bytifi 0.1.5 → 0.2.0

package/README.md

@@ -55,10 +55,12 @@ Prefer the environment variable — keys on the command line can appear in shell
 bytifi upload ./photo.png
 bytifi upload "./my video (1).mp4"
 bytifi upload ./report.pdf --expires 60 --delete-on-download
-bytifi upload ./large.iso --json > upload.json
+bytifi upload ./logs.txt --compress auto --concurrency 8 --json > upload.json
 bytifi upload ./photo.png -q
 ```
 
+Files over **10 MB** use multipart upload automatically (lower memory use). Compression defaults to **`auto`**: gzip for text-like files, skipped for video/images/zip.
+
 Upload accepts **one file at a time**. Quote paths that contain spaces. Avoid shell globs like `**` — your shell may expand them into dozens of paths.
 
 ### Decrypt from a link
@@ -126,6 +128,8 @@ Note: with `npm exec`, put `--` before the file path so npm does not swallow `--
 | `-q, --quiet` | Print only the share URL |
 | `--verbose` | Print API error details to stderr |
 | `--mime-type` | Override detected MIME type |
+| `--compress` | Compression mode: `auto`, `gzip`, or `off` (default: `auto`) |
+| `--concurrency` | Parallel encrypt/upload workers, 1–16 (default: `4`) |
 | `--base-url` | API base URL (default: `https://bytifi.com`) |
 
 ### Decrypt options
@@ -146,7 +150,7 @@ Note: with `npm exec`, put `--` before the file path so npm does not swallow `--
 
 Exit codes: `0` success, `1` usage error, `2` API error, `3` network error.
 
-JSON output (`--json`) for upload includes `shareUrl`, `encryptedFile`, `link`, `encryptionToken`, `clientEncryptionMeta`, and `expiresAt`.
+JSON output (`--json`) for upload includes `shareUrl`, `encryptedFile`, `link`, `encryptionToken`, `clientEncryptionMeta`, `compression`, and `expiresAt`.
 
 JSON output for decrypt includes `outputPath`, `originalName`, `size`, `mimeType`, `expiresAt`, `link`, `storageMode`, and `sourcePath` (for local decrypt).
 
@@ -156,9 +160,23 @@ Files over ~100 MB encrypted use multipart upload automatically. Progress prints
 
 **Upload**
 
-1. Encrypts the file locally with AES-GCM (same format as the website)
-2. Uploads encrypted bytes via the public API (parallel part uploads for large files)
-3. Prints a share URL including `#token=...`
+1. Optionally gzip-compress each chunk (`--compress auto|gzip|off`)
+2. Encrypts locally with AES-GCM (same format as the website, meta `version: 2` when compressed)
+3. Uploads encrypted bytes via multipart pipeline for files >10 MB
+4. Prints a share URL including `#token=...`
+
+## Compatibility
+
+| Scenario | Works? |
+|----------|--------|
+| Old links (no compression) | Yes — everywhere |
+| New CLI upload + new CLI decrypt | Yes |
+| New CLI upload + **updated website** decrypt | Yes — **deploy Bytifi-Website** after upgrading CLI |
+| New CLI upload + old website (not deployed) | **Broken in browser** — garbled download |
+| New CLI upload + old CLI (≤0.1.5) decrypt | **Broken** — upgrade CLI |
+| Website upload (no compression) | Yes — unchanged |
+
+Compressed files larger than one chunk use **part-based storage**; decrypt via share link or CLI part download.
 
 **Decrypt**
 

package/bin/bytifi.js

@@ -26,6 +26,8 @@ Upload options:
   -q, --quiet               Print only the share URL
       --verbose             Show API error details on stderr
       --mime-type <type>    Override detected MIME type
+      --compress <mode>     Compression: auto|gzip|off (default: auto)
+      --concurrency <n>     Parallel part workers (default: 4)
       --base-url <url>      API base URL (default: https://bytifi.com)
 
 Decrypt options:
@@ -54,6 +56,7 @@ Exit codes:
 Examples:
   bytifi upload ./photo.png
   bytifi upload ./video.mp4 --expires 60 --json > upload.json
+  bytifi upload ./logs.tar --compress gzip --concurrency 8
   bytifi upload ./large.iso -q
 
   bytifi decrypt 'https://bytifi.com/link?link=abc#token=...'
