decryption works, expose cli