yungle-cli 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Hein de Wilde
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,64 @@
+# yungle-cli
+
+Send and sync files with [Yungle](https://yungle.co) from the command line.
+
+```bash
+npm install -g yungle-cli
+yungle auth login
+yungle send ~/Shoot --to client@example.com
+```
+
+## Why a CLI
+
+Yungle's upload engine is resumable at part granularity and sized for 100 GB
+transfers. Until this existed, the only thing that could drive it was a browser
+tab that had to stay open — which is the wrong process to hand an eight-hour
+upload to. This one survives a closed laptop lid: interrupt `yungle send`, run
+the same command again, and it continues from the last committed part instead of
+starting over.
+
+## Commands
+
+| | |
+|---|---|
+| `yungle auth login` | Save an API key (or set `YUNGLE_API_KEY`) |
+| `yungle auth status` | Which key is in use, and what it may do |
+| `yungle send <paths…>` | Send files; prints the share link |
+| `yungle push <paths…> --collection <id>` | Upload into a collection |
+| `yungle ls transfers\|collections\|contacts` | List things |
+| `yungle rm transfer <id>` | Revoke a transfer |
+
+`--json` on any command prints a machine-readable object on stdout; progress
+goes to stderr, so `yungle send … --json \| jq` works.
+
+Folders keep their structure. Hidden files are skipped when walking a directory
+and kept when named directly.
+
+## Resuming
+
+State lives in `~/.cache/yungle/`. A session is keyed by the *local files* —
+their paths, sizes and modification times — because that is all the next
+invocation has to go on; it cannot know the transfer id of a process that was
+killed. Run the same command with the same files and it resumes; change a file
+and it starts over, because resuming into a row whose declared size no longer
+matches fails at the very end with an error that points nowhere useful.
+
+Sessions expire after two hours, matching the lifetime of the upload tokens
+they hold.
+
+## Credentials
+
+Read from `YUNGLE_API_KEY` first, then `~/.config/yungle/config.json` (written
+`0600`). A key acts as one workspace and can be revoked at any time from
+Settings → API keys.
+
+The API is available on any paid Yungle plan. Full documentation:
+<https://yungle.co/developers>
+
+## What it cannot do
+
+Your vault and end-to-end encrypted transfers are not reachable through the API
+this is built on. Their keys are derived in the client and never sent to us, so
+a server-side API has nothing to offer — see
+<https://yungle.co/developers/unsupported>. Reaching them from a local client is
+possible in principle and is not built yet.

package/dist/yungle.mjs

@@ -0,0 +1,868 @@
+#!/usr/bin/env node
+
+// ../../packages/api-client/src/index.ts
+var YungleApiError = class extends Error {
+  constructor(status, code, message, details) {
+    super(message);
+    this.status = status;
+    this.code = code;
+    this.details = details;
+    this.name = "YungleApiError";
+  }
+  status;
+  code;
+  details;
+  /** Worth trying again: throttled, or our fault. */
+  get retryable() {
+    return this.status === 429 || this.status >= 500;
+  }
+  /** Seconds to wait, when the server said. */
+  get retryAfterSeconds() {
+    const value = this.details?.retryAfterSeconds;
+    return typeof value === "number" ? value : null;
+  }
+};
+var DEFAULT_BASE = "https://yungle.co/api/v1";
+var YungleClient = class {
+  baseUrl;
+  apiKey;
+  doFetch;
+  maxRetries;
+  constructor(options) {
+    if (!options.apiKey) throw new Error("An API key is required.");
+    this.apiKey = options.apiKey;
+    this.baseUrl = (options.baseUrl ?? DEFAULT_BASE).replace(/\/+$/, "");
+    this.doFetch = options.fetch ?? globalThis.fetch.bind(globalThis);
+    this.maxRetries = options.maxRetries ?? 3;
+  }
+  // ── Account ───────────────────────────────────────────────────────────────
+  me() {
+    return this.request("GET", "/me");
+  }
+  // ── Transfers ─────────────────────────────────────────────────────────────
+  listTransfers() {
+    return this.request("GET", "/transfers");
+  }
+  /**
+   * Create a draft. Nothing is live and nobody is emailed until `finalizeTransfer`.
+   */
+  createTransfer(input) {
+    return this.request("POST", "/transfers", input);
+  }
+  getTransfer(id) {
+    return this.request("GET", `/transfers/${enc(id)}`);
+  }
+  /**
+   * Send it. Omit `recipients` for a link-only transfer, which costs nothing
+   * from the daily email budget.
+   *
+   * Idempotent server-side, so a lost response is safe to repeat.
