# Crypstie

Create and open end-to-end encrypted Crypstie links from Node.js or a shell.
The plaintext and the 256-bit key never reach the Crypstie server: it stores
only an authenticated ciphertext, while the key stays in the URL fragment.

Compatible with links created by the original Kotlin/JS client at
`crypstie.com`. No Kotlin runtime is required.

## Install

```shell
npm install crypstie
```

For global CLI use:

```shell
npm install --global crypstie
```

Requires Node.js 18 or newer.

## CLI

Create a reusable link from stdin or a file:

```shell
printf 'secret text' | crypstie create
crypstie create ./document.txt --days 7
```

Create a burn-on-read link:

```shell
crypstie create ./secret.txt --burn
```

Open a link. Quote it so the shell does not interpret `#`:

```shell
crypstie open 'https://crypstie.com/_id#key'
crypstie open "$CRYPSTIE_URL" --output ./document.bin
crypstie open "$CRYPSTIE_URL" --json
```

`put`/`encrypt` and `get`/`decrypt` are aliases for `create` and `open`.

## Node.js API

```js
const { createCrypstie, openCrypstie } = require('crypstie');

const created = await createCrypstie('secret text', {
  burnOnShow: false,
  deleteAt: new Date(Date.now() + 7 * 86400_000),
});
console.log(created.url);

const opened = await openCrypstie(created.url);
console.log(opened.text); // UTF-8 convenience view
console.log(opened.data); // Uint8Array with exact bytes
```

Both functions accept an optional `fetch` implementation and `AbortSignal`.
`createCrypstie` also accepts `rootUrl`, UI metadata fields, and binary input.
`openCrypstie` accepts optional `profileIds` for compatibility with owner-aware
legacy links.

## Security model

- Encryption is local AES-256-CTR with Encrypt-then-Authenticate and
  SHA-256-based HMAC, implemented by `unicrypto`.
- The encrypted record uses the BOSS wire format.
- The URL fragment is removed locally and is never included in the HTTP request.
- Anyone possessing the complete URL can decrypt the content. Treat the URL as
  a secret and avoid placing it in logs.
- `--burn` is enforced by the server. Concurrent first reads are subject to the
  guarantees of the deployed server implementation.

## AI agents

The npm package includes a compact skill at `skill/crypstie/SKILL.md`. Point an
agent's skill loader at that directory, or copy the `skill/crypstie` folder into
its skills directory. The skill uses the CLI and keeps secret links out of its
written responses whenever possible.

## Development

```shell
npm ci
npm test
npm pack --dry-run
```

Live read compatibility test:

```shell
CRYPSTIE_TEST_URL='https://crypstie.com/_id#key' npm test
```

Live create/read test (writes one expiring test record):

```shell
CRYPSTIE_LIVE_WRITE=1 npm test
```

Russian documentation: [docs/README.ru.md](docs/README.ru.md).

## Authors

- **sergeych** — Crypstie protocol, service, and original implementations
- **Codex (OpenAI)** — Node.js module, CLI, tests, and agent skill