stegdoc 4.0.0 → 5.0.1

package/src/commands/encode.js

@@ -1,449 +1,567 @@
-const path = require('path');
-const fs = require('fs');
-const { pipeline } = require('stream/promises');
-const chalk = require('chalk');
-const ora = require('ora');
-const AdmZip = require('adm-zip');
-const { createDocxWithBase64 } = require('../lib/docx-handler');
-const { createXlsxPartStreaming } = require('../lib/xlsx-handler');
-const { createMetadata, serializeMetadata } = require('../lib/metadata');
-const crypto = require('crypto');
-const { generateHash, parseSizeToBytes, formatBytes, generateFilename } = require('../lib/utils');
-const { packEncryptionMeta, generateSalt, createEncryptStream } = require('../lib/crypto');
-const { isCompressedMime, createCompressStream } = require('../lib/compression');
-const { resetTimeWindow } = require('../lib/decoy-generator');
-const { shouldRunInteractive, promptEncodeOptions } = require('../lib/interactive');
-const { Base64EncodeTransform, ChunkCollector, BinaryChunkCollector } = require('../lib/streams');
-
-/**
- * Zip a folder into a buffer
- * @param {string} folderPath - Path to folder
- * @returns {Buffer} Zip buffer
- */
-function zipFolder(folderPath) {
-  const zip = new AdmZip();
-  zip.addLocalFolder(folderPath);
-  return zip.toBuffer();
-}
-
-/**
- * Detect file type from the first 4KB without reading the entire file
- * @param {string} filePath - Path to file
- * @returns {Promise<object|null>} File type result or null
- */
-async function detectFileType(filePath) {
-  try {
-    const { fileTypeFromBuffer } = await import('file-type');
-    const fd = await fs.promises.open(filePath, 'r');
-    const buf = Buffer.alloc(4100);
-    await fd.read(buf, 0, 4100, 0);
-    await fd.close();
-    return await fileTypeFromBuffer(buf);
-  } catch {
-    return null;
-  }
-}
-
-/**
- * Compute SHA-256 hash of a file using streaming (no full file in memory)
- * @param {string} filePath - Path to file
- * @returns {Promise<string>} Hex SHA-256 hash
- */
-async function computeFileHash(filePath) {
-  return new Promise((resolve, reject) => {
-    const hash = crypto.createHash('sha256');
-    const stream = fs.createReadStream(filePath);
-    stream.on('data', (chunk) => hash.update(chunk));
-    stream.on('end', () => resolve(hash.digest('hex')));
-    stream.on('error', reject);
-  });
-}
-
-/**
- * Encode a file to XLSX/DOCX format with optional AES encryption and compression.
- * Uses streaming pipeline for XLSX to support multi-GB files.
- * @param {string} inputFile - Path to input file
- * @param {object} options - Command options
- */
-async function encodeCommand(inputFile, options) {
-  // Check if we should run interactive mode
-  if (shouldRunInteractive(options, 'encode')) {
-    const filename = path.basename(inputFile);
-    console.log(chalk.bold(`\nEncoding: ${filename}`));
-
-    const interactiveOptions = await promptEncodeOptions(filename);
-    options = { ...options, ...interactiveOptions };
-    console.log(); // Add spacing before starting
-  }
-
-  const quiet = options.quiet || false;
-  const spinner = quiet ? { start: () => {}, succeed: () => {}, fail: () => {}, info: () => {}, text: '' } : ora('Starting encoding process...').start();
-  const createdFiles = []; // Track created files for cleanup on failure
-
-  // Reset time window for fresh timestamps in this encode session
-  resetTimeWindow();
-
-  try {
-    // Validate input exists
-    if (!fs.existsSync(inputFile)) {
-      throw new Error(`Path not found: ${inputFile}`);
-    }
-
-    // Check if input is a directory
-    const isDirectory = fs.statSync(inputFile).isDirectory();
-
-    // Determine format (default to xlsx)
-    const format = (options.format || 'xlsx').toLowerCase();
-    if (format !== 'xlsx' && format !== 'docx') {
-      throw new Error('Invalid format. Use "xlsx" or "docx".');
-    }
-
-    const useEncryption = !!options.password;
-    const chunkInput = (options.chunkSize || '').toString().trim();
-
-    let streamSource;
-    let filename;
-    let extension;
-    let fileSize;
-    let tempZipPath = null;
-
-    if (isDirectory) {
-      // Zip the folder to a temp file, then stream from it
-      spinner.text = 'Zipping folder...';
-      const folderName = path.basename(inputFile);
-      const zipBuffer = zipFolder(inputFile);
-      filename = `${folderName}.zip`;
-      extension = '.zip';
-      fileSize = zipBuffer.length;
-
-      // Write zip to temp file for streaming
-      tempZipPath = path.join(require('os').tmpdir(), `stegdoc_${Date.now()}.zip`);
-      fs.writeFileSync(tempZipPath, zipBuffer);
-      streamSource = tempZipPath;
-