+   */
+  finalizeTransfer(id, input = {}) {
+    return this.request("POST", `/transfers/${enc(id)}/finalize`, input, { idempotent: true });
+  }
+  addTransferFiles(id, files) {
+    return this.request("POST", `/transfers/${enc(id)}/files`, { files });
+  }
+  removeTransferFile(id, fileId) {
+    return this.request("DELETE", `/transfers/${enc(id)}/files/${enc(fileId)}`);
+  }
+  updateTransfer(id, input) {
+    return this.request("PATCH", `/transfers/${enc(id)}`, input);
+  }
+  /** Immediate and irreversible — the encryption keys are destroyed. */
+  revokeTransfer(id) {
+    return this.request("DELETE", `/transfers/${enc(id)}`);
+  }
+  transferDownloads(id) {
+    return this.request("GET", `/transfers/${enc(id)}/downloads`);
+  }
+  // ── Collections ───────────────────────────────────────────────────────────
+  listCollections() {
+    return this.request("GET", "/collections");
+  }
+  createCollection(input) {
+    return this.request("POST", "/collections", input);
+  }
+  getCollection(id) {
+    return this.request("GET", `/collections/${enc(id)}`);
+  }
+  updateCollection(id, input) {
+    return this.request("PATCH", `/collections/${enc(id)}`, input);
+  }
+  deleteCollection(id) {
+    return this.request("DELETE", `/collections/${enc(id)}`);
+  }
+  /** `folderId` omitted lists everything; `'root'` lists the top level only. */
+  listCollectionFiles(id, folderId) {
+    const query = folderId ? `?folderId=${encodeURIComponent(folderId)}` : "";
+    return this.request("GET", `/collections/${enc(id)}/files${query}`);
+  }
+  addCollectionFiles(id, files, folderId) {
+    return this.request("POST", `/collections/${enc(id)}/files`, { files, folderId });
+  }
+  deleteCollectionFiles(id, fileIds) {
+    return this.request("DELETE", `/collections/${enc(id)}/files`, { fileIds });
+  }
+  listFolders(id) {
+    return this.request("GET", `/collections/${enc(id)}/folders`);
+  }
+  createFolder(id, input) {
+    return this.request("POST", `/collections/${enc(id)}/folders`, input);
+  }
+  listGuests(id) {
+    return this.request("GET", `/collections/${enc(id)}/guests`);
+  }
+  inviteGuests(id, emails) {
+    return this.request("POST", `/collections/${enc(id)}/guests`, { emails });
+  }
+  removeGuest(id, guestId) {
+    return this.request("DELETE", `/collections/${enc(id)}/guests/${enc(guestId)}`);
+  }
+  // ── Contacts ──────────────────────────────────────────────────────────────
+  listContacts() {
+    return this.request("GET", "/contacts");
+  }
+  createContact(input) {
+    return this.request("POST", "/contacts", input);
+  }
+  getContact(id) {
+    return this.request("GET", `/contacts/${enc(id)}`);
+  }
+  /** A full replacement: any field omitted is cleared. */
+  updateContact(id, input) {
+    return this.request("PATCH", `/contacts/${enc(id)}`, input);
+  }
+  deleteContact(id) {
+    return this.request("DELETE", `/contacts/${enc(id)}`);
+  }
+  // ── Transport ─────────────────────────────────────────────────────────────
+  /**
+   * `idempotent` widens what may be retried.
+   *
+   * GET and DELETE are safe by nature. POST is not — retrying `createTransfer`
+   * after a 500 would make a second draft — so it is opt-in per method, and set
+   * only where the server documents the operation as repeatable. Retrying a
+   * *throttle* is always fine regardless: a 429 means nothing happened.
