stegdoc 6.0.0 → 6.1.0

package/src/lib/metadata.js

@@ -24,15 +24,11 @@ function createMetadata({
   encrypted = true,
   compressed = false,
   contentHash = null,
-  // v5 fields
-  stegoMethod = null,
   compressionAlgo = null,
   payloadSize = null,
   dataLineCount = null,
   headerLineCount = null,
 }) {
-  const isV5 = stegoMethod === 'log-embed';
-
   const meta = {
     originalFilename,
     originalExtension,
@@ -44,20 +40,17 @@ function createMetadata({
     encrypted,
     compressed,
     contentHash,
-    pipelineOrder: isV5 ? 'brotli-encrypt-logEmbed' : 'compress-encrypt-base64',
+    pipelineOrder: 'brotli-encrypt-logEmbed',
     encodingDate: new Date().toISOString(),
-    version: isV5 ? '5.0.0' : '4.0.0',
+    version: '5.0.0',
     tool: 'stegdoc',
+    stegoMethod: 'log-embed',
+    compressionAlgo: compressionAlgo || 'brotli',
   };
 
-  // v5-specific fields
-  if (isV5) {
-    meta.stegoMethod = 'log-embed';
-    meta.compressionAlgo = compressionAlgo || 'brotli';
-    if (payloadSize !== null) meta.payloadSize = payloadSize;
-    if (dataLineCount !== null) meta.dataLineCount = dataLineCount;
-    if (headerLineCount !== null) meta.headerLineCount = headerLineCount;
-  }
+  if (payloadSize !== null) meta.payloadSize = payloadSize;
+  if (dataLineCount !== null) meta.dataLineCount = dataLineCount;
+  if (headerLineCount !== null) meta.headerLineCount = headerLineCount;
 
   return meta;
 }
@@ -71,81 +64,7 @@ function serializeMetadata(metadata) {
   return JSON.stringify(metadata);
 }
 
-/**
- * Parse metadata from string
- * @param {string} metadataStr - JSON string
- * @returns {object} Metadata object
- */
-function parseMetadata(metadataStr) {
-  try {
-    return JSON.parse(metadataStr);
-  } catch (error) {
-    throw new Error(`Failed to parse metadata: ${error.message}`);
-  }
-}
-
-/**
- * Validate metadata object
- * @param {object} metadata - Metadata to validate
- * @returns {boolean} True if valid
- * @throws {Error} If metadata is invalid
- */
-function validateMetadata(metadata) {
-  const required = ['originalFilename', 'originalExtension', 'hash', 'tool'];
-
-  for (const field of required) {
-    if (!metadata[field]) {
-      throw new Error(`Missing required metadata field: ${field}`);
-    }
-  }
-
-  if (metadata.tool !== 'stegdoc' && metadata.tool !== 'whitener') {
-    throw new Error('Invalid tool identifier in metadata');
-  }
-
-  // If it's a multi-part file, validate part info
-  if (metadata.totalParts !== null && metadata.totalParts > 1) {
-    if (metadata.partNumber === null || metadata.partNumber < 1 || metadata.partNumber > metadata.totalParts) {
-      throw new Error('Invalid part number in metadata');
-    }
-  }
-
-  return true;
-}
-
-/**
- * Check if metadata indicates a multi-part file
- * @param {object} metadata - Metadata object
- * @returns {boolean} True if multi-part
- */
-function isMultiPart(metadata) {
-  return metadata.totalParts !== null && metadata.totalParts > 1;
-}
-
-/**
- * Check if metadata indicates the v4 streaming format
- * @param {object} metadata - Metadata object
- * @returns {boolean} True if streaming format (v4+)
- */
-function isStreamingFormat(metadata) {
-  return metadata.pipelineOrder === 'compress-encrypt-base64';
-}
-
-/**
- * Check if metadata indicates the v5 log-embed format
- * @param {object} metadata - Metadata object
- * @returns {boolean} True if log-embed format (v5+)
- */
-function isLogEmbedFormat(metadata) {
-  return metadata.stegoMethod === 'log-embed' || metadata.pipelineOrder === 'brotli-encrypt-logEmbed';
-}
-
 module.exports = {
   createMetadata,
   serializeMetadata,
-  parseMetadata,
-  validateMetadata,
-  isMultiPart,
-  isStreamingFormat,
-  isLogEmbedFormat,
 };

