neozip-cli 0.80.0 → 0.95.0

package/dist/src/neounzip.js

@@ -51,10 +51,14 @@ const neozipkit_1 = require("neozipkit");
 const node_1 = __importDefault(require("neozipkit/node"));
 const neozip_blockchain_1 = require("neozip-blockchain");
 const ots_1 = require("neozip-blockchain/ots");
-const zipstamp_server_1 = require("neozip-blockchain/zipstamp-server");
+const token_service_1 = require("neozip-blockchain/token-service");
 const readline = __importStar(require("readline"));
 const version_1 = require("./version");
 const exit_codes_1 = require("./exit-codes");
+const bootstrap_1 = require("./connection/bootstrap");
+const output_1 = require("./cli/output");
+const params_1 = require("./cli/params");
+const validate_1 = require("./cli/validate");
 /**
  * Format bytes for display
  */
@@ -286,9 +290,9 @@ async function promptForTimeoutAction(networkConfig, currentRpcIndex, nonInterac
     });
 }
 /**
- * Perform Zipstamp upgrade on the archive (TS-SUBMIT.NZIP -> TIMESTAMP.NZIP)
+ * Perform Token Service upgrade on the archive (TS-SUBMIT.NZIP -> TIMESTAMP.NZIP)
  */
-async function performZipstampUpgrade(archivePath) {
+async function performTokenServiceUpgrade(archivePath) {
     try {
         // Dynamic import: use path without .js for ts-node; tsc emits .js for dist
         // @ts-expect-error TS2835 - node16 requires .js but ts-node resolves .ts from source
@@ -302,9 +306,9 @@ async function performZipstampUpgrade(archivePath) {
     }
 }
 /**
- * Prompt user for Zipstamp upgrade confirmation
+ * Prompt user for Token Service upgrade confirmation
  */
-function promptForZipstampUpgrade(archiveName) {
+function promptForTokenServiceUpgrade(archiveName) {
     return new Promise((resolve) => {
         const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
         rl.question(` - Batch confirmed. Upgrade archive to TIMESTAMP.NZIP? (y/N): `, (answer) => {
@@ -582,8 +586,8 @@ async function testArchive(zip, options) {
         return filename !== neozip_blockchain_1.TOKENIZED_METADATA &&
             filename !== ots_1.TIMESTAMP_METADATA &&
             filename !== ots_1.TIMESTAMP_SUBMITTED &&
-            filename !== zipstamp_server_1.SUBMIT_METADATA &&
-            filename !== zipstamp_server_1.TIMESTAMP_METADATA &&
+            filename !== token_service_1.SUBMIT_METADATA &&
+            filename !== token_service_1.TIMESTAMP_METADATA &&
             !entry.isDirectory;
     });
     for (const entry of entries) {
@@ -611,8 +615,8 @@ async function testArchive(zip, options) {
                     const isContentFile = name !== neozip_blockchain_1.TOKENIZED_METADATA &&
                         name !== ots_1.TIMESTAMP_METADATA &&
                         name !== ots_1.TIMESTAMP_SUBMITTED &&
-                        name !== zipstamp_server_1.SUBMIT_METADATA &&
-                        name !== zipstamp_server_1.TIMESTAMP_METADATA &&
+                        name !== token_service_1.SUBMIT_METADATA &&
+                        name !== token_service_1.TIMESTAMP_METADATA &&
                         !entry.isDirectory;
                     if (isContentFile) {
                         // Use the verified hash returned from testEntry()
@@ -625,14 +629,17 @@ async function testArchive(zip, options) {
                 throw new Error('ZIP file not loaded. Cannot determine backend type.');
             }
             // Report success
+            const encTag = entry.isEncrypted
+                ? (entry.aesVersion > 0 ? ' [AES-256]' : ' [PKZIP]')
+                : '';
             if (entry.sha256 && !options.skipBlockchain) {
-                console.log(`testing: ${name} ...OK SHA-256`);
+                console.log(`testing: ${name} ...OK SHA-256${encTag}`);
             }
             else if (entry.sha256 && options.skipBlockchain) {
-                console.log(`testing: ${name} ...OK (SHA-256 skipped)`);
+                console.log(`testing: ${name} ...OK (SHA-256 skipped)${encTag}`);
             }
             else {
-                console.log(`testing: ${name} ...OK`);
+                console.log(`testing: ${name} ...OK${encTag}`);
             }
         }
         catch (err) {
