feat(get): retrieve/download an image (optionally transformed)

[facundofarias]

The CLI could upload / list / delete but had no way to retrieve an image's bytes. Adds a get command.

pixelvault get <id>

• prints the CDN URL to stdout (agent-friendly, mirrors list)
• --json → full metadata
• -o/--output <file> → download the image to disk
• -t/--transform "<params>" → apply transform params to the URL / downloaded variant

pixelvault get img_xyz                              # print the CDN URL
pixelvault get img_xyz -o photo.png                 # download the original
pixelvault get img_xyz -o cut.png -t "segment=foreground"   # download a transparent cut-out
pixelvault get img_xyz -t "w=400&fmt=webp"          # just print the transformed URL

Ties the new transform capabilities into the CLI: download a thumbnail, cut-out, or watermarked variant in one call.

Notes

• Output contract preserved: URL → stdout, human messages → stderr.
• applyTransform tolerates a leading ?/&; unit-tested (+ metadata fetch). 16 tests pass; typecheck clean; build ok; get --help verified.
• Not bumped/published — version stays 0.1.0; a minor bump + npm publish is needed to ship this to the pixelvault-cli package (release decision).

🤖 Generated with Claude Code

[facundofarias]

Review Council Report

Reviewers: Claude + Codex (Gemini skipped: GOOGLE_CLOUD_PROJECT auth gap; Perplexity: no key). 2 reviewers meets council minimum.

Findings fixed

#	Severity	Finding	Fix
1	Important	-t "background=#ffaa00" → server got background= (the # parsed as a URL fragment)	applyTransform reserializes via URLSearchParams (encodes #///commas); also trims whitespace-only input
2	Important	Image id interpolated raw → get '../whoami' hits /v1/whoami	encodeURIComponent(args.id)
3	Important	-o silently overrode --json (bare URL where JSON expected)	--json now honored in download mode (emits metadata + transformed_url + output)
4	Important/Sugg.	0-byte/partial download reported "Saved"; writeFileSync errors raw	Refuse 0-byte writes; wrap write failures in CliError
5	Suggestion	tile example inconsistency (logo.png vs img_logo.png)	Standardized on img_logo.png across help + README

Verified, not changed

Claude flagged the skill's size/fit preset values as unverifiable — cross-checked against the serve-worker (s=256/m=640/l=1280/social=1200×630, scale-down default): accurate.

What both praised

Correct stdout/stderr contract; raw fetch+arrayBuffer for binary (not apiRequest's .json()); no double-wrapped errors; applyTransform pure + tested.

+2 tests (18 total), typecheck clean. No direct injection/SSRF (CDN host is server-controlled).

🤖 Review Council (Claude · Codex)