bytifi 0.1.0

package/README.md

@@ -0,0 +1,64 @@
+# Bytifi CLI
+
+Official command-line tool for encrypting and uploading files to [Bytifi](https://bytifi.com).
+
+## Install
+
+```bash
+npm install -g bytifi
+```
+
+Requires **Node.js 18+**.
+
+Or install from source:
+
+```bash
+git clone https://github.com/jpwcguy/Bytifi.git
+cd Bytifi
+npm link
+```
+
+## Setup
+
+```bash
+export BYTIFI_API_KEY=usk_your_api_key_here
+```
+
+Create an API key in **Account → API** on bytifi.com.
+
+## Usage
+
+```bash
+bytifi upload ./photo.png
+bytifi upload ./photo.png --expires 60 --json
+bytifi upload ./large.iso -q
+```
+
+### Options
+
+| Flag | Description |
+|------|-------------|
+| `-k, --api-key` | API key (default: `BYTIFI_API_KEY`) |
+| `-e, --expires` | Link lifetime in minutes: `5`, `15`, `30`, `60`, `120` |
+| `--delete-on-download` | Delete after first download |
+| `--json` | Machine-readable JSON output |
+| `-q, --quiet` | Print only the share URL |
+| `--mime-type` | Override MIME type detection |
+
+## How it works
+
+1. Encrypts the file locally with AES-GCM (same format as the website)
+2. Uploads encrypted bytes via the public API
+3. Prints a share URL including `#token=...`
+
+The server never receives plaintext or the decryption token.
+
+## Development
+
+```bash
+node bin/bytifi.js upload ./file.png --json
+```
+
+## Status
+
+WIP — v0.1.0 direct + multipart upload supported.