-      spinner.succeed && spinner.succeed(`Folder zipped: ${folderName}/ → ${formatBytes(fileSize)}`);
-    } else {
-      streamSource = inputFile;
-      filename = path.basename(inputFile);
-      extension = path.extname(inputFile);
-      fileSize = fs.statSync(inputFile).size;
-      spinner.succeed && spinner.succeed(`File detected: ${filename} (${formatBytes(fileSize)})`);
-    }
-
-    // Detect file type for compression decision (read only first 4KB)
-    spinner.text = 'Checking file type...';
-    let useCompression = true;
-    const fileType = await detectFileType(streamSource);
-
-    if (fileType && isCompressedMime(fileType.mime)) {
-      useCompression = false;
-      spinner.info && spinner.info(`Skipping compression (${fileType.ext} is already compressed)`);
-    }
-
-    // For DOCX format, warn about large files and use legacy in-memory path
-    if (format === 'docx') {
-      if (fileSize > 200 * 1024 * 1024) {
-        spinner.info && spinner.info('Warning: DOCX format is not recommended for files >200MB. Consider using XLSX.');
-      }
-      // Use legacy in-memory path for DOCX
-      await encodeLegacyDocx(streamSource, filename, extension, fileSize, options, useCompression, useEncryption, spinner, quiet, createdFiles);
-      if (tempZipPath) cleanupTemp(tempZipPath);
-      return;
-    }
-
-    // === XLSX Streaming Pipeline ===
-    const hash = generateHash();
-    const outputDir = options.outputDir || process.cwd();
-
-    // Parse chunk size
-    const chunkInputLower = chunkInput.toLowerCase();
-    let chunkSizeBytes;
-
-    if (chunkInputLower === '0' || chunkInputLower === 'max' || chunkInputLower === 'single' || chunkInputLower === 'none' || chunkInputLower === '') {
-      chunkSizeBytes = Infinity;
-    } else if (/^\d+\s*parts?$/i.test(chunkInput)) {
-      const numParts = parseInt(chunkInput, 10);
-      if (numParts < 1) {
-        throw new Error('Number of parts must be at least 1');
-      }
-      // Estimate output size for part calculation
-      const estimatedBase64Size = Math.ceil(fileSize * 4 / 3);
-      chunkSizeBytes = Math.ceil(estimatedBase64Size / numParts);
-      spinner.info && spinner.info(`Splitting into ~${numParts} parts (~${formatBytes(chunkSizeBytes)} content each)`);
-    } else if (chunkInput) {
-      chunkSizeBytes = parseSizeToBytes(chunkInput);
-    } else {
-      chunkSizeBytes = 5 * 1024 * 1024; // 5MB default
-    }
-
-    // Pre-compute content hash (fast streaming SHA-256 pass)
-    spinner.text = 'Computing file hash...';
-    const contentHash = await computeFileHash(streamSource);
-
-    // Generate session salt for encryption (shared across all parts)
-    const sessionSalt = useEncryption ? generateSalt() : null;
-
-    spinner.text = useCompression ? 'Compressing and encoding...' : 'Encoding...';
-
-    // We don't know totalParts upfront (depends on compression ratio).
-    // We write each part with partNumber set, and totalParts as null.
-    // Decode discovers all parts by filename pattern matching (already supported).
-    const partFiles = [];
-
-    if (useEncryption) {
-      // Encrypted pipeline: compress → collect binary chunks → encrypt per-part → base64 → xlsx
-      // Binary chunk size accounts for base64 expansion (~4/3x)
-      const binaryChunkSize = chunkSizeBytes === Infinity ? Infinity : Math.floor(chunkSizeBytes * 3 / 4);
-
-      const onBinaryChunkReady = async (binaryBuffer, index) => {
-        const partNumber = index + 1;
-        const partSpinner = quiet ? spinner : ora(`Creating part ${partNumber}...`).start();
-
-        // Encrypt this chunk independently
-        const { stream: cipher, iv, salt, getAuthTag } = createEncryptStream(options.password, sessionSalt);
-        const encrypted = Buffer.concat([cipher.update(binaryBuffer), cipher.final()]);
-        const authTag = getAuthTag();
-        const base64Chunk = encrypted.toString('base64');
-
-        const metadata = createMetadata({
-          originalFilename: filename,
-          originalExtension: extension,
-          hash,
-          partNumber,
-          totalParts: null,
-          originalSize: fileSize,
-          format,
-          encrypted: true,
-          compressed: useCompression,
-          contentHash,
-        });
-
-        const encryptionMeta = packEncryptionMeta({ iv, salt, authTag });
-        const outputFilename = generateFilename(hash, partNumber, null, format);
-        const outputPath = path.join(outputDir, outputFilename);
-
-        if (fs.existsSync(outputPath) && !options.force) {
-          throw new Error(`File already exists: ${outputPath}. Use --force to overwrite.`);
-        }
-
-        await createXlsxPartStreaming({
