cursedbelt-server 3.0.0 → 4.0.0

package/dist/server/private-media/pipeline.js

@@ -1,97 +0,0 @@
-import { mkdir, readdir, rm, writeFile } from 'node:fs/promises';
-import path from 'node:path';
-import { hlsLadderArgs, isFfmpegAvailable, LIBRARY_CRF, probeVideoStream, resolveLadder, runFfmpegProgress, } from '../media-bun';
-import { privateHlsFileKey, privateHlsMasterKey, privateSourceKey, } from '../storage/types';
-import { cryptBlobStream, generateContentKey, wrapContentKey } from './crypto';
-// ── Encrypted-HLS pipeline (private media) ──────────────────────────────────────
-// Transcodes a private upload into an AES-128-encrypted HLS ladder: ffmpeg encrypts every
-// segment with a per-item content key (via a key-info file), so the segments are ciphertext at
-// rest (Spotlight-safe, opaque names) AND safe to edge-cache — the player fetches the content
-// key from the gated key route and decrypts client-side (fast). The plaintext source is staged
-// only in the work dir and never persisted; only the encrypted segments + playlists are stored.
-// The content key is returned WRAPPED under the caller's set key (server-held or password-derived).
-const KEY_URI = 'enc.key'; // relative in the playlist → the gated key route serves it per-video
-async function uploadTree(store, dir, owner, id) {
-    const walk = async (rel) => {
-        const entries = await readdir(path.join(dir, rel), { withFileTypes: true });
-        for (const e of entries) {
-            const childRel = rel ? path.join(rel, e.name) : e.name;
-            if (e.isDirectory()) {
-                await walk(childRel);
-            }
-            else {
-                const mime = e.name.endsWith('.m3u8') ? 'application/vnd.apple.mpegurl' : 'video/mp2t';
-                const file = Bun.file(path.join(dir, childRel));
-                await store.putStream(privateHlsFileKey(owner, id, childRel), file.stream(), mime, {
-                    contentLength: file.size,
-                });
-            }
-        }
-    };
-    await walk('');
-}
-export async function processPrivateVideo(opts) {
-    const { store, workDir, owner, id, sourcePath, setKey, onProgress } = opts;
-    const report = (s, p) => onProgress?.(s, p);
-    const failed = {
-        status: 'failed',
-        durationSeconds: 0,
-        hasHls: false,
-        wrappedContentKey: null,
-    };
-    // Private media MUST be encrypted — unlike public it can't degrade to a plaintext fallback.
-    if (!(await isFfmpegAvailable()))
-        return failed;
-    const jobDir = path.join(workDir, owner, id);
-    await mkdir(jobDir, { recursive: true });
-    try {
-        report('processing', 1);
-        const probe = await probeVideoStream(sourcePath);
-        // Mint the AES-128 content key + write the ffmpeg key-info file (key URI / key file / IV).
-        const content = generateContentKey();
-        const keyFile = path.join(jobDir, 'enc.key.bin');
-        await writeFile(keyFile, content.key);
-        const keyInfoFile = path.join(jobDir, 'enc.keyinfo');
-        await writeFile(keyInfoFile, `${KEY_URI}\n${keyFile}\n${content.iv.toString('hex')}\n`);
-        const heights = resolveLadder(opts.ladderHeights ?? [480, 720, 1080], probe.height);
-        const hlsDir = path.join(jobDir, 'hls');
-        await mkdir(hlsDir, { recursive: true });
-        const ok = await runFfmpegProgress(hlsLadderArgs(sourcePath, hlsDir, {
-            heights,
-            crf: Number(LIBRARY_CRF),
-            hasAudio: probe.hasAudio,
-            keyInfoFile,
-        }), probe.duration, (pct) => report('processing', Math.max(1, Math.min(98, pct))));
-        if (!ok)
-            return failed;
-        // Upload ONLY the encrypted segments + playlists — never the key file (served via the route).
-        await uploadTree(store, hlsDir, owner, id);
-        report('ready', 100);
-        return {
-            status: 'ready',
-            durationSeconds: probe.duration,
-            hasHls: (await store.stat(privateHlsMasterKey(owner, id))) !== null,
-            wrappedContentKey: wrapContentKey(setKey, content),
-        };
-    }
-    catch {
-        report('failed', 0);
-        return failed;
-    }
-    finally {
-        // Wipe the job dir — the plaintext source, the raw key file, and the outputs all vanish.