package/bin/bytifi.js

@@ -0,0 +1,189 @@
+#!/usr/bin/env node
+
+import fs from 'node:fs/promises'
+import path from 'node:path'
+import process from 'node:process'
+import { fileURLToPath } from 'node:url'
+import { BytifiApiError, BytifiNetworkError, uploadFile } from '../lib/upload.js'
+
+const __filename = fileURLToPath(import.meta.url)
+
+function printHelp() {
+  process.stdout.write(`Bytifi CLI — encrypt and upload files
+
+Usage:
+  bytifi upload <file> [options]
+
+Options:
+  -k, --api-key <key>     API key (default: BYTIFI_API_KEY env var)
+  -e, --expires <minutes> Link lifetime: 5|15|30|60|120 (default: 30)
+      --delete-on-download  Remove file after first download
+      --json                Print machine-readable JSON to stdout
+  -q, --quiet               Print only the share URL
+      --mime-type <type>    Override detected MIME type
+      --base-url <url>      API base URL (default: https://bytifi.com)
+  -h, --help                Show this help
+
+Examples:
+  bytifi upload ./photo.png
+  BYTIFI_API_KEY=usk_... bytifi upload report.pdf --expires 60 --json
+`)
+}
+
+function parseArgs(argv) {
+  const positional = []
+  const options = {
+    apiKey: process.env.BYTIFI_API_KEY || '',
+    expiresInMinutes: 30,
+    deleteOnDownload: false,
+    json: false,
+    quiet: false,
+    mimeType: '',
+    baseUrl: 'https://bytifi.com',
+    help: false,
+  }
+
+  for (let index = 0; index < argv.length; index += 1) {
+    const arg = argv[index]
+
+    if (arg === '--help' || arg === '-h') {
+      options.help = true
+      continue
+    }
+
+    if (arg === '--json') {
+      options.json = true
+      continue
+    }
+
+    if (arg === '--quiet' || arg === '-q') {
+      options.quiet = true
+      continue
+    }
+
+    if (arg === '--delete-on-download') {
+      options.deleteOnDownload = true
+      continue
+    }
+
+    if (arg === '--api-key' || arg === '-k') {
+      options.apiKey = argv[index + 1] || ''
+      index += 1
+      continue
+    }
+
+    if (arg === '--expires' || arg === '-e') {
+      options.expiresInMinutes = Number(argv[index + 1])
+      index += 1
+      continue
+    }
+
+    if (arg === '--mime-type') {
+      options.mimeType = argv[index + 1] || ''
+      index += 1
+      continue
+    }
+
+    if (arg === '--base-url') {
+      options.baseUrl = argv[index + 1] || options.baseUrl
+      index += 1
+      continue
+    }
+
+    if (arg.startsWith('-')) {
+      throw new Error(`Unknown option: ${arg}`)
+    }
+
+    positional.push(arg)
+  }
+
+  return { positional, options }
+}
+
+function validateExpires(minutes) {
+  const allowed = new Set([5, 15, 30, 60, 120])
+  if (!allowed.has(minutes)) {
+    throw new Error('expires must be one of: 5, 15, 30, 60, 120')
+  }
+}
+
+async function runUpload(filePath, options) {
+  validateExpires(options.expiresInMinutes)
+
+  if (!options.apiKey) {
+    throw new Error('Missing API key. Pass --api-key or set BYTIFI_API_KEY.')
+  }
+
+  const resolvedPath = path.resolve(filePath)
+  await fs.access(resolvedPath)
+
+  const result = await uploadFile(resolvedPath, {
+    apiKey: options.apiKey,
+    baseUrl: options.baseUrl,
+    expiresInMinutes: options.expiresInMinutes,
+    deleteOnDownload: options.deleteOnDownload,
+    mimeType: options.mimeType || undefined,
+    onProgress: options.quiet || options.json
+      ? undefined
+      : (percent) => {
+          process.stderr.write(`Uploading encrypted parts: ${percent}%\n`)
+        },
+  })
+
+  if (options.json) {
+    process.stdout.write(`${JSON.stringify(result, null, 2)}\n`)
+    return
+  }
+
+  if (options.quiet) {
+    process.stdout.write(`${result.shareUrl}\n`)
+    return
+  }
+
+  process.stdout.write(`Share URL:\n${result.shareUrl}\n`)
+  process.stdout.write(`Download URL:\n${result.downloadUrl}\n`)
+  process.stdout.write(`Expires: ${result.expiresAt}\n`)
+}
+
+function exitCodeForError(error) {
+  if (error instanceof BytifiNetworkError) return 3
+  if (error instanceof BytifiApiError) return 2
+  return 1
+}
+
+async function main() {
+  const [command, ...rest] = process.argv.slice(2)
+
+  if (!command || command === '--help' || command === '-h') {
+    printHelp()
+    process.exit(0)
+  }
+
+  if (command !== 'upload') {
+    if (command === 'help') {
+      printHelp()
+      process.exit(0)
+    }
+
+    throw new Error(`Unknown command: ${command}`)
+  }
+
+  const { positional, options } = parseArgs(rest)
+
+  if (options.help) {
+    printHelp()
+    process.exit(0)
+  }
+
+  const filePath = positional[0]
+  if (!filePath) {
+    throw new Error('Missing file path. Usage: bytifi upload <file>')
+  }
+
+  await runUpload(filePath, options)
+}
+
+main().catch((error) => {
+  process.stderr.write(`${error.message || 'Upload failed.'}\n`)
+  process.exit(exitCodeForError(error))
+})

package/lib/base64url.js

@@ -0,0 +1,14 @@
+export function toBase64Url(bytes) {
+  const buffer = Buffer.isBuffer(bytes) ? bytes : Buffer.from(bytes)
+  return buffer
+    .toString('base64')
+    .replace(/\+/g, '-')
+    .replace(/\//g, '_')
+    .replace(/=+$/g, '')
+}
+
+export function fromBase64Url(value) {
+  const normalized = String(value || '').replace(/-/g, '+').replace(/_/g, '/')
+  const padded = normalized.padEnd(normalized.length + ((4 - (normalized.length % 4)) % 4), '=')
+  return Buffer.from(padded, 'base64')
+}

