stegdoc 5.6.0 → 6.0.0

package/src/commands/encode.js

@@ -5,7 +5,7 @@ const chalk = require('chalk');
 const ora = require('ora');
 const AdmZip = require('adm-zip');
 const { createDocxWithBase64, createDocxV5 } = require('../lib/docx-handler');
-const { createXlsxPartStreaming, createXlsxPartV5 } = require('../lib/xlsx-handler');
+const { createXlsxPartV5 } = require('../lib/xlsx-handler');
 const { createMetadata, serializeMetadata } = require('../lib/metadata');
 const crypto = require('crypto');
 const { generateHash, parseSizeToBytes, formatBytes, generateFilename } = require('../lib/utils');
@@ -14,7 +14,8 @@ const { isCompressedMime, createCompressStream, createBrotliCompressStream } = r
 const { resetTimeWindow } = require('../lib/decoy-generator');
 const { resetTimeState, BYTES_PER_DATA_LINE, calculateDataLineCount } = require('../lib/log-generator');
 const { shouldRunInteractive, promptEncodeOptions } = require('../lib/interactive');
-const { Base64EncodeTransform, ChunkCollector, BinaryChunkCollector, ProgressTransform } = require('../lib/streams');
+const { BinaryChunkCollector, ProgressTransform } = require('../lib/streams');
+const { loadNative } = require('../lib/native');
 
 /**
  * Zip a folder into a buffer
@@ -25,6 +26,65 @@ function zipFolder(folderPath) {
   return zip.toBuffer();
 }
 
+/**
+ * Pick an archive entry name that is not taken yet, disambiguating inputs that
+ * share a basename by inserting a counter before the extension.
+ *
+ * @param {string} name Preferred entry name.
+ * @param {Set<string>} used Names already placed in the archive.
+ * @returns {string} A free entry name, which is added to `used`.
+ */
+function uniqueEntryName(name, used) {
+  if (!used.has(name)) {
+    used.add(name);
+    return name;
+  }
+  const extension = path.extname(name);
+  const stem = name.slice(0, name.length - extension.length);
+  let counter = 2;
+  let candidate = `${stem}-${counter}${extension}`;
+  while (used.has(candidate)) {
+    counter += 1;
+    candidate = `${stem}-${counter}${extension}`;
+  }
+  used.add(candidate);
+  return candidate;
+}
+
+/**
+ * Zip several inputs into one buffer. Files land at the archive root under
+ * their basename; a folder keeps its own name as a prefix.
+ *
+ * @param {string[]} inputs Absolute or relative paths to files and folders.
+ * @returns {Buffer} The archive bytes.
+ */
+function zipInputs(inputs) {
+  const zip = new AdmZip();
+  const used = new Set();
+  for (const input of inputs) {
+    const base = path.basename(input.replace(/[\\/]+$/, ''));
+    const entry = uniqueEntryName(base, used);
+    if (fs.statSync(input).isDirectory()) {
+      zip.addLocalFolder(input, entry);
+    } else {
+      zip.addLocalFile(input, '', entry);
+    }
+  }
+  return zip.toBuffer();
+}
+
+/**
+ * Normalise a bundle name: no path segments, always a `.zip` extension.
+ *
+ * @param {string} name Requested name, possibly empty.
+ * @returns {string} The filename recorded in metadata for the bundle.
+ */
+function bundleFilename(name) {
+  const base = path.basename((name || '').trim());
+  if (!base || base === '.' || base === '..') return 'bundle.zip';
+  return base.toLowerCase().endsWith('.zip') ? base : `${base}.zip`;
+}
+
 /**
  * Detect file type from the first 4KB
  */
@@ -57,12 +117,24 @@ async function computeFileHash(filePath) {
 }
 
