A formally-verified OCaml tool to recover RPG Maker assets — one binary, zero deps

RPG Maker games ship their assets encrypted. If you need to get them back
legitimately — recovering your own project, a lost encryption key, an
authorized translation, or game preservation — you usually end up juggling
several format-specific scripts. I wanted one tool that just works, and can't
misbehave on hostile input.

So I built rpgm-decrypt in OCaml.

## What it does

• All five engine generations — XP / VX / VX Ace (.rgssad, .rgss2a, .rgss3a) and MV / MZ (.png_, .ogg_, .rpgmvp, .pak) — one command.
• Finds the key for you — reads System.json / scans rpg_core.js automatically, no manual key hunting.
• One self-contained binary — no Python, .NET, or Node. Copy it, run it.
• JSON / NDJSON output — pipes straight into jq for scripting.

## The part I actually care about: it can't misbehave
This is a parser eating untrusted binary input, so correctness and safety were
the whole point:

• Fuzzed 21M+ iterations, zero crashes. Corrupt/hostile input degrades gracefully instead of blowing up.
• Zip-Slip blocked by construction — extracted paths can never escape your output folder.
• Formally verified core — key functions carry Gospel contracts, and core safety properties are machine-checked with Why3 / Z3.
• Mutation-tested — 7/7 mutants killed.

console
  $ rpgm-decrypt ./MyGame ./decrypted
  [key]  found encryptionKey in www/js/System.json
    >  Title.png_  ->  decrypted/www/img/Title.png  [MV]
  === summary ===  scanned: 1873  decrypted: 1869  failed: 0

  ▎ Use it on content you're allowed to touch — your own work, a lost key, an
  ▎ authorized translation, or preservation. That responsibility is yours.

  GitHub: https://github.com/rolanfreeman6-png/rpgm-decrypt

  Curious what other RPG Maker archive formats people still need supported.