bytifi 0.1.1 → 0.1.3

package/README.md

@@ -1,16 +1,18 @@
 # Bytifi CLI
 
-Official command-line tool for encrypting and uploading files to [Bytifi](https://bytifi.com).
+Official command-line tool for encrypting, uploading, and decrypting files with [Bytifi](https://bytifi.com).
 
 ## Install
 
+### npm (all platforms)
+
 ```bash
 npm install -g bytifi
 ```
 
 Requires **Node.js 18+**.
 
-Or install from source:
+Or from source:
 
 ```bash
 git clone https://github.com/jpwcguy/Bytifi.git
@@ -18,16 +20,37 @@ cd Bytifi
 npm link
 ```
 
-## Setup
+### Windows (WinGet)
+
+```powershell
+winget install Bytifi.Bytifi
+```
+
+Or download [bytifi.exe from GitHub Releases](https://github.com/jpwcguy/Bytifi/releases/latest).
+
+### Environment variable (all platforms)
 
 ```bash
 export BYTIFI_API_KEY=usk_your_api_key_here
 ```
 
+PowerShell:
+
+```powershell
+$env:BYTIFI_API_KEY = "usk_your_api_key_here"
+```
+
 Create an API key in **Account → API** on bytifi.com.
 
+## Setup
+
+Set your API key via environment variable (see Install above) or pass `--api-key` per command.
+Prefer the environment variable — keys on the command line can appear in shell history and process lists.
+
 ## Usage
 
+### Upload
+
 ```bash
 bytifi upload ./photo.png
 bytifi upload ./photo.png --api-key usk_your_api_key_here
@@ -35,6 +58,42 @@ bytifi upload ./photo.png --expires 60 --json
 bytifi upload ./large.iso -q
 ```
 
+### Decrypt
+
+Download and decrypt a shared file locally, or decrypt a file you already downloaded from `/f/...`. No API key required.
+
+```bash
+# From share URL (downloads + decrypts)
+bytifi decrypt 'https://bytifi.com/link?link=TOKEN#token=ENCRYPTION_TOKEN'
+bytifi decrypt TOKEN --token ENCRYPTION_TOKEN -o ./restored-file.pdf
+
+# From a downloaded encrypted file
+bytifi decrypt ./downloaded.encrypted --link TOKEN --token ENCRYPTION_TOKEN
+bytifi decrypt ./downloaded.encrypted --meta ./upload-meta.json --token ENCRYPTION_TOKEN
+bytifi decrypt ./parts/ --link TOKEN --token ENCRYPTION_TOKEN
+```
+
+Use the full share URL (with `#token=...`) when possible. For `/f/...` downloads, pass the encryption token with `--token` and either `--link` (fetches metadata from the API) or `--meta` (saved `clientEncryptionMeta` JSON from upload `--json` output).
+
+#### Offline decrypt workflow
+
+Save metadata when you upload, so you can decrypt a downloaded `/f/...` file even after the link expires:
+
+```bash
+# 1. Upload and save the JSON output
+bytifi upload ./report.pdf --json > upload.json
+
+# 2. Download the encrypted file manually (browser, curl, etc.)
+curl -L "$(jq -r .encryptedFile upload.json)" -o report.encrypted
+
+# 3. Save metadata and decrypt locally (no API call needed)
+jq -c .clientEncryptionMeta upload.json > report.meta.json
+bytifi decrypt ./report.encrypted \
+  --meta ./report.meta.json \
+  --token "$(jq -r .encryptionToken upload.json)" \
+  -o ./report.pdf
+```
+
 Without a global install:
 
 ```bash
@@ -44,7 +103,7 @@ npm exec bytifi -- upload ./photo.png --api-key usk_your_api_key_here
 
 Note: with `npm exec`, put `--` before the file path so npm does not swallow `--api-key`.
 
-### Options
+### Upload options
 
 | Flag | Description |
 |------|-------------|
@@ -53,22 +112,50 @@ Note: with `npm exec`, put `--` before the file path so npm does not swallow `--
 | `--delete-on-download` | Delete after first download |
 | `--json` | Machine-readable JSON output |
 | `-q, --quiet` | Print only the share URL |
-| `--mime-type` | Override MIME type detection |
+| `--verbose` | Print API error details to stderr |
+| `--mime-type` | Override detected MIME type |
+| `--base-url` | API base URL (default: `https://bytifi.com`) |
+
+### Decrypt options
+
+| Flag | Description |
+|------|-------------|
+| `--token` | Encryption token (required if not in URL `#token=...`) |
+| `--link` | Link token for metadata when decrypting a local encrypted file |
+| `--meta` | Saved `clientEncryptionMeta` JSON for offline local decrypt |
+| `--share-url` | Share URL to read token/metadata while decrypting a local file |
+| `-o, --output` | Output file path |
+| `--output-dir` | Output directory when saving under the original filename |
+| `--json` | Machine-readable JSON output |
+| `-q, --quiet` | Print only the output file path |
+| `--verbose` | Print error details to stderr |
+| `--base-url` | API base URL (default: `https://bytifi.com`) |
+
+Exit codes: `0` success, `1` usage error, `2` API error, `3` network error.
+
+JSON output (`--json`) for upload includes `shareUrl`, `encryptedFile`, `encryptionToken`, `clientEncryptionMeta`, `expiresAt`, and `token`.
+
+JSON output for decrypt includes `outputPath`, `originalName`, `size`, `mimeType`, `expiresAt`, `linkToken`, `storageMode`, and `sourcePath` (for local decrypt).
+
+Files over ~100 MB encrypted use multipart upload automatically. Progress prints to stderr unless `--json` or `--quiet` is set.
 
 ## How it works
 
+**Upload**
+
 1. Encrypts the file locally with AES-GCM (same format as the website)
-2. Uploads encrypted bytes via the public API
+2. Uploads encrypted bytes via the public API (parallel part uploads for large files)
 3. Prints a share URL including `#token=...`
 
-The server never receives plaintext or the decryption token.
+**Decrypt**
+
+1. Reads link metadata from `/api/link/:token`, or from a saved `--meta` JSON file
+2. Downloads the encrypted file (single blob or per-part for large uploads), unless you pass a local encrypted file
+3. Decrypts locally and writes the original file to disk
 
 ## Development
 
