AttachmentResolver
Corex\Email\Message\AttachmentResolver · class · Add-ons layer
Turns attachment ids into absolute paths wp_mail() can send (spec 081, FR-010). ../../../../docs/internal/COREX-EMAIL-ADDON.md has described this class since the add-on was specified, and it did not exist — nor did attach(), attachMedia() or attachGenerated(). The mail stack carried no attachments field at all and WpMailDriver called wp_mail() with four arguments, so the $attachments parameter was never passed. The documentation promised a capability the framework did not have. Ids in, paths out, and never the reverse. A caller names an attachment by id; this resolves it. Nothing accepts a path from a request, which is the whole of the path-traversal defence the add-on spec claims — a caller who could supply ../../wp-config.php would have a mail-to-self exfiltration primitive.