neozip-cli 0.80.0 → 0.90.0

package/CHANGELOG.md

@@ -5,6 +5,65 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+**Release notes** for each version are documented here (not in a separate “what’s new” file).
+
+## [0.90.0] - 2026-03-18
+
+### Added
+
+- **Full AES-256 encryption support** — create, list, and extract password-protected archives with WinZip-compatible AES-256 (default) or legacy PKZIP encryption.
+
+#### Creating encrypted archives
+
+- **AES-256 (default)** — use `-e` / `--encrypt` or `--aes256`.
+
+  ```bash
+  neozip -e secure.nzip file.txt
+  neozip -e -P "mypassword" secure.nzip file.txt
+  neozip --aes256 -P "mypassword" secure.nzip file.txt folder/
+  ```
+
+- **Legacy PKZIP** — use `--pkzip` or `--pkzip-encrypt` only for older-tool compatibility (weak; prefer AES-256 for sensitive data).
+
+  ```bash
+  neozip --pkzip -P "mypassword" legacy.nzip file.txt
+  ```
+
+#### Listing encrypted archives
+
+- **neolist** lists contents; filenames are visible without a password. Encryption method (AES-256 or PKZIP) is shown where applicable. Extraction requires the password.
+
+#### Extracting encrypted archives
+
+- **neounzip** auto-detects AES-256 vs PKZIP. Use `-P` / `--password`.
+
+  ```bash
+  neounzip -P "mypassword" secure.nzip output/
+  neounzip --in-memory -P "mypassword" secure.nzip output/
+  ```
+
+- Wrong password yields a clear error (e.g. bad password / decryption failed).
+
+#### Compatibility
+
+- **AES-256**: WinZip, 7-Zip, and other tools supporting ZIP AES extension (AE-2).
+- **PKZIP** (ZipCrypto): create/extract legacy archives only.
+
+#### Encryption options summary
+
+| Command   | Option             | Effect |
+|-----------|--------------------|--------|
+| neozip    | `-e`, `--encrypt`  | AES-256 (default); prompt if no `-P` |
+| neozip    | `--aes256`         | Explicit AES-256 |
+| neozip    | `--pkzip`          | Legacy PKZIP encryption |
+| neozip    | `-P`, `--password`| Encryption password |
+| neounzip  | `-P`, `--password` | Decryption password (AES-256/PKZIP auto-detected) |
+| neounzip  | `--pkzip-decrypt`  | Force legacy PKZip 2.0 decryption |
+
+See [README.md](README.md) and [DOCUMENTATION.md](DOCUMENTATION.md) for more examples.
+
+---
+
 ## [0.80.0] - 2026-03-04
 
 ### Added
@@ -18,21 +77,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - **Configuration**
   - `neozip config` and `neozip init` work when run via ts-node (fixed dynamic import resolution for `.ts` vs `.js`)
 
-### Changed
-
-- User-facing copy now uses "blockchain" instead of "Ethereum blockchain" for Zipstamp and mint flows
-- Zipstamp verification in `neounzip` shows "Zipstamp (blockchain timestamp)" instead of "Ethereum timestamp"
-- Help text: `-ts, --timestamp` described as "Enable Zipstamp timestamp (blockchain)"
-
 ### Fixed
 
 - `neozip config` / `neozip init` no longer fail with "Cannot find module './config/ConfigSetup.js'" when run via `yarn neozip-config` or ts-node
 
-### Security
-
-- `.env.*` (including `.env.local`, `.env.local.rem`) added to `.gitignore` to avoid committing secrets
-- Documented how to purge env files from git history if they were ever committed
-
 ---
 
 ## [0.70.0-alpha] - 2025-11-21

package/DOCUMENTATION.md

@@ -47,11 +47,9 @@ neolist --help     # Show listing help
   - NeoZip ecosystem overview
   - Technical innovations
 
-- **[CHANGELOG.md](CHANGELOG.md)** - Version history
-  - Release notes
-  - Feature additions
-  - Known limitations
-  - Breaking changes
+- **[CHANGELOG.md](CHANGELOG.md)** - Version history and release notes
+  - Detailed changes per version (including feature guides, e.g. AES-256 in v0.90.0)
+  - Known limitations and breaking changes
 
