Replace yargs with commander

[james-pre]

This PR swaps the CLI argument parser from yargs to commander, significantly shrinking the production dependency footprint with no change to CLI behavior.

Motivation

yargs pulls in a tree of 16 packages. commander is a single package with zero transitive dependencies, which reduces install size, install time, and supply-chain exposure.

Dependency & size reduction

• −15 production dependencies (16 packages removed, 1 added)
• CLI parser footprint: ~744 KB → 203 KB unpacked
• commander ships zero transitive dependencies. The removed yargs tree included cliui, y18n, string-width, wrap-ansi, emoji-regex, ansi-styles, color-convert, escalade, and others.

Supply-chain security

• Fewer packages means a smaller attack surface and fewer maintainers to trust
• Eliminates 15 transitive dependencies from the production install, reducing exposure to dependency-confusion and compromised-package risks
• A single, well-audited, zero-dependency parser is far easier to review and keep patched than a multi-package tree

Compatibility

No user-facing changes to the CLI:

• All subcommands preserved: report, sign, seal, spf, vmc, bodyhash, license
• Identical option names, short aliases, defaults, and required options
• report remains the default command (mailauth message.eml)
• Numeric options coerced to numbers, matching yargs' previous behavior
• stdin input, --headers-only, --verbose, and DNS-cache flags all unchanged

Testing

• npm test — 675 passing, lint clean
• Manual verification of every subcommand (file + stdin input, RSA + Ed25519 signing, numeric coercion, required-option errors, help output)

Claude did a lot of the heavy lifting for this one, however I personally reviewed all of the changes.

[CLAassistant]

All committers have signed the CLA.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	commander@​15.0.0

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm yargs is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package-lock.json → npm/mocha@11.7.5 → npm/yargs@17.7.3 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/yargs@17.7.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[james-pre]

Hey @andris9 could you please take a look at this when you get a chance?