 /**
- * Encode a file to XLSX/DOCX format with optional AES encryption and compression.
+ * Encode one or more inputs to XLSX/DOCX format with optional AES encryption
+ * and compression. Several inputs, or a single folder, are zipped first and the
+ * archive is what gets encoded, so a decode hands back that zip.
+ *
+ * @param {string|string[]} input One path, or several to bundle together.
+ * @param {object} options Commander options for the encode command.
  */
-async function encodeCommand(inputFile, options) {
+async function encodeCommand(input, options) {
+  const inputs = Array.isArray(input) ? input : [input];
+  if (inputs.length === 0) {
+    throw new Error('No input given.');
+  }
+  const bundling = inputs.length > 1;
+  const bundleName = bundleFilename(options.bundleName);
+
   // Check if we should run interactive mode
   if (shouldRunInteractive(options, 'encode')) {
-    const filename = path.basename(inputFile);
+    const filename = bundling ? bundleName : path.basename(inputs[0]);
     console.log(chalk.bold(`\nEncoding: ${filename}`));
 
     const interactiveOptions = await promptEncodeOptions(filename);
@@ -72,6 +144,13 @@ async function encodeCommand(inputFile, options) {
 
   const quiet = options.quiet || false;
   const legacy = options.legacy || false;
+  if (options.v5 && options.v6) {
+    throw new Error('--v5 and --v6 cannot be combined.');
+  }
+  if (legacy && (options.v5 || options.v6)) {
+    throw new Error('--legacy cannot be combined with --v5 or --v6.');
+  }
+  const version = options.v5 ? 'v5' : 'v6';
   const spinner = quiet ? { start: () => {}, succeed: () => {}, fail: () => {}, info: () => {}, text: '' } : ora('Starting encoding process...').start();
   const createdFiles = [];
 
@@ -80,11 +159,14 @@ async function encodeCommand(inputFile, options) {
   resetTimeState();
 
   try {
-    if (!fs.existsSync(inputFile)) {
-      throw new Error(`Path not found: ${inputFile}`);
+    for (const candidate of inputs) {
+      if (!fs.existsSync(candidate)) {
+        throw new Error(`Path not found: ${candidate}`);
+      }
     }
 
-    const isDirectory = fs.statSync(inputFile).isDirectory();
+    const inputFile = inputs[0];
+    const isDirectory = !bundling && fs.statSync(inputFile).isDirectory();
     const format = (options.format || 'xlsx').toLowerCase();
     if (format !== 'xlsx' && format !== 'docx') {
       throw new Error('Invalid format. Use "xlsx" or "docx".');
@@ -99,7 +181,23 @@ async function encodeCommand(inputFile, options) {
     let fileSize;
     let tempZipPath = null;
 
-    if (isDirectory) {
+    if (bundling) {
+      // One archive keeps the pipeline single-payload: a decode hands back the
+      // zip, so nothing downstream has to know about multiple inputs.
+      spinner.text = `Bundling ${inputs.length} inputs...`;
+      const zipBuffer = zipInputs(inputs);
+      filename = bundleName;
+      extension = '.zip';
+      fileSize = zipBuffer.length;
+
+      tempZipPath = path.join(require('os').tmpdir(), `stegdoc_${Date.now()}.zip`);
+      fs.writeFileSync(tempZipPath, zipBuffer);
+      streamSource = tempZipPath;
+
+      spinner.succeed && spinner.succeed(
+        `Bundled ${inputs.length} inputs into ${filename} (${formatBytes(fileSize)})`
+      );
+    } else if (isDirectory) {
       spinner.text = 'Zipping folder...';
       const folderName = path.basename(inputFile);
       const zipBuffer = zipFolder(inputFile);
@@ -143,13 +241,13 @@ async function encodeCommand(inputFile, options) {
       if (format === 'docx') {
         await encodeLegacyDocx(streamSource, filename, extension, fileSize, options, useCompression, useEncryption, spinner, quiet, createdFiles);
       } else {
-        await encodeLegacyXlsx(streamSource, filename, extension, fileSize, options, useCompression, useEncryption, spinner, quiet, createdFiles);
+        throw new Error('Legacy XLSX format (--legacy) is no longer supported. Use v5 format (default) or legacy DOCX (-f docx --legacy).');
       }
       if (tempZipPath) cleanupTemp(tempZipPath);
       return;
     }
 
-    // === v5 Log-Embed Pipeline ===
+    // === Log-Embed Pipeline ===
     const hash = generateHash();
     const outputDir = options.outputDir || process.cwd();
 
