stegdoc 5.7.0 → 6.0.0

package/src/commands/decode.js

@@ -4,14 +4,19 @@ const { finished } = require('stream/promises');
 const chalk = require('chalk');
 const ora = require('ora');
 const { readDocxBase64, } = require('../lib/docx-handler');
-const { readXlsxBase64, readXlsxV5 } = require('../lib/xlsx-handler');
-const { validateMetadata, isMultiPart, isStreamingFormat, isLogEmbedFormat, parseMetadata } = require('../lib/metadata');
-const { detectFormat, formatBytes, generateContentHash } = require('../lib/utils');
+const { readXlsxBase64 } = require('../lib/xlsx-handler');
+const { validateMetadata, isMultiPart, isStreamingFormat } = require('../lib/metadata');
+const { detectFormat, formatBytes, generateContentHash, safeFilename } = require('../lib/utils');
 const { decrypt, unpackEncryptionMeta, createDecryptStream } = require('../lib/crypto');
-const { decompress, createDecompressStream, decompressBrotli, createBrotliDecompressStream } = require('../lib/compression');
+const { decompress, createDecompressStream } = require('../lib/compression');
 const { promptPassword, promptOverwrite } = require('../lib/interactive');
 const { extractContent, findMultiPartFiles, mergeBase64Chunks } = require('../lib/file-utils');
 const { HashPassthrough } = require('../lib/streams');
+const { loadNative } = require('../lib/native');
+
+const NATIVE_REQUIRED =
+  'This is a v5 log-embed file. Decoding it requires the native engine, which is not installed. ' +
+  'Reinstall stegdoc, or build it with `pnpm build:native`.';
 
 /**
  * Read file based on format
@@ -33,8 +38,18 @@ async function decodeCommand(inputFile, options) {
 
   try {
     const format = detectFormat(inputFile);
+
+    // Prefer the native engine for v5/v6 files and transport archives. It
+    // returns false for anything the legacy JS paths must handle.
+    const native = loadNative();
+    if (native && (await decodeV5Native(native, inputFile, format, options, spinner, quiet))) {
+      return;
+    }
+
     if (!format) {
-      throw new Error('Unknown file format. Supported formats: .xlsx, .docx');
+      throw new Error(
+        'Unknown file format. Supported formats: .xlsx, .docx, or a zip of them'
+      );
     }
 
     spinner.text = `Reading ${format.toUpperCase()} file...`;
@@ -44,9 +59,14 @@ async function decodeCommand(inputFile, options) {
 
     // Route based on format version
     if (readResult.formatVersion === 'v5') {
-      await decodeV5(inputFile, format, readResult, options, spinner, quiet);
-    } else {
-      // Legacy v3/v4 path
+      // The CommonJS v5 decoder survives only for the legacy v3/v4 formats; its
+      // output path is not sanitised, so log-embed files must go through the
+      // native engine. Reaching here means the binding is missing.
+      throw new Error(NATIVE_REQUIRED);
+    }
+
+    // Legacy v3/v4 path
+    {
       const { encryptedContent, encryptionMeta, metadata } = extractContent(readResult, format);
       validateMetadata(metadata);
 
@@ -96,190 +116,118 @@ async function decodeCommand(inputFile, options) {
 }
 
 /**
- * Resolve output path from options and metadata
+ * Resolve output path from options and metadata.
+ *
+ * `metadata.originalFilename` is unauthenticated, so it is reduced to a bare
+ * name before it is joined onto any directory (FORMAT.md 11.1).
  */
 function resolveOutputPath(options, metadata) {
+  const name = safeFilename(metadata.originalFilename);
   if (options.output) {
     if (fs.existsSync(options.output) && fs.statSync(options.output).isDirectory()) {
-      return path.join(options.output, metadata.originalFilename);
+      return path.join(options.output, name);
     } else if (!path.extname(options.output) && !fs.existsSync(options.output)) {
       fs.mkdirSync(options.output, { recursive: true });
-      return path.join(options.output, metadata.originalFilename);
+      return path.join(options.output, name);
     } else {
       return options.output;
     }
   }
-  return path.join(process.cwd(), metadata.originalFilename);
+  return path.join(process.cwd(), name);
 }
 