@@ -645,8 +652,8 @@ async function testArchive(zip, options) {
             const isContentFile = name !== neozip_blockchain_1.TOKENIZED_METADATA &&
                 name !== ots_1.TIMESTAMP_METADATA &&
                 name !== ots_1.TIMESTAMP_SUBMITTED &&
-                name !== zipstamp_server_1.SUBMIT_METADATA &&
-                name !== zipstamp_server_1.TIMESTAMP_METADATA &&
+                name !== token_service_1.SUBMIT_METADATA &&
+                name !== token_service_1.TIMESTAMP_METADATA &&
                 !entry.isDirectory;
             if (isEncrypted) {
                 // For encrypted files, decompression errors after decryption usually mean wrong password
@@ -965,8 +972,8 @@ async function extractArchive(zip, destination, options) {
         return filename !== neozip_blockchain_1.TOKENIZED_METADATA &&
             filename !== ots_1.TIMESTAMP_METADATA &&
             filename !== ots_1.TIMESTAMP_SUBMITTED &&
-            filename !== zipstamp_server_1.SUBMIT_METADATA &&
-            filename !== zipstamp_server_1.TIMESTAMP_METADATA &&
+            filename !== token_service_1.SUBMIT_METADATA &&
+            filename !== token_service_1.TIMESTAMP_METADATA &&
             !entry.isDirectory;
     });
     for (const entry of filteredEntries) {
@@ -1036,18 +1043,21 @@ async function extractArchive(zip, destination, options) {
             totalBytes += result.bytesExtracted;
             const hasSha = entry.sha256 ? true : false;
             const suffix = hasSha ? (options.skipBlockchain ? ' (SHA-256 skipped)' : ' (SHA-256 OK)') : '';
+            const encTag = entry.isEncrypted
+                ? (entry.aesVersion > 0 ? ' [AES-256]' : ' [PKZIP]')
+                : '';
             if (options.verbose)
-                log(`extracting: ${filename} (${result.bytesExtracted} bytes)${suffix}`, options);
+                log(`extracting: ${filename} (${result.bytesExtracted} bytes)${suffix}${encTag}`, options);
             else
-                log(`extracting: ${filename}${suffix}`, options);
+                log(`extracting: ${filename}${suffix}${encTag}`, options);
             // Collect verified SHA-256 hash for merkle root calculation (single pass - no double check)
             // Only if this is a content file (not metadata) and SHA-256 verification was performed
             if (!options.skipBlockchain && hasSha) {
                 const isContentFile = filename !== neozip_blockchain_1.TOKENIZED_METADATA &&
                     filename !== ots_1.TIMESTAMP_METADATA &&
                     filename !== ots_1.TIMESTAMP_SUBMITTED &&
-                    filename !== zipstamp_server_1.SUBMIT_METADATA &&
-                    filename !== zipstamp_server_1.TIMESTAMP_METADATA &&
+                    filename !== token_service_1.SUBMIT_METADATA &&
+                    filename !== token_service_1.TIMESTAMP_METADATA &&
                     !entry.isDirectory;
                 if (isContentFile && entry.sha256) {
                     // Use the verified hash from the entry (already verified during extraction)
@@ -1062,8 +1072,8 @@ async function extractArchive(zip, destination, options) {
             const isContentFile = filename !== neozip_blockchain_1.TOKENIZED_METADATA &&
                 filename !== ots_1.TIMESTAMP_METADATA &&
                 filename !== ots_1.TIMESTAMP_SUBMITTED &&
-                filename !== zipstamp_server_1.SUBMIT_METADATA &&
-                filename !== zipstamp_server_1.TIMESTAMP_METADATA &&
+                filename !== token_service_1.SUBMIT_METADATA &&
+                filename !== token_service_1.TIMESTAMP_METADATA &&
                 !entry.isDirectory;
             if (isContentFile && !options.skipBlockchain) {
                 // Check if failure was due to SHA-256 mismatch
@@ -1203,8 +1213,8 @@ async function verifyTokenization(zip, archiveName, options, extractionResult) {
                         return filename !== neozip_blockchain_1.TOKENIZED_METADATA &&
                             filename !== ots_1.TIMESTAMP_METADATA &&
                             filename !== ots_1.TIMESTAMP_SUBMITTED &&
-                            filename !== zipstamp_server_1.SUBMIT_METADATA &&
