@remit/mailbox-service 0.0.112 → 0.0.113

package/dist/body-part-mapper.js

@@ -0,0 +1,301 @@
+/**
+ * Pair every persisted `BodyPart` row with the decoded bytes mailparser
+ * produced for the same MIME node. Total function: returns one
+ * `BodyPartContentPair` per non-multipart leaf, never undefined, never
+ * throws on well-formed input.
+ *
+ * Source of truth (per issue #395):
+ *   - `partPath`, `contentType`, `contentId`, `dispositionFilename`,
+ *     `sizeOctets` — owned by BODYSTRUCTURE (the `BodyPart` row).
+ *   - Decoded bytes — owned by mailparser (`parsed.text`, `parsed.html`,
+ *     `parsed.attachments[i].content`).
+ *   - `parsed.attachments[i].partId` is also dot-numbered (set at runtime
+ *     in `mail-parser.js:860`; missing from `@types/mailparser`; surfaced
+ *     here via `./types/mailparser-augment.d.ts`). Structural pairing on
+ *     `partId === partPath` is the dominant strategy for non-text leaves.
+ *
+ * Pipeline (per leaf in declaration order; each step consumes one
+ * attachment when it pairs, subsequent steps work on the residual set):
+ *   1. text/plain → first leaf gets `parsed.text` (empty Buffer if
+ *      `sizeOctets === 0`); subsequent text/plain leaves get empty.
+ *   2. text/html → first leaf gets `parsed.html` (empty Buffer if
+ *      `sizeOctets === 0`); subsequent text/html leaves get empty.
+ *   3. Non-text leaves with `sizeOctets === 0` short-circuit to an empty
+ *      Buffer without consuming an attachment — symmetric with the text
+ *      path, so the positional fallback can't hand a zero-sized leaf real
+ *      bytes that belong to another leaf.
+ *   4. Remaining non-text leaves try, in order:
+ *      a. `attachment.partId === bodyPart.partPath`
+ *      b. contentId match (case + angle-insensitive)
+ *      c. dispositionFilename match (case-insensitive)
+ *      d. content-type compatibility class: exact → binary-family
+ *         (any non-text/*) → text-family
+ *      e. positional fallback: next unconsumed attachment in declaration
+ *         order. Logs at `debug` so operators can see "we guessed"
+ *         pairings without spamming higher levels.
+ *   5. Anything still unpaired → zero-byte Buffer + structured `warn` log.
+ *
+ * The mapper assumes well-formed input — malformed MIME is rejected
+ * upstream in `mime-walker.ts`. If a leaf truly has no source bytes
+ * available (e.g. mailparser tolerated a malformed message that
+ * BODYSTRUCTURE disagrees with on leaf count), it gets the empty-Buffer
+ * fallback rather than a throw, so the call site stays simple.
+ */
+/// <reference path="./types/mailparser-augment.d.ts" />
+import { Buffer } from "node:buffer";
+import { encapsulatedParts, outermostMessages, ownParts, } from "@remit/data-ports/message-parts";
+import { simpleParser } from "mailparser";
+const EMPTY_BUFFER = Buffer.alloc(0);
+const stripAngles = (value) => value.replace(/^<+|>+$/g, "");
+const buildContentType = (part) => `${part.mediaType.toLowerCase()}/${part.mediaSubtype}`;
+const textToBuffer = (value) => {
+    if (typeof value !== "string" || value.length === 0)
+        return EMPTY_BUFFER;
+    return Buffer.from(value, "utf8");
+};
+const isTextStar = (contentType) => contentType.toLowerCase().startsWith("text/");
+/** Match `partId === partPath` against an unconsumed attachment. */
+const findByPartId = (attachments, consumed, partPath) => {
+    for (let i = 0; i < attachments.length; i++) {
+        if (consumed.has(i))
+            continue;
+        const att = attachments[i];
+        if (typeof att.partId !== "string")
+            continue;
+        if (att.partId === partPath)
+            return i;
+    }
+    return null;
+};
+/** Match by contentId (case + angle-insensitive). */
+const findByContentId = (attachments, consumed, contentId) => {
+    const target = stripAngles(contentId).toLowerCase();
+    for (let i = 0; i < attachments.length; i++) {
+        if (consumed.has(i))
+            continue;
+        const att = attachments[i];
+        const candidates = [att.cid, att.contentId];
+        for (const cand of candidates) {
+            if (typeof cand !== "string")
+                continue;
+            if (stripAngles(cand).toLowerCase() === target)
+                return i;
+        }
+    }
+    return null;
+};
+/** Match by dispositionFilename (case-insensitive). */
+const findByFilename = (attachments, consumed, filename) => {
+    const target = filename.toLowerCase();
+    for (let i = 0; i < attachments.length; i++) {
+        if (consumed.has(i))
+            continue;
+        const att = attachments[i];
+        if (typeof att.filename !== "string")
+            continue;
+        if (att.filename.toLowerCase() === target)
+            return i;
+    }
+    return null;
+};
+/**
+ * Content-type compatibility class. The BodyPart row's content-type is the
+ * sender's verbatim label; mailparser's `att.contentType` is sniffed from
+ * filename extension. They often disagree (the Odido bug — postmortem
+ * #394 — is `application/octet-stream` vs `application/pdf`).
