2.0",
+		"natural": "^8.1.1",
+		"stopword": "^3.1.5",
+		"@types/mailparser": "^3.4.6",
+		"@types/nodemailer": "^8.0.1",
+		"@types/stopword": "^2.0.3",
+		"@remit/calendar-service": "*"
+	},
+	"license": "MIT",
+	"publishConfig": {
+		"access": "public"
+	},
+	"repository": {
+		"type": "git",
+		"url": "git+https://github.com/remit-mail/reader.git",
+		"directory": "packages/mailbox-service"
+	},
+	"files": [
+		"dist"
+	]
 }

package/src/account-credentials.ts

@@ -1,210 +0,0 @@
-/**
- * account-credentials.ts
- *
- * Single place in the codebase that branches on account.authType.
- * All sync handlers (IMAP, SMTP) must call resolveConnectionCredentials
- * rather than duplicating credential logic.
- *
- * Grep-verifiable constraint: `account.authType` must only appear here.
- */
-
-import type { AccountItem } from "@remit/data-ports";
-import { AccountAuthType, ConnectionState } from "@remit/domain-enums";
-import type { MailOAuthService } from "@remit/mail-oauth-service";
-import { RefreshTokenError } from "@remit/mail-oauth-service";
-import {
-	deserializeEncryptedPayload,
-	type SecretsService,
-	serializeEncryptedPayload,
-} from "@remit/secrets-service";
-import type { MailCredentials } from "./types.js";
-
-/** ConnectionState is a const object (not a TS enum); this is its value type. */
-export type ConnectionStateValue =
-	(typeof ConnectionState)[keyof typeof ConnectionState];
-
-/**
- * The fields that say whether an account holds a credential at all. Narrower
- * than AccountItem so a caller holding only an account summary can ask.
- */
-export type StoredCredentialFields = Partial<
-	Pick<AccountItem, "authType" | "passwordHash" | "oauthRefreshTokenHash">
->;
-
-/**
- * No credential of the kind this account's authType needs is stored. An
- * imported account holds none by design until its owner types one, so this is
- * a normal state of the world rather than a fault: no retry can change it, and
- * it is distinct from a credential the mail server rejected.
- *
- * `terminalState` is the connectionState that describes the account while it
- * stays this way, decided here so nothing downstream branches on authType.
- */
-export interface MissingCredential {
-	readonly status: "missing";
-	readonly terminalState: ConnectionStateValue;
-	readonly reason: string;
-}
-
-export type CredentialResolution =
-	| { readonly status: "resolved"; readonly credentials: MailCredentials }
-	| MissingCredential;
-
-type StoredCredential =
-	| { readonly status: "password"; readonly passwordHash: string }
-	| { readonly status: "oauthMicrosoft"; readonly refreshTokenHash: string }
-	| MissingCredential;
-
-const readStoredCredential = (
-	account: StoredCredentialFields,
-): StoredCredential => {
-	const authType = account.authType ?? AccountAuthType.Password;
-
-	if (authType === AccountAuthType.OauthMicrosoft) {
-		if (!account.oauthRefreshTokenHash) {
-			return {
-				status: "missing",
-				terminalState: ConnectionState.ReauthRequired,
-				reason: "authType=oauthMicrosoft but no oauthRefreshTokenHash",
-			};
-		}
-		return {
-			status: "oauthMicrosoft",
-			refreshTokenHash: account.oauthRefreshTokenHash,
-		};
-	}
-
-	if (!account.passwordHash) {
-		return {
-			status: "missing",
-			terminalState: ConnectionState.CredentialsMissing,
-			reason: "authType=password but no passwordHash",
-		};
-	}
-	return { status: "password", passwordHash: account.passwordHash };
-};
-
-/**
- * Whether the account holds the credential its authType requires.
- *
- * Keyed on the stored credential, never on `connectionState`: PATCH
- * /accounts/{id} writes a password without clearing `credentials_missing` —
- * only a successful connect clears it, via markAuthenticated — so a
- * state-based check would go on skipping an account that can sync perfectly
- * well.