-                            filename !== zipstamp_server_1.TIMESTAMP_METADATA &&
+                            filename !== token_service_1.SUBMIT_METADATA &&
+                            filename !== token_service_1.TIMESTAMP_METADATA &&
                             !entry.isDirectory; // Skip directories
                     });
                     // Extract each file once and verify SHA-256 during extraction
@@ -1554,8 +1564,8 @@ async function verifyTokenization(zip, archiveName, options, extractionResult) {
         } // End of token verification if statement
         // Check for OpenTimestamp verification and upgrade
         await verifyAndUpgradeOts(zip, archiveName, options);
-        // Check for Zipstamp verification
-        await verifyZipstampTimestamp(zip, archiveName, options, extractionResult);
+        // Check for Token Service verification
+        await verifyTokenServiceTimestamp(zip, archiveName, options, extractionResult);
     }
     catch (e) {
         const msg = e instanceof Error ? e.message : String(e);
@@ -1667,19 +1677,19 @@ async function verifyAndUpgradeOts(zip, archiveName, options) {
     }
 }
 /**
- * Verify Zipstamp timestamp if present
+ * Verify Token Service timestamp if present
  * Uses our extraction logic (extractEntry/extractToFile) for compatibility with file-based ZIPs
  * When batch is confirmed but archive has TS-SUBMIT.NZIP, offers upgrade (prompt/auto/skip)
  */
-async function verifyZipstampTimestamp(zip, archiveName, options, extractionResult) {
+async function verifyTokenServiceTimestamp(zip, archiveName, options, extractionResult) {
     try {
         if (options.skipBlockchain) {
             return;
         }
         const entries = await getDirectory(zip, false);
-        const zipstampEntry = entries.find((e) => (e.filename || '') === 'META-INF/TS-SUBMIT.NZIP' ||
+        const tokenServiceEntry = entries.find((e) => (e.filename || '') === 'META-INF/TS-SUBMIT.NZIP' ||
             (e.filename || '') === 'META-INF/TIMESTAMP.NZIP');
-        if (!zipstampEntry) {
+        if (!tokenServiceEntry) {
             return;
         }
         // Extract timestamp metadata using our extraction (works for both buffer and file-based)
@@ -1687,7 +1697,7 @@ async function verifyZipstampTimestamp(zip, archiveName, options, extractionResu
         const bufferBased = isBufferBased(zip);
         const fileBased = isFileBased(zip);
         if (bufferBased) {
-            const buf = await extractEntry(zip, zipstampEntry, true);
+            const buf = await extractEntry(zip, tokenServiceEntry, true);
             if (buf) {
                 try {
                     timestampData = JSON.parse(buf.toString('utf-8'));
@@ -1698,9 +1708,9 @@ async function verifyZipstampTimestamp(zip, archiveName, options, extractionResu
             }
         }
         else if (fileBased) {
-            const tmpPath = path.join(require('os').tmpdir(), `neounzip-zipstamp-${Date.now()}-${(zipstampEntry.filename || 'meta').replace(/[^a-zA-Z0-9]/g, '_')}`);
+            const tmpPath = path.join(require('os').tmpdir(), `neounzip-token-service-${Date.now()}-${(tokenServiceEntry.filename || 'meta').replace(/[^a-zA-Z0-9]/g, '_')}`);
             try {
-                await zip.extractToFile(zipstampEntry, tmpPath, { skipHashCheck: true });
+                await zip.extractToFile(tokenServiceEntry, tmpPath, { skipHashCheck: true });
                 const buf = fs.readFileSync(tmpPath);
                 timestampData = JSON.parse(buf.toString('utf-8'));
             }
@@ -1719,7 +1729,7 @@ async function verifyZipstampTimestamp(zip, archiveName, options, extractionResu
             }
         }
         if (!timestampData || !timestampData.digest) {
-            console.log('\n🔗 Zipstamp Verification:');
+            console.log('\n🔗 Token Service Verification:');
             console.log(' - Status: ❌ ERROR');
             console.log(' - Error: Failed to extract timestamp metadata');
             return;
@@ -1728,13 +1738,13 @@ async function verifyZipstampTimestamp(zip, archiveName, options, extractionResu
             zip.getMerkleRoot?.() ??