+ *
+ * Order:
+ *   1. Exact match (`application/pdf` ↔ `application/pdf`).
+ *   2. Binary family — leaf is non-`text/*`, attachment is non-`text/*`.
+ *      Covers octet-stream ↔ pdf, octet-stream ↔ image, etc.
+ *   3. Text family — leaf is `text/*`, attachment is `text/*`. Catches
+ *      `text/calendar` / `text/csv` after the inline `text/plain` and
+ *      `text/html` slots are taken.
+ */
+const findByContentTypeClass = (attachments, consumed, contentType) => {
+    const target = contentType.toLowerCase();
+    const leafIsText = isTextStar(target);
+    for (let i = 0; i < attachments.length; i++) {
+        if (consumed.has(i))
+            continue;
+        const att = attachments[i];
+        if (att.contentType?.toLowerCase() === target)
+            return i;
+    }
+    if (!leafIsText) {
+        for (let i = 0; i < attachments.length; i++) {
+            if (consumed.has(i))
+                continue;
+            const att = attachments[i];
+            const attType = att.contentType?.toLowerCase();
+            if (!attType)
+                continue;
+            if (!isTextStar(attType))
+                return i;
+        }
+    }
+    else {
+        for (let i = 0; i < attachments.length; i++) {
+            if (consumed.has(i))
+                continue;
+            const att = attachments[i];
+            const attType = att.contentType?.toLowerCase();
+            if (!attType)
+                continue;
+            if (isTextStar(attType))
+                return i;
+        }
+    }
+    return null;
+};
+/** Positional fallback: next unconsumed attachment in declaration order. */
+const findPositional = (attachments, consumed) => {
+    for (let i = 0; i < attachments.length; i++) {
+        if (!consumed.has(i))
+            return i;
+    }
+    return null;
+};
+const pairNonTextLeaf = (part, attachments, consumed, context) => {
+    const contentType = buildContentType(part);
+    // Symmetry with the text-leaf path: a leaf whose BODYSTRUCTURE-declared
+    // size is zero has no bytes to find, so do not consume a residual
+    // attachment for it (the positional fallback would otherwise hand it
+    // real bytes belonging to another leaf — see PR D, review note b).
+    if (part.sizeOctets === 0) {
+        return { content: EMPTY_BUFFER, paired: true };
+    }
+    const byPartId = findByPartId(attachments, consumed, part.partPath);
+    if (byPartId !== null) {
+        consumed.add(byPartId);
+        return { content: attachments[byPartId].content, paired: true };
+    }
+    if (part.contentId) {
+        const byCid = findByContentId(attachments, consumed, part.contentId);
+        if (byCid !== null) {
+            consumed.add(byCid);
+            return { content: attachments[byCid].content, paired: true };
+        }
+    }
+    if (part.dispositionFilename) {
+        const byName = findByFilename(attachments, consumed, part.dispositionFilename);
+        if (byName !== null) {
+            consumed.add(byName);
+            return { content: attachments[byName].content, paired: true };
+        }
+    }
+    const byType = findByContentTypeClass(attachments, consumed, contentType);
+    if (byType !== null) {
+        consumed.add(byType);
+        return { content: attachments[byType].content, paired: true };
+    }
+    const positional = findPositional(attachments, consumed);
+    if (positional !== null) {
+        consumed.add(positional);
+        const chosen = attachments[positional];
+        // Audit log so operators can see "we guessed" pairings when a
+        // well-formed message takes the structural-fallback path. Helps
+        // triage cases where mailparser and BODYSTRUCTURE disagree more
+        // than the earlier matchers can handle.