@@ -175,6 +273,49 @@ async function encodeCommand(inputFile, options) {
 
     // Pre-compute content hash
     spinner.text = 'Computing file hash...';
+
+    // Prefer the native engine. Legacy mode returned above.
+    const native = loadNative();
+    if (version === 'v6' && !native) {
+      throw new Error(
+        'v6 output requires the native engine (run `pnpm build:native` or install the platform package). Use --v5 for the JavaScript encoder.'
+      );
+    }
+    if (native) {
+      spinner.text = 'Encoding...';
+      const result = native.encode(streamSource, outputDir, {
+        format,
+        version,
+        password: options.password || undefined,
+        chunkSize: chunkSizeBytes === Infinity ? undefined : chunkSizeBytes,
+        compress: useCompression,
+        force: !!options.force,
+        originalFilename: filename,
+        originalExtension: extension,
+      });
+      createdFiles.push(...result.files);
+      spinner.succeed && spinner.succeed(`Encoded ${result.partCount} part${result.partCount !== 1 ? 's' : ''}`);
+
+      if (!quiet) {
+        console.log();
+        console.log(chalk.green.bold('✓ File encoded successfully!'));
+        console.log(chalk.cyan(`  Format: ${format.toUpperCase()} (${version} log-embed)`));
+        console.log(chalk.cyan(`  Hash: ${result.hash}`));
+        if (result.partCount > 1) {
+          console.log(chalk.cyan(`  Parts: ${result.partCount}`));
+        }
+        console.log(chalk.cyan(`  Encrypted: ${result.encrypted ? 'Yes' : 'No'}`));
+        console.log(chalk.cyan(`  Compressed: ${result.compressed ? 'Yes (Brotli)' : 'No'}`));
+        console.log(chalk.cyan(`  Location: ${outputDir}`));
+        if (result.encrypted) {
+          console.log(chalk.yellow(`  Remember your password - it cannot be recovered!`));
+        }
+      }
+
+      if (tempZipPath) cleanupTemp(tempZipPath);
+      return;
+    }
+
     const contentHash = await computeFileHash(streamSource);
 
     // Generate session salt for encryption
@@ -356,168 +497,6 @@ async function encodeCommand(inputFile, options) {
   }
 }
 
