Release Mail Tools 0.2.0

public/CHANGELOG.md

@@ -1,5 +1,14 @@
 # Changelog
 
+## 0.2.0 - 2026-09-02
+
+- Preserved original message octets and MIME entity ranges, including RFC 2231
+  continued parameters and byte-safe attachment downloads.
+- Added bounded mbox/mboxrd import, threading and search, safe packaged CID-image
+  preview, and deeper MIME-tree redaction with explicit evidence.
+- Added local RSA-SHA256 and Ed25519-SHA256 DKIM verification against public-key
+  DNS text pasted by the user.
+
 ## 0.1.0 - 2026-09-01
 
 - Initial local-first EML/MIME inspection release.

public/LICENSES/npm-runtime-licenses.txt

@@ -1,5 +1,5 @@
 ==============================================================================
-@add-ideas/toolbox-contract@0.2.3
+@add-ideas/toolbox-contract@0.3.0
 Declared licence: Apache-2.0
 ==============================================================================
 --- LICENSE ---
@@ -198,7 +198,7 @@ Declared licence: Apache-2.0
 
 
 ==============================================================================
-@add-ideas/toolbox-helpers@0.1.0
+@add-ideas/toolbox-helpers@0.2.0
 Declared licence: GPL-3.0-or-later
 ==============================================================================
 --- LICENSE ---
@@ -879,7 +879,7 @@ Public License instead of this License.  But first, please read
 
 
 ==============================================================================
-@add-ideas/toolbox-shell-react@0.2.3
+@add-ideas/toolbox-shell-react@0.3.0
 Declared licence: Apache-2.0
 ==============================================================================
 --- LICENSE ---

public/README.md

@@ -1,14 +1,17 @@
 # Mail Tools
 
-Mail Tools is a local-first browser workbench for inspecting `.eml` and MIME
-messages. Version 0.1.0 unfolds headers, decodes RFC 2047 words, builds a bounded
-multipart tree, decodes common transfer encodings, inventories attachments,
-compares text bodies, and creates canonical or focused redacted exports.
+Mail Tools is a local-first browser workbench for inspecting `.eml`, MIME and
+mbox files. It unfolds headers, decodes RFC 2047 words, builds a bounded
+multipart tree, threads mailbox messages, inventories attachments, compares
+text bodies, and creates canonical or focused redacted exports. File imports
+are parsed from their original octets, retain exact source byte ranges for raw
+MIME entities, and assemble RFC 2231 continued parameters.
 
 HTML bodies are sanitized and displayed only in an opaque sandbox with an
 embedded `default-src 'none'` policy. Remote images, links, forms, scripts,
-styles, media, frames and active documents are removed. No message, address,
-attachment, URL or telemetry leaves the browser.
+styles, media, frames and active documents are removed. Referenced CID images
+of a small safe type can be embedded from the same message. No message,
+address, attachment, URL or telemetry leaves the browser.
 