@@ -82,6 +85,8 @@ function parseUploadArgs(argv) {
     quiet: false,
     verbose: false,
     mimeType: '',
+    compressionMode: 'auto',
+    concurrency: 4,
     baseUrl: 'https://bytifi.com',
     help: false,
     version: false,
@@ -143,6 +148,23 @@ function parseUploadArgs(argv) {
       continue
     }
 
+    if (arg === '--compress') {
+      options.compressionMode = readFlagValue(argv, index, arg)
+      index += 1
+      continue
+    }
+
+    if (arg === '--concurrency') {
+      const raw = readFlagValue(argv, index, arg)
+      const concurrency = Number(raw)
+      if (!Number.isInteger(concurrency) || concurrency < 1 || concurrency > 16) {
+        throw new Error('concurrency must be an integer between 1 and 16.')
+      }
+      options.concurrency = concurrency
+      index += 1
+      continue
+    }
+
     if (arg === '--base-url') {
       options.baseUrl = readFlagValue(argv, index, arg)
       index += 1
@@ -312,6 +334,8 @@ async function runUpload(filePath, options) {
       expiresInMinutes: options.expiresInMinutes,
       deleteOnDownload: options.deleteOnDownload,
       mimeType: options.mimeType || undefined,
+      compressionMode: options.compressionMode,
+      concurrency: options.concurrency,
       signal: abortController.signal,
       onProgress: showProgress
         ? (percent) => {

package/lib/crypto.js

@@ -1,11 +1,30 @@
 import crypto from 'node:crypto'
 import fs from 'node:fs/promises'
 import path from 'node:path'
+import zlib from 'node:zlib'
+import { promisify } from 'node:util'
 import { fromBase64Url, toBase64Url } from './base64url.js'
 
+const gzipAsync = promisify(zlib.gzip)
+const gunzipAsync = promisify(zlib.gunzip)
+
 export const ENCRYPTED_PART_SIZE = 32 * 1024 * 1024
 export const PLAIN_CHUNK_SIZE = ENCRYPTED_PART_SIZE - 16
 export const DIRECT_UPLOAD_LIMIT_BYTES = 100 * 1024 * 1024
+export const MULTIPART_THRESHOLD_BYTES = 10 * 1024 * 1024
+
+const SKIP_COMPRESS_EXTENSIONS = new Set([
+  '.7z', '.avi', '.br', '.bz2', '.gif', '.gz', '.jpeg', '.jpg', '.mkv', '.mov',
+  '.mp3', '.mp4', '.png', '.rar', '.webp', '.woff', '.woff2', '.xz', '.zip', '.zst', '.iso',
+])
+
+const SKIP_COMPRESS_MIME_EXACT = new Set([
+  'application/gzip',
+  'application/pdf',
+  'application/x-7z-compressed',
+  'application/x-rar-compressed',
+  'application/zip',
+])
 
 export function buildChunkIv(noncePrefix, chunkIndex) {
   const iv = Buffer.alloc(12)
@@ -14,10 +33,75 @@ export function buildChunkIv(noncePrefix, chunkIndex) {
   return iv
 }
 
-export function encryptChunk(plainChunk, key, noncePrefix, chunkIndex) {
+export function resolveCompressionMode(requested, mimeType, originalName) {
+  const mode = String(requested || 'auto').toLowerCase()
+
+  if (mode === 'off' || mode === 'none') {
+    return 'none'
+  }
+
+  if (mode === 'gzip') {
+    return 'gzip'
+  }
+
+  if (mode === 'auto') {
+    return shouldSkipAutoCompression(mimeType, originalName) ? 'none' : 'gzip'
+  }
+
+  throw new Error('compress must be one of: auto, gzip, off')
+}
+
+function shouldSkipAutoCompression(mimeType, originalName) {
+  const extension = path.extname(String(originalName || '')).toLowerCase()
+  if (SKIP_COMPRESS_EXTENSIONS.has(extension)) {
+    return true
+  }
+
+  const normalizedMime = String(mimeType || '').toLowerCase()
+  if (SKIP_COMPRESS_MIME_EXACT.has(normalizedMime)) {
+    return true
+  }
+
+  if (normalizedMime.startsWith('video/') || normalizedMime.startsWith('audio/')) {
+    return true
+  }
+
+  if (normalizedMime.startsWith('image/')) {
+    return true
+  }
+
+  return false
+}
+
+export function usesChunkCompression(meta) {