 - **[env.example](env.example)** - Environment variable configuration
   - Wallet configuration
@@ -98,10 +96,15 @@ neolist --help     # Show listing help
   - No compression (fastest)
   - Useful for already-compressed files
 
-- **PKZIP Encryption**
-  - Legacy encryption for maximum compatibility
+- **AES-256 Encryption** (default, recommended)
+  - Strong WinZip-compatible AES-256 encryption
   - Password-protected archives
-  - InfoZip-compatible encrypted archives
+  - Compatible with WinZip, 7-Zip, and other AES-capable tools
+
+- **PKZIP Encryption** (legacy)
+  - Traditional encryption for maximum compatibility
+  - Use `--pkzip` flag to select
+  - Not recommended for sensitive data
 
 ### Blockchain Features
 

package/README.md

@@ -6,9 +6,9 @@
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
 [![Node.js Version](https://img.shields.io/badge/node-%3E%3D16.0.0-brightgreen)](https://nodejs.org/)
 
-## ⚠️ Beta Release Notice
+## Release Notice
 
-**This is a beta release (v0.75.0-beta).** This software is in active development and may contain bugs or incomplete features. While more stable than alpha releases, please use with caution in production environments.
+**Current version: v0.90.0.** This release adds full AES-256 encryption support. See [CHANGELOG.md](CHANGELOG.md) for details.
 
 - **API Stability**: Command-line interface is becoming more stable but may still change
 - **Testing**: Please test thoroughly and report any issues
@@ -21,7 +21,7 @@ NeoZip CLI is a modern, full-featured ZIP utility that provides:
 - **Standard ZIP Compatibility**: ~99% compatible with InfoZip utilities
 - **Blockchain Integration**: Tokenize archives and verify integrity on-chain
 - **Advanced Compression**: Zstd, Deflate, and Store compression methods
-- **Encryption Support**: PKZIP encryption
+- **Encryption Support**: AES-256 (default) and PKZIP encryption
 - **Cross-Platform**: Works on macOS, Linux, and Windows
 
 ## Features
@@ -42,9 +42,10 @@ NeoZip CLI is a modern, full-featured ZIP utility that provides:
 - Compression levels: 0-9 (0=store, 9=best compression)
 
 ### Encryption
-- **PKZIP**: Legacy encryption (maximum compatibility)
+- **AES-256**: Strong encryption (default, recommended)
+- **PKZIP**: Legacy encryption (for compatibility only)
 - Password-protected archives
-- InfoZip-compatible encrypted archives
+- Auto-detection of encryption method during extraction
 
 ### Blockchain Features
 - **Tokenization**: Create on-chain tokens for archives
@@ -70,10 +71,10 @@ NeoZip CLI is a modern, full-featured ZIP utility that provides:
 - Node.js 16.0.0 or higher
 - npm or yarn package manager
 
-### Install from npm (Beta Release)
+### Install from npm
 
 ```bash
-npm install -g neozip-cli@beta
+npm install -g neozip-cli
 ```
 
 After installation, the following commands will be available:
@@ -138,13 +139,19 @@ neozip -0 output.nzip ./src/
 ### Encryption Examples
 
 ```bash
-# Create encrypted archive (will prompt for password)
+# Create AES-256 encrypted archive (default, will prompt for password)
 neozip -e secure.nzip file.txt
 
-# Create encrypted archive with password
+# Create AES-256 encrypted archive with password
 neozip -e -P "mypassword" secure.nzip file.txt
 
-# Extract encrypted archive
+# Explicitly use AES-256
+neozip --aes256 -P "mypassword" secure.nzip file.txt
+
+# Use legacy PKZIP encryption (weak, for compatibility only)
+neozip --pkzip -P "mypassword" legacy.nzip file.txt
+
+# Extract encrypted archive (auto-detects AES-256 or PKZIP)
 neounzip -P "mypassword" secure.nzip tests/extracted/
 ```
 
