yungle-cli 0.2.1 → 0.3.0

package/dist/yungle.mjs

@@ -161,25 +161,213 @@ var require_src = __commonJS({
 import { isAbsolute, join as join6, relative as relative2, resolve as resolve3 } from "node:path";
 
 // ../../packages/api-client/dist/index.mjs
+var MIN_RENEW_DELAY_MS = 6e4;
+var RETRY_DELAY_MS = 6e4;
+function tokenExpiry(token) {
+  const dot = token.indexOf(".");
+  if (dot <= 0) return null;
+  try {
+    const b642 = token.slice(0, dot).replace(/-/g, "+").replace(/_/g, "/");
+    const json = atob(b642);
+    const exp = JSON.parse(json).exp;
+    return typeof exp === "number" ? exp : null;
+  } catch {
+    return null;
+  }
+}
+function renewDelayMs(expiresAt, now) {
+  return Math.max(MIN_RENEW_DELAY_MS, Math.floor((expiresAt - now) / 2));
+}
+function createTokenKeeper(initial, deps) {
+  const now = deps.now ?? (() => Date.now());
+  const setTimer = deps.setTimer ?? ((fn, ms) => setTimeout(fn, ms));
+  const clearTimer = deps.clearTimer ?? ((h2) => clearTimeout(h2));
+  let token = initial;
+  let expiresAt = tokenExpiry(initial);
+  let stopped = false;
+  let handle = null;
+  const schedule = (ms) => {
+    if (stopped) return;
+    handle = setTimer(() => void attempt(), ms);
+  };
+  const attempt = async () => {
+    if (stopped) return;
+    let outcome;
+    try {
+      outcome = await deps.renew(token);
+    } catch {
+      outcome = "retry";
+    }
+    if (stopped) return;
+    if (outcome === "final") {
+      stopped = true;
+      return;
+    }
+    if (outcome === "retry") {
+      if (expiresAt !== null && now() >= expiresAt) {
+        stopped = true;
+        return;
+      }
+      schedule(RETRY_DELAY_MS);
+      return;
+    }
+    token = outcome.token;
+    expiresAt = outcome.expiresAt;
+    schedule(renewDelayMs(expiresAt, now()));
+  };
+  schedule(expiresAt === null ? 60 * 6e4 : renewDelayMs(expiresAt, now()));
+  return {
+    current: () => token,
+    stop: () => {
+      stopped = true;
+      if (handle !== null) clearTimer(handle);
+    }
+  };
+}
+async function renewUploadToken(origin, current, doFetch = globalThis.fetch.bind(globalThis)) {
+  const res = await doFetch(`${origin.replace(/\/+$/, "")}/api/uploads/token`, {
+    method: "POST",
+    headers: { "x-yungle-upload-token": current }
+  });
+  if (res.status === 401 || res.status === 404) return "final";
+  if (!res.ok) return "retry";
+  const body = await res.json();
+  return { token: body.uploadToken, expiresAt: Date.parse(body.expiresAt) };
+}
+var MiB = 1024 * 1024;
+function chunkSize(size) {
+  return Math.max(64 * MiB, (Math.floor(size / (9e3 * MiB)) + 2) * MiB);
+}
+var UploadError = class extends Error {
+  constructor(message, status2) {
+    super(message);
+    this.status = status2;
+    this.name = "UploadError";
+  }
+  status;
+};
+function transient(status2) {
+  return status2 === 0 || status2 === 408 || status2 === 409 || status2 === 423 || status2 === 429 || status2 >= 500;
+}
+var b64 = (s) => {
+  const bytes = new TextEncoder().encode(s);
+  let bin = "";
+  for (const b of bytes) bin += String.fromCharCode(b);
+  return btoa(bin);
+};
+async function uploadFile(o2) {
+  const doFetch = o2.fetch ?? globalThis.fetch.bind(globalThis);
+  const size = o2.source.size;
+  const delays = o2.retryDelaysMs ?? [0, 1e3, 3e3, 5e3, 1e4, 3e4];
+  const keeper = o2.renew ? createTokenKeeper(o2.target.uploadToken, {
+    renew: async (t2) => {
+      const outcome = await o2.renew(t2);
+      if (typeof outcome === "object") o2.onToken?.(outcome.token);
+      return outcome;
+    }
+  }) : null;
+  const auth = () => ({ "Tus-Resumable": "1.0.0", "x-yungle-upload-token": keeper?.current() ?? o2.target.uploadToken });
+  const request = async (url, init) => {
+    let res;
+    try {
+      res = await doFetch(url, { ...init, signal: o2.signal });
+    } catch (err) {
+      if (o2.signal?.aborted) throw err;
+      throw new UploadError(`Connection failed: ${err.message}`, 0);
+    }
+    if (!res.ok) throw new UploadError(`Upload of ${o2.target.name} got HTTP ${res.status}.`, res.status);
+    return res;
+  };
+  const head = async (url) => Number((await request(url, { method: "HEAD", headers: auth() })).headers.get("upload-offset") ?? 0);
+  try {
+    let url = o2.uploadUrl;
+    let offset = 0;
+    if (url) {
+      try {
+        offset = await head(url);
+      } catch (err) {
+        if (!(err instanceof UploadError && err.status === 404)) throw err;
+        url = void 0;
+      }
+    }
+    if (!url) {
+      const created = await request(o2.endpoint, {
+        method: "POST",
+        headers: {
+          ...auth(),
+          "Upload-Length": String(size),
+          "Upload-Metadata": `fileId ${b64(o2.target.id)},token ${b64(o2.target.uploadToken)},filename ${b64(o2.target.name)}`
+        }
+      });
+      url = new URL(created.headers.get("location") ?? "", o2.endpoint).toString();
+      o2.onUploadUrl?.(url);
+    }
+    o2.onProgress?.(offset, size);
+    const step = chunkSize(size);
+    let failures = 0;
+    let stalls = 0;
+    while (offset < size) {
+      try {
+        const res = await request(url, {
+          method: "PATCH",
+          headers: { ...auth(), "Upload-Offset": String(offset), "Content-Type": "application/offset+octet-stream" },
+          body: o2.source.slice(offset, Math.min(size, offset + step))
+        });
+        const next2 = Number(res.headers.get("upload-offset"));
+        if (!(next2 > offset)) {
+          if (++stalls > 3) throw new UploadError(`Upload of ${o2.target.name} made no progress.`, res.status);
+        } else stalls = 0;
+        offset = next2;
+        failures = 0;
+        o2.onProgress?.(offset, size);
+      } catch (err) {
+        if (o2.signal?.aborted) throw err;
+        if (!(err instanceof UploadError) || !transient(err.status) || failures >= delays.length) throw err;
+        await new Promise((r2) => setTimeout(r2, delays[failures++]));
+        try {
+          offset = await head(url);
+        } catch (headErr) {
+          if (!(headErr instanceof UploadError) || !transient(headErr.status)) throw headErr;
+        }
+      }
+    }
+    return { uploadUrl: url };
+  } finally {
+    keeper?.stop();
+  }
+}
 var YungleApiError = class extends Error {
-  constructor(status2, code, message, details) {
+  constructor(status2, code, message, details, extras = {}) {
     super(message);
     this.status = status2;
     this.code = code;
     this.details = details;
     this.name = "YungleApiError";
+    if (extras.docs !== void 0) this.docs = extras.docs;
+    if (extras.retryAfterHeader !== void 0) this.retryAfterHeader = extras.retryAfterHeader;
   }
   status;
   code;
   details;
+  /** Where `code` is explained, with what to do about it. Absent on older servers. */
+  docs;
+  retryAfterHeader;
   /** Worth trying again: throttled, or our fault. */
   get retryable() {
     return this.status === 429 || this.status >= 500;
   }
-  /** Seconds to wait, when the server said. */
+  /**
+   * Seconds to wait, when the server said — in the body's
+   * `details.retryAfterSeconds` or, failing that, the `Retry-After` header.
+   *
+   * The header matters on its own: the monthly-allowance 429 states its wait
+   * (an hour) only there, and reading the body alone sent clients back in half
+   * a second to be refused again.