- */
-export const hasStoredCredential = (account: StoredCredentialFields): boolean =>
-	readStoredCredential(account).status !== "missing";
-
-export interface AccountCredentialsDeps {
-	secrets: Pick<SecretsService, "decrypt" | "encrypt">;
-	tokenService: Pick<MailOAuthService, "getAccessToken">;
-	/**
-	 * Called when the OAuth provider rotated the refresh token.
-	 * Must be awaited BEFORE the credentials are returned so the new token
-	 * is persisted before any IMAP command is issued.
-	 */
-	persistRotatedToken: (
-		accountId: string,
-		encryptedHash: string,
-		updatedAt: number,
-	) => Promise<void>;
-}
-
-/**
- * Resolve IMAP credentials for an account.
- *
- * - Password accounts: decrypt passwordHash → return password credential.
- * - OAuth accounts: decrypt oauthRefreshTokenHash → mint access token via
- *   tokenService.  If the provider rotated the refresh token, persist the
- *   new token via `deps.persistRotatedToken` BEFORE returning credentials.
- *
- * Returns `{ status: "missing" }` when the account stores no credential —
- * an expected outcome every caller settles terminally, never retries.
- *
- * Throws `RefreshTokenError` on OAuth failures; callers should handle:
- * - `kind === "reauth-required"` → set connectionState to reauth_required, ACK
- * - `kind === "transient"` → rethrow (SQS retry)
- * - `kind === "config"` → rethrow (SQS retry / alert)
- */
-export const resolveConnectionCredentials = async (
-	account: AccountItem,
-	deps: AccountCredentialsDeps,
-): Promise<CredentialResolution> => {
-	const stored = readStoredCredential(account);
-
-	if (stored.status === "missing") {
-		return stored;
-	}
-
-	if (stored.status === "oauthMicrosoft") {
-		return {
-			status: "resolved",
-			credentials: await resolveOauthCredentials(
-				account.accountId,
-				stored.refreshTokenHash,
-				deps,
-			),
-		};
-	}
-
-	return {
-		status: "resolved",
-		credentials: await resolvePasswordCredentials(
-			stored.passwordHash,
-			deps.secrets,
-		),
-	};
-};
-
-const resolvePasswordCredentials = async (
-	passwordHash: string,
-	secrets: Pick<SecretsService, "decrypt">,
-): Promise<MailCredentials> => {
-	const password = await secrets.decrypt(
-		deserializeEncryptedPayload(JSON.parse(passwordHash)),
-	);
-	return { kind: "password", password };
-};
-
-const resolveOauthCredentials = async (
-	accountId: string,
-	refreshTokenHash: string,
-	deps: AccountCredentialsDeps,
-): Promise<MailCredentials> => {
-	const refreshToken = await deps.secrets.decrypt(
-		deserializeEncryptedPayload(JSON.parse(refreshTokenHash)),
-	);
-
-	// getAccessToken throws RefreshTokenError on failure
-	const tokenSet = await deps.tokenService.getAccessToken(
-		accountId,
-		refreshToken,
-	);
-
-	// If the provider rotated the refresh token, persist it BEFORE returning.
-	// This guarantees the new token is stored even if a subsequent error occurs.
-	if (tokenSet.refreshToken) {
-		const encryptedPayload = await deps.secrets.encrypt(tokenSet.refreshToken);
-		const encryptedHash = JSON.stringify(
-			serializeEncryptedPayload(encryptedPayload),
-		);
-		await deps.persistRotatedToken(accountId, encryptedHash, Date.now());
-	}
-
-	return { kind: "accessToken", accessToken: tokenSet.accessToken };
-};
-
-/**
- * Build the encrypted hash string for an OAuth refresh token.
- * Helper used when first storing an OAuth token (e.g. after OAuth callback).
- */
-export const encryptRefreshToken = async (
-	refreshToken: string,
-	secrets: Pick<SecretsService, "encrypt">,
-): Promise<string> => {
-	const payload = await secrets.encrypt(refreshToken);
-	return JSON.stringify(serializeEncryptedPayload(payload));
-};
-
-export { ConnectionState, RefreshTokenError };

package/src/adversarial-mime.e2e.test.ts

@@ -1,307 +0,0 @@
-/**
- * E2E adversarial MIME corpus (#402).