+  return meta?.compression?.algorithm === 'gzip'
+}
+
+export function normalizeCompressionMeta(rawCompression) {
+  if (!rawCompression || typeof rawCompression !== 'object') {
+    return { algorithm: 'none', scope: 'chunk' }
+  }
+
+  const algorithm = String(rawCompression.algorithm || 'none').toLowerCase()
+  if (algorithm === 'gzip') {
+    return { algorithm: 'gzip', scope: 'chunk' }
+  }
+
+  return { algorithm: 'none', scope: 'chunk' }
+}
+
+export async function compressPlainChunk(plainChunk) {
+  return gzipAsync(plainChunk)
+}
+
+export async function decompressPlainChunk(compressedChunk) {
+  return gunzipAsync(compressedChunk)
+}
+
+export function encryptChunk(payloadChunk, key, noncePrefix, chunkIndex) {
   const iv = buildChunkIv(noncePrefix, chunkIndex)
   const cipher = crypto.createCipheriv('aes-256-gcm', key, iv)
-  const encrypted = Buffer.concat([cipher.update(plainChunk), cipher.final()])
+  const encrypted = Buffer.concat([cipher.update(payloadChunk), cipher.final()])
   const tag = cipher.getAuthTag()
   return Buffer.concat([encrypted, tag])
 }
@@ -28,10 +112,17 @@ export function buildClientEncryptionMeta({
   noncePrefix,
   originalSize,
   mimeType,
+  compression = 'none',
 }) {
+  const compressionMeta = normalizeCompressionMeta({
+    algorithm: compression === 'gzip' ? 'gzip' : 'none',
+    scope: 'chunk',
+  })
+
   return {
-    version: 1,
+    version: compressionMeta.algorithm === 'gzip' ? 2 : 1,
     algorithm: 'AES-GCM',
+    compression: compressionMeta,
     chunkSize: plainChunkSize,
     chunkCount,
     noncePrefix: toBase64Url(noncePrefix),
@@ -60,10 +151,12 @@ export function createEncryptionContext({
   tokenBytes = crypto.randomBytes(32),
   noncePrefix = crypto.randomBytes(8),
   plainChunkSize = PLAIN_CHUNK_SIZE,
+  compressionMode = 'auto',
 }) {
   if (tokenBytes.length !== 32) throw new Error('Encryption token must be 32 bytes.')
   if (noncePrefix.length !== 8) throw new Error('Nonce prefix must be 8 bytes.')
 
+  const compression = resolveCompressionMode(compressionMode, mimeType, originalName)
   const { chunkCount, encryptedSize } = calculateEncryptedSize(originalSize, plainChunkSize)
   const meta = buildClientEncryptionMeta({
     plainChunkSize,
@@ -71,6 +164,7 @@ export function createEncryptionContext({
     noncePrefix,
     originalSize,
     mimeType,
+    compression,
   })
 
   return {
@@ -84,6 +178,7 @@ export function createEncryptionContext({
     mimeType,
     originalSize,
     plainChunkSize,
+    compression,
   }
 }
 
@@ -104,6 +199,7 @@ export async function resolveUploadFile(filePath, options = {}) {
       originalSize: stat.size,
       originalName,
       mimeType,
+      compressionMode: options.compressionMode,
     }),
   }
 }
@@ -129,54 +225,12 @@ export async function encryptChunkFromFile(fileHandle, chunkIndex, context) {
     context.plainChunkSize,
   )
 
-  return encryptChunk(plainChunk, context.tokenBytes, context.noncePrefix, chunkIndex)
-}
-
-export async function collectEncryptedParts(filePath, context) {
-  const fileHandle = await fs.open(filePath, 'r')
-  const encryptedParts = []
-
-  try {
-    for (let chunkIndex = 0; chunkIndex < context.chunkCount; chunkIndex += 1) {
-      encryptedParts.push(await encryptChunkFromFile(fileHandle, chunkIndex, context))
-    }
-  } finally {
-    await fileHandle.close()
-  }
-
-  return encryptedParts
-}
-
-export async function encryptFileBuffer(fileBuffer, {
-  originalName = 'upload',
-  mimeType = 'application/octet-stream',
-  tokenBytes = crypto.randomBytes(32),
-  noncePrefix = crypto.randomBytes(8),