+   */
   get retryAfterSeconds() {
     const value = this.details?.retryAfterSeconds;
-    return typeof value === "number" ? value : null;
+    if (typeof value === "number") return value;
+    return this.retryAfterHeader ?? null;
   }
 };
 var DEFAULT_BASE = "https://yungle.co/api/v1";
@@ -190,7 +378,7 @@ function pageQuery(page, extra = {}) {
   const q = params.toString();
   return q ? `?${q}` : "";
 }
-var CLIENT_VERSION = true ? "0.2.1" : "dev";
+var CLIENT_VERSION = true ? "0.3.0" : "dev";
 var YungleClient = class {
   baseUrl;
   apiKey;
@@ -205,6 +393,27 @@ var YungleClient = class {
     this.maxRetries = options.maxRetries ?? 3;
     this.userAgent = options.userAgent ?? `yungle-client/${CLIENT_VERSION}`;
   }
+  /** The site root this client talks to (`https://yungle.co`), for the few endpoints outside `/api/v1`. */
+  get origin() {
+    return this.baseUrl.replace(/\/api\/v1$/, "");
+  }
+  /**
+   * Trade a still-valid upload token for a fresh one (two more hours). Returns
+   * `'final'` when the token is dead or the upload finished, `'retry'` on a
+   * transient failure. `createTokenKeeper(token, { renew: (t) => client.renewUploadToken(t) })`
+   * schedules this for you.
+   */
+  renewUploadToken(token) {
+    return renewUploadToken(this.origin, token, this.doFetch);
+  }
+  /**
+   * Upload one file to a target from `createTransfer` / `addTransferFiles` /
+   * `addCollectionFiles`: resumable, retried, and with its token renewed for
+   * as long as it runs. In Node, pass `await fs.openAsBlob(path)` as `source`.
+   */
+  uploadFile(tusEndpoint, target, source, opts = {}) {
+    return uploadFile({ ...opts, endpoint: tusEndpoint, target, source, renew: (t2) => this.renewUploadToken(t2), fetch: this.doFetch });
+  }
   // ── Account ───────────────────────────────────────────────────────────────
   me() {
     return this.request("GET", "/me");
@@ -230,6 +439,10 @@ var YungleClient = class {
   /**
    * Create a draft. Nothing is live and nobody is emailed until `finalizeTransfer`.
    */
+  /**
+   * A draft transfer. `files` are uploaded by you (tus, to the returned
+   * targets); `imports` are fetched by Yungle from URLs. Send either or both.
+   */
   createTransfer(input) {
     return this.request("POST", "/transfers", input);
   }
@@ -245,8 +458,32 @@ var YungleClient = class {
   finalizeTransfer(id, input = {}) {
     return this.request("POST", `/transfers/${enc(id)}/finalize`, input, { idempotent: true });
   }
-  addTransferFiles(id, files) {
-    return this.request("POST", `/transfers/${enc(id)}/files`, { files });
+  /**
+   * End-to-end encrypted transfers only: a file's sealed `{ name, path, size,
+   * type }` and/or thumbnail, from `yungle-e2e`. Called after the file exists,
+   * because each blob binds the file's id.
+   */
+  sealTransferFile(id, fileId, sealed) {
+    return this.request("POST", `/transfers/${enc(id)}/files/${enc(fileId)}/sealed`, sealed, { idempotent: true });
+  }
+  addTransferFiles(id, files, imports) {
+    return this.request("POST", `/transfers/${enc(id)}/files`, { files, ...imports?.length ? { imports } : {} });
+  }
+  /** Where a URL import stands: `importing` (with `receivedBytes`), `ready` or `failed`. */
+  getImport(fileId) {
+    return this.request("GET", `/imports/${enc(fileId)}`);
+  }
+  /**
+   * Poll `getImport` until every import is `ready` or `failed`, every
+   * `intervalMs` (default 5 s). Resolves with the final statuses; never throws
+   * for a failed import — check `status`.
+   */
+  async waitForImports(fileIds, intervalMs = 5e3) {
+    for (; ; ) {
+      const all = await Promise.all(fileIds.map((id) => this.getImport(id)));
+      if (all.every((s) => s.status !== "importing")) return all;
+      await sleep(intervalMs);
+    }
   }
   removeTransferFile(id, fileId) {
     return this.request("DELETE", `/transfers/${enc(id)}/files/${enc(fileId)}`);
@@ -258,6 +495,22 @@ var YungleClient = class {
   revokeTransfer(id) {
     return this.request("DELETE", `/transfers/${enc(id)}`);
   }
+  /**
+   * Signed download URLs for your own transfer. Fetching them is not a
+   * recipient download — it never appears in receipts. Throws
+   * `e2ee_unsupported` for an end-to-end encrypted transfer.
+   */
+  transferDownloadLinks(id) {
+    return this.request("GET", `/transfers/${enc(id)}/download-links`);
+  }
+  /**
+   * A link someone shared with you (`…/t/…` or `…/c/…`), as signed download
+   * URLs — what a person opening it in a browser could download, under the same
+   * rules. Pass `password` for a protected link. Any key works, free included.
+   */
+  resolveLink(url, password2) {
+    return this.request("POST", "/links/resolve", { url, ...password2 ? { password: password2 } : {} });
+  }
   transferDownloads(id) {
     return this.request("GET", `/transfers/${enc(id)}/downloads`);
   }
@@ -268,6 +521,13 @@ var YungleClient = class {
   createCollection(input) {
     return this.request("POST", "/collections", input);
   }
+  /**
+   * Signed download URLs for your own collection: every file with its folder
+   * `path`, and a whole-collection ZIP. The URLs need no key and support `Range`.
+   */
+  collectionDownloadLinks(id) {
+    return this.request("GET", `/collections/${enc(id)}/download-links`);
+  }
   getCollection(id) {
     return this.request("GET", `/collections/${enc(id)}`);
   }
@@ -295,8 +555,8 @@ var YungleClient = class {
       cursor3 = page.nextCursor ?? void 0;
     } while (cursor3);
   }
-  addCollectionFiles(id, files, folderId) {
-    return this.request("POST", `/collections/${enc(id)}/files`, { files, folderId });
+  addCollectionFiles(id, files, folderId, imports) {
+    return this.request("POST", `/collections/${enc(id)}/files`, { files, folderId, ...imports?.length ? { imports } : {} });
   }
   deleteCollectionFiles(id, fileIds) {
     return this.request("DELETE", `/collections/${enc(id)}/files`, { fileIds });
@@ -352,6 +612,26 @@ var YungleClient = class {
   listWebhookEvents(id, page = {}) {
     return this.request("GET", `/webhooks/${enc(id)}/events${pageQuery(page)}`);
   }
+  // ── Upload requests ───────────────────────────────────────────────────────
+  /** Your upload links, newest first (up to 100). */
+  listRequests() {
+    return this.request("GET", "/requests");
+  }
+  /**
+   * A public page where anyone with the link can upload into one of your
+   * collections. Subscribe to the `request.submitted` webhook to hear about
+   * each finished submission.
+   */
+  createRequest(input) {
+    return this.request("POST", "/requests", input);
+  }
+  getRequest(id) {
+    return this.request("GET", `/requests/${enc(id)}`);
+  }
+  /** `paused` stops uploads until set back to `active`; `closed` stops them for good. */
+  setRequestStatus(id, status2) {
+    return this.request("PATCH", `/requests/${enc(id)}`, { status: status2 });
+  }
   // ── Contacts ──────────────────────────────────────────────────────────────
   listContacts() {
     return this.request("GET", "/contacts");
@@ -412,13 +692,27 @@ async function toError(res) {
   } catch {
   }
   const err = body?.error;
+  const retryAfterHeader = parseRetryAfter(res.headers.get("retry-after"));
   return new YungleApiError(
     res.status,
     err?.code ?? "http_error",
     err?.message ?? `Request failed with status ${res.status}.`,
-    err?.details
+    err?.details,
+    {
+      ...typeof err?.docs === "string" ? { docs: err.docs } : {},
+      ...retryAfterHeader === null ? {} : { retryAfterHeader }
+    }
   );
 }
+function parseRetryAfter(value, now = Date.now()) {
+  if (value === null) return null;
+  const trimmed = value.trim();
+  if (/^\d+$/.test(trimmed)) return Number(trimmed);
+  const at = Date.parse(trimmed);
+  if (Number.isNaN(at)) return null;
+  const seconds = Math.ceil((at - now) / 1e3);
+  return seconds >= 0 ? seconds : null;
+}
 function backoffMs(attempt, error) {
   const stated = error.retryAfterSeconds;
   if (stated !== null) return stated * 1e3;
@@ -436,6 +730,7 @@ var VALUE_FLAGS = /* @__PURE__ */ new Set([
   "password",
   "expires",
   "collection",
+  "transfer",
   "folder",
   "out",
   "url",
@@ -447,8 +742,11 @@ var VALUE_FLAGS = /* @__PURE__ */ new Set([
   // `helpFlagsAreParsed` in args.test.ts now derives this from HELP.