+   */
+  async request(method, path, body, opts) {
+    const safe = method === "GET" || method === "DELETE" || opts?.idempotent === true;
+    let attempt = 0;
+    for (; ; ) {
+      const res = await this.doFetch(`${this.baseUrl}${path}`, {
+        method,
+        headers: {
+          Authorization: `Bearer ${this.apiKey}`,
+          Accept: "application/json",
+          ...body === void 0 ? {} : { "Content-Type": "application/json" }
+        },
+        ...body === void 0 ? {} : { body: JSON.stringify(body) }
+      });
+      if (res.ok) return await res.json();
+      const error = await toError(res);
+      const mayRetry = error.status === 429 || safe && error.retryable;
+      if (!mayRetry || attempt >= this.maxRetries) throw error;
+      await sleep(backoffMs(attempt, error));
+      attempt++;
+    }
+  }
+};
+function enc(segment) {
+  return encodeURIComponent(segment);
+}
+async function toError(res) {
+  let body = null;
+  try {
+    body = await res.json();
+  } catch {
+  }
+  const err = body?.error;
+  return new YungleApiError(
+    res.status,
+    err?.code ?? "http_error",
+    err?.message ?? `Request failed with status ${res.status}.`,
+    err?.details
+  );
+}
+function backoffMs(attempt, error) {
+  const stated = error.retryAfterSeconds;
+  if (stated !== null) return stated * 1e3;
+  return Math.min(2 ** attempt * 500, 8e3) + Math.floor(Math.random() * 250);
+}
+function sleep(ms) {
+  return new Promise((resolve2) => setTimeout(resolve2, ms));
+}
+
+// src/index.ts
+import { createInterface } from "node:readline/promises";
+
+// src/args.ts
+var VALUE_FLAGS = /* @__PURE__ */ new Set([
+  "to",
+  "message",
+  "title",
+  "password",
+  "expires",
+  "collection",
+  "folder",
+  "out",
+  "url",
+  "key"
+]);
+function parseArgs(argv) {
+  const [command = "help", ...rest] = argv;
+  const positionals = [];
+  const flags = {};
+  for (let i = 0; i < rest.length; i++) {
+    const token = rest[i];
+    if (token === "--") {
+      positionals.push(...rest.slice(i + 1));
+      break;
+    }
+    if (token.startsWith("--")) {
+      const body = token.slice(2);
+      const eq = body.indexOf("=");
+      if (eq >= 0) {
+        flags[body.slice(0, eq)] = body.slice(eq + 1);
+        continue;
+      }
+      if (VALUE_FLAGS.has(body)) {
+        const value = rest[i + 1];
+        if (value === void 0 || value.startsWith("--")) {
+          throw new Error(`--${body} needs a value.`);
+        }
+        flags[body] = value;
+        i++;
+        continue;
+      }
+      flags[body] = true;
+      continue;
+    }
+    positionals.push(token);
+  }
+  return { command, positionals, flags };
+}
+function listFlag(value) {
+  if (typeof value !== "string") return [];
+  return value.split(",").map((s) => s.trim()).filter(Boolean);
+}
+function numberFlag(value, name) {
+  if (value === void 0 || typeof value === "boolean") return void 0;
+  const n = Number(value);
+  if (!Number.isInteger(n) || n <= 0) throw new Error(`--${name} must be a positive whole number.`);
+  return n;
+}
+function stringFlag(value) {
+  return typeof value === "string" ? value : void 0;
+}
+
+// src/config.ts
+import { createHash } from "node:crypto";
+import { chmod, mkdir, readFile, writeFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+function xdg(envVar, fallback) {
+  const configured = process.env[envVar];
+  return configured && configured.startsWith("/") ? configured : join(homedir(), fallback);
+}
+var CONFIG_PATH = join(xdg("XDG_CONFIG_HOME", ".config"), "yungle", "config.json");
+var RESUME_PATH = join(xdg("XDG_CACHE_HOME", ".cache"), "yungle", "uploads.json");
+async function readConfig() {
+  try {
+    return JSON.parse(await readFile(CONFIG_PATH, "utf8"));
+  } catch {
+    return {};
+  }
+}
+async function writeConfig(config) {
+  await mkdir(dirname(CONFIG_PATH), { recursive: true, mode: 448 });
+  await writeFile(CONFIG_PATH, `${JSON.stringify(config, null, 2)}
+`, { mode: 384 });
+  await chmod(CONFIG_PATH, 384);
+}
+async function resolveKey() {
+  const fromEnv = process.env.YUNGLE_API_KEY?.trim();
+  const config = await readConfig();
+  const baseUrl = process.env.YUNGLE_API_URL?.trim() || config.baseUrl;
+  if (fromEnv) return { apiKey: fromEnv, baseUrl, source: "YUNGLE_API_KEY" };
+  if (config.apiKey) return { apiKey: config.apiKey, baseUrl, source: CONFIG_PATH };
+  return null;
+}
+var SESSION_TTL_MS = 2 * 60 * 60 * 1e3;
+function sessionKey(inputs, target) {
+  const parts = inputs.map((f) => [f.path, f.size, Math.floor(f.mtimeMs)]).sort((a, b) => a[0] < b[0] ? -1 : a[0] > b[0] ? 1 : 0);
+  return createHash("sha256").update(JSON.stringify([target, parts])).digest("hex").slice(0, 32);
+}
+async function readSessions() {
+  try {
+    const parsed = JSON.parse(await readFile(RESUME_PATH, "utf8"));
+    const now = Date.now();
+    const live = {};
+    for (const [key, session] of Object.entries(parsed)) {