@@ -183,8 +190,10 @@ neozip [options] <archive> [files...]
 - `-0` to `-9` - Compression level (0=store, 9=best)
 - `-x, --exclude <pattern>` - Exclude files matching pattern
 - `-i, --include <pattern>` - Include only matching files
-- `-e, --encrypt` - Encrypt files (will prompt for password)
+- `-e, --encrypt` - Encrypt files with AES-256 (default, will prompt for password)
 - `-P, --password <pwd>` - Encrypt with password
+- `--aes256` - Use AES-256 encryption (default, recommended)
+- `--pkzip` - Use legacy PKZIP encryption (weak, for compatibility only)
 - `-b, --blockchain` - Enable blockchain tokenization
 - `-ots, --opentimestamp` - Enable OpenTimestamp proof (Bitcoin)
 - `-ts, --timestamp` - Enable Zipstamp timestamp (Ethereum)
@@ -232,7 +241,7 @@ neounzip [options] <archive> [output]
 - `-o, --overwrite` - Overwrite files without prompting
 - `-t, --test` - Test archive integrity
 - `-l, --list` - List contents without extracting
-- `-P, --password <pwd>` - Password for encrypted archives
+- `-P, --password <pwd>` - Password for encrypted archives (AES-256 and PKZIP auto-detected)
 - `-x, --exclude <pattern>` - Exclude files from extraction
 - `-i, --include <pattern>` - Include only matching files
 - `-j, --junk-paths` - Extract files without directory structure
@@ -376,10 +385,13 @@ neozip -r -x "node_modules" -x "*.log" project.nzip ./
 ### Encryption
 
 ```bash
-# Create encrypted archive
+# Create AES-256 encrypted archive (default)
 neozip -e -P "secure-password" secret.nzip sensitive-files/
 
-# Extract encrypted archive
+# Create legacy PKZIP encrypted archive
+neozip --pkzip -P "secure-password" legacy.nzip sensitive-files/
+
+# Extract encrypted archive (auto-detects encryption method)
 neounzip -P "secure-password" secret.nzip decrypted/
 ```
 
@@ -479,19 +491,19 @@ neozip init
 # Verify password is correct
 neounzip -P "your-password" archive.nzip
 