-        await rm(jobDir, { recursive: true, force: true }).catch(() => { });
-    }
-}
-export async function processPrivateBlob(opts) {
-    try {
-        const file = Bun.file(opts.sourcePath);
-        const sizeBytes = file.size; // CTR is length-preserving, so plaintext size == stored size
-        const content = generateContentKey();
-        await opts.store.putStream(privateSourceKey(opts.owner, opts.id), cryptBlobStream(content, file.stream()), 'application/octet-stream', { contentLength: sizeBytes });
-        return { status: 'ready', sizeBytes, wrappedContentKey: wrapContentKey(opts.setKey, content) };
-    }
-    catch {
-        return { status: 'failed', sizeBytes: 0, wrappedContentKey: null };
-    }
-}

package/dist/server/private-media/unlock.d.ts

@@ -1,52 +0,0 @@
-import { type KeyMode } from './crypto';
-export type UnlockGrant = {
-    userId: string;
-    setKey: Buffer;
-    mode: KeyMode;
-};
-/**
- * What a supplied password MEANS at the unlock/reveal/private-upload surfaces:
- *   • derive (default) — the password derives the set key (deniable sets; the
- *     historical behavior).
- *   • gate — the password is an ACCESS CHECK against the app's own accounts
- *     (verifyPassword, e.g. the login store's argon2id verify) and the set key
- *     stays the recoverable server-derived one. Password changes never orphan
- *     content, and a password is REQUIRED to unlock (no silent session unlock).
- */
-export type UnlockPasswordPolicy = {
-    mode: 'derive';
-} | {
-    mode: 'gate';
-    verifyPassword: (who: {
-        userId: string;
-        userSalt: string;
-    }, password: string) => Promise<boolean>;
-};
-export interface UnlockService {
-    /** Mint an unlock token. Pass `password` for a deniable set; omit for the standard server-key
-     * set (the caller must already have authenticated the user). */
-    unlock(args: {
-        userId: string;
-        userSalt: string;
-        password?: string;
-    }): Promise<{
-        token: string;
-        mode: KeyMode;
-    }>;
-    /** Verify a token and recover the sealed set key, or null if invalid/expired/tampered. */
-    verify(token: string): Promise<UnlockGrant | null>;
-    /** Derive a set key without minting a token (for the reveal endpoint's per-item trials). */
-    deriveSetKey(args: {
-        userId: string;
-        userSalt: string;
-        password?: string;
-    }): Buffer;
-}
-export declare function createUnlockService(opts: {
-    /** Derives the recoverable (standard) set key. */
-    serverSecret: string;
-    /** Signs the unlock JWT AND (domain-separated) seals the set key inside it. */
-    unlockSecret: string;
-    /** Token lifetime — long enough to survive a paused-and-resumed private video. Default 6h. */
-    ttlSeconds?: number;
-}): UnlockService;

package/dist/server/private-media/unlock.js

@@ -1,55 +0,0 @@
-import { decryptSecret, deriveKey, encryptSecret } from 'cwip/node';
-// 🔴 `../auth/jwt`, NOT `../auth` — same reason as `storage/streamToken.ts`, and this is the
-// SECOND edge of the pair: `cursedbelt-server/storage` reaches private-media, so the barrel
-// import here put `otplib` (via `auth/index` → `totp.ts`) back into the storage graph after
-// streamToken.ts had been fixed. Found by bundling the graph and reading the externals, not by
-// grep — a two-hop edge is invisible to the obvious search.
-import { signToken, verifyPurposeToken } from '../auth/jwt';
-import { derivePasswordSetKey, deriveServerSetKey } from './crypto';
-// ── Unlock service ──────────────────────────────────────────────────────────────
-// Turns a private-mode unlock into a short-lived token that CARRIES the set key so later
-// requests (the HLS content-key route, reveal) can unwrap without re-deriving. Two modes:
-//   • deniable  — password given → setKey = scrypt(password, userSalt); the server holds no
-//     copy, so the token is the ONLY way back to that set key until it expires.
-//   • standard  — no password → setKey = scrypt(serverSecret, userId); recoverable, session-gated.
-// The set key is SEALED inside the token (AES-GCM under a server seal key), so the client can't
-// read it out; only this server can. The JWT is signed via cursedbelt's one jose integration
-// under the existing 'pm-unlock' purpose, so it can't be replayed as an access token.