package/src/lib/native.js

@@ -19,9 +19,9 @@ let resolved = false;
  *   3. `native/stegdoc.node`, the local `pnpm build:native` output.
  *
  * The binding is required for log-embed (v5/v6) decode and is the preferred
- * encoder. The CommonJS implementation remains only for the legacy v3/v4
- * formats, which the native engine does not cover. Set
- * `STEGDOC_DISABLE_NATIVE=1` to force the JS paths.
+ * encoder. The CommonJS v5 encoder survives only as a fallback for hosts where
+ * the binding cannot be loaded. Set `STEGDOC_DISABLE_NATIVE=1` to force that
+ * fallback; it does not affect decode, which has no JS path.
  *
  * @returns {object|null} The binding, or null when unavailable.
  */

package/src/lib/streams.js

@@ -1,35 +1,4 @@
 const { Transform, Writable } = require('stream');
-const crypto = require('crypto');
-
-/**
- * Transform stream that passes data through unchanged while computing SHA-256 hash.
- * Access the hex hash via .digest after the stream has ended.
- */
-class HashPassthrough extends Transform {
-  constructor() {
-    super();
-    this._hash = crypto.createHash('sha256');
-    this._finalized = false;
-  }
-
-  _transform(chunk, encoding, callback) {
-    this._hash.update(chunk);
-    this.push(chunk);
-    callback();
-  }
-
-  _flush(callback) {
-    this._finalized = true;
-    callback();
-  }
-
-  get digest() {
-    if (!this._finalized) {
-      throw new Error('Cannot read digest before stream has ended');
-    }
-    return this._hash.digest('hex');
-  }
-}
 
 /**
  * Writable stream that collects binary Buffer output up to maxBytes.
@@ -117,7 +86,6 @@ class ProgressTransform extends Transform {
 }
 
 module.exports = {
-  HashPassthrough,
   BinaryChunkCollector,
   ProgressTransform,
 };

package/src/lib/utils.js

@@ -9,15 +9,6 @@ function generateHash(length = 8) {
   return crypto.randomBytes(length).toString('hex');
 }
 
-/**
- * Generate SHA-256 hash of a buffer for integrity verification
- * @param {Buffer} buffer - Data to hash
- * @returns {string} Hexadecimal SHA-256 hash
- */
-function generateContentHash(buffer) {
-  return crypto.createHash('sha256').update(buffer).digest('hex');
-}
-
 /**
  * Parse size string to bytes
  * @param {string} sizeStr - Size string (e.g., "5MB", "100KB", "1GB")
@@ -113,13 +104,6 @@ function generateFilename(hash, partNumber = null, totalParts = null, format = '
   }
 }
 
-/**
- * Legacy alias for backward compatibility
- */
-function generateDocxFilename(hash, partNumber = null, totalParts = null) {
-  return generateFilename(hash, partNumber, totalParts, 'docx').replace(/\.docx$/, '');
-}
-
 /**
  * Parse filename to extract hash, part information, and format
  * @param {string} filename - Filename to parse
@@ -195,13 +179,6 @@ function parseFilename(filename) {
   return null;
 }
 
-/**
- * Legacy alias for backward compatibility
- */
-function parseDocxFilename(filename) {
-  return parseFilename(filename);
-}
-
 /**
  * Detect file format from extension
  * @param {string} filename - Filename to check
@@ -213,35 +190,11 @@ function detectFormat(filename) {
   return null;
 }
 
-/**
- * Reduce a metadata-supplied name to a bare, safe filename.
- *
- * `originalFilename` is unauthenticated, so it is never joined onto a directory
- * unchecked (FORMAT.md 11.1). Any directory component is discarded and the
- * remainder must not be empty, `.`, `..`, or contain NUL.
- *
- * @param {string} name - Metadata-supplied filename
- * @returns {string} A bare filename safe to join onto a directory
- * @throws {Error} If the name has no usable filename component
- */
-function safeFilename(name) {
-  const last = String(name == null ? '' : name).split(/[/\\]/).pop();
-  if (!last || last === '.' || last === '..' || last.includes('\0')) {
-    throw new Error(`Unsafe output filename in metadata: ${JSON.stringify(name)}`);
-  }
-  return last;
-}
-
 module.exports = {
   generateHash,
-  generateContentHash,
   parseSizeToBytes,
   formatBytes,
   generateFilename,
   parseFilename,
   detectFormat,
-  safeFilename,
-  // Legacy aliases for backward compatibility
-  generateDocxFilename,
-  parseDocxFilename,
 };