+        context.logger?.debug?.({
+            messageId: context.messageId,
+            partPath: part.partPath,
+            leafContentType: contentType,
+            chosenAttachmentPartId: chosen.partId ?? null,
+            chosenAttachmentContentType: chosen.contentType ?? null,
+            chosenAttachmentFilename: chosen.filename ?? null,
+        }, "body-part-mapper: positional fallback paired leaf with next residual attachment");
+        return { content: chosen.content, paired: true };
+    }
+    return { paired: false };
+};
+/**
+ * Pair body-part rows with mailparser bytes. Returns one pair per
+ * non-multipart leaf, in the order the leaves appear in `bodyParts`.
+ *
+ * Never throws on well-formed input. Leaves with no source bytes get an
+ * empty Buffer; the call site does not need a try/catch.
+ */
+export const mapBodyPartsToContent = (bodyParts, parsed, context = {}) => {
+    const pairs = [];
+    const attachments = parsed.attachments ?? [];
+    const consumed = new Set();
+    let textRouted = false;
+    let htmlRouted = false;
+    for (const part of bodyParts) {
+        if (part.isMultipart)
+            continue;
+        const contentType = buildContentType(part);
+        const isPlain = part.mediaType === "TEXT" && part.mediaSubtype === "plain";
+        const isHtml = part.mediaType === "TEXT" && part.mediaSubtype === "html";
+        // `sizeOctets === 0` is the explicit empty-leaf signal; an undefined
+        // sizeOctets (hand-built test input) is treated as non-empty so we
+        // fall through to the text-routing path.
+        const isEmptyLeaf = part.sizeOctets === 0;
+        if (isPlain) {
+            const content = !textRouted && !isEmptyLeaf ? textToBuffer(parsed.text) : EMPTY_BUFFER;
+            textRouted = true;
+            pairs.push({ partPath: part.partPath, contentType, content });
+            continue;
+        }
+        if (isHtml) {
+            const content = !htmlRouted && !isEmptyLeaf
+                ? textToBuffer(typeof parsed.html === "string" ? parsed.html : undefined)
+                : EMPTY_BUFFER;
+            htmlRouted = true;
+            pairs.push({ partPath: part.partPath, contentType, content });
+            continue;
+        }
+        const result = pairNonTextLeaf(part, attachments, consumed, context);
+        if (result.paired) {
+            pairs.push({
+                partPath: part.partPath,
+                contentType,
+                content: result.content,
+            });
+            continue;
+        }
+        context.logger?.warn({
+            messageId: context.messageId,
+            partPath: part.partPath,
+            contentType,
+            contentId: part.contentId,
+            filename: part.dispositionFilename,
+        }, "body-part-mapper: no source bytes for leaf; pairing with zero-byte buffer");
+        pairs.push({ partPath: part.partPath, contentType, content: EMPTY_BUFFER });
+    }
+    return pairs;
+};
+/**
+ * The parse every part's bytes are paired against. A message/rfc822 part stays
+ * one leaf holding the raw forwarded message whatever its disposition, so the
+ * forwarded message's own parts come only from parsing it in turn.
+ */
+export const parsePartSource = (source) => simpleParser(source, { ignoreEmbedded: true });
+/**
+ * `mapBodyPartsToContent`, extended to forwarded messages. mailparser hands a
+ * message/rfc822 part over as one attachment holding the raw forwarded
+ * message, so the parts inside it have no bytes in `parsed`. Each forwarded
+ * message is parsed on its own and its parts are paired against that parse,
+ * with their paths rebased so `<messagePath>.0` is the forwarded message's
+ * root — the shape `walkMimeStructure` stores.
+ */
+export const mapMessagePartsToContent = async (bodyParts, parsed, context = {}) => {
+    const messages = outermostMessages(bodyParts);
+    const pairs = mapBodyPartsToContent(ownParts(bodyParts), parsed, context);
+    for (const message of messages) {
+        const raw = pairs.find((pair) => pair.partPath === message.partPath);
+        const inner = encapsulatedParts(bodyParts, message.partPath);
+        if (!raw || inner.length === 0)
+            continue;
+        const prefix = `${message.partPath}.`;
+        const nested = await mapMessagePartsToContent(inner.map((part) => ({
+            ...part,
+            partPath: part.partPath.slice(prefix.length),
+        })), await parsePartSource(raw.content), context);
+        for (const pair of nested) {
+            pairs.push({ ...pair, partPath: `${prefix}${pair.partPath}` });
+        }
+    }
+    return pairs;
+};

package/dist/body-sync-queue.d.ts

@@ -0,0 +1,59 @@
+import type { QueueProducer } from "@remit/data-ports";
+/**
+ * SYNC_MESSAGE_BODY event structure (matches remit-imap-worker/events.ts). The
+ * consumer falls back to `messageIds` when `messages` (id+uid pairs) is absent.