-const PURPOSE = 'pm-unlock';
-export function createUnlockService(opts) {
-    const ttl = opts.ttlSeconds ?? 6 * 60 * 60;
-    const sealKey = deriveKey(opts.unlockSecret, 'pm-unlock-seal');
-    const deriveSetKey = ({ userId, userSalt, password, }) => password
-        ? derivePasswordSetKey(password, userSalt)
-        : deriveServerSetKey(opts.serverSecret, userId);
-    return {
-        deriveSetKey,
-        async unlock(args) {
-            const mode = args.password ? 'deniable' : 'standard';
-            const setKey = deriveSetKey(args);
-            const token = await signToken({
-                userId: args.userId,
-                sessionId: 'pm',
-                roles: [],
-                purpose: PURPOSE,
-                sk: encryptSecret(setKey.toString('base64'), sealKey),
-                m: mode,
-            }, opts.unlockSecret, ttl);
-            return { token, mode };
-        },
-        async verify(token) {
-            try {
-                const p = await verifyPurposeToken(token, opts.unlockSecret, PURPOSE);
-                const sealed = p.sk;
-                const mode = p.m;
-                if (typeof sealed !== 'string' || (mode !== 'standard' && mode !== 'deniable'))
-                    return null;
-                const setKey = Buffer.from(decryptSecret(sealed, sealKey), 'base64');
-                return { userId: p.userId, setKey, mode };
-            }
-            catch {
-                return null;
-            }
-        },
-    };
-}

package/src/server/private-media/blobRoute.spec.ts

@@ -1,165 +0,0 @@
-import { afterAll, beforeAll, describe, expect, test } from 'bun:test';
-import { mkdtemp, rm, writeFile } from 'node:fs/promises';
-import { tmpdir } from 'node:os';
-import path from 'node:path';
-import { Hono } from 'hono';
-import { createDiskStore } from '../storage/diskStore';
-import type { MediaStore } from '../storage/types';
-import { generateUserSalt, sealMeta } from './crypto';
-import { createMemoryPrivateIndex } from './index-store';
-import { mountPrivateRoutes } from './mountPrivateRoutes';
-import { processPrivateBlob } from './pipeline';
-import { createUnlockService } from './unlock';
-
-// The gated blob route: a private NON-video file (photo/doc) is one AES-128-CTR ciphertext at
-// privateSourceKey; the route decrypts under the unlock token's set key and serves plaintext
-// with the sealed descriptor's mime. A token whose set key doesn't own the item gets 403.
-
-const unlock = createUnlockService({ serverSecret: 'srv', unlockSecret: 'unlock' });
-const salt = generateUserSalt();
-const PLAINTEXT = 'plain photo bytes ✻ not for strangers';
-
-describe('private blob route', () => {
-  let root: string;
-  let store: MediaStore;
-  const index = createMemoryPrivateIndex();
-  const app = new Hono();
-
-  beforeAll(async () => {
-    root = await mkdtemp(path.join(tmpdir(), 'pm-blob-'));
-    store = createDiskStore(path.join(root, 'store'));
-    mountPrivateRoutes(app, {
-      store,
-      index,
-      unlock,
-      authorize: async () => ({ userId: 'u1', userSalt: salt }),
-    });
-
-    // Encrypt a staged plaintext under the 'alpha' set and index it, mirroring ingestPrivate.