-// ─── v5 Log-Embed Decode ────────────────────────────────────────────────────
-
 /**
- * Decode a v5 log-embed XLSX file
+ * Resolve the output path using a filename the native engine already
+ * sanitised. `safeFilename` is a bare name, so joining it cannot escape.
  */
-async function decodeV5(inputFile, format, firstReadResult, options, spinner, quiet) {
-  const metadata = firstReadResult.metadata;
-  validateMetadata(metadata);
-
-  const isEncrypted = metadata.encrypted || false;
-  const isCompressed = metadata.compressed || false;
-  const compressionAlgo = metadata.compressionAlgo || 'brotli';
-
-  spinner.succeed && spinner.succeed(`${format.toUpperCase()} file read (v5 log-embed format)`);
+function resolveNativeOutputPath(options, safeFilename) {
+  if (options.output) {
+    if (fs.existsSync(options.output) && fs.statSync(options.output).isDirectory()) {
+      return path.join(options.output, safeFilename);
+    } else if (!path.extname(options.output) && !fs.existsSync(options.output)) {
+      fs.mkdirSync(options.output, { recursive: true });
+      return path.join(options.output, safeFilename);
+    } else {
+      return options.output;
+    }
+  }
+  return path.join(process.cwd(), safeFilename);
+}
 
-  if (!quiet) {
-    console.log(chalk.cyan(`  Original file: ${metadata.originalFilename}`));
-    console.log(chalk.cyan(`  Original size: ${formatBytes(metadata.originalSize)}`));
-    console.log(chalk.cyan(`  Encrypted: ${isEncrypted ? 'Yes' : 'No'}`));
-    console.log(chalk.cyan(`  Compressed: ${isCompressed ? `Yes (${compressionAlgo})` : 'No'}`));
+/**
+ * Decode a v5 file through the native engine.
+ *
+ * Returns true when the file was handled, false when it is not a v5 file the
+ * native engine understands and the caller should fall back to the JS paths.
+ */
+async function decodeV5Native(native, inputFile, format, options, spinner, quiet) {
+  let version;
+  try {
+    version = native.probe(inputFile);
+  } catch {
+    // Not a readable container; let the JS paths produce the error.
+    return false;
   }
+  if (version !== 'v5' && version !== 'archive') return false;
+
+  const label = format ? format.toUpperCase() : 'ZIP';
+  spinner.text = `Reading ${label} file...`;
 
-  if (isEncrypted && !options.password) {
+  let result;
+  try {
+    result = native.decode(inputFile, options.password || undefined, undefined);
+  } catch (error) {
+    if (!String(error.message).startsWith('STEGDOC_PASSWORD_REQUIRED')) {
+      throw error;
+    }
     if (quiet || options.yes) {
       throw new Error('Password is required for encrypted files. Use -p or --password to specify.');
     }
     options.password = await promptPassword();
+    result = native.decode(inputFile, options.password || undefined, undefined);
   }
 
-  let outputPath = resolveOutputPath(options, metadata);
+  const engineVersion = result.formatVersion || 'v5';
+  spinner.succeed && spinner.succeed(`${label} file read (${engineVersion} log-embed format)`);
 
-  if (fs.existsSync(outputPath) && !options.force) {
-    if (quiet || options.yes) {
-      throw new Error(`File already exists: ${outputPath}. Use --force to overwrite.`);
-    }
-    const shouldOverwrite = await promptOverwrite(outputPath);
-    if (!shouldOverwrite) {
-      console.log(chalk.yellow('Operation cancelled.'));
-      process.exit(0);
-    }
+  if (!quiet) {
+    console.log(chalk.cyan(`  Original file: ${result.originalFilename}`));
+    console.log(chalk.cyan(`  Original size: ${formatBytes(result.originalSize)}`));
+    console.log(chalk.cyan(`  Encrypted: ${result.encrypted ? 'Yes' : 'No'}`));
+    console.log(chalk.cyan(`  Compressed: ${result.compressed ? 'Yes (brotli)' : 'No'}`));
   }
 
-  // Ensure output directory exists
+  const outputPath = resolveNativeOutputPath(options, result.safeFilename);
   const outputDir = path.dirname(outputPath);
   if (!fs.existsSync(outputDir)) {
     fs.mkdirSync(outputDir, { recursive: true });
   }
 
