stegdoc 6.0.0 → 6.1.0

package/README.md

@@ -27,7 +27,7 @@ the CLI, and as WebAssembly for the single-file browser tool.
 - **Multi-part splitting** for payloads larger than one document
 - **Integrity checking** with SHA-256, verified on decode
 - **ZIP, directory, or single-file input** on decode, discovered automatically
-- **Backward compatible** — the decoder reads every earlier format version
+- **v5 and v6 read support** — the decoder reads both log-embed versions
 
 ## Install
 
@@ -75,7 +75,6 @@ stegdoc verify access_log_20260315_1200_A1B2_part1.xlsx -p mypassword
 | `-p, --password <pass>` | Encryption password | None (unencrypted) |
 | `--v5` | Emit the v5 format (PBKDF2) | Off (v6) |
 | `--v6` | Emit the v6 format (the default) | On |
-| `--legacy` | Emit the legacy v4 DOCX format | Off |
 | `--no-limit` | Bypass the DOCX 1 MB limit | Off |
 | `--force` | Overwrite existing files | Prompt |
 | `-q, --quiet` | Minimal output for scripting | Off |
@@ -83,7 +82,8 @@ stegdoc verify access_log_20260315_1200_A1B2_part1.xlsx -p mypassword
 
 A directory is zipped before encoding, and several inputs are bundled into one
 zip first, so a decode hands that archive back. `-s max` produces a single part;
-`-s "3 parts"` splits into roughly three.
+`-s "3 parts"` splits into roughly three. Bundling a folder or several inputs
+uses the native engine to build the archive.
 
 ```bash
 stegdoc encode document.pdf -p mysecret                 # access log spreadsheet
@@ -250,12 +250,18 @@ decoders.
 The same engine also runs as WebAssembly in a single self-contained HTML file,
 for offline use where installing anything is not an option.
 
+```bash
+npx @stegdoc/web      # writes ./stegdoc.html
+```
+
+Or build it from source:
+
 ```bash
 pnpm install
 pnpm build:web        # -> dist/stegdoc.html
 ```
 
-Open `dist/stegdoc.html` in a browser. Encoding and decoding run in a Web Worker
+Open the file in a browser. Encoding and decoding run in a Web Worker
 so the page stays responsive; nothing is uploaded and no network is used. The UI
 offers XLSX or DOCX, v6 or v5, an optional password, an optional chunk size, and
 Brotli compression. Several files can be selected at once and are bundled into
@@ -284,8 +290,10 @@ The wire format is specified in [`spec/FORMAT.md`](spec/FORMAT.md).
 
 - The decoder auto-detects the version, so no flag is needed to read old files.
 - v6 is the default output. `--v5` emits the older format; both cover XLSX and
-  DOCX. `--legacy` produces v4 DOCX only; legacy XLSX is unsupported.
-- v3/v4 are read-only paths kept for old files.
+  DOCX.
+- v3/v4 (base64 in a hidden sheet or paragraph, gzip) are no longer readable.
+  The decoder reports that the format is unsupported; re-encode the file with a
+  current version of stegdoc.
 - Log-embed (v5/v6) decoding requires the native engine. Without it, the CLI
   fails loudly rather than falling back to an incomplete reader.
 - Encoding and decoding are randomised, so two encodes of the same input are
@@ -306,11 +314,12 @@ Then run the CLI directly with `node src/index.js <command>`.
