stegdoc 5.7.0 → 6.1.0

package/src/lib/crypto.js

@@ -18,75 +18,6 @@ function deriveKey(password, salt) {
   return crypto.pbkdf2Sync(password, salt, PBKDF2_ITERATIONS, KEY_LENGTH, 'sha256');
 }
 
-/**
- * Encrypt plaintext using AES-256-GCM
- * @param {string} plaintext - Data to encrypt
- * @param {string} password - User password
- * @returns {object} { ciphertext, iv, salt, authTag } - all as base64 strings
- */
-function encrypt(plaintext, password) {
-  // Generate random salt and IV
-  const salt = crypto.randomBytes(SALT_LENGTH);
-  const iv = crypto.randomBytes(IV_LENGTH);
-
-  // Derive key from password
-  const key = deriveKey(password, salt);
-
-  // Create cipher and encrypt
-  const cipher = crypto.createCipheriv(ALGORITHM, key, iv, {
-    authTagLength: AUTH_TAG_LENGTH,
-  });
-
-  let ciphertext = cipher.update(plaintext, 'utf8', 'base64');
-  ciphertext += cipher.final('base64');
-
-  // Get authentication tag
-  const authTag = cipher.getAuthTag();
-
-  return {
-    ciphertext,
-    iv: iv.toString('base64'),
-    salt: salt.toString('base64'),
-    authTag: authTag.toString('base64'),
-  };
-}
-
-/**
- * Decrypt ciphertext using AES-256-GCM
- * @param {string} ciphertext - Encrypted data (base64)
- * @param {string} password - User password
- * @param {string} ivBase64 - Initialization vector (base64)
- * @param {string} saltBase64 - Salt used for key derivation (base64)
- * @param {string} authTagBase64 - Authentication tag (base64)
- * @returns {string} Decrypted plaintext
- * @throws {Error} If decryption fails (wrong password or tampered data)
- */
-function decrypt(ciphertext, password, ivBase64, saltBase64, authTagBase64) {
-  // Convert from base64
-  const iv = Buffer.from(ivBase64, 'base64');
-  const salt = Buffer.from(saltBase64, 'base64');
-  const authTag = Buffer.from(authTagBase64, 'base64');
-
-  // Derive key from password
-  const key = deriveKey(password, salt);
-
-  // Create decipher
-  const decipher = crypto.createDecipheriv(ALGORITHM, key, iv, {
-    authTagLength: AUTH_TAG_LENGTH,
-  });
-
-  // Set auth tag for verification
-  decipher.setAuthTag(authTag);
-
-  try {
-    let plaintext = decipher.update(ciphertext, 'base64', 'utf8');
-    plaintext += decipher.final('utf8');
-    return plaintext;
-  } catch (error) {
-    throw new Error('Decryption failed: Invalid password or corrupted data');
-  }
-}
-
 /**
  * Pack encryption metadata into a single string for storage
  * @param {object} encryptionData - { iv, salt, authTag }
@@ -96,19 +27,6 @@ function packEncryptionMeta(encryptionData) {
   return `${encryptionData.iv}:${encryptionData.salt}:${encryptionData.authTag}`;
 }
 
-/**
- * Unpack encryption metadata from storage string
- * @param {string} packed - Packed string (iv:salt:authTag)
- * @returns {object} { iv, salt, authTag }
- */
-function unpackEncryptionMeta(packed) {
-  const [iv, salt, authTag] = packed.split(':');
-  if (!iv || !salt || !authTag) {
-    throw new Error('Invalid encryption metadata format');
-  }
-  return { iv, salt, authTag };
-}
-
 /**
  * Generate a random salt for key derivation (one per encode session)
  * @returns {Buffer} Random salt
@@ -139,34 +57,9 @@ function createEncryptStream(password, salt) {
   };
 }
 