+      if (session && now - session.createdAt < SESSION_TTL_MS) live[key] = session;
+    }
+    return live;
+  } catch {
+    return {};
+  }
+}
+async function findSession(key) {
+  return (await readSessions())[key] ?? null;
+}
+async function saveSession(key, session) {
+  const sessions = await readSessions();
+  sessions[key] = session;
+  await mkdir(dirname(RESUME_PATH), { recursive: true });
+  await writeFile(RESUME_PATH, JSON.stringify(sessions));
+}
+async function dropSession(key) {
+  const sessions = await readSessions();
+  if (!(key in sessions)) return;
+  delete sessions[key];
+  await mkdir(dirname(RESUME_PATH), { recursive: true });
+  await writeFile(RESUME_PATH, JSON.stringify(sessions));
+}
+var URL_PATH = RESUME_PATH.replace(/uploads\.json$/, "upload-urls.json");
+async function readUploadUrls() {
+  try {
+    return JSON.parse(await readFile(URL_PATH, "utf8"));
+  } catch {
+    return {};
+  }
+}
+async function saveUploadUrl(fileId, uploadUrl) {
+  const current = await readUploadUrls();
+  if (current[fileId] === uploadUrl) return;
+  current[fileId] = uploadUrl;
+  await mkdir(dirname(URL_PATH), { recursive: true });
+  await writeFile(URL_PATH, JSON.stringify(current));
+}
+async function clearUploadUrls(fileIds) {
+  const current = await readUploadUrls();
+  let changed = false;
+  for (const id of fileIds) {
+    if (id in current) {
+      delete current[id];
+      changed = true;
+    }
+  }
+  if (changed) await writeFile(URL_PATH, JSON.stringify(current));
+}
+
+// src/files.ts
+import { readdir, stat } from "node:fs/promises";
+import { basename, join as join2, relative, resolve, sep } from "node:path";
+function isHidden(name) {
+  return name.startsWith(".");
+}
+async function collectFiles(inputs) {
+  const out2 = [];
+  for (const input of inputs) {
+    const absolute = resolve(input);
+    const info = await stat(absolute);
+    if (info.isDirectory()) {
+      await walk(absolute, basename(absolute), out2);
+    } else {
+      out2.push({
+        path: absolute,
+        name: basename(absolute),
+        size: info.size,
+        relativeDir: "",
+        mtimeMs: info.mtimeMs
+      });
+    }
+  }
+  return out2;
+}
+async function walk(dir, prefix, out2) {
+  const entries = await readdir(dir, { withFileTypes: true });
+  for (const entry of entries) {
+    if (isHidden(entry.name)) continue;
+    const full = join2(dir, entry.name);
+    if (entry.isDirectory()) {
+      await walk(full, `${prefix}/${entry.name}`, out2);
+    } else if (entry.isFile()) {
+      const info = await stat(full);
+      out2.push({
+        path: full,
+        name: entry.name,
+        size: info.size,
+        relativeDir: prefix,
+        mtimeMs: info.mtimeMs
+      });
+    }
+  }
+}
+function toFileInputs(files) {
+  return files.map((f) => ({
+    name: f.name,
+    size: f.size,
+    ...f.relativeDir ? { path: f.relativeDir } : {}
+  }));
+}
+function pairWithTargets(files, targets) {
+  if (files.length !== targets.length) {
+    throw new Error(
+      `The server returned ${targets.length} upload targets for ${files.length} files. Refusing to guess which is which.`
+    );
+  }
+  return files.map((file, i) => ({ file, target: targets[i] }));
+}
+function formatBytes(bytes) {
+  if (bytes < 1024) return `${bytes} B`;
+  const units = ["KB", "MB", "GB", "TB"];
+  let value = bytes / 1024;
+  let unit = 0;
+  while (value >= 1024 && unit < units.length - 1) {
+    value /= 1024;
+    unit++;
+  }
+  return `${value < 10 ? value.toFixed(1) : Math.round(value)} ${units[unit]}`;
+}
+
+// src/upload.ts
+import { createReadStream } from "node:fs";
+import { stat as stat2 } from "node:fs/promises";
+var CONCURRENCY = 3;
+async function uploadAll(files, endpoint, onProgress) {
+  const queue = [...files];
+  const workers = Array.from({ length: Math.min(CONCURRENCY, queue.length) }, async () => {
+    for (; ; ) {
+      const next = queue.shift();
+      if (!next) return;
+      await uploadOne(next, endpoint, onProgress);
+    }
+  });
+  await Promise.all(workers);
+  await clearUploadUrls(files.map((f) => f.target.id));
+}
+async function uploadOne(file, endpoint, onProgress) {
+  const tus = await import("tus-js-client");
+  const { size } = await stat2(file.path);
+  const urls = await readUploadUrls();
+  const uploadUrl = urls[file.target.id];
+  const started = Date.now();
+  await new Promise((resolve2, reject) => {
+    const upload = new tus.Upload(createReadStream(file.path), {
+      endpoint,
+      /**
+       * Reattach to an upload already in progress. The endpoint stays set as a
+       * fallback: if the upload was never actually created the HEAD 404s and
+       * tus falls back to a clean creation, which for zero progress is exactly
+       * right. Never re-POST one that *is* in progress — that restarts it with
+       * a fresh encryption key and abandons everything already sent.