package/lib/crypto.js

@@ -0,0 +1,148 @@
+import crypto from 'node:crypto'
+import fs from 'node:fs/promises'
+import path from 'node:path'
+import { fromBase64Url, toBase64Url } from './base64url.js'
+
+export const ENCRYPTED_PART_SIZE = 32 * 1024 * 1024
+export const PLAIN_CHUNK_SIZE = ENCRYPTED_PART_SIZE - 16
+export const DIRECT_UPLOAD_LIMIT_BYTES = 100 * 1024 * 1024
+
+export function buildChunkIv(noncePrefix, chunkIndex) {
+  const iv = Buffer.alloc(12)
+  noncePrefix.copy(iv, 0, 0, 8)
+  iv.writeUInt32BE(chunkIndex, 8)
+  return iv
+}
+
+export function encryptChunk(plainChunk, key, noncePrefix, chunkIndex) {
+  const iv = buildChunkIv(noncePrefix, chunkIndex)
+  const cipher = crypto.createCipheriv('aes-256-gcm', key, iv)
+  const encrypted = Buffer.concat([cipher.update(plainChunk), cipher.final()])
+  const tag = cipher.getAuthTag()
+  return Buffer.concat([encrypted, tag])
+}
+
+export function createEncryptionToken(tokenBytes = crypto.randomBytes(32)) {
+  if (tokenBytes.length !== 32) {
+    throw new Error('Encryption token must be 32 bytes.')
+  }
+
+  return {
+    tokenBytes,
+    token: toBase64Url(tokenBytes),
+  }
+}
+
+export function buildClientEncryptionMeta({
+  plainChunkSize,
+  chunkCount,
+  noncePrefix,
+  originalSize,
+  mimeType,
+}) {
+  return {
+    version: 1,
+    algorithm: 'AES-GCM',
+    chunkSize: plainChunkSize,
+    chunkCount,
+    noncePrefix: toBase64Url(noncePrefix),
+    originalSize,
+    mimeType: mimeType || 'application/octet-stream',
+  }
+}
+
+export async function encryptFileBuffer(fileBuffer, {
+  originalName = 'upload',
+  mimeType = 'application/octet-stream',
+  tokenBytes = crypto.randomBytes(32),
+  noncePrefix = crypto.randomBytes(8),
+  plainChunkSize = PLAIN_CHUNK_SIZE,
+} = {}) {
+  if (tokenBytes.length !== 32) throw new Error('Encryption token must be 32 bytes.')
+  if (noncePrefix.length !== 8) throw new Error('Nonce prefix must be 8 bytes.')
+
+  const key = tokenBytes
+  const chunkCount = Math.ceil(fileBuffer.length / plainChunkSize) || 1
+  const encryptedParts = []
+  let encryptedSize = 0
+
+  for (let chunkIndex = 0; chunkIndex < chunkCount; chunkIndex += 1) {
+    const start = chunkIndex * plainChunkSize
+    const end = Math.min(fileBuffer.length, start + plainChunkSize)
+    const plainChunk = fileBuffer.subarray(start, end)
+    const encryptedChunk = encryptChunk(plainChunk, key, noncePrefix, chunkIndex)
+    encryptedParts.push(encryptedChunk)
+    encryptedSize += encryptedChunk.length
+  }
+
+  const meta = buildClientEncryptionMeta({
+    plainChunkSize,
+    chunkCount,
+    noncePrefix,
+    originalSize: fileBuffer.length,
+    mimeType,
+  })
+
+  return {
+    token: toBase64Url(tokenBytes),
+    tokenBytes,
+    meta,
+    encryptedParts,
+    encryptedBuffer: Buffer.concat(encryptedParts),
+    encryptedSize,
+    originalName,
+    mimeType,
+    originalSize: fileBuffer.length,
+  }
+}
+
+export async function encryptFile(filePath, options = {}) {
+  const absolutePath = path.resolve(filePath)
+  const fileBuffer = await fs.readFile(absolutePath)
+  const originalName = options.originalName || path.basename(absolutePath)
+  const mimeType = options.mimeType || guessMimeType(originalName)
+
+  return encryptFileBuffer(fileBuffer, {
+    ...options,
+    originalName,
+    mimeType,
+  })
+}
+
+export function decryptChunk(encryptedChunk, tokenBytes, noncePrefix, chunkIndex) {
+  if (encryptedChunk.length < 16) {
+    throw new Error('Encrypted chunk is too small.')
+  }
+
+  const iv = buildChunkIv(noncePrefix, chunkIndex)
+  const ciphertext = encryptedChunk.subarray(0, encryptedChunk.length - 16)
+  const tag = encryptedChunk.subarray(encryptedChunk.length - 16)
+  const decipher = crypto.createDecipheriv('aes-256-gcm', tokenBytes, iv)
+  decipher.setAuthTag(tag)
+  return Buffer.concat([decipher.update(ciphertext), decipher.final()])
+}
+
+export function importToken(token) {
+  const tokenBytes = fromBase64Url(token)
+  if (tokenBytes.length !== 32) {
+    throw new Error('Invalid encryption token length.')
+  }
+  return tokenBytes
+}
+
+function guessMimeType(filename) {
+  const ext = path.extname(filename).toLowerCase()
+  const map = {
+    '.png': 'image/png',
+    '.jpg': 'image/jpeg',
+    '.jpeg': 'image/jpeg',
+    '.gif': 'image/gif',
+    '.webp': 'image/webp',
+    '.pdf': 'application/pdf',
+    '.zip': 'application/zip',
+    '.txt': 'text/plain',
+    '.json': 'application/json',
+    '.iso': 'application/octet-stream',
+  }
+  return map[ext] || 'application/octet-stream'
+}