             null;
         if (!merkleRoot) {
-            console.log('\n🔗 Zipstamp Verification:');
+            console.log('\n🔗 Token Service Verification:');
             console.log(' - Status: ❌ ERROR');
             console.log(' - Error: Merkle root not found in ZIP file');
             return;
         }
         if (timestampData.digest.toLowerCase() !== merkleRoot.toLowerCase()) {
-            console.log('\n🔗 Zipstamp Verification:');
+            console.log('\n🔗 Token Service Verification:');
             console.log(' - Status: ❌ ERROR');
             console.log(' - Error: Timestamp digest does not match ZIP merkle root');
             return;
@@ -1742,8 +1752,9 @@ async function verifyZipstampTimestamp(zip, archiveName, options, extractionResu
         // Use verifyDigest directly - pass undefined for chainId when 0/invalid (server may reject chainId 0)
         const chainId = timestampData.chainId && timestampData.chainId > 0 ? timestampData.chainId : undefined;
         const batchId = timestampData.batchId || undefined;
-        const response = await (0, zipstamp_server_1.verifyDigest)(merkleRoot, chainId, batchId, undefined, {
+        const response = await (0, token_service_1.verifyDigest)(merkleRoot, chainId, batchId, undefined, {
             debug: options.debug ?? false,
+            serverUrl: (0, bootstrap_1.resolveVerifyServerUrl)(timestampData.serverUrl),
         });
         const res = response.success
             ? response.verified
@@ -1758,10 +1769,10 @@ async function verifyZipstampTimestamp(zip, archiveName, options, extractionResu
                 }
                 : { status: 'pending', message: 'Timestamp is pending confirmation' }
             : { status: 'error', message: response.error || 'Verification failed' };
-        console.log('\n🔗 Zipstamp Verification:');
+        console.log('\n🔗 Token Service Verification:');
         if (res.status === 'valid') {
             console.log(' - Status: ✅ VERIFIED');
-            console.log(' - Stamp type: Zipstamp (blockchain timestamp)');
+            console.log(' - Stamp type: Token Service (blockchain timestamp)');
             if (res.network) {
                 console.log(` - Network: ${res.network}`);
             }
@@ -1788,24 +1799,24 @@ async function verifyZipstampTimestamp(zip, archiveName, options, extractionResu
                 console.log(` - Block timestamp (minted): ${mintedStr}`);
             }
             // Offer upgrade when archive has TS-SUBMIT.NZIP but batch is confirmed
-            const hasPendingMetadata = (zipstampEntry.filename || '') === 'META-INF/TS-SUBMIT.NZIP';
+            const hasPendingMetadata = (tokenServiceEntry.filename || '') === 'META-INF/TS-SUBMIT.NZIP';
             if (hasPendingMetadata) {
                 let doUpgrade = false;
-                if (options.zipstampSkipUpgrade) {
+                if (options.tokenServiceSkipUpgrade) {
                     doUpgrade = false;
-                    console.log(' - Upgrade: Skipped (--zipstamp-skip-upgrade)');
+                    console.log(' - Upgrade: Skipped (--token-service-skip-upgrade)');
                 }
-                else if (options.zipstampAutoUpgrade) {