-// ─── Legacy v4 XLSX Pipeline ────────────────────────────────────────────────
-
-async function encodeLegacyXlsx(inputPath, filename, extension, fileSize, options, useCompression, useEncryption, spinner, quiet, createdFiles) {
-  const hash = generateHash();
-  const outputDir = options.outputDir || process.cwd();
-  const format = 'xlsx';
-  const chunkInput = (options.chunkSize || '').toString().trim();
-
-  // Parse chunk size
-  const chunkInputLower = chunkInput.toLowerCase();
-  let chunkSizeBytes;
-
-  if (chunkInputLower === '0' || chunkInputLower === 'max' || chunkInputLower === 'single' || chunkInputLower === 'none' || chunkInputLower === '') {
-    chunkSizeBytes = Infinity;
-  } else if (/^\d+\s*parts?$/i.test(chunkInput)) {
-    const numParts = parseInt(chunkInput, 10);
-    if (numParts < 1) throw new Error('Number of parts must be at least 1');
-    const estimatedBase64Size = Math.ceil(fileSize * 4 / 3);
-    chunkSizeBytes = Math.ceil(estimatedBase64Size / numParts);
-    spinner.info && spinner.info(`Splitting into ~${numParts} parts (~${formatBytes(chunkSizeBytes)} content each)`);
-  } else if (chunkInput) {
-    chunkSizeBytes = parseSizeToBytes(chunkInput);
-  } else {
-    chunkSizeBytes = 5 * 1024 * 1024;
-  }
-
-  spinner.text = 'Computing file hash...';
-  const contentHash = await computeFileHash(inputPath);
-
-  const sessionSalt = useEncryption ? generateSalt() : null;
-
-  spinner.text = useCompression ? 'Compressing and encoding (legacy v4)...' : 'Encoding (legacy v4)...';
-
-  const partFiles = [];
-
-  if (useEncryption) {
-    const binaryChunkSize = chunkSizeBytes === Infinity ? Infinity : Math.floor(chunkSizeBytes * 3 / 4);
-
-    const onBinaryChunkReady = async (binaryBuffer, index) => {
-      const partNumber = index + 1;
-      const partSpinner = quiet ? spinner : ora(`Creating part ${partNumber}...`).start();
-
-      const { stream: cipher, iv, salt, getAuthTag } = createEncryptStream(options.password, sessionSalt);
-      const encrypted = Buffer.concat([cipher.update(binaryBuffer), cipher.final()]);
-      const authTag = getAuthTag();
-      const base64Chunk = encrypted.toString('base64');
-
-      const metadata = createMetadata({
-        originalFilename: filename,
-        originalExtension: extension,
-        hash,
-        partNumber,
-        totalParts: null,
-        originalSize: fileSize,
-        format,
-        encrypted: true,
-        compressed: useCompression,
-        contentHash,
-      });
-
-      const encryptionMeta = packEncryptionMeta({ iv, salt, authTag });
-      const outputFilename = generateFilename(hash, partNumber, null, format);
-      const outputPath = path.join(outputDir, outputFilename);
-
-      if (fs.existsSync(outputPath) && !options.force) {
-        throw new Error(`File already exists: ${outputPath}. Use --force to overwrite.`);
-      }
-
-      await createXlsxPartStreaming({
-        base64Content: base64Chunk,
-        encryptionMeta,
-        metadataJson: serializeMetadata(metadata),
-        outputPath,
-      });
-
-      partFiles.push(outputPath);
-      createdFiles.push(outputPath);
-      partSpinner.succeed && partSpinner.succeed(`Created: ${outputFilename} (${formatBytes(base64Chunk.length)} encoded)`);
-    };
-
-    const collector = new BinaryChunkCollector(binaryChunkSize, onBinaryChunkReady);
-    const streams = [fs.createReadStream(inputPath)];
-    if (!quiet) {
-      streams.push(new ProgressTransform(fileSize, (processed, total) => {
-        const pct = Math.min(100, Math.round((processed / total) * 100));
-        spinner.text = `Compressing (legacy v4)... ${formatBytes(processed)} / ${formatBytes(total)} (${pct}%)`;
-      }));
-    }
-    if (useCompression) streams.push(createCompressStream());
-    streams.push(collector);
-    await pipeline(...streams);
-  } else {
-    const onChunkReady = async (base64Chunk, index) => {
-      const partNumber = index + 1;
-      const partSpinner = quiet ? spinner : ora(`Creating part ${partNumber}...`).start();
-
-      const metadata = createMetadata({
-        originalFilename: filename,
-        originalExtension: extension,
-        hash,
-        partNumber,
-        totalParts: null,
-        originalSize: fileSize,
-        format,
-        encrypted: false,
-        compressed: useCompression,
-        contentHash,
-      });
-
-      const outputFilename = generateFilename(hash, partNumber, null, format);
-      const outputPath = path.join(outputDir, outputFilename);
-
-      if (fs.existsSync(outputPath) && !options.force) {
-        throw new Error(`File already exists: ${outputPath}. Use --force to overwrite.`);
-      }
-
-      await createXlsxPartStreaming({
-        base64Content: base64Chunk,
-        encryptionMeta: '',
-        metadataJson: serializeMetadata(metadata),
-        outputPath,
-      });
-
-      partFiles.push(outputPath);
-      createdFiles.push(outputPath);
-      partSpinner.succeed && partSpinner.succeed(`Created: ${outputFilename} (${formatBytes(base64Chunk.length)} encoded)`);
-    };
-
-    const collector = new ChunkCollector(chunkSizeBytes, onChunkReady);
-    const streams = [fs.createReadStream(inputPath)];
-    if (!quiet) {
-      streams.push(new ProgressTransform(fileSize, (processed, total) => {
-        const pct = Math.min(100, Math.round((processed / total) * 100));
-        spinner.text = `Encoding (legacy v4)... ${formatBytes(processed)} / ${formatBytes(total)} (${pct}%)`;
-      }));
-    }
-    if (useCompression) streams.push(createCompressStream());
-    streams.push(new Base64EncodeTransform());
-    streams.push(collector);
-    await pipeline(...streams);
-  }
-
-  const totalParts = partFiles.length;
-  spinner.succeed && spinner.succeed('Encoding complete!');
-
-  if (!quiet) {
-    console.log();
-    console.log(chalk.green.bold('✓ File encoded successfully!'));
-    console.log(chalk.cyan(`  Format: XLSX (v4 legacy)`));
-    console.log(chalk.cyan(`  Hash: ${hash}`));
-    if (totalParts > 1) {
-      console.log(chalk.cyan(`  Parts: ${totalParts}`));
-    }
-    console.log(chalk.cyan(`  Encrypted: ${useEncryption ? 'Yes' : 'No'}`));
-    console.log(chalk.cyan(`  Compressed: ${useCompression ? 'Yes (gzip)' : 'No'}`));
-    console.log(chalk.cyan(`  Location: ${outputDir}`));
-    if (useEncryption) {
-      console.log(chalk.yellow(`  Remember your password - it cannot be recovered!`));
-    }
-  }
-}
-
 // ─── Legacy v4 DOCX Pipeline ────────────────────────────────────────────────
 