   "client",
   "forward-to",
-  "interval"
+  "interval",
+  "from-url",
+  "target"
 ]);
+var REPEATABLE = /* @__PURE__ */ new Set(["to", "from-url"]);
 var OPTIONAL_VALUE = /* @__PURE__ */ new Set(["key"]);
 function parseArgs(argv) {
   const [command = "help", ...rest] = argv;
@@ -464,7 +762,10 @@ function parseArgs(argv) {
       const body = token.slice(2);
       const eq = body.indexOf("=");
       if (eq >= 0) {
-        flags[body.slice(0, eq)] = body.slice(eq + 1);
+        const name = body.slice(0, eq);
+        const prior = flags[name];
+        flags[name] = REPEATABLE.has(name) && typeof prior === "string" ? `${prior}
+${body.slice(eq + 1)}` : body.slice(eq + 1);
         continue;
       }
       if (VALUE_FLAGS.has(body)) {
@@ -476,7 +777,9 @@ function parseArgs(argv) {
           }
           throw new Error(`--${body} needs a value.`);
         }
-        flags[body] = value;
+        const prior = flags[body];
+        flags[body] = REPEATABLE.has(body) && typeof prior === "string" ? `${prior}
+${value}` : value;
         i2++;
         continue;
       }
@@ -489,7 +792,11 @@ function parseArgs(argv) {
 }
 function listFlag(value) {
   if (typeof value !== "string") return [];
-  return value.split(",").map((s) => s.trim()).filter(Boolean);
+  return value.split(/[\n,]/).map((s) => s.trim()).filter(Boolean);
+}
+function urlListFlag(value) {
+  if (typeof value !== "string") return [];
+  return value.split("\n").map((s) => s.trim()).filter(Boolean);
 }
 function numberFlag(value, name) {
   if (value === void 0 || typeof value === "boolean") return void 0;
@@ -701,15 +1008,17 @@ Get started
 
 Send and receive
   yungle send <paths\u2026>                    send files or folders, print the link
+    --from-url <url>      also send a file Yungle fetches from a URL (repeatable)
     --to <email>          recipient (repeatable, or comma-separated)
     --message <text>      note for the recipients
     --title <text>        label for your dashboard
     --password <text>     recipients must enter this
     --expires <days>      lifetime, clamped to your plan
-  yungle get <link>                       download a transfer sent to you
+  yungle get <link>                       download a transfer or collection shared with you
     --out <dir>           where to save (default: current directory)
     --zip                 one zip instead of separate files
     --password <text>     for a protected link; asks if left out
+  yungle put <file> --target <target>     upload one file to a target an assistant prepared
   yungle status [<id|link>]               who downloaded a transfer
   yungle transfers                        list your recent transfers
   yungle revoke <id>                      stop a transfer's link for good
@@ -717,10 +1026,19 @@ Send and receive
 Collections
   yungle push <paths\u2026> --collection <id>  upload into a collection
     --folder <id>         target folder
+    --from-url <url>      also add a file Yungle fetches from a URL (repeatable)
+  yungle pull --collection <id>           download your collection, folders kept
+    --transfer <id>       download your own transfer instead
+    --out <dir>           where to save (default: the collection's title)
+    --zip                 one zip instead of separate files
   yungle watch <dir> --collection <id>    keep uploading new files as they appear
     --interval <seconds>  how often to look (default 10)
     --existing            also upload what is already in the folder
   yungle collections                      list your collections
+  yungle requests                         list upload links that feed your collections
+  yungle requests new --collection <id>   make one, and print the link to give people
+    --title <text>        shown on the upload page
+  yungle requests pause|resume|close <id> stop or restart uploads through one
   yungle contacts                         list your contacts
 
 In the browser
@@ -750,12 +1068,15 @@ var COMMANDS = [
   "logout",
   "send",
   "get",
+  "put",
   "status",
   "transfers",
   "revoke",
   "push",
+  "pull",
   "watch",
   "collections",
+  "requests",
   "contacts",
   "open",
   "webhooks",
@@ -785,11 +1106,13 @@ function resolveAlias(argv) {
 var EXAMPLES = {
   login: ["yungle login", "yungle login --key            # on a server: paste a key from Settings \u2192 API keys"],
   send: [
+    "yungle send --from-url https://example-bucket.s3.eu-central-1.amazonaws.com/render.mov?X-Amz-Signature=\u2026 --to client@example.com",
     'yungle send ~/Shoot --to anna@studio.nl --message "Final selects"',
     "yungle send report.pdf                        # just a link, nobody emailed",
     "yungle send dist/ --json | jq -r .url         # in a script"
   ],
   get: ["yungle get https://yungle.co/t/emerald-palm-a5mt", "yungle get <link> --zip --out ~/Downloads"],
+  pull: ["yungle pull --collection 01JABC\u2026 --out ./wedding", "yungle pull --transfer 01JABD\u2026"],
   status: ["yungle status                                 # pick from your recent transfers", "yungle status https://yungle.co/t/emerald-palm-a5mt"],
   push: ["yungle push ~/Shoot --collection 01J8Z3M9Q0W4", "yungle push raw/ --collection 01J8Z3M9Q0W4 --folder 01J8Z4AB"],
   watch: ["yungle watch ~/Renders --collection 01J8Z3M9Q0W4", "yungle watch /Volumes/CARD --collection 01J8Z3M9Q0W4 --interval 30"],
@@ -960,7 +1283,7 @@ async function readSessions() {
     const now = Date.now();
     const live = {};
     for (const [key, session] of Object.entries(parsed)) {
-      if (session && now - session.createdAt < SESSION_TTL_MS) live[key] = session;
+      if (session && now - (session.touchedAt ?? session.createdAt) < SESSION_TTL_MS) live[key] = session;
     }
     return live;
   } catch {
@@ -976,6 +1299,16 @@ async function saveSession(key, session) {
   await mkdir(dirname(RESUME_PATH), { recursive: true, mode: 448 });
   await writeFile(RESUME_PATH, JSON.stringify(sessions), { mode: 384 });
 }
+async function saveRenewedToken(key, fileId, uploadToken) {
+  const sessions = await readSessions();
+  const session = sessions[key];
+  const file = session?.files.find((f) => f.id === fileId);
+  if (!session || !file) return;
+  file.uploadToken = uploadToken;
+  session.touchedAt = Date.now();
+  await mkdir(dirname(RESUME_PATH), { recursive: true, mode: 448 });
+  await writeFile(RESUME_PATH, JSON.stringify(sessions), { mode: 384 });
+}
 async function dropSession(key) {
   const sessions = await readSessions();
   if (!(key in sessions)) return;
@@ -1010,6 +1343,123 @@ async function clearUploadUrls(fileIds) {
   if (changed) await writeFile(URL_PATH, JSON.stringify(current), { mode: 384 });
 }
 
+// src/get.ts
+import { createReadStream, createWriteStream } from "node:fs";
+import { mkdir as mkdir2, rename, stat as stat2 } from "node:fs/promises";
+import { basename as basename2, join as join3 } from "node:path";
+import { Readable } from "node:stream";
+import { pipeline } from "node:stream/promises";
+var SLUG = /^[A-Za-z0-9_-]{8,128}$/;
+function parseTransferLink(input, defaultOrigin) {
+  const text2 = input.trim();
+  if (SLUG.test(text2)) return { origin: defaultOrigin, kind: "t", slug: text2, recipient: null, hasKey: false };
+  let url;
+  try {
+    url = new URL(text2);
+  } catch {
+    throw new Error(`Not a Yungle link: ${text2}`);
+  }