 ```bash
 node bin/bytifi.js upload ./file.png --json
+node bin/bytifi.js decrypt ./file.encrypted --meta ./meta.json --token '...'
 ```
-
-## Status
-
-WIP — v0.1.0 direct + multipart upload supported.

package/bin/bytifi.js

@@ -3,34 +3,73 @@
 import fs from 'node:fs/promises'
 import path from 'node:path'
 import process from 'node:process'
-import { fileURLToPath } from 'node:url'
+import { createRequire } from 'node:module'
+import { decryptFile } from '../lib/decrypt.js'
 import { BytifiApiError, BytifiNetworkError, uploadFile } from '../lib/upload.js'
 
-const __filename = fileURLToPath(import.meta.url)
+const require = createRequire(import.meta.url)
+const { version } = require('../package.json')
 
 function printHelp() {
-  process.stdout.write(`Bytifi CLI — encrypt and upload files
+  process.stdout.write(`Bytifi CLI v${version} — encrypt, upload, and decrypt files
 
 Usage:
   bytifi upload <file> [options]
+  bytifi decrypt <url-or-token> [options]
+  bytifi decrypt <encrypted-file> [options]
 
-Options:
-  -k, --api-key <key>     API key (default: BYTIFI_API_KEY env var)
-  -e, --expires <minutes> Link lifetime: 5|15|30|60|120 (default: 30)
+Upload options:
+  -k, --api-key <key>       API key (default: BYTIFI_API_KEY env var)
+  -e, --expires <minutes>   Link lifetime: 5|15|30|60|120 (default: 30)
       --delete-on-download  Remove file after first download
       --json                Print machine-readable JSON to stdout
   -q, --quiet               Print only the share URL
+      --verbose             Show API error details on stderr
       --mime-type <type>    Override detected MIME type
       --base-url <url>      API base URL (default: https://bytifi.com)
+
+Decrypt options:
+      --token <token>       Encryption token (if not in URL #token=...)
+      --link <token>        Link token for metadata (local encrypted files)
+      --meta <path>         Saved clientEncryptionMeta JSON (offline local decrypt)
+      --share-url <url>     Share URL for token/metadata when decrypting a local file
+  -o, --output <path>       Output file path (default: original filename)
+      --output-dir <dir>    Directory for decrypted file (default: cwd)
+      --json                Print machine-readable JSON to stdout
+  -q, --quiet               Print only the output file path
+      --verbose             Show error details on stderr
+      --base-url <url>      API base URL (default: https://bytifi.com)
+
+Global:
+  -V, --version             Show version
   -h, --help                Show this help
 
+Exit codes:
+  0  success
+  1  usage or validation error
+  2  API error (4xx/5xx response)
+  3  network error
+
 Examples:
   bytifi upload ./photo.png
   BYTIFI_API_KEY=usk_... bytifi upload report.pdf --expires 60 --json
+  bytifi decrypt 'https://bytifi.com/link?link=abc123#token=...'
+  bytifi decrypt abc123 --token '...' -o ./report.pdf
+  bytifi decrypt ./downloaded.encrypted --link abc123 --token '...'
+  bytifi decrypt ./downloaded.encrypted --meta ./upload-meta.json --token '...'
+  bytifi decrypt ./parts/ --link abc123 --token '...'
 `)
 }
 
-function parseArgs(argv) {
+function readFlagValue(argv, index, flagName) {
+  const value = argv[index + 1]
+  if (!value || value.startsWith('-')) {
+    throw new Error(`Option ${flagName} requires a value.`)
+  }
+  return value
+}
+
+function parseUploadArgs(argv) {
   const positional = []
   const options = {
     apiKey: process.env.BYTIFI_API_KEY || '',
@@ -38,9 +77,11 @@ function parseArgs(argv) {
     deleteOnDownload: false,
     json: false,
     quiet: false,
+    verbose: false,
     mimeType: '',
     baseUrl: 'https://bytifi.com',
     help: false,
+    version: false,