-  // Set up output pipeline: [decompress] → hash → file
-  const hashStream = new HashPassthrough();
-  const outputStream = fs.createWriteStream(outputPath);
-
-  let decompressStream = null;
-  if (isCompressed) {
-    if (compressionAlgo === 'brotli') {
-      decompressStream = createBrotliDecompressStream();
-    } else {
-      decompressStream = createDecompressStream();
-    }
-    decompressStream.pipe(hashStream).pipe(outputStream);
-  } else {
-    hashStream.pipe(outputStream);
-  }
-
-  const writeTarget = isCompressed ? decompressStream : hashStream;
-
-  // Check for multi-part
-  const hasMultipleParts = isMultiPart(metadata) || metadata.partNumber !== null;
-  let totalPartsFound = 1;
-
-  if (hasMultipleParts) {
-    const inputDir = path.dirname(inputFile);
-    const allParts = findMultiPartFiles(inputDir, metadata.hash, format);
-    totalPartsFound = allParts.length;
-
-    if (metadata.totalParts !== null && totalPartsFound !== metadata.totalParts) {
-      throw new Error(
-        `Missing parts! Found ${totalPartsFound} of ${metadata.totalParts} parts. ` +
-        `Make sure all parts are in the same directory.`
-      );
-    }
-
-    spinner.text = `Multi-part file detected (${totalPartsFound} parts)`;
-    spinner.succeed && spinner.succeed(`Found all ${totalPartsFound} parts`);
-
-    for (let i = 0; i < allParts.length; i++) {
-      const pct = Math.round(((i + 1) / totalPartsFound) * 100);
-      const partSpinner = quiet ? spinner : ora(`Decoding part ${i + 1}/${totalPartsFound} (${pct}%)...`).start();
-
-      const partResult = await readFile(allParts[i].path, format);
-
-      let partPayload;
-      let partEncMeta;
-
-      if (partResult.formatVersion === 'v5') {
-        partPayload = partResult.payloadBuffer;
-        partEncMeta = partResult.encryptionMeta;
-      } else {
-        // Shouldn't happen for v5, but handle gracefully
-        const extracted = extractContent(partResult, format);
-        partPayload = Buffer.from(extracted.encryptedContent, 'base64');
-        partEncMeta = extracted.encryptionMeta;
-      }
-
-      if (isEncrypted) {
-        const { iv, salt, authTag } = unpackEncryptionMeta(partEncMeta);
-        const decipher = createDecryptStream(options.password, iv, salt, authTag);
-        try {
-          const decrypted = Buffer.concat([decipher.update(partPayload), decipher.final()]);
-          writeTarget.write(decrypted);
-        } catch (error) {
-          throw new Error('Decryption failed: Invalid password or corrupted data');
-        }
-      } else {
-        writeTarget.write(partPayload);
-      }
-
-      partSpinner.succeed && partSpinner.succeed(`Part ${i + 1}/${totalPartsFound} decoded`);
-    }
-  } else {
-    // Single file
-    spinner.text = 'Decoding...';
-
-    const payloadBuffer = firstReadResult.payloadBuffer;
-    const encryptionMeta = firstReadResult.encryptionMeta;
-
-    if (isEncrypted) {
-      const { iv, salt, authTag } = unpackEncryptionMeta(encryptionMeta);
-      const decipher = createDecryptStream(options.password, iv, salt, authTag);
-      try {
-        const decrypted = Buffer.concat([decipher.update(payloadBuffer), decipher.final()]);
-        writeTarget.write(decrypted);
-      } catch (error) {
-        throw new Error('Decryption failed: Invalid password or corrupted data');
-      }
-    } else {
-      writeTarget.write(payloadBuffer);
+  if (fs.existsSync(outputPath) && !options.force) {
+    if (quiet || options.yes) {
+      throw new Error(`File already exists: ${outputPath}. Use --force to overwrite.`);
     }
-  }
-
-  // End pipeline and wait
-  writeTarget.end();
-  await finished(outputStream);
-
-  // Verify integrity
-  if (metadata.contentHash) {
-    spinner.text = 'Verifying integrity...';
-    const actualHash = hashStream.digest;
-    if (actualHash !== metadata.contentHash) {
-      try { fs.unlinkSync(outputPath); } catch { /* ignore */ }
-      throw new Error('Integrity check failed! The file may be corrupted or tampered with.');
+    const shouldOverwrite = await promptOverwrite(outputPath);
+    if (!shouldOverwrite) {
+      console.log(chalk.yellow('Operation cancelled.'));
+      process.exit(0);
     }
-    spinner.succeed && spinner.succeed('Integrity verified (SHA-256 match)');
   }
 