+       */
+      ...uploadUrl ? { uploadUrl } : {},
+      uploadSize: size,
+      /**
+       * The token authorizes EVERY method, not just the creation POST — the
+       * server verifies HEAD, PATCH and DELETE too. Metadata below only reaches
+       * the server on the first POST, so it cannot carry the token alone.
+       */
+      headers: { "x-yungle-upload-token": file.target.uploadToken },
+      metadata: {
+        fileId: file.target.id,
+        token: file.target.uploadToken,
+        filename: file.target.name
+      },
+      retryDelays: [0, 1e3, 3e3, 5e3, 1e4, 3e4],
+      /**
+       * Persist the upload URL the moment the server hands one over, so a
+       * `kill -9` a second later still resumes. Waiting until the upload
+       * finishes would mean the state file only ever describes work that no
+       * longer needs it.
+       *
+       * `onUploadUrlAvailable` and `upload.url`, **not** `onAfterResponse` +
+       * `req.getURL()`: that returns the URL the request was *sent to*, which
+       * for the creation POST is the endpoint itself, not the `Location` the
+       * server answered with. The first version did that, and the symptom was
+       * an empty resume file with no error anywhere — a killed upload silently
+       * restarting from zero, which is the one thing this command exists to
+       * prevent.
+       */
+      onUploadUrlAvailable: () => {
+        const location = upload.url;
+        if (location && !urls[file.target.id]) {
+          urls[file.target.id] = location;
+          void saveUploadUrl(file.target.id, location);
+        }
+      },
+      onProgress: (sent, total) => {
+        const elapsed = Math.max(1, Date.now() - started) / 1e3;
+        onProgress({
+          id: file.target.id,
+          name: file.target.name,
+          sent,
+          total: total || size,
+          rate: sent / elapsed,
+          resumed: Boolean(uploadUrl)
+        });
+      },
+      onSuccess: () => resolve2(),
+      onError: (err) => reject(err)
+    });
+    upload.start();
+  });
+}
+
+// src/index.ts
+var HELP = `yungle \u2014 send and sync files with Yungle
+
+  yungle auth login                       save an API key
+  yungle auth status                      show which key is in use
+  yungle send <paths\u2026>                    send files, print the share link
+    --to <email>          recipient (repeatable, or comma-separated)
+    --message <text>      note for the recipients
+    --title <text>        label for your dashboard
+    --password <text>     recipients must enter this
+    --expires <days>      lifetime, clamped to your plan
+  yungle push <paths\u2026> --collection <id>  upload into a collection
+    --folder <id>         target folder
+  yungle ls transfers|collections|contacts
+  yungle rm transfer <id>                 revoke a transfer
+
+Global flags
+  --json                  machine-readable output
+  --url <base>            override the API base URL
+
+Credentials are read from YUNGLE_API_KEY, then ${CONFIG_PATH}.
+Docs: https://yungle.co/developers`;
+async function main(argv) {
+  let parsed;
+  try {
+    parsed = parseArgs(argv);
+  } catch (err) {
+    process.stderr.write(`${err.message}
+`);
+    return 2;
+  }
+  const { command, positionals, flags } = parsed;
+  const json = flags.json === true;
+  try {
+    switch (command) {
+      case "help":
+      case "--help":
+      case "-h":
+        process.stdout.write(`${HELP}
+`);
+        return 0;
+      case "auth":
+        return await auth(positionals, flags, json);
+      case "send":
+        return await send(positionals, flags, json);
+      case "push":
+        return await push(positionals, flags, json);
+      case "ls":
+        return await list(positionals, flags, json);
+      case "rm":
+        return await remove(positionals, flags, json);
+      default:
+        process.stderr.write(`Unknown command: ${command}
+
+${HELP}
+`);
+        return 2;
+    }
+  } catch (err) {
+    return fail(err, json);
+  }
+}
+async function auth(positionals, flags, json) {
+  const sub = positionals[0] ?? "status";
+  if (sub === "login") {
+    let key = stringFlag(flags.key);
+    if (!key) {
+      process.stderr.write(
+        `Create a key at https://yungle.co/dashboard/settings/api
+and paste it here.