package/lib/upload.js

@@ -0,0 +1,242 @@
+import { DIRECT_UPLOAD_LIMIT_BYTES } from './crypto.js'
+
+const DEFAULT_BASE_URL = 'https://bytifi.com'
+
+export class BytifiApiError extends Error {
+  constructor(message, { status = 0, body = null } = {}) {
+    super(message)
+    this.name = 'BytifiApiError'
+    this.status = status
+    this.body = body
+  }
+}
+
+export class BytifiNetworkError extends Error {
+  constructor(message, { cause } = {}) {
+    super(message)
+    this.name = 'BytifiNetworkError'
+    this.cause = cause
+  }
+}
+
+function normalizeBaseUrl(baseUrl) {
+  return String(baseUrl || DEFAULT_BASE_URL).replace(/\/+$/, '')
+}
+
+async function readResponseBody(response) {
+  const text = await response.text()
+  if (!text) return null
+
+  try {
+    return JSON.parse(text)
+  } catch {
+    return text
+  }
+}
+
+async function apiFetch(baseUrl, path, { apiKey, method = 'GET', headers = {}, body = null } = {}) {
+  const url = `${normalizeBaseUrl(baseUrl)}${path}`
+  const requestHeaders = {
+    Authorization: `Bearer ${apiKey}`,
+    ...headers,
+  }
+
+  let response
+
+  try {
+    response = await fetch(url, {
+      method,
+      headers: requestHeaders,
+      body,
+    })
+  } catch (error) {
+    throw new BytifiNetworkError(error.message || 'Network request failed.', { cause: error })
+  }
+
+  const payload = await readResponseBody(response)
+
+  if (!response.ok) {
+    const message = typeof payload === 'object' && payload?.error
+      ? payload.error
+      : typeof payload === 'string' && payload
+        ? payload
+        : `Request failed with status ${response.status}.`
+    throw new BytifiApiError(message, { status: response.status, body: payload })
+  }
+
+  return payload
+}
+
+function buildShareUrl(payload, encryptionToken) {
+  return `${payload.url}#token=${encodeURIComponent(encryptionToken)}`
+}
+
+function buildResult(payload, encryption, shareUrl) {
+  return {
+    shareUrl,
+    url: payload.url,
+    downloadUrl: payload.downloadUrl,
+    token: payload.token,
+    encryptionToken: encryption.token,
+    originalName: payload.originalName || encryption.originalName,
+    size: payload.size,
+    expiresAt: payload.expiresAt,
+    deleteOnDownload: payload.deleteOnDownload,
+    clientEncrypted: payload.clientEncrypted,
+  }
+}
+
+async function uploadDirect(encryption, {
+  apiKey,
+  baseUrl,
+  expiresInMinutes,
+  deleteOnDownload,
+}) {
+  const formData = new FormData()
+  const blob = new Blob([encryption.encryptedBuffer], { type: 'application/octet-stream' })
+
+  formData.append('file', blob, encryption.originalName)
+  formData.append('clientEncrypted', 'true')
+  formData.append('clientEncryptionMeta', JSON.stringify(encryption.meta))
+  formData.append('deleteOnDownload', deleteOnDownload ? 'true' : 'false')
+  formData.append('expiresInMinutes', String(expiresInMinutes))
+
+  const payload = await apiFetch(baseUrl, '/api/public/upload', {
+    apiKey,
+    method: 'POST',
+    body: formData,
+  })
+
+  const shareUrl = buildShareUrl(payload, encryption.token)
+  return buildResult(payload, encryption, shareUrl)
+}
+
+async function pollUploadStatus(sessionToken, { apiKey, baseUrl, signal }) {
+  while (true) {
+    if (signal?.aborted) {
+      throw new Error('Upload aborted.')
+    }
+
+    const payload = await apiFetch(
+      baseUrl,
+      `/api/public/upload/status?sessionToken=${encodeURIComponent(sessionToken)}`,
+      { apiKey },
+    )
+
+    if (payload.status !== 'processing') {
+      return payload
+    }
+
+    await new Promise((resolve) => setTimeout(resolve, 1500))
+  }
+}
+
+async function uploadMultipart(encryption, {
+  apiKey,
+  baseUrl,