+  const m = url.pathname.match(/^\/(t|c)\/([^/]+)\/?$/);
+  if (!m || !SLUG.test(m[2])) throw new Error(`Not a Yungle link: ${text2}`);
+  return {
+    origin: url.origin,
+    kind: m[1],
+    slug: m[2],
+    recipient: m[1] === "t" ? url.searchParams.get("r") : null,
+    hasKey: url.hash.length > 1
+  };
+}
+function safeRelativeDir(path) {
+  if (!path) return "";
+  return path.replace(/\\/g, "/").split("/").filter((seg) => seg && seg !== "." && seg !== "..").map(safeFileName).join("/");
+}
+function dedupePaths(entries) {
+  const byDir = /* @__PURE__ */ new Map();
+  entries.forEach((e2, i2) => byDir.set(e2.dir.toLowerCase(), [...byDir.get(e2.dir.toLowerCase()) ?? [], i2]));
+  const out2 = new Array(entries.length);
+  for (const idx of byDir.values()) {
+    const names = dedupeNames(idx.map((i2) => entries[i2].name));
+    idx.forEach((i2, k) => {
+      out2[i2] = entries[i2].dir ? `${entries[i2].dir}/${names[k]}` : names[k];
+    });
+  }
+  return out2;
+}
+function safeFileName(name) {
+  const last = basename2(name.replace(/\\/g, "/"));
+  const cleaned = last.replace(/[\x00-\x1f<>:"|?*]/g, "_").replace(/^\.+$/, "_").trim();
+  return cleaned || "file";
+}
+function dedupeNames(names) {
+  const used = /* @__PURE__ */ new Set();
+  return names.map((name) => {
+    let candidate = name;
+    const dot = name.lastIndexOf(".");
+    const [stem, ext] = dot > 0 ? [name.slice(0, dot), name.slice(dot)] : [name, ""];
+    for (let n3 = 2; used.has(candidate.toLowerCase()); n3++) candidate = `${stem} (${n3})${ext}`;
+    used.add(candidate.toLowerCase());
+    return candidate;
+  });
+}
+function resumeFrom(partialBytes, expectedSize) {
+  if (partialBytes <= 0 || partialBytes >= expectedSize) return null;
+  return partialBytes;
+}
+var ManifestError = class extends Error {
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+    this.name = "ManifestError";
+  }
+  code;
+};
+async function fetchManifest(link, password2, userAgent) {
+  const res = await fetch(`${link.origin}/api/${link.kind}/${encodeURIComponent(link.slug)}/manifest`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json", "User-Agent": userAgent },
+    body: JSON.stringify({ ...password2 ? { password: password2 } : {}, ...link.recipient ? { r: link.recipient } : {} })
+  });
+  const body = await res.json().catch(() => null);
+  if (!res.ok || !body || body.error) {
+    const code = body?.error?.code ?? `http_${res.status}`;
+    const message = code === "not_found" ? `No such ${link.kind === "c" ? "collection" : "transfer"}. Check the link, or it may have been deleted.` : body?.error?.message ?? `The server answered ${res.status}.`;
+    throw new ManifestError(code, message);
+  }
+  return body;
+}
+async function fileCrc32(path) {
+  const zlib = await import("node:zlib");
+  const crc32 = zlib.crc32;
+  if (typeof crc32 !== "function") return null;
+  let value = 0;
+  for await (const chunk of createReadStream(path, { highWaterMark: 4 * 1024 * 1024 })) value = crc32(chunk, value);
+  return value.toString(16).padStart(8, "0");
+}
+async function downloadTo(url, dest, expectedSize, userAgent, onBytes) {
+  await mkdir2(join3(dest, ".."), { recursive: true });
+  const part = `${dest}.part`;
+  const have = await stat2(part).then((s) => s.size, () => 0);
+  const from = expectedSize === null ? null : resumeFrom(have, expectedSize);
+  const res = await fetch(url, {
+    headers: { "User-Agent": userAgent, ...from !== null ? { Range: `bytes=${from}-` } : {} }
+  });
+  if (res.status === 410) throw new ManifestError("expired", "The transfer expired, was revoked, or reached its download limit.");
+  if (!res.ok || !res.body) throw new ManifestError(`http_${res.status}`, `Download failed with ${res.status}.`);
+  const appending = from !== null && res.status === 206;
+  if (appending) onBytes(from);
+  const counter = new TransformStream({
+    transform(chunk, controller) {
+      onBytes(chunk.byteLength);
+      controller.enqueue(chunk);
+    }
+  });
+  await pipeline(
+    Readable.fromWeb(res.body.pipeThrough(counter)),
+    createWriteStream(part, { flags: appending ? "a" : "w" })
+  );
+  await rename(part, dest);
+}
+
 // src/errors.ts
 var CliError = class extends Error {
   constructor(message, hint, code = "cli_error", exitCode = 1) {
@@ -1029,7 +1479,8 @@ var NotSignedIn = class extends CliError {
   }
 };
 function explain(err) {
-  if (err instanceof CliError) return { message: err.message, hint: err.hint, code: err.code };
+  if (err instanceof CliError) return { message: err.message, hint: err.hint, code: err.code, exitCode: err.exitCode };
+  if (err instanceof ManifestError) return { message: err.message, code: err.code };
   if (err instanceof YungleApiError) {
     const base = { code: err.code, details: err.details };
     switch (err.code) {
@@ -1056,6 +1507,8 @@ function explain(err) {
         };
       case "not_found":
         return { ...base, message: err.message, hint: "yungle transfers   (list what you have)" };
+      case "e2ee_unsupported":
+        return { ...base, message: err.message, hint: "Open the link in a browser; only it holds the key." };
       case "email_budget_exhausted":
         return { ...base, message: err.message, hint: "Share the link yourself; the transfer is live." };
       default:
@@ -1102,95 +1555,22 @@ function suggest(word, known) {
   return best !== null && bestD <= Math.max(1, Math.floor(best.length / 3)) ? best : null;
 }
 
-// src/get.ts
-import { createWriteStream } from "node:fs";
-import { mkdir as mkdir2, rename, stat as stat2 } from "node:fs/promises";
-import { basename as basename2, join as join3 } from "node:path";
-import { Readable } from "node:stream";
-import { pipeline } from "node:stream/promises";
-var SLUG = /^[A-Za-z0-9_-]{8,128}$/;
-function parseTransferLink(input, defaultOrigin) {
-  const text2 = input.trim();
-  if (SLUG.test(text2)) return { origin: defaultOrigin, slug: text2, recipient: null, hasKey: false };
-  let url;
+// src/index.ts
+import { stat as stat5, unlink } from "node:fs/promises";
+
+// src/target.ts
+function unpackTarget(blob) {
+  let parsed;
   try {
-    url = new URL(text2);
+    parsed = JSON.parse(Buffer.from(blob.trim(), "base64url").toString("utf8"));
   } catch {
-    throw new Error(`Not a Yungle transfer link: ${text2}`);
-  }
-  const m = url.pathname.match(/^\/t\/([^/]+)\/?$/);
-  if (!m || !SLUG.test(m[1])) {
-    throw new Error(
-      url.pathname.startsWith("/c/") ? "That is a collection link. `yungle get` downloads transfers (/t/\u2026) for now." : `Not a Yungle transfer link: ${text2}`
-    );
-  }
-  return { origin: url.origin, slug: m[1], recipient: url.searchParams.get("r"), hasKey: url.hash.length > 1 };
-}
-function safeFileName(name) {
-  const last = basename2(name.replace(/\\/g, "/"));
-  const cleaned = last.replace(/[\x00-\x1f<>:"|?*]/g, "_").replace(/^\.+$/, "_").trim();
-  return cleaned || "file";
-}
-function dedupeNames(names) {
-  const used = /* @__PURE__ */ new Set();
-  return names.map((name) => {
-    let candidate = name;
-    const dot = name.lastIndexOf(".");
-    const [stem, ext] = dot > 0 ? [name.slice(0, dot), name.slice(dot)] : [name, ""];
-    for (let n3 = 2; used.has(candidate.toLowerCase()); n3++) candidate = `${stem} (${n3})${ext}`;
-    used.add(candidate.toLowerCase());
-    return candidate;
-  });
-}
-function resumeFrom(partialBytes, expectedSize) {