+  fs.writeFileSync(outputPath, result.bytes);
   spinner.succeed && spinner.succeed('Decoding complete!');
 
   if (!quiet) {
-    const outputSize = fs.statSync(outputPath).size;
     console.log();
     console.log(chalk.green.bold('✓ File decoded successfully!'));
-    console.log(chalk.cyan(`  Original: ${metadata.originalFilename}`));
+    console.log(chalk.cyan(`  Original: ${result.originalFilename}`));
     console.log(chalk.cyan(`  Output: ${outputPath}`));
-    console.log(chalk.cyan(`  Size: ${formatBytes(outputSize)}`));
-    if (hasMultipleParts) {
-      console.log(chalk.cyan(`  Parts merged: ${totalPartsFound}`));
+    console.log(chalk.cyan(`  Size: ${formatBytes(result.bytes.length)}`));
+    if (result.partCount > 1) {
+      console.log(chalk.cyan(`  Parts merged: ${result.partCount}`));
     }
   }
+  return true;
 }
 
 // ─── v4 Streaming Decode ────────────────────────────────────────────────────

package/src/commands/encode.js

@@ -14,7 +14,8 @@ const { isCompressedMime, createCompressStream, createBrotliCompressStream } = r
 const { resetTimeWindow } = require('../lib/decoy-generator');
 const { resetTimeState, BYTES_PER_DATA_LINE, calculateDataLineCount } = require('../lib/log-generator');
 const { shouldRunInteractive, promptEncodeOptions } = require('../lib/interactive');
-const { Base64EncodeTransform, ChunkCollector, BinaryChunkCollector, ProgressTransform } = require('../lib/streams');
+const { BinaryChunkCollector, ProgressTransform } = require('../lib/streams');
+const { loadNative } = require('../lib/native');
 
 /**
  * Zip a folder into a buffer
@@ -25,6 +26,65 @@ function zipFolder(folderPath) {
   return zip.toBuffer();
 }
 
+/**
+ * Pick an archive entry name that is not taken yet, disambiguating inputs that
+ * share a basename by inserting a counter before the extension.
+ *
+ * @param {string} name Preferred entry name.
+ * @param {Set<string>} used Names already placed in the archive.
+ * @returns {string} A free entry name, which is added to `used`.
+ */
+function uniqueEntryName(name, used) {
+  if (!used.has(name)) {
+    used.add(name);
+    return name;
+  }
+  const extension = path.extname(name);
+  const stem = name.slice(0, name.length - extension.length);
+  let counter = 2;
+  let candidate = `${stem}-${counter}${extension}`;
+  while (used.has(candidate)) {
+    counter += 1;
+    candidate = `${stem}-${counter}${extension}`;
+  }
+  used.add(candidate);
+  return candidate;
+}
+
+/**
+ * Zip several inputs into one buffer. Files land at the archive root under
+ * their basename; a folder keeps its own name as a prefix.
+ *
+ * @param {string[]} inputs Absolute or relative paths to files and folders.
+ * @returns {Buffer} The archive bytes.
+ */
+function zipInputs(inputs) {
+  const zip = new AdmZip();
+  const used = new Set();
+  for (const input of inputs) {
+    const base = path.basename(input.replace(/[\\/]+$/, ''));
+    const entry = uniqueEntryName(base, used);
+    if (fs.statSync(input).isDirectory()) {
+      zip.addLocalFolder(input, entry);
+    } else {
+      zip.addLocalFile(input, '', entry);
+    }
+  }
+  return zip.toBuffer();
+}
+
+/**
+ * Normalise a bundle name: no path segments, always a `.zip` extension.
+ *
+ * @param {string} name Requested name, possibly empty.
+ * @returns {string} The filename recorded in metadata for the bundle.
+ */
+function bundleFilename(name) {
+  const base = path.basename((name || '').trim());
+  if (!base || base === '.' || base === '..') return 'bundle.zip';
+  return base.toLowerCase().endsWith('.zip') ? base : `${base}.zip`;
+}
+
 /**
  * Detect file type from the first 4KB
  */
@@ -57,12 +117,24 @@ async function computeFileHash(filePath) {
 }
 