package/src/lib/xlsx-handler.js

@@ -1,8 +1,4 @@
-const fs = require('fs');
-const path = require('path');
-const AdmZip = require('adm-zip');
-const { generateLogHeaders, encodePayloadToLogLines, decodeLogLines, resetTimeState } = require('./log-generator');
-const { parseXmlFromZip, ensureArray, extractTextContent } = require('./xml-utils');
+const { generateLogHeaders, encodePayloadToLogLines } = require('./log-generator');
 const { createXlsxRaw } = require('./xlsx-writer');
 
 const V5_SHEET_NAME = 'Access Logs';
@@ -45,273 +41,6 @@ async function createXlsxPartV5(options) {
   return outputPath;
 }
 
-/**
- * Read a v5 log-embed XLSX file and extract payload.
- * Uses fast regex-based XML scanning instead of full DOM parsing for speed.
- * @param {string} xlsxPath - Path to XLSX file
- * @returns {object} { payloadBuffer, metadataJson, encryptionMeta, metadata }
- */
-async function readXlsxV5(xlsxPath) {
-  if (!fs.existsSync(xlsxPath)) {
-    throw new Error(`XLSX file not found: ${xlsxPath}`);
-  }
-
-  // Read file once and reuse the zip instance
-  const fileBuffer = fs.readFileSync(xlsxPath);
-  const zip = new AdmZip(fileBuffer);
-
-  // Parse shared strings — handles both normal and namespace-prefixed XML (ns0:si, ns0:t)
-  let sharedStrings = null;
-  const ssEntry = zip.getEntry('xl/sharedStrings.xml');
-  if (ssEntry) {
-    sharedStrings = [];
-    const ssXml = ssEntry.getData().toString('utf8');
-    // Match <si><t>...</t></si> or <ns0:si><ns0:t>...</ns0:t></ns0:si> (any nsN prefix)
-    const siRegex = /<(?:\w+:)?si><(?:\w+:)?t[^>]*>([^<]*)<\/(?:\w+:)?t><\/(?:\w+:)?si>/g;
-    let match;
-    while ((match = siRegex.exec(ssXml)) !== null) {
-      sharedStrings.push(decodeXmlEntities(match[1]));
-    }
-  }
-
-  // Extract sheet1.xml raw string
-  const sheetEntry = zip.getEntry('xl/worksheets/sheet1.xml');
-  if (!sheetEntry) {
-    throw new Error('Sheet not found in XLSX file.');
-  }
-  const sheetXml = sheetEntry.getData().toString('utf8');
-
-  // Fast row extraction using regex — handles both normal and namespace-prefixed XML
-  const allRows = [];
-  const rowRegex = /<(?:\w+:)?row [^>]*>(.*?)<\/(?:\w+:)?row>/gs;
-  const cellRegex = /<(?:\w+:)?c r="([A-Z]+)\d+"(?: t="([^"]*)")?[^>]*>(?:<(?:\w+:)?v>([^<]*)<\/(?:\w+:)?v>|<(?:\w+:)?is><(?:\w+:)?t[^>]*>([^<]*)<\/(?:\w+:)?t><\/(?:\w+:)?is>)?<\/(?:\w+:)?c>/g;
-
-  let rowMatch;
-  while ((rowMatch = rowRegex.exec(sheetXml)) !== null) {
-    const rowXml = rowMatch[1];
-    const rowValues = [];
-
-    let cellMatch;
-    cellRegex.lastIndex = 0;
-    while ((cellMatch = cellRegex.exec(rowXml)) !== null) {
-      const colLetter = cellMatch[1];
-      const cellType = cellMatch[2] || '';
-      const vValue = cellMatch[3];
-      const inlineValue = cellMatch[4];
-
-      const colIdx = colLetterToIndex(colLetter);
-
-      let value;
-      if (cellType === 's' && vValue !== undefined && sharedStrings) {
-        const ssIndex = parseInt(vValue, 10);
