drop-and-share

Command-line uploader for drop-share — upload a file, a ZIP, or a whole folder to a drop-share server and get back a shareable artifact URL. Published to npm as drop-and-share; the command it installs is drop-share.

Zero runtime dependencies: it only uses Node's own fs/path and the global fetch/FormData/Blob.

Requirements

• Node.js 18 or newer
• A drop-share server to upload to (self-hosted). If you don't set --server/ARTIFACT_SERVER, uploads go to this maintainer's own instance at https://artifacts.msar.dev by default — see the note below.

Use it with no install

npx drop-and-share upload ./photo.png --server https://your-domain

Or install it once

npm install -g drop-and-share
drop-share upload ./photo.png --server https://your-domain

This gives you a drop-share binary directly on your PATH.

Usage

drop-share upload <path> [<path> ...] [--server <url>] [--extract] [--name <name>] [--token <token>] [--password <password>] [--new]
drop-share update <path> [--server <url>] [--extract] [--id <id>] [--token <token>] [--password <password>]

| Argument / option | Description | | --------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------- | | <path> | File or folder to upload. Required. | | --server <url> | The drop-share server to upload to. Can be set via ARTIFACT_SERVER instead. Defaults to https://artifacts.msar.dev if neither is given. | | --extract | Only applies to a .zip file: extract it server-side into a browsable artifact instead of uploading it unchanged. | | --name <name> | Override the display/stored filename for a single-file upload. | | --new (upload only) | Force publishing a brand-new artifact even if this directory was published before. | | --id <id> (update only) | Update a specific artifact id directly, instead of looking up the one saved for this path. | | --token <token> | Token for updating a protected artifact. The token is sent in the X-Artifact-Token header and saved in ~/.drop-share/state.json. | | --password <password> | Alias for --token. |

Passing several paths to upload bundles them into a single artifact. Each path must be a file, not a directory. Since paths are plain positional arguments, your shell's normal filename tab-completion works for each one. If two files share a basename, their parent directory name is prefixed to keep them distinct (for example, a-logo.png and b-logo.png).

Running drop-share upload <path> again in a directory you've published before updates that same artifact (adding new files, overwriting changed ones, leaving everything else untouched) instead of creating a new one — drop-share remembers the directory, in ~/.drop-share/state.json. Use drop-share update <path> to be explicit about updating, or --new to force a fresh artifact.

ARTIFACT_SERVER can be set in your shell profile so you don't have to pass --server on every call:

export ARTIFACT_SERVER=https://your-domain
drop-share upload ./release.zip

Protected artifacts reuse the saved token automatically when uploading again from the same directory. Pass --token (or --password) to provide or replace it explicitly. Tokens are stored in ~/.drop-share/state.json; protect that file and do not share it.

Note: if you don't pass --server and don't set ARTIFACT_SERVER, this CLI uploads to the maintainer's own server (https://artifacts.msar.dev) by default. That server has no authentication, so this is a convenience default, not a shared public service — point --server at your own drop-share deployment for anything beyond quick testing.

Publishing and local development

To publish a new CLI version, push a tag matching cli-v* (for example, git tag cli-v0.2.0 && git push --tags), or run the Publish CLI workflow manually from the Actions tab with a version input. The workflow syncs cli/package.json's version to the tag, builds it, and runs npm publish. Publishing requires an NPM_TOKEN repository secret with publish rights to the drop-and-share package.

To build and run the CLI locally without publishing:

cd cli
npm install
npm run build
node dist/index.js upload ../README.md --server http://localhost:5173

Examples

# A single file
drop-share upload ./photo.png --server https://your-domain

# A ZIP, stored as-is (this is the default for .zip files)
drop-share upload ./release.zip --server https://your-domain

# A ZIP, extracted server-side into a browsable artifact
drop-share upload ./release.zip --extract --server https://your-domain

# A whole folder - relative paths inside it are preserved
drop-share upload ./my-project/ --server https://your-domain

# Several files in one artifact
drop-share upload ./a.png ./b.png ./notes.md --server https://your-domain

On success it prints the artifact's URL:

Uploading release.zip (4.2 MB)...

Upload complete.

Artifact:
https://your-domain/a/01K7X3ABCD9QWERTY123456789/

Limits

The server enforces a maximum of 10 MB per file and 10 MB per artifact (folder or extracted ZIP) — this CLI checks the same limits locally first, purely to fail fast without a network round trip. The server-side check is the one that actually matters and can't be bypassed by skipping the CLI.

Behavior notes

• Folders: enumerated recursively; relative paths are preserved and sent as-is (never the local absolute filesystem path). Symlinks are skipped with a warning rather than followed.
• Re-uploading in the same directory: updates the artifact created by the previous upload in that directory (see drop-share update above) instead of creating a new one, unless you pass --new. Bundled files use their common parent directory.
• Optional artifact protection: unprotected artifacts need no token. Protected artifact updates require --token/--password, or the token saved from an earlier upload. This is per-artifact protection, not user authentication; point --server at a server you control.