-          base64Content: base64Chunk,
-          encryptionMeta,
-          metadataJson: serializeMetadata(metadata),
-          outputPath,
-        });
-
-        partFiles.push(outputPath);
-        createdFiles.push(outputPath);
-        partSpinner.succeed && partSpinner.succeed(`Created: ${outputFilename} (${formatBytes(base64Chunk.length)} encoded)`);
-      };
-
-      const collector = new BinaryChunkCollector(binaryChunkSize, onBinaryChunkReady);
-
-      // Build pipeline
-      const streams = [fs.createReadStream(streamSource)];
-      if (useCompression) {
-        streams.push(createCompressStream());
-      }
-      streams.push(collector);
-
-      await pipeline(...streams);
-    } else {
-      // Unencrypted pipeline: compress → base64 → collect string chunks → xlsx
-      const onChunkReady = async (base64Chunk, index) => {
-        const partNumber = index + 1;
-        const partSpinner = quiet ? spinner : ora(`Creating part ${partNumber}...`).start();
-
-        const metadata = createMetadata({
-          originalFilename: filename,
-          originalExtension: extension,
-          hash,
-          partNumber,
-          totalParts: null,
-          originalSize: fileSize,
-          format,
-          encrypted: false,
-          compressed: useCompression,
-          contentHash,
-        });
-
-        const outputFilename = generateFilename(hash, partNumber, null, format);
-        const outputPath = path.join(outputDir, outputFilename);
-
-        if (fs.existsSync(outputPath) && !options.force) {
-          throw new Error(`File already exists: ${outputPath}. Use --force to overwrite.`);
-        }
-
-        await createXlsxPartStreaming({
-          base64Content: base64Chunk,
-          encryptionMeta: '',
-          metadataJson: serializeMetadata(metadata),
-          outputPath,
-        });
-
-        partFiles.push(outputPath);
-        createdFiles.push(outputPath);
-        partSpinner.succeed && partSpinner.succeed(`Created: ${outputFilename} (${formatBytes(base64Chunk.length)} encoded)`);
-      };
-
-      const collector = new ChunkCollector(chunkSizeBytes, onChunkReady);
-
-      // Build pipeline
-      const streams = [fs.createReadStream(streamSource)];
-      if (useCompression) {
-        streams.push(createCompressStream());
-      }
-      streams.push(new Base64EncodeTransform());
-      streams.push(collector);
-
-      await pipeline(...streams);
-    }
-
-    const totalParts = partFiles.length;
-
-    spinner.succeed && spinner.succeed('Encoding complete!');
-
-    if (!quiet) {
-      console.log();
-      console.log(chalk.green.bold('✓ File encoded successfully!'));
-      console.log(chalk.cyan(`  Format: ${format.toUpperCase()}`));
-      console.log(chalk.cyan(`  Hash: ${hash}`));
-      if (totalParts > 1) {
-        console.log(chalk.cyan(`  Parts: ${totalParts}`));
-      }
-      console.log(chalk.cyan(`  Encrypted: ${useEncryption ? 'Yes' : 'No'}`));
-      console.log(chalk.cyan(`  Compressed: ${useCompression ? 'Yes' : 'No'}`));
-      console.log(chalk.cyan(`  Location: ${outputDir}`));
-      if (useEncryption) {
-        console.log(chalk.yellow(`  Remember your password - it cannot be recovered!`));
-      }
-    }
-
-    if (tempZipPath) cleanupTemp(tempZipPath);
-  } catch (error) {
-    spinner.fail && spinner.fail('Encoding failed');
-
-    // Cleanup partially created files
-    for (const file of createdFiles) {
-      try {
-        if (fs.existsSync(file)) {
-          fs.unlinkSync(file);
-        }
-      } catch {
-        // Ignore cleanup errors
-      }
-    }
-
-    console.error(chalk.red(`Error: ${error.message}`));
-    process.exit(1);
-  }
-}
-
-/**
- * Legacy in-memory encode path for DOCX format
- */
-async function encodeLegacyDocx(inputPath, filename, extension, fileSize, options, useCompression, useEncryption, spinner, quiet, createdFiles) {
-  const { compress } = require('../lib/compression');
-  const { encrypt, packEncryptionMeta: packMeta } = require('../lib/crypto');
-  const { generateContentHash } = require('../lib/utils');
-  const { createDocxWithBase64 } = require('../lib/docx-handler');
-
-  const fileBuffer = fs.readFileSync(inputPath);
-  const contentHash = generateContentHash(fileBuffer);
-
-  // Compress if beneficial
-  let processedBuffer = fileBuffer;
-  if (useCompression) {
-    spinner.text = 'Compressing...';
-    const compressedBuffer = await compress(fileBuffer);
-    if (compressedBuffer.length < fileBuffer.length) {
-      processedBuffer = compressedBuffer;
-      spinner.succeed && spinner.succeed(`Compressed: ${formatBytes(fileBuffer.length)} → ${formatBytes(compressedBuffer.length)}`);