-  if (partialBytes <= 0 || partialBytes >= expectedSize) return null;
-  return partialBytes;
-}
-var ManifestError = class extends Error {
-  constructor(code, message) {
-    super(message);
-    this.code = code;
-    this.name = "ManifestError";
+    throw new Error("That --target is not one Yungle issued (it does not decode).");
   }
-  code;
-};
-async function fetchManifest(link, password2, userAgent) {
-  const res = await fetch(`${link.origin}/api/t/${encodeURIComponent(link.slug)}/manifest`, {
-    method: "POST",
-    headers: { "Content-Type": "application/json", "User-Agent": userAgent },
-    body: JSON.stringify({ ...password2 ? { password: password2 } : {}, ...link.recipient ? { r: link.recipient } : {} })
-  });
-  const body = await res.json().catch(() => null);
-  if (!res.ok || !body || body.error) {
-    const code = body?.error?.code ?? `http_${res.status}`;
-    const message = code === "not_found" ? "No such transfer. Check the link, or it may have been deleted." : body?.error?.message ?? `The server answered ${res.status}.`;
-    throw new ManifestError(code, message);
+  const p = parsed;
+  if (typeof p?.e !== "string" || typeof p.i !== "string" || typeof p.t !== "string" || typeof p.n !== "string" || typeof p.s !== "number" || !/^https?:\/\//.test(p.e)) {
+    throw new Error("That --target is incomplete; ask for a fresh upload command.");
   }
-  return body;
-}
-async function downloadTo(url, dest, expectedSize, userAgent, onBytes) {
-  await mkdir2(join3(dest, ".."), { recursive: true });
-  const part = `${dest}.part`;
-  const have = await stat2(part).then((s) => s.size, () => 0);
-  const from = expectedSize === null ? null : resumeFrom(have, expectedSize);
-  const res = await fetch(url, {
-    headers: { "User-Agent": userAgent, ...from !== null ? { Range: `bytes=${from}-` } : {} }
-  });
-  if (res.status === 410) throw new ManifestError("expired", "The transfer expired, was revoked, or reached its download limit.");
-  if (!res.ok || !res.body) throw new ManifestError(`http_${res.status}`, `Download failed with ${res.status}.`);
-  const appending = from !== null && res.status === 206;
-  if (appending) onBytes(from);
-  const counter = new TransformStream({
-    transform(chunk, controller) {
-      onBytes(chunk.byteLength);
-      controller.enqueue(chunk);
-    }
-  });
-  await pipeline(
-    Readable.fromWeb(res.body.pipeThrough(counter)),
-    createWriteStream(part, { flags: appending ? "a" : "w" })
-  );
-  await rename(part, dest);
+  return p;
 }
 
 // ../../node_modules/.pnpm/@clack+core@1.5.1/node_modules/@clack/core/dist/index.mjs
@@ -2583,7 +2963,7 @@ function fail(err, json) {
 `);
     process.stderr.write("\n");
   }
-  return x.code === "usage" ? 2 : 1;
+  return x.code === "usage" ? 2 : x.exitCode ?? 1;
 }
 
 // src/mcp-command.ts
@@ -2758,88 +3138,103 @@ async function installInto(c2, entry, io) {
 }
 
 // src/upload.ts
-import { createReadStream } from "node:fs";
+import { createReadStream as createReadStream2 } from "node:fs";
 import { stat as stat4 } from "node:fs/promises";
 var CONCURRENCY = 3;
-async function uploadAll(files, endpoint, onProgress) {
+async function uploadAll(files, endpoint, onProgress, renewal) {
   const queue = [...files];
   const workers = Array.from({ length: Math.min(CONCURRENCY, queue.length) }, async () => {
     for (; ; ) {
       const next2 = queue.shift();
       if (!next2) return;
-      await uploadOne(next2, endpoint, onProgress);
+      await uploadOne(next2, endpoint, onProgress, renewal);
     }
   });
   await Promise.all(workers);
   await clearUploadUrls(files.map((f) => f.target.id));
 }
-async function uploadOne(file, endpoint, onProgress) {
+async function uploadOne(file, endpoint, onProgress, renewal) {
   const tus = await import("tus-js-client");
+  const keeper = renewal ? createTokenKeeper(file.target.uploadToken, {
+    renew: async (current) => {
+      const outcome = await renewal.renew(current);
+      if (typeof outcome === "object") renewal.onRenewed?.(file.target.id, outcome.token);
+      return outcome;
+    }
+  }) : null;
   const { size } = await stat4(file.path);
   const urls = await readUploadUrls();
   const uploadUrl = urls[file.target.id];
   const started = Date.now();
-  await new Promise((resolve4, reject) => {
-    const upload = new tus.Upload(createReadStream(file.path), {
-      endpoint,
-      /**
-       * Reattach to an upload already in progress. The endpoint stays set as a
-       * fallback: if the upload was never actually created the HEAD 404s and
-       * tus falls back to a clean creation, which for zero progress is exactly
-       * right. Never re-POST one that *is* in progress — that restarts it with
-       * a fresh encryption key and abandons everything already sent.
-       */
-      ...uploadUrl ? { uploadUrl } : {},
-      uploadSize: size,
-      /**
-       * The token authorizes EVERY method, not just the creation POST — the
-       * server verifies HEAD, PATCH and DELETE too. Metadata below only reaches
-       * the server on the first POST, so it cannot carry the token alone.
-       */
-      headers: { "x-yungle-upload-token": file.target.uploadToken },
-      metadata: {
-        fileId: file.target.id,
-        token: file.target.uploadToken,
-        filename: file.target.name
-      },
-      retryDelays: [0, 1e3, 3e3, 5e3, 1e4, 3e4],
-      /**
-       * Persist the upload URL the moment the server hands one over, so a
-       * `kill -9` a second later still resumes. Waiting until the upload
-       * finishes would mean the state file only ever describes work that no
-       * longer needs it.
-       *
-       * `onUploadUrlAvailable` and `upload.url`, **not** `onAfterResponse` +
-       * `req.getURL()`: that returns the URL the request was *sent to*, which
-       * for the creation POST is the endpoint itself, not the `Location` the
-       * server answered with. The first version did that, and the symptom was
-       * an empty resume file with no error anywhere — a killed upload silently
-       * restarting from zero, which is the one thing this command exists to
-       * prevent.
-       */
-      onUploadUrlAvailable: () => {
-        const location = upload.url;
-        if (location && !urls[file.target.id]) {
-          urls[file.target.id] = location;
-          void saveUploadUrl(file.target.id, location);
-        }
-      },
-      onProgress: (sent, total) => {
-        const elapsed = Math.max(1, Date.now() - started) / 1e3;
-        onProgress({
-          id: file.target.id,
-          name: file.target.name,
-          sent,
-          total: total || size,
-          rate: sent / elapsed,
-          resumed: Boolean(uploadUrl)
-        });
-      },
-      onSuccess: () => resolve4(),
-      onError: (err) => reject(err)
+  try {
+    await new Promise((resolve4, reject) => {
+      const upload = new tus.Upload(createReadStream2(file.path), {
+        endpoint,
+        /**
+         * Reattach to an upload already in progress. The endpoint stays set as a
+         * fallback: if the upload was never actually created the HEAD 404s and
+         * tus falls back to a clean creation, which for zero progress is exactly
+         * right. Never re-POST one that *is* in progress — that restarts it with
+         * a fresh encryption key and abandons everything already sent.