 |---------|---------|
 | `pnpm test` | conformance against the frozen fixtures (builds native first) |
 | `pnpm test:rust` | the Rust decoder against the same fixtures |
-| `pnpm test:interop` | Rust encode -> JavaScript decode |
+| `pnpm test:interop` | Rust binary encode -> CLI (napi) decode |
 | `pnpm test:safety` | output-path traversal containment |
 | `pnpm test:contract` | CLI flags, exit codes, filenames |
 | `pnpm build:wasm` | the wasm binding -> `web/pkg` |
 | `pnpm build:web` | the single-file browser tool -> `dist/stegdoc.html` |
+| `pnpm build:web-package` | stage `@stegdoc/web` from `dist/` |
 | `pnpm test:wasm` | wasm round-trip, headless in Node |
 | `pnpm test:browser` | the built page, round-trip from `file://` |
 | `cargo test` | Rust unit and property tests |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "stegdoc",
-  "version": "6.0.0",
+  "version": "6.1.0",
   "description": "Hide files inside Office documents (XLSX/DOCX) with AES-256 encryption and steganography",
   "main": "src/index.js",
   "bin": {
@@ -16,6 +16,7 @@
     "prepare-publish": "node scripts/prepare-publish.js",
     "build:wasm": "node scripts/build-wasm.js",
     "build:web": "node scripts/build-web.js",
+    "build:web-package": "node scripts/build-web-package.js",
     "test": "pnpm build:native && node spec/tools/conformance.js",
     "test:rust": "node spec/tools/conformance.js --bin target/debug/stegdoc",
     "test:interop": "node spec/tools/interop.js",
@@ -59,23 +60,21 @@
   ],
   "packageManager": "pnpm@10.19.0",
   "dependencies": {
-    "adm-zip": "^0.5.16",
     "chalk": "^4.1.2",
     "commander": "^14.0.2",
     "docx": "^9.5.1",
-    "fast-xml-parser": "^5.3.3",
-    "file-type": "^16.5.4",
     "inquirer": "^8.2.6",
     "ora": "^5.4.1"
   },
   "devDependencies": {
+    "adm-zip": "^0.5.16",
     "playwright-core": "^1.63.0"
   },
   "optionalDependencies": {
-    "@stegdoc/binding-win32-x64-msvc": "6.0.0",
-    "@stegdoc/binding-linux-x64-gnu": "6.0.0",
-    "@stegdoc/binding-linux-arm64-gnu": "6.0.0",
-    "@stegdoc/binding-darwin-x64": "6.0.0",
-    "@stegdoc/binding-darwin-arm64": "6.0.0"
+    "@stegdoc/binding-win32-x64-msvc": "6.1.0",
+    "@stegdoc/binding-linux-x64-gnu": "6.1.0",
+    "@stegdoc/binding-linux-arm64-gnu": "6.1.0",
+    "@stegdoc/binding-darwin-x64": "6.1.0",
+    "@stegdoc/binding-darwin-arm64": "6.1.0"
   }
 }

package/src/commands/decode.js

@@ -1,33 +1,17 @@
 const path = require('path');
 const fs = require('fs');
-const { finished } = require('stream/promises');
 const chalk = require('chalk');
 const ora = require('ora');
-const { readDocxBase64, } = require('../lib/docx-handler');
-const { readXlsxBase64 } = require('../lib/xlsx-handler');
-const { validateMetadata, isMultiPart, isStreamingFormat } = require('../lib/metadata');
-const { detectFormat, formatBytes, generateContentHash, safeFilename } = require('../lib/utils');
-const { decrypt, unpackEncryptionMeta, createDecryptStream } = require('../lib/crypto');
-const { decompress, createDecompressStream } = require('../lib/compression');
+const { detectFormat, formatBytes } = require('../lib/utils');
 const { promptPassword, promptOverwrite } = require('../lib/interactive');
-const { extractContent, findMultiPartFiles, mergeBase64Chunks } = require('../lib/file-utils');
-const { HashPassthrough } = require('../lib/streams');
 const { loadNative } = require('../lib/native');
 
 const NATIVE_REQUIRED =
   'This is a v5 log-embed file. Decoding it requires the native engine, which is not installed. ' +
   'Reinstall stegdoc, or build it with `pnpm build:native`.';
 
-/**
- * Read file based on format
- */
-async function readFile(filePath, format) {
-  if (format === 'xlsx') {
-    return await readXlsxBase64(filePath);
-  } else {
-    return await readDocxBase64(filePath);
-  }
-}
+const LEGACY_UNSUPPORTED =
+  'The legacy v3/v4 format is no longer supported. Re-encode the file with a current version of stegdoc.';
 
 /**
  * Decode a DOCX/XLSX file back to original format
@@ -39,73 +23,81 @@ async function decodeCommand(inputFile, options) {
   try {
     const format = detectFormat(inputFile);
 
-    // Prefer the native engine for v5/v6 files and transport archives. It
-    // returns false for anything the legacy JS paths must handle.
