# Mail Tools

Mail Tools is a local-first browser workbench for inspecting `.eml` and MIME
messages. Version 0.1.0 unfolds headers, decodes RFC 2047 words, builds a bounded
multipart tree, decodes common transfer encodings, inventories attachments,
compares text bodies, and creates canonical or focused redacted exports.

HTML bodies are sanitized and displayed only in an opaque sandbox with an
embedded `default-src 'none'` policy. Remote images, links, forms, scripts,
styles, media, frames and active documents are removed. No message, address,
attachment, URL or telemetry leaves the browser.

## Development and release

Requires Node.js 22+ and npm 11+.

```sh
npm ci
npm run check
npm run test:browser
npm run release:artifact
```

The last command creates deterministic `release/mail-tools-0.1.0.zip` and its
SHA-256 sidecar. The app uses relative assets and is tested beneath
`/deep/nested/mail/`. It can run standalone or from add·ideas Toolbox.

## v0.1 boundary

- source limit: 8 MiB; at most 2,000 headers, 500 MIME parts, nesting depth 20,
  and a conservative 16 MiB decoded-data budget;
- folded headers, duplicate fields and RFC 2047 B/Q words;
- multipart and nested `message/rfc822`, Base64 and quoted-printable;
- safe text previews, sanitized HTML, attachment inventory/download;
- address/date and unverified SPF/DKIM/DMARC/ARC header diagnostics;
- bounded line comparison and normalized EML plus top-level header redaction
  with a JSON report.

This is not a mail client, spam detector, forensic verifier or anonymity tool.
It does not open mailbox containers, contact servers, decrypt S/MIME/OpenPGP,
validate DKIM signatures, establish sender identity, scan malware, render CID
resources, or guarantee round-trip byte identity. See
[`docs/PRIVACY-SECURITY.md`](docs/PRIVACY-SECURITY.md).

Licensed under GPL-3.0-or-later.