- *
- * Each .eml fixture under `test/fixtures/mime-adversarial-e2e/` is APPENDed to
- * the mailfuzz Dovecot INBOX, fetched back via IMAP, then parsed end-to-end
- * with mailparser. The suite asserts the two behaviours called out in #402:
- *
- *   1. body renders            — `parsed.text` or `parsed.html` is non-empty
- *   2. attachments are listable — when the fixture declares attachments, every
- *                                 expected filename appears in `parsed.attachments`
- *                                 with non-zero content length
- *
- * The shapes here are content-driven adversarial cases that real-world senders
- * actually emit (PDF as application/octet-stream, TNEF, nested multipart/related,
- * forwarded message/rfc822, calendar invites, quoted-printable soft breaks,
- * 8-bit UTF-8 bodies, empty text/plain alternatives) — the same class of shape
- * that caused the body-sync regression in #394.
- *
- * Mapper unit-level defence lives in `body-part-mapper.property.test.ts`; this
- * suite is the integration-layer belt-and-braces against the same class.
- */
-
-import assert from "node:assert/strict";
-import { readdirSync, readFileSync } from "node:fs";
-import { dirname, join, resolve } from "node:path";
-import { after, before, describe, test } from "node:test";
-import { fileURLToPath } from "node:url";
-import { type ParsedMail, simpleParser } from "mailparser";
-import { uniqueMailboxName } from "./test-helpers/isolated-mailbox.js";
-import {
-	createMailfuzzConnection,
-	withMailfuzzConnection,
-} from "./test-helpers/mailfuzz-connection.js";
-
-const __filename = fileURLToPath(import.meta.url);
-const __dirname = dirname(__filename);
-const FIXTURES_DIR = resolve(
-	__dirname,
-	"../test/fixtures/mime-adversarial-e2e",
-);
-
-interface AttachmentExpectation {
-	filename: string;
-	contentType?: string;
-}
-
-interface FixtureExpectation {
-	/** Subject must round-trip — proves the message we fetched is the one we appended. */
-	subjectIncludes: string;
-	/** At least one of `text` or `html` must be non-empty after parsing. */
-	bodyRenders: true;
-	/** Attachments expected after parsing. Empty array means "no attachments". */
-	attachments: AttachmentExpectation[];
-	/** Optional substring that must appear in parsed.text or parsed.html. */
-	bodyContains?: string;
-	/**
-	 * Skip the BODYSTRUCTURE re-fetch for this fixture.
-	 * Set when the fixture shape is synthetic and doesn't produce a meaningful
-	 * BODYSTRUCTURE response (e.g. bare TNEF blob — see fixture 05 and #408).
-	 */
-	skipBodyStructure?: true;
-}
-
-/**
- * Expectations indexed by .eml basename. Each fixture must have one entry.
- *
- * Filename is the contract — match it exactly to the file on disk.
- */
-const EXPECTATIONS: Record<string, FixtureExpectation> = {
-	"01-octet-stream-pdf.eml": {
-		subjectIncludes: "Adversarial fixture 01",
-		bodyRenders: true,
-		attachments: [{ filename: "contract.pdf" }],
-		bodyContains: "contract PDF",
-	},
-	"02-nested-related-cid-image.eml": {
-		subjectIncludes: "Adversarial fixture 02",
-		bodyRenders: true,
-		attachments: [
-			{ filename: "logo.png", contentType: "image/png" },
-			{ filename: "invoice.pdf" },
-		],
-		bodyContains: "Inline logo",
-	},
-	"03-calendar-invite.eml": {
-		subjectIncludes: "Adversarial fixture 03",
-		bodyRenders: true,
-		attachments: [{ filename: "invite.ics" }],
-		bodyContains: "Meeting invite",
-	},
-	"04-forwarded-rfc822-with-attachments.eml": {
-		subjectIncludes: "Adversarial fixture 04",
-		bodyRenders: true,
-		// mailparser surfaces the forwarded rfc822 as an attachment whose name
-		// derives from the Content-Disposition filename. The inner pdf is not
-		// surfaced as a top-level attachment because it lives inside the nested
-		// rfc822 — listing the rfc822 itself is the integration-layer contract.