+         */
+        ...uploadUrl ? { uploadUrl } : {},
+        uploadSize: size,
+        /**
+         * The token authorizes EVERY method, not just the creation POST — the
+         * server verifies HEAD, PATCH and DELETE too. Metadata below only reaches
+         * the server on the first POST, so it cannot carry the token alone.
+         */
+        headers: { "x-yungle-upload-token": file.target.uploadToken },
+        // The renewed token, once there is one — read per request, not fixed above.
+        onBeforeRequest: (req) => {
+          if (keeper) req.setHeader("x-yungle-upload-token", keeper.current());
+        },
+        metadata: {
+          fileId: file.target.id,
+          token: file.target.uploadToken,
+          filename: file.target.name
+        },
+        retryDelays: [0, 1e3, 3e3, 5e3, 1e4, 3e4],
+        /**
+         * Persist the upload URL the moment the server hands one over, so a
+         * `kill -9` a second later still resumes. Waiting until the upload
+         * finishes would mean the state file only ever describes work that no
+         * longer needs it.
+         *
+         * `onUploadUrlAvailable` and `upload.url`, **not** `onAfterResponse` +
+         * `req.getURL()`: that returns the URL the request was *sent to*, which
+         * for the creation POST is the endpoint itself, not the `Location` the
+         * server answered with. The first version did that, and the symptom was
+         * an empty resume file with no error anywhere — a killed upload silently
+         * restarting from zero, which is the one thing this command exists to
+         * prevent.
+         */
+        onUploadUrlAvailable: () => {
+          const location = upload.url;
+          if (location && !urls[file.target.id]) {
+            urls[file.target.id] = location;
+            void saveUploadUrl(file.target.id, location);
+          }
+        },
+        onProgress: (sent, total) => {
+          const elapsed = Math.max(1, Date.now() - started) / 1e3;
+          onProgress({
+            id: file.target.id,
+            name: file.target.name,
+            sent,
+            total: total || size,
+            rate: sent / elapsed,
+            resumed: Boolean(uploadUrl)
+          });
+        },
+        onSuccess: () => resolve4(),
+        onError: (err) => reject(err)
+      });
+      upload.start();
     });
-    upload.start();
-  });
+  } finally {
+    keeper?.stop();
+  }
 }
 
 // src/watch.ts
@@ -2876,7 +3271,7 @@ async function saveUploaded(dir, collectionId, uploaded) {
 }
 
 // src/index.ts
-var CLI_VERSION = true ? "0.2.1" : "dev";
+var CLI_VERSION = true ? "0.3.0" : "dev";
 var USER_AGENT = `yungle-cli/${CLI_VERSION}`;
 async function main(argvIn) {
   const argv = resolveAlias(argvIn);
@@ -2912,6 +3307,10 @@ async function main(argvIn) {
         return await send(positionals, flags, json);
       case "get":
         return await get(positionals, flags, json);
+      case "pull":
+        return await pull(flags, json);
+      case "put":
+        return await put(positionals, flags, json);
       case "status":
         return await status(positionals, flags, json);
       case "transfers":
@@ -2920,6 +3319,8 @@ async function main(argvIn) {
         return await collections(flags, json);
       case "contacts":
         return await contacts(flags, json);
+      case "requests":
+        return await requests(positionals, flags, json);
       case "revoke":
         return await revoke(positionals, flags, json);
       case "push":
@@ -3024,8 +3425,9 @@ async function send(pathsIn, flags, json) {
   let paths = pathsIn;
   let recipients = listFlag(flags.to);
   let message = stringFlag(flags.message);
+  const urls = urlListFlag(flags["from-url"]);
   let askedFor = false;
-  if (paths.length === 0) {
+  if (paths.length === 0 && urls.length === 0) {
     if (!interactive(flags)) throw new CliError("Nothing to send.", "yungle send <file or folder> [--to someone@example.com]", "usage", 2);
     const answers = await askSend();
     paths = answers.paths;
@@ -3041,28 +3443,35 @@ async function send(pathsIn, flags, json) {
     if (!await confirm2("Send it as a link you share yourself?")) throw new CliError("Cancelled; nothing was sent.", hint, "cancelled", 130);
     recipients = [];
   }
-  const files = await collectFiles(paths);
-  if (files.length === 0) throw new CliError("Those paths contain no files (hidden files are skipped).", void 0, "usage", 2);
+  const files = paths.length ? await collectFiles(paths) : [];
+  if (files.length === 0 && urls.length === 0) throw new CliError("Those paths contain no files (hidden files are skipped).", void 0, "usage", 2);
   const total = files.reduce((n3, f) => n3 + f.size, 0);
-  const summary = `${plural(files.length, "file")} ${sym.dot} ${formatBytes(total)}${recipients.length ? ` to ${recipients.join(", ")}` : ""}`;
+  const summary = [files.length ? `${plural(files.length, "file")} ${sym.dot} ${formatBytes(total)}` : "", urls.length ? `${plural(urls.length, "URL")} fetched by Yungle` : ""].filter(Boolean).join(" + ") + (recipients.length ? ` to ${recipients.join(", ")}` : "");
   if (askedFor && !await confirm2(`Send ${summary}?`)) throw new CliError("Cancelled; nothing was sent.", void 0, "cancelled", 130);
   heading(`Sending ${summary}`);
-  const key = sessionKey(files, "transfer");
+  const key = sessionKey(files, `transfer${urls.length ? `:${urls.join("\n")}` : ""}`);
   const existing = await findSession(key);
   let created;
   if (existing && existing.kind === "transfer") {
     note("Resuming the interrupted upload.");
-    created = { transfer: { id: existing.targetId }, tusEndpoint: existing.tusEndpoint, files: existing.files };
+    created = { transfer: { id: existing.targetId }, tusEndpoint: existing.tusEndpoint, files: existing.files, imports: existing.imports ?? [] };
   } else {
     const fresh = await api.createTransfer({
       files: toFileInputs(files),
+      ...urls.length ? { imports: urls.map((url) => ({ url })) } : {},
       title: stringFlag(flags.title),
       expiresInDays: numberFlag(flags.expires, "expires")
     });
-    created = { transfer: fresh.transfer, tusEndpoint: fresh.tusEndpoint, files: fresh.files.map((f, i2) => ({ ...f, path: files[i2].path })) };
-    await saveSession(key, { createdAt: Date.now(), kind: "transfer", targetId: fresh.transfer.id, tusEndpoint: fresh.tusEndpoint, files: created.files });
+    created = {
+      transfer: fresh.transfer,
+      tusEndpoint: fresh.tusEndpoint,
+      files: fresh.files.map((f, i2) => ({ ...f, path: files[i2].path })),
+      imports: (fresh.imports ?? []).map((i2) => ({ fileId: i2.fileId, name: i2.name, size: i2.size }))
+    };
+    await saveSession(key, { createdAt: Date.now(), kind: "transfer", targetId: fresh.transfer.id, tusEndpoint: fresh.tusEndpoint, files: created.files, imports: created.imports });
   }
-  await streamAll(files, created);
+  if (files.length) await streamAll(files, created, api, key);
+  if (created.imports.length) await awaitImports(api, created.imports);
   const after = await freshClient(flags, api);
   await dropSession(key);
   const finalized = await after.finalizeTransfer(created.transfer.id, {
@@ -3088,7 +3497,60 @@ async function send(pathsIn, flags, json) {
     t2.url
   );
 }
-async function streamAll(files, targets) {
+async function put(positionals, flags, json) {
+  const blob = stringFlag(flags.target);
+  const path = positionals[0];
+  if (!blob || !path) throw new CliError("Put what, where?", "yungle put <file> --target <target>", "usage", 2);
+  let target;
+  try {
+    target = unpackTarget(blob);
+  } catch (err) {
+    throw new CliError(err.message, void 0, "usage", 2);