+
+`
+      );
+      const rl = createInterface({ input: process.stdin, output: process.stderr });
+      key = (await rl.question("API key: ")).trim();
+      rl.close();
+    }
+    if (!key) {
+      process.stderr.write("No key given.\n");
+      return 2;
+    }
+    const client2 = new YungleClient({ apiKey: key, baseUrl: stringFlag(flags.url) });
+    const me = await client2.me();
+    const config = await readConfig();
+    await writeConfig({ ...config, apiKey: key, baseUrl: stringFlag(flags.url) ?? config.baseUrl });
+    return out(
+      json,
+      { ok: true, workspace: me.workspace.email, plan: me.plan.name, scopes: me.key.scopes },
+      `Signed in as ${me.workspace.email ?? me.workspace.id} (${me.plan.name ?? "free"}).
+Saved to ${CONFIG_PATH}`
+    );
+  }
+  if (sub === "status") {
+    const resolved = await resolveKey();
+    if (!resolved) {
+      return out(json, { authenticated: false }, "Not signed in. Run `yungle auth login`.", 1);
+    }
+    const me = await client(flags).me();
+    return out(
+      json,
+      { authenticated: true, source: resolved.source, ...me },
+      [
+        `Workspace: ${me.workspace.email ?? me.workspace.id}`,
+        `Plan:      ${me.plan.name ?? "free"}`,
+        `Storage:   ${formatBytes(me.plan.usedBytes)} of ${formatBytes(me.plan.quotaBytes)}`,
+        `Key:       ${me.key.name} (${me.key.scopes.join(", ")})`,
+        `Source:    ${resolved.source}`
+      ].join("\n")
+    );
+  }
+  process.stderr.write("Usage: yungle auth login | yungle auth status\n");
+  return 2;
+}
+async function send(paths, flags, json) {
+  if (paths.length === 0) {
+    process.stderr.write("Nothing to send. Give me one or more files or folders.\n");
+    return 2;
+  }
+  const api = client(flags);
+  const files = await collectFiles(paths);
+  if (files.length === 0) {
+    process.stderr.write("Those paths contained no files.\n");
+    return 2;
+  }
+  const total = files.reduce((n, f) => n + f.size, 0);
+  progress(`Sending ${files.length} file${files.length === 1 ? "" : "s"} \xB7 ${formatBytes(total)}
+`);
+  const key = sessionKey(files, "transfer");
+  const existing = await findSession(key);
+  let created;
+  if (existing && existing.kind === "transfer") {
+    progress("  resuming the interrupted upload\n");
+    created = {
+      transfer: { id: existing.targetId },
+      tusEndpoint: existing.tusEndpoint,
+      files: existing.files
+    };
+  } else {
+    const fresh = await api.createTransfer({
+      files: toFileInputs(files),
+      title: stringFlag(flags.title),
+      expiresInDays: numberFlag(flags.expires, "expires")
+    });
+    created = { transfer: fresh.transfer, tusEndpoint: fresh.tusEndpoint, files: fresh.files.map((f, i) => ({ ...f, path: files[i].path })) };
+    await saveSession(key, {
+      createdAt: Date.now(),
+      kind: "transfer",
+      targetId: fresh.transfer.id,
+      tusEndpoint: fresh.tusEndpoint,
+      files: created.files
+    });
+  }
+  await streamAll(files, created, api);
+  await dropSession(key);
+  const recipients = listFlag(flags.to);
+  const finalized = await api.finalizeTransfer(created.transfer.id, {
+    ...recipients.length ? { recipients } : {},
+    ...stringFlag(flags.message) ? { message: stringFlag(flags.message) } : {},
+    ...stringFlag(flags.password) ? { password: stringFlag(flags.password) } : {},
+    ...stringFlag(flags.title) ? { title: stringFlag(flags.title) } : {}
+  });
+  return out(
+    json,
+    {
+      id: finalized.transfer.id,
+      url: finalized.transfer.url,
+      expiresAt: finalized.transfer.expiresAt,
+      notified: finalized.notified
+    },
+    [
+      finalized.transfer.url,
+      finalized.notified.length ? `Emailed ${finalized.notified.join(", ")}` : "Link only \u2014 nobody was emailed."