+ */
+export interface SyncMessageBodyTarget {
+    messageId: string;
+    uid: number;
+}
+export interface SyncMessageBodyEvent {
+    type: "SYNC_MESSAGE_BODY";
+    eventId: string;
+    timestamp: number;
+    accountId: string;
+    mailboxId: string;
+    messageIds: string[];
+    messages?: SyncMessageBodyTarget[];
+    /**
+     * Always true for this read-miss re-arm cue: the caller only reaches
+     * `requestBodySync` when a `/content` read found `bodyStorageKey` set but
+     * the storage object missing, so the worker must bypass its "already
+     * stored" skip guard and re-fetch even though the DB row is stale.
+     */
+    force: true;
+}
+export interface BodySyncQueueLogger {
+    info(obj: Record<string, unknown>, msg: string): void;
+    error(obj: Record<string, unknown>, msg: string): void;
+}
+export interface BodySyncQueueConfig {
+    queue: QueueProducer<SyncMessageBodyEvent>;
+    logger?: BodySyncQueueLogger;
+}
+export interface RequestBodySyncInput {
+    accountId: string;
+    mailboxId: string;
+    messageId: string;
+    /** UID resolved at read time so the worker issues one FETCH without a lookup. */
+    uid?: number;
+}
+/**
+ * Re-arms the body-sync cue for a single message from the read path.
+ *
+ * The worker emits SYNC_MESSAGE_BODY during metadata sync; this service lets the
+ * API re-emit that cue on demand when a body-fetch finds the storage object
+ * missing (never synced, or lost). The subsequent client retry then resolves
+ * once the worker has stored the body.
+ *
+ * A queue-send failure never rejects: the read path already returns a retryable
+ * 202 to the caller, and a rejection here would land on the shared API event
+ * loop and fail an unrelated in-flight request. It is logged loudly with an
+ * alertable field instead.
+ */
+export declare class BodySyncQueueService {
+    private queue;
+    private log;
+    constructor(config: BodySyncQueueConfig);
+    requestBodySync: (input: RequestBodySyncInput) => Promise<void>;
+}

package/dist/body-sync-queue.js

@@ -0,0 +1,56 @@
+import { randomUUID } from "node:crypto";
+const noopLogger = {
+    info: () => { },
+    error: () => { },
+};
+/**
+ * Re-arms the body-sync cue for a single message from the read path.
+ *
+ * The worker emits SYNC_MESSAGE_BODY during metadata sync; this service lets the
+ * API re-emit that cue on demand when a body-fetch finds the storage object
+ * missing (never synced, or lost). The subsequent client retry then resolves
+ * once the worker has stored the body.
+ *
+ * A queue-send failure never rejects: the read path already returns a retryable
+ * 202 to the caller, and a rejection here would land on the shared API event
+ * loop and fail an unrelated in-flight request. It is logged loudly with an
+ * alertable field instead.
+ */
+export class BodySyncQueueService {
+    queue;
+    log;
+    constructor(config) {
+        this.queue = config.queue;
+        this.log = config.logger ?? noopLogger;
+    }
+    requestBodySync = async (input) => {
+        const { accountId, mailboxId, messageId, uid } = input;
+        const event = {
+            type: "SYNC_MESSAGE_BODY",
+            eventId: randomUUID(),
+            timestamp: Date.now(),
+            accountId,
+            mailboxId,
+            messageIds: [messageId],
+            ...(uid !== undefined && { messages: [{ messageId, uid }] }),
+            force: true,
+        };
+        await this.queue
+            .send({ body: event })
+            .then(() => {
+            this.log.info({ eventId: event.eventId, accountId, mailboxId, messageId }, "Re-armed SYNC_MESSAGE_BODY cue");
+        })
+            .catch((error) => {
+            this.log.error({
+                alert: "body_sync_cue_enqueue_failed",
+                eventId: event.eventId,
+                accountId,
+                mailboxId,
+                messageId,
+                errorName: error?.name,
+                errorCode: error?.Code ??