   }
 
   for (let index = 0; index < argv.length; index += 1) {
@@ -51,6 +92,11 @@ function parseArgs(argv) {
       continue
     }
 
+    if (arg === '--version' || arg === '-V') {
+      options.version = true
+      continue
+    }
+
     if (arg === '--json') {
       options.json = true
       continue
@@ -61,31 +107,138 @@ function parseArgs(argv) {
       continue
     }
 
+    if (arg === '--verbose') {
+      options.verbose = true
+      continue
+    }
+
     if (arg === '--delete-on-download') {
       options.deleteOnDownload = true
       continue
     }
 
     if (arg === '--api-key' || arg === '-k') {
-      options.apiKey = argv[index + 1] || ''
+      options.apiKey = readFlagValue(argv, index, arg)
       index += 1
       continue
     }
 
     if (arg === '--expires' || arg === '-e') {
-      options.expiresInMinutes = Number(argv[index + 1])
+      const raw = readFlagValue(argv, index, arg)
+      const minutes = Number(raw)
+      if (!Number.isFinite(minutes)) {
+        throw new Error(`Invalid expires value: ${raw}`)
+      }
+      options.expiresInMinutes = minutes
       index += 1
       continue
     }
 
     if (arg === '--mime-type') {
-      options.mimeType = argv[index + 1] || ''
+      options.mimeType = readFlagValue(argv, index, arg)
       index += 1
       continue
     }
 
     if (arg === '--base-url') {
-      options.baseUrl = argv[index + 1] || options.baseUrl
+      options.baseUrl = readFlagValue(argv, index, arg)
+      index += 1
+      continue
+    }
+
+    if (arg.startsWith('-')) {
+      throw new Error(`Unknown option: ${arg}`)
+    }
+
+    positional.push(arg)
+  }
+
+  return { positional, options }
+}
+
+function parseDecryptArgs(argv) {
+  const positional = []
+  const options = {
+    encryptionToken: '',
+    linkToken: '',
+    metaPath: '',
+    shareUrl: '',
+    output: '',
+    outputDirectory: '',
+    json: false,
+    quiet: false,
+    verbose: false,
+    baseUrl: 'https://bytifi.com',
+    help: false,
+    version: false,
+  }
+
+  for (let index = 0; index < argv.length; index += 1) {
+    const arg = argv[index]
+
+    if (arg === '--help' || arg === '-h') {
+      options.help = true
+      continue
+    }
+
+    if (arg === '--version' || arg === '-V') {
+      options.version = true
+      continue
+    }
+
+    if (arg === '--json') {
+      options.json = true
+      continue
+    }
+
+    if (arg === '--quiet' || arg === '-q') {
+      options.quiet = true
+      continue
+    }
+
+    if (arg === '--verbose') {
+      options.verbose = true
+      continue
+    }
+
+    if (arg === '--token') {
+      options.encryptionToken = readFlagValue(argv, index, arg)
+      index += 1
+      continue
+    }
+
+    if (arg === '--link') {
+      options.linkToken = readFlagValue(argv, index, arg)
+      index += 1
+      continue
+    }
+
+    if (arg === '--meta') {
+      options.metaPath = readFlagValue(argv, index, arg)
+      index += 1
+      continue
+    }
+
+    if (arg === '--share-url') {
+      options.shareUrl = readFlagValue(argv, index, arg)
+      index += 1
+      continue
+    }
+
+    if (arg === '--output' || arg === '-o') {
+      options.output = readFlagValue(argv, index, arg)
+      index += 1
+      continue
+    }
+
+    if (arg === '--output-dir') {
+      options.outputDirectory = readFlagValue(argv, index, arg)
+      index += 1
+      continue
+    }
+
+    if (arg === '--base-url') {
+      options.baseUrl = readFlagValue(argv, index, arg)
       index += 1
       continue
     }
@@ -107,6 +260,14 @@ function validateExpires(minutes) {
   }
 }
 
+function writeProgress(label, percent) {
+  process.stderr.write(`\r${label}: ${percent}%`)