 async function encodeLegacyDocx(inputPath, filename, extension, fileSize, options, useCompression, useEncryption, spinner, quiet, createdFiles) {

package/src/commands/info.js

@@ -6,6 +6,46 @@ const { readXlsxBase64 } = require('../lib/xlsx-handler');
 const { validateMetadata, isMultiPart, isLogEmbedFormat } = require('../lib/metadata');
 const { detectFormat, formatBytes } = require('../lib/utils');
 const { extractContent, findMultiPartFiles } = require('../lib/file-utils');
+const { loadNative } = require('../lib/native');
+
+/**
+ * Print metadata read by the native engine, which handles v5 and v6.
+ */
+function printNativeInfo(info) {
+  console.log();
+  console.log(chalk.bold.white('File Information:'));
+  console.log(chalk.cyan(`  Format: ${info.format.toUpperCase()} (${info.formatVersion})`));
+  console.log(chalk.cyan(`  Stego method: Log-embed (${info.formatVersion})`));
+  console.log(chalk.cyan(`  Authenticated metadata: ${info.authenticated ? 'Yes' : 'No'}`));
+  console.log();
+  console.log(chalk.bold.white('Original File:'));
+  console.log(chalk.cyan(`  Filename: ${info.originalFilename}`));
+  console.log(chalk.cyan(`  Size: ${formatBytes(info.originalSize)}`));
+  console.log();
+  console.log(chalk.bold.white('Encoding Options:'));
+  console.log(chalk.cyan(`  Encrypted: ${info.encrypted ? chalk.yellow('Yes') : 'No'}`));
+  console.log(chalk.cyan(`  Compressed: ${info.compressed ? chalk.green('Yes') : 'No'}`));
+  console.log(chalk.cyan(`  Encoded on: ${info.encodingDate || 'Unknown'}`));
+  if (info.contentHash) {
+    console.log(chalk.cyan(`  Content hash: ${info.contentHash.slice(0, 16)}...`));
+  }
+  console.log();
+  if (info.partCount > 1) {
+    console.log(chalk.bold.white('Multi-part File:'));
+    console.log(chalk.cyan(`  This is part: ${info.partNumber} of ${info.partCount}`));
+    console.log(chalk.cyan(`  Hash: ${info.hash}`));
+    console.log();
+    console.log(chalk.green.bold(`All ${info.partCount} parts required to decode`));
+  } else {
+    console.log(chalk.bold.white('Single File:'));
+    console.log(chalk.cyan(`  Hash: ${info.hash}`));
+    console.log();
+    console.log(chalk.green.bold('Ready to decode'));
+  }
+  if (info.encrypted) {
+    console.log(chalk.yellow('\nNote: Password required for decoding'));
+  }
+}
 
 /**
  * Show information about an encoded file without decoding
@@ -19,6 +59,15 @@ async function infoCommand(inputFile, options) {
       throw new Error('Unknown file format. Supported formats: .xlsx, .docx');
     }
 
+    // The native engine reads v5 and v6; the JS reader only knows v5.
+    const native = loadNative();
+    if (native && native.probe(inputFile) === 'v5') {
+      const info = native.info(inputFile);
+      spinner.succeed('File metadata read successfully');
+      printNativeInfo(info);
+      return;
+    }
+
     let readResult;
     if (format === 'xlsx') {
       readResult = await readXlsxBase64(inputFile);