     const native = loadNative();
-    if (native && (await decodeV5Native(native, inputFile, format, options, spinner, quiet))) {
-      return;
+    if (!native) {
+      throw new Error(NATIVE_REQUIRED);
     }
 
-    if (!format) {
+    let probe;
+    try {
+      probe = native.probe(inputFile);
+    } catch {
+      probe = 'unknown';
+    }
+    if (probe === 'legacy') {
+      throw new Error(LEGACY_UNSUPPORTED);
+    }
+    if (probe !== 'v5' && probe !== 'archive') {
       throw new Error(
         'Unknown file format. Supported formats: .xlsx, .docx, or a zip of them'
       );
     }
 
-    spinner.text = `Reading ${format.toUpperCase()} file...`;
-
-    // Read the first file
-    const readResult = await readFile(inputFile, format);
+    const label = format ? format.toUpperCase() : 'ZIP';
+    spinner.text = `Reading ${label} file...`;
 
-    // Route based on format version
-    if (readResult.formatVersion === 'v5') {
-      // The CommonJS v5 decoder survives only for the legacy v3/v4 formats; its
-      // output path is not sanitised, so log-embed files must go through the
-      // native engine. Reaching here means the binding is missing.
-      throw new Error(NATIVE_REQUIRED);
+    let result;
+    try {
+      result = native.decode(inputFile, options.password || undefined, undefined);
+    } catch (error) {
+      if (!String(error.message).startsWith('STEGDOC_PASSWORD_REQUIRED')) {
+        throw error;
+      }
+      if (quiet || options.yes) {
+        throw new Error('Password is required for encrypted files. Use -p or --password to specify.');
+      }
+      options.password = await promptPassword();
+      result = native.decode(inputFile, options.password || undefined, undefined);
     }
 
-    // Legacy v3/v4 path
-    {
-      const { encryptedContent, encryptionMeta, metadata } = extractContent(readResult, format);
-      validateMetadata(metadata);
+    const engineVersion = result.formatVersion || 'v5';
+    spinner.succeed && spinner.succeed(`${label} file read (${engineVersion} log-embed format)`);
 
-      const isEncrypted = metadata.encrypted || (encryptionMeta && encryptionMeta.length > 0);
-      const isCompressed = metadata.compressed || false;
+    if (!quiet) {
+      console.log(chalk.cyan(`  Original file: ${result.originalFilename}`));
+      console.log(chalk.cyan(`  Original size: ${formatBytes(result.originalSize)}`));
+      console.log(chalk.cyan(`  Encrypted: ${result.encrypted ? 'Yes' : 'No'}`));
+      console.log(chalk.cyan(`  Compressed: ${result.compressed ? 'Yes (brotli)' : 'No'}`));
+    }
 
-      spinner.succeed && spinner.succeed(`${format.toUpperCase()} file read successfully`);
+    const outputPath = resolveNativeOutputPath(options, result.safeFilename);
+    const outputDir = path.dirname(outputPath);
+    if (!fs.existsSync(outputDir)) {
+      fs.mkdirSync(outputDir, { recursive: true });
+    }
 
-      if (!quiet) {
-        console.log(chalk.cyan(`  Original file: ${metadata.originalFilename}`));
-        console.log(chalk.cyan(`  Original size: ${formatBytes(metadata.originalSize)}`));
-        console.log(chalk.cyan(`  Encrypted: ${isEncrypted ? 'Yes' : 'No'}`));
-        console.log(chalk.cyan(`  Compressed: ${isCompressed ? 'Yes' : 'No'}`));
+    if (fs.existsSync(outputPath) && !options.force) {
+      if (quiet || options.yes) {