-/**
- * Create a streaming decrypt decipher for per-part decryption.
- * Auth tag is set immediately and verified on .final().
- * @param {string} password - User password
- * @param {string} ivBase64 - IV (base64)
- * @param {string} saltBase64 - Salt (base64)
- * @param {string} authTagBase64 - Auth tag (base64)
- * @returns {crypto.Decipher} Decipher transform stream
- */
-function createDecryptStream(password, ivBase64, saltBase64, authTagBase64) {
-  const iv = Buffer.from(ivBase64, 'base64');
-  const salt = Buffer.from(saltBase64, 'base64');
-  const authTag = Buffer.from(authTagBase64, 'base64');
-  const key = deriveKey(password, salt);
-  const decipher = crypto.createDecipheriv(ALGORITHM, key, iv, {
-    authTagLength: AUTH_TAG_LENGTH,
-  });
-  decipher.setAuthTag(authTag);
-  return decipher;
-}
-
 module.exports = {
-  encrypt,
-  decrypt,
   deriveKey,
   packEncryptionMeta,
-  unpackEncryptionMeta,
   generateSalt,
   createEncryptStream,
-  createDecryptStream,
 };

package/src/lib/docx-handler.js

@@ -1,16 +1,11 @@
 const {
   Document, Paragraph, TextRun, Packer, Table, TableRow, TableCell,
-  AlignmentType, HeadingLevel, WidthType, ShadingType, BorderStyle, PageBreak,
+  AlignmentType, HeadingLevel, WidthType, ShadingType,
 } = require('docx');
 const fs = require('fs');
 const path = require('path');
-const { serializeMetadata, parseMetadata } = require('./metadata');
-const { parseXmlFromZip, ensureArray, extractTextContent } = require('./xml-utils');
 const { generateIncident, generateHebrewDate } = require('./docx-templates');
-const {
-  encodePayloadToLogLines, decodeLogLines, generateLogHeaders, resetTimeState,
-  BYTES_PER_DATA_LINE, calculateDataLineCount,
-} = require('./log-generator');
+const { encodePayloadToLogLines, resetTimeState } = require('./log-generator');
 
 // ─── Shared Styles ──────────────────────────────────────────────────────────
 
@@ -311,277 +306,6 @@ function createHebrewCell(text, isHeader, widthPct) {
   });
 }
 