package/src/commands/verify.js

@@ -7,6 +7,66 @@ const { validateMetadata, isMultiPart, isStreamingFormat, isLogEmbedFormat } = r
 const { detectFormat, formatBytes } = require('../lib/utils');
 const { decrypt, unpackEncryptionMeta, createDecryptStream } = require('../lib/crypto');
 const { extractContent, findMultiPartFiles } = require('../lib/file-utils');
+const { loadNative } = require('../lib/native');
+
+/**
+ * Verify a v5/v6 file with the native engine, which also reads v6.
+ */
+function verifyNative(native, inputFile, options, spinner) {
+  const info = native.info(inputFile);
+  const issues = [];
+
+  spinner.succeed('Metadata valid');
+
+  if (info.encrypted) {
+    if (!options.password) {
+      issues.push('File is encrypted but no password provided');
+      spinner.warn('Encryption check skipped (no password)');
+    } else {
+      spinner.text = 'Verifying decryption...';
+      try {
+        native.decode(inputFile, options.password);
+        spinner.succeed('Decryption password valid');
+      } catch (e) {
+        issues.push('Decryption failed - wrong password or corrupted data');
+        spinner.fail('Decryption check failed');
+      }
+    }
+  } else {
+    // No password needed; a full decode also checks the content hash.
+    try {
+      native.decode(inputFile, undefined);
+      spinner.succeed('Content hash valid');
+    } catch (e) {
+      issues.push(`Decode failed: ${e.message}`);
+      spinner.fail('Decode check failed');
+    }
+  }
+
+  console.log();
+  if (issues.length === 0) {
+    console.log(chalk.green.bold('✓ File verification passed!'));
+    console.log(chalk.cyan(`  Original file: ${info.originalFilename}`));
+    console.log(chalk.cyan(`  Size: ${formatBytes(info.originalSize)}`));
+    console.log(chalk.cyan(`  Encrypted: ${info.encrypted ? 'Yes' : 'No'}`));
+    console.log(chalk.cyan(`  Compressed: ${info.compressed ? 'Yes' : 'No'}`));
+    console.log(chalk.cyan(`  Format version: ${info.formatVersion} (log-embed)`));
+    if (info.partCount > 1) {
+      console.log(chalk.cyan(`  Parts: ${info.partCount}`));
+    }
+    console.log();
+    console.log(chalk.green('File is ready to decode.'));
+  } else {
+    console.log(chalk.yellow.bold('⚠ Verification completed with issues:'));
+    console.log();
+    for (const issue of issues) {
+      console.log(chalk.yellow(`  • ${issue}`));
+    }
+    console.log();
+    console.log(chalk.red('File cannot be decoded until issues are resolved.'));
+    process.exit(1);
+  }
+}
 
 /**
  * Verify that a file can be decoded without actually writing output
@@ -21,6 +81,12 @@ async function verifyCommand(inputFile, options) {
       throw new Error('Unknown file format. Supported formats: .xlsx, .docx');
     }
 
+    // The native engine reads v5 and v6; the JS reader only knows v5.
+    const native = loadNative();
+    if (native && native.probe(inputFile) === 'v5') {
+      return verifyNative(native, inputFile, options, spinner);
+    }
+
     spinner.text = `Reading ${format.toUpperCase()} file...`;
 
     let readResult;

package/src/index.js

@@ -2,6 +2,7 @@
 
 const { program } = require('commander');
 const chalk = require('chalk');
+const { version } = require('../package.json');
 const encodeCommand = require('./commands/encode');
 const decodeCommand = require('./commands/decode');
 const infoCommand = require('./commands/info');
@@ -11,24 +12,27 @@ const verifyCommand = require('./commands/verify');
 program
   .name('stegdoc')
   .description('CLI tool to encode files into Office documents with AES-256 encryption')
-  .version('5.6.0');
+  .version(version);
 