+        throw new Error(`File already exists: ${outputPath}. Use --force to overwrite.`);
       }
-
-      if (isEncrypted && !options.password) {
-        if (quiet || options.yes) {
-          throw new Error('Password is required for encrypted files. Use -p or --password to specify.');
-        }
-        options.password = await promptPassword();
+      const shouldOverwrite = await promptOverwrite(outputPath);
+      if (!shouldOverwrite) {
+        console.log(chalk.yellow('Operation cancelled.'));
+        process.exit(0);
       }
+    }
 
-      let outputPath = resolveOutputPath(options, metadata);
+    fs.writeFileSync(outputPath, result.bytes);
+    spinner.succeed && spinner.succeed('Decoding complete!');
 
-      if (fs.existsSync(outputPath) && !options.force) {
-        if (quiet || options.yes) {
-          throw new Error(`File already exists: ${outputPath}. Use --force to overwrite.`);
-        }
-        const shouldOverwrite = await promptOverwrite(outputPath);
-        if (!shouldOverwrite) {
-          console.log(chalk.yellow('Operation cancelled.'));
-          process.exit(0);
-        }
-      }
-
-      if (isStreamingFormat(metadata) && format === 'xlsx') {
-        await decodeStreaming(inputFile, format, metadata, encryptedContent, encryptionMeta, isEncrypted, isCompressed, options, outputPath, spinner, quiet);
-      } else {
-        await decodeLegacy(inputFile, format, metadata, encryptedContent, encryptionMeta, isEncrypted, isCompressed, options, outputPath, spinner, quiet);
+    if (!quiet) {
+      console.log();
+      console.log(chalk.green.bold('✓ File decoded successfully!'));
+      console.log(chalk.cyan(`  Original: ${result.originalFilename}`));
+      console.log(chalk.cyan(`  Output: ${outputPath}`));
+      console.log(chalk.cyan(`  Size: ${formatBytes(result.bytes.length)}`));
+      if (result.partCount > 1) {
+        console.log(chalk.cyan(`  Parts merged: ${result.partCount}`));
       }
     }
   } catch (error) {
@@ -115,27 +107,6 @@ async function decodeCommand(inputFile, options) {
   }
 }
 
-/**
- * Resolve output path from options and metadata.
- *
- * `metadata.originalFilename` is unauthenticated, so it is reduced to a bare
- * name before it is joined onto any directory (FORMAT.md 11.1).
- */
-function resolveOutputPath(options, metadata) {
-  const name = safeFilename(metadata.originalFilename);
-  if (options.output) {
-    if (fs.existsSync(options.output) && fs.statSync(options.output).isDirectory()) {
-      return path.join(options.output, name);
-    } else if (!path.extname(options.output) && !fs.existsSync(options.output)) {
-      fs.mkdirSync(options.output, { recursive: true });
-      return path.join(options.output, name);
-    } else {
-      return options.output;
-    }
-  }
-  return path.join(process.cwd(), name);
-}
-
 /**
  * Resolve the output path using a filename the native engine already
  * sanitised. `safeFilename` is a bare name, so joining it cannot escape.
@@ -154,281 +125,4 @@ function resolveNativeOutputPath(options, safeFilename) {
   return path.join(process.cwd(), safeFilename);
 }
 
-/**
- * Decode a v5 file through the native engine.
- *
- * Returns true when the file was handled, false when it is not a v5 file the
- * native engine understands and the caller should fall back to the JS paths.