-    const src = path.join(root, 'src.bin');
-    await writeFile(src, PLAINTEXT);
-    const setKey = unlock.deriveSetKey({ userId: 'u1', userSalt: salt, password: 'alpha' });
-    const res = await processPrivateBlob({ store, owner: 'u1', id: 'b1', sourcePath: src, setKey });
-    expect(res.status).toBe('ready');
-    await index.add({
-      id: 'b1',
-      owner: 'u1',
-      sizeBytes: res.sizeBytes,
-      createdAt: 1,
-      status: 'ready',
-      keyMode: 'deniable',
-      wrappedContentKey: res.wrappedContentKey ?? '',
-      sealedMeta: sealMeta(setKey, { name: 'secret.jpg', mime: 'image/jpeg', tags: [] }),
-    });
-  });
-  afterAll(async () => {
-    await rm(root, { recursive: true, force: true });
-  });
-
-  const tokenFor = async (password: string) =>
-    (await unlock.unlock({ userId: 'u1', userSalt: salt, password })).token;
-
-  test('serves decrypted plaintext with the sealed mime to the owning set', async () => {
-    const res = await app.request(`/_private/u/${await tokenFor('alpha')}/file/b1`);
-    expect(res.status).toBe(200);
-    expect(res.headers.get('content-type')).toBe('image/jpeg');
-    expect(res.headers.get('cache-control')).toBe('no-store');
-    expect(await res.text()).toBe(PLAINTEXT);
-  });
-
-  test("a valid token from the WRONG set can't open it (403, zero bytes)", async () => {
-    const res = await app.request(`/_private/u/${await tokenFor('bravo')}/file/b1`);
-    expect(res.status).toBe(403);
-  });
-
-  test('garbage token → 401; unknown id → 404', async () => {
-    expect((await app.request('/_private/u/not-a-token/file/b1')).status).toBe(401);
-    const res = await app.request(`/_private/u/${await tokenFor('alpha')}/file/nope`);
-    expect(res.status).toBe(404);
-  });
-});
-
-// ── Range/CTR-seek (genapp-100) ──────────────────────────────────────────────
-// A big private VIDEO on a remote-store host has no HLS derivatives — this
-// route is its only byte path, so Range is what makes it scrub. CTR decrypts
-// from the block-aligned offset with the IV counter advanced; these pin the
-// exact-slice contract at aligned, unaligned, suffix, and unsatisfiable ranges.
-describe('private blob route — Range (CTR seek)', () => {
-  let root: string;
-  let store: MediaStore;
-  const index = createMemoryPrivateIndex();
-  const app = new Hono();
-  // >3 CTR blocks with an unaligned tail, so mid-block seeks are meaningful.
-  const BYTES = Buffer.from(Array.from({ length: 1000 }, (_, i) => i % 251));
-
-  beforeAll(async () => {
-    root = await mkdtemp(path.join(tmpdir(), 'pm-blob-range-'));
-    store = createDiskStore(path.join(root, 'store'));
-    mountPrivateRoutes(app, {
-      store,
-      index,
-      unlock,
-      authorize: async () => ({ userId: 'u1', userSalt: salt }),
-    });
-    const src = path.join(root, 'clip.bin');
-    await writeFile(src, BYTES);
-    const setKey = unlock.deriveSetKey({ userId: 'u1', userSalt: salt, password: 'alpha' });
-    const res = await processPrivateBlob({ store, owner: 'u1', id: 'v1', sourcePath: src, setKey });
-    expect(res.status).toBe('ready');
-    await index.add({
-      id: 'v1',
-      owner: 'u1',
-      sizeBytes: res.sizeBytes,
-      createdAt: 1,
-      status: 'ready',
-      keyMode: 'deniable',
-      wrappedContentKey: res.wrappedContentKey ?? '',
-      sealedMeta: sealMeta(setKey, { name: 'clip.mp4', mime: 'video/mp4', tags: [] }),
-    });
-  });
-  afterAll(async () => {
-    await rm(root, { recursive: true, force: true });
-  });
-
-  const token = async () => (await unlock.unlock({ userId: 'u1', userSalt: salt, password: 'alpha' })).token;
-  const get = async (range?: string) =>
-    app.request(`/_private/u/${await token()}/file/v1`, range ? { headers: { range } } : undefined);
-
-  test('a full read advertises Accept-Ranges and still decrypts whole', async () => {
-    const res = await get();
-    expect(res.status).toBe(200);
-    expect(res.headers.get('accept-ranges')).toBe('bytes');
-    expect(Buffer.from(await res.arrayBuffer()).equals(BYTES)).toBe(true);
-  });
-
-  test('a block-aligned range decrypts the exact slice as 206', async () => {
-    const res = await get('bytes=160-479');
-    expect(res.status).toBe(206);
-    expect(res.headers.get('content-range')).toBe('bytes 160-479/1000');
-    expect(res.headers.get('content-length')).toBe('320');