 // Encode command
 program
-  .command('encode <file>')
-  .description('Encode a file into XLSX/DOCX format with compression and optional encryption')
+  .command('encode <inputs...>')
+  .description('Encode one or more files (or folders) into XLSX/DOCX format with compression and optional encryption')
   .option('-o, --output-dir <dir>', 'Output directory for files', process.cwd())
+  .option('--bundle-name <name>', 'Filename recorded for a multi-input bundle', 'bundle.zip')
   .option('-s, --chunk-size <size>', 'Maximum size per output file (e.g., "5MB", "25MB")', '5MB')
   .option('-f, --format <format>', 'Output format: xlsx (default) or docx', 'xlsx')
   .option('-p, --password <password>', 'Encryption password (optional, but recommended)')
   .option('--force', 'Overwrite existing files without asking')
   .option('--legacy', 'Use v4 format (hidden sheet + gzip) for backward compatibility')
+  .option('--v5', 'Emit the v5 format (PBKDF2) instead of the v6 default')
+  .option('--v6', 'Emit the v6 format (default; Argon2id, authenticated metadata)')
   .option('--no-limit', 'Bypass DOCX 1 MB size limit (large files will produce huge documents)')
   .option('-q, --quiet', 'Minimal output (for scripting)')
   .option('-y, --yes', 'Skip interactive prompts, use defaults')
-  .action(async (file, options) => {
+  .action(async (inputs, options) => {
     try {
-      await encodeCommand(file, options);
+      await encodeCommand(inputs, options);
     } catch (error) {
       console.error(chalk.red(`Error: ${error.message}`));
       process.exit(1);

package/src/lib/bindings.js

@@ -0,0 +1,99 @@
+'use strict';
+
+/**
+ * The napi binding target table, shared by the loader and the build scripts.
+ *
+ * The published package ships no binary. Each target becomes an optional
+ * dependency `@stegdoc/binding-<suffix>` carrying one `.node`, selected at
+ * require time by `src/lib/native.js`. The shape matches the ecosystem norm
+ * (`@swc/core-*`, `@rollup/rollup-*`), which is also what the airgap
+ * lockfile's `os`/`cpu`/`libc` filter expects.
+ *
+ * @typedef {object} BindingTarget
+ * @property {string} triple - Rust target triple.
+ * @property {string} suffix - npm name suffix, `<os>-<cpu>[-<libc>]`.
+ * @property {string} os - npm `os` field value.
+ * @property {string} cpu - npm `cpu` field value.
+ * @property {string} [libc] - npm `libc` field value.
+ * @property {string} lib - Artifact filename Cargo produces.
+ */
+
+/** Scope the platform packages publish under. Changing it is a one-line rename. */
+const SCOPE = '@stegdoc';
+
+/** @type {BindingTarget[]} */
+const TARGETS = [
+  {
+    triple: 'x86_64-pc-windows-msvc',
+    suffix: 'win32-x64-msvc',
+    os: 'win32',
+    cpu: 'x64',
+    lib: 'stegdoc_node.dll',
+  },
+  {
+    triple: 'x86_64-unknown-linux-gnu',
+    suffix: 'linux-x64-gnu',
+    os: 'linux',
+    cpu: 'x64',
+    libc: 'glibc',
+    lib: 'libstegdoc_node.so',
+  },
+  {
+    triple: 'aarch64-unknown-linux-gnu',
+    suffix: 'linux-arm64-gnu',
+    os: 'linux',
+    cpu: 'arm64',
+    libc: 'glibc',
+    lib: 'libstegdoc_node.so',
+  },
+  {
+    triple: 'x86_64-apple-darwin',
+    suffix: 'darwin-x64',
+    os: 'darwin',
+    cpu: 'x64',
+    lib: 'libstegdoc_node.dylib',
+  },
+  {
+    triple: 'aarch64-apple-darwin',
+    suffix: 'darwin-arm64',
+    os: 'darwin',
+    cpu: 'arm64',
+    lib: 'libstegdoc_node.dylib',
+  },
+];
+
+/**
+ * The npm package name for a target.
+ * @param {BindingTarget} target
+ * @returns {string}
+ */
+function packageName(target) {
+  return `${SCOPE}/binding-${target.suffix}`;
+}
+
+/**
+ * Whether the running Linux is musl-based. No musl package is published, so
+ * the loader must not pick the glibc binary for it.
+ * @returns {boolean}
+ */
+function isMusl() {
+  if (process.platform !== 'linux') return false;
+  try {
+    return !process.report.getReport().header.glibcVersionRuntime;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * The target matching the running platform, or null when none is published.
+ * @returns {BindingTarget|null}
+ */
+function hostTarget() {
+  if (isMusl()) return null;
+  return (
+    TARGETS.find((target) => target.os === process.platform && target.cpu === process.arch) || null
+  );
+}
+
+module.exports = { SCOPE, TARGETS, packageName, hostTarget };