stegdoc 5.7.0 → 6.1.0

package/src/commands/verify.js

@@ -1,139 +1,102 @@
-const path = require('path');
 const chalk = require('chalk');
 const ora = require('ora');
-const { readDocxBase64 } = require('../lib/docx-handler');
-const { readXlsxBase64 } = require('../lib/xlsx-handler');
-const { validateMetadata, isMultiPart, isStreamingFormat, isLogEmbedFormat } = require('../lib/metadata');
-const { detectFormat, formatBytes } = require('../lib/utils');
-const { decrypt, unpackEncryptionMeta, createDecryptStream } = require('../lib/crypto');
-const { extractContent, findMultiPartFiles } = require('../lib/file-utils');
+const { formatBytes } = require('../lib/utils');
+const { loadNative } = require('../lib/native');
+
+const NATIVE_REQUIRED =
+  'Verifying a file requires the native engine, which is not installed. ' +
+  'Reinstall stegdoc, or build it with `pnpm build:native`.';
+
+const LEGACY_UNSUPPORTED =
+  'The legacy v3/v4 format is no longer supported. Re-encode the file with a current version of stegdoc.';
 
 /**
- * Verify that a file can be decoded without actually writing output
+ * Verify a v5/v6 file with the native engine, which also reads v6.
  */
-async function verifyCommand(inputFile, options) {
-  const spinner = ora('Verifying file...').start();
+function verifyNative(native, inputFile, options, spinner) {
+  const info = native.info(inputFile);
   const issues = [];
 
-  try {
-    const format = detectFormat(inputFile);
-    if (!format) {
-      throw new Error('Unknown file format. Supported formats: .xlsx, .docx');
-    }
+  spinner.succeed('Metadata valid');
 
-    spinner.text = `Reading ${format.toUpperCase()} file...`;
-
-    let readResult;
-    if (format === 'xlsx') {
-      readResult = await readXlsxBase64(inputFile);
+  if (info.encrypted) {
+    if (!options.password) {
+      issues.push('File is encrypted but no password provided');
+      spinner.warn('Encryption check skipped (no password)');
     } else {
-      readResult = await readDocxBase64(inputFile);
+      spinner.text = 'Verifying decryption...';
+      try {
+        native.decode(inputFile, options.password);
+        spinner.succeed('Decryption password valid');
+      } catch (e) {
+        issues.push('Decryption failed - wrong password or corrupted data');
+        spinner.fail('Decryption check failed');
+      }
     }
-
-    const extracted = extractContent(readResult, format);
-    const metadata = extracted.metadata;
-    const encryptionMeta = extracted.encryptionMeta;
-
+  } else {
+    // No password needed; a full decode also checks the content hash.
     try {
-      validateMetadata(metadata);
-      spinner.succeed('Metadata valid');
+      native.decode(inputFile, undefined);
+      spinner.succeed('Content hash valid');
     } catch (e) {
-      issues.push(`Metadata: ${e.message}`);
-      spinner.warn('Metadata issues found');
+      issues.push(`Decode failed: ${e.message}`);
+      spinner.fail('Decode check failed');
     }
+  }
 