-    expect(Buffer.from(await res.arrayBuffer()).equals(BYTES.subarray(160, 480))).toBe(true);
-  });
-
-  test('an UNALIGNED mid-block range decrypts the exact slice (the CTR counter + lead-in drop)', async () => {
-    const res = await get('bytes=7-300');
-    expect(res.status).toBe(206);
-    expect(res.headers.get('content-range')).toBe('bytes 7-300/1000');
-    expect(Buffer.from(await res.arrayBuffer()).equals(BYTES.subarray(7, 301))).toBe(true);
-  });
-
-  test('an open-ended range runs to the last byte; a suffix range serves the tail', async () => {
-    const open = await get('bytes=990-');
-    expect(open.status).toBe(206);
-    expect(Buffer.from(await open.arrayBuffer()).equals(BYTES.subarray(990))).toBe(true);
-    const suffix = await get('bytes=-25');
-    expect(suffix.status).toBe(206);
-    expect(suffix.headers.get('content-range')).toBe('bytes 975-999/1000');
-    expect(Buffer.from(await suffix.arrayBuffer()).equals(BYTES.subarray(975))).toBe(true);
-  });
-
-  test('an out-of-bounds range answers 416 with the total', async () => {
-    const res = await get('bytes=1000-1200');
-    expect(res.status).toBe(416);
-    expect(res.headers.get('content-range')).toBe('bytes */1000');
-  });
-});

package/src/server/private-media/crypto.spec.ts

@@ -1,81 +0,0 @@
-import { describe, expect, test } from 'bun:test';
-import {
-  derivePasswordSetKey,
-  deriveServerSetKey,
-  generateContentKey,
-  generateUserSalt,
-  openMeta,
-  sealMeta,
-  unwrapContentKey,
-  wrapContentKey,
-} from './crypto';
-
-describe('private-media crypto core', () => {
-  const salt = generateUserSalt();
-
-  test('same password + salt → same key; different password → different key', () => {
-    const a = derivePasswordSetKey('hunter2', salt);
-    const a2 = derivePasswordSetKey('hunter2', salt);
-    const b = derivePasswordSetKey('other-pass', salt);
-    expect(a.equals(a2)).toBe(true);
-    expect(a.equals(b)).toBe(false);
-    expect(a.length).toBe(32);
-  });
-
-  test('the same password under different user salts yields different keys', () => {
-    const s2 = generateUserSalt();
-    expect(derivePasswordSetKey('pw', salt).equals(derivePasswordSetKey('pw', s2))).toBe(false);
-  });
-
-  test('server key is recoverable and distinct from any password key', () => {
-    const srv = deriveServerSetKey('server-secret', 'user-1');
-    expect(srv.equals(deriveServerSetKey('server-secret', 'user-1'))).toBe(true);
-    expect(srv.equals(deriveServerSetKey('server-secret', 'user-2'))).toBe(false);
-    expect(srv.equals(derivePasswordSetKey('server-secret', salt))).toBe(false);
-  });
-
-  test('sealMeta/openMeta round-trips; a wrong key returns null (the membership test)', () => {
-    const key = derivePasswordSetKey('pw-A', salt);
-    const wrong = derivePasswordSetKey('pw-B', salt);
-    const sealed = sealMeta(key, { title: 'Secret Clip', notes: 'private', tags: ['x'] });
-    expect(openMeta<{ title: string }>(key, sealed)?.title).toBe('Secret Clip');
-    expect(openMeta(wrong, sealed)).toBeNull(); // wrong password ⇒ not a member, no info leak
-  });
-
-  test('content key wrap/unwrap round-trips; wrong key ⇒ null', () => {
-    const key = derivePasswordSetKey('pw', salt);
-    const wrong = deriveServerSetKey('srv', 'u');
-    const content = generateContentKey();
-    expect(content.key.length).toBe(16); // AES-128
-    expect(content.iv.length).toBe(16);
-    const wrapped = wrapContentKey(key, content);
-    const unwrapped = unwrapContentKey(key, wrapped);
-    expect(unwrapped?.key.equals(content.key)).toBe(true);
-    expect(unwrapped?.iv.equals(content.iv)).toBe(true);
-    expect(unwrapContentKey(wrong, wrapped)).toBeNull();
-  });
-
-  test('a tampered envelope decrypts to null, not garbage', () => {
-    const key = derivePasswordSetKey('pw', salt);
-    const sealed = sealMeta(key, { title: 't' });
-    expect(openMeta(key, `${sealed}x`)).toBeNull();
-  });
-});
-
-describe('incrementIv (genapp-100 CTR seek)', () => {
-  test('adds blocks big-endian with byte carry', async () => {
-    const { incrementIv } = await import('./crypto');
-    const iv = Buffer.alloc(16);
-    iv[15] = 0xff;
-    const plus1 = incrementIv(iv, 1);
-    expect(plus1[15]).toBe(0x00);
-    expect(plus1[14]).toBe(0x01);
-    // A large jump carries across multiple bytes: 0x01_0000 blocks.