-// ─── v5 DOCX Reader ─────────────────────────────────────────────────────────
-
-/**
- * Read a v5 log-embed DOCX file and extract payload.
- * Scans for monospace paragraphs that contain log lines.
- * @param {string} docxPath - Path to DOCX file
- * @returns {object} { payloadBuffer, metadataJson, encryptionMeta, metadata, formatVersion }
- */
-async function readDocxV5(docxPath) {
-  const docParsed = parseXmlFromZip(docxPath, 'word/document.xml');
-  if (!docParsed) {
-    throw new Error('Could not find document.xml in DOCX file');
-  }
-
-  // Also parse styles to identify monospace/code runs
-  const stylesParsed = parseXmlFromZip(docxPath, 'word/styles.xml');
-
-  // Extract all paragraphs with their formatting info
-  const body = docParsed?.document?.body;
-  if (!body) throw new Error('Empty document body');
-
-  const paragraphs = ensureArray(body.p);
-  const logLines = [];
-
-  for (const para of paragraphs) {
-    const runs = ensureArray(para.r);
-    let paraText = '';
-    let isCode = false;
-
-    for (const run of runs) {
-      if (run.t !== undefined) {
-        paraText += extractTextContent(run.t);
-      }
-
-      // Check if run uses monospace font (Consolas/Courier)
-      const rPr = run.rPr;
-      if (rPr) {
-        const fonts = rPr.rFonts;
-        if (fonts) {
-          const fontName = fonts['@_w:ascii'] || fonts['@_ascii'] || '';
-          if (/consolas|courier/i.test(fontName)) {
-            isCode = true;
-          }
-        }
-      }
-    }
-
-    // Also check paragraph-level shading as indicator of code block
-    const pPr = para.pPr;
-    if (pPr && pPr.shd) {
-      const fill = pPr.shd['@_w:fill'] || pPr.shd['@_fill'] || '';
-      if (fill === 'F2F2F2' || fill === 'f2f2f2') {
-        isCode = true;
-      }
-    }
-
-    // Collect code paragraphs that look like log lines
-    if (isCode && paraText.trim().length > 0) {
-      // Skip the comment line
-      if (paraText.startsWith('//')) continue;
-      logLines.push(paraText.trim());
-    }
-  }
-
-  if (logLines.length === 0) {
-    throw new Error('No log lines found in DOCX file. This may not be a v5 stegdoc file.');
-  }
-
-  // Parse log lines back into row arrays
-  const rows = logLines.map(parseLogLine);
-
-  // Decode using the same engine as XLSX
-  return decodeLogLines(rows);
-}
-
-/**
- * Parse a formatted log line string back into a row array.
- * Input format: `IP - - [timestamp] "request" status bytes "referer" "ua" "requestId" "traceId"`
- */
-function parseLogLine(line) {
-  // Regex to parse nginx combined log format with extra fields
-  const regex = /^(\S+)\s+-\s+-\s+(\[[^\]]+\])\s+"([^"]+)"\s+(\d+)\s+(\d+)\s+"([^"]+)"\s+"([^"]+)"\s+"([^"]+)"\s+"([^"]+)"$/;
-  const match = line.match(regex);
-
-  if (!match) {
-    // Fallback: try to extract what we can
-    return ['', '', '', line, '', '', '', '', '', ''];
-  }
-
-  const [, ip, timestamp, request, status, bytes, referer, ua, requestId, traceId] = match;
-
-  // Extract method from request
-  const methodMatch = request.match(/^(\w+)\s/);
-  const method = methodMatch ? methodMatch[1] : '';
-
-  return [ip, timestamp, method, request, status, bytes, referer, ua, requestId, traceId];
-}
-
-/**
- * Detect if a DOCX file is v5 (log-embed) format.
- * Checks for the presence of log-formatted monospace content.
- */
-function detectDocxVersion(docxPath) {
-  try {
-    const docParsed = parseXmlFromZip(docxPath, 'word/document.xml');
-    if (!docParsed) return 'legacy';
-
-    const body = docParsed?.document?.body;
-    if (!body) return 'legacy';
-
-    // Quick check: look for the STGD05 marker in raw text
-    const paragraphs = ensureArray(body.p);
-    for (const para of paragraphs) {
-      const runs = ensureArray(para.r);
-      for (const run of runs) {
-        const text = extractTextContent(run.t || '');
-        if (text.includes('/api/v1/health/')) {
-          return 'v5';
-        }
-      }
-    }
-
-    // Check for WHITENER_METADATA (legacy)
-    for (const para of paragraphs) {
-      const runs = ensureArray(para.r);
-      for (const run of runs) {
-        const text = extractTextContent(run.t || '');
-        if (text.includes('WHITENER_METADATA:')) {
-          return 'legacy';
-        }
-      }
-    }
-
-    return 'legacy';
-  } catch {
-    return 'legacy';
-  }
-}
-
-// ─── Legacy DOCX (v3/v4) ───────────────────────────────────────────────────
-
-/**
- * Create a legacy DOCX file with base64 content (v3/v4 format)
- */
-async function createDocxWithBase64(options) {
-  const { base64Content, metadata, outputPath } = options;
-
-  const metadataStr = serializeMetadata(metadata);
-
-  const doc = new Document({
-    sections: [{
-      properties: {},
-      children: [
-        new Paragraph({
-          children: [
-            new TextRun({
-              text: `WHITENER_METADATA:${metadataStr}`,
-              size: 1,
-            }),
-          ],
-        }),
-        new Paragraph({
-          children: [
-            new TextRun({ text: '---', break: 1 }),
-          ],
-        }),
-        new Paragraph({
-          children: [
-            new TextRun({
-              text: base64Content,
-              font: 'Courier New',
-              size: 16,
-            }),
-          ],
-        }),
-      ],
-    }],
-  });
-
-  const buffer = await Packer.toBuffer(doc);
-
-  const outputDir = path.dirname(outputPath);
-  if (!fs.existsSync(outputDir)) {
-    fs.mkdirSync(outputDir, { recursive: true });
-  }
-
-  fs.writeFileSync(outputPath, buffer);
-  return outputPath;
-}
-
-// ─── Unified Reader ─────────────────────────────────────────────────────────
-
-/**
- * Read a DOCX file, auto-detecting v5 vs legacy format.
- */
-async function readDocxBase64(docxPath) {
-  if (!fs.existsSync(docxPath)) {
-    throw new Error(`DOCX file not found: ${docxPath}`);
-  }
-
-  const version = detectDocxVersion(docxPath);
-
-  if (version === 'v5') {
-    const result = await readDocxV5(docxPath);
-    return {
-      ...result,
-      formatVersion: 'v5',
-    };
-  }
-
-  // Legacy path
-  try {
-    const docParsed = parseXmlFromZip(docxPath, 'word/document.xml');
-    if (!docParsed) {
-      throw new Error('Could not find document.xml in DOCX file');
-    }
-
-    const fullText = extractAllText(docParsed);
-    const metadataMarker = 'WHITENER_METADATA:';
-    const metadataStart = fullText.indexOf(metadataMarker);
-
-    if (metadataStart === -1) {
-      throw new Error('No metadata found in DOCX file. This may not be a stegdoc-encoded file.');
-    }
-
-    const separatorIndex = fullText.indexOf('---', metadataStart);
-    if (separatorIndex === -1) {
-      throw new Error('Invalid file format: separator not found');
-    }
-
-    const metadataStr = fullText.substring(metadataStart + metadataMarker.length, separatorIndex).trim();
-    const metadata = parseMetadata(metadataStr);
-    const base64Content = fullText.substring(separatorIndex + 3).trim();
-
-    return {
-      base64Content,
-      metadata,
-      formatVersion: 'legacy',
-    };
-  } catch (error) {
-    throw new Error(`Failed to read DOCX file: ${error.message}`);
-  }
-}
-
-/**
- * Extract all text content from parsed DOCX document (legacy)
- */
-function extractAllText(docParsed) {
-  let fullText = '';
-  const body = docParsed?.document?.body;
-  if (!body) return fullText;
-
-  const paragraphs = ensureArray(body.p);
-  for (const para of paragraphs) {
-    const runs = ensureArray(para.r);
-    for (const run of runs) {
-      if (run.t !== undefined) {
-        fullText += extractTextContent(run.t);
-      }
-    }
-  }
-  return fullText;
-}
-
 module.exports = {
-  // v5
   createDocxV5,
-  readDocxV5,
-  detectDocxVersion,
-  // Legacy
-  createDocxWithBase64,
-  // Unified
-  readDocxBase64,
 };