-    const isEncrypted = metadata.encrypted || (encryptionMeta && encryptionMeta.length > 0);
-    const isV5 = isLogEmbedFormat(metadata);
-    const isV4 = !isV5 && isStreamingFormat(metadata);
-
-    // Check multi-part
-    const hasMultipleParts = isMultiPart(metadata) || metadata.partNumber !== null;
-    if (hasMultipleParts) {
-      spinner.text = 'Checking multi-part files...';
-      const inputDir = path.dirname(inputFile);
-      const allParts = findMultiPartFiles(inputDir, metadata.hash, format);
-      const totalParts = metadata.totalParts || allParts.length;
-
-      if (metadata.totalParts !== null && allParts.length !== metadata.totalParts) {
-        const missing = [];
-        const foundParts = new Set(allParts.map(p => p.partNumber));
-        for (let i = 1; i <= metadata.totalParts; i++) {
-          if (!foundParts.has(i)) missing.push(i);
-        }
-        issues.push(`Missing parts: ${missing.join(', ')}`);
-        spinner.warn(`Found ${allParts.length}/${metadata.totalParts} parts`);
-      } else {
-        spinner.succeed(`All ${totalParts} parts found`);
-      }
+  console.log();
+  if (issues.length === 0) {
+    console.log(chalk.green.bold('✓ File verification passed!'));
+    console.log(chalk.cyan(`  Original file: ${info.originalFilename}`));
+    console.log(chalk.cyan(`  Size: ${formatBytes(info.originalSize)}`));
+    console.log(chalk.cyan(`  Encrypted: ${info.encrypted ? 'Yes' : 'No'}`));
+    console.log(chalk.cyan(`  Compressed: ${info.compressed ? 'Yes' : 'No'}`));
+    console.log(chalk.cyan(`  Format version: ${info.formatVersion} (log-embed)`));
+    if (info.partCount > 1) {
+      console.log(chalk.cyan(`  Parts: ${info.partCount}`));
     }
-
-    // Check password for encrypted files
-    if (isEncrypted) {
-      if (!options.password) {
-        issues.push('File is encrypted but no password provided');
-        spinner.warn('Encryption check skipped (no password)');
-      } else {
-        spinner.text = 'Verifying decryption...';
-        try {
-          if (isV5) {
-            await verifyV5Encryption(extracted, options.password);
-          } else if (isV4) {
-            await verifyV4Encryption(inputFile, format, encryptionMeta, options.password);
-          } else {
-            await verifyV3Encryption(inputFile, format, metadata, extracted.encryptedContent, encryptionMeta, options.password);
-          }
-          spinner.succeed('Decryption password valid');
-        } catch (e) {
-          issues.push('Decryption failed - wrong password or corrupted data');
-          spinner.fail('Decryption check failed');
-        }
-      }
+    console.log();
+    console.log(chalk.green('File is ready to decode.'));
+  } else {
+    console.log(chalk.yellow.bold('⚠ Verification completed with issues:'));
+    console.log();
+    for (const issue of issues) {
+      console.log(chalk.yellow(`  • ${issue}`));
     }
-
-    // Summary
     console.log();
+    console.log(chalk.red('File cannot be decoded until issues are resolved.'));
+    process.exit(1);
+  }
+}
 
-    if (issues.length === 0) {
-      console.log(chalk.green.bold('✓ File verification passed!'));
-      console.log(chalk.cyan(`  Original file: ${metadata.originalFilename}`));
-      console.log(chalk.cyan(`  Size: ${formatBytes(metadata.originalSize)}`));
-      console.log(chalk.cyan(`  Encrypted: ${isEncrypted ? 'Yes' : 'No'}`));
-      console.log(chalk.cyan(`  Compressed: ${metadata.compressed ? 'Yes' : 'No'}`));
-
-      let versionStr = 'v3 (legacy)';
-      if (isV5) versionStr = 'v5 (log-embed)';
-      else if (isV4) versionStr = 'v4 (streaming)';
-      console.log(chalk.cyan(`  Format version: ${versionStr}`));
-
-      if (hasMultipleParts) {
-        const totalParts = metadata.totalParts || 'unknown';
-        console.log(chalk.cyan(`  Parts: ${totalParts}`));
-      }
+/**
+ * Verify that a file can be decoded without actually writing output
+ */
+async function verifyCommand(inputFile, options) {
+  const spinner = ora('Verifying file...').start();
 
-      console.log();
-      console.log(chalk.green('File is ready to decode.'));
-    } else {
-      console.log(chalk.yellow.bold('⚠ Verification completed with issues:'));
-      console.log();
-      for (const issue of issues) {
-        console.log(chalk.yellow(`  • ${issue}`));
-      }
-      console.log();
+  try {
+    const native = loadNative();
+    if (!native) {
+      throw new Error(NATIVE_REQUIRED);
+    }
 
-      const hasBlockingIssue = issues.some(i =>
-        i.includes('Missing parts') ||
-        i.includes('Decryption failed') ||
-        i.includes('Metadata')
+    let probe;
+    try {
+      probe = native.probe(inputFile);
+    } catch {
+      probe = 'unknown';
+    }
+    if (probe === 'legacy') {
+      throw new Error(LEGACY_UNSUPPORTED);
+    }
+    if (probe !== 'v5' && probe !== 'archive') {
+      throw new Error(
+        'Unknown file format. Supported formats: .xlsx, .docx, or a zip of them'
       );
-
-      if (hasBlockingIssue) {
-        console.log(chalk.red('File cannot be decoded until issues are resolved.'));
-        process.exit(1);
-      } else {
-        console.log(chalk.yellow('File may still be decodable. Run decode to attempt.'));
-      }
     }
 