-    const jump = incrementIv(Buffer.alloc(16), 0x010000);
-    expect(jump[13]).toBe(0x01);
-    expect(jump[14]).toBe(0x00);
-    expect(jump[15]).toBe(0x00);
-    // The input IV is never mutated.
-    expect(iv[15]).toBe(0xff);
-  });
-});

package/src/server/private-media/crypto.ts

@@ -1,155 +0,0 @@
-import { createCipheriv, randomBytes } from 'node:crypto';
-import { decryptSecret, deriveKey, encryptSecret } from 'cwip/node';
-
-// ── private-media crypto core ───────────────────────────────────────────────────
-// The reusable heart of encrypted private media. Pure composition of cwip's `secretBox`
-// (scrypt `deriveKey` + AES-256-GCM `encryptSecret`/`decryptSecret`) — whose own docs describe
-// exactly our two key modes: derive from a SERVER SECRET (recoverable "standard") vs from the
-// USER'S PASSWORD (zero-knowledge "deniable"). We use scrypt (slow, brute-force-resistant) for
-// the password KDF — NOT cursedbelt's vault HKDF, which is fast and password-unsafe.
-//
-// Streaming stays fast because the bytes are AES-128 HLS segments the player decrypts (edge-
-// cacheable); this module only mints/wraps the small 16-byte content key + seals metadata.
-
-export type KeyMode = 'standard' | 'deniable';
-
-/** A random per-user salt (non-secret, stored plaintext, stable once created). Domain-separates
- * a user's password-derived keys so the same password yields different keys across users. */
-export const generateUserSalt = (): string => randomBytes(16).toString('base64url');
-
-/** Zero-knowledge set key: scrypt(password, per-user salt). The server never stores this (or a
- * hash of it); it exists only transiently after an unlock. Different passwords → disjoint sets. */
-export const derivePasswordSetKey = (password: string, userSalt: string): Buffer =>
-  deriveKey(password, `pmedia:${userSalt}`);
-
-/** Recoverable set key: scrypt(serverSecret, userId). The server can always derive it, so
- * `standard`-mode media is decryptable once private is unlocked (session-gated) — protects a
- * stolen disk / Finder / backups, but a compromised running server can decrypt. */
-export const deriveServerSetKey = (serverSecret: string, userId: string): Buffer =>
-  deriveKey(serverSecret, `pmedia-srv:${userId}`);
-
-// ── Sealed metadata envelope (title / thumbnail key / notes / tags) ──────────────
-// Encrypted under the set key; NEVER stored in the plaintext index. A successful decrypt is
-// also the deniable MEMBERSHIP TEST — trying a password reveals only the items it opens.
-
-export const sealMeta = (setKey: Buffer, meta: unknown): string =>
-  encryptSecret(JSON.stringify(meta), setKey);
-
-/** Open a sealed envelope, or null if this key doesn't own it (wrong password / mode key).
- * The null return IS the membership signal — no stored set identifier is needed. */
-export function openMeta<T = unknown>(setKey: Buffer, sealed: string): T | null {
-  try {
-    return JSON.parse(decryptSecret(sealed, setKey)) as T;
-  } catch {
-    return null;
-  }
-}
-
-// ── AES-128 HLS content key: minted per item, WRAPPED under the set key ───────────
-// The raw 16-byte key + 16-byte IV drive ffmpeg's `-hls_key_info_file` (AES-128 segments). Only
-// the wrapped form is stored; the key route unwraps it (with the unlock-provided set key) and
-// returns the raw key to hls.js, which decrypts segments client-side.