+                else if (options.tokenServiceAutoUpgrade) {
                     doUpgrade = true;
-                    console.log(' - Upgrade: Automatically applying (--zipstamp-auto-upgrade)');
+                    console.log(' - Upgrade: Automatically applying (--token-service-auto-upgrade)');
                 }
                 else {
-                    doUpgrade = await promptForZipstampUpgrade(archiveName);
+                    doUpgrade = await promptForTokenServiceUpgrade(archiveName);
                 }
                 if (doUpgrade) {
-                    await performZipstampUpgrade(archiveName);
+                    await performTokenServiceUpgrade(archiveName);
                 }
-                else if (!options.zipstampSkipUpgrade && !options.zipstampAutoUpgrade) {
+                else if (!options.tokenServiceSkipUpgrade && !options.tokenServiceAutoUpgrade) {
                     console.log(' - Note: Run "neozip upgrade <archive>" to upgrade when ready');
                 }
             }
@@ -1829,11 +1840,11 @@ async function verifyZipstampTimestamp(zip, archiveName, options, extractionResu
     }
     catch (error) {
         const errorMessage = error instanceof Error ? error.message : 'Unknown error';
-        console.log('\n🔗 Zipstamp Verification:');
+        console.log('\n🔗 Token Service Verification:');
         if (errorMessage.includes('ESOCKETTIMEDOUT') || errorMessage.includes('ECONNRESET') ||
             errorMessage.includes('ENOTFOUND') || errorMessage.includes('ECONNREFUSED') ||
             errorMessage.includes('timeout') || errorMessage.includes('network')) {
-            console.log(' - Status: 📡 COMMUNICATION ERROR (unable to contact Zipstamp server)');
+            console.log(' - Status: 📡 COMMUNICATION ERROR (unable to contact Token Service)');
             console.log(` - Error: ${errorMessage}`);
         }
         else {
@@ -1845,7 +1856,23 @@ async function verifyZipstampTimestamp(zip, archiveName, options, extractionResu
 /**
  * Parse command line arguments
  */
-function parseArgs(args) {
+function unzipParamsToOptions(params) {
+    const allowed = [
+        'test', 'skipBlockchain', 'verbose', 'quiet', 'overwrite', 'testOnly', 'bufferSize',
+        'password', 'debug', 'showFiles', 'encryptionMethod', 'exclude', 'include', 'junkPaths',
+        'never', 'exdir', 'preservePerms', 'symlinks', 'hardLinks', 'listOnly', 'freshenOnly',
+        'updateOnly', 'commentOnly', 'otsAutoUpgrade', 'otsSkipUpgrade', 'tokenServiceAutoUpgrade',
+        'tokenServiceSkipUpgrade', 'inMemory', 'nonInteractive', 'preVerify', 'dryRun',
+    ];
+    const out = {};
+    for (const key of allowed) {
+        if (key in params) {
+            out[key] = params[key];
+        }
+    }
+    return out;
+}
+function parseArgs(args, seed) {
     const options = {
         dest: '.',
         test: false,
@@ -1857,11 +1884,13 @@ function parseArgs(args) {
         bufferSize: 512 * 1024, // 512KB default (optimal for modern systems)
         enableProgress: true,
         junkPaths: false,
-        never: false
+        never: false,
+        // Seed from agent --params/--json first; explicit CLI flags below override.