-        value = ssIndex < sharedStrings.length ? sharedStrings[ssIndex] : '';
-      } else if (inlineValue !== undefined) {
-        value = decodeXmlEntities(inlineValue);
-      } else if (vValue !== undefined) {
-        value = decodeXmlEntities(vValue);
-      } else {
-        value = '';
-      }
-
-      rowValues[colIdx] = value;
-    }
-
-    allRows.push(rowValues);
-  }
-
-  // Skip the first row (column headers)
-  if (allRows.length < 2) {
-    throw new Error('Not enough rows in XLSX file for v5 format.');
-  }
-
-  const dataRows = allRows.slice(1); // Skip header row
-
-  // Decode log lines
-  return decodeLogLines(dataRows);
-}
-
-/**
- * Decode XML entities in a string value
- */
-function decodeXmlEntities(str) {
-  if (!str || !str.includes('&')) return str;
-  return str
-    .replace(/&amp;/g, '&')
-    .replace(/&lt;/g, '<')
-    .replace(/&gt;/g, '>')
-    .replace(/&apos;/g, "'")
-    .replace(/&quot;/g, '"');
-}
-
-/**
- * Convert column letter to 0-based index (A=0, B=1, ..., Z=25, AA=26)
- */
-function colLetterToIndex(letters) {
-  let index = 0;
-  for (let i = 0; i < letters.length; i++) {
-    index = index * 26 + (letters.charCodeAt(i) - 64);
-  }
-  return index - 1; // 0-based
-}
-
-/**
- * Detect whether an XLSX file is v5 (log-embed) or v3/v4 (hidden sheet) format.
- * @param {string} xlsxPath - Path to XLSX file
- * @returns {string} 'v5' or 'legacy'
- */
-function detectXlsxVersion(xlsxPath) {
-  const zip = new AdmZip(xlsxPath);
-
-  // v5 files have only sheet1.xml, v3/v4 have sheet2.xml (hidden data sheet)
-  const sheet2 = zip.getEntry('xl/worksheets/sheet2.xml');
-  if (sheet2) {
-    return 'legacy';
-  }
-
-  // Double-check: look at sheet name in workbook.xml
-  const wbEntry = zip.getEntry('xl/workbook.xml');
-  if (wbEntry) {
-    const wbXml = wbEntry.getData().toString('utf8');
-    if (wbXml.includes('Access Logs') || wbXml.includes('access_log')) {
-      return 'v5';
-    }
-  }
-
-  // Default: try v5 if only one sheet exists
-  return 'v5';
-}
-
-// ─── v3/v4 Legacy XLSX Creation (removed — no longer passes air gap filters)
-
-// ─── Unified Reader ─────────────────────────────────────────────────────────
-
-/**
- * Read an XLSX file and extract content. Auto-detects v5 vs v3/v4 format.
- * @param {string} xlsxPath - Path to XLSX file
- * @returns {Promise<object>} For v5: { payloadBuffer, metadataJson, encryptionMeta, metadata, formatVersion: 'v5' }
- *                            For legacy: { base64Content, encryptionMeta, metadata, formatVersion: 'legacy' }
- */
-async function readXlsxBase64(xlsxPath) {
-  if (!fs.existsSync(xlsxPath)) {
-    throw new Error(`XLSX file not found: ${xlsxPath}`);
-  }
-
-  const version = detectXlsxVersion(xlsxPath);
-
-  if (version === 'v5') {
-    const result = await readXlsxV5(xlsxPath);
-    return {
-      ...result,
-      formatVersion: 'v5',
-    };
-  }
-
-  const result = await extractFromXml(xlsxPath);
-  return {