-    } else {
-      useCompression = false;
-      spinner.info && spinner.info('Compression skipped (no size benefit)');
-    }
-  }
-
-  // Convert to base64
-  const base64 = processedBuffer.toString('base64');
-
-  let contentToStore;
-  let encryptionMeta = null;
-
-  if (useEncryption) {
-    spinner.text = 'Encrypting content...';
-    const { ciphertext, iv, salt, authTag } = encrypt(base64, options.password);
-    encryptionMeta = packMeta({ iv, salt, authTag });
-    contentToStore = ciphertext;
-    spinner.succeed && spinner.succeed('Content encrypted with AES-256-GCM');
-  } else {
-    contentToStore = base64;
-  }
-
-  const hash = generateHash();
-  const outputDir = options.outputDir || process.cwd();
-  const format = 'docx';
-
-  const metadata = createMetadata({
-    originalFilename: filename,
-    originalExtension: extension,
-    hash,
-    partNumber: null,
-    totalParts: null,
-    originalSize: fileSize,
-    format,
-    encrypted: useEncryption,
-    compressed: useCompression,
-    contentHash,
-  });
-
-  const outputFilename = generateFilename(hash, null, null, format);
-  const outputPath = path.join(outputDir, outputFilename);
-
-  if (fs.existsSync(outputPath) && !options.force) {
-    throw new Error(`File already exists: ${outputPath}. Use --force to overwrite.`);
-  }
-
-  const docxContent = useEncryption
-    ? `${encryptionMeta}|||${contentToStore}`
-    : contentToStore;
-
-  await createDocxWithBase64({
-    base64Content: docxContent,
-    metadata,
-    outputPath,
-  });
-
-  createdFiles.push(outputPath);
-  spinner.succeed && spinner.succeed('Encoding complete!');
-
-  if (!quiet) {
-    console.log();
-    console.log(chalk.green.bold('✓ File encoded successfully!'));
-    console.log(chalk.cyan(`  Format: DOCX`));
-    console.log(chalk.cyan(`  Hash: ${hash}`));
-    console.log(chalk.cyan(`  Output: ${outputFilename}`));
-    console.log(chalk.cyan(`  Encrypted: ${useEncryption ? 'Yes' : 'No'}`));
-    console.log(chalk.cyan(`  Compressed: ${useCompression ? 'Yes' : 'No'}`));
-    console.log(chalk.cyan(`  Location: ${outputDir}`));
-    if (useEncryption) {
-      console.log(chalk.yellow(`  Remember your password - it cannot be recovered!`));
-    }
-  }
-}
-
-/**
- * Cleanup temporary file
- */
-function cleanupTemp(tempPath) {
-  try {
-    if (fs.existsSync(tempPath)) {
-      fs.unlinkSync(tempPath);
-    }
-  } catch {
-    // Ignore
-  }
-}
-
-module.exports = encodeCommand;
+const path = require('path');
+const fs = require('fs');
+const { pipeline } = require('stream/promises');
+const chalk = require('chalk');
+const ora = require('ora');
+const AdmZip = require('adm-zip');
+const { createDocxWithBase64, createDocxV5 } = require('../lib/docx-handler');
+const { createXlsxPartStreaming, createXlsxPartV5 } = require('../lib/xlsx-handler');
+const { createMetadata, serializeMetadata } = require('../lib/metadata');
+const crypto = require('crypto');
+const { generateHash, parseSizeToBytes, formatBytes, generateFilename } = require('../lib/utils');
+const { packEncryptionMeta, generateSalt, createEncryptStream } = require('../lib/crypto');
+const { isCompressedMime, createCompressStream, createBrotliCompressStream } = require('../lib/compression');
+const { resetTimeWindow } = require('../lib/decoy-generator');
+const { resetTimeState, BYTES_PER_DATA_LINE, calculateDataLineCount } = require('../lib/log-generator');
+const { shouldRunInteractive, promptEncodeOptions } = require('../lib/interactive');
+const { Base64EncodeTransform, ChunkCollector, BinaryChunkCollector } = require('../lib/streams');
+
+/**
+ * Zip a folder into a buffer
+ */
+function zipFolder(folderPath) {
+  const zip = new AdmZip();
+  zip.addLocalFolder(folderPath);
+  return zip.toBuffer();
+}
+
+/**
+ * Detect file type from the first 4KB
+ */
+async function detectFileType(filePath) {
+  try {
+    const { fileTypeFromBuffer } = await import('file-type');
+    const fd = await fs.promises.open(filePath, 'r');
+    const buf = Buffer.alloc(4100);
+    await fd.read(buf, 0, 4100, 0);
+    await fd.close();
+    return await fileTypeFromBuffer(buf);
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Compute SHA-256 hash of a file using streaming
+ */
+async function computeFileHash(filePath) {
+  return new Promise((resolve, reject) => {
+    const hash = crypto.createHash('sha256');
+    const stream = fs.createReadStream(filePath);
+    stream.on('data', (chunk) => hash.update(chunk));
+    stream.on('end', () => resolve(hash.digest('hex')));
+    stream.on('error', reject);
+  });
+}
+
+/**
+ * Encode a file to XLSX/DOCX format with optional AES encryption and compression.