-# Try different encryption method
-neozip --pkzip-encrypt -P "password" archive.nzip files/
+# Use legacy PKZIP if AES-256 is not supported by target tool
+neozip --pkzip -P "password" archive.nzip files/
 ```
 
 ## Contributing
 
-We welcome feedback and contributions! Since this is a beta release, we're actively seeking input:
+We welcome feedback and contributions:
 
 1. **Report Issues**: Use [GitHub Issues](https://github.com/NeoWareInc/neozip-support/issues) or email [support@neozip.io](mailto:support@neozip.io)
 2. **Suggest Features**: Share your ideas and use cases
 3. **Test and Provide Feedback**: Help us improve by testing and reporting your experience
 
-**Important**: This is a beta release. API and behavior may still change. Please test thoroughly.
+**Important**: Please test thoroughly and report issues. See [CHANGELOG.md](CHANGELOG.md) for version history.
 
 ## License
 
@@ -511,6 +523,6 @@ This project is licensed under the MIT License - see the [LICENSE](LICENSE) file
 
 ---
 
-**Version**: 0.75.0-beta  
-**Status**: Beta Release  
-**Last Updated**: December 26, 2025
+**Version**: 0.90.0
+**Status**: Release (see [CHANGELOG.md](CHANGELOG.md) for latest changes)
+**Last Updated**: March 18, 2026

package/dist/src/neolist.js

@@ -461,8 +461,11 @@ function outputVerbose(entries, archivePath, zip, options = { verbose: false, qu
     entries.forEach((entry, index) => {
         // Use ZipEntry's showVerboseInfo() method for detailed information
         log(`File ${index + 1}: ${formatEntryName(entry)}`, options);
-        // Call showVerboseInfo() directly - it will output to console
         entry.showVerboseInfo();
+        if (entry.isEncrypted) {
+            const method = entry.aesVersion > 0 ? 'AES-256' : 'PKZIP';
+            log(`  Encryption method: ${method}`, options);
+        }
         log('', options);
     });
     // Summary
@@ -715,6 +718,9 @@ function outputJson(entries, archivePath, zip, options = { verbose: false, quiet
             if (entry.isStrongEncrypt !== undefined) {
                 fileInfo.isStrongEncrypt = entry.isStrongEncrypt;
             }
+            if (entry.isEncrypted) {
+                fileInfo.encryptionMethod = entry.aesVersion > 0 ? 'AES-256' : 'PKZIP';
+            }
             // Add symbolic link information if present
             if (entry.isSymlink !== undefined) {
                 fileInfo.isSymlink = entry.isSymlink;

package/dist/src/neounzip.js

@@ -625,14 +625,17 @@ async function testArchive(zip, options) {
                 throw new Error('ZIP file not loaded. Cannot determine backend type.');
             }
             // Report success
+            const encTag = entry.isEncrypted
+                ? (entry.aesVersion > 0 ? ' [AES-256]' : ' [PKZIP]')
+                : '';
             if (entry.sha256 && !options.skipBlockchain) {
-                console.log(`testing: ${name} ...OK SHA-256`);
+                console.log(`testing: ${name} ...OK SHA-256${encTag}`);
             }
             else if (entry.sha256 && options.skipBlockchain) {
-                console.log(`testing: ${name} ...OK (SHA-256 skipped)`);
+                console.log(`testing: ${name} ...OK (SHA-256 skipped)${encTag}`);
             }
             else {
-                console.log(`testing: ${name} ...OK`);
+                console.log(`testing: ${name} ...OK${encTag}`);
             }
         }
         catch (err) {
@@ -1036,10 +1039,13 @@ async function extractArchive(zip, destination, options) {
             totalBytes += result.bytesExtracted;
             const hasSha = entry.sha256 ? true : false;
             const suffix = hasSha ? (options.skipBlockchain ? ' (SHA-256 skipped)' : ' (SHA-256 OK)') : '';
+            const encTag = entry.isEncrypted
+                ? (entry.aesVersion > 0 ? ' [AES-256]' : ' [PKZIP]')
+                : '';
             if (options.verbose)
-                log(`extracting: ${filename} (${result.bytesExtracted} bytes)${suffix}`, options);
+                log(`extracting: ${filename} (${result.bytesExtracted} bytes)${suffix}${encTag}`, options);
             else
-                log(`extracting: ${filename}${suffix}`, options);
+                log(`extracting: ${filename}${suffix}${encTag}`, options);
             // Collect verified SHA-256 hash for merkle root calculation (single pass - no double check)
             // Only if this is a content file (not metadata) and SHA-256 verification was performed
             if (!options.skipBlockchain && hasSha) {
