Release Package Tools 0.1.0

2026-09-01 13:04:50 +02:00
commit e42943e689
66 changed files with 11321 additions and 0 deletions
@@ -0,0 +1,55 @@
+# Package Tools
+
+Package Tools is a production-oriented, local-first browser workbench for
+inspecting ZIP/ZIP64 compound packages. It exposes the container tree and adds
+bounded, format-aware interpretation for EPUB, OOXML (`.docx`, `.xlsx`,
+`.pptx`), OpenDocument (`.odt`, `.ods`, `.odp`), JAR, APK, and Chrome/Firefox
+extension packages.
+
+Version 0.1.0 can:
+
+- inventory paths, sizes, compression, CRC-32, ZIP64 and encryption state;
+- reject traversal, ambiguous, colliding and special-entry paths;
+- detect excessive expansion and compression ratios before preview;
+- interpret OOXML content types and internal/external relationships;
+- inspect EPUB container/package metadata and manifest/spine consistency;
+- inspect ODF manifests, JAR manifests and WebExtension manifests;
+- inventory known signature-material files without asserting validity or trust;
+- flag missing relationship/manifest targets and unreferenced embedded media;
+- preview bounded text, raster images, audio and video, and download a strictly
+  re-read entry;
+- compare two package inventories by path, kind, size, compressed size and CRC;
+- export an inert JSON inventory report.
+
+All processing happens in the browser. The app has no telemetry, remote parser,
+CDN assets or automatic network lookups.
+
+## Run and verify
+
+```sh
+npm ci
+npm run dev
+npm run check
+npm run test:browser
+npm run package:release -- --force
+```
+
+Node.js 22 or newer and the Chromium/Firefox Playwright browsers are required
+for the complete verification suite.
+
+## Boundaries
+
+Package Tools is an inspection aid, not a renderer for office/ebook content,
+an APK resource decoder, a Java class analyser, an extension sandbox, or a
+signature verifier. It never establishes authenticity or publisher trust.
+Encrypted entries, split archives, unsafe paths, unsupported compression, and
+entries beyond the configured byte budgets remain inventory-only.
+
+APK v2/v3/v4 signing blocks live outside normal ZIP entries and are not decoded
+in v0.1. Chrome CRX wrapper headers are not a guaranteed input format; use an
+unpacked ZIP-form extension package when needed.
+
+## Licence
+
+Copyright © 2026 Albrecht Degering. Package Tools is free software licensed
+under the GNU General Public License v3.0 or later. See `LICENSE`.