 /**
- * Encode a file to XLSX/DOCX format with optional AES encryption and compression.
+ * Encode one or more inputs to XLSX/DOCX format with optional AES encryption
+ * and compression. Several inputs, or a single folder, are zipped first and the
+ * archive is what gets encoded, so a decode hands back that zip.
+ *
+ * @param {string|string[]} input One path, or several to bundle together.
+ * @param {object} options Commander options for the encode command.
  */
-async function encodeCommand(inputFile, options) {
+async function encodeCommand(input, options) {
+  const inputs = Array.isArray(input) ? input : [input];
+  if (inputs.length === 0) {
+    throw new Error('No input given.');
+  }
+  const bundling = inputs.length > 1;
+  const bundleName = bundleFilename(options.bundleName);
+
   // Check if we should run interactive mode
   if (shouldRunInteractive(options, 'encode')) {
-    const filename = path.basename(inputFile);
+    const filename = bundling ? bundleName : path.basename(inputs[0]);
     console.log(chalk.bold(`\nEncoding: ${filename}`));
 
     const interactiveOptions = await promptEncodeOptions(filename);
@@ -72,6 +144,13 @@ async function encodeCommand(inputFile, options) {
 
   const quiet = options.quiet || false;
   const legacy = options.legacy || false;
+  if (options.v5 && options.v6) {
+    throw new Error('--v5 and --v6 cannot be combined.');
+  }
+  if (legacy && (options.v5 || options.v6)) {
+    throw new Error('--legacy cannot be combined with --v5 or --v6.');
+  }
+  const version = options.v5 ? 'v5' : 'v6';
   const spinner = quiet ? { start: () => {}, succeed: () => {}, fail: () => {}, info: () => {}, text: '' } : ora('Starting encoding process...').start();
   const createdFiles = [];
 
@@ -80,11 +159,14 @@ async function encodeCommand(inputFile, options) {
   resetTimeState();
 
   try {
-    if (!fs.existsSync(inputFile)) {
-      throw new Error(`Path not found: ${inputFile}`);
+    for (const candidate of inputs) {
+      if (!fs.existsSync(candidate)) {
+        throw new Error(`Path not found: ${candidate}`);
+      }
     }
 
-    const isDirectory = fs.statSync(inputFile).isDirectory();
+    const inputFile = inputs[0];
+    const isDirectory = !bundling && fs.statSync(inputFile).isDirectory();
     const format = (options.format || 'xlsx').toLowerCase();
     if (format !== 'xlsx' && format !== 'docx') {
       throw new Error('Invalid format. Use "xlsx" or "docx".');
@@ -99,7 +181,23 @@ async function encodeCommand(inputFile, options) {
     let fileSize;
     let tempZipPath = null;
 
-    if (isDirectory) {
+    if (bundling) {
+      // One archive keeps the pipeline single-payload: a decode hands back the
+      // zip, so nothing downstream has to know about multiple inputs.
+      spinner.text = `Bundling ${inputs.length} inputs...`;
+      const zipBuffer = zipInputs(inputs);
+      filename = bundleName;
+      extension = '.zip';
+      fileSize = zipBuffer.length;
+
+      tempZipPath = path.join(require('os').tmpdir(), `stegdoc_${Date.now()}.zip`);
+      fs.writeFileSync(tempZipPath, zipBuffer);
+      streamSource = tempZipPath;
+
+      spinner.succeed && spinner.succeed(
+        `Bundled ${inputs.length} inputs into ${filename} (${formatBytes(fileSize)})`
+      );
+    } else if (isDirectory) {
       spinner.text = 'Zipping folder...';
       const folderName = path.basename(inputFile);
       const zipBuffer = zipFolder(inputFile);
@@ -149,7 +247,7 @@ async function encodeCommand(inputFile, options) {
       return;
     }
 
-    // === v5 Log-Embed Pipeline ===
+    // === Log-Embed Pipeline ===
     const hash = generateHash();
     const outputDir = options.outputDir || process.cwd();
 