@@ -2086,7 +2092,7 @@ Options:
       --progress         Enable enhanced progress reporting
       --debug            Enable debug output
   -sf, --show-files      Show files as they are extracted
-  -P, --password [pwd]   Password for encrypted files. Provide password or will prompt
+  -P, --password [pwd]   Password for encrypted files (AES-256 and PKZIP supported)
   -x, --exclude <pattern> Exclude files matching pattern (can be used multiple times)
   -i, --include <pattern> Include only files matching pattern (can be used multiple times)
   -j, --junk-paths       Extract files without directory structure (flatten to destination)
@@ -2270,6 +2276,13 @@ async function main() {
             log(`🚀 NEOUNZIP v${version_1.APP_VERSION} (${version_1.APP_RELEASE_DATE})`, options);
             log(`📦 Archive: ${archive}`, options);
             log(`📁 Destination: ${extractDestination}`, options);
+            const allEntries = zip.getDirectory();
+            const hasEncrypted = allEntries.some((e) => e.isEncrypted);
+            if (hasEncrypted) {
+                const hasAes = allEntries.some((e) => e.isEncrypted && e.aesVersion > 0);
+                const encLabel = hasAes ? 'AES-256' : 'PKZIP';
+                log(`🔐 Encryption: ${encLabel}`, options);
+            }
             if (options.debug) {
                 // Set global Logger level to 'debug' for debug output
                 // Note: Individual class logging is controlled by their loggingEnabled static property

package/dist/src/neozip/createZip.js

@@ -407,8 +407,9 @@ class ZipCreator {
         if (!this.options.blockchainZipstamp && !this.options.blockchainOts) {
             (0, utils_1.log)(`🔗 Tokenization: ${this.options.blockchain ? 'enabled' : 'disabled'}`, this.options);
         }
-        const encryptionMethod = this.options.encryptionMethod || 'pkzip';
-        (0, utils_1.log)(`🔐 Encryption: ${this.options.encrypt ? `${encryptionMethod.toUpperCase()} enabled` : 'disabled'}`, this.options);
+        const encryptionMethod = this.options.encryptionMethod || 'aes256';
+        const encryptionLabel = encryptionMethod === 'aes256' ? 'AES-256' : 'PKZIP';
+        (0, utils_1.log)(`🔐 Encryption: ${this.options.encrypt ? `${encryptionLabel} enabled` : 'disabled'}`, this.options);
         (0, utils_1.log)('', this.options);
         if (this.options.debug) {
             (0, utils_1.logDebug)('Debug mode enabled', this.options);
@@ -822,7 +823,7 @@ class ZipCreator {
             useZstd: level === 0 ? false : (this.options.compression || 'zstd') === 'zstd',
             useSHA256: this.options.blockchain || this.options.blockchainOts || this.options.blockchainZipstamp || false,
             password: this.options.encrypt ? this.options.password : null,
-            encryptionMethod: this.options.encryptionMethod || 'pkzip'
+            encryptionMethod: (this.options.encryptionMethod === 'pkzip' ? 'zipcrypto' : 'aes256')
         };
         // Get entries from zip.getDirectory() (populated by processFiles())
         // This is the single source of truth for entry order

package/dist/src/neozip.js

@@ -260,45 +260,45 @@ function parseArgs(args) {
                 break;
             case '-e':
             case '--encrypt':
-                // InfoZip-compatible encryption option
                 options.encrypt = true;
-                // Only set encryption method if not already set
                 if (!options.encryptionMethod) {
-                    options.encryptionMethod = 'pkzip'; // Default to PKZIP (InfoZip compatible)
+                    options.encryptionMethod = 'aes256';
                 }
-                // Only prompt for password if not already provided
                 if (!options.password) {
-                    options.password = 'PROMPT'; // Will prompt for password
+                    options.password = 'PROMPT';
                 }
                 break;
             case '-P':
             case '--password':
-                // InfoZip-compatible password option (uppercase P)
                 options.encrypt = true;
-                // Only set encryption method if not already set (e.g., by --pkzip-encrypt)
                 if (!options.encryptionMethod) {
-                    options.encryptionMethod = 'pkzip'; // Default to PKZIP
+                    options.encryptionMethod = 'aes256';
                 }
                 if (i + 1 < args.length && !args[i + 1].startsWith('-')) {
-                    // Password provided directly