+    ].join("\n")
+  );
+}
+async function push(paths, flags, json) {
+  const collectionId = stringFlag(flags.collection);
+  if (!collectionId) {
+    process.stderr.write("Which collection? Pass --collection <id>.\n");
+    return 2;
+  }
+  if (paths.length === 0) {
+    process.stderr.write("Nothing to push.\n");
+    return 2;
+  }
+  const api = client(flags);
+  const files = await collectFiles(paths);
+  if (files.length === 0) {
+    process.stderr.write("Those paths contained no files.\n");
+    return 2;
+  }
+  const total = files.reduce((n, f) => n + f.size, 0);
+  progress(`Uploading ${files.length} file${files.length === 1 ? "" : "s"} \xB7 ${formatBytes(total)}
+`);
+  const key = sessionKey(files, `collection:${collectionId}:${stringFlag(flags.folder) ?? ""}`);
+  const existing = await findSession(key);
+  let targets;
+  if (existing && existing.kind === "collection") {
+    progress("  resuming the interrupted upload\n");
+    targets = { tusEndpoint: existing.tusEndpoint, files: existing.files };
+  } else {
+    const fresh = await api.addCollectionFiles(
+      collectionId,
+      toFileInputs(files),
+      stringFlag(flags.folder) ?? null
+    );
+    targets = {
+      tusEndpoint: fresh.tusEndpoint,
+      files: fresh.files.map((f, i) => ({ ...f, path: files[i].path }))
+    };
+    await saveSession(key, {
+      createdAt: Date.now(),
+      kind: "collection",
+      targetId: collectionId,
+      tusEndpoint: fresh.tusEndpoint,
+      files: targets.files
+    });
+  }
+  await streamAll(files, targets, api);
+  await dropSession(key);
+  const collection = await api.getCollection(collectionId);
+  return out(
+    json,
+    { collection: collection.collection.id, uploaded: files.length, url: collection.collection.url },
+    `Uploaded ${files.length} file${files.length === 1 ? "" : "s"} to \u201C${collection.collection.title}\u201D.
+${collection.collection.url ?? ""}`
+  );
+}
+async function list(positionals, flags, json) {
+  const what = positionals[0] ?? "transfers";
+  const api = client(flags);
+  if (what === "transfers") {
+    const { transfers } = await api.listTransfers();
+    return out(
+      json,
+      { transfers },
+      transfers.length === 0 ? "No transfers yet." : transfers.map(
+        (t) => `${t.id}  ${pad(t.title ?? t.firstFileName ?? "(untitled)", 32)} ${pad(formatBytes(t.sizeBytes), 9)} ${t.downloadCount} dl  ${t.url}`
+      ).join("\n")
+    );
+  }
+  if (what === "collections") {
+    const { collections } = await api.listCollections();
+    return out(
+      json,
+      { collections },
+      collections.length === 0 ? "No collections yet." : collections.map(
+        (c) => `${c.id}  ${pad(c.title, 32)} ${pad(`${c.fileCount} files`, 12)} ${formatBytes(c.sizeBytes)}`
+      ).join("\n")
+    );
+  }
+  if (what === "contacts") {
+    const { contacts } = await api.listContacts();
+    return out(
+      json,
+      { contacts },
+      contacts.length === 0 ? "No contacts yet." : contacts.map((c) => `${c.id}  ${pad([c.firstName, c.lastName].filter(Boolean).join(" ") || "\u2014", 24)} ${c.email}`).join("\n")
+    );
+  }
+  process.stderr.write("Usage: yungle ls transfers|collections|contacts\n");
+  return 2;
+}
+async function remove(positionals, flags, json) {
+  const [what, id] = positionals;
+  if (what !== "transfer" || !id) {
+    process.stderr.write("Usage: yungle rm transfer <id>\n");
+    return 2;
+  }
+  const { transfer } = await client(flags).revokeTransfer(id);
+  return out(
+    json,
+    { id: transfer.id, status: transfer.status },
+    `Revoked. The link no longer works and the content is unrecoverable.`
+  );
+}
+function client(flags) {
+  const apiKey = process.env.YUNGLE_API_KEY?.trim() ?? cachedKey;
+  if (!apiKey) throw new NotSignedIn();
+  return new YungleClient({ apiKey, baseUrl: stringFlag(flags.url) ?? cachedBaseUrl });
+}