package/src/lib/log-generator.js

@@ -657,9 +657,12 @@ function decodeLogLines(allRows) {
   const headerStr = headerPayload.toString('utf8');
 
   // Parse header: "STGD05|<metaLen>|<encLen>|{metadataJson}{encryptionMeta}"
-  const markerIdx = headerStr.indexOf('STGD05|');
+  const markerIdx = headerStr.search(/STGD0[56]\|/);
   if (markerIdx === -1) {
-    throw new Error('Invalid v5 format: magic marker not found. This may not be a stegdoc v5 file.');
+    throw new Error('Invalid log-embed format: magic marker not found. This may not be a stegdoc file.');
+  }
+  if (headerStr.startsWith('STGD06|', markerIdx)) {
+    throw new Error('This file uses the v6 format, which the JavaScript decoder cannot read. The native engine is required.');
   }
 
   const afterMarker = headerStr.slice(markerIdx + 7);

package/src/lib/metadata.js

@@ -24,15 +24,11 @@ function createMetadata({
   encrypted = true,
   compressed = false,
   contentHash = null,
-  // v5 fields
-  stegoMethod = null,
   compressionAlgo = null,
   payloadSize = null,
   dataLineCount = null,
   headerLineCount = null,
 }) {
-  const isV5 = stegoMethod === 'log-embed';
-
   const meta = {
     originalFilename,
     originalExtension,
@@ -44,20 +40,17 @@ function createMetadata({
     encrypted,
     compressed,
     contentHash,
-    pipelineOrder: isV5 ? 'brotli-encrypt-logEmbed' : 'compress-encrypt-base64',
+    pipelineOrder: 'brotli-encrypt-logEmbed',
     encodingDate: new Date().toISOString(),
-    version: isV5 ? '5.0.0' : '4.0.0',
+    version: '5.0.0',
     tool: 'stegdoc',
+    stegoMethod: 'log-embed',
+    compressionAlgo: compressionAlgo || 'brotli',
   };
 
-  // v5-specific fields
-  if (isV5) {
-    meta.stegoMethod = 'log-embed';
-    meta.compressionAlgo = compressionAlgo || 'brotli';
-    if (payloadSize !== null) meta.payloadSize = payloadSize;
-    if (dataLineCount !== null) meta.dataLineCount = dataLineCount;
-    if (headerLineCount !== null) meta.headerLineCount = headerLineCount;
-  }
+  if (payloadSize !== null) meta.payloadSize = payloadSize;
+  if (dataLineCount !== null) meta.dataLineCount = dataLineCount;
+  if (headerLineCount !== null) meta.headerLineCount = headerLineCount;
 
   return meta;
 }
@@ -71,81 +64,7 @@ function serializeMetadata(metadata) {
   return JSON.stringify(metadata);
 }
 
