Release Mail Tools 0.2.0

README.md

@@ -1,14 +1,17 @@
 # Mail Tools
 
-Mail Tools is a local-first browser workbench for inspecting `.eml` and MIME
-messages. Version 0.1.0 unfolds headers, decodes RFC 2047 words, builds a bounded
-multipart tree, decodes common transfer encodings, inventories attachments,
-compares text bodies, and creates canonical or focused redacted exports.
+Mail Tools is a local-first browser workbench for inspecting `.eml`, MIME and
+mbox files. It unfolds headers, decodes RFC 2047 words, builds a bounded
+multipart tree, threads mailbox messages, inventories attachments, compares
+text bodies, and creates canonical or focused redacted exports. File imports
+are parsed from their original octets, retain exact source byte ranges for raw
+MIME entities, and assemble RFC 2231 continued parameters.
 
 HTML bodies are sanitized and displayed only in an opaque sandbox with an
 embedded `default-src 'none'` policy. Remote images, links, forms, scripts,
-styles, media, frames and active documents are removed. No message, address,
-attachment, URL or telemetry leaves the browser.
+styles, media, frames and active documents are removed. Referenced CID images
+of a small safe type can be embedded from the same message. No message,
+address, attachment, URL or telemetry leaves the browser.
 
 ## Development and release
 
@@ -21,7 +24,7 @@ npm run test:browser
 npm run release:artifact
 ```
 
-The last command creates deterministic `release/mail-tools-0.1.0.zip` and its
+The last command creates deterministic `release/mail-tools-0.2.0.zip` and its
 SHA-256 sidecar. The app uses relative assets and is tested beneath
 `/deep/nested/mail/`. It can run standalone or from add·ideas Toolbox.
 
@@ -29,17 +32,26 @@ SHA-256 sidecar. The app uses relative assets and is tested beneath
 
 - source limit: 8 MiB; at most 2,000 headers, 500 MIME parts, nesting depth 20,
   and a conservative 16 MiB decoded-data budget;
-- folded headers, duplicate fields and RFC 2047 B/Q words;
+- folded headers, duplicate fields, RFC 2047 B/Q words, and RFC 2231 parameter
+  continuations;
 - multipart and nested `message/rfc822`, Base64 and quoted-printable;
-- safe text previews, sanitized HTML, attachment inventory/download;
-- address/date and unverified SPF/DKIM/DMARC/ARC header diagnostics;
+- bounded mbox/mboxrd import and local Message-ID/References threading;
+- safe text previews, sanitized HTML with local CID images, attachment
+  inventory/download;
+- address/date and SPF/DKIM/DMARC/ARC claim diagnostics;
+- RFC 6376 simple/relaxed RSA-SHA256 and RFC 8463 Ed25519-SHA256 DKIM
+  verification against a public-key TXT record pasted by the user;
 - bounded line comparison and normalized EML plus top-level header redaction
   with a JSON report.
 
 This is not a mail client, spam detector, forensic verifier or anonymity tool.
-It does not open mailbox containers, contact servers, decrypt S/MIME/OpenPGP,
-validate DKIM signatures, establish sender identity, scan malware, render CID
-resources, or guarantee round-trip byte identity. See
+It does not contact mail or DNS servers, decrypt S/MIME/OpenPGP, establish
+sender identity, scan malware, open maildir/PST/OST containers, or guarantee
+that the deliberately normalized canonical export is byte-identical. DKIM
+verification proves only that the preserved bytes match the pasted key record;
+the tool cannot establish whether that record is authentic or current. The
+untouched source octets remain available for inspection.
+See
 [`docs/PRIVACY-SECURITY.md`](docs/PRIVACY-SECURITY.md).
 
 Licensed under GPL-3.0-or-later.