+        ...(seed?.options ?? {}),
     };
-    let archive = '';
-    let destination = '.';
-    let filePatterns = [];
+    let archive = seed?.archive ?? '';
+    let destination = seed?.destination ?? '.';
+    let filePatterns = seed?.filePatterns ? [...seed.filePatterns] : [];
     for (let i = 0; i < args.length; i++) {
         const arg = args[i];
         switch (arg) {
@@ -2009,11 +2038,11 @@ function parseArgs(args) {
             case '--ots-skip-upgrade':
                 options.otsSkipUpgrade = true;
                 break;
-            case '--zipstamp-auto-upgrade':
-                options.zipstampAutoUpgrade = true;
+            case '--token-service-auto-upgrade':
+                options.tokenServiceAutoUpgrade = true;
                 break;
-            case '--zipstamp-skip-upgrade':
-                options.zipstampSkipUpgrade = true;
+            case '--token-service-skip-upgrade':
+                options.tokenServiceSkipUpgrade = true;
                 break;
             case '--in-memory':
                 options.inMemory = true;
@@ -2021,6 +2050,9 @@ function parseArgs(args) {
             case '--non-interactive':
                 options.nonInteractive = true;
                 break;
+            case '--dry-run':
+                options.dryRun = true;
+                break;
             default:
                 if (arg.startsWith('-')) {
                     console.error(`Error: Unknown option ${arg}`);
@@ -2061,6 +2093,8 @@ function parseArgs(args) {
  * Show help information
  */
 function showHelp() {
+    if ((0, output_1.isJsonOutput)())
+        return;
     console.log(`
 NeoUnZip Version: ${version_1.APP_VERSION} (${version_1.APP_RELEASE_DATE})
 
@@ -2086,7 +2120,7 @@ Options:
       --progress         Enable enhanced progress reporting
       --debug            Enable debug output
   -sf, --show-files      Show files as they are extracted
-  -P, --password [pwd]   Password for encrypted files. Provide password or will prompt
+  -P, --password [pwd]   Password for encrypted files (AES-256 and PKZIP supported)
   -x, --exclude <pattern> Exclude files matching pattern (can be used multiple times)
   -i, --include <pattern> Include only files matching pattern (can be used multiple times)
   -j, --junk-paths       Extract files without directory structure (flatten to destination)
@@ -2097,9 +2131,13 @@ Options:
   -H, --hard-links       Restore hard links efficiently (recreate link relationships)
       --ots-auto-upgrade Automatically upgrade OTS timestamps when available
       --ots-skip-upgrade Skip OTS timestamp upgrades (no prompt)
-      --zipstamp-auto-upgrade Automatically upgrade Zipstamp timestamps when confirmed
-      --zipstamp-skip-upgrade Skip Zipstamp timestamp upgrades (no prompt)
+      --token-service-auto-upgrade Automatically upgrade Token Service timestamps when confirmed
+      --token-service-skip-upgrade Skip Token Service timestamp upgrades (no prompt)
       --in-memory        Force in-memory processing mode (browser compatible)
+      --dry-run          Show the extraction plan without writing any files
+      --format <fmt>     Output format: text (default) or json (machine-readable)
+      --params <json>    Provide options as a JSON object (agent input; '-' = stdin)
+      --json <json>      Provide payload {archive, exdir, filePatterns} as JSON ('-' = stdin)
 
 Arguments:
   <archive>        ZIP file to extract or test
@@ -2115,6 +2153,8 @@ Examples:
  * Show extended help information (equivalent to InfoZip's -h2)
  */
 function showExtendedHelp() {
+    if ((0, output_1.isJsonOutput)())
+        return;
     console.log('Extended Help for NeoUnzip');
     console.log('');
     console.log('NeoUnzip is a next-generation ZIP extraction utility that builds upon the strengths');
@@ -2237,13 +2277,47 @@ async function main() {
     let zip = null;
     let options = null;
     try {
+        (0, bootstrap_1.bootstrapConnectionContext)();
         // Parse command line arguments
         const args = process.argv.slice(2);
-        const parsed = parseArgs(args);
+        // Resolve machine-readable output mode early so error exits are structured.
+        (0, output_1.setOutputFormat)((0, output_1.detectOutputFormat)(args));
+        // Extract agent input (--params/--json) and strip --format, then parse.
