mailauth 4.13.3 → 5.0.1

package/lib/tools.js

@@ -191,7 +191,7 @@ const formatSignatureHeaderLine = (type, values, folded) => {
     const header =
         `${headerKey}: ` +
         Object.keys(values)
-            .filter(key => values[key] !== false && typeof values[key] !== 'undefined' && values.key !== null && keyOrdering.includes(key))
+            .filter(key => values[key] !== false && typeof values[key] !== 'undefined' && values[key] !== null && keyOrdering.includes(key))
             .sort((a, b) => keyOrdering.indexOf(a) - keyOrdering.indexOf(b))
             .map(key => {
                 let val = values[key] || '';
@@ -471,10 +471,17 @@ const formatDomain = domain => {
     } catch (err) {
         // ignore punycode errors
     }
-    return domain;
+    // the root label is not part of the name, so "example.com." and "example.com" are the same domain
+    return domain.replace(/\.+$/, '');
 };
 
 const getAlignment = (fromDomain, domainList, strict) => {
+    // This argument used to be an options object. Every object is truthy, so a leftover
+    // { strict: false } call would otherwise mean hard strict, the opposite of what it asks for.
+    if (strict && typeof strict === 'object') {
+        strict = strict.strict;
+    }
+
     domainList = []
         .concat(domainList || [])
         .map(entry => {
@@ -486,20 +493,28 @@ const getAlignment = (fromDomain, domainList, strict) => {
         .sort((a, b) => (a.underSized || 0) - (b.underSized || 0));
 
     if (strict) {
-        fromDomain = formatDomain(fromDomain);
+        // strict alignment: the domains must be identical (RFC 9989 §3.2.10.2)
+        let from = formatDomain(fromDomain);
+        if (!from) {
+            // a bare root label normalizes to an empty string, which must not align with anything
+            return false;
+        }
         for (let entry of domainList) {
-            let domain = formatDomain(tldts.getDomain(entry.domain, TLDTS_OPTS) || entry.domain);
-            if (formatDomain(domain) === fromDomain) {
+            if (formatDomain(entry.domain) === from) {
                 return entry;
             }
         }
+        return false;
     }
 
-    // match org domains
-    fromDomain = formatDomain(tldts.getDomain(fromDomain, TLDTS_OPTS) || fromDomain);
+    // relaxed alignment: the domains must share an Organizational Domain (RFC 9989 §3.2.10.1)
+    let fromOrg = formatDomain(tldts.getDomain(fromDomain, TLDTS_OPTS) || fromDomain);
+    if (!fromOrg) {
+        return false;
+    }
     for (let entry of domainList) {
-        let domain = formatDomain(tldts.getDomain(entry.domain, TLDTS_OPTS) || entry.domain);
-        if (domain === fromDomain) {
+        let entryOrg = formatDomain(tldts.getDomain(entry.domain, TLDTS_OPTS) || entry.domain);
+        if (entryOrg === fromOrg) {
             return entry;
         }
     }
@@ -589,7 +604,9 @@ function parseTagValueRecord(record, options = {}) {
 
     // Split on semicolons
     const parts = sanitized.split(';');
-    const tags = {};
+    // no prototype, so that a tag named "__proto__" is stored as a normal key instead of
+    // replacing the prototype, and so that "toString" and friends are not seen as already set
+    const tags = Object.create(null);
     const validPairs = [];
     const errors = [];
     const warnings = [];

package/package.json

@@ -1,14 +1,14 @@
 {
     "name": "mailauth",
-    "version": "4.13.3",
+    "version": "5.0.1",
     "description": "Email authentication library for Node.js",
     "main": "lib/mailauth.js",
     "types": "index.d.ts",
     "scripts": {
-        "test": "eslint \"lib/**/*.js\" \"test/**/*.js\" && mocha --recursive \"./test/**/*.js\" --reporter spec",
+        "test": "eslint \"lib/**/*.js\" \"test/**/*.js\" && mocha --recursive \"./test/**/*-test.js\" --reporter spec",
         "format": "prettier --write .",
         "build-source": "rm -rf node_modules package-lock.json && npm install && npm run licenses && rm -rf node_modules package-lock.json && npm install --production && rm -rf package-lock.json",
-        "build-dist": "npx pkg --compress Brotli package.json && rm -rf package-lock.json && npm install && node winconf.js",
+        "build-dist": "pkg --compress Brotli package.json && rm -rf package-lock.json && npm install && node winconf.js",
         "build-dist-fast": "pkg --debug package.json && npm install && node winconf.js",
         "licenses": "license-report --only=prod --output=table --config license-report-config.json > licenses.txt",
         "update": "rm -rf node_modules package-lock.json && npx ncu -u && npm install"
@@ -35,30 +35,30 @@
     "homepage": "https://github.com/postalsys/mailauth",
     "devDependencies": {
         "chai": "4.4.1",
-        "eslint": "10.3.0",
+        "eslint": "10.8.0",
         "eslint-config-nodemailer": "1.2.0",
         "eslint-config-prettier": "10.1.8",
-        "js-yaml": "4.1.1",
-        "license-report": "6.8.2",
+        "js-yaml": "5.2.3",
+        "license-report": "6.8.5",
         "mbox-reader": "1.2.0",
-        "mocha": "11.7.5",
-        "prettier": "3.8.3",
+        "mocha": "11.8.0",
+        "prettier": "3.9.6",
         "resedit": "3.0.2"
     },
     "dependencies": {
-        "@postalsys/vmc": "1.1.4",
-        "fast-xml-parser": "5.7.3",
-        "ipaddr.js": "2.4.0",
-        "joi": "18.2.1",
-        "libmime": "5.3.8",
-        "nodemailer": "8.0.7",
+        "@postalsys/vmc": "1.1.5",
+        "commander": "15.0.0",
+        "fast-xml-parser": "5.10.1",
+        "ipaddr.js": "2.5.0",
+        "joi": "18.2.3",
+        "libmime": "5.4.1",
+        "nodemailer": "9.0.4",
         "punycode.js": "2.3.1",
-        "tldts": "7.0.30",
-        "undici": "7.25.0",
-        "yargs": "17.7.2"
+        "tldts": "7.4.10",
+        "undici": "8.10.0"
     },
     "engines": {
-        "node": ">=20.18.1"
+        "node": ">=22.19.0"
     },
     "bin": {
         "mailauth": "bin/mailauth.js"
@@ -69,10 +69,10 @@
             "LICENSE.txt"
         ],
         "targets": [
-            "node20-linux-x64",
-            "node20-macos-x64",
-            "node20-macos-arm64",
-            "node20-win-x64"
+            "node24-linux-x64",
+            "node24-macos-x64",
+            "node24-macos-arm64",
+            "node24-win-x64"
         ],
         "outputPath": "ee-dist"
     }