+ */
+async function encodeCommand(inputFile, options) {
+  // Check if we should run interactive mode
+  if (shouldRunInteractive(options, 'encode')) {
+    const filename = path.basename(inputFile);
+    console.log(chalk.bold(`\nEncoding: ${filename}`));
+
+    const interactiveOptions = await promptEncodeOptions(filename);
+    options = { ...options, ...interactiveOptions };
+    console.log();
+  }
+
+  const quiet = options.quiet || false;
+  const legacy = options.legacy || false;
+  const spinner = quiet ? { start: () => {}, succeed: () => {}, fail: () => {}, info: () => {}, text: '' } : ora('Starting encoding process...').start();
+  const createdFiles = [];
+
+  // Reset time windows
+  resetTimeWindow();
+  resetTimeState();
+
+  try {
+    if (!fs.existsSync(inputFile)) {
+      throw new Error(`Path not found: ${inputFile}`);
+    }
+
+    const isDirectory = fs.statSync(inputFile).isDirectory();
+    const format = (options.format || 'xlsx').toLowerCase();
+    if (format !== 'xlsx' && format !== 'docx') {
+      throw new Error('Invalid format. Use "xlsx" or "docx".');
+    }
+
+    const useEncryption = !!options.password;
+    const chunkInput = (options.chunkSize || '').toString().trim();
+
+    let streamSource;
+    let filename;
+    let extension;
+    let fileSize;
+    let tempZipPath = null;
+
+    if (isDirectory) {
+      spinner.text = 'Zipping folder...';
+      const folderName = path.basename(inputFile);
+      const zipBuffer = zipFolder(inputFile);
+      filename = `${folderName}.zip`;
+      extension = '.zip';
+      fileSize = zipBuffer.length;
+
+      tempZipPath = path.join(require('os').tmpdir(), `stegdoc_${Date.now()}.zip`);
+      fs.writeFileSync(tempZipPath, zipBuffer);
+      streamSource = tempZipPath;
+
+      spinner.succeed && spinner.succeed(`Folder zipped: ${folderName}/ → ${formatBytes(fileSize)}`);
+    } else {
+      streamSource = inputFile;
+      filename = path.basename(inputFile);
+      extension = path.extname(inputFile);
+      fileSize = fs.statSync(inputFile).size;
+      spinner.succeed && spinner.succeed(`File detected: ${filename} (${formatBytes(fileSize)})`);
+    }
+
+    spinner.text = 'Checking file type...';
+    let useCompression = true;
+    const fileType = await detectFileType(streamSource);
+
+    if (fileType && isCompressedMime(fileType.mime)) {
+      useCompression = false;
+      spinner.info && spinner.info(`Skipping compression (${fileType.ext} is already compressed)`);
+    }
+
+    // DOCX v5 size limit (not applicable in legacy mode or with --no-limit)
+    const noLimit = options.noLimit || options.limit === false;
+    if (format === 'docx' && !legacy && !noLimit && fileSize > 1 * 1024 * 1024) {
+      throw new Error(
+        `DOCX format is limited to files under 1 MB (yours is ${formatBytes(fileSize)}). ` +
+        `Use XLSX format (-f xlsx) for larger files, or --no-limit to bypass.`
+      );
+    }
+
+    // Route to legacy or v5 pipeline
+    if (legacy) {
+      if (format === 'docx') {
+        await encodeLegacyDocx(streamSource, filename, extension, fileSize, options, useCompression, useEncryption, spinner, quiet, createdFiles);
+      } else {
+        await encodeLegacyXlsx(streamSource, filename, extension, fileSize, options, useCompression, useEncryption, spinner, quiet, createdFiles);
+      }
+      if (tempZipPath) cleanupTemp(tempZipPath);
+      return;
+    }
+
+    // === v5 Log-Embed Pipeline ===
+    const hash = generateHash();
+    const outputDir = options.outputDir || process.cwd();
+
+    // Parse chunk size
+    const chunkInputLower = chunkInput.toLowerCase();
+    let chunkSizeBytes;
+
+    if (chunkInputLower === '0' || chunkInputLower === 'max' || chunkInputLower === 'single' || chunkInputLower === 'none' || chunkInputLower === '') {
+      chunkSizeBytes = Infinity;
+    } else if (/^\d+\s*parts?$/i.test(chunkInput)) {
+      const numParts = parseInt(chunkInput, 10);
+      if (numParts < 1) {
+        throw new Error('Number of parts must be at least 1');
+      }
+      const estimatedBase64Size = Math.ceil(fileSize * 4 / 3);
+      chunkSizeBytes = Math.ceil(estimatedBase64Size / numParts);
+      spinner.info && spinner.info(`Splitting into ~${numParts} parts (~${formatBytes(chunkSizeBytes)} content each)`);
+    } else if (chunkInput) {
+      chunkSizeBytes = parseSizeToBytes(chunkInput);
+    } else {
+      chunkSizeBytes = 5 * 1024 * 1024; // 5MB default
+    }
+
+    // Pre-compute content hash
+    spinner.text = 'Computing file hash...';
+    const contentHash = await computeFileHash(streamSource);
+
+    // Generate session salt for encryption
+    const sessionSalt = useEncryption ? generateSalt() : null;