+}
+
+function clearProgressLine() {
+  process.stderr.write('\r\x1b[K')
+}
+
 async function runUpload(filePath, options) {
   validateExpires(options.expiresInMinutes)
 
@@ -115,34 +276,120 @@ async function runUpload(filePath, options) {
   }
 
   const resolvedPath = path.resolve(filePath)
-  await fs.access(resolvedPath)
-
-  const result = await uploadFile(resolvedPath, {
-    apiKey: options.apiKey,
-    baseUrl: options.baseUrl,
-    expiresInMinutes: options.expiresInMinutes,
-    deleteOnDownload: options.deleteOnDownload,
-    mimeType: options.mimeType || undefined,
-    onProgress: options.quiet || options.json
-      ? undefined
-      : (percent) => {
-          process.stderr.write(`Encrypting and uploading: ${percent}%\n`)
-        },
-  })
-
-  if (options.json) {
-    process.stdout.write(`${JSON.stringify(result, null, 2)}\n`)
-    return
+
+  try {
+    await fs.access(resolvedPath)
+  } catch {
+    throw new Error(`File not found or not readable: ${resolvedPath}`)
   }
 
-  if (options.quiet) {
-    process.stdout.write(`${result.shareUrl}\n`)
-    return
+  const abortController = new AbortController()
+
+  const handleSignal = () => {
+    abortController.abort()
   }
 
-  process.stdout.write(`Share URL:\n${result.shareUrl}\n`)
-  process.stdout.write(`Download URL:\n${result.downloadUrl}\n`)
-  process.stdout.write(`Expires: ${result.expiresAt}\n`)
+  process.on('SIGINT', handleSignal)
+  process.on('SIGTERM', handleSignal)
+
+  const showProgress = !options.quiet && !options.json
+  let lastPercent = -1
+
+  try {
+    const result = await uploadFile(resolvedPath, {
+      apiKey: options.apiKey,
+      baseUrl: options.baseUrl,
+      expiresInMinutes: options.expiresInMinutes,
+      deleteOnDownload: options.deleteOnDownload,
+      mimeType: options.mimeType || undefined,
+      signal: abortController.signal,
+      onProgress: showProgress
+        ? (percent) => {
+            if (percent !== lastPercent) {
+              lastPercent = percent
+              writeProgress('Encrypting and uploading', percent)
+            }
+          }
+        : undefined,
+    })
+
+    if (showProgress) {
+      clearProgressLine()
+    }
+
+    if (options.json) {
+      process.stdout.write(`${JSON.stringify(result, null, 2)}\n`)
+      return
+    }
+
+    if (options.quiet) {
+      process.stdout.write(`${result.shareUrl}\n`)
+      return
+    }
+
+    process.stdout.write(`Share URL:\n${result.shareUrl}\n`)
+    process.stdout.write(`Encrypted file:\n${result.encryptedFile}\n`)
+    process.stdout.write(`Expires: ${result.expiresAt}\n`)
+  } finally {
+    process.off('SIGINT', handleSignal)
+    process.off('SIGTERM', handleSignal)
+  }
+}
+
+async function runDecrypt(input, options) {
+  const abortController = new AbortController()
+
+  const handleSignal = () => {
+    abortController.abort()
+  }
+
+  process.on('SIGINT', handleSignal)
+  process.on('SIGTERM', handleSignal)
+
+  const showProgress = !options.quiet && !options.json
+  let lastPercent = -1
+
+  try {
+    const result = await decryptFile(input, {
+      encryptionToken: options.encryptionToken,
+      linkToken: options.linkToken,
+      metaPath: options.metaPath,
+      shareUrl: options.shareUrl,
+      output: options.output || undefined,
+      outputDirectory: options.outputDirectory || undefined,
+      baseUrl: options.baseUrl,
+      signal: abortController.signal,
+      onProgress: showProgress
+        ? (percent) => {
+            if (percent !== lastPercent) {
+              lastPercent = percent
+              writeProgress('Downloading and decrypting', percent)
+            }
+          }
+        : undefined,