+                    error?.code,
+            }, "Failed to re-arm SYNC_MESSAGE_BODY cue (read path returned a retryable 202)");
+        });
+    };
+}

package/dist/body-sync-terminal.d.ts

@@ -0,0 +1,58 @@
+import type { IMessageRepository } from "@remit/data-ports";
+import type { StorageService } from "@remit/storage-service";
+import type { BodySyncLogger } from "./body-sync.js";
+import type { IImapConnection } from "./types.js";
+export interface ResolveExhaustedBodySyncDeps {
+    messageService: Pick<IMessageRepository, "get" | "deleteIfPlacement">;
+    storageService: Pick<StorageService, "storeBodyPart" | "bodyPartExists">;
+    log: BodySyncLogger;
+}
+export interface ResolveExhaustedBodySyncInput {
+    accountId: string;
+    accountConfigId: string;
+    mailboxId: string;
+    mailboxPath: string;
+    failedMessageIds: string[];
+    getConnection: () => Promise<IImapConnection>;
+}
+export interface ResolveExhaustedBodySyncResult {
+    /** Outcome 1 (EXPECTED): message gone upstream, row deleted. */
+    reconciledMessageIds: string[];
+    /** Outcome 2 (BROKEN): message exists but is unfetchable/unparseable. */
+    brokenMessageIds: string[];
+}
+/**
+ * Whether a message's body-sync has already been marked permanently failed
+ * (outcome 2 of {@link resolveExhaustedBodySyncFailures}). The read path
+ * calls this before attempting or re-arming any fetch so a client that opens
+ * a broken message gets the explicit unrecoverable error immediately instead
+ * of looping through another 202 or another IMAP round-trip.
+ */
+export declare const isMessageBodySyncBroken: (storageService: Pick<StorageService, "bodyPartExists">, accountConfigId: string, accountId: string, messageId: string) => Promise<boolean>;
+/**
+ * Resolve every SYNC_MESSAGE_BODY failure that has exhausted the body
+ * queue's redelivery budget (see `BODY_SYNC_MAX_ATTEMPTS` in
+ * `sync-message-body.ts`) into exactly one of the two terminal outcomes
+ * issue #1270 / epic #1281 invariant 3 require. There is no third, softer
+ * outcome — every failed id lands in one of the two result lists.
+ *
+ * 1. EXPECTED — the message no longer exists on IMAP (expunged, or a
+ *    UIDVALIDITY change moved it, #1272), confirmed by
+ *    {@link isMessageGoneFromOpenMailbox}. This loop is the most exposed of
+ *    the four sites that used to read an empty FETCH as absence: it issues
+ *    back-to-back single-UID FETCHes on one connection, which is the
+ *    condition imapflow #408 drops rows under. The stale row is deleted via
+ *    `deleteIfPlacement` so the existing missing-row 404 path
+ *    takes over. Callers should emit a metric only — this is routine, not an
+ *    incident.
+ * 2. BROKEN — the message still exists on IMAP but its body could not be
+ *    fetched or parsed. The failure is persisted as a body-part sentinel
+ *    (survives across invocations and warm/cold starts) and logged with an
+ *    `alert`-shaped entry so an operator alarm can key off it. Callers
+ *    should treat this as loud: the message is unrecoverable until an
+ *    operator investigates.
+ *
+ * Neither outcome re-enqueues: both are terminal, so the caller acks the SQS
+ * message either way — retrying a stale or broken message can never succeed.
+ */
+export declare const resolveExhaustedBodySyncFailures: (deps: ResolveExhaustedBodySyncDeps, input: ResolveExhaustedBodySyncInput) => Promise<ResolveExhaustedBodySyncResult>;

package/dist/body-sync-terminal.js

@@ -0,0 +1,95 @@
+import { isMessageGoneFromOpenMailbox } from "./message-presence.js";
+/**
+ * Body-part sentinel path a permanently-broken message's failure context is
+ * written under, mirroring the `.materialized` deferred-parts sentinel in
+ * `body-sync.ts`. Using the existing per-message body-part storage (instead
+ * of a new Message-row column) means no schema change: the read path checks
+ * for it with the same `bodyPartExists` HEAD it already issues.
