fix: restore outbound CID attachment support

[R44VC0RP]

Summary

• restore outbound content_id support for send and reply attachment schemas
• preserve CID metadata for queued sends and route replies through the CID-aware multipart MIME builder
• harden attachment URL fetching, MIME header construction, quoted-printable encoding, and API-key logging

Verification

• bun test app/api/e2/helper/email-builder.test.ts
• bunx biome lint app/api/e2/emails/send.ts app/api/e2/emails/reply.ts app/api/e2/helper/attachment-processor.ts app/api/e2/helper/email-builder.ts app/api/e2/helper/email-builder.test.ts app/api/e2/helper/main.ts app/api/e2/lib/auth.ts lib/api-types.ts
• bun run generate:openapi
• git diff --check origin/main...HEAD

Notes

• Full-repository bun run lint still reports existing diagnostics outside this change set.

---

Note

Medium Risk
Changes affect production email send/reply and MIME construction (SSRF, header injection, encoding); mitigations are tested but any MIME regression could break delivery or threading.

Overview
Restores inline CID attachments (content_id) on send/reply APIs and keeps CID metadata through processing, storage, and multipart/related MIME via the shared buildRawEmailMessage path (reply no longer builds raw MIME inline).

Security and correctness on the outbound pipeline: SSRF checks and no redirects for remote attachment URLs, stricter content_id validation, pre-decode base64 size limits, header/MIME injection sanitization and real quoted-printable encoding in email-builder, plus API key values redacted in logs. Shared imports/types tightened (ProcessedAttachment, schedule parsing).

Adds email-builder.test.ts covering CID MIME, injection hardening, and QP encoding; updates public AttachmentInput types.

^{Reviewed by Cursor Bugbot for commit 6b94cfe. Bugbot is set up for automated code reviews on this repo. Configure here.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
inbound.new	Ready	Preview, Comment	Jun 3, 2026 2:18pm

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 1cf9e8b. Configure here.}