+    })
+
+    if (showProgress) {
+      clearProgressLine()
+    }
+
+    if (options.json) {
+      process.stdout.write(`${JSON.stringify(result, null, 2)}\n`)
+      return
+    }
+
+    if (options.quiet) {
+      process.stdout.write(`${result.outputPath}\n`)
+      return
+    }
+
+    process.stdout.write(`Saved: ${result.outputPath}\n`)
+    process.stdout.write(`Original name: ${result.originalName}\n`)
+    process.stdout.write(`Expires: ${result.expiresAt}\n`)
+  } finally {
+    process.off('SIGINT', handleSignal)
+    process.off('SIGTERM', handleSignal)
+  }
 }
 
 function exitCodeForError(error) {
@@ -151,6 +398,25 @@ function exitCodeForError(error) {
   return 1
 }
 
+function printError(error, verbose) {
+  process.stderr.write(`${error.message || 'Command failed.'}\n`)
+
+  if (!verbose) return
+
+  if (error instanceof BytifiApiError) {
+    if (error.status) {
+      process.stderr.write(`HTTP ${error.status}\n`)
+    }
+    if (error.body) {
+      process.stderr.write(`${JSON.stringify(error.body, null, 2)}\n`)
+    }
+  }
+
+  if (error instanceof BytifiNetworkError && error.cause) {
+    process.stderr.write(`${error.cause}\n`)
+  }
+}
+
 async function main() {
   const [command, ...rest] = process.argv.slice(2)
 
@@ -159,31 +425,82 @@ async function main() {
     process.exit(0)
   }
 
-  if (command !== 'upload') {
-    if (command === 'help') {
+  if (command === '--version' || command === '-V') {
+    process.stdout.write(`${version}\n`)
+    process.exit(0)
+  }
+
+  if (command === 'help') {
+    printHelp()
+    process.exit(0)
+  }
+
+  if (command === 'upload') {
+    const { positional, options } = parseUploadArgs(rest)
+
+    if (options.help) {
       printHelp()
       process.exit(0)
     }
 
-    throw new Error(`Unknown command: ${command}`)
-  }
+    if (options.version) {
+      process.stdout.write(`${version}\n`)
+      process.exit(0)
+    }
 
-  const { positional, options } = parseArgs(rest)
+    if (options.json && options.quiet) {
+      throw new Error('Use either --json or --quiet, not both.')
+    }
 
-  if (options.help) {
-    printHelp()
-    process.exit(0)
+    const filePath = positional[0]
+    if (!filePath) {
+      throw new Error('Missing file path. Usage: bytifi upload <file>')
+    }
+
+    if (positional.length > 1) {
+      process.stderr.write(`Warning: ignoring extra files: ${positional.slice(1).join(', ')}\n`)
+    }
+
+    await runUpload(filePath, options)
+    return
   }
 
-  const filePath = positional[0]
-  if (!filePath) {
-    throw new Error('Missing file path. Usage: bytifi upload <file>')
+  if (command === 'decrypt') {
+    const { positional, options } = parseDecryptArgs(rest)
+
+    if (options.help) {
+      printHelp()
+      process.exit(0)
+    }
+
+    if (options.version) {
+      process.stdout.write(`${version}\n`)
+      process.exit(0)
+    }
+
+    if (options.json && options.quiet) {
+      throw new Error('Use either --json or --quiet, not both.')
+    }
+
+    const input = positional[0]
+    if (!input) {
+      throw new Error('Missing input. Usage: bytifi decrypt <url-or-token|encrypted-file>')
+    }
+
+    if (positional.length > 1) {
+      process.stderr.write(`Warning: ignoring extra arguments: ${positional.slice(1).join(', ')}\n`)
+    }
+
+    await runDecrypt(input, options)
+    return
   }
 
-  await runUpload(filePath, options)
+  throw new Error(`Unknown command: ${command}`)
 }
 
 main().catch((error) => {
-  process.stderr.write(`${error.message || 'Upload failed.'}\n`)
+  clearProgressLine()
+  const verbose = process.argv.includes('--verbose')
+  printError(error, verbose)
   process.exit(exitCodeForError(error))
 })