+    return verifyNative(native, inputFile, options, spinner);
   } catch (error) {
     spinner.fail('Verification failed');
     console.error(chalk.red(`Error: ${error.message}`));
@@ -141,67 +104,4 @@ async function verifyCommand(inputFile, options) {
   }
 }
 
-/**
- * Verify v5 log-embed encryption
- */
-async function verifyV5Encryption(extracted, password) {
-  const { payloadBuffer, encryptionMeta } = extracted;
-  const { iv, salt, authTag } = unpackEncryptionMeta(encryptionMeta);
-  const decipher = createDecryptStream(password, iv, salt, authTag);
-  decipher.update(payloadBuffer);
-  decipher.final();
-}
-
-/**
- * Verify v4 per-part encryption
- */
-async function verifyV4Encryption(inputFile, format, encryptionMeta, password) {
-  const { iv, salt, authTag } = unpackEncryptionMeta(encryptionMeta);
-
-  let readResult;
-  if (format === 'xlsx') {
-    readResult = await readXlsxBase64(inputFile);
-  } else {
-    readResult = await readDocxBase64(inputFile);
-  }
-
-  const { encryptedContent } = extractContent(readResult, format);
-  const binaryData = Buffer.from(encryptedContent, 'base64');
-
-  const decipher = createDecryptStream(password, iv, salt, authTag);
-  decipher.update(binaryData);
-  decipher.final();
-}
-
-/**
- * Verify v3 shared encryption
- */
-async function verifyV3Encryption(inputFile, format, metadata, encryptedContent, encryptionMeta, password) {
-  const { iv, salt, authTag } = unpackEncryptionMeta(encryptionMeta);
-
-  let fullContent = encryptedContent;
-
-  if (isMultiPart(metadata)) {
-    const inputDir = path.dirname(inputFile);
-    const allParts = findMultiPartFiles(inputDir, metadata.hash, format);
-
-    if (allParts.length === metadata.totalParts) {
-      const contentParts = [];
-      for (const part of allParts) {
-        let partResult;
-        if (format === 'xlsx') {
-          partResult = await readXlsxBase64(part.path);
-        } else {
-          partResult = await readDocxBase64(part.path);
-        }
-        const { encryptedContent: partContent } = extractContent(partResult, format);
-        contentParts.push(partContent);
-      }
-      fullContent = contentParts.join('');
-    }
-  }
-
-  decrypt(fullContent, password, iv, salt, authTag);
-}
-
 module.exports = verifyCommand;

package/src/index.js

@@ -2,6 +2,7 @@
 
 const { program } = require('commander');
 const chalk = require('chalk');
+const { version } = require('../package.json');
 const encodeCommand = require('./commands/encode');
 const decodeCommand = require('./commands/decode');
 const infoCommand = require('./commands/info');
@@ -11,24 +12,26 @@ const verifyCommand = require('./commands/verify');
 program
   .name('stegdoc')
   .description('CLI tool to encode files into Office documents with AES-256 encryption')
-  .version('5.6.0');
+  .version(version);
 
 // Encode command
 program
-  .command('encode <file>')
-  .description('Encode a file into XLSX/DOCX format with compression and optional encryption')
+  .command('encode <inputs...>')
+  .description('Encode one or more files (or folders) into XLSX/DOCX format with compression and optional encryption')
   .option('-o, --output-dir <dir>', 'Output directory for files', process.cwd())
+  .option('--bundle-name <name>', 'Filename recorded for a multi-input bundle', 'bundle.zip')
   .option('-s, --chunk-size <size>', 'Maximum size per output file (e.g., "5MB", "25MB")', '5MB')
   .option('-f, --format <format>', 'Output format: xlsx (default) or docx', 'xlsx')
   .option('-p, --password <password>', 'Encryption password (optional, but recommended)')
   .option('--force', 'Overwrite existing files without asking')
-  .option('--legacy', 'Use v4 format (hidden sheet + gzip) for backward compatibility')
+  .option('--v5', 'Emit the v5 format (PBKDF2) instead of the v6 default')
+  .option('--v6', 'Emit the v6 format (default; Argon2id, authenticated metadata)')
   .option('--no-limit', 'Bypass DOCX 1 MB size limit (large files will produce huge documents)')
   .option('-q, --quiet', 'Minimal output (for scripting)')
   .option('-y, --yes', 'Skip interactive prompts, use defaults')
-  .action(async (file, options) => {
+  .action(async (inputs, options) => {
     try {
-      await encodeCommand(file, options);
+      await encodeCommand(inputs, options);
     } catch (error) {
       console.error(chalk.red(`Error: ${error.message}`));
       process.exit(1);