+
+    spinner.text = useCompression ? 'Compressing (Brotli) and encoding...' : 'Encoding...';
+
+    const partFiles = [];
+
+    // v5 pipeline: compress (brotli) → collect binary chunks → encrypt per-part → embed in log lines
+    const binaryChunkSize = chunkSizeBytes === Infinity ? Infinity : Math.floor(chunkSizeBytes * 3 / 4);
+
+    const onBinaryChunkReady = async (binaryBuffer, index) => {
+      const partNumber = index + 1;
+      const partSpinner = quiet ? spinner : ora(`Creating part ${partNumber}...`).start();
+
+      let payloadBuffer;
+      let encryptionMeta = '';
+
+      if (useEncryption) {
+        const { stream: cipher, iv, salt, getAuthTag } = createEncryptStream(options.password, sessionSalt);
+        payloadBuffer = Buffer.concat([cipher.update(binaryBuffer), cipher.final()]);
+        const authTag = getAuthTag();
+        encryptionMeta = packEncryptionMeta({ iv, salt, authTag });
+      } else {
+        payloadBuffer = binaryBuffer;
+      }
+
+      const dataLineCount = calculateDataLineCount(payloadBuffer.length);
+
+      const metadata = createMetadata({
+        originalFilename: filename,
+        originalExtension: extension,
+        hash,
+        partNumber,
+        totalParts: null,
+        originalSize: fileSize,
+        format,
+        encrypted: useEncryption,
+        compressed: useCompression,
+        contentHash,
+        stegoMethod: 'log-embed',
+        compressionAlgo: 'brotli',
+        payloadSize: payloadBuffer.length,
+        dataLineCount,
+        headerLineCount: null,
+      });
+
+      const metadataJson = serializeMetadata(metadata);
+
+      // Calculate header line count with actual metadata
+      const actualHeaderPayload = Buffer.from(`STGD05|${Buffer.from(metadataJson).length}|${Buffer.from(encryptionMeta).length}|${metadataJson}${encryptionMeta}`);
+      const actualHeaderLineCount = Math.ceil(actualHeaderPayload.length / BYTES_PER_DATA_LINE);
+      metadata.headerLineCount = actualHeaderLineCount;
+
+      // Verify stability
+      const finalMetadataJson = serializeMetadata(metadata);
+      const verifyPayload = Buffer.from(`STGD05|${Buffer.from(finalMetadataJson).length}|${Buffer.from(encryptionMeta).length}|${finalMetadataJson}${encryptionMeta}`);
+      const verifyCount = Math.ceil(verifyPayload.length / BYTES_PER_DATA_LINE);
+      if (verifyCount !== actualHeaderLineCount) {
+        metadata.headerLineCount = verifyCount;
+      }
+
+      const outputFilename = generateFilename(hash, partNumber, null, format);
+      const outputPath = path.join(outputDir, outputFilename);
+
+      if (fs.existsSync(outputPath) && !options.force) {
+        throw new Error(`File already exists: ${outputPath}. Use --force to overwrite.`);
+      }
+
+      if (format === 'docx') {
+        await createDocxV5({
+          payloadBuffer,
+          encryptionMeta,
+          metadataJson: serializeMetadata(metadata),
+          outputPath,
+          hash,
+        });
+      } else {
+        await createXlsxPartV5({
+          payloadBuffer,
+          encryptionMeta,
+          metadataJson: serializeMetadata(metadata),
+          outputPath,
+        });
+      }
+
+      partFiles.push(outputPath);
+      createdFiles.push(outputPath);
+      partSpinner.succeed && partSpinner.succeed(`Created: ${outputFilename} (${formatBytes(payloadBuffer.length)} payload, ${dataLineCount} data lines)`);
+    };
+
+    const collector = new BinaryChunkCollector(binaryChunkSize, onBinaryChunkReady);
+
+    const streams = [fs.createReadStream(streamSource)];
+    if (useCompression) {
+      streams.push(createBrotliCompressStream());
+    }
+    streams.push(collector);
+
+    await pipeline(...streams);
+
+    const totalParts = partFiles.length;
+
+    spinner.succeed && spinner.succeed('Encoding complete!');
+
+    if (!quiet) {
+      console.log();
+      console.log(chalk.green.bold('✓ File encoded successfully!'));
+      console.log(chalk.cyan(`  Format: ${format.toUpperCase()} (v5 log-embed)`));
+      console.log(chalk.cyan(`  Hash: ${hash}`));
+      if (totalParts > 1) {
+        console.log(chalk.cyan(`  Parts: ${totalParts}`));
+      }
+      console.log(chalk.cyan(`  Encrypted: ${useEncryption ? 'Yes' : 'No'}`));
+      console.log(chalk.cyan(`  Compressed: ${useCompression ? 'Yes (Brotli)' : 'No'}`));
+      console.log(chalk.cyan(`  Location: ${outputDir}`));
+      if (useEncryption) {
+        console.log(chalk.yellow(`  Remember your password - it cannot be recovered!`));
+      }
+    }
+
+    if (tempZipPath) cleanupTemp(tempZipPath);
+  } catch (error) {
+    spinner.fail && spinner.fail('Encoding failed');
+
+    for (const file of createdFiles) {