                     options.password = args[++i];
                 }
                 else {
-                    // No password provided, will prompt later
                     options.password = 'PROMPT';
                 }
                 break;
             case '-p':
             case '--show-progress':
-                // InfoZip-compatible show-progress option (lowercase p)
                 options.showFiles = true;
                 break;
+            case '--aes256':
+            case '--aes-256':
+                options.encrypt = true;
+                options.encryptionMethod = 'aes256';
+                if (!options.password) {
+                    options.password = 'PROMPT';
+                }
+                break;
+            case '--pkzip':
             case '--pkzip-encrypt':
                 options.encrypt = true;
                 options.encryptionMethod = 'pkzip';
-                // Only prompt for password if not already provided
                 if (!options.password) {
-                    options.password = 'PROMPT'; // Will prompt for password
+                    options.password = 'PROMPT';
                 }
                 break;
             case '-x':
@@ -432,10 +432,10 @@ function parseArgs(args) {
                 break;
         }
     }
-    // -ots and -ts are mutually exclusive (choose Bitcoin OTS or Zipstamp)
+    // -ots and -ts are mutually exclusive (choose Bitcoin OTS or Ethereum Zipstamp)
     if (options.blockchainOts && options.blockchainZipstamp) {
         console.error('Error: Cannot use both -ots (OpenTimestamps) and -ts (Zipstamp) in the same run');
-        console.error('   Use -ots for Bitcoin timestamping or -ts for Zipstamp timestamping');
+        console.error('   Use -ts for Zipstamp timestamping or -ots for Bitcoin timestamping');
         (0, exit_codes_1.exitZip)(exit_codes_1.ZIP_EXIT_CODES.PARAMETER_ERROR);
     }
     if (!archive) {
@@ -508,7 +508,7 @@ Options:
   -bd, --blockchain-default Auto-select default token option (use existing or mint new)
   -bm, --blockchain-mint  Force mint new token (skip existing token selection)
   -ots, --opentimestamp   Enable OpenTimestamp proof on Bitcoin blockchain
-  -ts, --timestamp       Enable Zipstamp timestamp (blockchain)
+  -ts, --timestamp       Enable Ethereum Zipstamp timestamp (blockchain)
       --timestamp-email <email>  Email for Zipstamp server (some servers require verified email)
   -n, --network <network> Blockchain network (base-sepolia, base-mainnet, default: base-sepolia)
   -w, --wallet-key <key>  Wallet private key (overrides NEOZIP_WALLET_PASSKEY)
@@ -519,10 +519,11 @@ Options:
       --block-size <bytes> Block size for streaming (default: 131072)
       --no-progress       Disable progress reporting
       --progress          Enable enhanced progress reporting
-  -e, --encrypt           Encrypt files (InfoZip-compatible). Will prompt for password
-  -P, --password [pwd]    Encrypt files with password (InfoZip-compatible). Provide password or will prompt
+  -e, --encrypt           Encrypt files with AES-256 (default). Will prompt for password
+  -P, --password [pwd]    Encrypt files with password. Provide password or will prompt
+      --aes256            Use AES-256 encryption (default, recommended)
+      --pkzip, --pkzip-encrypt  Use legacy PKZIP encryption (weak, for compatibility only)
   -p, --show-progress     Show progress during compression (InfoZip-compatible)
-      --pkzip-encrypt     Use PKZIP encryption (legacy compatibility only, same as -e)
   -x, --exclude <pattern> Exclude files matching pattern (can be used multiple times)
   -i, --include <pattern> Include only files matching pattern (can be used multiple times)
       --suffixes <list>   Don't compress files with these suffixes (can be used multiple times)

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "neozip-cli",
-  "version": "0.80.0",
-  "release_date": "2026-03-04",
+  "version": "0.90.0",
+  "release_date": "2026-03-18",
   "description": "A full-featured command-line ZIP application with NeoZipKit integration",
   "main": "dist/src/index.js",
   "bin": {
@@ -47,8 +47,11 @@
     "neozip-ots": "npx ts-node src/neozip.ts -ots -T tests/output/calgary-ots.nzip tests/fixtures/calgary/*",
     "neozip-stamp": "npx ts-node src/neozip.ts -ts -T tests/output/calgary-stamp.nzip tests/fixtures/calgary/*",
     "neozip-mint": "node dist/src/neozip.js mint -o tests/output/calgary-stamp-upgrade.nzip tests/output/calgary-stamp-nft.nzip",