-  plainChunkSize = PLAIN_CHUNK_SIZE,
-} = {}) {
-  const context = createEncryptionContext({
-    originalSize: fileBuffer.length,
-    originalName,
-    mimeType,
-    tokenBytes,
-    noncePrefix,
-    plainChunkSize,
-  })
-
-  const encryptedParts = []
-
-  for (let chunkIndex = 0; chunkIndex < context.chunkCount; chunkIndex += 1) {
-    const start = chunkIndex * plainChunkSize
-    const end = Math.min(fileBuffer.length, start + plainChunkSize)
-    const plainChunk = fileBuffer.subarray(start, end)
-    encryptedParts.push(encryptChunk(plainChunk, context.tokenBytes, context.noncePrefix, chunkIndex))
+  let payload = plainChunk
+  if (context.compression === 'gzip') {
+    payload = await compressPlainChunk(plainChunk)
   }
 
-  return {
-    ...context,
-    encryptedParts,
-    encryptedBuffer: Buffer.concat(encryptedParts),
-  }
+  return encryptChunk(payload, context.tokenBytes, context.noncePrefix, chunkIndex)
 }
 
 export function decryptChunk(encryptedChunk, tokenBytes, noncePrefix, chunkIndex) {
@@ -192,6 +246,16 @@ export function decryptChunk(encryptedChunk, tokenBytes, noncePrefix, chunkIndex
   return Buffer.concat([decipher.update(ciphertext), decipher.final()])
 }
 
+export async function decryptPlainChunkFromEncrypted(encryptedChunk, tokenBytes, noncePrefix, chunkIndex, meta) {
+  const payload = decryptChunk(encryptedChunk, tokenBytes, noncePrefix, chunkIndex)
+
+  if (!usesChunkCompression(meta)) {
+    return payload
+  }
+
+  return decompressPlainChunk(payload)
+}
+
 export function importToken(token) {
   const tokenBytes = fromBase64Url(token)
   if (tokenBytes.length !== 32) {
@@ -215,6 +279,7 @@ export function normalizeClientEncryptionMeta(rawMeta) {
   return {
     version: Number(rawMeta.version) || 1,
     algorithm: String(rawMeta.algorithm || 'AES-GCM'),
+    compression: normalizeCompressionMeta(rawMeta.compression),
     chunkSize,
     chunkCount,
     noncePrefix: rawMeta.noncePrefix,
@@ -226,20 +291,22 @@ export function normalizeClientEncryptionMeta(rawMeta) {
 export function buildEncryptedChunkPlan(meta) {
   const chunks = []
   let offset = 0
+  const variableEncryptedSizes = usesChunkCompression(meta)
 
   for (let chunkIndex = 0; chunkIndex < meta.chunkCount; chunkIndex += 1) {
     const start = chunkIndex * meta.chunkSize
     const plainSize = Math.min(meta.originalSize - start, meta.chunkSize)
-    const encryptedSize = plainSize + 16
+    const encryptedSize = variableEncryptedSizes ? null : plainSize + 16
 
-    chunks.push({ chunkIndex, encryptedSize, plainSize })
-    offset += encryptedSize
+    chunks.push({ chunkIndex, encryptedSize, plainSize, variableEncryptedSize: variableEncryptedSizes })
+    offset += encryptedSize || 0
   }
 
   return {
     chunks,
-    totalEncryptedSize: offset,
+    totalEncryptedSize: variableEncryptedSizes ? null : offset,
     totalPlainSize: meta.originalSize,
+    variableEncryptedSizes,
   }
 }
 

package/lib/decrypt.js

@@ -3,9 +3,10 @@ import path from 'node:path'
 import process from 'node:process'
 import {
   buildEncryptedChunkPlan,
-  decryptChunk,
+  decryptPlainChunkFromEncrypted,
   importToken,
   normalizeClientEncryptionMeta,
+  usesChunkCompression,
 } from './crypto.js'
 import { fromBase64Url } from './base64url.js'
 import { BytifiApiError, BytifiNetworkError } from './upload.js'
@@ -249,7 +250,13 @@ async function decryptFromParts({
 
       const chunk = chunks[index]
       const encryptedPart = await fetchEncryptedPart(baseUrl, linkToken, chunk.chunkIndex + 1, signal)
-      const plainPart = decryptChunk(encryptedPart, tokenBytes, noncePrefix, chunk.chunkIndex)