- */
-async function decodeV5Native(native, inputFile, format, options, spinner, quiet) {
-  let version;
-  try {
-    version = native.probe(inputFile);
-  } catch {
-    // Not a readable container; let the JS paths produce the error.
-    return false;
-  }
-  if (version !== 'v5' && version !== 'archive') return false;
-
-  const label = format ? format.toUpperCase() : 'ZIP';
-  spinner.text = `Reading ${label} file...`;
-
-  let result;
-  try {
-    result = native.decode(inputFile, options.password || undefined, undefined);
-  } catch (error) {
-    if (!String(error.message).startsWith('STEGDOC_PASSWORD_REQUIRED')) {
-      throw error;
-    }
-    if (quiet || options.yes) {
-      throw new Error('Password is required for encrypted files. Use -p or --password to specify.');
-    }
-    options.password = await promptPassword();
-    result = native.decode(inputFile, options.password || undefined, undefined);
-  }
-
-  const engineVersion = result.formatVersion || 'v5';
-  spinner.succeed && spinner.succeed(`${label} file read (${engineVersion} log-embed format)`);
-
-  if (!quiet) {
-    console.log(chalk.cyan(`  Original file: ${result.originalFilename}`));
-    console.log(chalk.cyan(`  Original size: ${formatBytes(result.originalSize)}`));
-    console.log(chalk.cyan(`  Encrypted: ${result.encrypted ? 'Yes' : 'No'}`));
-    console.log(chalk.cyan(`  Compressed: ${result.compressed ? 'Yes (brotli)' : 'No'}`));
-  }
-
-  const outputPath = resolveNativeOutputPath(options, result.safeFilename);
-  const outputDir = path.dirname(outputPath);
-  if (!fs.existsSync(outputDir)) {
-    fs.mkdirSync(outputDir, { recursive: true });
-  }
-
-  if (fs.existsSync(outputPath) && !options.force) {
-    if (quiet || options.yes) {
-      throw new Error(`File already exists: ${outputPath}. Use --force to overwrite.`);
-    }
-    const shouldOverwrite = await promptOverwrite(outputPath);
-    if (!shouldOverwrite) {
-      console.log(chalk.yellow('Operation cancelled.'));
-      process.exit(0);
-    }
-  }
-
-  fs.writeFileSync(outputPath, result.bytes);
-  spinner.succeed && spinner.succeed('Decoding complete!');
-
-  if (!quiet) {
-    console.log();
-    console.log(chalk.green.bold('✓ File decoded successfully!'));
-    console.log(chalk.cyan(`  Original: ${result.originalFilename}`));
-    console.log(chalk.cyan(`  Output: ${outputPath}`));
-    console.log(chalk.cyan(`  Size: ${formatBytes(result.bytes.length)}`));
-    if (result.partCount > 1) {
-      console.log(chalk.cyan(`  Parts merged: ${result.partCount}`));
-    }
-  }
-  return true;
-}
-
-// ─── v4 Streaming Decode ────────────────────────────────────────────────────
-
-async function decodeStreaming(inputFile, format, metadata, encryptedContent, encryptionMeta, isEncrypted, isCompressed, options, outputPath, spinner, quiet) {
-  const outputDir = path.dirname(outputPath);
-  if (!fs.existsSync(outputDir)) {
-    fs.mkdirSync(outputDir, { recursive: true });
-  }
-
-  const hashStream = new HashPassthrough();
-  const outputStream = fs.createWriteStream(outputPath);
-
-  let decompressStream = null;
-  if (isCompressed) {
-    decompressStream = createDecompressStream();
-    decompressStream.pipe(hashStream).pipe(outputStream);
-  } else {
-    hashStream.pipe(outputStream);
-  }
-
-  const writeTarget = isCompressed ? decompressStream : hashStream;
-
-  const hasMultipleParts = isMultiPart(metadata) || metadata.partNumber !== null;
-  let totalPartsFound = 1;
-