-		attachments: [{ filename: "forwarded.eml" }],
-		bodyContains: "Forwarding",
-	},
-	"05-tnef-winmail.eml": {
-		subjectIncludes: "Adversarial fixture 05",
-		bodyRenders: true,
-		attachments: [{ filename: "winmail.dat" }],
-		bodyContains: "TNEF",
-		// skipBodyStructure: The TNEF fixture uses a synthetic magic-byte stub
-		// rather than a real-world winmail.dat capture, so the BODYSTRUCTURE
-		// returned by Dovecot for this fixture is not meaningful. The re-fetch
-		// is skipped here to avoid asserting on a shape that will change once
-		// the fixture is replaced with a real capture. See #408.
-		skipBodyStructure: true,
-	},
-	"06-8bit-non-ascii.eml": {
-		subjectIncludes: "Café façade",
-		bodyRenders: true,
-		attachments: [],
-		bodyContains: "café",
-	},
-	"07-quoted-printable-soft-breaks.eml": {
-		subjectIncludes: "Adversarial fixture 07",
-		bodyRenders: true,
-		attachments: [],
-		// "single" is split across a soft line break in the encoded source;
-		// only an actually-decoded quoted-printable reassembles it.
-		bodyContains: "single logical line",
-	},
-	"08-alternative-empty-text.eml": {
-		subjectIncludes: "Adversarial fixture 08",
-		bodyRenders: true,
-		attachments: [],
-		// text/plain is empty; rendering must fall back to html.
-		bodyContains: "intentionally empty",
-	},
-};
-
-const listEmlFixtures = (): string[] =>
-	readdirSync(FIXTURES_DIR)
-		.filter((name) => name.endsWith(".eml"))
-		.sort();
-
-const loadFixtureRaw = (name: string): string => {
-	const path = join(FIXTURES_DIR, name);
-	// Read as utf8 — fixture 06 includes raw 8-bit UTF-8 bytes which IMAP
-	// servers accept on APPEND as long as they're valid UTF-8 octets.
-	return readFileSync(path, "utf8");
-};
-
-const bodyText = (parsed: ParsedMail): string => {
-	const text = parsed.text ?? "";
-	const html = typeof parsed.html === "string" ? parsed.html : "";
-	return `${text}\n${html}`;
-};
-
-describe("Adversarial MIME corpus (Dovecot) — #402", {
-	skip: !process.env.RUN_E2E_TESTS,
-}, () => {
-	// Own mailbox instead of the shared INBOX so appending fixtures never
-	// collides with another e2e file's count/flag assertions (#508).
-	const inbox = uniqueMailboxName("E2E_adversarial");
-
-	before(async () => {
-		await withMailfuzzConnection(async (connection) => {
-			await connection.createMailbox(inbox);
-		});
-	});
-
-	after(async () => {
-		const connection = createMailfuzzConnection();
-		await connection.connect();
-		await connection.deleteMailbox(inbox).catch(() => {});
-		if (connection.isConnected) {
-			await connection.disconnect();
-		}
-	});
-
-	// Sanity: every .eml on disk has an expectation entry, and every
-	// expectation entry points at an existing file. Catches a fixture being
-	// added without an assertion (or vice versa).
-	test("every fixture has an expectation entry", () => {
-		const onDisk = new Set(listEmlFixtures());
-		const expected = new Set(Object.keys(EXPECTATIONS));
-		for (const name of onDisk) {
-			assert.ok(
-				expected.has(name),
-				`Fixture ${name} has no expectation entry in EXPECTATIONS`,
-			);
-		}
-		for (const name of expected) {
-			assert.ok(
-				onDisk.has(name),
-				`Expectation ${name} has no .eml file on disk`,
-			);
-		}
-		// Pin the count: #402 calls for 8 adversarial shapes.