+      const plainPart = await decryptPlainChunkFromEncrypted(
+        encryptedPart,
+        tokenBytes,
+        noncePrefix,
+        chunk.chunkIndex,
+        meta,
+      )
 
       await fileHandle.write(plainPart)
       decryptedBytes += plainPart.length
@@ -269,7 +276,6 @@ async function decryptFromSingleFile({
   onProgress,
   signal,
 }) {
-  const { chunks, totalEncryptedSize } = buildEncryptedChunkPlan(meta)
   const response = await fetch(encryptedFileUrl, { signal })
 
   if (!response.ok) {
@@ -280,6 +286,28 @@ async function decryptFromSingleFile({
     })
   }
 
+  if (usesChunkCompression(meta)) {
+    if (meta.chunkCount !== 1) {
+      throw new Error(
+        'Compressed files with multiple chunks require part-based download. Open the share link in a browser or use part files.',
+      )
+    }
+
+    const encryptedBuffer = Buffer.from(await response.arrayBuffer())
+    const plainPart = await decryptPlainChunkFromEncrypted(
+      encryptedBuffer,
+      tokenBytes,
+      noncePrefix,
+      0,
+      meta,
+    )
+    await fs.writeFile(outputPath, plainPart)
+    onProgress?.(100)
+    return
+  }
+
+  const { chunks, totalEncryptedSize } = buildEncryptedChunkPlan(meta)
+
   if (!response.body) {
     const encryptedBuffer = Buffer.from(await response.arrayBuffer())
     await writeDecryptedBuffer(encryptedBuffer, chunks, meta, tokenBytes, noncePrefix, outputPath, onProgress, signal)
@@ -342,7 +370,13 @@ async function decryptFromSingleFile({
         throw new Error('Encrypted file ended before all parts were downloaded.')
       }
 
-      const plainPart = decryptChunk(encryptedChunk, tokenBytes, noncePrefix, chunk.chunkIndex)
+      const plainPart = await decryptPlainChunkFromEncrypted(
+        encryptedChunk,
+        tokenBytes,
+        noncePrefix,
+        chunk.chunkIndex,
+        meta,
+      )
       await fileHandle.write(plainPart)
       decryptedBytes += plainPart.length
       nextChunkIndex += 1
@@ -357,6 +391,23 @@ async function decryptFromSingleFile({
 }
 
 async function writeDecryptedBuffer(encryptedBuffer, chunks, meta, tokenBytes, noncePrefix, outputPath, onProgress, signal) {
+  if (usesChunkCompression(meta)) {
+    if (chunks.length !== 1) {
+      throw new Error('Compressed files with multiple chunks require part-based storage.')
+    }
+
+    const plainPart = await decryptPlainChunkFromEncrypted(
+      encryptedBuffer,
+      tokenBytes,
+      noncePrefix,
+      0,
+      meta,
+    )
+    await fs.writeFile(outputPath, plainPart)
+    onProgress?.(100)
+    return
+  }
+
   const fileHandle = await fs.open(outputPath, 'w')
   let offset = 0
   let decryptedBytes = 0
@@ -372,7 +423,13 @@ async function writeDecryptedBuffer(encryptedBuffer, chunks, meta, tokenBytes, n
         throw new Error('Encrypted file ended before all parts were downloaded.')
       }
 
-      const plainPart = decryptChunk(encryptedChunk, tokenBytes, noncePrefix, chunk.chunkIndex)
+      const plainPart = await decryptPlainChunkFromEncrypted(
+        encryptedChunk,
+        tokenBytes,
+        noncePrefix,
+        chunk.chunkIndex,
+        meta,
+      )
       await fileHandle.write(plainPart)
       offset += chunk.encryptedSize
       decryptedBytes += plainPart.length
@@ -395,6 +452,17 @@ async function decryptFromLocalSingleFile({
   signal,
 }) {
   const { chunks } = buildEncryptedChunkPlan(meta)
+
+  if (usesChunkCompression(meta)) {
+    if (meta.chunkCount !== 1) {
+      throw new Error('Compressed multi-chunk files must be decrypted from a parts directory.')