-  if (hasMultipleParts) {
-    const inputDir = path.dirname(inputFile);
-    const allParts = findMultiPartFiles(inputDir, metadata.hash, format);
-    totalPartsFound = allParts.length;
-
-    if (metadata.totalParts !== null && totalPartsFound !== metadata.totalParts) {
-      throw new Error(
-        `Missing parts! Found ${totalPartsFound} of ${metadata.totalParts} parts. ` +
-        `Make sure all parts are in the same directory.`
-      );
-    }
-
-    spinner.text = `Multi-part file detected (${totalPartsFound} parts)`;
-    spinner.succeed && spinner.succeed(`Found all ${totalPartsFound} parts`);
-
-    for (let i = 0; i < allParts.length; i++) {
-      const partSpinner = quiet ? spinner : ora(`Decoding part ${i + 1} of ${totalPartsFound}...`).start();
-
-      const partResult = await readFile(allParts[i].path, format);
-      const { encryptedContent: partContent, encryptionMeta: partEncMeta } = extractContent(partResult, format);
-
-      const binaryData = Buffer.from(partContent, 'base64');
-
-      if (isEncrypted) {
-        const { iv, salt, authTag } = unpackEncryptionMeta(partEncMeta);
-        const decipher = createDecryptStream(options.password, iv, salt, authTag);
-        try {
-          const decrypted = Buffer.concat([decipher.update(binaryData), decipher.final()]);
-          writeTarget.write(decrypted);
-        } catch (error) {
-          throw new Error('Decryption failed: Invalid password or corrupted data');
-        }
-      } else {
-        writeTarget.write(binaryData);
-      }
-
-      partSpinner.succeed && partSpinner.succeed(`Part ${i + 1} decoded`);
-    }
-  } else {
-    spinner.text = 'Decoding...';
-    const binaryData = Buffer.from(encryptedContent, 'base64');
-
-    if (isEncrypted) {
-      const { iv, salt, authTag } = unpackEncryptionMeta(encryptionMeta);
-      const decipher = createDecryptStream(options.password, iv, salt, authTag);
-      try {
-        const decrypted = Buffer.concat([decipher.update(binaryData), decipher.final()]);
-        writeTarget.write(decrypted);
-      } catch (error) {
-        throw new Error('Decryption failed: Invalid password or corrupted data');
-      }
-    } else {
-      writeTarget.write(binaryData);
-    }
-  }
-
-  writeTarget.end();
-  await finished(outputStream);
-
-  if (metadata.contentHash) {
-    spinner.text = 'Verifying integrity...';
-    const actualHash = hashStream.digest;
-    if (actualHash !== metadata.contentHash) {
-      try { fs.unlinkSync(outputPath); } catch { /* ignore */ }
-      throw new Error('Integrity check failed! The file may be corrupted or tampered with.');
-    }
-    spinner.succeed && spinner.succeed('Integrity verified (SHA-256 match)');
-  }
-
-  spinner.succeed && spinner.succeed('Decoding complete!');
-
-  if (!quiet) {
-    const outputSize = fs.statSync(outputPath).size;
-    console.log();
-    console.log(chalk.green.bold('✓ File decoded successfully!'));
-    console.log(chalk.cyan(`  Original: ${metadata.originalFilename}`));
-    console.log(chalk.cyan(`  Output: ${outputPath}`));
-    console.log(chalk.cyan(`  Size: ${formatBytes(outputSize)}`));
-    if (hasMultipleParts) {
-      console.log(chalk.cyan(`  Parts merged: ${totalPartsFound}`));
-    }
-  }
-}
-
-// ─── v3 Legacy Decode ───────────────────────────────────────────────────────
-
-async function decodeLegacy(inputFile, format, metadata, encryptedContent, encryptionMeta, isEncrypted, isCompressed, options, outputPath, spinner, quiet) {