-    "neozip-encrypt": "npx ts-node src/neozip.ts --encrypt -P 'pass123' -T tests/output/calgary-encrypted.nzip tests/fixtures/calgary/*",
-    "neozip-encrypt-sm": "npx ts-node src/neozip.ts --encrypt -P 'pass123' -T tests/output/encrypted-sm.nzip tests/fixtures/test-sm/*",
+    "neozip-encrypt": "npx ts-node src/neozip.ts --pkzip -P 'pass123' -T tests/output/calgary-encrypted.nzip tests/fixtures/calgary/*",
+    "neozip-encrypt-sm": "npx ts-node src/neozip.ts --pkzip -P 'pass123' -T tests/output/encrypted-sm.nzip tests/fixtures/test-sm/*",
+    "neozip-encrypt-aes": "npx ts-node src/neozip.ts -e -P 'pass123' tests/output/calgary-encrypted-aes.nzip tests/fixtures/calgary/*",
+    "neozip-encrypt-aes-sm": "npx ts-node src/neozip.ts -e -P 'pass123' tests/output/encrypted-aes-sm.nzip tests/fixtures/test-sm/*",
+    "neozip-encrypt-aes-explicit": "npx ts-node src/neozip.ts --aes256 -P 'pass123' tests/output/calgary-encrypted-aes-explicit.nzip tests/fixtures/calgary/*",
     "neozip-update": "node tests/scripts/test-update-option.js",
     "neozip-sm": "npx ts-node src/neozip.ts -T tests/output/test-sm.nzip tests/fixtures/test-sm/*",
     "neozip-init": "npx ts-node src/neozip.ts init",
@@ -73,6 +76,9 @@
     "neounzip-decrypt-sm": "npx ts-node src/neounzip.ts --password 'pass123' tests/output/encrypted-sm.nzip -t",
     "neounzip-decrypt-sm-inmem": "npx ts-node src/neounzip.ts --in-memory --password 'pass123' tests/output/encrypted-sm.nzip -t",
     "neounzip-decrypt-pkzip": "npx ts-node src/neounzip.ts --pkzip-decrypt --password 'legacy-test-123' tests/output/calgary-pkzip.nzip -t",
+    "neounzip-decrypt-aes": "npx ts-node src/neounzip.ts --password 'pass123' tests/output/calgary-encrypted-aes.nzip -t",
+    "neounzip-decrypt-aes-inmem": "npx ts-node src/neounzip.ts --in-memory --password 'pass123' tests/output/calgary-encrypted-aes.nzip -t",
+    "neounzip-decrypt-aes-sm": "npx ts-node src/neounzip.ts --password 'pass123' tests/output/encrypted-aes-sm.nzip -t",
     "neounzip-help": "npx ts-node src/neounzip.ts --help",
     "neolist": "npx ts-node src/neolist.ts tests/output/calgary.nzip",
     "neolist-inmem": "npx ts-node src/neolist.ts --in-memory tests/output/calgary.nzip",
@@ -85,6 +91,7 @@
     "neolist-zip64": "npx ts-node src/neolist.ts tests/fixtures/calgary-zip64.zip",
     "neolist-stamp": "npx ts-node src/neolist.ts tests/output/calgary-stamp.nzip",
     "neolist-stamp-upgrade": "npx ts-node src/neolist.ts tests/output/calgary-stamp-upgrade.nzip",
+    "neolist-encrypted-aes": "npx ts-node src/neolist.ts -v tests/output/calgary-encrypted-aes.nzip",
     "neolist-help": "npx ts-node src/neolist.ts --help",
     "infozip-encrypt-zip": "zip -e -P 'pass123' -r tests/fixtures/infozip/calgary-encrypted.zip tests/fixtures/calgary/*",
     "infozip-encrypt-sm": "zip -e -P 'pass123' -0 tests/fixtures/infozip/encrypted-sm.zip tests/fixtures/test-sm/*",
@@ -98,7 +105,8 @@
     "test:neozip": "node tests/scripts/comprehensive/test-neozip-options.js",
     "test:neounzip": "node tests/scripts/comprehensive/test-neounzip-options.js",
     "test:neolist": "node tests/scripts/comprehensive/test-neolist-options.js",
-    "test:encryption": "npm run neozip-encrypt && npm run neounzip-decrypt && echo '✅ All encryption tests completed successfully!'",
+    "test:encryption": "npm run neozip-encrypt-aes && npm run neounzip-decrypt-aes && npm run neozip-encrypt && npm run neounzip-decrypt && echo '✅ All encryption tests (AES-256 + PKZIP) completed successfully!'",
+    "test:encryption-aes": "npm run neozip-encrypt-aes && npm run neounzip-decrypt-aes && npm run neounzip-decrypt-aes-inmem && echo '✅ AES-256 encryption tests completed successfully!'",
     "test:stamp": "echo '=== Testing Timestamp Support ===' && npm run neozip-ots && npm run neounzip-ots && echo '' && echo '--- Zipstamp (may fail if server unreachable) ---' && (npm run neozip-zipstamp && npm run neounzip-zipstamp && echo '✅ Zipstamp tests completed') || echo '⚠️ Zipstamp skipped (server may be unreachable)' && echo '' && echo '✅ Timestamp tests completed successfully!'",
     "test:infozip-decrypt": "npx ts-node tests/scripts/test-infozip-decrypt.ts",
     "test:comments": "node tests/scripts/comprehensive/test-comments-options.js",
@@ -147,6 +155,7 @@
     "moment": "^2.29.4",
     "moment-timezone": "^0.5.43",
     "neozip-blockchain": "npm:neozip-blockchain@latest",
+    "neozip-cli": "^0.80.0",
     "neozipkit": "npm:neozipkit@latest",
     "opentimestamps": "^0.4.9",
     "ora": "^5.4.1",