+    }
+
+    const encryptedBuffer = await fs.readFile(encryptedFilePath)
+    await writeDecryptedBuffer(encryptedBuffer, chunks, meta, tokenBytes, noncePrefix, outputPath, onProgress, signal)
+    return
+  }
+
   const stat = await fs.stat(encryptedFilePath)
 
   if (stat.size <= 64 * 1024 * 1024) {
@@ -421,7 +489,13 @@ async function decryptFromLocalSingleFile({
         throw new Error('Encrypted file ended before all parts were read.')
       }
 
-      const plainPart = decryptChunk(encryptedChunk, tokenBytes, noncePrefix, chunk.chunkIndex)
+      const plainPart = await decryptPlainChunkFromEncrypted(
+        encryptedChunk,
+        tokenBytes,
+        noncePrefix,
+        chunk.chunkIndex,
+        meta,
+      )
       await outputHandle.write(plainPart)
       offset += chunk.encryptedSize
       decryptedBytes += plainPart.length
@@ -485,7 +559,13 @@ async function decryptFromLocalParts({
       }
 
       const encryptedPart = await fs.readFile(path.join(partsDirectory, partEntry.name))
-      const plainPart = decryptChunk(encryptedPart, tokenBytes, noncePrefix, chunk.chunkIndex)
+      const plainPart = await decryptPlainChunkFromEncrypted(
+        encryptedPart,
+        tokenBytes,
+        noncePrefix,
+        chunk.chunkIndex,
+        meta,
+      )
 
       await fileHandle.write(plainPart)
       decryptedBytes += plainPart.length

package/lib/upload.js

@@ -1,5 +1,5 @@
 import {
-  DIRECT_UPLOAD_LIMIT_BYTES,
+  MULTIPART_THRESHOLD_BYTES,
   encryptChunkFromFile,
   resolveUploadFile,
 } from './crypto.js'
@@ -132,6 +132,70 @@ function buildResult(payload, context, shareUrl) {
     expiresAt: payload.expiresAt,
     deleteOnDownload: payload.deleteOnDownload,
     clientEncrypted: payload.clientEncrypted,
+    compression: context.compression,
+  }
+}
+
+function createBoundedQueue(maxSize) {
+  const items = []
+  const waiters = []
+  let closed = false
+
+  function notifyWaiters() {
+    while (waiters.length > 0) {
+      const resolve = waiters.shift()
+      resolve()
+    }
+  }
+
+  return {
+    async push(item, signal) {
+      while (items.length >= maxSize) {
+        if (signal?.aborted) {
+          throw new Error('Upload aborted.')
+        }
+        await new Promise((resolve, reject) => {
+          const onAbort = () => {
+            const index = waiters.indexOf(resolve)
+            if (index >= 0) waiters.splice(index, 1)
+            reject(new Error('Upload aborted.'))
+          }
+          waiters.push(resolve)
+          signal?.addEventListener('abort', onAbort, { once: true })
+        })
+      }
+
+      items.push(item)
+      notifyWaiters()
+    },
+    async take(signal) {
+      while (items.length === 0) {
+        if (closed) {
+          return null
+        }
+        if (signal?.aborted) {
+          throw new Error('Upload aborted.')
+        }
+        await new Promise((resolve, reject) => {
+          const onAbort = () => {
+            const index = waiters.indexOf(resolve)
+            if (index >= 0) waiters.splice(index, 1)
+            reject(new Error('Upload aborted.'))