-    ...result,
-    formatVersion: 'legacy',
-  };
-}
-
-// ─── Legacy XML Extraction ──────────────────────────────────────────────────
-
-async function extractFromXml(xlsxPath) {
-  let sharedStrings = [];
-  const ssParsed = parseXmlFromZip(xlsxPath, 'xl/sharedStrings.xml');
-
-  if (ssParsed && ssParsed.sst && ssParsed.sst.si) {
-    const siArray = ensureArray(ssParsed.sst.si);
-    sharedStrings = siArray.map((si) => extractTextContent(si.t));
-  }
-
-  const sheetParsed = parseXmlFromZip(xlsxPath, 'xl/worksheets/sheet2.xml');
-
-  if (!sheetParsed) {
-    throw new Error('Hidden sheet not found in XLSX file. This may not be a stegdoc-encoded file.');
-  }
-
-  const cellValues = new Map();
-  const sheetData = sheetParsed.worksheet?.sheetData;
-
-  if (sheetData && sheetData.row) {
-    const rows = ensureArray(sheetData.row);
-
-    for (const row of rows) {
-      if (!row.c) continue;
-      const cells = ensureArray(row.c);
-
-      for (const cell of cells) {
-        const cellRef = cell['@_r'];
-        const cellType = cell['@_t'];
-        const cellValue = cell.v;
-
-        if (cellRef === undefined) continue;
-
-        if (cellType === 's' && cellValue !== undefined) {
-          const ssIndex = parseInt(cellValue, 10);
-          if (ssIndex < sharedStrings.length) {
-            cellValues.set(cellRef, sharedStrings[ssIndex]);
-          }
-        } else if (cellType === 'inlineStr' && cell.is) {
-          const text = extractTextContent(cell.is.t);
-          if (text !== undefined) {
-            cellValues.set(cellRef, text);
-          }
-        } else if (cellValue !== undefined) {
-          cellValues.set(cellRef, String(cellValue));
-        }
-      }
-    }
-  }
-
-  const encryptionMeta = cellValues.get('A1') || '';
-  const metadata = cellValues.get('B1');
-  const chunkCountStr = cellValues.get('C1');
-
-  if (!metadata) {
-    throw new Error('No metadata found in XLSX file.');
-  }
-
-  const chunkCount = parseInt(chunkCountStr, 10);
-  if (isNaN(chunkCount) || chunkCount <= 0) {
-    throw new Error('Invalid chunk count in XLSX file.');
-  }
-
-  const chunks = [];
-  for (let i = 0; i < chunkCount; i++) {
-    const row = Math.floor(i / 26) + 2;
-    const col = (i % 26) + 1;
-    const cellRef = `${columnToLetter(col)}${row}`;
-    const chunk = cellValues.get(cellRef);
-    if (chunk) {
-      chunks.push(chunk);
-    }
-  }
-
-  return {
-    base64Content: chunks.join(''),
-    encryptionMeta,
-    metadata,
-  };
-}
-
-// ─── Helpers ────────────────────────────────────────────────────────────────
-
-function columnToLetter(col) {
-  let letter = '';
-  while (col > 0) {
-    const mod = (col - 1) % 26;
-    letter = String.fromCharCode(65 + mod) + letter;
-    col = Math.floor((col - 1) / 26);
-  }
-  return letter;
-}
-
 module.exports = {
-  // v5
   createXlsxPartV5,
-  readXlsxV5,
-  detectXlsxVersion,
-  // Unified reader (auto-detects v5 vs legacy)
-  readXlsxBase64,
 };