package/src/lib/bindings.js

@@ -0,0 +1,99 @@
+'use strict';
+
+/**
+ * The napi binding target table, shared by the loader and the build scripts.
+ *
+ * The published package ships no binary. Each target becomes an optional
+ * dependency `@stegdoc/binding-<suffix>` carrying one `.node`, selected at
+ * require time by `src/lib/native.js`. The shape matches the ecosystem norm
+ * (`@swc/core-*`, `@rollup/rollup-*`), which is also what the airgap
+ * lockfile's `os`/`cpu`/`libc` filter expects.
+ *
+ * @typedef {object} BindingTarget
+ * @property {string} triple - Rust target triple.
+ * @property {string} suffix - npm name suffix, `<os>-<cpu>[-<libc>]`.
+ * @property {string} os - npm `os` field value.
+ * @property {string} cpu - npm `cpu` field value.
+ * @property {string} [libc] - npm `libc` field value.
+ * @property {string} lib - Artifact filename Cargo produces.
+ */
+
+/** Scope the platform packages publish under. Changing it is a one-line rename. */
+const SCOPE = '@stegdoc';
+
+/** @type {BindingTarget[]} */
+const TARGETS = [
+  {
+    triple: 'x86_64-pc-windows-msvc',
+    suffix: 'win32-x64-msvc',
+    os: 'win32',
+    cpu: 'x64',
+    lib: 'stegdoc_node.dll',
+  },
+  {
+    triple: 'x86_64-unknown-linux-gnu',
+    suffix: 'linux-x64-gnu',
+    os: 'linux',
+    cpu: 'x64',
+    libc: 'glibc',
+    lib: 'libstegdoc_node.so',
+  },
+  {
+    triple: 'aarch64-unknown-linux-gnu',
+    suffix: 'linux-arm64-gnu',
+    os: 'linux',
+    cpu: 'arm64',
+    libc: 'glibc',
+    lib: 'libstegdoc_node.so',
+  },
+  {
+    triple: 'x86_64-apple-darwin',
+    suffix: 'darwin-x64',
+    os: 'darwin',
+    cpu: 'x64',
+    lib: 'libstegdoc_node.dylib',
+  },
+  {
+    triple: 'aarch64-apple-darwin',
+    suffix: 'darwin-arm64',
+    os: 'darwin',
+    cpu: 'arm64',
+    lib: 'libstegdoc_node.dylib',
+  },
+];
+
+/**
+ * The npm package name for a target.
+ * @param {BindingTarget} target
+ * @returns {string}
+ */
+function packageName(target) {
+  return `${SCOPE}/binding-${target.suffix}`;
+}
+
+/**
+ * Whether the running Linux is musl-based. No musl package is published, so
+ * the loader must not pick the glibc binary for it.
+ * @returns {boolean}
+ */
+function isMusl() {
+  if (process.platform !== 'linux') return false;
+  try {
+    return !process.report.getReport().header.glibcVersionRuntime;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * The target matching the running platform, or null when none is published.
+ * @returns {BindingTarget|null}
+ */
+function hostTarget() {
+  if (isMusl()) return null;
+  return (
+    TARGETS.find((target) => target.os === process.platform && target.cpu === process.arch) || null
+  );
+}
+
+module.exports = { SCOPE, TARGETS, packageName, hostTarget };

package/src/lib/compression.js

@@ -9,40 +9,6 @@ const zlib = require('zlib');
  */
 const BROTLI_DEFAULT_QUALITY = 6;
 