-/**
- * Parse metadata from string
- * @param {string} metadataStr - JSON string
- * @returns {object} Metadata object
- */
-function parseMetadata(metadataStr) {
-  try {
-    return JSON.parse(metadataStr);
-  } catch (error) {
-    throw new Error(`Failed to parse metadata: ${error.message}`);
-  }
-}
-
-/**
- * Validate metadata object
- * @param {object} metadata - Metadata to validate
- * @returns {boolean} True if valid
- * @throws {Error} If metadata is invalid
- */
-function validateMetadata(metadata) {
-  const required = ['originalFilename', 'originalExtension', 'hash', 'tool'];
-
-  for (const field of required) {
-    if (!metadata[field]) {
-      throw new Error(`Missing required metadata field: ${field}`);
-    }
-  }
-
-  if (metadata.tool !== 'stegdoc' && metadata.tool !== 'whitener') {
-    throw new Error('Invalid tool identifier in metadata');
-  }
-
-  // If it's a multi-part file, validate part info
-  if (metadata.totalParts !== null && metadata.totalParts > 1) {
-    if (metadata.partNumber === null || metadata.partNumber < 1 || metadata.partNumber > metadata.totalParts) {
-      throw new Error('Invalid part number in metadata');
-    }
-  }
-
-  return true;
-}
-
-/**
- * Check if metadata indicates a multi-part file
- * @param {object} metadata - Metadata object
- * @returns {boolean} True if multi-part
- */
-function isMultiPart(metadata) {
-  return metadata.totalParts !== null && metadata.totalParts > 1;
-}
-
-/**
- * Check if metadata indicates the v4 streaming format
- * @param {object} metadata - Metadata object
- * @returns {boolean} True if streaming format (v4+)
- */
-function isStreamingFormat(metadata) {
-  return metadata.pipelineOrder === 'compress-encrypt-base64';
-}
-
-/**
- * Check if metadata indicates the v5 log-embed format
- * @param {object} metadata - Metadata object
- * @returns {boolean} True if log-embed format (v5+)
- */
-function isLogEmbedFormat(metadata) {
-  return metadata.stegoMethod === 'log-embed' || metadata.pipelineOrder === 'brotli-encrypt-logEmbed';
-}
-
 module.exports = {
   createMetadata,
   serializeMetadata,
-  parseMetadata,
-  validateMetadata,
-  isMultiPart,
-  isStreamingFormat,
-  isLogEmbedFormat,
 };

package/src/lib/native.js

@@ -0,0 +1,68 @@
+'use strict';
+
+const path = require('path');
+
+const { hostTarget, packageName } = require('./bindings');
+
+const NATIVE_DIR = path.join(__dirname, '..', '..', 'native');
+
+let binding;
+let resolved = false;
+
+/**
+ * Load the native format engine, or return null when it is not available.
+ *
+ * Resolution order:
+ *   1. `STEGDOC_NATIVE_PATH`, an explicit `.node` file.
+ *   2. The platform package (`@stegdoc/binding-<suffix>`) from the published
+ *      install's optionalDependencies.
+ *   3. `native/stegdoc.node`, the local `pnpm build:native` output.
+ *
+ * The binding is required for log-embed (v5/v6) decode and is the preferred
+ * encoder. The CommonJS v5 encoder survives only as a fallback for hosts where
+ * the binding cannot be loaded. Set `STEGDOC_DISABLE_NATIVE=1` to force that
+ * fallback; it does not affect decode, which has no JS path.
+ *
+ * @returns {object|null} The binding, or null when unavailable.
+ */
+function loadNative() {
+  if (resolved) return binding;
+  resolved = true;
+
+  if (process.env.STEGDOC_DISABLE_NATIVE === '1') {
+    binding = null;
+    return binding;
+  }
+
+  const explicit = process.env.STEGDOC_NATIVE_PATH;
+  if (explicit) {
+    binding = require(explicit);
+    return binding;
+  }
+
+  const target = hostTarget();
+  if (target) {
+    try {
+      binding = require(packageName(target));
+      return binding;
+    } catch {
+      // Not installed; fall through to the development build.
+    }
+  }
+
+  try {
+    binding = require(path.join(NATIVE_DIR, 'stegdoc.node'));
+  } catch {
+    binding = null;
+  }
+  return binding;
+}
+
+/**
+ * @returns {boolean} Whether the native engine is loaded.
+ */
+function nativeAvailable() {
+  return loadNative() !== null;
+}
+
+module.exports = { loadNative, nativeAvailable };