+  expiresInMinutes,
+  deleteOnDownload,
+  onProgress,
+  signal,
+  concurrency = 3,
+}) {
+  const partSize = encryption.meta.chunkSize + 16
+  const initPayload = await apiFetch(baseUrl, '/api/public/upload/init', {
+    apiKey,
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({
+      originalName: encryption.originalName,
+      mimeType: encryption.mimeType,
+      size: encryption.encryptedSize,
+      originalSize: encryption.originalSize,
+      clientEncrypted: true,
+      clientEncryptionMeta: encryption.meta,
+      partSize,
+      expiresInMinutes,
+      deleteOnDownload,
+    }),
+  })
+
+  const sessionToken = initPayload.sessionToken
+  const totalParts = encryption.encryptedParts.length
+  let completedParts = 0
+
+  const uploadPart = async (partNumber) => {
+    const partBuffer = encryption.encryptedParts[partNumber - 1]
+    await apiFetch(
+      baseUrl,
+      `/api/public/upload/part?sessionToken=${encodeURIComponent(sessionToken)}&partNumber=${partNumber}`,
+      {
+        apiKey,
+        method: 'PUT',
+        headers: { 'Content-Type': 'application/octet-stream' },
+        body: partBuffer,
+      },
+    )
+
+    completedParts += 1
+    onProgress?.(Math.round((completedParts / totalParts) * 100))
+  }
+
+  const queue = Array.from({ length: totalParts }, (_, index) => index + 1)
+  const workers = Array.from({ length: Math.min(concurrency, totalParts) }, async () => {
+    while (queue.length > 0) {
+      if (signal?.aborted) {
+        throw new Error('Upload aborted.')
+      }
+
+      const partNumber = queue.shift()
+      if (!partNumber) return
+      await uploadPart(partNumber)
+    }
+  })
+
+  try {
+    await Promise.all(workers)
+  } catch (error) {
+    await apiFetch(baseUrl, '/api/public/upload/abort', {
+      apiKey,
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ sessionToken }),
+    }).catch(() => {})
+
+    throw error
+  }
+
+  let completePayload = await apiFetch(baseUrl, '/api/public/upload/complete', {
+    apiKey,
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({ sessionToken }),
+  })
+
+  if (completePayload.status === 'processing') {
+    completePayload = await pollUploadStatus(sessionToken, { apiKey, baseUrl, signal })
+  }
+
+  const shareUrl = buildShareUrl(completePayload, encryption.token)
+  return buildResult(completePayload, encryption, shareUrl)
+}
+
+export async function uploadEncrypted(encryption, options) {
+  if (!options?.apiKey) {
+    throw new Error('API key is required.')
+  }
+
+  if (encryption.encryptedSize <= DIRECT_UPLOAD_LIMIT_BYTES) {
+    return uploadDirect(encryption, options)
+  }
+
+  return uploadMultipart(encryption, options)
+}
+
+export async function uploadFile(filePath, options) {
+  const { encryptFile } = await import('./crypto.js')
+  const encryption = await encryptFile(filePath, {
+    mimeType: options?.mimeType,
+  })
+
+  return uploadEncrypted(encryption, options)
+}

package/package.json

@@ -0,0 +1,38 @@
+{
+  "name": "bytifi",
+  "version": "0.1.0",
+  "description": "Official Bytifi CLI — encrypt and upload files from the terminal",
+  "type": "module",
+  "bin": {
+    "bytifi": "./bin/bytifi.js"
+  },
+  "files": [
+    "bin",
+    "lib"
+  ],
+  "engines": {
+    "node": ">=18"
+  },
+  "scripts": {
+    "upload": "node bin/bytifi.js upload"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/jpwcguy/Bytifi.git"
+  },
+  "homepage": "https://bytifi.com",
+  "bugs": {
+    "url": "https://github.com/jpwcguy/Bytifi/issues"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "keywords": [
+    "bytifi",
+    "cli",
+    "encryption",
+    "upload",
+    "file-sharing"
+  ],
+  "license": "MIT"
+}