+      try {
+        if (fs.existsSync(file)) {
+          fs.unlinkSync(file);
+        }
+      } catch {
+        // Ignore cleanup errors
+      }
+    }
+
+    console.error(chalk.red(`Error: ${error.message}`));
+    process.exit(1);
+  }
+}
+
+// ─── Legacy v4 XLSX Pipeline ────────────────────────────────────────────────
+
+async function encodeLegacyXlsx(inputPath, filename, extension, fileSize, options, useCompression, useEncryption, spinner, quiet, createdFiles) {
+  const hash = generateHash();
+  const outputDir = options.outputDir || process.cwd();
+  const format = 'xlsx';
+  const chunkInput = (options.chunkSize || '').toString().trim();
+
+  // Parse chunk size
+  const chunkInputLower = chunkInput.toLowerCase();
+  let chunkSizeBytes;
+
+  if (chunkInputLower === '0' || chunkInputLower === 'max' || chunkInputLower === 'single' || chunkInputLower === 'none' || chunkInputLower === '') {
+    chunkSizeBytes = Infinity;
+  } else if (/^\d+\s*parts?$/i.test(chunkInput)) {
+    const numParts = parseInt(chunkInput, 10);
+    if (numParts < 1) throw new Error('Number of parts must be at least 1');
+    const estimatedBase64Size = Math.ceil(fileSize * 4 / 3);
+    chunkSizeBytes = Math.ceil(estimatedBase64Size / numParts);
+    spinner.info && spinner.info(`Splitting into ~${numParts} parts (~${formatBytes(chunkSizeBytes)} content each)`);
+  } else if (chunkInput) {
+    chunkSizeBytes = parseSizeToBytes(chunkInput);
+  } else {
+    chunkSizeBytes = 5 * 1024 * 1024;
+  }
+
+  spinner.text = 'Computing file hash...';
+  const contentHash = await computeFileHash(inputPath);
+
+  const sessionSalt = useEncryption ? generateSalt() : null;
+
+  spinner.text = useCompression ? 'Compressing and encoding (legacy v4)...' : 'Encoding (legacy v4)...';
+
+  const partFiles = [];
+
+  if (useEncryption) {
+    const binaryChunkSize = chunkSizeBytes === Infinity ? Infinity : Math.floor(chunkSizeBytes * 3 / 4);
+
+    const onBinaryChunkReady = async (binaryBuffer, index) => {
+      const partNumber = index + 1;
+      const partSpinner = quiet ? spinner : ora(`Creating part ${partNumber}...`).start();
+
+      const { stream: cipher, iv, salt, getAuthTag } = createEncryptStream(options.password, sessionSalt);
+      const encrypted = Buffer.concat([cipher.update(binaryBuffer), cipher.final()]);
+      const authTag = getAuthTag();
+      const base64Chunk = encrypted.toString('base64');
+
+      const metadata = createMetadata({
+        originalFilename: filename,
+        originalExtension: extension,
+        hash,
+        partNumber,
+        totalParts: null,
+        originalSize: fileSize,
+        format,
+        encrypted: true,
+        compressed: useCompression,
+        contentHash,
+      });
+
+      const encryptionMeta = packEncryptionMeta({ iv, salt, authTag });
+      const outputFilename = generateFilename(hash, partNumber, null, format);
+      const outputPath = path.join(outputDir, outputFilename);
+
+      if (fs.existsSync(outputPath) && !options.force) {
+        throw new Error(`File already exists: ${outputPath}. Use --force to overwrite.`);
+      }
+
+      await createXlsxPartStreaming({
+        base64Content: base64Chunk,
+        encryptionMeta,
+        metadataJson: serializeMetadata(metadata),
+        outputPath,
+      });
+
+      partFiles.push(outputPath);
+      createdFiles.push(outputPath);
+      partSpinner.succeed && partSpinner.succeed(`Created: ${outputFilename} (${formatBytes(base64Chunk.length)} encoded)`);
+    };
+
+    const collector = new BinaryChunkCollector(binaryChunkSize, onBinaryChunkReady);
+    const streams = [fs.createReadStream(inputPath)];
+    if (useCompression) streams.push(createCompressStream());
+    streams.push(collector);
+    await pipeline(...streams);
+  } else {
+    const onChunkReady = async (base64Chunk, index) => {
+      const partNumber = index + 1;
+      const partSpinner = quiet ? spinner : ora(`Creating part ${partNumber}...`).start();
+
+      const metadata = createMetadata({
+        originalFilename: filename,
+        originalExtension: extension,
+        hash,
+        partNumber,
+        totalParts: null,
+        originalSize: fileSize,
+        format,
+        encrypted: false,
+        compressed: useCompression,
+        contentHash,
+      });
+
+      const outputFilename = generateFilename(hash, partNumber, null, format);
+      const outputPath = path.join(outputDir, outputFilename);
+
+      if (fs.existsSync(outputPath) && !options.force) {
+        throw new Error(`File already exists: ${outputPath}. Use --force to overwrite.`);
+      }
+
+      await createXlsxPartStreaming({
+        base64Content: base64Chunk,
+        encryptionMeta: '',