+          }
+          waiters.push(resolve)
+          signal?.addEventListener('abort', onAbort, { once: true })
+        })
+      }
+
+      return items.shift()
+    },
+    close() {
+      closed = true
+      notifyWaiters()
+    },
+    get pending() {
+      return items.length
+    },
   }
 }
 
@@ -221,7 +285,7 @@ async function uploadMultipartStreaming(filePath, context, {
   signal,
   concurrency = DEFAULT_CONCURRENCY,
 }) {
-  const partSize = context.meta.chunkSize + 16
+  const maxPartSize = context.meta.chunkSize + 16
   const initPayload = await apiFetchWithRetry(baseUrl, '/api/public/upload/init', {
     apiKey,
     method: 'POST',
@@ -233,7 +297,7 @@ async function uploadMultipartStreaming(filePath, context, {
       originalSize: context.originalSize,
       clientEncrypted: true,
       clientEncryptionMeta: context.meta,
-      partSize,
+      partSize: maxPartSize,
       expiresInMinutes,
       deleteOnDownload,
     }),
@@ -242,37 +306,58 @@ async function uploadMultipartStreaming(filePath, context, {
 
   const sessionToken = initPayload.sessionToken
   const workerCount = Math.min(
-    Number(initPayload.concurrency) || concurrency,
+    Number(concurrency) || Number(initPayload.concurrency) || DEFAULT_CONCURRENCY,
     context.chunkCount,
   )
+  const queue = createBoundedQueue(Math.max(2, workerCount * 2))
   const fileHandle = await fs.open(filePath, 'r')
   let nextChunkIndex = 0
   let completedParts = 0
 
-  async function uploadWorker() {
+  function claimChunkIndex() {
+    const chunkIndex = nextChunkIndex
+    nextChunkIndex += 1
+    return chunkIndex
+  }
+
+  async function encryptWorker() {
     while (true) {
       if (signal?.aborted) {
         throw new Error('Upload aborted.')
       }
 
-      const chunkIndex = nextChunkIndex
-      nextChunkIndex += 1
-
+      const chunkIndex = claimChunkIndex()
       if (chunkIndex >= context.chunkCount) {
         return
       }
 
-      const partNumber = chunkIndex + 1
       const encryptedPart = await encryptChunkFromFile(fileHandle, chunkIndex, context)
+      await queue.push({
+        partNumber: chunkIndex + 1,
+        body: encryptedPart,
+      }, signal)
+    }
+  }
+
+  async function uploadWorker() {
+    while (true) {
+      if (signal?.aborted) {
+        throw new Error('Upload aborted.')
+      }
+
+      const part = await queue.take(signal)
+      if (!part) {
+        return
+      }
 
       await apiFetchWithRetry(
         baseUrl,
-        `/api/public/upload/part?sessionToken=${encodeURIComponent(sessionToken)}&partNumber=${partNumber}`,
+        `/api/public/upload/part?sessionToken=${encodeURIComponent(sessionToken)}&partNumber=${part.partNumber}`,
         {
           apiKey,
           method: 'PUT',
           headers: { 'Content-Type': 'application/octet-stream' },
-          body: encryptedPart,
+          body: part.body,
           signal,
         },
       )
@@ -283,7 +368,11 @@ async function uploadMultipartStreaming(filePath, context, {
   }
 
   try {
-    await Promise.all(Array.from({ length: workerCount }, () => uploadWorker()))
+    const uploadWorkers = Array.from({ length: workerCount }, () => uploadWorker())
+    const encryptWorkers = Array.from({ length: workerCount }, () => encryptWorker())
+    await Promise.all(encryptWorkers)
+    queue.close()
+    await Promise.all(uploadWorkers)
   } catch (error) {
     await apiFetchWithRetry(baseUrl, '/api/public/upload/abort', {
       apiKey,
@@ -321,9 +410,10 @@ export async function uploadFile(filePath, options) {
 
   const { absolutePath, context } = await resolveUploadFile(filePath, {
     mimeType: options.mimeType,
+    compressionMode: options.compressionMode,
   })
 
-  if (context.encryptedSize <= DIRECT_UPLOAD_LIMIT_BYTES) {
+  if (context.originalSize <= MULTIPART_THRESHOLD_BYTES) {
     const encryptedBuffer = await collectEncryptedBuffer(absolutePath, context, {
       onProgress: options.onProgress,
       signal: options.signal,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bytifi",
-  "version": "0.1.5",
+  "version": "0.2.0",
   "description": "Official Bytifi CLI — encrypt, upload, and decrypt files from the terminal",
   "type": "module",
   "bin": {