-		assert.equal(
-			onDisk.size,
-			8,
-			"Expected exactly 8 adversarial MIME fixtures",
-		);
-	});
-
-	for (const name of Object.keys(EXPECTATIONS).sort()) {
-		const expectation = EXPECTATIONS[name];
-		if (!expectation) continue;
-
-		test(`fixture ${name} round-trips through IMAP and parses`, async () => {
-			const raw = loadFixtureRaw(name);
-
-			await withMailfuzzConnection(async (connection) => {
-				// APPEND the fixture into this file's own mailbox. Mailfuzz uses
-				// Dovecot which returns a proper UID on APPEND (mokapi does not —
-				// see outbox-roundtrip.e2e.test.ts and the RFC 025 notes).
-				const appendResult = await connection.append(inbox, raw);
-				assert.ok(
-					appendResult.uid > 0,
-					`APPEND should return a UID for ${name}`,
-				);
-
-				await connection.openBox(inbox, true);
-
-				// Fetch the message we just appended back. fetchMessageBody
-				// returns the raw RFC822 source; mailparser handles the rest
-				// (multipart walking, base64/qp decoding, charset folding).
-				const rfc822 = await connection.fetchMessageBody(appendResult.uid);
-				assert.ok(
-					rfc822 && rfc822.length > 0,
-					`fetchMessageBody should return bytes for ${name}`,
-				);
-
-				// BODYSTRUCTURE re-fetch: exercises the IMAP mapper path at the
-				// integration boundary (the exact regression class from #394).
-				// Skipped for fixtures with synthetic shapes that don't produce
-				// meaningful BODYSTRUCTURE (see skipBodyStructure flag + #408).
-				// The guard in fetchMessages skips rows with undefined uid/internalDate
-				// so back-to-back FETCH is safe on Dovecot (see imapflow-connection.ts).
-				if (!expectation.skipBodyStructure) {
-					const refetched = await connection.fetchMessages([appendResult.uid]);
-					assert.ok(
-						refetched.length > 0,
-						`BODYSTRUCTURE re-fetch should return a message for ${name}`,
-					);
-					assert.ok(
-						refetched[0]?.bodyStructure != null,
-						`BODYSTRUCTURE should be present for ${name}`,
-					);
-				}
-
-				const parsed = await simpleParser(rfc822);
-
-				// Subject round-trips (proves we fetched the right message and
-				// any encoded-word headers decoded correctly).
-				assert.ok(
-					parsed.subject,
-					`Parsed subject should be present for ${name}`,
-				);
-				assert.ok(
-					parsed.subject?.includes(expectation.subjectIncludes),
-					`Subject "${parsed.subject}" should include "${expectation.subjectIncludes}" for ${name}`,
-				);
-
-				// Body renders — at least one of text/html is non-empty. This
-				// is the headline "body renders" assertion from #402.
-				const text = parsed.text ?? "";
-				const html = typeof parsed.html === "string" ? parsed.html : "";
-				assert.ok(
-					text.trim().length > 0 || html.trim().length > 0,
-					`Body should render (text or html non-empty) for ${name}`,
-				);
-
-				if (expectation.bodyContains) {
-					const haystack = bodyText(parsed).toLowerCase();
-					const needle = expectation.bodyContains.toLowerCase();
-					assert.ok(
-						haystack.includes(needle),
-						`Body should contain "${expectation.bodyContains}" for ${name}`,
-					);
-				}
-
-				// Attachments are listable — every expected attachment appears
-				// in parsed.attachments with a matching filename and non-zero
-				// content length. This is the "attachments listable" half of
-				// the #402 contract.
-				const attachments = parsed.attachments ?? [];
-				for (const expectedAtt of expectation.attachments) {
-					const found = attachments.find(
-						(a) => a.filename === expectedAtt.filename,
-					);
-					assert.ok(
-						found,
-						`Attachment "${expectedAtt.filename}" should be listable for ${name}; got [${attachments.map((a) => a.filename).join(", ")}]`,
-					);
-					assert.ok(
-						(found.size ?? 0) > 0,
-						`Attachment "${expectedAtt.filename}" should have non-zero size for ${name}`,
-					);
-					if (expectedAtt.contentType) {
-						assert.equal(
-							found.contentType,
-							expectedAtt.contentType,
-							`Attachment "${expectedAtt.filename}" should have contentType "${expectedAtt.contentType}" for ${name}`,
-						);
-					}
-				}
-			});
-		});
-	}
-});