-  let finalBase64;
-
-  if (isMultiPart(metadata)) {
-    spinner.start && (spinner.text = `Multi-part file detected (${metadata.totalParts} parts)`);
-
-    const inputDir = path.dirname(inputFile);
-    const allParts = findMultiPartFiles(inputDir, metadata.hash, format, metadata.totalParts);
-
-    if (allParts.length !== metadata.totalParts) {
-      throw new Error(
-        `Missing parts! Found ${allParts.length} of ${metadata.totalParts} parts. ` +
-        `Make sure all parts are in the same directory.`
-      );
-    }
-
-    spinner.succeed && spinner.succeed(`Found all ${metadata.totalParts} parts`);
-
-    const chunks = [];
-    for (let i = 0; i < allParts.length; i++) {
-      const partSpinner = quiet ? spinner : ora(`Reading part ${i + 1} of ${metadata.totalParts}...`).start();
-      const partResult = await readFile(allParts[i].path, format);
-      const { encryptedContent: partContent } = extractContent(partResult, format);
-      chunks.push(partContent);
-      partSpinner.succeed && partSpinner.succeed(`Part ${i + 1} read`);
-    }
-
-    spinner.text = 'Merging parts...';
-    const mergedContent = mergeBase64Chunks(chunks);
-    spinner.succeed && spinner.succeed('Parts merged successfully');
-
-    if (isEncrypted) {
-      spinner.text = 'Decrypting content...';
-      const { iv, salt, authTag } = unpackEncryptionMeta(encryptionMeta);
-      finalBase64 = decrypt(mergedContent, options.password, iv, salt, authTag);
-      spinner.succeed && spinner.succeed('Content decrypted');
-    } else {
-      finalBase64 = mergedContent;
-    }
-  } else {
-    if (isEncrypted) {
-      spinner.text = 'Decrypting content...';
-      const { iv, salt, authTag } = unpackEncryptionMeta(encryptionMeta);
-      finalBase64 = decrypt(encryptedContent, options.password, iv, salt, authTag);
-      spinner.succeed && spinner.succeed('Content decrypted');
-    } else {
-      finalBase64 = encryptedContent;
-    }
-  }
-
-  let fileBuffer;
-  if (isCompressed) {
-    spinner.text = 'Decompressing...';
-    const compressedBuffer = Buffer.from(finalBase64, 'base64');
-    fileBuffer = await decompress(compressedBuffer);
-    spinner.succeed && spinner.succeed(`Decompressed: ${formatBytes(compressedBuffer.length)} → ${formatBytes(fileBuffer.length)}`);
-  } else {
-    fileBuffer = Buffer.from(finalBase64, 'base64');
-  }
-
-  if (metadata.contentHash) {
-    spinner.text = 'Verifying integrity...';
-    const actualHash = generateContentHash(fileBuffer);
-    if (actualHash !== metadata.contentHash) {
-      throw new Error('Integrity check failed! The file may be corrupted or tampered with.');
-    }
-    spinner.succeed && spinner.succeed('Integrity verified (SHA-256 match)');
-  }
-
-  spinner.text = 'Writing output file...';
-  const outputDir = path.dirname(outputPath);
-  if (!fs.existsSync(outputDir)) {
-    fs.mkdirSync(outputDir, { recursive: true });
-  }
-
-  fs.writeFileSync(outputPath, fileBuffer);
-
-  spinner.succeed && spinner.succeed('Decoding complete!');
-
-  if (!quiet) {
-    console.log();
-    console.log(chalk.green.bold('✓ File decoded successfully!'));
-    console.log(chalk.cyan(`  Original: ${metadata.originalFilename}`));
-    console.log(chalk.cyan(`  Output: ${outputPath}`));
-    console.log(chalk.cyan(`  Size: ${formatBytes(fileBuffer.length)}`));
-    if (isMultiPart(metadata)) {
-      console.log(chalk.cyan(`  Parts merged: ${metadata.totalParts}`));
-    }
-  }
-}
-
 module.exports = decodeCommand;