@@ -175,6 +273,49 @@ async function encodeCommand(inputFile, options) {
 
     // Pre-compute content hash
     spinner.text = 'Computing file hash...';
+
+    // Prefer the native engine. Legacy mode returned above.
+    const native = loadNative();
+    if (version === 'v6' && !native) {
+      throw new Error(
+        'v6 output requires the native engine (run `pnpm build:native` or install the platform package). Use --v5 for the JavaScript encoder.'
+      );
+    }
+    if (native) {
+      spinner.text = 'Encoding...';
+      const result = native.encode(streamSource, outputDir, {
+        format,
+        version,
+        password: options.password || undefined,
+        chunkSize: chunkSizeBytes === Infinity ? undefined : chunkSizeBytes,
+        compress: useCompression,
+        force: !!options.force,
+        originalFilename: filename,
+        originalExtension: extension,
+      });
+      createdFiles.push(...result.files);
+      spinner.succeed && spinner.succeed(`Encoded ${result.partCount} part${result.partCount !== 1 ? 's' : ''}`);
+
+      if (!quiet) {
+        console.log();
+        console.log(chalk.green.bold('✓ File encoded successfully!'));
+        console.log(chalk.cyan(`  Format: ${format.toUpperCase()} (${version} log-embed)`));
+        console.log(chalk.cyan(`  Hash: ${result.hash}`));
+        if (result.partCount > 1) {
+          console.log(chalk.cyan(`  Parts: ${result.partCount}`));
+        }
+        console.log(chalk.cyan(`  Encrypted: ${result.encrypted ? 'Yes' : 'No'}`));
+        console.log(chalk.cyan(`  Compressed: ${result.compressed ? 'Yes (Brotli)' : 'No'}`));
+        console.log(chalk.cyan(`  Location: ${outputDir}`));
+        if (result.encrypted) {
+          console.log(chalk.yellow(`  Remember your password - it cannot be recovered!`));
+        }
+      }
+
+      if (tempZipPath) cleanupTemp(tempZipPath);
+      return;
+    }
+
     const contentHash = await computeFileHash(streamSource);
 
     // Generate session salt for encryption

package/src/commands/info.js

@@ -6,6 +6,46 @@ const { readXlsxBase64 } = require('../lib/xlsx-handler');
 const { validateMetadata, isMultiPart, isLogEmbedFormat } = require('../lib/metadata');
 const { detectFormat, formatBytes } = require('../lib/utils');
 const { extractContent, findMultiPartFiles } = require('../lib/file-utils');
+const { loadNative } = require('../lib/native');
+
+/**
+ * Print metadata read by the native engine, which handles v5 and v6.
+ */
+function printNativeInfo(info) {
+  console.log();
+  console.log(chalk.bold.white('File Information:'));
+  console.log(chalk.cyan(`  Format: ${info.format.toUpperCase()} (${info.formatVersion})`));
+  console.log(chalk.cyan(`  Stego method: Log-embed (${info.formatVersion})`));
+  console.log(chalk.cyan(`  Authenticated metadata: ${info.authenticated ? 'Yes' : 'No'}`));
+  console.log();
+  console.log(chalk.bold.white('Original File:'));
+  console.log(chalk.cyan(`  Filename: ${info.originalFilename}`));
+  console.log(chalk.cyan(`  Size: ${formatBytes(info.originalSize)}`));
+  console.log();
+  console.log(chalk.bold.white('Encoding Options:'));
+  console.log(chalk.cyan(`  Encrypted: ${info.encrypted ? chalk.yellow('Yes') : 'No'}`));
+  console.log(chalk.cyan(`  Compressed: ${info.compressed ? chalk.green('Yes') : 'No'}`));
+  console.log(chalk.cyan(`  Encoded on: ${info.encodingDate || 'Unknown'}`));
+  if (info.contentHash) {
+    console.log(chalk.cyan(`  Content hash: ${info.contentHash.slice(0, 16)}...`));
+  }
+  console.log();
+  if (info.partCount > 1) {
+    console.log(chalk.bold.white('Multi-part File:'));
+    console.log(chalk.cyan(`  This is part: ${info.partNumber} of ${info.partCount}`));
+    console.log(chalk.cyan(`  Hash: ${info.hash}`));
+    console.log();
+    console.log(chalk.green.bold(`All ${info.partCount} parts required to decode`));
+  } else {
+    console.log(chalk.bold.white('Single File:'));
+    console.log(chalk.cyan(`  Hash: ${info.hash}`));
+    console.log();
+    console.log(chalk.green.bold('Ready to decode'));
+  }
+  if (info.encrypted) {
+    console.log(chalk.yellow('\nNote: Password required for decoding'));
+  }
+}
 