+        const agent = (0, params_1.extractAgentInput)((0, output_1.stripFormatFlag)(args));
+        const seed = {};
+        if (agent.params)
+            seed.options = unzipParamsToOptions(agent.params);
+        if (agent.payload) {
+            if (typeof agent.payload.archive === 'string')
+                seed.archive = agent.payload.archive;
+            if (typeof agent.payload.destination === 'string')
+                seed.destination = agent.payload.destination;
+            if (typeof agent.payload.exdir === 'string') {
+                seed.options = { ...(seed.options ?? {}), exdir: agent.payload.exdir };
+            }
+            if (Array.isArray(agent.payload.filePatterns)) {
+                seed.filePatterns = agent.payload.filePatterns.map(String);
+            }
+        }
+        const parsed = parseArgs(agent.argv, seed);
         const { archive, destination, filePatterns } = parsed;
         options = parsed.options;
+        // In JSON mode, suppress decorative human logs so stdout stays pure JSON.
+        if ((0, output_1.isJsonOutput)()) {
+            options.quiet = true;
+        }
         // Use exdir option if provided, otherwise use destination
         const extractDestination = options.exdir || destination;
+        // Input hardening: reject control characters in the extraction directory.
+        try {
+            (0, validate_1.validateSafeOutputDir)(extractDestination, 'Extraction directory');
+        }
+        catch (err) {
+            if (err instanceof validate_1.ValidationError) {
+                (0, exit_codes_1.exitUnzip)(exit_codes_1.UNZIP_EXIT_CODES.INVALID_OPTIONS, `Error: ${err.message}`);
+            }
+            throw err;
+        }
         // Load the ZIP file
         zip = new node_1.default();
         if (options.inMemory) {
@@ -2270,6 +2344,13 @@ async function main() {
             log(`🚀 NEOUNZIP v${version_1.APP_VERSION} (${version_1.APP_RELEASE_DATE})`, options);
             log(`📦 Archive: ${archive}`, options);
             log(`📁 Destination: ${extractDestination}`, options);
+            const allEntries = zip.getDirectory();
+            const hasEncrypted = allEntries.some((e) => e.isEncrypted);
+            if (hasEncrypted) {
+                const hasAes = allEntries.some((e) => e.isEncrypted && e.aesVersion > 0);
+                const encLabel = hasAes ? 'AES-256' : 'PKZIP';
+                log(`🔐 Encryption: ${encLabel}`, options);
+            }
             if (options.debug) {
                 // Set global Logger level to 'debug' for debug output
                 // Note: Individual class logging is controlled by their loggingEnabled static property
@@ -2284,17 +2365,71 @@ async function main() {
                 log('', options);
             }
         }
+        // Dry-run: report the plan without extracting or writing anything.
