be507070b6
- pack: two-pass algorithm reads/hashes/compresses/encrypts files then writes header+TOC+data - inspect: reads header and TOC, displays all metadata (sizes, offsets, IVs, HMACs, SHA-256) - unpack: HMAC-first verification, AES-256-CBC decryption, optional gzip decompression, SHA-256 check - CLI dispatch wired from main.rs to archive module - Directory traversal protection: rejects filenames starting with / or containing .. - Compression auto-detection: .apk/.zip/etc stored without gzip (flags=0x00 when no file compressed) - Round-trip verified: pack+unpack produces byte-identical files - HMAC tamper detection verified: flipped ciphertext byte triggers rejection Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>