+        metadataJson: serializeMetadata(metadata),
+        outputPath,
+      });
+
+      partFiles.push(outputPath);
+      createdFiles.push(outputPath);
+      partSpinner.succeed && partSpinner.succeed(`Created: ${outputFilename} (${formatBytes(base64Chunk.length)} encoded)`);
+    };
+
+    const collector = new ChunkCollector(chunkSizeBytes, onChunkReady);
+    const streams = [fs.createReadStream(inputPath)];
+    if (useCompression) streams.push(createCompressStream());
+    streams.push(new Base64EncodeTransform());
+    streams.push(collector);
+    await pipeline(...streams);
+  }
+
+  const totalParts = partFiles.length;
+  spinner.succeed && spinner.succeed('Encoding complete!');
+
+  if (!quiet) {
+    console.log();
+    console.log(chalk.green.bold('✓ File encoded successfully!'));
+    console.log(chalk.cyan(`  Format: XLSX (v4 legacy)`));
+    console.log(chalk.cyan(`  Hash: ${hash}`));
+    if (totalParts > 1) {
+      console.log(chalk.cyan(`  Parts: ${totalParts}`));
+    }
+    console.log(chalk.cyan(`  Encrypted: ${useEncryption ? 'Yes' : 'No'}`));
+    console.log(chalk.cyan(`  Compressed: ${useCompression ? 'Yes (gzip)' : 'No'}`));
+    console.log(chalk.cyan(`  Location: ${outputDir}`));
+    if (useEncryption) {
+      console.log(chalk.yellow(`  Remember your password - it cannot be recovered!`));
+    }
+  }
+}
+
+// ─── Legacy v4 DOCX Pipeline ────────────────────────────────────────────────
+
+async function encodeLegacyDocx(inputPath, filename, extension, fileSize, options, useCompression, useEncryption, spinner, quiet, createdFiles) {
+  const { compress } = require('../lib/compression');
+  const { encrypt, packEncryptionMeta: packMeta } = require('../lib/crypto');
+  const { generateContentHash } = require('../lib/utils');
+
+  const fileBuffer = fs.readFileSync(inputPath);
+  const contentHash = generateContentHash(fileBuffer);
+
+  let processedBuffer = fileBuffer;
+  if (useCompression) {
+    spinner.text = 'Compressing...';
+    const compressedBuffer = await compress(fileBuffer);
+    if (compressedBuffer.length < fileBuffer.length) {
+      processedBuffer = compressedBuffer;
+      spinner.succeed && spinner.succeed(`Compressed: ${formatBytes(fileBuffer.length)} → ${formatBytes(compressedBuffer.length)}`);
+    } else {
+      useCompression = false;
+      spinner.info && spinner.info('Compression skipped (no size benefit)');
+    }
+  }
+
+  const base64 = processedBuffer.toString('base64');
+
+  let contentToStore;
+  let encryptionMeta = null;
+
+  if (useEncryption) {
+    spinner.text = 'Encrypting content...';
+    const { ciphertext, iv, salt, authTag } = encrypt(base64, options.password);
+    encryptionMeta = packMeta({ iv, salt, authTag });
+    contentToStore = ciphertext;
+    spinner.succeed && spinner.succeed('Content encrypted with AES-256-GCM');
+  } else {
+    contentToStore = base64;
+  }
+
+  const hash = generateHash();
+  const outputDir = options.outputDir || process.cwd();
+  const format = 'docx';
+
+  const metadata = createMetadata({
+    originalFilename: filename,
+    originalExtension: extension,
+    hash,
+    partNumber: null,
+    totalParts: null,
+    originalSize: fileSize,
+    format,
+    encrypted: useEncryption,
+    compressed: useCompression,
+    contentHash,
+  });
+
+  const outputFilename = generateFilename(hash, null, null, format);
+  const outputPath = path.join(outputDir, outputFilename);
+
+  if (fs.existsSync(outputPath) && !options.force) {
+    throw new Error(`File already exists: ${outputPath}. Use --force to overwrite.`);
+  }
+
+  const docxContent = useEncryption
+    ? `${encryptionMeta}|||${contentToStore}`
+    : contentToStore;
+
+  await createDocxWithBase64({
+    base64Content: docxContent,
+    metadata,
+    outputPath,
+  });
+
+  createdFiles.push(outputPath);
+  spinner.succeed && spinner.succeed('Encoding complete!');
+
+  if (!quiet) {
+    console.log();
+    console.log(chalk.green.bold('✓ File encoded successfully!'));
+    console.log(chalk.cyan(`  Format: DOCX (v4 legacy)`));
+    console.log(chalk.cyan(`  Hash: ${hash}`));
+    console.log(chalk.cyan(`  Output: ${outputFilename}`));
+    console.log(chalk.cyan(`  Encrypted: ${useEncryption ? 'Yes' : 'No'}`));
+    console.log(chalk.cyan(`  Compressed: ${useCompression ? 'Yes' : 'No'}`));
+    console.log(chalk.cyan(`  Location: ${outputDir}`));
+    if (useEncryption) {
+      console.log(chalk.yellow(`  Remember your password - it cannot be recovered!`));
+    }
+  }
+}
+
+function cleanupTemp(tempPath) {
+  try {
+    if (fs.existsSync(tempPath)) {
+      fs.unlinkSync(tempPath);
+    }
+  } catch {
+    // Ignore
+  }
+}
+
+module.exports = encodeCommand;