+ */
+const BODY_SYNC_FAILED_MARKER_PATH = ".sync-failed";
+/**
+ * Whether a message's body-sync has already been marked permanently failed
+ * (outcome 2 of {@link resolveExhaustedBodySyncFailures}). The read path
+ * calls this before attempting or re-arming any fetch so a client that opens
+ * a broken message gets the explicit unrecoverable error immediately instead
+ * of looping through another 202 or another IMAP round-trip.
+ */
+export const isMessageBodySyncBroken = (storageService, accountConfigId, accountId, messageId) => storageService.bodyPartExists(accountConfigId, accountId, messageId, BODY_SYNC_FAILED_MARKER_PATH);
+const markMessageBodySyncFailed = async (storageService, accountConfigId, accountId, messageId, context) => {
+    await storageService.storeBodyPart({
+        accountConfigId,
+        accountId,
+        messageId,
+        partPath: BODY_SYNC_FAILED_MARKER_PATH,
+        content: Buffer.from(JSON.stringify({ ...context, failedAt: Date.now() })),
+        contentType: "application/json",
+    });
+};
+/**
+ * Resolve every SYNC_MESSAGE_BODY failure that has exhausted the body
+ * queue's redelivery budget (see `BODY_SYNC_MAX_ATTEMPTS` in
+ * `sync-message-body.ts`) into exactly one of the two terminal outcomes
+ * issue #1270 / epic #1281 invariant 3 require. There is no third, softer
+ * outcome — every failed id lands in one of the two result lists.
+ *
+ * 1. EXPECTED — the message no longer exists on IMAP (expunged, or a
+ *    UIDVALIDITY change moved it, #1272), confirmed by
+ *    {@link isMessageGoneFromOpenMailbox}. This loop is the most exposed of
+ *    the four sites that used to read an empty FETCH as absence: it issues
+ *    back-to-back single-UID FETCHes on one connection, which is the
+ *    condition imapflow #408 drops rows under. The stale row is deleted via
+ *    `deleteIfPlacement` so the existing missing-row 404 path
+ *    takes over. Callers should emit a metric only — this is routine, not an
+ *    incident.
+ * 2. BROKEN — the message still exists on IMAP but its body could not be
+ *    fetched or parsed. The failure is persisted as a body-part sentinel
+ *    (survives across invocations and warm/cold starts) and logged with an
+ *    `alert`-shaped entry so an operator alarm can key off it. Callers
+ *    should treat this as loud: the message is unrecoverable until an
+ *    operator investigates.
+ *
+ * Neither outcome re-enqueues: both are terminal, so the caller acks the SQS
+ * message either way — retrying a stale or broken message can never succeed.
+ */
+export const resolveExhaustedBodySyncFailures = async (deps, input) => {
+    const { accountId, accountConfigId, mailboxId, mailboxPath, failedMessageIds, getConnection, } = input;
+    const reconciledMessageIds = [];
+    const brokenMessageIds = [];
+    if (failedMessageIds.length === 0) {
+        return { reconciledMessageIds, brokenMessageIds };
+    }
+    const connection = await getConnection();
+    await connection.openBox(mailboxPath);
+    for (const messageId of failedMessageIds) {
+        const message = await deps.messageService.get(messageId);
+        if (await isMessageGoneFromOpenMailbox(connection, message.uid)) {
+            const reconciled = await deps.messageService.deleteIfPlacement(messageId, {
+                status: message.status,
+                mailboxId: message.mailboxId,
+                uid: message.uid,
+            });
+            deps.log.info({
+                metric: "body_sync_stale_row_reconciled",
+                accountId,
+                accountConfigId,
+                mailboxId,
+                messageId,
+                uid: message.uid,
+                reconciled,
+            }, "Message no longer exists on IMAP after retry exhaustion; stale row reconciled");
+            reconciledMessageIds.push(messageId);
+            continue;
+        }
+        await markMessageBodySyncFailed(deps.storageService, accountConfigId, accountId, messageId, { accountId, accountConfigId, mailboxId, messageId, uid: message.uid });
+        deps.log.error?.({
+            alert: "body_sync_message_broken",
+            accountId,
+            accountConfigId,
+            mailboxId,
+            messageId,
+            uid: message.uid,
+        }, "Message body could not be fetched/parsed after retry exhaustion; message exists on IMAP but is unrecoverable");
+        brokenMessageIds.push(messageId);
+    }
+    return { reconciledMessageIds, brokenMessageIds };
+};