Release Mail Tools 0.2.0

docs/ARCHITECTURE.md

@@ -1,11 +1,21 @@
 # Architecture
 
 The React shell lazy-loads one workbench. `core/mime.ts` turns bounded source
-text into immutable-looking header and MIME-part records; parsing never creates
-DOM. Transfer decoding consumes a global byte budget. Diagnostics, comparison,
+bytes into immutable-looking header and MIME-part records; parsing never creates
+DOM. A one-byte internal syntax view preserves arbitrary octets, while every raw
+multipart entity records exact offsets into the retained source buffer.
+Transfer decoding consumes a global byte budget. Diagnostics, comparison,
 canonicalization and redaction are separate pure modules.
 
+`core/mbox.ts` splits bounded mbox/mboxrd containers and derives a presentation
+tree from Message-ID, In-Reply-To and References. `core/dkim.ts` implements
+bounded RFC 6376 canonicalization and uses WebCrypto for RSA-SHA256 or
+Ed25519-SHA256 verification. The key record is explicit user input; the app has
+no DNS client and makes no network request.
+
 Only the selected HTML text is passed through DOMPurify. It is then embedded in
 an iframe without sandbox capabilities and with an inner policy that denies all
-connections and active content. Attachment downloads are explicit Blob URLs
-with sanitized filenames. The service worker caches only same-origin app files.
+connections and active content. Explicit `cid:` image references can resolve to
+small safe image parts already present in the message; no external URI is
+retained. Attachment downloads are explicit Blob URLs with sanitized filenames.
+The service worker caches only same-origin app files.