package/src/lib/file-utils.js

@@ -1,160 +0,0 @@
-const fs = require('fs');
-const path = require('path');
-const { parseMetadata } = require('./metadata');
-const { parseFilename } = require('./utils');
-
-/**
- * Extract content and metadata based on format
- * @param {object} readResult - Result from readFile
- * @param {string} format - File format ('xlsx' or 'docx')
- * @returns {object} { encryptedContent, encryptionMeta, metadata }
- */
-function extractContent(readResult, format) {
-  // v5 log-embed format returns metadata already parsed
-  if (readResult.formatVersion === 'v5') {
-    return {
-      encryptedContent: null, // v5 uses payloadBuffer instead
-      encryptionMeta: readResult.encryptionMeta,
-      metadata: readResult.metadata,
-      payloadBuffer: readResult.payloadBuffer,
-    };
-  }
-
-  if (format === 'xlsx') {
-    return {
-      encryptedContent: readResult.base64Content,
-      encryptionMeta: readResult.encryptionMeta,
-      metadata: parseMetadata(readResult.metadata),
-    };
-  } else {
-    // DOCX: encryption meta is embedded in content with ||| separator
-    const { base64Content, metadata } = readResult;
-
-    // Check if this is a v2+ encrypted file
-    if (base64Content.includes('|||')) {
-      const [encryptionMeta, encryptedContent] = base64Content.split('|||');
-      return {
-        encryptedContent,
-        encryptionMeta,
-        metadata,
-      };
-    }
-
-    // Legacy unencrypted DOCX
-    return {
-      encryptedContent: base64Content,
-      encryptionMeta: null,
-      metadata,
-    };
-  }
-}
-
-/**
- * Find all parts of a multi-part file in a directory
- * @param {string} dirPath - Directory to search
- * @param {string} hash - Original hash from metadata
- * @param {string} format - File format ('xlsx' or 'docx')
- * @param {number} [expectedParts] - Expected total parts (optional, for validation)
- * @returns {Array<{path: string, partNumber: number, filename: string}>} Array of parts sorted by part number
- */
-function findMultiPartFiles(dirPath, hash, format, expectedParts = null) {
-  const files = fs.readdirSync(dirPath);
-  const parts = [];
-  const ext = format === 'docx' ? '.docx' : '.xlsx';
-
-  // Also support legacy hex filenames for backward compatibility
-  const legacyBaseHash = hash.length >= 16 ? hash.slice(0, 16) : hash;
-
-  for (const file of files) {
-    if (!file.toLowerCase().endsWith(ext)) continue;
-
-    const parsed = parseFilename(file);
-    if (!parsed || parsed.partNumber === null) continue;
-
-    // Match by new realistic filename pattern
-    // Check if file matches the expected pattern (same reportId from hash)
-    if (parsed.reportId) {
-      // New realistic format - match by reportId (last 4 chars of hash)
-      // This is deterministic and doesn't depend on current date
-      const expectedReportId = hash.slice(-4).toUpperCase();
-      if (parsed.reportId === expectedReportId) {
-        parts.push({
-          path: path.join(dirPath, file),
-          partNumber: parsed.partNumber,
-          filename: file,
-          dateStr: parsed.dateStr,
-          timeStr: parsed.timeStr,
-        });
-      }
-    } else if (parsed.baseHash === legacyBaseHash) {
-      // Legacy hex format - match by base hash
-      parts.push({
-        path: path.join(dirPath, file),
-        partNumber: parsed.partNumber,
-        filename: file,
-      });
-    }
-  }
-
-  // Sort by part number
-  parts.sort((a, b) => a.partNumber - b.partNumber);
-
-  // For realistic filenames, ensure all parts have the same date/time pattern
-  // This handles edge cases where multiple file sets might share the same reportId
-  if (parts.length > 0 && parts[0].dateStr) {
-    const refDateStr = parts[0].dateStr;
-    const refTimeStr = parts[0].timeStr;
-    const filteredParts = parts.filter(
-      (p) => p.dateStr === refDateStr && p.timeStr === refTimeStr
-    );
-    // If filtering removed some parts, use the filtered set
-    if (filteredParts.length !== parts.length) {
-      parts.length = 0;
-      parts.push(...filteredParts);
-    }
-  }
-
-  // Validate sequential parts if expectedParts is provided
-  if (expectedParts !== null && parts.length === expectedParts) {
-    for (let i = 0; i < expectedParts; i++) {
-      if (parts[i].partNumber !== i + 1) {
-        throw new Error(`Missing part ${i + 1}. Parts must be sequential.`);
-      }
-    }
-  }
-
-  return parts;
-}
-
-/**
- * Check if a directory is writable
- * @param {string} dirPath - Directory path to check
- * @returns {boolean} True if writable
- */
-function isDirectoryWritable(dirPath) {
-  try {
-    if (!fs.existsSync(dirPath)) {
-      fs.mkdirSync(dirPath, { recursive: true });
-    }
-    fs.accessSync(dirPath, fs.constants.W_OK);
-    return true;
-  } catch {
-    return false;
-  }
-}
-
-/**
- * Merge base64 chunks back into a single string
- * @param {Array<string>} chunks - Array of base64 chunks
- * @returns {string} Merged base64 string
- */
-function mergeBase64Chunks(chunks) {
-  return chunks.join('');
-}
-
-module.exports = {
-  extractContent,
-  findMultiPartFiles,
-  isDirectoryWritable,
-  mergeBase64Chunks,
-};