package/CLAUDE.md

@@ -1,66 +0,0 @@
-# CLAUDE.md
-
-This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
-
-## Project Overview
-
-mailauth is a Node.js library and CLI tool for email authentication. It implements SPF, DKIM, DMARC, ARC, BIMI, and MTA-STS protocols. Pure JavaScript, no native dependencies. Requires Node.js >= 20.18.1.
-
-## Commands
-
-- **Run all tests (lint + mocha):** `npm test`
-- **Run a single test file:** `npx mocha test/dkim/body/relaxed-test.js --reporter spec`
-- **Run tests matching a pattern:** `npx mocha --recursive "./test/**/*.js" --reporter spec --grep "pattern"`
-- **Lint only:** `npx eslint "lib/**/*.js" "test/**/*.js"`
-- **Format code:** `npm run format` (uses Prettier)
-
-## Code Style
-
-- CommonJS (`require`/`module.exports`), not ES modules
-- `'use strict'` at top of every file
-- Mocha + Chai (expect style) for tests
-- Prettier: 160 print width, 4-space indent, single quotes, no trailing commas, LF line endings
-- ESLint: unused vars prefixed with `_`, `no-console` allowed
-
-## Architecture
-
-### Entry Point
-
-`lib/mailauth.js` — exports `authenticate()` (the main all-in-one function) and individual protocol functions. The `authenticate` pipeline runs in order: DKIM verify → SPF → ARC → DMARC → BIMI, each step feeding results to the next.
-
-### Protocol Modules
-
-Each protocol lives in its own directory under `lib/`:
-
-- **`lib/dkim/`** — DKIM signing (`sign.js`, `dkim-signer.js`, `DkimSignStream`) and verification (`verify.js`, `dkim-verifier.js`). Body canonicalization in `body/` (relaxed/simple), header canonicalization in `header/` (relaxed/simple). `message-parser.js` is the streaming RFC822 parser used by both signing and verification.
-- **`lib/spf/`** — SPF verification (`spf-verify.js`), macro expansion (`macro.js`). Entry point `index.js` wraps the verifier.
-- **`lib/dmarc/`** — DMARC verification (`verify.js`) and DNS record fetching (`get-dmarc-record.js`). Takes DKIM and SPF results as input.
-- **`lib/arc/`** — ARC chain validation and seal creation. `trustlist.js` contains known ARC trust anchors.
-- **`lib/bimi/`** — BIMI record resolution and SVG validation (`validate-svg.js`). Depends on DMARC passing.
-- **`lib/mta-sts.js`** — MTA-STS policy fetching and MX validation (standalone, not part of authenticate pipeline).
-
-### Shared Utilities
-
-- **`lib/tools.js`** — DNS helpers, key parsing, header formatting, stream utilities, domain alignment checks
-- **`lib/parse-dkim-headers.js`** — Parses structured DKIM/ARC header fields
-- **`lib/parse-received.js`** — Parses Received headers
-
-### CLI
-
-`bin/mailauth.js` — yargs-based CLI with subcommands: `report`, `sign`, `seal`, `spf`, `vmc`, `bodyhash`. Command implementations in `lib/commands/`.
-
-### Tests
-
-Tests mirror the `lib/` structure under `test/`. Test fixtures in `test/fixtures/` include sample emails, DNS response caches, keys, and RFC test suite YAML files. Many tests use mock DNS resolvers that return fixture data instead of making real DNS queries.
-
-### Type Definitions
-
-`index.d.ts` and per-module `.d.ts` files provide TypeScript type definitions for consumers.
-
-### Key Design Pattern
-
-All protocol functions accept an optional `resolver` parameter (async function matching `dns.promises.resolve` signature) for DNS lookups. This enables testing with mock DNS and allows consumers to implement caching or custom resolution.
-
-## Releases
-
-Version numbers, changelogs, and releases are managed automatically by release-please via GitHub Actions. Do not manually edit `package.json` version, `CHANGELOG.md`, or release-related files.