122 lines
3.1 KiB
Markdown
122 lines
3.1 KiB
Markdown
# Crypstie
|
|
|
|
Create and open end-to-end encrypted Crypstie links from Node.js or a shell.
|
|
The plaintext and the 256-bit key never reach the Crypstie server: it stores
|
|
only an authenticated ciphertext, while the key stays in the URL fragment.
|
|
|
|
Compatible with links created by the original Kotlin/JS client at
|
|
`crypstie.com`. No Kotlin runtime is required.
|
|
|
|
## Install
|
|
|
|
```shell
|
|
npm install crypstie
|
|
```
|
|
|
|
For global CLI use:
|
|
|
|
```shell
|
|
npm install --global crypstie
|
|
```
|
|
|
|
Requires Node.js 18 or newer.
|
|
|
|
## CLI
|
|
|
|
Create a reusable link from stdin or a file:
|
|
|
|
```shell
|
|
printf 'secret text' | crypstie create
|
|
crypstie create ./document.txt --days 7
|
|
```
|
|
|
|
Create a burn-on-read link:
|
|
|
|
```shell
|
|
crypstie create ./secret.txt --burn
|
|
```
|
|
|
|
Open a link. Quote it so the shell does not interpret `#`:
|
|
|
|
```shell
|
|
crypstie open 'https://crypstie.com/_id#key'
|
|
crypstie open "$CRYPSTIE_URL" --output ./document.bin
|
|
crypstie open "$CRYPSTIE_URL" --json
|
|
```
|
|
|
|
`put`/`encrypt` and `get`/`decrypt` are aliases for `create` and `open`.
|
|
|
|
## Node.js API
|
|
|
|
```js
|
|
const { createCrypstie, openCrypstie } = require('crypstie');
|
|
|
|
const created = await createCrypstie('secret text', {
|
|
burnOnShow: false,
|
|
deleteAt: new Date(Date.now() + 7 * 86400_000),
|
|
});
|
|
console.log(created.url);
|
|
|
|
const opened = await openCrypstie(created.url);
|
|
console.log(opened.text); // UTF-8 convenience view
|
|
console.log(opened.data); // Uint8Array with exact bytes
|
|
```
|
|
|
|
Both functions accept an optional `fetch` implementation and `AbortSignal`.
|
|
`createCrypstie` also accepts `rootUrl`, UI metadata fields, and binary input.
|
|
`openCrypstie` accepts optional `profileIds` for compatibility with owner-aware
|
|
legacy links.
|
|
|
|
## Security model
|
|
|
|
- Encryption is local AES-256-CTR with Encrypt-then-Authenticate and
|
|
SHA-256-based HMAC, implemented by `unicrypto`.
|
|
- The encrypted record uses the BOSS wire format.
|
|
- The URL fragment is removed locally and is never included in the HTTP request.
|
|
- Anyone possessing the complete URL can decrypt the content. Treat the URL as
|
|
a secret and avoid placing it in logs.
|
|
- `--burn` is enforced by the server. Concurrent first reads are subject to the
|
|
guarantees of the deployed server implementation.
|
|
|
|
## AI agents
|
|
|
|
The npm package includes a compact skill at `skills/crypstie/SKILL.md`. Point an
|
|
agent's skill loader at that directory, or copy the `skills/crypstie` folder into
|
|
its skills directory. The skill uses the CLI and keeps secret links out of its
|
|
written responses whenever possible.
|
|
|
|
After a local install, the skill is available at:
|
|
|
|
```text
|
|
node_modules/crypstie/skills/crypstie
|
|
```
|
|
|
|
## Development
|
|
|
|
```shell
|
|
npm ci
|
|
npm test
|
|
npm pack --dry-run
|
|
```
|
|
|
|
Live read compatibility test:
|
|
|
|
```shell
|
|
CRYPSTIE_TEST_URL='https://crypstie.com/_id#key' npm test
|
|
```
|
|
|
|
Live create/read test (writes one expiring test record):
|
|
|
|
```shell
|
|
CRYPSTIE_LIVE_WRITE=1 npm test
|
|
```
|
|
|
|
Russian documentation: [docs/README.ru.md](docs/README.ru.md).
|
|
|
|
Source code and issues: [SergeychWorks/crypstie3-node](https://gitea.sergeych.net/SergeychWorks/crypstie3-node).
|
|
|
|
## Authors
|
|
|
|
- **sergeych** — Crypstie protocol, service, and original implementations
|
|
- **Codex (OpenAI)** — Node.js module, CLI, tests, and agent skill
|