+  }
+  const abs = resolve3(path);
+  const size = await stat5(abs).then((s) => s.isFile() ? s.size : -1, () => -2);
+  if (size === -2) throw new CliError(`No such file: ${abs}`, void 0, "not_found");
+  if (size === -1) throw new CliError(`${abs} is not a file.`, void 0, "usage", 2);
+  if (size !== target.s) {
+    throw new CliError(`${abs} is ${formatBytes(size)}; this target was made for ${formatBytes(target.s)}.`, "Use the file the target was created for.", "size_mismatch");
+  }
+  heading(`Uploading ${target.n} ${sym.dot} ${formatBytes(size)}`);
+  const origin = new URL(target.e).origin;
+  const started = Date.now();
+  await uploadAll(
+    [{ path: abs, target: { id: target.i, name: target.n, size: target.s, uploadToken: target.t } }],
+    target.e,
+    (p) => drawProgress(progressLine(p.sent, p.total, started, p.resumed ? "resumed" : "")),
+    { renew: (t2) => renewUploadToken(origin, t2) }
+  );
+  endProgress();
+  return out(json, { uploaded: target.n, fileId: target.i, bytes: size }, success(`Uploaded ${target.n}`), target.i);
+}
+async function awaitImports(api, imports) {
+  const total = imports.reduce((n3, i2) => n3 + i2.size, 0);
+  heading(`Yungle is fetching ${plural(imports.length, "file")} ${sym.dot} ${formatBytes(total)}`);
+  const started = Date.now();
+  for (; ; ) {
+    const statuses = await Promise.all(imports.map((i2) => api.getImport(i2.fileId)));
+    const received = statuses.reduce((n3, s) => n3 + s.receivedBytes, 0);
+    const done = statuses.filter((s) => s.status !== "importing").length;
+    drawProgress(progressLine(received, total, started, `${done}/${imports.length} fetched`));
+    if (done === imports.length) {
+      endProgress();
+      const failed = statuses.filter((s) => s.status === "failed");
+      if (failed.length) {
+        throw new CliError(
+          `Could not fetch ${failed.map((f) => `${f.name} (${f.error ?? "failed"})`).join(", ")}.`,
+          "Check the URL is public and still valid, then run the command again.",
+          "import_failed"
+        );
+      }
+      return;
+    }
+    await new Promise((r2) => setTimeout(r2, 2e3));
+  }
+}
+async function streamAll(files, targets, api, resumeKey) {
   const paired = pairWithTargets(files, targets.files);
   const totalBytes = paired.reduce((n3, { file }) => n3 + file.size, 0);
   const sentPer = /* @__PURE__ */ new Map();
@@ -3109,6 +3571,12 @@ async function streamAll(files, targets) {
         if (p.resumed) resumed = true;
         sentPer.set(p.id, p.sent);
         if (p.sent >= p.total) finished.add(p.id);
+      },
+      {
+        renew: (t2) => api.renewUploadToken(t2),
+        onRenewed: (fileId, token) => {
+          if (resumeKey) void saveRenewedToken(resumeKey, fileId, token);
+        }
       }
     );
   } finally {
@@ -3135,7 +3603,7 @@ async function get(positionals, flags, json) {
       const needs = err instanceof ManifestError && (err.code === "password_required" || err.code === "wrong_password");
       if (!needs || !interactive(flags)) {
         if (err instanceof ManifestError && err.code === "password_required") {
-          throw new CliError("This transfer is password protected.", `yungle get ${input} --password <password>`, "password_required");
+          throw new CliError(`This ${link.kind === "c" ? "collection" : "transfer"} is password protected.`, `yungle get ${input} --password <password>`, "password_required");
         }
         throw err;
       }
@@ -3150,27 +3618,76 @@ async function get(positionals, flags, json) {
       "e2ee"
     );
   }
-  if (manifest.files.length === 0) return out(json, { saved: [] }, "  This transfer has no files.");
-  const useZip = flags.zip === true && manifest.zipUrl !== null;
-  const jobs = useZip ? [{ url: manifest.zipUrl, name: `yungle-${link.slug}.zip`, size: null }] : dedupeNames(manifest.files.map((f) => safeFileName(f.name))).map((name, i2) => ({ url: manifest.files[i2].downloadUrl, name, size: manifest.files[i2].size }));
+  return saveManifest(manifest, {
+    outDir,
+    zip: flags.zip === true,
+    zipName: `yungle-${link.slug}.zip`,
+    json,
+    empty: `  This ${link.kind === "c" ? "collection" : "transfer"} has no files.`
+  });
+}
+async function pull(flags, json) {
+  const collectionId = stringFlag(flags.collection);
+  const transferId = stringFlag(flags.transfer);
+  if (!collectionId === !transferId) {
+    throw new CliError("Pull what?", "yungle pull --collection <id>   or   yungle pull --transfer <id>", "usage", 2);
+  }
+  const api = client(flags);
+  const manifest = collectionId ? await api.collectionDownloadLinks(collectionId) : await api.transferDownloadLinks(transferId);
+  const outDir = resolve3(stringFlag(flags.out) ?? (collectionId ? safeFileName(manifest.title ?? collectionId) : "."));
+  return saveManifest(manifest, {
+    outDir,
+    zip: flags.zip === true,
+    zipName: `yungle-${collectionId ?? transferId}.zip`,
+    json,
+    empty: `  This ${collectionId ? "collection" : "transfer"} has no files.`
+  });
+}
+async function saveManifest(manifest, opts) {
+  const { outDir, json } = opts;
+  if (manifest.files.length === 0) return out(json, { saved: [], skipped: [], complete: manifest.complete ?? true }, opts.empty);
+  if (manifest.complete === false && !json) {
+    note(`Still uploading: ${plural(manifest.files.length, "file")} have arrived so far. Run this again later for the rest.`);
+  }
+  const useZip = opts.zip && manifest.zipUrl !== null;
+  const relPaths = dedupePaths(manifest.files.map((f) => ({ dir: safeRelativeDir(f.path), name: safeFileName(f.name) })));
+  const jobs = useZip ? [{ url: manifest.zipUrl, rel: opts.zipName, size: null }] : relPaths.map((rel, i2) => ({ url: manifest.files[i2].downloadUrl, rel, size: manifest.files[i2].size, crc32: manifest.files[i2].crc32 ?? null }));
   const total = manifest.files.reduce((n3, f) => n3 + f.size, 0);
   heading(`Downloading ${plural(manifest.files.length, "file")} ${sym.dot} ${formatBytes(total)}`);
   let received = 0;
   const started = Date.now();
   const saved = [];
+  const skipped = [];
   for (const [i2, job] of jobs.entries()) {
-    const dest = join6(outDir, job.name);
+    const dest = join6(outDir, job.rel);
+    if (job.size !== null && await stat5(dest).then((st) => st.size, () => -1) === job.size) {
+      received += job.size;
+      skipped.push(dest);
+      continue;
+    }
     await downloadTo(job.url, dest, job.size, USER_AGENT, (n3) => {
       received += n3;
       drawProgress(progressLine(Math.min(received, total), total, started, `${i2 + 1}/${jobs.length} files`));
     });
+    const expected = "crc32" in job ? job.crc32 : null;
+    if (expected) {
+      const actual = await fileCrc32(dest);
+      if (actual !== null && actual !== expected) {
+        await unlink(dest).catch(() => void 0);
+        throw new CliError(`${job.rel} arrived damaged (checksum ${actual}, expected ${expected}) and was deleted.`, "Run the same command again to fetch it afresh.", "checksum_mismatch");
+      }
+    }
     saved.push(dest);
   }
   endProgress();
+  const skippedNote = skipped.length ? [o.dim(`${plural(skipped.length, "file")} already here, skipped`)] : [];
   return out(
     json,
-    { saved, message: manifest.message, expiresAt: manifest.expiresAt },
-    success(`Saved ${saved.length === 1 ? shown(saved[0]) : `${plural(saved.length, "file")} to ${shown(outDir)}`}`, manifest.message ? [o.italic(`\u201C${manifest.message}\u201D`)] : []),
+    { saved, skipped, complete: manifest.complete ?? true, message: manifest.message, expiresAt: manifest.expiresAt },
+    success(
+      saved.length === 0 ? "Nothing new to download" : `Saved ${saved.length === 1 ? shown(saved[0]) : `${plural(saved.length, "file")} to ${shown(outDir)}`}`,