+var NotSignedIn = class extends Error {
+  constructor() {
+    super("Not signed in. Run `yungle auth login`, or set YUNGLE_API_KEY.");
+    this.name = "NotSignedIn";
+  }
+};
+var cachedKey;
+var cachedBaseUrl;
+async function loadCredentials() {
+  const resolved = await resolveKey();
+  cachedKey = resolved?.apiKey;
+  cachedBaseUrl = resolved?.baseUrl;
+}
+async function streamAll(files, targets, _api) {
+  const paired = pairWithTargets(files, targets.files);
+  const totalBytes = paired.reduce((n, { file }) => n + file.size, 0);
+  const sentPer = /* @__PURE__ */ new Map();
+  const finished = /* @__PURE__ */ new Set();
+  const started = Date.now();
+  let anyResumed = false;
+  const render = () => {
+    let sent = 0;
+    for (const value of sentPer.values()) sent += value;
+    const pct = totalBytes ? Math.floor(sent / totalBytes * 100) : 100;
+    const rate = sent / Math.max(1, (Date.now() - started) / 1e3);
+    progress(
+      `\r  ${String(pct).padStart(3)}%  ${pad(`${formatBytes(sent)} of ${formatBytes(totalBytes)}`, 22)}${pad(`${formatBytes(rate)}/s`, 12)}${finished.size}/${paired.length} files${anyResumed ? "  (resumed)" : ""}   `
+    );
+  };
+  await uploadAll(
+    paired.map(({ file, target }) => ({ path: file.path, target })),
+    targets.tusEndpoint,
+    (p) => {
+      if (p.resumed) anyResumed = true;
+      sentPer.set(p.id, p.sent);
+      if (p.sent >= p.total) finished.add(p.id);
+      render();
+    }
+  );
+  render();
+  progress("\n");
+}
+function progress(text) {
+  if (process.stderr.isTTY) process.stderr.write(text);
+}
+function pad(text, width) {
+  return text.length > width ? `${text.slice(0, width - 1)}\u2026` : text.padEnd(width);
+}
+function out(json, data, human, code = 0) {
+  process.stdout.write(json ? `${JSON.stringify(data, null, 2)}
+` : `${human}
+`);
+  return code;
+}
+function fail(err, json) {
+  if (err instanceof YungleApiError) {
+    if (json) {
+      process.stdout.write(`${JSON.stringify({ error: { code: err.code, message: err.message, details: err.details } }, null, 2)}
+`);
+    } else {
+      process.stderr.write(`${err.message}
+`);
+      if (err.code === "upgrade_required") {
+        process.stderr.write("See https://yungle.co/dashboard/settings/plan\n");
+      }
+    }
+    return 1;
+  }
+  const message = err instanceof Error ? err.message : String(err);
+  if (json) process.stdout.write(`${JSON.stringify({ error: { code: "cli_error", message } }, null, 2)}
+`);
+  else process.stderr.write(`${message}
+`);
+  return 1;
+}
+export {
+  loadCredentials,
+  main
+};
+await loadCredentials();
+process.exit(await main(process.argv.slice(2)));

package/package.json

@@ -0,0 +1,56 @@
+{
+  "name": "yungle-cli",
+  "version": "0.1.0",
+  "type": "module",
+  "description": "Send and sync files with Yungle from the command line.",
+  "bin": {
+    "yungle": "./dist/yungle.mjs"
+  },
+  "exports": {
+    ".": "./src/index.ts"
+  },
+  "scripts": {
+    "build": "node build.mjs",
+    "typecheck": "tsc --noEmit",
+    "test": "node --import tsx --test src/*.test.ts",
+    "lint": "eslint .",
+    "dev": "node --import tsx bin/yungle.mjs",
+    "prepublishOnly": "node build.mjs"
+  },
+  "dependencies": {
+    "tus-js-client": "^4.3.1"
+  },
+  "devDependencies": {
+    "@types/node": "^22.10.5",
+    "esbuild": "^0.28.1",
+    "tsx": "^4.19.2",
+    "typescript": "^5.7.3",
+    "@yungle/api-client": "workspace:*"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "keywords": [
+    "yungle",
+    "file-transfer",
+    "cli",
+    "upload",
+    "tus",
+    "resumable"
+  ],
+  "license": "MIT",
+  "author": "Hein de Wilde",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/heindewilde/yungle.git"
+  },
+  "homepage": "https://yungle.co/developers",
+  "bugs": {
+    "url": "https://github.com/heindewilde/yungle/issues"
+  },
+  "engines": {
+    "node": ">=22"
+  }
+}