 /**
  * Show information about an encoded file without decoding
@@ -19,6 +59,15 @@ async function infoCommand(inputFile, options) {
       throw new Error('Unknown file format. Supported formats: .xlsx, .docx');
     }
 
+    // The native engine reads v5 and v6; the JS reader only knows v5.
+    const native = loadNative();
+    if (native && native.probe(inputFile) === 'v5') {
+      const info = native.info(inputFile);
+      spinner.succeed('File metadata read successfully');
+      printNativeInfo(info);
+      return;
+    }
+
     let readResult;
     if (format === 'xlsx') {
       readResult = await readXlsxBase64(inputFile);

package/src/commands/verify.js

@@ -7,6 +7,66 @@ const { validateMetadata, isMultiPart, isStreamingFormat, isLogEmbedFormat } = r
 const { detectFormat, formatBytes } = require('../lib/utils');
 const { decrypt, unpackEncryptionMeta, createDecryptStream } = require('../lib/crypto');
 const { extractContent, findMultiPartFiles } = require('../lib/file-utils');
+const { loadNative } = require('../lib/native');
+
+/**
+ * Verify a v5/v6 file with the native engine, which also reads v6.
+ */
+function verifyNative(native, inputFile, options, spinner) {
+  const info = native.info(inputFile);
+  const issues = [];
+
+  spinner.succeed('Metadata valid');
+
+  if (info.encrypted) {
+    if (!options.password) {
+      issues.push('File is encrypted but no password provided');
+      spinner.warn('Encryption check skipped (no password)');
+    } else {
+      spinner.text = 'Verifying decryption...';
+      try {
+        native.decode(inputFile, options.password);
+        spinner.succeed('Decryption password valid');
+      } catch (e) {
+        issues.push('Decryption failed - wrong password or corrupted data');
+        spinner.fail('Decryption check failed');
+      }
+    }
+  } else {
+    // No password needed; a full decode also checks the content hash.
+    try {
+      native.decode(inputFile, undefined);
+      spinner.succeed('Content hash valid');
+    } catch (e) {
+      issues.push(`Decode failed: ${e.message}`);
+      spinner.fail('Decode check failed');
+    }
+  }
+
+  console.log();
+  if (issues.length === 0) {
+    console.log(chalk.green.bold('✓ File verification passed!'));
+    console.log(chalk.cyan(`  Original file: ${info.originalFilename}`));
+    console.log(chalk.cyan(`  Size: ${formatBytes(info.originalSize)}`));
+    console.log(chalk.cyan(`  Encrypted: ${info.encrypted ? 'Yes' : 'No'}`));
+    console.log(chalk.cyan(`  Compressed: ${info.compressed ? 'Yes' : 'No'}`));
+    console.log(chalk.cyan(`  Format version: ${info.formatVersion} (log-embed)`));
+    if (info.partCount > 1) {
+      console.log(chalk.cyan(`  Parts: ${info.partCount}`));
+    }
+    console.log();
+    console.log(chalk.green('File is ready to decode.'));
+  } else {
+    console.log(chalk.yellow.bold('⚠ Verification completed with issues:'));
+    console.log();
+    for (const issue of issues) {
+      console.log(chalk.yellow(`  • ${issue}`));
+    }
+    console.log();
+    console.log(chalk.red('File cannot be decoded until issues are resolved.'));
+    process.exit(1);
+  }
+}
 
 /**
  * Verify that a file can be decoded without actually writing output
@@ -21,6 +81,12 @@ async function verifyCommand(inputFile, options) {
       throw new Error('Unknown file format. Supported formats: .xlsx, .docx');
     }
 
+    // The native engine reads v5 and v6; the JS reader only knows v5.
+    const native = loadNative();
+    if (native && native.probe(inputFile) === 'v5') {
+      return verifyNative(native, inputFile, options, spinner);
+    }
+
     spinner.text = `Reading ${format.toUpperCase()} file...`;
 
     let readResult;