+      [...manifest.message ? [o.italic(`\u201C${manifest.message}\u201D`)] : [], ...skippedNote]
+    ),
     saved.join("\n")
   );
 }
@@ -3261,6 +3778,51 @@ async function collections(flags, json) {
     collections2.map((c2) => `${c2.id}	${c2.title}`).join("\n")
   );
 }
+async function requests(positionals, flags, json) {
+  const api = client(flags);
+  const [sub, id] = positionals;
+  if (!sub) {
+    const { requests: rows } = await api.listRequests();
+    if (rows.length === 0) return out(json, { requests: rows }, '  No upload requests yet. yungle requests new --collection <id> --title "\u2026"', "");
+    return out(
+      json,
+      { requests: rows },
+      table(
+        rows.map((r2) => [o.dim(r2.id), r2.title, r2.status, plural(r2.submissionCount, "submission"), formatBytes(r2.receivedBytes), accentOut(r2.url)]),
+        { flex: 1, header: ["ID", "Title", "Status", "Received", "Size", "Link"] }
+      ),
+      rows.map((r2) => `${r2.id}	${r2.url}`).join("\n")
+    );
+  }
+  if (sub === "new") {
+    const collectionId = stringFlag(flags.collection);
+    const title = stringFlag(flags.title);
+    if (!collectionId || !title) throw new CliError("Which collection, and what should the page say?", 'yungle requests new --collection <id> --title "Send us your raw footage"', "usage", 2);
+    const { request: request2 } = await api.createRequest({
+      collectionId,
+      title,
+      ...stringFlag(flags.message) ? { message: stringFlag(flags.message) } : {},
+      ...stringFlag(flags.password) ? { password: stringFlag(flags.password) } : {}
+    });
+    return out(json, { request: request2 }, success(`Upload request \u201C${request2.title}\u201D is live`, [accentOut(request2.url), o.dim("Anyone with the link can upload into the collection.")]), request2.url);
+  }
+  if (sub === "show" && id) {
+    const { request: request2, submissions } = await api.getRequest(id);
+    return out(
+      json,
+      { request: request2, submissions },
+      [
+        `  ${o.bold(request2.title)}  ${o.dim(request2.status)}  ${accentOut(request2.url)}`,
+        ...submissions.length === 0 ? ["  Nothing received yet."] : [table(submissions.map((s) => [formatDate(s.createdAt), s.uploaderName ?? o.dim("\u2014"), s.uploaderEmail ?? "", plural(s.fileCount, "file"), formatBytes(s.sizeBytes)]), { flex: 1, header: ["When", "From", "Email", "Files", "Size"] })]
+      ].join("\n"),
+      submissions.map((s) => `${s.id}	${s.fileCount}`).join("\n")
+    );
+  }
+  const status2 = { pause: "paused", resume: "active", close: "closed" }[sub];
+  if (!status2 || !id) throw new CliError(`Unknown: requests ${sub}`, "yungle requests [new|show|pause|resume|close]", "usage", 2);
+  const { request } = await api.setRequestStatus(id, status2);
+  return out(json, { request }, success(`\u201C${request.title}\u201D is ${request.status}`), request.status);
+}
 async function contacts(flags, json) {
   const { contacts: contacts2 } = await client(flags).listContacts();
   if (contacts2.length === 0) return out(json, { contacts: contacts2 }, "  No contacts yet.", "");
@@ -3288,29 +3850,40 @@ async function revoke(positionals, flags, json) {
 async function push(paths, flags, json) {
   const collectionId = stringFlag(flags.collection);
   if (!collectionId) throw new CliError("Which collection?", "yungle collections   then   yungle push <paths> --collection <id>", "usage", 2);
-  if (paths.length === 0) throw new CliError("Nothing to upload.", `yungle push <paths> --collection ${collectionId}`, "usage", 2);
+  const urls = urlListFlag(flags["from-url"]);
+  if (paths.length === 0 && urls.length === 0) throw new CliError("Nothing to upload.", `yungle push <paths> --collection ${collectionId}`, "usage", 2);
   const api = client(flags);
-  const files = await collectFiles(paths);
-  if (files.length === 0) throw new CliError("Those paths contain no files (hidden files are skipped).", void 0, "usage", 2);
-  heading(`Uploading ${plural(files.length, "file")} ${sym.dot} ${formatBytes(files.reduce((n3, f) => n3 + f.size, 0))}`);
-  const key = sessionKey(files, `collection:${collectionId}:${stringFlag(flags.folder) ?? ""}`);
+  const files = paths.length ? await collectFiles(paths) : [];
+  if (files.length === 0 && urls.length === 0) throw new CliError("Those paths contain no files (hidden files are skipped).", void 0, "usage", 2);
+  if (files.length) heading(`Uploading ${plural(files.length, "file")} ${sym.dot} ${formatBytes(files.reduce((n3, f) => n3 + f.size, 0))}`);
+  const key = sessionKey(files, `collection:${collectionId}:${stringFlag(flags.folder) ?? ""}${urls.length ? `:${urls.join("\n")}` : ""}`);
   const existing = await findSession(key);
   let targets;
   if (existing && existing.kind === "collection") {
     note("Resuming the interrupted upload.");
-    targets = { tusEndpoint: existing.tusEndpoint, files: existing.files };
+    targets = { tusEndpoint: existing.tusEndpoint, files: existing.files, imports: existing.imports ?? [] };
   } else {
-    const fresh = await api.addCollectionFiles(collectionId, toFileInputs(files), stringFlag(flags.folder) ?? null);
-    targets = { tusEndpoint: fresh.tusEndpoint, files: fresh.files.map((f, i2) => ({ ...f, path: files[i2].path })) };
-    await saveSession(key, { createdAt: Date.now(), kind: "collection", targetId: collectionId, tusEndpoint: fresh.tusEndpoint, files: targets.files });
+    const fresh = await api.addCollectionFiles(
+      collectionId,
+      toFileInputs(files),
+      stringFlag(flags.folder) ?? null,
+      urls.map((url) => ({ url }))
+    );
+    targets = {
+      tusEndpoint: fresh.tusEndpoint,
+      files: fresh.files.map((f, i2) => ({ ...f, path: files[i2].path })),
+      imports: (fresh.imports ?? []).map((i2) => ({ fileId: i2.fileId, name: i2.name, size: i2.size }))
+    };
+    await saveSession(key, { createdAt: Date.now(), kind: "collection", targetId: collectionId, tusEndpoint: fresh.tusEndpoint, files: targets.files, imports: targets.imports });
   }
-  await streamAll(files, targets);
+  if (files.length) await streamAll(files, targets, api, key);
+  if (targets.imports.length) await awaitImports(api, targets.imports);
   await dropSession(key);
   const { collection } = await (await freshClient(flags, api)).getCollection(collectionId);
   return out(
     json,
-    { collection: collection.id, uploaded: files.length, url: collection.url },
-    success(`Uploaded ${plural(files.length, "file")} to \u201C${collection.title}\u201D`, collection.url ? [accentOut(collection.url)] : []),
+    { collection: collection.id, uploaded: files.length + targets.imports.length, url: collection.url },
+    success(`Added ${plural(files.length + targets.imports.length, "file")} to \u201C${collection.title}\u201D`, collection.url ? [accentOut(collection.url)] : []),
     collection.url ?? collection.id
   );
 }
@@ -3337,8 +3910,9 @@ async function watch(positionals, flags, json) {
     const { ready, seen } = planTick(current, lastSeen, uploaded);
     lastSeen = seen;
     if (ready.length > 0) {
-      const target = await (await freshClient(flags, api)).addCollectionFiles(collectionId, toFileInputs(ready), stringFlag(flags.folder) ?? null);
-      await streamAll(ready, target);
+      const tickApi = await freshClient(flags, api);
+      const target = await tickApi.addCollectionFiles(collectionId, toFileInputs(ready), stringFlag(flags.folder) ?? null);
+      await streamAll(ready, target, tickApi, null);
       for (const f of ready) {
         uploaded.add(fingerprint(f));
         if (json) process.stdout.write(`${JSON.stringify({ uploaded: f.path, size: f.size })}