 ## Development and release
 
@@ -21,7 +24,7 @@ npm run test:browser
 npm run release:artifact
 ```
 
-The last command creates deterministic `release/mail-tools-0.1.0.zip` and its
+The last command creates deterministic `release/mail-tools-0.2.0.zip` and its
 SHA-256 sidecar. The app uses relative assets and is tested beneath
 `/deep/nested/mail/`. It can run standalone or from add·ideas Toolbox.
 
@@ -29,17 +32,26 @@ SHA-256 sidecar. The app uses relative assets and is tested beneath
 
 - source limit: 8 MiB; at most 2,000 headers, 500 MIME parts, nesting depth 20,
   and a conservative 16 MiB decoded-data budget;
-- folded headers, duplicate fields and RFC 2047 B/Q words;
+- folded headers, duplicate fields, RFC 2047 B/Q words, and RFC 2231 parameter
+  continuations;
 - multipart and nested `message/rfc822`, Base64 and quoted-printable;
-- safe text previews, sanitized HTML, attachment inventory/download;
-- address/date and unverified SPF/DKIM/DMARC/ARC header diagnostics;
+- bounded mbox/mboxrd import and local Message-ID/References threading;
+- safe text previews, sanitized HTML with local CID images, attachment
+  inventory/download;
+- address/date and SPF/DKIM/DMARC/ARC claim diagnostics;
+- RFC 6376 simple/relaxed RSA-SHA256 and RFC 8463 Ed25519-SHA256 DKIM
+  verification against a public-key TXT record pasted by the user;
 - bounded line comparison and normalized EML plus top-level header redaction
   with a JSON report.
 
 This is not a mail client, spam detector, forensic verifier or anonymity tool.
-It does not open mailbox containers, contact servers, decrypt S/MIME/OpenPGP,
-validate DKIM signatures, establish sender identity, scan malware, render CID
-resources, or guarantee round-trip byte identity. See
+It does not contact mail or DNS servers, decrypt S/MIME/OpenPGP, establish
+sender identity, scan malware, open maildir/PST/OST containers, or guarantee
+that the deliberately normalized canonical export is byte-identical. DKIM
+verification proves only that the preserved bytes match the pasted key record;
+the tool cannot establish whether that record is authentic or current. The
+untouched source octets remain available for inspection.
+See
 [`docs/PRIVACY-SECURITY.md`](docs/PRIVACY-SECURITY.md).
 
 Licensed under GPL-3.0-or-later.

public/SOURCE.md

@@ -1,8 +1,8 @@
 # Corresponding source
 
-The corresponding source for Mail Tools 0.1.0 is available at:
+The corresponding source for Mail Tools 0.2.0 is available at:
 
-https://git.add-ideas.de/lotobo/mail-tools/src/tag/v0.1.0
+https://git.add-ideas.de/lotobo/mail-tools/src/tag/v0.2.0
 
 Build with Node.js 22+, npm 11+, and the exact dependencies in
 `package-lock.json`. Run `npm ci && npm run release:artifact`.

public/docs/ARCHITECTURE.md

@@ -1,11 +1,21 @@
 # Architecture
 
 The React shell lazy-loads one workbench. `core/mime.ts` turns bounded source
-text into immutable-looking header and MIME-part records; parsing never creates
-DOM. Transfer decoding consumes a global byte budget. Diagnostics, comparison,
+bytes into immutable-looking header and MIME-part records; parsing never creates
+DOM. A one-byte internal syntax view preserves arbitrary octets, while every raw
+multipart entity records exact offsets into the retained source buffer.
+Transfer decoding consumes a global byte budget. Diagnostics, comparison,
 canonicalization and redaction are separate pure modules.
 
+`core/mbox.ts` splits bounded mbox/mboxrd containers and derives a presentation
+tree from Message-ID, In-Reply-To and References. `core/dkim.ts` implements
+bounded RFC 6376 canonicalization and uses WebCrypto for RSA-SHA256 or
+Ed25519-SHA256 verification. The key record is explicit user input; the app has
+no DNS client and makes no network request.
+
 Only the selected HTML text is passed through DOMPurify. It is then embedded in
 an iframe without sandbox capabilities and with an inner policy that denies all
-connections and active content. Attachment downloads are explicit Blob URLs
-with sanitized filenames. The service worker caches only same-origin app files.
+connections and active content. Explicit `cid:` image references can resolve to
+small safe image parts already present in the message; no external URI is
+retained. Attachment downloads are explicit Blob URLs with sanitized filenames.
+The service worker caches only same-origin app files.

public/docs/PRIVACY-SECURITY.md

@@ -5,9 +5,16 @@ memory. There is no storage, telemetry, analytics, remote-resource request or
 server integration. Closing/reloading the page clears the workbench.
 
 Limits reduce accidental resource exhaustion but do not make Mail Tools a
-forensic parser. HTML loses links, styling and embedded resources by design.
+forensic parser. HTML loses links, styling and external embedded resources by
+design; only bounded safe image parts referenced by `cid:` can be embedded.
 Downloaded attachments remain untrusted. Authentication results and Received
-headers are self-asserted text; no DNS or cryptographic verification occurs.
+headers are self-asserted text.
+
+The optional DKIM lab performs local cryptographic verification against a DNS
+TXT value pasted by the user. It never resolves DNS, so a passing result means
+only that the message bytes match that supplied key. It does not prove that the
+key is current, authoritative or obtained securely, and it does not turn other
+authentication headers into verified evidence.
 
 Focused redaction removes a fixed set of top-level transport/authentication
 headers. It does not rewrite nested `message/rfc822` content and can leave names,

public/sw.js

@@ -1,5 +1,5 @@
 const CACHE_PREFIX = "mail-tools-shell-";
-const CACHE_NAME = CACHE_PREFIX + "0.1.0";
+const CACHE_NAME = CACHE_PREFIX + "0.2.0";
 const CORE = [
   "./",
   "./manifest.webmanifest",

public/toolbox-app.json

@@ -3,12 +3,12 @@
   "schemaVersion": 1,
   "id": "de.add-ideas.mail-tools",
   "name": "Mail Tools",
-  "version": "0.1.0",
-  "description": "Inspect and redact email messages locally.",
+  "version": "0.2.0",
+  "description": "Inspect email and mailbox files locally.",
   "entry": "./",
   "icon": "./favicon.svg",
   "categories": ["documents", "developer", "privacy"],
-  "tags": ["email", "eml", "mime", "headers", "attachments"],
+  "tags": ["email", "eml", "mbox", "mime", "dkim", "attachments"],
   "integration": {
     "contextVersion": 1,
     "launchModes": ["navigate", "new-tab"],
@@ -21,6 +21,18 @@
     "crossOriginIsolated": false,
     "topLevelContext": false
   },
+  "io": {
+    "accepts": [
+      { "mediaType": "message/rfc822", "extensions": [".eml"] },
+      { "mediaType": "application/mbox", "extensions": [".mbox", ".mbx"] },
+      { "mediaType": "text/plain", "extensions": [".txt"] }
+    ],
+    "produces": [
+      { "mediaType": "message/rfc822", "extensions": [".eml"] },
+      { "mediaType": "application/json", "extensions": [".json"] }
+    ]
+  },
+  "capabilities": { "required": [], "optional": ["web-crypto"] },
   "privacy": {
     "processing": "local",
     "fileUploads": true,