-/**
- * Compress data using Brotli (used in v5+)
- * @param {Buffer} buffer - Data to compress
- * @param {number} [quality] - Compression quality (0-11, default 6)
- * @returns {Promise<Buffer>} Compressed data
- */
-function compressBrotli(buffer, quality) {
-  const q = quality !== undefined ? quality : BROTLI_DEFAULT_QUALITY;
-  return new Promise((resolve, reject) => {
-    zlib.brotliCompress(buffer, {
-      params: {
-        [zlib.constants.BROTLI_PARAM_QUALITY]: q,
-      },
-    }, (err, result) => {
-      if (err) reject(err);
-      else resolve(result);
-    });
-  });
-}
-
-/**
- * Decompress Brotli data
- * @param {Buffer} buffer - Compressed data
- * @returns {Promise<Buffer>} Decompressed data
- */
-function decompressBrotli(buffer) {
-  return new Promise((resolve, reject) => {
-    zlib.brotliDecompress(buffer, (err, result) => {
-      if (err) reject(err);
-      else resolve(result);
-    });
-  });
-}
-
 /**
  * Create a streaming Brotli compression transform
  * @param {number} [quality] - Compression quality (0-11, default 6)
@@ -57,130 +23,4 @@ function createBrotliCompressStream(quality) {
   });
 }
 
-/**
- * Create a streaming Brotli decompression transform
- * @returns {zlib.BrotliDecompress} Brotli transform stream
- */
-function createBrotliDecompressStream() {
-  return zlib.createBrotliDecompress();
-}
-
-// ─── Gzip Compression (v3/v4 legacy) ───────────────────────────────────────
-
-/**
- * MIME types that are already compressed - no benefit from additional compression
- */
-const COMPRESSED_MIMES = new Set([
-  // Archives
-  'application/zip',
-  'application/x-7z-compressed',
-  'application/x-rar-compressed',
-  'application/gzip',
-  'application/x-gzip',
-  'application/x-bzip2',
-  'application/x-xz',
-  'application/x-tar',
-  'application/x-lzip',
-  'application/x-lzma',
-  'application/zstd',
-
-  // Images (lossy compressed)
-  'image/jpeg',
-  'image/png',
-  'image/gif',
-  'image/webp',
-  'image/avif',
-  'image/heic',
-  'image/heif',
-  'image/jxl',
-
-  // Audio
-  'audio/mpeg', // mp3
-  'audio/ogg',
-  'audio/flac',
-  'audio/aac',
-  'audio/mp4',
-  'audio/x-m4a',
-  'audio/opus',
-
-  // Video
-  'video/mp4',
-  'video/webm',
-  'video/x-matroska', // mkv
-  'video/quicktime', // mov
-  'video/x-msvideo', // avi
-  'video/mpeg',
-
-  // Documents (OOXML are zip-based)
-  'application/vnd.openxmlformats-officedocument.wordprocessingml.document', // docx
-  'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet', // xlsx
-  'application/vnd.openxmlformats-officedocument.presentationml.presentation', // pptx
-  'application/pdf',
-  'application/epub+zip',
-]);
-
-/**
- * Check if a file type is already compressed
- * @param {string|null} mime - MIME type from file-type detection
- * @returns {boolean}
- */
-function isCompressedMime(mime) {
-  return mime ? COMPRESSED_MIMES.has(mime) : false;
-}
-
-/**
- * Compress data using gzip
- * @param {Buffer} buffer - Data to compress
- * @returns {Promise<Buffer>} Compressed data
- */
-function compress(buffer) {
-  return new Promise((resolve, reject) => {
-    zlib.gzip(buffer, { level: 9 }, (err, result) => {
-      if (err) reject(err);
-      else resolve(result);
-    });
-  });
-}
-
-/**
- * Decompress gzip data
- * @param {Buffer} buffer - Compressed data
- * @returns {Promise<Buffer>} Decompressed data
- */
-function decompress(buffer) {
-  return new Promise((resolve, reject) => {
-    zlib.gunzip(buffer, (err, result) => {
-      if (err) reject(err);
-      else resolve(result);
-    });
-  });
-}
-
-/**
- * Create a streaming gzip compression transform
- * @returns {zlib.Gzip} Gzip transform stream
- */
-function createCompressStream() {
-  return zlib.createGzip({ level: 9 });
-}
-
-/**
- * Create a streaming gunzip decompression transform
- * @returns {zlib.Gunzip} Gunzip transform stream
- */
-function createDecompressStream() {
-  return zlib.createGunzip();
-}
-
-module.exports = {
-  isCompressedMime,
-  compress,
-  decompress,
-  createCompressStream,
-  createDecompressStream,
-  compressBrotli,
-  decompressBrotli,
-  createBrotliCompressStream,
-  createBrotliDecompressStream,
-  COMPRESSED_MIMES,
-};
+module.exports = { createBrotliCompressStream };