Package Tools is a production-oriented, local-first browser workbench for inspecting ZIP/ZIP64 compound packages. It exposes the container tree and adds bounded, format-aware interpretation for EPUB, OOXML (.docx, .xlsx, .pptx), OpenDocument (.odt, .ods, .odp), JAR, APK, and Chrome/Firefox extension packages.

Version 0.2.0 can:

inventory paths, sizes, compression, CRC-32, ZIP64 and encryption state;
reject traversal, ambiguous, colliding and special-entry paths;
detect excessive expansion and compression ratios before preview;
interpret OOXML content types and internal/external relationships;
inspect EPUB container/package metadata and manifest/spine consistency;
inspect ODF manifests, JAR manifests and WebExtension manifests;
inventory signature-material pairs and declared digest algorithms without asserting validity or trust;
extract bounded dependency declarations from package.json, Python requirements, Maven metadata and JAR Class-Path, plus conventional licence-file evidence;
flag missing relationship/manifest targets and unreferenced embedded media;
preview bounded text, raster images, audio and video, and download a strictly re-read entry;
compare two packages using bounded, on-demand SHA-256 of verified decompressed entries; matching metadata/CRC alone remains explicitly unverified;
summarize safe bounded JSON, XML, manifest and text differences without rendering or executing package content;
export an inert JSON inventory report.
explicitly hand a verified entry to the browser/OS share surface where supported, with verified download-and-reopen as the local-only fallback.

All processing happens in the browser. The app has no telemetry, remote parser, CDN assets or automatic network lookups.

Run and verify

npm ci
npm run dev
npm run check
npm run test:browser
npm run package:release -- --force

Node.js 22 or newer and the Chromium/Firefox Playwright browsers are required for the complete verification suite.

Boundaries

Package Tools is an inspection aid, not a renderer for office/ebook content, an APK resource decoder, a Java class analyser, an extension sandbox, or a signature verifier. It never establishes authenticity or publisher trust. Dependency declarations are not resolved or vulnerability-checked, and licence evidence is not a legal interpretation. A chosen OS share target can upload a file even though Package Tools itself never does. Encrypted entries, split archives, unsafe paths, unsupported compression, and entries beyond the configured byte budgets remain inventory-only.

APK v2/v3/v4 signing blocks live outside normal ZIP entries and are not decoded in v0.2. Chrome CRX wrapper headers are not a guaranteed input format; use an unpacked ZIP-form extension package when needed.

README.md

Package Tools

Run and verify

Boundaries

Licence