+        if (options.dryRun) {
+            const dirEntries = zip.getDirectory();
+            const planned = dirEntries
+                .filter((e) => !e.isDirectory && !(typeof e.filename === 'string' && e.filename.endsWith('/')))
+                .map((e) => ({
+                entry: e.filename,
+                target: zip.prepareExtractionPath(e, extractDestination, { junkPaths: options.junkPaths }),
+                size: e.size ?? e.uncompressedSize,
+            }));
+            const plan = {
+                command: 'neounzip',
+                action: options.testOnly ? 'test' : options.listOnly ? 'list' : 'extract',
+                dryRun: true,
+                archive,
+                destination: extractDestination,
+                entryCount: planned.length,
+                entries: planned,
+            };
+            if ((0, output_1.isJsonOutput)()) {
+                (0, output_1.emitResult)(plan);
+            }
+            else {
+                console.log('Dry run — no files will be written.');
+                console.log(JSON.stringify(plan, null, 2));
+            }
+            process.exit(exit_codes_1.UNZIP_EXIT_CODES.SUCCESS);
+        }
         if (options.testOnly) {
             const testResult = await testArchive(zip, options);
             // Always verify tokenization info after testing so users see results at the end
             // Pass pre-calculated merkle root to avoid double extraction (single pass)
             await verifyTokenization(zip, archive, options, testResult.extractionResult);
+            if ((0, output_1.isJsonOutput)()) {
+                (0, output_1.emitResult)({
+                    command: 'neounzip',
+                    action: 'test',
+                    archive,
+                    failures: testResult.failures,
+                    passed: testResult.failures === 0,
+                });
+            }
             process.exit(testResult.failures === 0 ? exit_codes_1.UNZIP_EXIT_CODES.SUCCESS : exit_codes_1.UNZIP_EXIT_CODES.WARNING);
         }
         else if (options.listOnly) {
-            await listArchive(zip, archive, options);
-            // Show tokenization info after listing (no pre-calculated result, will extract once)
-            await verifyTokenization(zip, archive, options);
+            if ((0, output_1.isJsonOutput)()) {
+                const dirEntries = zip.getDirectory();
+                (0, output_1.emitResult)({
+                    command: 'neounzip',
+                    action: 'list',
+                    archive,
+                    entryCount: dirEntries.length,
+                    entries: dirEntries.map((e) => ({
+                        name: e.filename,
+                        size: e.size ?? e.uncompressedSize,
+                        compressedSize: e.compressedSize,
+                        encrypted: !!e.isEncrypted,
+                    })),
+                });
+            }
+            else {
+                await listArchive(zip, archive, options);
+                // Show tokenization info after listing (no pre-calculated result, will extract once)
+                await verifyTokenization(zip, archive, options);
+            }
         }
         else if (options.commentOnly) {
             // Comment mode - show only archive comment, no other output
@@ -2330,12 +2465,48 @@ async function main() {
                 // Pre-verification passed - proceed with extraction
                 console.log('\n✅ Pre-verification passed - proceeding with extraction...\n');
             }
+            // Zip-slip protection: validate the ACTUAL output path each entry would be
+            // written to (as computed by neozipkit) and refuse any that escape the
+            // target directory.
+            try {
+                const resolvedDest = path.resolve(extractDestination);
+                const withSep = resolvedDest.endsWith(path.sep) ? resolvedDest : resolvedDest + path.sep;
+                const dirEntries = zip.getDirectory();
+                for (const e of dirEntries) {
+                    if (e.isDirectory)
+                        continue;
+                    const name = e.filename;
+                    if (typeof name !== 'string' || name.endsWith('/'))
+                        continue;
+                    const outPath = zip.prepareExtractionPath(e, extractDestination, { junkPaths: options.junkPaths });
+                    const resolved = path.resolve(outPath);
+                    if (resolved !== resolvedDest && !resolved.startsWith(withSep)) {
+                        throw new validate_1.ValidationError(`Entry "${name}" escapes the extraction directory (path traversal)`);
+                    }
+                }
+            }
+            catch (err) {
+                if (err instanceof validate_1.ValidationError) {
+                    (0, exit_codes_1.exitUnzip)(exit_codes_1.UNZIP_EXIT_CODES.ZIP_FORMAT_ERROR, `Error: ${err.message}`);
+                }
+                throw err;
+            }
             const extractionResult = await extractArchive(zip, extractDestination, options);
             // Show tokenization info after extraction (pass pre-calculated merkle root to avoid double extraction)
             // Skip blockchain verification if we already did it during pre-verify
             if (!options.preVerify) {
                 await verifyTokenization(zip, archive, options, extractionResult);
             }
+            if ((0, output_1.isJsonOutput)()) {
+                (0, output_1.emitResult)({
+                    command: 'neounzip',
+                    action: 'extract',
+                    archive,
+                    destination: extractDestination,
+                    allFilesValid: extractionResult.allFilesValid,
+                    failedFiles: extractionResult.failedFiles,
+                });
+            }
         }
         log('✓ NeoUnZip completed successfully', options);
         // Close file handle if file-based ZIP was loaded