-
-export type ContentKey = { key: Buffer; iv: Buffer };
-
-export const generateContentKey = (): ContentKey => ({
-  key: randomBytes(16), // AES-128
-  iv: randomBytes(16),
-});
-
-export const wrapContentKey = (setKey: Buffer, content: ContentKey): string =>
-  encryptSecret(`${content.key.toString('base64')}.${content.iv.toString('base64')}`, setKey);
-
-/** Unwrap a content key, or null if the set key can't open it (wrong password / mode key). */
-export function unwrapContentKey(setKey: Buffer, wrapped: string): ContentKey | null {
-  try {
-    const [k, iv] = decryptSecret(wrapped, setKey).split('.');
-    if (!k || !iv) return null;
-    return { key: Buffer.from(k, 'base64'), iv: Buffer.from(iv, 'base64') };
-  } catch {
-    return null;
-  }
-}
-
-// ── Whole-file blob cipher (non-video private files: photos, docs) ────────────────
-// AES-128-CTR under the item's content key — the same key/IV material the HLS path wraps, so
-// wrap/unwrap is shared. CTR is length-preserving and streaming (no padding, no buffering), and
-// encrypt/decrypt are the same operation. Tamper-evidence comes from the GCM-sealed descriptor +
-// the gated serve route (parity with the encrypted-HLS segments, which are CBC-without-MAC too).
-
-/** Pipe a byte stream through the item's AES-128-CTR keystream. Symmetric: pass ciphertext to
- * decrypt, plaintext to encrypt. */
-/** Big-endian increment of a 16-byte CTR IV by `blocks` — the counter arithmetic that lets a
- * decryptor start mid-stream (genapp-100: Range/seek on private blobs). */
-export function incrementIv(iv: Buffer, blocks: number): Buffer {
-  const out = Buffer.from(iv);
-  let carry = BigInt(blocks);
-  for (let i = out.length - 1; i >= 0 && carry > 0n; i--) {
-    const sum = BigInt(out[i]) + (carry & 0xffn);
-    out[i] = Number(sum & 0xffn);
-    carry = (carry >> 8n) + (sum >> 8n);
-  }
-  return out;
-}
-
-/**
- * Decrypt a CTR ciphertext stream that starts at the BLOCK-ALIGNED offset covering plaintext
- * byte `startOffset`, dropping the intra-block lead-in — the seek half of {@link cryptBlobStream}.
- * CTR is length-preserving and positionally keyed, so byte N of plaintext only needs ciphertext
- * from block ⌊N/16⌋ onward with the IV counter advanced by that many blocks (genapp-100: this is
- * what makes big private videos scrub on a remote-store host with no local derivatives).
- */
-export function cryptBlobRangeStream(
-  content: ContentKey,
-  stream: ReadableStream<Uint8Array>,
-  startOffset: number,
-): ReadableStream<Uint8Array> {
-  const BLOCK = 16;
-  const blocks = Math.floor(startOffset / BLOCK);
-  let drop = startOffset % BLOCK;
-  const cipher = createCipheriv('aes-128-ctr', content.key, incrementIv(content.iv, blocks));
-  return stream.pipeThrough(
-    new TransformStream<Uint8Array, Uint8Array>({
-      transform(chunk, controller) {
-        let out = cipher.update(chunk);
-        if (drop > 0) {
-          const skip = Math.min(drop, out.byteLength);
-          out = out.subarray(skip);
-          drop -= skip;
-        }
-        if (out.byteLength > 0) {
-          controller.enqueue(new Uint8Array(out.buffer, out.byteOffset, out.byteLength));
-        }
-      },
-      flush(controller) {
-        const out = cipher.final(); // empty for CTR — kept for cipher-contract completeness
-        if (out.byteLength > 0) {
-          controller.enqueue(new Uint8Array(out.buffer, out.byteOffset, out.byteLength));
-        }
-      },
-    }),
-  );
-}
-
-export function cryptBlobStream(
-  content: ContentKey,
-  stream: ReadableStream<Uint8Array>,
-): ReadableStream<Uint8Array> {
-  const cipher = createCipheriv('aes-128-ctr', content.key, content.iv);
-  return stream.pipeThrough(
-    new TransformStream<Uint8Array, Uint8Array>({
-      transform(chunk, controller) {
-        const out = cipher.update(chunk);
-        if (out.byteLength > 0) {
-          controller.enqueue(new Uint8Array(out.buffer, out.byteOffset, out.byteLength));
-        }
-      },
-      flush(controller) {
-        const out = cipher.final(); // empty for CTR — kept for cipher-contract completeness
-        if (out.byteLength > 0) {
-          controller.enqueue(new Uint8Array(out.buffer, out.byteOffset, out.byteLength));
-        }
-      },
-    }),
-  );
-}